CN103647642B - A kind of based on certification agency re-encryption method and system - Google Patents

Abstract

The invention discloses a certificate-based proxy re-encryption method and system, and relates to the technical field of data encryption in information security. In order to solve the deficiencies in existing proxy re-encryption methods, the present invention combines certificate-based cryptosystem and proxy re-encryption to provide a certificate-based proxy re-encryption method, which includes generating system parameters and generating user public keys and private key pair, generate user certificate, encrypt message, generate proxy re-encryption key, proxy re-encryption, and recover message. The invention also provides a certificate-based proxy re-encryption system, including a system parameter generation module, a user key generation module, a certificate generation module, an encryption module, a proxy re-encryption key generation module, a proxy re-encryption module and a decryption module. The technical scheme of the invention not only simplifies the certificate management process, but also does not have the problems of key distribution and key trusteeship, and is convenient for application in an open network environment.

Description

A method and system for re-encryption based on certificate proxy

technical field

The invention relates to the technical field of data encryption in information security, in particular to a certificate-based proxy re-encryption method and system.

Background technique

With the rapid development of information technology, the security of electronic data has been paid more and more attention by data owners. Data encryption technology is the core and key technology to ensure the confidentiality of electronic data. It converts data into meaningless ciphertext through encryption keys and encryption algorithms, thereby preventing data from being accessed by unauthorized persons and effectively ensuring data confidentiality. .

Decryption authorization is often encountered in real society. For example, a company manager needs to go on a business trip. In order not to affect the company's business, the manager needs to entrust a reliable assistant to help him handle some business-related encrypted emails during his business trip, but at the same time he does not want to disclose his private key to the assistant. In order to solve the above-mentioned problem of decryption authorization, Blaze et al. proposed the idea of proxy re-encryption in 1998. In the proxy re-encryption system, a semi-trusted proxy re-encryption center with the proxy re-encryption key can directly convert the ciphertext of the message M encrypted by the user Alice's public key into the message M encrypted by the user Bob's public key. The ciphertext encrypted by M, in which the user Alice is called the entrusting party, and the user Bob is called the accepting party. During this process, the semi-trusted proxy re-encryption center cannot obtain any information about the message M. Since proxy re-encryption can effectively solve the problem of decryption authorization, this method has many important practical applications, such as cross-domain operation of digital rights, forwarding of encrypted emails, and sharing of secure data in public clouds. Proxy re-encryption has been widely concerned since it was proposed, and domestic and foreign scholars have conducted in-depth discussions and researches on it. However, most of the existing proxy re-encryption methods are proposed under the traditional public key cryptosystem or identity-based cryptosystem, so these methods either have complex certificate management problems, or key distribution and key escrow problems. However, although the certificateless proxy re-encryption method proposed by Sur et al. effectively solves the complex certificate management and key escrow problems, it still has the problem of key distribution. Therefore, the application of existing proxy re-encryption methods in open network environments will be limited.

The certificate-based cryptosystem is a new type of public key cryptosystem proposed by Gentry in 2003. defect. One of the biggest features of the certificate-based cryptosystem is to provide an efficient hidden certificate mechanism, that is, the user certificate is only sent to the certificate holder, and combined with its private key to generate the final decryption key or signature key. Based on this feature, the certificate-based cryptosystem not only eliminates the third-party query problem of the certificate status, simplifies the complex certificate management process in the traditional public-key cryptosystem, but also overcomes the inherent key distribution problem and encryption problem in the identity-based cryptosystem Key escrow issues. Therefore, the certificate-based cryptosystem is a new type of public key encryption system with excellent performance and easy to apply in the open network environment.

Contents of the invention

The technical problem to be solved by the present invention is a problem existing in the existing proxy re-encryption method. The present invention combines the certificate-based encryption system and the proxy re-encryption system to provide a certificate-based proxy re-encryption method. Benefiting from the excellent performance of the certificate-based cryptosystem, the method proposed by the invention not only simplifies the certificate management process, but also does not have the problems of key distribution and key custody.

