CN107154845A

CN107154845A - A kind of BGN types ciphertext decryption outsourcing scheme based on attribute

Info

Publication number: CN107154845A
Application number: CN201710233091.7A
Authority: CN
Inventors: 张薇; 李镇林; 杨晓元; 周潭平; 张帅伟; 张敏情; 韩益亮; 薛帅
Original assignee: Engineering University of Chinese Peoples Armed Police Force
Current assignee: Engineering University of Chinese Peoples Armed Police Force
Priority date: 2017-04-11
Filing date: 2017-04-11
Publication date: 2017-09-12
Anticipated expiration: 2037-04-11
Also published as: CN107154845B

Abstract

Outsourcing scheme is decrypted present invention relates particularly to a kind of BGN types ciphertext based on attribute, is comprised the following steps：(1) initialization system parameter, produces encryption key；(2) sender-selected access structure, to message encryption, generates ciphertext；(3) recipient's input master key and attribute, output transition key and private key；(4) sending direction high in the clouds sends ciphertext；(5) receive direction high in the clouds and send transition key；(6) high in the clouds carries out being converted to part ciphertext and is sent to recipient using transition key to ciphertext；(7) part ciphertext is decrypted using private key by recipient, obtains message；Also include high in the clouds between step (4) and step (5) and operating procedure is calculated to the homomorphism of ciphertext.This outsourcing decryption scheme not only increases the decryption efficiency of system, reduces the storage overhead of recipient；The ciphertext that encryption method according to this programme is obtained, can allow server that ciphertext data are carried out with multiple additive homomorphism and a multiplicative homomorphic operation, in the case where not increasing decryption difficulty, greatly improve the CPA securities of user profile.

Description

A kind of BGN types ciphertext decryption outsourcing scheme based on attribute

Technical field

The invention belongs to field of information security technology, and in particular to a kind of BGN types ciphertext decryption outsourcing side based on attribute Case.

Background technology

The proposition of cloud computing concept, has brought the development of information industry into fast traffic lane.Cloud service is providing the user with magnanimity Storage service and powerful computing capability while, also promoted expanding economy, public cloud is mainly by the incredible 3rd Square service provider safeguards and run that the safety problem of cloud computing association also increasingly highlights.The safety problem of cloud is considered as Cloud service practical application faces challenge maximum in many difficulties, is also cloud service the biggest problem urgently to be resolved hurrily.If user Sensitive data is saved in by Cloud Server with plaintext version, because these information may be replicated or even distorted in high in the clouds, and user The unauthorized behavior in high in the clouds can not be learnt at all, so that imponderable loss is caused, so cloud is unconditionally to be trusted 's.In order to prevent the malice of sensitive data from revealing and unauthorized access, user can carry out outsourcing with ciphertext form to data.

Traditional cloud computing encryption and decryption model, it is impossible to realize the fine-granularity access control to result of calculation.Shamir exists Identity based encryption is proposed within 1984, the public key of user is, by the unique mark generation related to its identity, to be taken during access Business device end need not inquire about the public key certificate of user again.Encryption based on attribute is proposed by Sahai and Waters, can be regarded as Popularization to Identity based encryption, in this encryption system, key and ciphertext and the Attribute Association of user are got up, and are only belonged to During sexual satisfaction access control policy, the legal decryption of user's ability, it is achieved thereby that to the fine-granularity access control of ciphertext.

In the encryption system based on attribute, the key and ciphertext of user are respectively associated descriptive attributes collection and access plan Slightly.Only associated attribute and access strategy is mutually matched, and a specific key can decrypt a specific ciphertext. At present, there are two kinds of encryption methods based on attribute to be suggested, include the encryption (KP-ABE) based on attribute of key strategy With the encryption (CP-ABE) based on attribute of Ciphertext policy.In KP-ABE, access strategy is embedded in private key, and in CP- In ABE, access strategy is embedded in ciphertext.Encryption ABE based on attribute provides a kind of safe mode so that data are gathered around The person of having shares outer bag data on incredible server, rather than is carried out in the trusted servers for have specific user.This One advantage make it that this methods of ABE are popular in cloud storage, because cloud storage need to be a large number of users for belonging to different tissues The access control of safety is provided.

Nevertheless, the encryption ABE based on attribute but has a main defect, i.e. key distribution and decrypted in efficiency The calculation cost in stage can increase with the growth of the complexity of access module.With access the time required to ciphertext size and decryption The complexity of formula and increase, this is undoubtedly individual huge challenge for resource-constrained mobile subscriber.In order to ensure that distal end is provided The limited mobile subscriber in source also can safely and efficiently be decrypted, and this concept of the ABE of outsourcing is suggested, and it make it that encryption and decryption can be with It is contracted out to third party service provider.The core of ABE decryption outsourcings is exactly to change encryption key generating algorithms, generates two keys, one Individual is the short ElGamal keys preserved by user, and one is Distorted Key TK.Ciphertext CT for meeting access function, can So that CT to be first converted into simple and short and small ElGamal ciphertexts CT ' using TK beyond the clouds.User only needs to a simple index Computing can be carried out decryption.This outsourcing decrypts scheme compared to traditional encipherment scheme based on attribute, improves system Decryption efficiency, reduce the storage overhead of recipient.However, to the decryption of ciphertext, some is by high in the clouds in this scheme Carry out, this requires that external packet server is trusted, and ciphertext, transition key TK have the possibility illegally read.

Therefore, design a kind of can not only improve and decrypt Information Security in sub-contract management, while not increasing user's solution again The ciphertext decryption outsourcing scheme of close difficulty has important value.

The content of the invention

In order to which the decryption outsourcing scheme for improving CP-ABE schemes in the prior art decrypts Information Security in sub-contract management, together When do not increase user's decryption difficulty again, decrypt outsourcing scheme the invention provides a kind of BGN types ciphertext based on attribute.The present invention Outsourcing scheme is decrypted there is provided the BGN types ciphertext based on attribute, the ciphertext obtained according to the encryption method of this programme can allow clothes Device be engaged in the multiple additive homomorphism of ciphertext data progress and a multiplicative homomorphic operation, so as to not increase the same of user's decryption difficulty When greatly improve the CPA securities of user profile.

The technical problem to be solved in the present invention is achieved through the following technical solutions：

A kind of BGN types ciphertext decryption outsourcing scheme based on attribute, comprises the following steps：

Step (1)：Initialization system parameter, produces encryption key, master key MSK and public key PK；

Step (2)：A sender-selected access structure, message is encrypted, and export ciphertext CT；

Step (3)：Recipient inputs master key MSK and attribute S, randomly chooses parameter, output transition key TK and private key SK；

Step (4)：Sender sends ciphertext data CT by overt channel to high in the clouds；

Step (5)：Receive direction high in the clouds and send transition key TK；

Step (6)：High in the clouds carries out conversion calculating to ciphertext CT using transition key TK and obtains part ciphertext CT ', and by institute State part ciphertext CT ' and be sent to recipient；

Step (7)：Part ciphertext CT ' is decrypted using private key SK by recipient, obtains message；

Also include high in the clouds between the step (4) and step (5) and operating procedure is calculated to the homomorphism of ciphertext.

