Decentralized multi-authority attribute-based encryption with fully adaptive security

Abstract

The present invention relates to a system, method, network device, and machine-readable medium for encrypting and decrypting messages in a distributed multi-authority attribute-based encryption (MA-ABE) scheme that is provably fully adaptively secure, specifically against an attacker who can corrupt some of the authorities and perform key queries adaptively throughout the life of the system.

Description

[Technical Field]

[0001] [Cross-reference of related applications] This application claims priority to U.S. Provisional Patent Application No. 63 / 179,862, filed on 26 April 2021, which is incorporated herein by reference in its entirety.

[0002] [Technical field] This disclosure relates to a multi-authority attribute-based cryptographic scheme that is provable, fully adaptively secure, specifically secure against an attacker who could potentially compromise some of the authorities, and that adaptively performs key queries throughout the entire lifecycle of the system. [Background technology]

[0003] Attribute-based encryption (ABE) schemes enable fine-grained access control when accessing encrypted data. Such encryption schemes support decryption keys, allowing users with specific certificates (or attributes) to decrypt specific messages without disclosing any additional information. The challenge of designing ABE schemes has received considerable attention over the years, resulting in a long series of studies to navigate the various trade-offs between expressiveness, efficiency, security, and underlying assumptions.

[0004] Attribute-based cryptography is a generalization of traditional public-key cryptography that provides fine-grained access control to encrypted data based on the recipient's certificate (or attributes). ABEs have two avatars: ciphertext policy and key policy. In a ciphertext-policy ABE (CP-ABE), as the name suggests, the ciphertext is associated with the access policy and the key is associated with the attributes. In a key-policy ABE (KP-ABE), the roles of the access policy and attribute set are reversed; that is, the ciphertext is associated with the attributes and the key is associated with the access policy. In both cases, decryption is only possible if the attributes satisfy the access policy. Furthermore, given any ciphertext created with respect to an access policy, it is necessary that a group of colluding users who do not individually possess the secret keys corresponding to the attribute sets that satisfy the access policy cannot decrypt the encrypted message. This property is known as collusion resistance.

[0005] Since its inception by Goyal, Pandey, Sahai, and Waters, ABEs have become a fundamental cryptographic primitive with a long list of potential applications. Therefore, the task of designing ABE schemes has attracted considerable attention from the cryptographic community, resulting in a lengthy sequence of work to navigate various trade-offs between expressiveness, efficiency, security, and underlying assumptions.

[0006] Multi-authority ABE The standard ABE scheme has one major limitation: Under the ABE scheme, each user must prove they possess a specific set of attributes in order to go to a single master authority and receive the private key corresponding to each of those attributes. This implies that there must be one trusted authority overseeing all attributes, e.g., driver's license, voter registration, and college admission. However, in practice, different entities exist responsible for issuing and maintaining different attributes; for example, the DMV is the authority over driver's licenses, and similarly, the election commission and college offices are responsible for the other two attributes, respectively. Therefore, it is desirable to be able to delegate each attribute to a different (and perhaps not fully trusted) authority.

[0007] In multi-authority attribute-based encryption (ABE) schemes, restricted decryption keys can only be generated and issued by a central authority that possesses the master private key. Chase introduces the concept of multi-authority ABE (MA-ABE), which allows multiple parties to act as authorities. More precisely, in MA-ABE, there are multiple authorities controlling different attributes, each of which can issue private keys to users who possess those attributes under its control, without any interaction with other authorities in the system. Given ciphertext generated with respect to some access policy, a user who possesses a set of attributes that satisfy the access policy can decrypt the ciphertext by retrieving the individual private keys obtained from the various authorities controlling those attributes.

[0008] To address the above issues, the concept of a multi-authority ABE (MA-ABE) scheme has been introduced. In MA-ABE, there are multiple authorities controlling different attributes, each of which can issue a private key to a user who owns an attribute under its control, without any interaction with other authorities in the system. Given a ciphertext generated regarding some access policy, a user who owns a set of attributes that satisfy the access policy can decrypt the ciphertext by retrieving the individual private keys obtained from the various authorities controlling those attributes. As described above, security requires preventing collusion against users without authority, but the key difference is that some attribute authorities may be corrupted and therefore capable of colluding with adversarial users.

[0009] After a few initial attempts with various limitations, Lewko and Waters have been able to design the first truly decentralized MA-ABE scheme, in which any party can become an authority and no global coordination is required other than creating an initial trusted configuration. In their scheme, a party can act as an authority simply by issuing their own public key and a private key that reflects the user's attributes to a different user. Different authorities can join the system at any time without even needing to know each other. Furthermore, there is no limit to the number of attribute authorities that can be involved during the system's lifetime. These schemes are NC 1 It supports all access policies computable by the circuit. Furthermore, using powerful dual-system techniques, security is proven by assuming a composite-order bilinear group in a random oracle model, using a "subgroup decision" type assumption.

[0010] Following Lewko and Waters, several extensions and improvements exist. Okamoto and Takashima provide a construction for prime-order bilinear groups that depends on the decision-linear (DLIN) assumption. Rouselakis and Waters, and Ambrona and Gay offer efficiency improvements, but use lower-than-standard q-type assumptions and generic group models, respectively. Datta et al. provide the first Learning With Errors (LWE) based construction to support non-trivial classes of access policies. All of the above are random oracle models.

[0011] Security: The natural definition of MA-ABE security requires normal resistance to collusion against users without authority, but the key difference here is that some attribute authorities can be corrupted and therefore can collude with adversarial users. While some configurations support adaptive key queries, no known configuration supports fully adaptive corruption of authorities under any assumptions. Assuming the decentralized nature of MA-ABE, it seems unsatisfactory to assume that an attacker commits to a set of corrupted authorities at the start of the security game, even before seeing any of the secret keys. In reality, one doesn't even expect all attribute authorities to participate in the system simultaneously. Therefore, the "static corruption" model considered in previous studies does not capture realistic attack scenarios, and it is desirable to improve upon it by supporting adaptive corruption of authorities.

