36 results about "Attribute-based encryption" patented technology

The invention relates to the technical field of network and information security, in particular to a zero-trust multi-party security data exchange method, which comprises the following steps of: generating a zero-trust token and a capability authorization bill and constructing context description data; authentication encryption is performed on the plaintext fragment, attribute-based encryption is performed on the data one-time key, and a policy bearing ciphertext container is assembled; in the trusted execution environment, authentication decryption is completed through a one-time secret key of data recovery through joint challenge and threshold deblocking, or strategy migration and transfer are achieved through proxy re-encryption; and aggregating the decryption event and the forwarding event by vector commitment, generating a time anchor, and mapping the time anchor into a next round of random base. According to the invention, fine-grained authorization of the key layer, no plaintext transfer, event-level verifiable auditing and rapid revocation are realized.

Mechanisms are provided for computing resource access security in which a credential of a user agent is authenticated to determine if the user agent is associated with an entity for which an attribute based encryption (ABE) key is to be generated. If so, an ABE key is generated and provided which corresponds to a set of attributes of the entity. Token issuance logic receives a token request and the ABE key from a relying party computing device and executes a decryption operation on locking metadata associated with at least one attribute value based on the ABE key. The token issuance logic, in response to the decryption operation successfully decrypting the locking metadata, issues a generated token to the relying party computing device based on the at least one attribute value. The relying party computing device accesses the computing resources using the generated token.

The invention discloses an engineering building BIM (Building Information Modeling) data security management method, which comprises the following steps of: 1, embedding authority parameters into BIM model metadata through an attribute-based encryption algorithm; 2, deploying a permission management smart contract in an alliance chain, when project management triggers a stage change event, automatically calling the permission matrix generated in the step 1 by the smart contract, calling a BIMBase platform API to obtain a latest model version, recalculating the permission matrix, verifying the identity of an operator, and distributing an encrypted new permission set to related nodes; 3, constructing an auditing module containing a three-party alliance chain, and performing auditing confirmation within 5 seconds by adopting an improved PBFT consensus algorithm; a BIM event log visual interface is developed, and multi-dimensional retrieval according to roles, time and operation types is supported; 4, constructing an anomaly detection module of the LSTM-CNN hybrid model; constructing a normal behavior baseline model through transfer learning; when continuous three times of baseline deviation operation are detected, the module automatically triggers a three-level response mechanism.

The present disclosure provides a method for selectively encrypting and decrypting portions of a document. The method includes receiving a document containing plaintext, analyzing the document using an artificial intelligence system to identify portions containing sensitive information, assigning predefined security levels or attributes to the identified portions, sending an encrypt file content request to a cryptographic engine, receiving an encrypted file content response, building an encrypted document by replacing portions with masking symbols and storing encrypted portions as metadata, and sending the encrypted document to a client device. The artificial intelligence system uses machine learning models trained on domain-specific data and employs pattern recognition and contextual analysis to identify sensitive content based on semantic understanding and classification rules.

To provide an attribute-based encryption system and method for selectively encrypting and decrypting portions of documents based on user attributes in order to protect document content.SOLUTION: A document encryption method comprises: receiving, by a document security manager, a digital document containing original text and image content; processing the original text content to identify each of text portions and image portions; generating encrypt content requests including the identified text and image portions with associated attributes and metadata; transmitting the requests to a cryptographic engine, which returns encrypted content; receiving the encrypted content from the cryptographic engine; and replacing original content with masking symbols, applying visual obfuscation, embedding the encrypted content as metadata, and updating document properties to indicate the encrypted content.SELECTED DRAWING: Figure 12

The invention relates to systems, methods, network devices, and machine-readable media for encrypting and decrypting messages in a decentralized multi-authority attribute-based encryption (MA-ABE) scheme for access structures described by monotone LSSS under the decisional bilinear Diffie-Hellman assumptions. The construction can also be modified to obtain an MA-ABE scheme under computational bilinear Diffie-Hellman assumptions.