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (1) tool Body is：

Step (1-1)：Initialization system parameter, inputs security parameter λ and attribute space U, wherein U={ 0,1 }^*；

Step (1-2)：Algorithm ξ (λ) is run, tuple (q is obtained₁,q₂,G,G₁, e) with bilinear map e:G×G→G₁, its In, q₁,q₂For prime number, G, G₁All it is that rank is n=q₁q₂Group；

Step (1-3)：Random selection generation member k, the u in group G, and makeThen h is crowd G q1 ranks subgroup generation Member, then randomly choose Groups of Prime Orders G ' and G ' that rank is p_T, the generation member that g is group G ' is made, bilinear map e ' is obtained:G′ ×G′→G′_T；

Step (1-4)：Random selection is by { 0,1 }^*It is mapped to G ' hash function F and by G '_TIt is mapped to the Hash of (0,1) Function, randomly chooses factor alpha, a ∈ Z_p, Z_pAs mould p integer field, then the master key of algorithm be expressed as：MSK=(g^α,PK)； Public key is expressed as：PK=(n, g, k, h, e, e ' (g, g)^α,g^a,F,H,G,G₁)。

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (2) tool Body is：

Step (2-1)：Sender-selected LSSS access structures (M, ρ), wherein, M is a l × n relevant with attribute Matrix, ρ is the row element M with M_iRelated function, i=1,2 ..., l；

Step (2-2)：Randomly choose n Z_pIn element (s, y₂... ..., y_n)∈Z_p, composition of vector v, v=(s, y₂... ..., y_n), wherein, s is privacy sharing parameter, calculates λ_i=M_iV, wherein, M_iBe M the i-th row element constituted to Amount, then randomly choose l+1 Z_pIn element (R, r₁... ..., r_l)∈Z_p, ciphertext CT is exported, ciphertext CT includes three below portion Point：

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (3) tool Body is：

Step (3-1)：Recipient inputs master key MSK and attribute S, random selection t ' ∈ Z_p, output

SK '=(PK, K '=g^αg^at′, L '=g^t′,{K_x'=F (x)^t′}_x∈S)

Step (3-2)：Randomly choose z ∈ Z_p, and t=t '/z is made, obtain the private key SK of transition key TK and recipient：

TK is：

SK is：SK=(q₁,z)。

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (6) tool Body is：

Step (6-1)：The transition key TK that high in the clouds is sent using recipient carries out conversion calculating to ciphertext CT, works as recipient Attribute S be unsatisfactory for access structure (M, ρ), then high in the clouds output ⊥, system is out of service；

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i：ρ(i)∈ S }, then there is constant collection { ω_i∈Z_p}_i∈I, for { λ_iIn all values, calculate ∑_i∈Iω_iλ_i=s can recover secret Shared parameter s, and then transfer algorithm calculating is run, part ciphertext CT ' is obtained,

The transfer algorithm is calculated：

Step (6-2)：High in the clouds is to recipient's returning part ciphertext CT '=(c, Q).

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (7) tool Body is：

Step (7-1)：Recipient input private key SK=(q₁, z) and part ciphertext CT ', utilize (z, Q) calculate e ' (g, g)^sα=Q^z；

Step (7-2)：Recipient recycles part private key q₁Calculate

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of forIt is discrete Logarithm, you can obtain clear-text message m.

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, the homomorphism calculates behaviour It is the operation of additive homomorphism at least one times and the operation of most multiplicative homomorphics to make step.

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (4)：Sender Sent by overt channel to high in the clouds after ciphertext data CT, it is addition at least one times that high in the clouds calculates operating procedure to the homomorphism of ciphertext Homomorphism is operated,

High in the clouds receives ciphertext packet and contains c1 and c2：

WithCalculate

Then the ciphertext after additive homomorphism is calculated is：

C=g^s,

Step (5)：Receive direction high in the clouds and send transition key TK；

Step (6)：Ciphertext after high in the clouds is operated using transition key TK to additive homomorphism carries out conversion calculating, and by part Ciphertext is sent to recipient, and step (6) detailed process is as follows：

Step (6-1)：The transition key TK that high in the clouds is sent using recipient carries out conversion calculating to ciphertext,

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i：ρ(i)∈ S }, then there is constant collection { ω_i∈Z_p}_i∈I, calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing turns Scaling method is calculated, and obtains part ciphertext,

The transfer algorithm is calculated：

Step (6-2)：High in the clouds is to recipient's returning part ciphertext CT '=(c, Q)；

Step (7)：Part ciphertext CT ' is decrypted using private key SK by recipient, and step (7) detailed process is as follows：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an index Computing, calculates e ' (g, g)^sα=Q^z, obtain e ' (g, g)^sα, so as to obtain H (e ' (g, g)^sα) value；

Step (7-2)：Recipient recycles part private key q₁Calculate：

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of forIt is discrete right Number, you can obtain clear-text message m₁+m₂。

Because c ' ∈ G in the ciphertext obtained by an additive homomorphism, illustrate high in the clouds receive can be carried out after ciphertext CT it is many Sub-addition homomorphism is operated.

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, step (4)：Sender Sent by overt channel to high in the clouds after ciphertext data CT, it is a multiplicative homomorphic that high in the clouds calculates operating procedure to the homomorphism of ciphertext Operation,

Make k₁=e (k, k), h₁=e (k, h), then k1 rank is n, and h1 rank is q1, and necessarily has β ∈ Z so thatZ is limited integer field, is calculated

Then the ciphertext after a multiplicative homomorphic is calculated is：

C=g^s,

Step (5)：Receive direction high in the clouds and send transition key TK；

Step (6)：High in the clouds carries out conversion calculating using transition key TK to ciphertext, obtains part ciphertext, and by the portion Point ciphertext is sent to recipient, and step (6) detailed process is as follows：

Step (6-1)：The transition key TK that high in the clouds is sent using recipient carries out conversion calculating to ciphertext, when recipient's Attribute S meets access structure (M, ρ), definitionAnd meet I={ i:ρ (i) ∈ S }, then there is constant collection {ω_i∈Z_p}_i∈I, calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing transfer algorithm is calculated, and is obtained Part ciphertext CT ',

The transfer algorithm is calculated：

Step (7)：Part ciphertext CT ' is decrypted using private key SK by recipient, obtains message, step (7) specific mistake Journey is as follows：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an index Computing, that is, calculate e ' (g, g)^sα=Q^z, obtain e ' (g, g)^sα, so as to obtain H (e ' (g, g)^sα)²Value；

Step (7-2)：Recipient recycles part private key q₁Calculate：

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of for's Discrete logarithm, you can obtain clear-text message m₁m₂。

More specifically, in the BGN types ciphertext decryption outsourcing scheme of the present invention based on attribute, the random selection institute It is specially two Big prime q that 512bit sizes are randomly choosed using PRNG that the parameter of finger, which produces algorithm,₁、q₂, G, G₁All it is that rank is n=q₁q₂Group, e:G×G→G₁It is bilinear map.