[0012] Achieving fully adaptive security is a gap in existing configurations. This is one of the rare cases where generic complexity leveraging / guessing style arguments fail (even when accepting a sub-exponential security loss). In fact, applying these arguments to the inventors' configuration results in an exponential loss proportional to the maximum number of authorities per ciphertext. Therefore, there must be a predetermined maximum number of authorities per ciphertext limit, in which case the security parameters must be appropriately selected. Furthermore, it is desirable to have a truly decentralized scheme in which any party can join as an authority at any time, and there is no limit to the number of authorities. Decentralized Multi-Authority Attribute-Based Encryption (MA-ABE) is a decentralized generalization of standard (ciphertext policy) attribute-based encryption in which there is no trusted central authority, any party can become an authority and issue private keys, and no global adjustments other than creating an initial set of common reference parameters are required.

[0013] Arguments that leverage standard complexity do not work in multi-authority settings. Therefore, a configuration that can withstand adaptive corruption of authority is required, regardless of the assumptions used. [Overview of the Initiative]

[0014] Some embodiments of the present invention provide a system, method, network device and machine-readable medium for encrypting messages according to a multi-authority attribute-based encryption scheme. The system is m for encryption i The steps include receiving an electronic message m containing bits, The steps include storing an electronic message in a computerized storage medium, Run the global configuration algorithm, Create group G, Sample g and h as two generators of G, Sample a seed for the seed extractor Thereby generating global parameters, and Execute the authority setting algorithm, Two exponents y A and y b Sample, Set the public key as {g {yA} , g {yb}}, Set the private key as {y A and y b}, Thereby generating a public and private key pair, and s, r A , r B Sample, C {1,A} = g {rA} C {1,B} = g {r_B} C {2,A} = g {yA*rA} g {s} C {2,B} = g {yB*rA} g {-s} C = m xor Ext(e(g, h), seed) Calculate, Store (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) on a computer storage medium Thereby executing an encryption algorithm for the message m and the access policy M, and (H(GID) * h) {yA} and (H(GID)) {yB} Outputting to execute a key generation algorithm, where H is a global cryptographic hash function that maps to a group, steps including a processor configured to perform. In some further embodiments, any party can join as an authority at any time, and there is no limit to the number of authorities. In some further embodiments, the method is fully adaptively secure. In some further embodiments, the method is provably fully adaptively secure to the extent that it is secure against an attacker who can corrupt some of the authorities and adaptively perform key queries throughout the entire lifespan of the system. In some further embodiments, an adversary does not possess sufficient private keys or authority master keys to decrypt encrypted messages with respect to the access structure. In some embodiments, the computerized processor is The steps include storing a message encrypted according to an attribute-based encryption scheme in a computerized storage medium, (K {GID,A} ,K {GID,B} ) containing the components generated as a key and ciphertext (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) received, D A =e(C {2,A} ,H(GID)*h) / e(C {1,A},K {GID,A} ) calculate, D B =e(C {2,B} ,H(GID)) / e(C {1,B} ,K {GID,B} ) calculate, C xor Ext(D A *D B Outputs seed) This completes the steps of executing the decryption algorithm and This further configures the system to decrypt the message. [Brief explanation of the drawing]

[0015] The accompanying drawings, included and incorporated herein, and constituting a portion thereof, serve to illustrate embodiments of the present disclosure and, together with the detailed description, illustrate the principles of the embodiments of the present disclosure. [Figure 1] This document presents an example of a system architecture for a decentralized, multi-authority, attribute-based encryption scheme. [Figure 2] An example sequence diagram of a decentralized multi-authority attribute-based encryption scheme is shown. [Figure 3] An example of a computer system architecture for implementing the system and method of the present invention is shown. [Figure 4] Further details of an example computer system architecture for implementing the system and method of the present invention are provided. [Modes for carrying out the invention]

[0016] The inventors construct the first truly decentralized MA-ABE scheme that is provably secure even when fully adaptive corruption of authority is permissible, in addition to fully adaptive key queries. The scheme of the present invention is based on a bilinear group using the assumption of standard polynomial hardness (difficulty) in a random oracle model. The inventors emphasize that the configuration of the present invention is the first provably secure scheme against fully adaptive corruption of authority under any assumptions.

[0017] First, we provide a construction based on bilinear groups of composite order, using (so far) standard subgroup determination assumptions; and second, we provide a construction for bilinear groups of prime order to which k-linear (k-Lin) or, more generally, matrix Diffie-Hellman (MDDH) applies.

[0018] Theorem (informal): Assume a composite-order bilinear group for which the "standard" subgroup determination assumptions apply. In this case, a fully adaptive MA-ABE scheme exists in the random oracle model.

[0019] The assumptions used by the present invention in the above theorem have been used multiple times in the past and have been shown to be applicable to general bilinear group models. However, it should be noted that composite order-based constructions have several drawbacks compared to more standard prime order settings. First, in prime order groups, security can be obtained under more standard assumptions such as the k-LIN or bilinear Diffie-Hellman (BDH) assumption. Second, in prime order groups, a much more efficient system can be achieved for the same level of security. This is because, in composite order groups, security typically depends on the difficulty of factorizing the order of the group. Second, this requires the use of larger group orders, resulting in considerably slower group and pairing operations.

[0020] For this purpose, starting with Freeman and Lewko, several frameworks and tools have been developed to convert existing composite-order group constructions to similar ones for prime-order groups. The inventors, using a recent set of tools by Chen, Gong, Kowalczyk, and Wee, have succeeded in obtaining constructions in the (asymmetric) bilinear group of prime-order groups that are more secure under the more standard k-Lin or MDDH assumptions. The constructions of the present invention are secure based on any choice of k. For example, setting k=1 gives security under the Symmetric External Diffie-Hellman Assumption (SXDH), while setting k=2 corresponds to security under the DLIN assumption.

[0021] Theorem (informal): Assume a bilinear group of prime order that satisfies the k-Lin or MDDH assumption. In that case, there exists a fully adaptive MA-ABE scheme in the random oracle model.