The invention relates to the technical field of block chains, in particular to a lightweight block chain encryption method based on hybrid encryption, and the method comprises the following steps: S1, carrying out the encryption of transaction data in a block chain through employing a lightweight symmetric encryption algorithm, and generating encrypted transaction data; s2, using an asymmetric encryption algorithm and an anti-quantum encryption algorithm to cooperatively encrypt a key of the lightweight symmetric encryption algorithm in the S1 to generate an encrypted key; s3, carrying out signature processing on the encrypted transaction data and the encryption key by adopting a lightweight digital signature algorithm to generate signature information; and S4, setting access authority for the encrypted transaction data by adopting an attribute-based encryption algorithm. According to the invention, the transaction data is encrypted by adopting the lightweight symmetric encryption algorithm, so that the problem that the application is limited in the resource limited scene such as lightweight equipment due to the fact that most of the traditional block chain encryption methods adopt a single encryption mechanism is solved.

Provided is an information disclosure method for disclosing transaction information in an information disclosure system that includes a transmission terminal and a verification terminal, wherein the information disclosure method includes: an encrypted VC generation step in which the transmission terminal generates an encrypted item, from a transaction VC which includes items (hereinafter referred to as transaction items) related to one or more pieces of transaction information, by using an encryption key of an attribute-based encryption for each transaction item to encrypt the transaction item and a conditional expression input by a sender with respect to said transaction item, and generates an encrypted VC which includes one or more encrypted items; and an encrypted VC decryption step in which the verification terminal generates a decrypted VC by using a decryption key of the attribute-based encryption to decrypt each encrypted item included in the encrypted VC. In the encrypted VC decryption step, if attribute information included in the decryption key for each encrypted item satisfies the conditional expression included in the relevant encrypted item, a transaction item corresponding to the encrypted item is acquired, and a decrypted VC which includes the acquired transaction item is generated.

An IoT device according to an embodiment encrypts IoT data using a peripheral device and transmits the IoT data to a server, and a user device requests and obtains necessary IoT data from the server, thereby achieving real-time IoT data sharing. The IoT device performs only relatively low-performance operation of attribute-based encryption to encrypt IoT data collected through a sensor and outsources the remaining high-performance operations of attribute-based encryption to the peripheral device providing external communication network connection to the IoT device to generate a final ciphertext. A user device generates an attribute bloom filter using an access policy thereof, requests and obtains IoT data encrypted according to attribute-based encryption. A cloud server receives and stores IoT data encrypted by the IoT device and the peripheral device according to attribute-based encryption and transmits IoT data retrieved using the attribute bloom filter as a query to the user device.

The present application relates to the technical field of network and information security, and particularly relates to a zero-trust multi-party secure data exchange method, which comprises the following steps: generating a zero-trust token and a capability authorization ticket and constructing context description data; performing authentication encryption on plaintext fragments and performing attribute-based encryption on data one-time keys to assemble a policy-carrying ciphertext container; in a trusted execution environment, recovering the data one-time key through joint challenge and threshold unsealing to complete authentication decryption, or realizing policy migration and transfer through proxy re-encryption; and aggregating the decryption and transfer events into a vector commitment and generating a time anchor, which is mapped into a next round of random base. The present application realizes fine-grained authorization at the key layer, plaintext-free transfer, event-level verifiable audit and fast revocation.

The application relates to a kind of attribute-based encryption-based differentiated permission access control methods, and belongs to the field of attribute cryptography and access control technology.The application adopts hybrid encryption mechanism, encrypts shared data using symmetric encryption system, and encrypts symmetric key using attribute-based encryption system, and only when the key associated attributes of a user meet the access control policy, the user can decrypt to obtain the symmetric key, and then decrypt to obtain the shared data plaintext using the symmetric key.In order to ensure the integrity and non-repudiation of shared data, the private key of the data owner is used for signing while the data owner generates the ciphertext.By using symmetric encryption mechanism and attribute-based encryption system, attribute-based, fine-grained permission control is realized, and the encryption and decryption efficiency of data is ensured.