The mathematical theory that the present invention is applied is made an explanation below：

" bilinear map " of the present invention is " Bilinear map ", refers to a kind of Function Mapping, and the element in group G is reflected It is mapped to crowd G_TIn, its implication is as follows：

G, G_TIt is the multiplicative cyclic group that two ranks are p, g is first for G generation, then bilinear map e:G×G→G_TUnder satisfaction Row property：

(1) bilinearity：To any u, k ∈ G and a, b ∈ Z_p, there is e (u^a,k^b)=e (u, k)^ab。

(2) non-degeneracy：There is u, k ∈ G so that e (u, k) ≠ 1.

(3) computability：There is efficient algorithm, to any u, k ∈ G, e (u, k) can be calculated.

Wherein, Z_pFor mould p integer field；

" access structure " of the present invention has following implication：

Assuming that { P₁,P₂,…,P_nBe privacy sharing participant's set, define P=2 { P₁,P₂,…,P_n, access structure Γ is { P₁,P₂,…,P_nNonvoid subset, i.e.,The monotonicity of access structure is defined as follows：If A ∈ Γ andThen B ∈ Γ.Meanwhile, the subset is called an authorized subset, it is impossible to which the subset for reconstructing shared secret is unauthorized son Collection.

" LSSS (Linear Secret Sharing Scheme) access structure " of the present invention has following implication：

One linear privacy sharing mechanism (Linear Secret for being defined on privacy sharing participant's set P Sharing Scheme, LSSS) Π refers to：

(1) share of all participants constitutes a Z_pOn vector.

(2) there is l × n matrix M, it is a shared generator matrix on Π.M the i-th row correspondent entity ρ (i), wherein i=1,2 ..., l, ρ are the mapping functions that P is arrived from { 1,2 ..., l }.Randomly choose column vectorWherein s is shared secret, then the l on the s shared compositions that Mv is obtained using Π Vector, and (Mv)_iBelong to entity ρ (i).

Linear reconstruction：Assuming that Π is a LSSS on access structure Γ, authorization set S ∈ Γ are made, I={ i are defined:ρ (i) ∈ S } andSo just it is bound to the presence of such a constant collection { w_i∈Z_p}_i∈ISo that ∑_i∈Iw_iM_i= (1,0 ..., 0) set up, so as to there is ∑_i∈Iw_iM_iV=s；And for unauthorized collection, then in the absence of such { w_i∈Z_p}_i∈I。

Beneficial effects of the present invention：

1st, in decryption outsourcing scheme of the invention, the ciphertext that information is produced in ciphering process includes three parts, wherein A part of ciphertext is embedded into BGN type ciphertexts, and server can be allowed to carry out multiple additive homomorphism to the part ciphertext and once multiply Method homomorphism operate, this result with directly to plaintext carry out same computing again by result encrypt；Therefore, to ciphertext Carry out after class homomorphism operation, can not only greatly promote Information Security, while not increasing the difficulty of user's decrypting process.

2nd, homomorphism calculates operation the operation such as can carry out, retrieve, compare in encryption data, draw correct result, And without data be decrypted in whole processing procedure, that is to say, that server is not required to read user's sensitive data just can be with Processing data information.

3rd, decryption outsourcing scheme of the invention utilizes bilinear map technology, and uses domestic hash function SM3 algorithms, will The security reduction of scheme is difficult it is assumed that having reached CPA safety to subgroup decision problem.

4th, in the access control of high in the clouds result of calculation, by adding the encryption method based on attribute, realizing to homomorphism The fine-granularity access control based on attribute of operation result decrypted rights；Access rule is specified by user, can be visited at any time The change of authority is asked, that is, shares generator matrix formula and message binds together generation ciphertext, it is possible to change at any time together The associated identity characteristic collection of generator matrix is enjoyed, and the private key of user is only related to identity characteristic collection.

5th, in terms of efficiency, under mobile cloud storage environment, user is embedded into BGN after property control is handled by Hash In type ciphertext, high in the clouds storage is uploaded to, then by ciphertext switch process, the part decryption of ciphertext is outsourced to high in the clouds and carried out, is protected The security of data beyond the clouds has been demonstrate,proved, on the premise of clear data is not revealed, by means of the powerful operational capability of outsourcing decryption agent, Accelerate decryption speed, reduce storage, the decryption expense of recipient, improve the decryption efficiency of system.

The present invention is described in further details below with reference to drawings and Examples.

Brief description of the drawings

Fig. 1 is the schematic flow sheet that BGN type ciphertext of the present invention based on attribute decrypts outsourcing scheme.

Embodiment

Reach technological means and effect that predetermined purpose is taken for the present invention is expanded on further, below in conjunction with accompanying drawing and reality Apply example as follows to embodiment of the invention, architectural feature detailed description.

Embodiment 1：BGN types ciphertext decryption outsourcing scheme based on attribute

BGN types ciphertext based on attribute decryption outsourcing scheme as shown in Figure 1, it is comprised the following steps that：

Step (1)：Initialization system parameter, produces encryption key, master key MSK and public key PK, step (1) detailed process is such as Under：

Step (1-1)：Initialization system parameter, inputs security parameter λ and attribute space U, wherein U={ 0,1 }^*；Inputted Security parameter λ value than larger, in the present embodiment, λ selection 1024bit sizes, it is sufficient to ensure the security of scheme.

Step (1-2)：Algorithm ξ (λ) is run, tuple (q is obtained₁, q₂, G, G₁, e) with bilinear map e:G×G→G₁, its In, q₁,q₂For prime number, G, G₁All it is that rank is n=q₁q₂Group；ξ (λ) is that disclosed parameter produces algorithm, q₁,q₂For Big prime, Q is selected in the present embodiment₁,q₂For the prime number of 512bit sizes.

Step (1-3)：Random selection generation member k, the u in group G, and makeThen h is crowd G q₁Rank subgroup is generated Member, then randomly choose Groups of Prime Orders G ' and G ' that rank is p_T, the generation member that g is group G ' is made, bilinear map e ' is obtained:G′ ×G′→G′_T。

Step (1-4)：Random selection is by { 0,1 }^*It is mapped to G ' hash function F and by G '_TIt is mapped to the Hash of (0,1) Function H, randomly chooses factor alpha, a ∈ Z_p, i.e. α, a randomly choose on mould p integer field, Z_pAs mould p integer field, then The master key of algorithm is expressed as：MSK=(g^α,PK)；

Public key is expressed as：PK=(n, g, k, h, e, e ' (g, g)^α,g^a,F,H,G,G₁)。

Hash function F and hash function H used in step (1) are disclosed domestic hash function SM3 algorithms.

Step (2)：A sender-selected access structure, message is encrypted, and generates ciphertext CT, step (2) tool Body process is as follows：

Step (2-1)：Sender-selected LSSS access structures (M, ρ), wherein, M is a l × n relevant with attribute Matrix, ρ is the row element M with M_iMatrix M every a line can be corresponded to the unitary of certain in access structure by related function, expression The mapping of element, i=1,2 ..., l.

