49 results about "Attribute authority" patented technology

A central server configured with an Attribute Authority (“AA”) acting as a Trusted Third Party mediating service provider and using X.509-compatible PKI and PMI, VPN technology, device-side thin client applications, security hardware (HSM, Network), cloud hosting, authentication, Active Directory and other solutions. This ecosystem results in real time management of credentials, identity profiles, communication lines, and keys. It is not centrally managed, rather distributes rights to users. Using its Inviter-Invitee protocol suite, Inviters vouch for the identity of Invitees who successfully complete the protocol establishing communication lines. Users establish and respond to authorization requests and other real-time verifications pertaining to accessing each communication line (not end point) and sharing encrypted digital files. These are auditable, brokered, trusted-relationships where such relationships / digital agreements can each stand-alone (for privacy) or can leverage build-up of identity confidence levels across relationships. The service is agnostic to how encrypted user content is transported or stored.

The invention discloses an on-cloud semi-homomorphic encryption method capable of resisting private key tracking, which comprises the following steps of: S1, generating a blind identity based on the real identity of a data user, and performing identity de-association processing; s2, the attribute authority generates a binding key pair based on the blind identity and returns the binding key pair; s3, the data user discloses a real identity and a public key to the data owner; s4, the data owner encrypts the plaintext after verifying the public key to form a ciphertext set; s5, uploading the ciphertext set to a cloud service provider, and performing classified storage; s6, the cloud service provider receives the analysis request and performs homomorphic addition aggregation on the ciphertext set to generate an aggregated ciphertext; and S7, the data user uses the private key to decrypt the aggregated ciphertext, and a plaintext analysis result is recovered. According to the method, the identity privacy of the user is protected while encrypted data analysis is realized, and the method has the characteristics of untraceability and lightweight deployment.

The invention discloses a fine-grained access control system and method based on combination of CPK and attribute authority, a key generation management unit generates a public and private key pair corresponding to each attribute, and an attribute and strategy management unit defines a system attribute set and formulates an access control strategy. The user and authorization management unit distributes attribute information for a user and determines an access authority according to the attribute information, the data access and encryption unit combines a plurality of attribute public keys according to an access control strategy to form a combined public key, and the data decryption and verification unit verifies user authority attributes and combines private keys of corresponding attributes to form a combined private key; and the local resource and authority management unit stores and updates the attribute private key and authority information of the user side. Through matrix key generation, attribute public key combined encryption and private key combined decryption mechanisms, the problems of complex key management and low efficiency of a traditional ABE scheme are solved, dynamic attribute extension and a complex access strategy are supported, and the performance and expandability under large-scale user and attribute scenes are remarkably improved.

The invention discloses an attribute-based encrypted data sharing system supporting flexible change of a user. The attribute-based encrypted data sharing system comprises a central authority CA, generating and issuing public parameters, generating a first key component and an authority amount, and initiating attribute revocation; the attribute authority AA is used for generating a pre-decryption key, an attribute quantity and a new pre-decryption key, and updating a key component; the data owner DO provides a user public key, a first attribute set, an index, a blind keyword and an initial ciphertext; the proxy server PS generates a keyword search trap door and a final ciphertext, verifies the search request, downloads the corresponding final ciphertext for pre-decryption after the search request passes the verification, and outputs a pre-decrypted ciphertext; the cloud service provider CSP stores the final ciphertext; and the DU generates and sends a second attribute set, initiates a search request based on a keyword search trap door, and receives and decrypts the pre-decrypted ciphertext. The access control and sharing utilization of the data by the data owner are realized, and meanwhile, the forward security and instantaneity of the user after revocation are ensured.

The invention relates to the technical field of intelligent locks, in particular to an attribute-based intelligent lock access control method and system.The method comprises the steps that main body attributes, object attributes, environment attributes and authority attributes are collected and stored, the main body attributes comprise unique identifiers, roles and positions of visitors, and the object attributes comprise device identifiers of intelligent locks; the environment attribute comprises access time, an access date and an access position, and the permission attribute comprises unlocking operation; establishing a corresponding relationship between attributes and permissions, and forming an attribute authorization list for checking in an access control execution stage; when an access request is received, the identity of a visitor is verified through an identity verification mechanism; analyzing the access request, and obtaining a subject attribute, an object attribute, an environment attribute and a requested operation; according to the attribute authorization list and a preset strategy set, whether the access request is authorized or not is judged, and the strategy set is stored in the intelligent lock; and executing or denying the access request according to a judgment result. The problems that an existing intelligent lock is poor in safety, complex in operation and insufficient in authority management dynamics can be solved.