Ciphertext conversion system (100), comprising: a conversion key generating device (600), comprising a conversion target setting unit (603) for generating an attribute-based encryption key and an attribute-based ciphertext that is encrypted with the attribute-based encryption key according to an attribute-based encryption scheme; and a conversion key generation unit (604) for generating a conversion key that converts a first common-key ciphertext into a second common-key ciphertext, which is a ciphertext that conforms to a first common-key cryptographic scheme and is different from the first common-key ciphertext, based on a first cryptographic common-key information used in generating the first common-key ciphertext, by encrypting a plaintext with a first secret key according to the first common-key cryptographic scheme, and to generate a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key, which is used to decrypt the second common-key ciphertext, with the attribute-based encryption key.

A method for facilitating granted access to protected resources associated with a service provider (SP). The method begins with the SP establishing a root of trust for a third party via a set of attribute-based encryption (ABE) master secret key and one or more common parameters. Once reviewed by the entity, the SP receives a binary object from the third party that encodes the policy as a cryptographic payload. When a client application desires to register with and interoperate with a service provider, the SP receives a request for credentials. The request has an associated (ABE) user key generated by a third party according to a policy. The service provider determines whether the binary object obtained during the initial review process can be decrypted using the ABE user key and the common parameter as well as the ABE user key. If so, and assuming that it has obtained any other necessary permission, the service provider issues the credential to the client application.

A data distribution system that distributes an encrypted data from a transmitting device to a receiving device via a relay device with support by a key issuing device, wherein the key issuing device is configured to generate public parameters for ElGamal encryption and a secret key for attribute-based encryption, send the public parameters to the transmitting device and keep the secret key; and the transmitting device is configured to encrypt data by the public parameters, create a user defined policy for each data ID, attach the defined policy for the corresponding data ID to the encrypted data and send the encrypted data with the user defined policy to the relay device.

The workload on the data transmission device is reduced. [Solution] A data distribution system that distributes encrypted data from a transmitting device to a receiving device via a relay device with the support of a key issuing device, wherein the key issuing device is configured to generate public parameters for ElGamal encryption and a private key for attribute-based encryption, transmit the public parameters to the transmitting device, and retain the private key, and the transmitting device is configured to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and transmit the encrypted data together with the user-defined policy to the relay device.

The present disclosure a method for a lattice-based homomorphic proxy re-encryption scheme. Conventional methods are attribute based and the attribute-based encryption schemes employ very expensive operations and generate long ciphertexts and secret keys (whose sizes also increase linearly with the size of the access policy), which makes them hard to implement in real-life applications. The present disclosure provides a unidirectional, single-hop HPRE scheme from the Learning With Errors (LWE) assumption which is Chosen Plaintext Attack (CPA) secure. Further, the present disclosure is based on the widely accepted BGV algorithm that supports both levelled FHE operations as well as arbitrary number of ciphertexts with unique and secure re-encryption key generation. Further, the present disclosure provides batch evaluation of ciphertexts, in order to enable re-encryption and evaluation of multiple ciphertexts.

The present disclosure provides a method for creating a ciphertext having a relatively smaller size that is compatible with pre-existing attribute-based encryption (ABE) schemes. The method includes receiving a plaintext message and ABE attributes, executing a set-up procedure to generate a master public-private key pair, and executing an encryption procedure. The set-up procedure involves sampling random learning with errors (LWE) matrices, establishing a gadget trapdoor, and computing matrices for the master public key. The encryption procedure generates the ciphertext from an LWE sample for a concatenation of matrices based on the ABE attributes. The method further includes storing the ciphertext and transmitting it to a recipient device over a communication network. The ciphertext has a reduced size compared to ciphertexts generated by pre-existing ABE schemes while maintaining compatibility.