Step (2-2)：Randomly choose n Z_pIn element (s, y₂... ..., y_n)∈Z_p, composition of vector v, v=(s, y₂... ..., y_n), wherein, s is privacy sharing parameter, calculates λ_i=M_iV, wherein, M_iBe M the i-th row element constituted to Amount, then randomly choose l+1 Z_pIn element (R, r₁... ..., r_l)∈Z_p, i.e., R is randomly choosed on mould p integer field, r₁,…,r_l, output ciphertext CT, CT include three below part：

Step (3)：Recipient inputs master key MSK and attribute S, selects random parameter, output transition key TK and private key SK, step (3) detailed process is as follows：

Step (3-1)：Recipient inputs master key MSK and attribute S, random selection t ' ∈ Z_p, output：

SK '=(PK, K '=g^αg^at′, L '=g^t′,{K_x'=F (x)^t′}_x∈S)。

SK=(q₁,z)。

Step (4)：Sender sends ciphertext data CT by overt channel to high in the clouds.

High in the clouds is received after the ciphertext data CT of sender's transmission；Homomorphism can be carried out to ciphertext and calculate operating procedure, together It is the operation of additive homomorphism at least one times and the operation of most multiplicative homomorphics that state, which calculates operating procedure,；High in the clouds receive according to this Obtained ciphertext CT, which is encrypted, in embodiment scheme includes three parts, and wherein Part I ciphertext c insertion BGN can allow clothes Device be engaged in the part multiple additive homomorphism of ciphertext progress and a multiplicative homomorphic operation.

Step (5)：Receive direction high in the clouds and send transition key TK.

Step (6)：High in the clouds carries out conversion calculating using transition key TK to ciphertext CT, obtains part ciphertext CT ', and by institute State part ciphertext CT ' and be sent to recipient, step (6) detailed process is as follows：

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i：ρ(i)∈ S }, i.e. then there is constant in all elements ρ (i) ∈ S by mapping the set that ρ () corresponds to matrix M rower i in property set S Collect { ω_i∈Z_p}_i∈ISo that ∑_i∈Iw_iM_i=(1,0 ..., 0) is set up, for { λ_iIn all values, { λ_iIt is secret s Live part, then calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing transfer algorithm is calculated, and is obtained Part ciphertext CT ',

The transfer algorithm is calculated：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an index Computing, that is, calculate e ' (g, g)^sα=Q^z。

Step (7-2)：Recipient recycles part private key q₁Calculate：

In the ciphertext decryption outsourcing scheme of the present embodiment, wherein, the operating main body of step (3) is recipient, with step (2) and step (4) is different, therefore the order of step (3) can be changed, step (3) not have to be in step (2) and step (4) between, as long as after step (1), before step (5).The parameter of " random selection " meaning in the present invention program It is specially two Big prime q that 512bit sizes are randomly choosed using pseudo-random generator to produce algorithm₁、q₂, G, G₁All it is that rank is N=q₁q₂Group, e:G×G→G₁It is bilinear map.PRNG is not specifically designated, if it can reach with The purpose of machine selection, as long as random selection can be realized, does not then produce influence to solution security.

Embodiment 2：BGN types ciphertext decryption outsourcing scheme based on attribute

Concrete scheme is as follows：

Step (1-2)：Algorithm ξ (λ) is run, tuple (q is obtained₁,q₂,G,G₁, e) with bilinear map e:G×G→G₁, its In, q₁,q₂For prime number, G, G₁All it is that rank is n=q₁q₂Group；ξ (λ) is that disclosed parameter produces algorithm, q₁,q₂For Big prime, Q is selected in the present embodiment₁,q₂For the prime number of 512bit sizes.

Step (1-3)：Random selection generation member k, the u in group G, and makeThen h is crowd G q₁Give birth to rank subgroup Cheng Yuan, then randomly choose Groups of Prime Orders G ' and G ' that rank is p_T, the generation member that g is group G ' is made, bilinear map e ' is obtained: G′×G′→G′_T。

Output public key is expressed as：PK=(n, g, k, h, e, e ' (g, g)^α,g^a,F,H,G,G₁)。

SK '=(PK, K '=g^αg^at′, L '=g^t′,{K_x'=F (x)^t′}_x∈S)。

SK=(q₁,z)。

High in the clouds is received after the ciphertext data CT of sender's transmission；Homomorphism can be carried out to ciphertext and calculate operating procedure, together It is the operation of additive homomorphism at least one times and the operation of most multiplicative homomorphics that state, which calculates operating procedure,.In the present embodiment, carry out Additive homomorphism operation：

High in the clouds receives ciphertext packet and contains c1 and c2：

WithCalculate

Ciphertext after additive homomorphism is calculated is：

C=g^s,

Because c ' ∈ G in the ciphertext obtained by additive homomorphism, illustrating that high in the clouds is received can carry out repeatedly adding after ciphertext CT Method homomorphism is operated.

Step (5)：Receive direction high in the clouds and send transition key TK.

Step (6)：Ciphertext after high in the clouds is operated using transition key TK to additive homomorphism carries out conversion calculating, obtains part Ciphertext CT ', and the part ciphertext CT ' is sent to recipient, step (6) detailed process is as follows：

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i: ρ (i) ∈ S }, Then there is constant collection { ω_i∈Z_p}_i∈I, for { λ_iIn all values, { λ i } is secret s live part, that is, calculates ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing transfer algorithm is calculated, and obtains part ciphertext CT ',

The transfer algorithm is calculated：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an index Computing, that is, calculate e ' (g, g)^sα=Q^z, obtain e ' (g, g)^sα, so as to obtain H (e ' (g, g)^sα) value.

Step (7-2)：Recipient recycles part private key q₁Calculate：

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of forIt is discrete Logarithm, you can obtain clear-text message m₁+m₂。

What high in the clouds was received obtained ciphertext CT is encrypted according to this embodiment scheme includes three parts, wherein first Part ciphertext c is embedded into BGN type ciphertexts, and server can be allowed to carry out multiple additive homomorphism operation to the part ciphertext, this Result with directly to plaintext carry out same computing again by result encrypt；Therefore, class homomorphism operation is carried out to ciphertext Afterwards, Information Security can be greatly promoted, while not increasing the difficulty of user's decrypting process.Because being obtained by additive homomorphism Ciphertext in c ' ∈ G, illustrate that high in the clouds can carry out multiple additive homomorphism operation after receiving ciphertext CT.

In the ciphertext decryption outsourcing scheme of the present embodiment, wherein, the operating main body of step (3) is recipient, with step (2) and step (4) is different, therefore the order of step (3) can be changed, step (3) not have to be in step (2) and step (4) between, as long as after step (1), before step (5).

It is specially random using pseudo-random generator that the parameter of " random selection " meaning in the present invention program, which produces algorithm, Select two Big prime q of 512bit sizes₁、q₂, G, G₁All it is that rank is n=q₁q₂Group, e:G×G→G₁It is bilinear map. PRNG is not specifically designated, as long as it can reach randomly selected purpose, as long as can realize random Selection, then do not produce influence to solution security.