[0022] Technical overview The MA-ABE of this invention (like other known MA-ABE schemes) allows each user within the system to identify a global identifier

number

number

[0023] Here, NC 1 Recalling the syntax of a distributed MA-ABE for access policies, it is well known that this can be implemented using a (monotonic) linear secret sharing scheme (LSSS). The distributed MA-ABE scheme consists of five steps: GlobalSetup, AuthSetup, KeyGen, Enc, and Dec. The GlobalSetup step takes security parameters as input (in unary coding) and outputs global public parameters. All other steps depend on these global parameters (they may not be explicitly mentioned if they are clear from the context). The AuthSetup step takes the corresponding public key and master private key pair (PK). u MSK u To generate any authority

number

number

number

number

[0024] Fully adaptive security Like standard ABEs, the security of the MA-ABE scheme requires collusion resistance, meaning that a group of colluding users not individually authorized to decrypt the ciphertext should not be able to decrypt it when they collectively extract components of their private key. However, in the case of MA-ABE, collusion resistance must be maintained even if some attribute authorities collude with adversarial users, thereby allowing these users to freely obtain the private keys corresponding to attributes controlled by the corrupted authority. Decentralized MA-ABE allows for the continued requirement of collusion resistance even if the public and private keys of a corrupted authority are generated in a malicious manner. This is important because the decentralized MA-ABE scheme allows anyone to function as an attribute authority by generating public and private keys locally and independently from everyone else in the system. The inventors aim for fully adaptive security, broadly defined by the following game:

[0025] Global Settings: The challenger runs GlobalSetup to generate globally exposed parameters.

[0026] Query Stage I: The attacker is allowed to adaptively perform queries involving a number of polynomials of the following form: (a) Authority setting query: The challenger runs AuthSetup to create a public / master key pair for the authority specified by the adversary. (b) Secret key query: The challenger runs KeyGen to create a secret key for a given attribute. (c) Authority Master Key Query: The challenger provides the attacker with a master secret key that corresponds to some authority of the adversary's choice.

[0027] Challenge Phase: The adversary submits two messages, msg0 and msg1, along with the access structure and the set of authority public keys contained within it. This allows the challenger to obtain an encrypted message (randomly selected) about the access structure from the adversary. It is crucial that the adversary does not possess sufficient private keys / authority master keys to decrypt the encrypted message about the access structure.

[0028] Query Phase 2: This is the same as Query Phase 1 (while ensuring that the constraints from the Challenge Phase are not violated).

[0029] Hypothesis: The attacker submits a hypothesis about which message forms the basis of the challenge ciphertext.

[0030] All previous MA-ABE schemes consider a much weaker definition, where the adversary must commit to a set of authorities and a subset of corrupted authorities within the system during the global setup phase. By that point, all private / public key pairs for all intact authorities have already been created by the challenger, and the public keys have been given to the attacker. (i.e., only form 2 queries (private key queries) are permitted between query phases I and II.) The fully adaptive definition of the present invention is far more realistic, given the decentralized nature of MA-ABE.

[0031] Previous research and the approach of this invention

[0032] Like any ABE scheme, the challenge in MA-ABE is to create a system of collusion. Typically, ABE schemes achieve resistance to collusion by using the authority of a system that recognizes the master private key to "bond" together different key components representing different attributes of the user, with the help of a new randomness specific to the user. Such randomization makes different key components of a user compatible with each other, but incompatible with key components issued to another user.

[0033] However, multi-authority configurations aim to simultaneously achieve the goals of autonomous key generation and resistance to collusion. The requirement of autonomous key generation means that standard techniques for key randomization cannot be applied because there is no single party compiling all the parts together. Furthermore, in a decentralized MA-ABE system, each component may come from a different authority, such authorities not coordinating and, in some cases, not even recognizing each other. To overcome this, conventional decentralized MA-ABE schemes use the output of a public hash function applied to the user's global identity (GID) as the randomness that links multiple key components issued to a particular user by different authorities.

[0034] To understand this challenge, we will focus on one specific configuration by Lewko and Waters. This is the first true decentralized MA-ABE scheme, but all related subsequent research relies heavily on it and therefore suffers similar problems. The security proof of the Lewko and Waters configuration uses the dual-system technique originally developed by Waters. In a dual-system, ciphertexts and keys can take two forms: ordinary or semi-functional. Semi-functional ciphertexts and keys are not used in actual systems; they are used only in security proofs. An ordinary key can decrypt an ordinary or semi-functional ciphertext, and an ordinary ciphertext can be decrypted by an ordinary key or a semi-functional key. However, when a semi-functional key is used to decrypt a semi-functional ciphertext, the decryption fails. The security of the dual-system is proven using a series of "indistinguishable" games. The first game is the actual security game (with ordinary ciphertexts and keys). In the next game, the ciphertexts are semi-functional, but all keys are ordinary. We define q games for an attacker who requests q private keys. In the kth game, the first k keys are semi-functional, while the remaining keys are normal. In game q, all keys and challenge ciphertexts given to the attacker are semi-functional. Therefore, none of the given keys are useful for decrypting the challenge ciphertext.

[0035] Lewko and Waters' proof follows this high-level approach, but essentially relies on the fact that corrupted authorities are pre-specified. Towards the end of the proof, all keys become semi-functional, and the challenge ciphertext also becomes semi-functional. The goal of the final hybrid is to move into a game where the semi-functional challenge ciphertext is a random message (rather than the original message). To make this indistinguishable, these need to "shut off" the rows in the matrix of access policies corresponding to the corrupted authorities. This is done by using information theory tools to select vectors orthogonal to the rows in the challenge ciphertext (such vectors should exist, since corrupted sets should not be allowed). In effect, this allows us to completely ignore the existence of the authority master keys corresponding to these rows, while for the other rows, the absence of private keys has already been dealt with when we move into a game where all keys are semi-functional.

[0036] This approach obviously fails if the authority can be adaptively corrupted. Firstly, the authority can be corrupted after the challenge ciphertext is created, and the challenger could give the adversary the corresponding master key, which may not even be known at the time the challenge ciphertext is created, so technically it is impossible to "block" the line corresponding to a corrupted authority. However, in Lewko and Waters' (proof) approach, this is impossible because the challenger does not even have a properly formed master key for the authority (at that point).

[0037] Overcoming barriers and (composite number order) schemes

[0038] To solve this problem, we must figure out how to integrate the corrupted authority into a dual-system cryptographic proof. This is difficult because, as with Lewko and Waters, the authority keys of the present invention consist simply of exponents spanning a composite number group N=p1p2p3. Since these authority keys are exponents and not group elements, there is no obvious way to migrate them to semi-functional status, as is typical with proofs modifying group-based secret keys.