The invention discloses a multi-authoritative attribute-based proxy signature method with a flexible threshold, and relates to the technical field of cyberspace security, the method comprises the following steps: constructing a multi-authoritative attribute-based proxy signature system with entities including a central attribute authority, a distributed attribute authority, an original signer, a proxy signer and a verifier, and establishing system parameters, carrying out system initialization; generating a secret key for an original signer and a secret key for a proxy signer through central attribute authority and distributed attribute authority respectively; the original signer generates a consignment and authorization to the proxy signer; after the proxy signer receives the authorization sent by the original signer, authorization verification is carried out; after the authorization verification is passed, the proxy signer calculates a proxy signature for the message according to the authorization sent by the original signer, and sends the message, the delegate and the proxy signature to the verifier; the verifier verifies the proxy signature based on the message and the delegate. The method is high in flexibility and adaptability.

The invention discloses an attribute-based encryption method and system based on support of multi-authority accountability and outsourcing calculation, and the method specifically comprises the steps: introducing a multi-attribute authority mechanism to be responsible for key distribution and management, reducing the dependence on a single mechanism, and improving the safety and reliability of the system; the cloud server locally updates the access strategy and the ciphertext according to the minimum change increment set uploaded by the data owner; a white-box tracking technology is adopted to bind a user identity with an attribute key, so that a system can locate a specific identity of a malicious user and a specific identity of a malicious attribute authority through a leaked key; intensive computing tasks in the encryption and decryption processes are outsourced to a cloud server, and meanwhile it is ensured that user privacy is not leaked in the outsourcing process; for the untrusted problem of the cloud server, the calculation result is verified by using the smart contract in the block chain, and it is ensured that the verification process is open and transparent and the result is trusted; and an attribute version mark is introduced, so that efficient revocation of old version attributes is realized, and the safety is further improved.

The invention provides a block chain data credible interaction method based on multi-permission attribute-based encryption. The method comprises the following steps: step 1, initializing a system; the whole system generates initial parameters, including generation and uplink of public parameters and generation of public keys and private keys. And step 2, data encryption. A data owner in the system needs to organize and encrypt data and upload ciphertext information to a block chain. And step 3, generating a secret key. When a data user wants to access data of other data owners, the data user sends an access request to the block chain. After the access request of the data user is monitored, the block chain notifies the attribute authority to provide the access key. And 4, data decryption. And the data user who needs to access the encrypted data obtains the access key and then downloads the corresponding ciphertext. And the data user decrypts the ciphertext according to the system parameters and the attribute token to obtain the data.

The invention relates to the field of data sharing, and particularly discloses an access control method based on outsourcing calculation and attribute-based searchable encryption on a block chain, comprising the following steps: S1, an attribute authority initializes to generate a system public key and a master key, and generates an attribute private key of a user; s2, the data owner formulates an access control strategy to assist the outsourcing encryption service provider in partial encryption, and the data user and the outsourcing encryption service provider encrypt the keyword, the data ciphertext storage address and the symmetric key and upload the encrypted ciphertext to the block chain for storage; s3, the data user generates a search trap door and sends the search trap door to the block chain, and user attributes are verified; and S4, the data user assists the outsourcing decryption service provider in partially decrypting the ciphertext, locally decrypting to obtain the data storage address and the symmetric key, downloading the data ciphertext, and decrypting by using the symmetric key to obtain the data plaintext. According to the invention, the calculation burden of encryption and decryption of a local user is reduced, and the sharing efficiency and security of data are improved.