The application discloses an engineering building BIM data security management method, comprising the following steps: step one: embedding a permission parameter into BIM model metadata through an attribute-based encryption algorithm; step two: deploying a permission management smart contract on a consortium chain, when a project management triggers a phase change event, the smart contract automatically calls the permission matrix generated in step one, calls a BIMBase platform API to obtain the latest model version, recalculates the permission matrix, verifies the identity of an operation party, and distributes the encrypted new permission set to relevant nodes; step three: building a three-party consortium chain audit module and adopting an improved PBFT consensus algorithm to perform audit confirmation within 5 seconds; developing a BIM event log visualization interface, and supporting multi-dimensional retrieval according to roles, time and operation types; and step four: building an abnormality detection module of an LSTM-CNN hybrid model; building a normal behavior baseline model through transfer learning; when it is detected that an operation deviates from the baseline for three times in succession, the module automatically triggers a three-level response mechanism.

An encryption unit (403) that an encryption apparatus (400) includes, when a user secret key SKΓ is generated using a secret key MSK of attribute based encryption and a set of attributes Γ corresponding to a decryption-possible condition L, generates a key K and a ciphertext P corresponding to the key K by encrypting the decryption-possible condition L using, as an encryption key of the attribute based encryption, a key PK consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post quantum cryptography, regards a part of the ciphertext P where the decryption-possible condition L is encrypted based on a secret value as P-D, regards a part of the ciphertext P where the secret value that is shared is encrypted as P-SS, and generates K′ and P′-D by randomizing each of the key K and the P-D using a random number R, and generates a ciphertext C by encrypting data consisting of the P-D and the random number R using the public key PQCPK. Here, the P-SS, the P′-D, and the K′ are decryption-possible verification parameters corresponding to the user secret key SKΓ.

The invention relates to the technical field of information security, in particular to a voice text and other multi-mode data encryption and decryption method and device. The method comprises the following steps: decomposing a medical record containing multiple data types into independent composition modes; for each mode, using a unique and disposable symmetric key to encrypt large-volume data of the mode through a symmetric algorithm; defining an independent attribute-based access strategy for each mode, and encrypting a corresponding symmetric key by using a ciphertext strategy based on an attribute-based encryption scheme; and packaging the symmetric ciphertexts of all the modes and the corresponding encrypted symmetric keys into a structured multi-mode encryption container. The apparatus includes a plurality of functional modules for performing encryption and decryption steps. According to the scheme, the user can only decrypt the symmetric key corresponding to the data mode of which the authority meets the access strategy by virtue of the attribute private key, so that the problems of coarse access control granularity, high calculation overhead and easiness in leakage of strategy privacy in the prior art can be effectively solved.

A method, system, and computer program product are configured to: receive a telemetry message in a telemetry pipeline; determine a classification of the telemetry message; select, based on the classification of the telemetry message, an attribute-based encryption (ABE) ciphertext from plural different ABE ciphertexts, wherein each respective one of the plural different ABE ciphertexts is encoded with a respective data sovereignty policy; attach the ABE ciphertext to the telemetry message; and forward the telemetry message with the ABE ciphertext to a data sovereignty gateway.

The invention discloses a cross-chain data transmission method and system, and relates to the technical field of block chains, the cross-chain data transmission method is applied to a data owning end, and the method comprises the following steps: generating a corresponding linear key matrix according to an access strategy of each attribute; encrypting to-be-transmitted data according to a security vector set and the linear key matrix to obtain a target encrypted ciphertext; and sending the target encrypted ciphertext to a main chain, and storing the target encrypted ciphertext to a target storage position through the main chain, so that a data use end obtains the target encrypted ciphertext through a relay chain and a parallel chain. A block chain in a data transmission system is divided into a main chain, a parallel chain and a relay chain. According to the method, the block chain network data is acquired, then the data is stored in the distributed storage network, and finally, an attribute-based encryption algorithm is used for resisting quantum attacks to ensure data security in a transmission process, so that the overall execution efficiency, the computing performance and the system security of block chain network data transmission are improved.

The invention discloses an electronic license security protection method and system based on a block chain, and a storage medium, and belongs to the field of electronic license security. According to the method, an attribute-based encryption technology is utilized for privacy protection of the electronic license, good access control is provided for an electronic license library, meanwhile, indexes are stored by utilizing a block chain technology, sharing and acquisition of data are realized by utilizing an intelligent contract, user revocation is realized by changing version permission, and the privacy of the user is effectively prevented from being leaked; the electronic certificate credibility verification is combined with a cryptographic algorithm and a high-robustness watermarking algorithm, an electronic certificate sharing certificate storage process is designed, an electronic certificate credibility verification framework is constructed, and three-party credibility verification of the electronic certificate is ensured.