[0039] The proof of this invention devises a novel method for utilizing such keys. The first step of the proof is to make the ciphertext semi-functional with respect to the p3 subgroup. This argument relies on two important facts: (1) Any subset of the authority compromised by the attacker does not satisfy the access structure. Therefore, the compromised authority alone is not sufficient to (information-theoretically) determine whether the challenge ciphertext is semi-functional. (2) A key given by an uncompromised authority does not have components of the order p3 subgroup and therefore does not help such an attacker (in this step). In summary, this provides a way to leverage information-theoretic steps to handle adaptive corruption of authority. The approach of this invention uses both computational and information-theoretic arguments to proceed between different hybrid experiments. A key feature is that any step that relies on an attacker's key that does not satisfy the access structure is an information-theoretic argument, and therefore avoids any problem that unfolds around inferring which authority is compromised. (Of course, there are multiple computational arguments between and in setting the information-theoretic arguments). Similar high-level approaches that use information about what adversaries corrupt only in information-theoretic arguments have been used in some previous dual-system proofs, but here it is possible to implement this technique in the context of (more difficult) distributed setups and corrupted authorities.

[0040] The approach of the present invention makes it possible to establish both a semi-functional key and a ciphertext in a given subspace of a cryptographic system. However, this comes with great caution. The semi-functional argument is established in the p3 subgroup, but it must be kept separate from the ciphertext component that blinds the message, which simply remains in the p1 subgroup. Thus, at this stage, it is unclear that all the work done by the inventors may even completely conceal the message. Therefore, the next part of the proof of the present invention requires "bleeding" the semi-functional part of the ciphertext to the part that blinds the message. To do this, it is necessary to establish two subsystem configurations, where the configuration of the present invention essentially looks like two copies of Lewko and Waters' multi-authority ABE scheme. Here, the present invention alternates between bleeding to one first and then to the other.

[0041] This novel technology is called a dual system with dual subsystems. This technology utilizes semi-functionality in one subsystem to introduce semi-functionality into the other subsystem. More specifically, the inventors introduce a special group element into the public parameters that originally reside within the p1 subgroup. The goal of the present invention is to ultimately have this group element persist in both the p1 and p2 subgroups, and to blind the message in its p1 and p2 segments. The challenge ciphertext and key are then cleverly transformed so that the p2 segment of this special group element remains information-theoretically hidden from adversaries, and its entropy can be amplified using a suitable randomness extractor to completely conceal the encrypted message.

[0042] The user secret key components of the two subsystems are set asymmetrically, that is, the special group elements in the user secret key component corresponding to the first subsystem are multiplied, while those in the user secret key component corresponding to the second subsystem are not multiplied. Next, the semi-functional portion of the p3 subgroup of the second subsystem is first bled into the p2 subgroup of the same, making it semi-functional. Then, this semi-functionality of the second subsystem is used to switch the special group elements from those embedded in the user secret key component of the first subsystem to those corresponding to the second subsystem. After this step is complete, the anti-functional portion of the p3 subgroup of the first subsystem is then bled into the p2 portion of the same. At this point, the p2 segment of the ciphertext component that blinds the message becomes completely independent of the p2 segments of all other ciphertext and key components, and thus its entropy can be used to blind the message information-theoretically.

[0043] We would like to emphasize that all applications of dual-system methodologies have so far dealt only with single systems, and the idea of ​​such two subsystems is entirely new to the research of this invention. Furthermore, the problem addressed in this study appears to go beyond the scope of standard single-system dual-system techniques, as it is not clear how to bleed a semi-functional component into the ciphertextual component that blinds the message and isolate the user key from its special group element within the single system. As is evident from the inventors' research into solving a long-standing unresolved problem, this novel technique is extremely powerful. The inventors envision finding further novel applications related to adaptive security problems that appear to go beyond the scope of existing variations of dual-system cryptographic methods, for example, constructing adaptively secure functional cryptographic schemes that go beyond linear functions under standard group-based assumptions.

[0044] composition:

[0045] The scheme of the present invention relates to a bilinear group of composite order N.

number

number

number

[0046] At a very high level, as is evident from the configuration, the encryption algorithm uses the message msg as term Ext(e(g1,h) s Blind by (seed). Here, s is

number

number

number

number

[0047] AuthSetup(GP,u): The algorithm is a random number.

number

number

[0048] Enc(GP,msg,(M,ρ),{PK u}): First, a random number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0049] KeyGen(GP,GID,MSK u ): Authority attribute u is the secret key SK for GID GID,u SK GID,u =(K GID,A,u ,K GID,B,u ) is generated as follows. Here,

number

[0050] Dec(GP,CT,GID,{SK GID,u}): Decryption involves global parameter GP, hash function H, and LSSS access structure.

number

number

number

number

number

number

number

[0051] For all x∈I, the decoding algorithm is:

number

number

number

[0052] The proposed scheme is accurate, as confirmed by testing.

[0053] Porting to the prime number order group

[0054] As described above, much research has been conducted to devise methods for converting existing composite order constructs to similar ones for prime order. All of these frameworks are different and have varying levels of conciseness or generality. The inventors have succeeded in adapting the construction and proof from the composite order setting to the prime order setting using Chen et al.'s recent framework, which appears to be the most efficient and (almost certainly) the easiest to use.

[0055] This framework demonstrates a method for simulating composite number order groups and their subgroups using prime number order groups, while guaranteeing similarities at a high level to prime number order assumptions of various subgroup decision styles. These similarities are derived from standard k-linear assumptions (more generally, MDDH assumptions). Here, since the transformation process is not entirely black-box and needs to be adapted to the scheme of the moment, it is necessary to introduce some additional technical concepts to deal with the specific setting of the invention. Specifically, the proof of security of the prime number order constructions of the invention depends not only on subgroup decision style assumptions but also on the security of several information-theoretic arguments and random oracles. Making this work for the scheme of the invention using the framework is quite technical and systematic. See the technical section for details. Nevertheless, the inventors note that the high-level concepts and hybrid sequences are the same as in the case of composite number order.

[0056] Preface

[0057] function

number

[0058] To represent a vector,

number

number

number

number

number

number

number

number

[0059] Indistinguishability: Two sequences of random variables X = {X λ} λ∈N and Y={Y λ} λ∈N This is an arbitrary non-uniform PowerPoint presentation algorithm.

number

number

number

[0060] For two distributions D and D' on a discrete domain Ω, the statistical distance between D and D' is given by SD(D,D')=(1 / 2)·Σ ω∈Ω It is defined as |D(ω)-D'(ω)|. The distribution D={D} is parameterized by the security parameter λ. λ} λ∈N ) and D'={D' λ} λ∈N The family is all

number

[0061] Access Structure and Linear Secret Sharing Method

[0062] This subsection presents the definitions of access structures and linear secret sharing schemes.