This invention discloses a blockchain-based verifiable key generation method in MA-CPABE. The method includes: a data owner running a global setting algorithm to generate system parameters, and electing multiple decentralized attribute authorization nodes through a blockchain staking mechanism; each node generating public and private keys and uploading the public key to the blockchain; the data owner encrypting data based on a policy and publishing the ciphertext and its identifier to the blockchain; when a user requests a key, the attribute authorization node calls an optimized key generation circuit to generate a decryption key and a corresponding zero-knowledge proof, submitting the proof and related data to the blockchain, where a verification node verifies and records the key generation event; for the update history of the zero-knowledge proof, a chain-based evidence storage system is constructed through a smart contract event mechanism to achieve verifiable traceability of its change history. This invention achieves decentralized trusted key management, efficient off-chain computation and verifiability, and significantly reduced blockchain resource consumption.

The present invention discloses a lightweight sensitive data access control method, comprising: a system initialization step, generating public parameters; an encryption step, including two parts, symmetric encryption and attribute-based encryption, generating an access control tree according to an access control policy; embedding key material into the access control tree based on the Shamir secret sharing scheme; wherein the secret value of the root node is used to generate a key and an integrity verification key of a symmetric encryption algorithm, and the password share of the leaf node is used to generate an attribute ciphertext. In a decryption key generation step, a data user applies to an attribute authority for its attribute key, and the attribute authority generates a key for the attribute verified by the data user and sends it to the data user securely; in a decryption step, a user who complies with the access control policy uses its attribute key to recover a symmetric encryption key according to the access control tree, and decrypts and verifies the ciphertext data. The present invention is used for resource-constrained devices in an open network environment to control access to sensitive data.

The present application provides a trusted and controlled sharing method, access method and system for privacy data based on blockchain, which relates to the field of blockchain technology. The sharing method includes: storing the ciphertext of privacy data outside the blockchain; encrypting the access path and symmetric key of the ciphertext of privacy data with a hierarchical simplified access strategy based on the attribute encryption algorithm of multiple attribute authorization agencies, and storing the access path ciphertext and key information ciphertext in the blockchain, so that when the edge node as the blockchain endorsement node receives the blinded attribute key of the data user for the privacy data, if it is determined that the data user meets the minimum access attribute level corresponding to the hierarchical simplified access strategy, the key information ciphertext is pre-decrypted and calculated based on the smart contract and PBFT consensus mechanism, and the pre-decryption result is sent to the data user. The present application can improve the security of privacy data in the process of data sharing, improve the storage and computing efficiency in the process of data sharing, and reduce the occupancy rate of device resources.

The present application belongs to the field of encryption and decryption technology, and provides an interactive attribute-based encryption and decryption method and system, including: an attribute authorization agency AA executes an initialization algorithm to generate system public parameters, a master key and an attribute-based encrypted access structure; for each attribute, the attribute authorization agency generates an attribute-independent key component and an attribute-related key component based on the master key and the access structure; the data owner uses the system public parameters and the access structure to encrypt data and generate ciphertext; the data owner publishes the ciphertext and the access structure to the blockchain network; the authorized user obtains the ciphertext and the access structure from the blockchain network, executes the interactive attribute-based decryption algorithm, generates an intermediate key, and sends an interactive decryption task containing the intermediate key to the service provider; the authorized user receives the decryption result fed back by the service provider, thereby significantly reducing the computational burden of the lightweight device during the decryption process.

A device includes one or more processors configured to receive, from a user device, an authentication request including credentials of a user. The one or more processors are also configured to obtain user attributes of the user from one or more user data records associated with one or more identity systems. The one or more processors are further configured to obtain one or more roles of the user based on one or more membership lists. The one or more processors are also configured to generate an authentication token indicating the user attributes and the one or more roles.

The present invention relates to a multi-authorized party collaborative attribute and key management method with clear ownership based on RAFT consensus. During the system initialization phase, each attribute authorization agency (AA) registers and initializes its identity on the blockchain, and then generates and broadcasts a global attribute public key and constructs an attribute block through multi-party collaboration. During the user registration process, the data user (DU) submits an identity and attribute request to the system. After preliminary verification by the Leader AA, a consensus is reached among the AAs through the RAFT algorithm to ensure the consistency and security of the registration information. During the user attribute update phase, the user or organization needs to submit an attribute change request. The system processes and verifies the update request through the RAFT consensus mechanism to ensure the correctness and consistency of the attribute change. A new attribute key is generated after the update is confirmed and replaces the old key to ensure system security. The present invention utilizes the RAFT consensus algorithm to improve the system's fault tolerance and data consistency, and at the same time combines blockchain technology to enhance the security and immutability of the data.