Embodiment 3：BGN types ciphertext decryption outsourcing scheme based on attribute

Concrete scheme is as follows：

SK '=(PK, K '=g^αg^at′, L '=g^t′,{K_x'=F (x)^t′}_x∈S)。

SK=(q₁,z)。

High in the clouds is received after the ciphertext data CT of sender's transmission；Homomorphism can be carried out to ciphertext and calculate operating procedure, together It is the operation of additive homomorphism at least one times and the operation of most multiplicative homomorphics that state, which calculates operating procedure,.In the present embodiment, carry out Multiplicative homomorphic operation：

Make k₁=e (k, k), h₁=e (k, h), then k₁Rank be n, h₁Rank be q₁, and necessarily have β ∈ Z so thatZ is limited integer field, is calculated

By Ciphertext after multiplicative homomorphic is calculated is：

C=g^s,

C ' ∈ G1 in the ciphertext obtained by multiplicative homomorphic, due to causing e in the absence of efficient algorithm:G₁×G₁→ G is set up, So this programme can only carry out a multiplication.

Step (5)：Receive direction high in the clouds and send transition key TK.

Step (6)：High in the clouds carries out conversion calculating using transition key TK to ciphertext, obtains part ciphertext CT ', and will be described Part ciphertext CT ' is sent to recipient, and step (6) detailed process is as follows：

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i:ρ (i) ∈ S }, then there is constant collection { ω_i∈Z_p}_i∈I, for { λ_iIn all values, { λ_iBe secret s live part, then Calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing transfer algorithm is calculated, and obtains part ciphertext CT ',

The transfer algorithm is calculated：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an index Computing, that is, calculate e ' (g, g)^sα=Q^z, obtain e ' (g, g)^sα, so as to obtain H (e ' (g, g)^sα)²Value.

Step (7-2)：Recipient recycles part private key q₁Calculate：

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of forFrom Dissipate logarithm, you can obtain clear-text message m₁m₂。

According to embodiment 3, what high in the clouds was received obtained ciphertext CT is encrypted according to this embodiment scheme includes three Part, wherein Part I ciphertext c are embedded into BGN type ciphertexts, and server can be allowed to carry out a multiplication to the part ciphertext Homomorphism operate, this result with directly to plaintext carry out same computing again by result encrypt；Therefore, ciphertext is entered After the operation of row class homomorphism, Information Security can be greatly promoted, while not increasing the difficulty of user's decrypting process.

Under mobile cloud storage environment, user is embedded into BGN type ciphertexts after property control is handled by Hash, on High in the clouds storage is passed to, then by ciphertext switch process, the part decryption of ciphertext is outsourced to high in the clouds and carried out, it is ensured that data are in cloud The security at end, on the premise of clear data is not revealed, by means of the powerful operational capability of outsourcing decryption agent, accelerates decryption speed Degree, reduces storage, the decryption expense of recipient, improves the decryption efficiency of system.

Embodiment 4：Security to the BGN types ciphertext decryption outsourcing scheme of the present invention is illustrated

The security of the present invention program is built upon opponent's algorithm Α and can not broken through on the basis of the hypothesis of subgroup decision problem. Assuming that there is a certain algorithm Β can break through the semantic security of this programme with advantage ε, then just certainly exist opponent's algorithm Α Subgroup decision problem can be solved with advantage ε to assume.Detailed proof procedure is as follows：

(1) opponent's algorithm Α randomly chooses g ∈ G, by public key (n, G, G₁, e, g, x) and it is sent to algorithm Β.

(2) algorithm Β selects two clear-text message m at random₀,m₁Opponent algorithm Α is sent to, algorithm Α returns to random challenge CiphertextWherein

(3) algorithm Β exports the conjecture b ' on b, if b=b ', algorithm Α outputs " 1 ", otherwise exports " 0 ".

If element x is uniformly distributed in group G, then challenge ciphertext c is also to be uniformly distributed in group G, the selection with b It is unrelated, i.e. Pr | b=b ' |=1/2；If x is crowd G q₁Element in rank subgroup, then Pr is just had according to hypothesis | b=b ' | ＞ 1/2+ ε, so SD-Adv_A(τ) ＞ ε, this means that the advantage ε that opponent's algorithm Α solves subgroup decision problem hypothesis is not It is insignificant, with difficult problem contradiction.

Therefore, scheme is assumed to be issued to CPA safety in subgroup decision problem difficulty.Simultaneously, it is necessary to it is noted that decryption person The leakage of attribute does not interfere with the safety of ciphertext.Because if attacker does not get part of key q₁, then even if he, which knows, adds The attribute of close person and random parameter z, i.e. attacker can calculate e ' (g, g)^sαValue, but do not know part of key q₁Value, It can not thus calculate

So correct plaintext still can not be obtained.On the other hand, even if attacker has only taken part of key q₁, still E ' (g, g) can not be calculated because his attribute is unsatisfactory for ciphertext access strategy, i.e. attacker^sαValue, therefore can not decrypt To in plain text.In summary, only attribute meets the legal decryption person of ciphertext access strategy and just can normally decrypt ciphertext.

Process is understood according to the above description, and decryption outsourcing scheme of the invention utilizes bilinear map technology, and uses state Hash function SM3 algorithms are produced, the security reduction of scheme is difficult it is assumed that having reached CPA safety to subgroup decision problem.

Above content is to combine specific preferred embodiment further description made for the present invention, it is impossible to assert The specific implementation of the present invention is confined to these explanations.For general technical staff of the technical field of the invention, On the premise of not departing from present inventive concept, some simple deduction or replace can also be made, should all be considered as belonging to the present invention's Protection domain.

Claims

1. a kind of BGN types ciphertext decryption outsourcing scheme based on attribute, comprises the following steps：

Step (3)：Recipient inputs master key MSK and attribute S, randomly chooses parameter, exports transition key TK and private key SK；

Step (5)：Receive direction high in the clouds and send transition key TK；

Step (6)：High in the clouds carries out conversion calculating to ciphertext CT using transition key TK and obtains part ciphertext CT ', and by the portion Point ciphertext CT ' is sent to recipient；

Characterized in that, also include high in the clouds between the step (4) and step (5) calculates operating procedure to the homomorphism of ciphertext.