[0063] Definition (access structure):

number

number

number

number

number

number

[0064] Definition (Linear Secret Sharing Scheme (LSSS)): Let q = q(λ) be a prime number,

number

number

number

number

number

number

number

number

number

number

[0065] 1.

number

number

number

[0066] 2.

number

number

number

number

number

number

number

number

number

number

number

[0067] The accuracy and security of a monotonic LSSS are formalized as follows: S(S') is some monotonic access structure

number

number

number

number

number

number

Number

Number

Number

Number

Number

Number

[0068] Remark 1 (NC 1 and Monotonic LSSS): Consider an access structure 1 described by an NC

Number

[0069] Strong randomness extractor

[0070] The minimum entropy of a random variable X is

Number

Number

Number

[0071] Definition (seeded randomness extractor): The function Ext: Ω × S → Γ is a strong (t, ε)-extractor for a t-source X on Ω if

Number

[0072] Theorem: For all

Number

[0073] Fully adaptable distributed MA-ABE for LSSS

[0074] The attribute-based encryption (MA-ABE, multi-authority attribute-based encryption) system MA-ABE = (GlobalSetup, AuthSetup, KeyGen, Enc, Dec) of a decentralized multi-authority consists of five procedures whose syntax is given below. The supported access structure dealt with by the present invention is an access structure captured by linear secret sharing schemes (LSSS). Let the population of authorities be

Number

Number

Number

[0075] GlobalSetup(1 λ ) → GP: The global setup algorithm takes in the security parameter λ in unary representation and outputs the global public parameters GP for the system. Assume that GP contains the description of the population of attribute authorities

Number

Number

Number

[0076] AuthSetup(GP, u) → (PK u , MSK u ): The authority

Number

[0077] KeyGen(GP, GID, MSK u ) → SK GID,u : The key generation algorithm takes as input the global parameter GP, the global identifier of the user

Number

Number

[0078]

Number

Number

Number

number

number

number

number

number

[0079] Dec(GP,CT,{SK GID,u})→msg': The decryption algorithm is a global parameter GP, some LSSS access policy

number

number

number

number

[0080] Accuracy: The MA-ABE scheme for access structures achievable with LSSS is for all

number

number

number

number

number

number

[0081] Fully Adaptive Security: Defines fully adaptive (selected plaintext) security for a distributed MA-ABE scheme. That is, consider a security game in which adaptive secret key queries, adaptive authority corruption queries, and adaptive challenge ciphertext queries may exist. This is formalized in the following game between a challenger and an attacker. Consider two types of authority public keys, namely those legitimately generated by the challenger and those supplied by the attacker themselves, noting that the former type of authority key can be corrupted by the attacker at any point in the game, and the latter type of authority key can potentially be maliciously formed.

[0082] The game consists of the following stages: Global Settings: The challenger runs GlobalSetup to generate the global public parameter GP and provides it to the attacker. Query Stage 1: The attacker is allowed to adaptively perform a number of queries involving polynomials of the following types: Authority setting query: The attacker can set the authority of that choice

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0083] Definition (MA-ABE fully adaptive security for LSSS): The MA-ABE scheme for access structures achievable with LSSS is for all

number

number

number

[0084] Note (MA-ABE's fully adaptive security for LSSS in a random oracle model): Furthermore, consider the above concept of fully adaptive security in a random oracle model. In this context, we assume a global hash function H that is exposed as part of the global public parameters and accessible to all parties in the system, including the attacker. In the security proof, H is modeled as a probability function so that the challenger can program it. Thus, in the fully adaptive security game described above, we further cause the attacker to adaptively present H oracle queries to the challenger, along with key queries performed both before and after the challenge ciphertext query.

[0085] Composite number order group MA-ABE scheme

[0086] The following describes the composite number-order bilinear group and the assumptions on which the configuration of the present invention depends, and then provides the configuration.

[0087] Composite number order bilinear group and assumptions

[0088] The system of the present invention depends on a composite-order bilinear group. In particular, a composite-order bilinear group of order N, which is the product of three prime numbers, i.e., N = p1p2p3.

number

number

number

number

number

number

number

number

number

number

number

number

[0089] composition

[0090] Here, in the composite order bilinear group NC 1 We present the MA-ABE for the configuration. As stated above, we assume that each authority controls only one attribute, and therefore use the terms "authority" and "attribute" interchangeably.

[0091] GlobalSetup(1 λ The global configuration algorithm uses a unary encoded security parameter 1. λThis involves incorporating the following: First, select prime numbers p1, p2, and p3, and set N = p1p2p3. Next, create a bilinear group of order N.

number

number

number

number

number

number

number

number

number

[0092] AuthSetup(GP,H,u): Global parameters GP, hash function H, and authority index.

number

number

number

[0093] Enc(GP,H,msg,(M,ρ),{PK u The encryption algorithm takes the global parameter GP as input, the hash function H, and the message to be encrypted.

number

number

number

number

[0094] First, random numbers

number

number

number

number

number

number

number

number

number

number

number

[0095] Here,

number

[0096] KeyGen(GP,H,GID,MSK u The key generation algorithm takes global parameter GP, hash function H, and user's global identifier as input.

number

number

number

[0097] Dec(GP,H,CT,GID,{SK GID,u}): Decryption involves global parameter GP, hash function H, and LSSS access structure.

number

number

number

number

number

number

[0098] For all x ∈ I, first, the decoding algorithm is:

number

number

number

[0099] Prime number order group MA-ABE scheme

[0100] In the following, we recall the bilinear group of prime order, provide the relevant notation, give the basic structure of the transformation framework, give the assumptions on which the configuration of the present invention depends, and then provide the configuration.

[0101] Prime-order bilinear groups and related notations

[0102] Notation:

number

number

number

number

number

number

number

number

number

number

number

number

number

[0103] Arbitrary bilinear group parameters

number

number

number

number

number

number

number

number

number

[0104] Prime order bilinear group:

number

number

number

number

number

number

number

number

number

[0105]

number

number

[0106] composition

[0107] Here, in the bilinear group of prime order, NC 1 We present the MA-ABE for the configuration. As stated above, we assume that each authority controls only one attribute, and therefore use the terms "authority" and "attribute" interchangeably.