The present invention adopts the following technical solutions for solving the problems of the technologies described above:

A method for re-encrypting based on a certificate agent, comprising the following steps:

Step A, generate the system master key and system public parameter set; the specific process is:

In step 101, the certificate center selects a k-bit large prime number p according to the set security parameter k∈Z ⁺ , and generates a p-order additive cyclic group G and a p-factorial cyclic group G _T , and defined in the group G and The bilinear pairing e:G×G→G _T on the group G _T ; where: Z ⁺ is a positive integer, and the bilinear pairing e:G×G→G _T is the Cartesian product of the group G and itself G×G to The mapping of the group G _T , that is, the bilinear pair e:G×G→G _T refers to the function z=e(P ₁ , P ₂ ), where P ₁ , P ₂ ∈G are independent variables, and z∈G _T is dependent variable;

Step 102, select two generators P and Q from the additive cyclic group G and randomly select Calculate Q _pub =αQ, g=e(P,Q) and h=e(Q,Q); where: set

Step 103, define five hash functions H ₂ : {0,1} ⁿ → {0,1} ⁿ , H ₄ :G _T ×G _T →{0,1} ⁿ and Where: H1 is the Cartesian product {0, ₁ } ^* ×G×G _T to The cryptographic hash function of H ₂ is the cryptographic hash function of {0,1} ⁿ to {0,1} ⁿ , and H ₃ is {0,1} ^* to H ₄ is the cryptographic hash function of the Cartesian product G _T ×G _T to {0,1} ⁿ , H ₅ is the Cartesian product G _T ×G _T to The cryptographic hash function, n represents the bit length of the plaintext, {0,1} ^* represents the set of binary strings of uncertain length, {0,1} ⁿ represents the set of binary strings of length n bits, {0, 1} ^* ×G×G _T represents the Cartesian product of {0,1} ^* , group G and group G _T , and G _T ×G _T represents the Cartesian product of group G _T and itself;

According to step 101 to step 103, the system master key stored secretly by the certificate center is msk=α, and the system public parameter set is params={p,G,G _T ,e,n,P,Q,Q _pub ,g, h,H ₁ ,H ₂ ,H ₃ ,H ₄ ,H ₅ }.

Step B, according to the public parameter set of the system and the identity information of the user, generate the user's public key and private key pair, the user includes the sender and the receiver; the specific process is as follows:

The user whose identity is id _U is first in Randomly choose an integer from As your own private key SK _U , that is, SK _U =x _U ; then use the system public parameter set params to generate your own public key ${\mathrm{PK}}_u=({\mathrm{PK}}_u^{\left(1\right)},{\mathrm{PK}}_u^{\left(2\right)})$ $=(x_{u}Q,g^{x_u}).$

Step C, generating a user's certificate according to the system master key, the system public parameter set, the user's identity information, and the user's public key; the specific process is as follows:

The user with identity id _U submits his identity information id _U and public key PK _U to the certificate center; the certificate center generates the certificate Cert _{U of user id U =} (H ₁ (id _U ,PK _U )+α) ^-1 Q , and then send the certificate Cert _U to the user whose identity is id _U.

Step D, generate the original ciphertext according to the public parameter set of the system, the plaintext to be encrypted and the recipient's identity information and public key; the specific process is as follows:

The sender uses the receiver's identity id _V and public key To encrypt plaintext M with length n bits, the sender first randomly selects σ∈{0,1} ⁿ and calculates r=H ₃ (M,σ,id _V ,PK _V ); then calculates $C_1=m\⊕h_2\left(\mathrm{\σ}\right),C_2=\mathrm{\σ}\⊕h_4(h^r,{\left({\mathrm{PK}}_V^{\left(2\right)}\right)}^r),$ C ₃ =rP and C ₄ =r(H ₁ (id _V ,PK _V )Q+Q _Pub ); finally send C=(C ₁ ,C ₂ ,C ₃ ,C ₄ ) as the ciphertext of plaintext M to Receiver id _V .