A system, method and computer program product are configured to: receive, at a telemetry backend, a request for telemetry data from a user, the request including an attribute-based encryption (ABE) ciphertext associated with the user; attempt to decrypt the ABE ciphertext using plural different ABE decryption keys; successfully decrypt the ABE ciphertext using a respective one of the plural different ABE decryption keys; and based on the successfully decrypting the ABE ciphertext using the respective one of the plural different ABE decryption keys, provide the user with access to telemetry data stored in a respective one of plural storage partitions associated with the respective one of the plural different ABE decryption keys, wherein the telemetry data stored in the respective one of plural storage partitions includes the telemetry data requested by the user.

The application discloses a cross-chain data transmission method and system, relates to the technical field of blockchains, and applies to a data possession end. The method comprises the following steps: generating a corresponding linear key matrix according to an access strategy of each attribute; encrypting to-be-transmitted data according to a security vector set and the linear key matrix to obtain target encrypted ciphertext; sending the target encrypted ciphertext to a main chain, and storing the target encrypted ciphertext to a target storage position through the main chain, so that a data user end obtains the target encrypted ciphertext through a relay chain and a parallel chain. The blockchains in the data transmission system are divided into the main chain, the parallel chain and the relay chain. Then, data is stored on a distributed storage network. Finally, an attribute-based encryption algorithm is used to resist quantum attacks and ensure the safety of data in the transmission process, so that the overall execution efficiency, the computing performance and the system safety of the blockchain network data transmission are improved.

The present disclosure provides a method for key-policy attribute-based encryption. The method includes receiving a message to be encrypted, a master public key, and a set of attributes. A random integer s is sampled between 1 and a prime integer p, where p is established by a pairing-friendly curve comprising three groups of two source groups and one target group. Every attribute in the set is hashed to a first source group of the pairing-friendly curve and multiplied by s to generate a set of attribute encodings. A target group element in the master public key is multiplied by s to generate a blinding factor. The message is masked with the blinding factor. A ciphertext is computed comprising the masked message, the set of attributes, the set of attribute encodings, and an encoding of s in a second source group of the pairing-friendly curve. The ciphertext is then outputted.

Mechanisms are provided for computing resource access security in which credentials of a user agent are authenticated to determine whether the user agent is associated with an entity for which an attribute-based encryption (ABE) key is to be generated. If associated, an ABE key is generated and provided that corresponds to the set of attributes of the entity. The token publishing logic receives a token request and an ABE key from the relying computing device, and performs a decryption operation on lock metadata associated with the at least one attribute value based on the ABE key. The token publishing logic publishes the generated token to the relying computing device based on the at least one attribute value in response to the decryption operation successfully decrypting the lock metadata. The relying computing device uses the generated token to access the computing resource.

A method, system, and computer program product are configured to: receive a telemetry message in a telemetry pipeline; determine a classification of the telemetry message; select, based on the classification of the telemetry message, an attribute-based encryption (ABE) ciphertext from plural different ABE ciphertexts, wherein each respective one of the plural different ABE ciphertexts is encoded with a respective data sovereignty policy; attach the ABE ciphertext to the telemetry message; and forward the telemetry message with the ABE ciphertext to a data sovereignty gateway.

An attribute based encryption system includes a key generator configured to generate a cyclic group (G) having a prime order q; generate an attribute key matrix (M); generate a master public key (MPK) based, at least in part, on the group (G) and (M); generate a master secret key (MSK) based on a first vector s and a second vector t that represent an encryption policy; generate a user secret key based, at least in part, on the MSK and on a set of one or more user attributes; and send the user secret key to a user device, wherein a ciphertext message can be successfully decrypted if a vector y associated with attributes of the user associated with the user secret key is orthogonal to each row of a set of rows of M selected according to a set of authorization attributes used to encrypt the ciphertext message.