[0108] GlobalSetup(1 λ The global configuration algorithm uses a unary encoded security parameter 1. λ This procedure involves first selecting a prime number p, and then the bilinear group of order p.

number

number

number

number

number

[0109]

number

number

number

number

number

[0110] Furthermore, all parties are global identifiers

number

number

number

number

number

number

[0111] AuthSetup(GP,u): Global parameters GP and Authority Index

number

number

number

[0112] Enc(GP,msg,(M,ρ),{PK u The encryption algorithm takes the global parameter GP as input and the message to be encrypted.

number

number

number

number

[0113] First, a random vector

number

number

number

number

[0114] Here,

number

number

[0115] KeyGen(GP,GID,MSK u The key generation algorithm takes the global parameter GP and the user's global identifier as input.

number

number

number

[0116] Dec(GP,CT,GID,{SK GID,u}): Decryption is performed using the global parameter GP and the LSSS access structure.

number

number

number

number

number

number

[0117] For all x ∈ I, first, the decoding algorithm is:

number

number

number

[0118] System Implementation

[0119] Referring to Figure 1, an example of a system architecture for a distributed multi-authority attribute-based encryption scheme is shown. The owner 105 of a message, such as arbitrary data, can encrypt the message as described here and store the resulting ciphertext in cloud storage 110. Other users, shown as accessors 115, may retrieve this ciphertext from cloud storage 110. Multiple authorities 120 may be instantiated to manage public and private keys. Authority 120 may distribute private keys to the data owner 105 and private keys to accessors 115. As described here, a user can decrypt the ciphertext only if they have at least a predetermined number of attributes from the required authorities.

[0120] Referring to Figure 2, an example sequence diagram of a distributed multi-authority attribute-based encryption scheme is shown. Arbitrary data may be stored in Cloud 201. Data may be uploaded to the cloud by data owner 202. User 203 may then want to retrieve data from Cloud 201. User 203 may first view the file details and then request a key from authority 204. Although only a single authority 204 is shown here, multiple authorities can be instantiated, and a user may communicate with multiple authorities.

[0121] Figures 3 and 4 show examples of computer systems useful for implementing the various embodiments described herein. The various embodiments may be implemented using one or more computer systems, such as the computer system 500 shown in Figure 3. One or more computer systems 500 may be used, for example, to implement any of the embodiments discussed herein, as well as combinations and subcombinations thereof.

[0122] The computer system 500 may include one or more processors (also called a central processing unit, processing device, or CPU), such as a processor 504. The processor 504 may be connected to a communication infrastructure 506 (e.g., a bus).

[0123] The computer system 500 may also include user input / output devices 503 such as a monitor, keyboard, and pointing device, which may communicate with a communication infrastructure 506 via a user input / output interface 502. One or more of the processors 504 may be graphics processing units (GPUs). In one embodiment, the GPU may be a processor which is a special electronic circuit designed to process mathematically intensive applications. The GPU may have a parallel structure that is efficient for parallel processing of large blocks of data, such as mathematically intensive data common to computer graphics applications, images, videos, etc.

[0124] The computer system 500 may also include main memory 508, such as random-access memory (RAM). The main memory 508 may include one or more levels of cache. The main memory 508 may store control logic (i.e., computer software, instructions, etc.) and / or data. The computer system 500 may also include one or more secondary storage devices or secondary memory 510. The secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device or removable storage drive 514. The removable storage drive 514 may interact with a removable storage unit 518. The removable storage unit 518 may include a computer-usable or readable storage device that stores computer software (control logic) and / or data. The removable storage drive 514 may read from and write to the removable storage unit 518.

[0125] The secondary memory 510 may include other means, devices, components, equipment or other approaches for enabling computer programs and / or other instructions and / or data to be accessed by the computer system 500. Such means, devices, components, equipment or other approaches may include, for example, a removable storage unit 522 and an interface 520. Examples of the removable storage unit 522 and interface 520 may include a program cartridge and cartridge interface, a removable memory chip (such as an EPROM or PROM) and associated socket, a memory stick and USB port, a memory card and associated memory card slot, and / or other removable storage units and associated interfaces.

[0126] The computer system 500 may further include a communication interface 524 (for example, a network interface). The communication interface 524 may enable the computer system 500 to communicate and interact with any combination of external devices, external networks, external entities, etc. (individually or collectively referred to as remote devices, networks, entities 528). For example, the communication interface 524 may enable the computer system 500 to communicate with external or remote devices, networks, entities 528 via a communication path 526. The communication path 526 may be wired and / or wireless (or a combination thereof) and may include any combination of LAN, WAN, Internet, etc. Control logic and / or data may be transmitted to and from the computer system 500 via the communication path 526.

[0127] The computer system 500 may also be, to give some non-limiting examples, a personal digital assistant (PDA), a desktop workstation, a laptop computer or notebook computer, a netbook, a tablet, a smartphone, a smartwatch or other wearable device, an appliance, part of the Internet of Things and / or an embedded system, or any combination thereof.

[0128] The computer system 500 may also be a client or server computing device that accesses or hosts any application and / or data through any delivery paradigm, including but not limited to remote or distributed cloud computing solutions, local or on-premises software ("on-premises" cloud-based solutions), "as a service" models (e.g., content as a service (CaaS), digital content as a service (DCaaS), software as a service (SaaS), managed software as a service (MSaaS), platform as a service (PaaS), desktop as a service (DaaS), framework as a service (FaaS), backend as a service (BaaS), mobile backend as a service (MBaaS), infrastructure as a service (IaaS), etc.), and / or hybrid models including any combination of the above examples, or other service or delivery paradigms.

[0129] Figure 4 shows an example of a computer system 900 machine in which a set of instructions is executed to cause the machine to perform one or more of the operations described herein. In another implementation, the machine may be connected to other machines in a LAN, intranet, extranet and / or internet (e.g., network connection). The machine may operate as a server or client machine in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or client machine in a cloud computing infrastructure or environment.

[0130] A machine may be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web appliance, server, network router, switch or bridge, dedicated application or network security appliance or device, or any machine capable of executing a set of instructions (such as sequential) that specify the actions to be performed by that machine. Furthermore, although a single machine is given as an example, the term “machine” also includes any set of machines that individually or collectively execute a set (or set) of instructions for performing one or more of the methodologies discussed herein.