2. the BGN types ciphertext decryption outsourcing scheme according to claim 1 based on attribute, it is characterised in that the step (1) it is specially：

Step (1-2)：Algorithm ξ (λ) is run, tuple (q is obtained₁,q₂,G,G₁, e) with bilinear map e:G×G→G₁, wherein, q₁,q₂For prime number, G, G₁All it is that rank is n=q₁q₂Group；

Step (1-3)：Random selection generation member k, the u in group G, and makeThen h is crowd G q₁Rank subgroup generation member, Groups of Prime Orders G ' and G ' that rank is p are randomly choosed again_T, the generation member that g is group G ' is made, bilinear map e ' is obtained:G′× G′→G′_T；

Step (1-4)：Random selection is by { 0,1 }^*It is mapped to G ' hash function F and by G '_TThe hash function of (0,1) is mapped to, Randomly choose factor alpha, a ∈ Z_p, Z_pFor mould p integer field, then the master key of algorithm is expressed as：MSK=(g^α,PK)；

3. the BGN types ciphertext decryption outsourcing scheme according to claim 2 based on attribute, it is characterised in that the step (2) it is specially：

Step (2-2)：Randomly choose n Z_pIn element (s, y₂... ..., y_n)∈Z_p, composition of vector v, v=(s, y₂... ..., y_n), wherein, s is privacy sharing parameter, calculates λ_i=M_iV, wherein, M_iIt is the vector that M the i-th row element is constituted, then with Machine selects l+1 Z_pIn element (R, r₁... ..., r_l)∈Z_p, ciphertext CT is exported, ciphertext CT includes three below part：

C '=g^s,

<mrow> <mo>(</mo> <msub> <mi>C</mi> <mn>1</mn> </msub> <mo>=</mo> <msup> <mi>g</mi> <mrow> <msub> <mi>a&lambda;</mi> <mn>1</mn> </msub> </mrow> </msup> <mo>&CenterDot;</mo> <mi>F</mi> <msup> <mrow> <mo>(</mo> <mrow> <mi>&rho;</mi> <mrow> <mo>(</mo> <mn>1</mn> <mo>)</mo> </mrow> </mrow> <mo>)</mo> </mrow> <mrow> <mo>-</mo> <msub> <mi>r</mi> <mn>1</mn> </msub> </mrow> </msup> <mo>,</mo> <msub> <mi>D</mi> <mn>1</mn> </msub> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>r</mi> <mn>1</mn> </msub> </msup> <mo>)</mo> <mo>,</mo> <mn>......</mn> <mo>;</mo> <mo>(</mo> <msub> <mi>C</mi> <mi>l</mi> </msub> <mo>=</mo> <msup> <mi>g</mi> <mrow> <msub> <mi>a&lambda;</mi> <mi>l</mi> </msub> </mrow> </msup> <mo>&CenterDot;</mo> <mi>F</mi> <msup> <mrow> <mo>(</mo> <mrow> <mi>&rho;</mi> <mrow> <mo>(</mo> <mi>l</mi> <mo>)</mo> </mrow> </mrow> <mo>)</mo> </mrow> <mrow> <mo>-</mo> <msub> <mi>r</mi> <mi>l</mi> </msub> </mrow> </msup> <mo>,</mo> <msub> <mi>D</mi> <mi>l</mi> </msub> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>r</mi> <mi>l</mi> </msub> </msup> <mo>)</mo> <mo>.</mo> </mrow>

4. the BGN types ciphertext decryption outsourcing scheme according to claim 1 based on attribute, it is characterised in that the homomorphism It is the operation of additive homomorphism at least one times and the operation of most multiplicative homomorphics to calculate operating procedure.

5. the BGN types ciphertext decryption outsourcing scheme according to claim 3 based on attribute, it is characterised in that the step (3) it is specially：

SK '=(PK, K '=g^αg^at′, L '=g^t′,{K_x'=F (x)^t′}_x∈S)；

TK is：

PK, K=K '^1/z=g^(α/z)g^at, L=L '^1/z=g^t,SK is：SK=(q₁,z)。

6. the BGN types ciphertext decryption outsourcing scheme according to claim 5 based on attribute, it is characterised in that the step (6) it is specially：

Step (6-1)：The transition key TK that high in the clouds is sent using recipient carries out conversion calculating to ciphertext CT, when the category of recipient Property S be unsatisfactory for access structure (M, ρ), then high in the clouds output ⊥, system is out of service；

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i：ρ (i) ∈ S }, then deposit In constant collection { ω_i∈Z_p}_i∈I, for { λ_iIn all values, calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing ginseng S is measured, and then runs transfer algorithm and is calculated, part ciphertext CT ' is obtained,

The transfer algorithm is calculated：

<mrow> <mtable> <mtr> <mtd> <mrow> <mi>Q</mi> <mo>=</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <mrow> <mo>(</mo> <msup> <mi>C</mi> <mo>&prime;</mo> </msup> <mo>,</mo> <mi>K</mi> <mo>)</mo> </mrow> <mo>/</mo> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <mo>(</mo> <mrow> <munder> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>&Element;</mo> <mi>I</mi> </mrow> </munder> <msubsup> <mi>C</mi> <mi>i</mi> <msub> <mi>w</mi> <mi>i</mi> </msub> </msubsup> <mo>,</mo> <mi>L</mi> </mrow> <mo>)</mo> <mo>&CenterDot;</mo> <munder> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>&Element;</mo> <mi>I</mi> </mrow> </munder> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <mo>(</mo> <mrow> <msubsup> <mi>D</mi> <mi>i</mi> <msub> <mi>w</mi> <mi>i</mi> </msub> </msubsup> <mo>,</mo> <msub> <mi>K</mi> <mrow> <mi>&rho;</mi> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </mrow> </msub> </mrow> <mo>)</mo> <mo>)</mo> </mrow> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mi>g</mi> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mrow> <mi>s</mi> <mi>&alpha;</mi> <mo>/</mo> <mi>z</mi> </mrow> </msup> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mi>g</mi> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mrow> <mi>s</mi> <mi>a</mi> <mi>t</mi> </mrow> </msup> <mo>/</mo> <mrow> <mo>(</mo> <mrow> <munder> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>&Element;</mo> <mi>I</mi> </mrow> </munder> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <msub> <mi>ta&lambda;</mi> <mi>i</mi> </msub> <msub> <mi>w</mi> <mi>i</mi> </msub> </mrow> </msup> </mrow> <mo>)</mo> </mrow> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mi>g</mi> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mrow> <mi>s</mi> <mi>&alpha;</mi> <mo>/</mo> <mi>z</mi> </mrow> </msup> </mrow> </mtd> </mtr> </mtable> <mo>;</mo> </mrow>

7. the BGN types ciphertext decryption outsourcing scheme according to claim 6 based on attribute, it is characterised in that the step (7) it is specially：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to calculate e ' (g, g)^sα=Q^z；

Step (7-2)：Recipient recycles part private key q₁Calculate

<mrow> <msup> <mi>c</mi> <msub> <mi>q</mi> <mn>1</mn> </msub> </msup> <mo>=</mo> <msup> <mrow> <mo>(</mo> <mrow> <msup> <mi>k</mi> <mrow> <mi>m</mi> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> </mrow> </msup> <msup> <mi>h</mi> <mi>R</mi> </msup> </mrow> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </msup> <mo>=</mo> <msup> <mrow> <mo>(</mo> <msup> <mi>k</mi> <mrow> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </mrow> </msup> <mo>)</mo> </mrow> <mi>m</mi> </msup> <mo>;</mo> </mrow>

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of forDiscrete logarithm, i.e., Clear-text message m can be obtained.