Step E, generating a proxy re-encryption key according to the system public parameter set, sender's identity information, private key and certificate, and receiver's identity information and public key; the specific process is as follows:

The sender id _U according to the public key of the receiver id _V First choose randomly and calculate Then use your own private key SK _U and certificate Cert _U and public key of recipient id _V ${\mathrm{PK}}_V=({\mathrm{PK}}_V^{\left(1\right)},{\mathrm{PK}}_V^{\left(2\right)}),$ calculate ${\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(1\right)}={\mathrm{SK}}_u\&Center\; Dot;{\mathrm{PK}}_V^{\left(1\right)},{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(2\right)}=\mathrm{the\; s}(h_1({\mathrm{id}}_V,{\mathrm{PK}}_V)Q+Q_{\mathrm{Pub}})$ and ${\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(3\right)}={\mathrm{tCert}}_u;$ Finally will ${\mathrm{PRK}}_{u\&Right\; Arrow;V}=({\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(1\right)},{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(2\right)},{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(3\right)})$ Acts as a proxy re-encryption key.

Step F, generating re-encrypted ciphertext according to the system public parameter set, original ciphertext and proxy re-encryption key; the specific process is as follows:

Proxy re-encryption key submitted by sender id _U And the original ciphertext C=(C ₁ , C ₂ , C ₃ , C ₄ ) encrypted with the sender’s identity id _U and public key PK _U , first set C ₁ ′=C ₁ , C ₂ ′=C ₂ , ${C_5}^{\′}={\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(2\right)};$ then calculate ${C_3}^{\′}=e(C_3,{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(1\right)})$ and ${C_4}^{\′}=e(C_4,{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(3\right)});$ Finally, C′=(id _U , C ₁ ′, C ₂ ′, C ₃ ′, C ₄ ′, C ₅ ′) is forwarded to the receiver id _V as the proxy re-encrypted ciphertext.

Step G, restore the plaintext according to the system public parameter set, the ciphertext to be decrypted, and the recipient's private key and certificate, and the ciphertext to be decrypted includes the original ciphertext or re-encrypted ciphertext; the specific process is as follows:

The receiver whose identity is id _V uses his own private key SK _V and certificate Cert _V to decrypt the ciphertext C. According to the type of ciphertext C, it can be divided into the following two situations:

If the ciphertext C is the original ciphertext without re-encryption, that is, C=(C ₁ ,C ₂ ,C ₃ ,C ₄ ), the receiver id _V first calculates $\mathrm{\σ}=C_2\⊕h_4(e(C_4,{\mathrm{Cert}}_V),{(C_3,Q)}^{{\mathrm{SK}}_V}),$ Then calculate and obtain the plaintext $m=C_1\⊕h_2\left(\mathrm{\σ}\right);$ Then calculate r=H ₃ (M,σ,id _V ,PK _V ), and judge whether C ₄ =r(H ₁ (id _V ,PK _V )Q+Q _Pub ) is true: if true, the plaintext M is valid; otherwise , the ciphertext is invalid, and the decryption fails;

If C is the agent re-encrypted ciphertext, that is, C=(id _U , C ₁ ′, C ₂ ′, C ₃ ′, C ₄ ′, C ₅ ′), the receiver id _V is first calculated sequentially $t=h_5(e({C_5}^{\′},{\mathrm{Cert}}_V),e{({C_5}^{\′},{\mathrm{Cert}}_V)}^{{\mathrm{SK}}_V})$ and $\mathrm{\σ}={C_2}^{\′}\⊕h_4({\left({C_4}^{\′}\right)}^{1/t},{\left({C_3}^{\′}\right)}^{{1/\mathrm{SK}}_V}),$ Then calculate and obtain the plaintext Then calculate r=H ₃ (M,σ,id _U ,PK _U ), and judge Whether and C ₄ ′=h ^r holds true: if true, the plaintext M is valid; otherwise, the ciphertext is invalid and the decryption fails.