A kind of attribute classification and grading data security storage and access control method includes a central authority CA, N attribute authorities AAs and X sub-authorities aas, user, agency administrator, product transaction traceability public blockchain, information security supervision alliance blockchain and interstellar file system IPFS.The present application stores massive unstructured data and encrypted information using IPFS, only stores the file addressing hash generated by IPFS on the blockchain, reduces the data storage pressure and security risk of the blockchain;A multi-agency ciphertext policy-based attribute encryption algorithm is constructed to meet the needs of privacy information protection and dynamic fine-grained access control of the system;The combination of multi-authority hierarchical authorization and central authority disperses the system overhead, making it easier to supervise;Accurate tracking of malicious users is achieved, and users and attributes can be revoked immediately without updating keys or ciphertexts.

The invention discloses a privacy security protection method based on multi-authority attribute encryption. The privacy security protection method specifically comprises the following steps: step 1, setting global parameters based on symmetric composite number order bilinear mapping; 2, setting a private key and a public key of an attribute authority k; 3, generating a secret key of an attribute in the access authority of the information receiver based on a threshold type access strategy; 4, encrypting the information sent by the information sender; and 5, when a certain information receiver needs to obtain the information sent by the information sender, the information receiver decrypts the ciphertext to obtain the related information. According to the encryption scheme provided by the invention, high-security decentration is realized on the basis of realizing efficient encryption and decryption.

A method for implementing fine-grained data access sharing in 6G network based on fog computing and cloud computing environment includes: (1) a security parameter is given for initialization; (2) each user is registered as a user with the said attribute authority AA; (3) a corresponding user private key is generated given a set of attributes S of a user; (4) an access policy is given by the owner of the data and data encryption is performed; (5) the user performs the data decryption process according to the embedded policy for the set of owned attributes in different environments; (6) the update key generation process is performed; (7) after receiving the private key update key from the attribute authority AA, the user updates the private key component associated with the revoked attribute in order to complete the private key update process; (8) upon receiving the ciphertext update key from the attribute authority AA, the cloud server updates the ciphertext component associated with the revocation attribute to complete the ciphertext update process.

This invention proposes a method for sharing traditional Chinese medicine (TCM) data based on attribute-based encryption and homomorphic encryption. The method includes an attribute authorization agency, TCM data owners, a blockchain, TCM data users, data user agents, and private key sharers. The attribute authorization agency is responsible for generating the homomorphic encryption public and private keys, attribute public and private keys, and verifying data compliance. The data owner encrypts the data using the homomorphic encryption public key and stores it on the blockchain after setting access policies using attribute-based encryption. When a data user initiates an access request, the data user agent verifies the user's access rights. Upon successful verification, a homomorphic operation is performed on the ciphertext. Subsequently, multiple private key sharers, who collaboratively manage fragments of the homomorphic private key, complete partial decryption. Finally, the TCM data user recovers the plaintext result. This method ensures that TCM data is usable but not visible through homomorphic encryption, achieves precise access control through attribute-based encryption, and reduces the risk of private key escrow through secret sharing.

The invention discloses an attribute-based strategy hiding and puncturing encryption method, which relates to the technical field of data encryption, and is characterized in that a user can autonomously update a secret key of the user, so that the user loses the decryption capability, and does not need to depend on a centralized secret key distribution mechanism. In the scheme, the seamless revocation of the decryption capability can be realized without deleting the key component in the key update. Besides, the scheme utilizes a block chain technology to verify an access policy by integrating an attribute authorization center into a consensus node, so that the calculation overhead is reduced. The invention further discloses an attribute-based strategy hiding and puncturing encryption system, the puncturing function is realized, the encryption scheme has forward security, and a user can actively cancel the key decryption function.