8. the BGN types ciphertext decryption outsourcing scheme according to claim 5 based on attribute, it is characterised in that step (4)： Sender is sent after ciphertext data CT by overt channel to high in the clouds, and it is at least one that high in the clouds calculates operating procedure to the homomorphism of ciphertext Sub-addition homomorphism is operated,

High in the clouds receives ciphertext and includes c1 and c2：

With

Calculate

<mfenced open = "" close = ""> <mtable> <mtr> <mtd> <mrow> <msup> <mi>c</mi> <mo>&prime;</mo> </msup> <mo>=</mo> <msub> <mi>c</mi> <mn>1</mn> </msub> <msub> <mi>c</mi> <mn>2</mn> </msub> <msup> <mi>h</mi> <mi>R</mi> </msup> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <mrow> <mo>(</mo> <mrow> <msup> <mi>k</mi> <mrow> <msub> <mi>m</mi> <mn>1</mn> </msub> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> </mrow> </msup> <msup> <mi>h</mi> <msub> <mi>R</mi> <mn>1</mn> </msub> </msup> </mrow> <mo>)</mo> </mrow> <mo>&CenterDot;</mo> <mrow> <mo>(</mo> <mrow> <msup> <mi>k</mi> <mrow> <msub> <mi>m</mi> <mn>2</mn> </msub> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> </mrow> </msup> <msup> <mi>h</mi> <msub> <mi>R</mi> <mn>2</mn> </msub> </msup> </mrow> <mo>)</mo> </mrow> <msup> <mi>h</mi> <mi>R</mi> </msup> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <msup> <mi>k</mi> <mrow> <mo>(</mo> <msub> <mi>m</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>m</mi> <mn>2</mn> </msub> <mo>)</mo> <mi>H</mi> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> </msup> <msup> <mi>h</mi> <mrow> <msub> <mi>R</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>R</mi> <mn>2</mn> </msub> <mo>+</mo> <mi>R</mi> </mrow> </msup> <mo>&Element;</mo> <mi>G</mi> </mrow> </mtd> </mtr> </mtable> </mfenced>

Then the ciphertext after additive homomorphism is calculated is：

<mrow> <msup> <mi>c</mi> <mo>&prime;</mo> </msup> <mo>=</mo> <msup> <mi>k</mi> <mrow> <mo>(</mo> <msub> <mi>m</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>m</mi> <mn>2</mn> </msub> <mo>)</mo> <mi>H</mi> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> </msup> <msup> <mi>h</mi> <mrow> <msub> <mi>R</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>R</mi> <mn>2</mn> </msub> <mo>+</mo> <mi>R</mi> </mrow> </msup> <mo>&Element;</mo> <mi>G</mi> </mrow>

C=g^s,

<mrow> <mo>(</mo> <msub> <mi>C</mi> <mn>1</mn> </msub> <mo>=</mo> <msup> <mi>g</mi> <mrow> <msub> <mi>a&lambda;</mi> <mn>1</mn> </msub> </mrow> </msup> <mo>&CenterDot;</mo> <mi>F</mi> <msup> <mrow> <mo>(</mo> <mrow> <mi>&rho;</mi> <mrow> <mo>(</mo> <mn>1</mn> <mo>)</mo> </mrow> </mrow> <mo>)</mo> </mrow> <mrow> <mo>-</mo> <msub> <mi>r</mi> <mn>1</mn> </msub> </mrow> </msup> <mo>,</mo> <msub> <mi>D</mi> <mn>1</mn> </msub> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>r</mi> <mn>1</mn> </msub> </msup> <mo>)</mo> <mo>,</mo> <mn>......</mn> <mo>,</mo> <mo>(</mo> <msub> <mi>C</mi> <mi>l</mi> </msub> <mo>=</mo> <msup> <mi>g</mi> <mrow> <msub> <mi>a&lambda;</mi> <mi>l</mi> </msub> </mrow> </msup> <mo>&CenterDot;</mo> <mi>F</mi> <msup> <mrow> <mo>(</mo> <mrow> <mi>&rho;</mi> <mrow> <mo>(</mo> <mi>l</mi> <mo>)</mo> </mrow> </mrow> <mo>)</mo> </mrow> <mrow> <mo>-</mo> <msub> <mi>r</mi> <mi>l</mi> </msub> </mrow> </msup> <mo>,</mo> <msub> <mi>D</mi> <mi>l</mi> </msub> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>r</mi> <mi>l</mi> </msub> </msup> <mo>)</mo> <mo>;</mo> </mrow>

Step (5)：Receive direction high in the clouds and send transition key TK；

Step (6)：Ciphertext after high in the clouds is operated using transition key TK to additive homomorphism carries out conversion calculating, and by part ciphertext Recipient is sent to, step (6) detailed process is as follows：

When the attribute S of recipient meets access structure (M, ρ), defineAnd meet I={ i:ρ (i) ∈ S }, then deposit In constant collection { ω_i∈Z_p}_i∈I, calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing transfer algorithm meter Calculate, obtain part ciphertext,

The transfer algorithm is calculated：

<mrow> <mtable> <mtr> <mtd> <mrow> <mi>Q</mi> <mo>=</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <mrow> <mo>(</mo> <msup> <mi>C</mi> <mo>&prime;</mo> </msup> <mo>,</mo> <mi>K</mi> <mo>)</mo> </mrow> <mo>/</mo> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <mo>(</mo> <mrow> <munder> <mo>&Pi;</mo> <mrow> <mi>e</mi> <mo>&Element;</mo> <mi>I</mi> </mrow> </munder> <msubsup> <mi>C</mi> <mi>i</mi> <msub> <mi>w</mi> <mi>i</mi> </msub> </msubsup> <mo>,</mo> <mi>L</mi> </mrow> <mo>)</mo> <mo>&CenterDot;</mo> <munder> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>&Element;</mo> <mi>I</mi> </mrow> </munder> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <mo>(</mo> <mrow> <msubsup> <mi>D</mi> <mi>i</mi> <msub> <mi>w</mi> <mi>i</mi> </msub> </msubsup> <mo>,</mo> <msub> <mi>K</mi> <mrow> <mi>&rho;</mi> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> </mrow> </msub> </mrow> <mo>)</mo> <mo>)</mo> </mrow> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mi>g</mi> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mrow> <mi>s</mi> <mi>&alpha;</mi> <mo>/</mo> <mi>z</mi> </mrow> </msup> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mi>g</mi> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mrow> <mi>s</mi> <mi>a</mi> <mi>t</mi> </mrow> </msup> <mo>/</mo> <mrow> <mo>(</mo> <mrow> <munder> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>&Element;</mo> <mi>I</mi> </mrow> </munder> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <msub> <mi>ta&lambda;</mi> <mi>i</mi> </msub> <msub> <mi>w</mi> <mi>i</mi> </msub> </mrow> </msup> </mrow> <mo>)</mo> </mrow> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mi>g</mi> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mrow> <mi>s</mi> <mi>&alpha;</mi> <mo>/</mo> <mi>z</mi> </mrow> </msup> </mrow> </mtd> </mtr> </mtable> <mo>;</mo> </mrow>

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an exponent arithmetic, Calculate e ' (g, g)^sα=Q^z, obtain e ' (g, g)^sα, so as to obtain H (e ' (g, g)^sα) value；