[0131] An example of a computer system 900 includes a processing device 902, main memory 904 (e.g., read-only memory (ROM), flash memory, synchronous DRAM (SDRAM, synchronous DRAM, etc., dynamic random-access memory (DRAM), etc.), static memory 906 (e.g., flash memory, static random-access memory (SRAM), etc.), and a data storage device 918, all of which communicate via a bus 930.

[0132] The processing device 902 represents one or more processing devices, such as a microprocessor or a central processing unit. More specifically, the processing device may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing another instruction set, or a processor implementing a combination of instruction sets. The processing device 902 may also be one or more special-purpose processing devices, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. The processing device 902 is configured to execute instructions 926 for performing the operations and steps described herein.

[0133] The computer system 900 may further include a network interface device 908 for communication via a network 920. The computer system 900 may also include a video display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursor control device 914 (e.g., a mouse), a graphics processing unit 922, a signal generating device 916 (e.g., a speaker), another graphics processing unit 922, a video processing unit 928, and an audio processing unit 932.

[0134] The data storage device 918 may include a machine-readable medium 924 (also known as a computer-readable storage medium) in which a set of one or more instructions 926 (e.g., software instructions) that embody one or more of the operations described herein is stored. The instructions 926 may also reside, all or at least partially, in the main memory 904 and / or processing device 902 during execution by the computer system 900, where the main memory 904 and processing device 902 also constitute the machine-readable storage medium.

[0135] In one example, instruction 926 includes instructions for implementing operations and functions corresponding to the subject matter of this disclosure. Although the machine-readable storage medium 924 is shown as a single medium in the example implementation, the term “machine-readable storage medium” should be understood to include a single or multiple mediums (e.g., a centralized or distributed database and / or associated caches and servers) that store one or more sets of instructions 926. The term “machine-readable storage medium” should also be understood to include a medium that can store or encode a set of instructions 926 for machine execution and that causes a machine to perform one or more of the operations of this disclosure. Accordingly, the term “machine-readable storage medium” includes, but is not limited to, solid memory, optical media and magnetic media.

[0136] Some of the detailed explanations are presented in terms of algorithms and symbolic representations of operations on data bits in computer memory. These algorithmic descriptions and representations are methods used by those skilled in the field of data processing to most effectively communicate the content of their research to others skilled in that field. Here, an algorithm is generally considered to be a consistent sequence of actions that produce a desired result. The actions require the physical manipulation of physical quantities. While not always the case, these quantities usually take the form of electrical or magnetic signals that can be stored, combined, compared, and otherly manipulated. Referring to these signals as bits, values, elements, symbols, characters, terms, numbers, etc., has proven convenient in some cases, primarily for reasons of common usage.

[0137] However, it should be noted that all of these terms and similar terms are associated with appropriate physical quantities and are merely convenient labels applied to those quantities. Unless otherwise specified, as is evident from the above explanation, descriptions using terms such as “identify,” “determine,” “execute,” “perform,” “collect,” “create,” and “transmit” are understood to describe the actions and processes of a computer system or similar electronic computing device that manipulate and transform data represented as physical (electronic) quantities in the registers and memory of the computer system into other data similarly represented as physical quantities in the memory or registers of the computer system or other such information storage devices.

[0138] This disclosure also relates to an apparatus for performing the operations described herein. This apparatus may be specifically configured for the intended purpose, or may include a computer that is selectively started or reconfigured by a computer program stored in the computer. Such computer programs may be stored in computer-readable storage media, but not limited to, any type of disk, including floppy disks, optical disks, CD-ROMs and magneto-optical disks, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic or optical cards, or any type of medium suitable for storing electronic instructions, each coupled to a computer system bus.

[0139] The operations and examples presented herein are not inherently related to any particular computer or other device. Various types of systems may be used with the program in accordance with the teachings presented herein, or may prove useful for constructing more specialized devices for performing the operations. The structures of these various systems will appear as described herein. Furthermore, this disclosure is not written with reference to any particular programming language. It is acknowledged that various programming languages ​​may be used to implement the teachings of this disclosure described herein.

[0140] This disclosure may be provided as a computer program product or software which may include a machine-readable medium storing instructions and may be used to program a computer system (or other electronic device) to perform a process in accordance with this disclosure. The machine-readable medium includes any mechanism that stores information in a format that can be read by a machine (e.g., a computer). For example, machine-readable (e.g., computer-readable) medium includes machine-readable (e.g., computer) storage media such as read-only memory ("ROM"), random-access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory devices, etc.

[0141] In some embodiments, a tangible, non-temporary device or product including a tangible, non-temporary computer-usable or readable medium storing control logic (software) is also referred to herein as a computer program product or program storage device. This includes, but is not limited to, a computer system 500, main memory 508, secondary memory 510, removable storage units 518 and 522, and tangible products embodying any combination thereof. If such control logic is executed by one or more data processing devices (such as the computer system 500), such data processing devices may be made to operate as described herein.

[0142] Based on the teachings contained herein, it will be apparent to those skilled in the art how embodiments of the disclosure can be constructed and used with data processing devices, computer systems, and / or computer architectures other than those shown in Figures 3 and 4. In particular, embodiments can be operated with software, hardware, and / or operating system implementations other than those individually described.

[0143] It is clear that the detailed description section, rather than the other sections, is intended to be used to interpret the claims. The other sections may describe one or more embodiments devised by the inventor, but may not describe all of them. Therefore, they are not intended to limit the scope of this disclosure or the claims.

[0144] This disclosure describes exemplary embodiments for exemplary fields and uses, but it should be understood that this disclosure is not limited thereto. Other embodiments and modifications thereof are possible and fall within the scope and true intent of this disclosure. For example, without limiting the generality of this paragraph, embodiments are not limited to the software, hardware, firmware, and / or entities shown in the figures herein. Furthermore, embodiments (whether expressly described herein or otherwise) may have considerable utility in fields and uses other than those described herein.

[0145] Embodiments are described herein using functional configuration blocks that demonstrate the implementation of specified functions and their relationships. The boundaries of these functional configuration blocks are arbitrarily defined here for the sake of clarity. Different boundaries can be defined as long as the specified functions and relationships (or equivalents) are properly performed. In addition, alternative embodiments may execute the functional blocks, steps, operations, methods, etc., in an order different from that described herein.