The present invention also provides a certificate-based proxy re-encryption system, including:

The system parameter generation module is used to generate the master key of the certificate center and the public parameter set of the cryptographic system according to the input security parameters;

The user key generation module is used to generate the user's public key and private key pair according to the public parameter set generated by the system parameter generation module and the user's identity information, and the user includes a sender and a receiver;

The certificate generation module is used to generate the user's certificate according to the master key and public parameter set generated by the system parameter generation module, the user's identity information and the public key generated by the user key generation module;

The encryption module is used to generate the original ciphertext of the plaintext according to the public parameter set generated by the system parameter generation module, the plaintext to be encrypted, the identity information of the recipient, and the recipient's public key generated by the user key generation module;

The proxy re-encryption key generation module is used to generate the public parameter set generated by the system parameter generation module, the identity information of the sender and the identity information of the receiver, and the private key of the sender and the public key of the receiver generated by the user key generation module. key, and the sender's certificate generated by the certificate generation module to generate a proxy re-encryption key;

The proxy re-encryption module is used to generate re-encryption ciphertext according to the public parameter set generated by the system parameter generation module, the original ciphertext input by the encryption module, and the proxy re-encryption key generated by the proxy re-encryption key generation module;

The decryption module is used to generate the public parameter set generated by the system parameter generation module, the original ciphertext generated by the encryption module or the re-encrypted ciphertext generated by the proxy re-encryption module, the receiver's private key generated by the user key generation module, and the certificate Generate the recipient's certificate generated by the module, recovering the plaintext.

Further, in the certificate-based proxy re-encryption system of the present invention, the decryption module specifically includes a ciphertext decryption unit and a ciphertext validity verification unit; wherein:

The ciphertext decryption unit is used for the decryptor to decrypt the ciphertext and restore the plaintext;

The ciphertext validity verification unit is used for the decryptor to verify the validity of the ciphertext, and then judge whether the plaintext output by the ciphertext decryption unit is valid.

Compared with the prior art, the present invention adopts the above technical scheme and has the following technical effects:

The present invention combines the certificate-based encryption system with the proxy re-encryption system to provide an efficient hidden certificate mechanism, that is, the user's certificate is only sent to the certificate holder, and combined with its private key to generate the final decryption key. The method effectively overcomes the problems existing in the existing proxy re-encryption method, and is a novel proxy re-encryption method very suitable for application in an open network environment. The main reasons are as follows:

First of all, since the user can decrypt the currently received ciphertext only after obtaining the certificate, the sender does not need to obtain the latest certificate status information of the receiver before sending the encrypted information, so the invention not only eliminates the traditional proxy re-encryption In the method, the third party asks questions about the status of the certificate, and also simplifies the revocation of the certificate.

Second, since the certificate authority cannot know the user's private key, this method solves the inherent key escrow problem in the identity-based proxy re-encryption method.

In addition, since the certificate is only used to bind the corresponding relationship between the user's public key and the user's identity, it can be sent to the user publicly, so this method also effectively overcomes the problems existing in the identity-based proxy re-encryption method and the certificateless proxy re-encryption method. Key distribution problem.

Description of drawings

Fig. 1 is a flow chart of the certificate-based proxy re-encryption method according to the present invention.

Fig. 2 is a flowchart of operations performed by the cryptographic system according to the method of the present invention.

Fig. 3 is a schematic diagram of a certificate-based proxy re-encryption system according to the present invention.

detailed description

Below in conjunction with accompanying drawing, technical scheme of the present invention is described in further detail:

The certificate-based proxy re-encryption method of the present invention can be realized based on bilinear pairing. The basic definition of bilinear pairing and the properties it satisfies will be briefly introduced below.

Let G be an additive cyclic group of order p, G _T be a multiplicative cyclic group of order p, and P be a generator of the group G, where p is a large prime number. Assume that the discrete logarithm problem on both groups G and G _T is hard. If a map e:G×G→G _T is defined on the group G and group G _T and satisfies the following three properties, the map is called an effective bilinear pairing. The bilinear pair e:G×G→G _T is the mapping of the Cartesian product G×G of the group G and itself to the group G _T , that is, the bilinear pair e:G×G→G _T refers to the function z=e (P ₁ , P ₂ ), where P ₁ , P ₂ ∈ G is the independent variable, and z ∈ G _T is the dependent variable.