Step (7-2)：Recipient recycles part private key q₁Calculate：

<mrow> <msup> <mrow> <mo>(</mo> <msup> <mi>c</mi> <mo>&prime;</mo> </msup> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </msup> <mo>=</mo> <msup> <mrow> <mo>(</mo> <msup> <mi>k</mi> <mrow> <mo>(</mo> <msub> <mi>m</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>m</mi> <mn>2</mn> </msub> <mo>)</mo> <mi>H</mi> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> </msup> <msup> <mi>h</mi> <mrow> <msub> <mi>R</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>R</mi> <mn>2</mn> </msub> <mo>+</mo> <mi>R</mi> </mrow> </msup> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </msup> <mo>=</mo> <msup> <mrow> <mo>(</mo> <msup> <mi>k</mi> <mrow> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </mrow> </msup> <mo>)</mo> </mrow> <mrow> <mo>(</mo> <msub> <mi>m</mi> <mn>1</mn> </msub> <mo>+</mo> <msub> <mi>m</mi> <mn>2</mn> </msub> <mo>)</mo> </mrow> </msup> <mo>.</mo> </mrow>

9. the BGN types ciphertext decryption outsourcing scheme according to claim 5 based on attribute, it is characterised in that step (4)： Sender is sent after ciphertext data CT by overt channel to high in the clouds, and high in the clouds calculates operating procedure once to multiply to the homomorphism of ciphertext Method homomorphism is operated,

Make k₁=e (k, k), h₁=e (k, h), then k₁Rank be n, h₁Rank be q₁, and necessarily have β ∈ Z so that Z is limited integer field, is calculated

Then the ciphertext after a multiplicative homomorphic is calculated is：

<mrow> <msup> <mi>c</mi> <mo>&prime;</mo> </msup> <mo>=</mo> <msubsup> <mi>k</mi> <mn>1</mn> <mrow> <msub> <mi>m</mi> <mn>1</mn> </msub> <msub> <mi>m</mi> <mn>2</mn> </msub> <mi>H</mi> <msup> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <mn>2</mn> </msup> </mrow> </msubsup> <msubsup> <mi>h</mi> <mn>1</mn> <mrow> <mi>R</mi> <mo>+</mo> <mrow> <mo>(</mo> <msub> <mi>R</mi> <mn>1</mn> </msub> <msub> <mi>m</mi> <mn>2</mn> </msub> <mo>+</mo> <msub> <mi>R</mi> <mn>2</mn> </msub> <msub> <mi>m</mi> <mn>1</mn> </msub> <mo>)</mo> </mrow> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <mo>+</mo> <msub> <mi>&beta;q</mi> <mn>2</mn> </msub> <msub> <mi>R</mi> <mn>1</mn> </msub> <msub> <mi>R</mi> <mn>2</mn> </msub> </mrow> </msubsup> <mo>&Element;</mo> <msub> <mi>G</mi> <mn>1</mn> </msub> </mrow>

C′=g^s,

Step (5)：Receive direction high in the clouds and send transition key TK；

Step (6)：High in the clouds carries out conversion calculating using transition key TK to ciphertext, obtains part ciphertext, and the part is close Text is sent to recipient, and step (6) detailed process is as follows：

Step (6-1)：The transition key TK that high in the clouds is sent using recipient carries out conversion calculating to ciphertext, when the attribute of recipient S meets access structure (M, ρ), definitionAnd meet I={ i:ρ (i) ∈ S }, then there is constant collection { ω_i∈ Z_p}_i∈I, calculate ∑_i∈Iω_iλ_i=s can recover privacy sharing parameter s, and then computing transfer algorithm is calculated, and obtains part close Literary CT ',

The transfer algorithm is calculated：

Step (7)：Part ciphertext CT ' is decrypted using private key SK by recipient, obtains message, step (7) detailed process is such as Under：

Step (7-1)：Recipient input private key SK=(q₁, z) with part ciphertext CT ', utilize (z, Q) to carry out an exponent arithmetic, Calculate e ' (g, g)^sα=Q^Z, obtain e ' (g, g)^sα, so as to obtain H (e ' (g, g)^sα)²Value；

Step (7-2)：Recipient recycles part private key q₁Calculate：

<mrow> <mtable> <mtr> <mtd> <mrow> <msup> <mrow> <mo>(</mo> <msup> <mi>c</mi> <mo>&prime;</mo> </msup> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </msup> <mo>=</mo> <msup> <mrow> <mo>(</mo> <mrow> <msup> <msub> <mi>k</mi> <mn>1</mn> </msub> <mrow> <msub> <mi>m</mi> <mn>1</mn> </msub> <msub> <mi>m</mi> <mn>2</mn> </msub> <mi>H</mi> <msup> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <mn>2</mn> </msup> </mrow> </msup> <msup> <msub> <mi>h</mi> <mn>1</mn> </msub> <mrow> <mi>R</mi> <mo>+</mo> <mrow> <mo>(</mo> <msub> <mi>R</mi> <mn>1</mn> </msub> <msub> <mi>m</mi> <mn>2</mn> </msub> <mo>+</mo> <msub> <mi>R</mi> <mn>2</mn> </msub> <msub> <mi>m</mi> <mn>1</mn> </msub> <mo>)</mo> </mrow> <mi>H</mi> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <mo>+</mo> <msub> <mi>&beta;q</mi> <mn>2</mn> </msub> <msub> <mi>R</mi> <mn>1</mn> </msub> <msub> <mi>R</mi> <mn>2</mn> </msub> </mrow> </msup> </mrow> <mo>)</mo> </mrow> <msub> <mi>q</mi> <mn>1</mn> </msub> </msup> </mrow> </mtd> </mtr> <mtr> <mtd> <mrow> <mo>=</mo> <msup> <mrow> <mo>(</mo> <mrow> <msup> <msub> <mi>k</mi> <mn>1</mn> </msub> <mrow> <mi>H</mi> <msup> <mrow> <mo>(</mo> <msup> <mi>e</mi> <mo>&prime;</mo> </msup> <msup> <mrow> <mo>(</mo> <mrow> <mi>g</mi> <mo>,</mo> <mi>g</mi> </mrow> <mo>)</mo> </mrow> <mrow> <mi>&alpha;</mi> <mi>s</mi> </mrow> </msup> <mo>)</mo> </mrow> <mn>2</mn> </msup> <msub> <mi>q</mi> <mn>1</mn> </msub> </mrow> </msup> </mrow> <mo>)</mo> </mrow> <mrow> <msub> <mi>m</mi> <mn>1</mn> </msub> <msub> <mi>m</mi> <mn>2</mn> </msub> </mrow> </msup> </mrow> </mtd> </mtr> </mtable> <mo>;</mo> </mrow>

Step (7-3)：Recipient pass through Pollard ' s lambda algorithms decryption withThe bottom of forIt is discrete right Number, you can obtain clear-text message m₁m₂。

10. the decryption outsourcing scheme of the BGN types ciphertext based on attribute according to claim any one of 1-9, it is characterised in that It is to randomly choose the two big of 512bit sizes using PRNG that the signified parameter of the random selection, which produces algorithm, Prime number q₁、q₂, G, G₁All it is that rank is n=q₁q₂Group, e:G×G→G₁It is bilinear map.