The invention provides an efficient access control method for supporting malicious authorization tracking and preventing collusion on a chain, and belongs to the technical field of information security, the method introduces a block chain to construct a plurality of attribute authorization centers, a central mechanism distributes an attribute set for the plurality of attribute authorization centers, and the attribute authorization centers are responsible for attribute authorization; the central mechanism only needs to manage issuing of attribute authorization authority, specific attribute authorization is completely realized by a plurality of authorization centers, and functions of the central mechanism are decomposed; malicious authorization of the attribute authorization center is tracked, and the malicious authorization center is revoked, so that the scheme authorization is ensured to be credible; in the authorization process of the authorization center, the secret keys mastered by the users are further segmented and randomized, so that part of the secret keys owned by the users are completely irrelevant to attributes, and the difficulty of collusion realization among the users is further increased; and the system calculation overhead is reduced by using outsourcing decryption and proxy re-encryption.

The present application relates to a data encryption method, in particular to a multi-center attribute-based encryption method supporting privacy protection for a smart medical system, a computer readable storage medium and equipment, which is used to solve the defects of single authorization center, insecure sensitive information, key abuse, and inability to guarantee the confidentiality and integrity of data based on attribute-based encryption technology in the smart medical system. The multi-center attribute-based encryption method uses the decentralized characteristics of the block chain, adopts multiple accounting nodes BN θ as a plurality of attribute authorization agencies to distribute keys, effectively avoiding the single point bottleneck problem; at the same time, the consensus node generates an anonymous identity certificate AIC for the data user DU to protect the sensitive information of the data user DU from being leaked. The present application can accurately track and revoke malicious data users DU, and can realize accountability to malicious data users DU and corrupt centers through tracking smart contracts.

The invention discloses a single sign-on access control method based on attribute encryption in cloud storage, and relates to the technical field of information security, and the method comprises the steps: S1, generating a system public parameter and a master key, and enabling an attribute authority to generate own public and private keys; s2, the user registers to an authentication server, and the authentication server issues a token to the user; s3, the authentication server generates a corresponding decryption key for each user; s4, the data owner formulates an access strategy, encrypts the message according to the access strategy and the system public parameters, calculates and uploads a ciphertext to the storage server; s5, the user sends a decryption request to the storage server, and a plaintext is obtained through decryption; s6, the attribute authority updates the ciphertext and the decryption key; the authentication server maintains a user revocation list. According to the method, dynamic fine-grained access control is realized on the premise that information such as user attributes is not leaked, the problem of privacy leakage caused by multiple times of registration of the user is relieved through a single sign-on method, and the method has high efficiency.

The invention discloses a fine-grained anonymous authentication method for a multi-attribute authoritative system. The multi-attribute authoritative anonymous authentication system comprises a central authority, a plurality of attribute authoritative, N users and M relying parties. When the multi-attribute authoritative system is initialized, the center authorizes to initialize public parameters and secret values; the attribute authority generates a secret value for each managed attribute and publishes public parameters, and it is proved that the secret value is held in a zero-knowledge proof mode; when the user joins in, an empty voucher is obtained from a central authority; the user sequentially searches the attribute authority to sign the voucher, and finally the voucher with multiple attributes is obtained; and when obtaining the service provided by the relying party, the user proves that the service has the required attribute to the relying party, and anonymous authentication is completed. According to the method, the secret value is generated and the public parameter is published for each attribute through the attribute authority, so that the problem that the user colludes with the untrusted attribute authority to counterfeit the attribute is solved, and the normal operation of anonymous authentication of the multi-attribute authority system is ensured.

The invention discloses a distributed supervision anonymous certificate method and system based on an attribute signature, and the method comprises the steps: a user submits an attribute application to a distributed attribute mechanism, and the attribute mechanism issues an attribute private key to the user through a chain type authorization method after the authentication is passed; the user submits a revocation right application to the supervision mechanism, and the supervision mechanism generates a revocation right for the user and publishes a certificate white list; the user uses the attribute private key and the revoked right to generate an anonymous certificate, and the anonymous certificate is shown to the verifier; the verifier verifies the attribute signature and certificate validity of the anonymous certificate; when a dispute occurs, the verifier can request arbitration, and the supervision mechanism recovers the real identity of the user or revokes the anonymous certificate of the user according to the dispute degree. Compared with the prior art, the anonymous certificate revocation method has the advantages that double decentration of the attribute mechanism and the supervision mechanism is realized, and the anonymous certificate revocation method is efficient.