[0146] The terms “one embodiment,” “embodiment,” “exemplary embodiment,” or similar phrases herein indicate that the embodiments described may include certain features, structures, or characteristics, but not all embodiments will include such features, structures, or characteristics. Furthermore, such phrases do not necessarily refer to the same embodiment. Moreover, if certain features, structures, or characteristics are described in relation to an embodiment, incorporating such features, structures, or characteristics into other embodiments is within the scope of knowledge of those skilled in the art, even if not explicitly mentioned or described herein. Furthermore, some embodiments may be described using the expressions “combined” and “connected,” along with their derivatives. These terms are not necessarily intended to be synonymous with each other. For example, some embodiments may be described using the terms “connected” and / or “combined” to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term “combined” can also mean that two or more elements are not in direct contact with each other but still cooperate or interact with each other.

[0147] The scope and extent of this disclosure should not be limited by any of the exemplary embodiments described above, but should be defined solely in accordance with the following claims and equivalents. In the above specification, implementations of the disclosure are described with reference to specific examples of such implementations. It is clear that various modifications may be made without departing from the broader intent and scope of this disclosure, as described in the following claims. Accordingly, the specification and drawings should be considered illustrative, not restrictive.

Claims

1. A computerized system for encrypting messages according to a multi-authority attribute-based encryption scheme, m for encryption i The steps include receiving an electronic message m containing bits, The steps include storing the aforementioned electronic message in a computerized storage medium, Run the global configuration algorithm, Generate group G, g and h are sampled as the two generators of group G, Sampling seeds for the seed extractor. The steps involve generating global parameters by doing so, Execute the authority setting algorithm, Two exponents y A And sample yB, public key {g {yA} Set as ,g{yB}, The private key {y A Set as {yB} This involves the steps of generating a public and private key pair, s, r A , r B Sampling, C {1,A} =g {rA} C {1,B} =g{rB} C {2,A} =g {yA*rA} g {s} C {2,B} =g{yB*rB}g {-s} C = m xor Ext(e(g,h), seed) Calculate the following, where e is the bilinear pairing and Ext is the seed random extractor: (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) is stored in a computerized storage medium. This involves the steps of executing an encryption algorithm on the electronic message m and the access policy M, (H(GID)*h) {yA} and (H(GID)) {yB} The step is to execute the key generation algorithm by outputting, where H is a global cryptographic hash function that maps to the group G, and GID is the global identifier of the user, and A computerized system including a processor configured to perform the following actions.

2. A computerized system for encrypting messages according to claim 1, wherein any party can participate as an authority at any time, and there is no limit to the number of authorities.

3. A computerized system for encrypting a message according to claim 1, wherein the encrypted message is fully adaptively secure.

4. A computerized system for encrypting a message according to claim 1, wherein the encrypted message is provably fully adaptively secure to an attacker who can corrupt one or more authorities and adaptively perform key queries throughout the entire lifespan of the computerized system.

5. A computerized system for encrypting messages according to claim 4, wherein the adversary does not possess a secret key or authority master key sufficient to decrypt the encrypted message with respect to the access structure.

6. The aforementioned processor, The steps include storing the message encrypted according to an attribute-based encryption scheme in the computerized storage medium, (K {GID,A} ,K {GID,B} ) containing the components generated as a key and ciphertext (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) received, D A =e(C {2,A} ,H(GID)*h) / e(C {1,A },K {GID,A} ) calculate, D B =e(C {2,B} ,H(GID)) / e(C {1,B} ,K {GID,B} ) calculate, C xor Ext(D A *D B Outputs ,seed) This completes the steps of executing the decryption algorithm and A computerized system for encrypting a message according to claim 1, further configured to decrypt the message by performing the following:

7. A computerized method performed by a computer for encrypting a message according to a multi-authority attribute-based encryption scheme, m for encryption i A step of storing an electronic message m containing bits in a computerized storage medium, Run the global configuration algorithm, Generate group G, g and h are sampled as the two generators of group G, Sampling seeds for the seed extractor. The steps involve generating global parameters by doing so, Execute the authority setting algorithm, Two exponents y A And sample yB, public key {g {yA} Set as ,g{yB}, The private key {y A Set as {yB} This involves the steps of generating a public and private key pair, s, r A , r B Sampling, C {1,A} =g {rA} C {1,B} =g{rB} C {2,A} =g {yA*rA} g {s} C {2,B} =g{yB*rB}g {-s} C = m xor Ext(e(g,h), seed) Calculate the following, where e is the bilinear pairing and Ext is the seed random extractor: (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) is stored in a computerized storage medium. This involves the steps of executing an encryption algorithm on the electronic message m and the access policy M, (H(GID)*h) {yA} and (H(GID)) {yB} The step is to execute the key generation algorithm by outputting, where H is a global cryptographic hash function that maps to the group G, and GID is the global identifier of the user, and A method that includes this.

8. A computerized method for encrypting a message according to claim 7, wherein any party can participate as an authority at any time, and there is no limit to the number of authorities.

9. A computerized method for encrypting a message according to claim 7, wherein the method is fully adaptively secure.

10. A computerized method for encrypting a message according to claim 7, wherein the method is provably fully adaptively secure so as to be secure against an attacker who can compromise one or more authorities and adaptively perform key queries throughout the entire lifespan of the system.

11. A computerized method for encrypting a message according to claim 10, wherein the adversary does not possess a secret key or authority master key sufficient to decrypt the encrypted message with respect to the access structure.

12. The method further includes the step of decrypting a message in accordance with the multi-authority attribute-based encryption scheme, This method is The steps include storing the message encrypted according to an attribute-based encryption scheme in the computerized storage medium, (K {GID,A} ,K {GID,B} ) containing the components generated as a key and ciphertext (C, C {1,A} , C {1,B} , C {2,A} , C {2,B} ) received, D A =e(C {2,A} ,H(GID)*h) / e(C {1,A },K {GID,A} ) calculate, D B =e(C {2,B} ,H(GID)) / e(C {1,B} ,K {GID,B} ) calculate, C xor Ext(D A *D B Outputs ,seed) This completes the steps of executing the decryption algorithm and A computerized method for encrypting the message according to claim 7, including the method described in claim 7.

Images