The three properties that bilinear correspondences satisfy are:

(1) Bilinear. For any P ₁ , P ₂ ∈ G and There is e(aP ₁ ,bP ₂ )=e(P ₁ ,P ₂ ) ^ab .

(2) Non-degenerate. in is the identity element of the group _GT .

(3) Computability. For any P ₁ , P ₂ ∈ G, there is an effective algorithm to calculate e(P ₁ , P ₂ ).

Among them, the large prime number p is not lower than 160 bits of binary representation for discrete logarithm problems, and not lower than 1024 bits of binary representation for large integer decomposition problems. The concept of a cyclic group is: Let H be a group, if there is an element P∈H such that H={kP|k∈Z}, then H is called an additive cyclic group, and P is called a generator of H; if there is an element u ∈H makes H={u ^k |k∈Z}, then H is called a multiplicative cyclic group, and u is called a generator of H. If H is an additive (multiplicative) cyclic group and the order of the generator P(u) is n, that is, n is the smallest positive integer that makes the power of P(u) equal to the identity element of the group H, then H is called an addition of order n ( multiplication) cyclic group. In simple terms, an additive cyclic group means that the generator of the cyclic group can generate all the elements in the group by addition, while a multiplicative cyclic group means that the generator of the cyclic group can generate all the elements in the group by exponentiation . also, where Z _p refers to the residual class of integers modulo prime p, ie Z _p ={0,1,...,p-1}.

According to the above bilinear pairing description, the certificate-based proxy re-encryption method proposed in the present invention will be further described below in conjunction with the accompanying drawings and implementation examples, but this is not intended to limit the present invention.

The entity of the method design of the present invention is as follows:

(1) Certificate Center: responsible for generating system parameters, namely generating system master keys and system public parameter sets, and a trusted third party that verifies system users and issues certificates;

(2) Client: The original recipient of the encrypted message is the entity that entrusts the recipient to exercise the right to decrypt;

(3) Accepting party: the entity that receives the authorization of the entrusting party and exercises the decryption right on behalf of the entrusting party;

(4) Proxy re-encryption center: accept the entrusting party's proxy re-encryption entrustment, and act as a semi-trusted third party that converts the entrusting party's original ciphertext into re-encrypted ciphertext;

(5) Sender: the original sending entity of the message;

(6) Receiver: The receiving entity of the ciphertext, which can be the entrusting party or the accepting party.

With reference to accompanying drawing 1 and accompanying drawing 2, the step of the method of the present invention is specifically described as follows:

Step A, generate the system master key and system public parameter set, the specific steps are as follows:

Step 101: According to the set security parameter k∈Z ⁺ , select a k-bit large prime number p, and generate a p-order additive cyclic group G and a p-factorial cyclic group G _T , and define the group G and group G The bilinear pairing e:G×G→G _T on _T , where the bilinear pairing e:G×G→G _T is the mapping from the Cartesian product G×G of the group G and itself to the group G _T .

Step 102: Select two generators P and Q from the additive cyclic group G and randomly select Calculate Q _pub =αQ, g=e(P,Q) and h=e(Q,Q), where the set

Step 103: Define five hash functions H ₂ : {0,1} ⁿ → {0,1} ⁿ , H ₄ :G _T ×G _T →{0,1} ⁿ and where H1 is the Cartesian product _{ 0,1} ^* ×G×G _T to The cryptographic hash function of H ₂ is the cryptographic hash function of {0,1} ⁿ to {0,1} ⁿ , and H ₃ is {0,1} ^* to H ₄ is the cryptographic hash function of the Cartesian product G _T ×G _T to {0,1} ⁿ , H ₅ is the Cartesian product G _T ×G _T to The cryptographic hash function, n represents the bit length of the plaintext, {0,1} ^* represents the set of binary strings of uncertain length, {0,1} ⁿ represents the set of binary strings of length n bits, {0, 1} ^* ×G×G _T represents the Cartesian product of {0,1} ^* , group G and group G _T , and G _T ×G _T represents the Cartesian product of group G _T and itself.

According to the execution results of step 101, step 102 and step 103, the system public parameter set params={p,G,G _T ,e,n,P,Q,Q _pub ,g,h,H ₁ ,H ₂ , H ₃ , H ₄ , H ₅ } and system master key msk=α.