The invention provides a data sharing encryption method and system supporting anonymity and attribute hiding, and relates to the field of data sharing, and the system comprises a central authority which is used for generating a public parameter based on a security parameter; the attribute authority is used for generating a public key and a private key of the attribute authority based on the public parameters, and anonymizing the data use end; the central authority is also used for distributing corresponding secret values to attributes in the access strategy matrix submitted by the data uploading end; the central authority and the attribute authority are also used for generating an attribute private key of the data use end; the data uploading end is also used for encrypting the plaintext message based on the public parameter and the public key of the attribute authority to generate a ciphertext; the data use end is further used for judging whether the attribute of the data use end meets the access strategy of the ciphertext or not based on the public parameters and the attribute private key of the data use end, and if yes, decrypted data are generated, and the data sharing method and device have the advantage that the flexibility and safety of data sharing are improved.

The application relates to a property access control method supporting multi-domain tracking and user management, and belongs to the field of information security.The method comprises the following steps: a property authorization center generates a unique identity according to user properties, and completes the registration of a new data user; a data owner encrypts plaintext data to obtain intermediate ciphertext; a cloud server performs re-encryption on the intermediate ciphertext; the property authorization center generates a property key and identifies a legal user and a malicious user among the registered new data users based on a conversion key; a proxy server performs initial decryption conversion on the re-encrypted ciphertext; a legal user uses a user private key to complete final decryption, and obtains plaintext data. The method aims to solve the technical problems that the prior art is difficult to realize multi-domain tracking under a multi-domain environment, is difficult to realize user revocation under the premise of considering forward and backward security, and is difficult to realize user addition under the premise of ensuring forward security.

The application discloses a policy hidden access control method and system based on a distributed cuckoo filter, and specifically comprises the following steps: based on system parameters, making each attribute authority generate a respective public-private key pair, and making the public key of the public-private key pair public to all entities; based on the system parameters, the public-private key pair and a user attribute set, generating a corresponding user key component; making a data owner generate a policy fingerprint and an attribute fingerprint according to an access policy, and encrypting a plaintext by using the system parameters, the public-private key pair and the access policy to obtain a ciphertext containing the policy fingerprint; reconstructing the access policy by using a policy row set, and decrypting and verifying the ciphertext in combination with the user key component. The application designs a distributed cuckoo filter to realize a completely hidden policy, and converts the access policy and attributes into fingerprint information tables stored in the DCF, thereby hiding the mapping between the policy and the attributes.

The invention belongs to the field of data security and access control, and particularly relates to a responsibility-questionable anonymous authentication method based on attribute encryption and a block chain technology. The invention provides a service access control method with anonymity and responsibility in combination with attribute encryption, a blacklist mechanism, zero-knowledge proof and a block chain technology. The system comprises a user, a service provider, an attribute authority, a tracking group, a block chain platform, an attribute management module, an anonymous authentication module and an accountability processing module. The service provider publishes service information and an access strategy to the block chain platform, the user obtains an attribute key through an attribute authority and generates anonymous authentication, and the block chain platform verifies the anonymous authentication through an intelligent contract; for a malicious user, a service provider can initiate a tracking request, and a tracking group collaboratively obtains the identity of the malicious user and updates a blacklist stored on a chain; the method effectively prevents the malicious user from accessing again while protecting the privacy of the user, and is suitable for decentralized identity management, access control, privacy protection and other scenes.

The invention discloses a strategy hidden access control method and system based on a distributed Cuckou filter, and the method specifically comprises the steps: enabling each attribute authorization mechanism to generate a public and private key pair based on system parameters, and enabling a public key of the public and private key pair to be public to all entities; generating a corresponding user key component based on the system parameters, the public and private key pair and the user attribute set; enabling a data owner to generate a strategy fingerprint and an attribute fingerprint according to an access strategy, and encrypting a plaintext by using a system parameter, a public and private key pair and the access strategy to obtain a ciphertext containing the strategy fingerprint; and reconstructing the access policy by using the policy row set, and decrypting and verifying the ciphertext in combination with the user key component. According to the method, a distributed Cuckou filter is designed to realize a completely hidden strategy, and an access strategy and attributes thereof are converted into mapping between the hidden strategy and the attributes in a fingerprint information table stored in a DCF through conversion.