Step B, generating the user's public key and private key pair according to the system public parameter set, the specific steps are as follows:

Step 104: For user identity id _U , in Randomly choose an integer from As its private key SK _U , that is, SK _U =x _U .

Step 105: Calculate and obtain the public key of user id _U

Step C, generating a user's certificate according to the system master key, the system public parameter set, the user's identity and the user's public key, the specific steps are as follows:

Step 106: For the user identity id _U and the public key PK _U , calculate and obtain the certificate Cert _U =(H ₁ (id _U ,PK _U )+α) ^-1 Q of the user id _U.

Step D, generating the original ciphertext according to the public parameter set of the system, the plaintext to be encrypted, and the identity and public key of the recipient, the specific steps are as follows:

Step 107: According to the receiver's identity id _V and public key As well as the plaintext M to be sent, first randomly select σ∈{0,1} ⁿ and calculate r=H ₃ (M,σ,id _V ,PK _V ); then calculate C ₃ =rP and C ₄ =r(H ₁ (id _V ,PK _V )Q+Q _Pub ), so as to obtain the original ciphertext C=(C ₁ ,C ₂ ,C ₃ ,C ₄ ) of the plaintext M.

Step E, generating a proxy re-encryption key according to the system public parameter set, the client's identity, private key and certificate, and the accepting party's identity and public key, the specific steps are as follows:

Step 108: According to the private key SK _U of the entrusting party id _U and the certificate Cert _U and the public key of the accepting party id _V ${\mathrm{PK}}_V=({\mathrm{PK}}_V^{\left(1\right)},{\mathrm{PK}}_V^{\left(2\right)}),$ First choose randomly $\mathrm{the\; s}\∈Z_p^{*}$ and calculate $t=h_5(h^{\mathrm{the\; s}},e{(Q,{\mathrm{PK}}_V^{\left(1\right)})}^{\mathrm{the\; s}});$ and then calculate ${\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(1\right)}={\mathrm{SK}}_u\&Center\; Dot;{\mathrm{PK}}_V^{\left(1\right)},{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(2\right)}=\mathrm{the\; s}(h_1({\mathrm{id}}_V,{\mathrm{PK}}_V)Q+Q_{\mathrm{Pub}})$ and ${\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(3\right)}={\mathrm{tCert}}_u,$ To obtain the proxy re-encryption key ${\mathrm{PRK}}_{u\&Right\; Arrow;V}=({\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(1\right)},{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(2\right)},{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(3\right)}).$

Step F, generating re-encrypted ciphertext according to the system public parameter set, original ciphertext and proxy re-encryption key, the specific steps are as follows:

Step 109: Re-encrypt the key against the proxy And the original ciphertext C=(C ₁ , C ₂ , C ₃ , C ₄ ) encrypted with identity id _U and public key PK _U , calculate and obtain the proxy re-encrypted ciphertext encrypted with identity id _V and public key PK _V C′=(id _U ,C ₁ ′,C ₂ ′,C ₃ ′,C ₄ ′,C ₅ ′), where C ₁ ′=C ₁ , C ₂ ′=C ₂ , ${C_4}^{\′}=e(C_4,{\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(3\right)})$ as well as ${C_5}^{\′}={\mathrm{PRK}}_{u\&Right\; Arrow;V}^{\left(2\right)}.$

Step G, restore the plaintext according to the system public parameter set, the ciphertext to be decrypted (original ciphertext or re-encrypted ciphertext) and the decryptor's private key and certificate, the specific steps are as follows:

When the ciphertext C is the original ciphertext without re-encryption, that is, C=(C ₁ , C ₂ , C ₃ , C ₄ ), the decryption module 7 performs the following steps:

Step 110: According to the private key SK _V and the certificate Cert _V of the decryptor id _V , and the ciphertext C=(C ₁ , C ₂ , C ₃ , C ₄ ), calculate $\mathrm{\σ}=C_2\⊕h_4(e(C_4,{\mathrm{Cert}}_V),{(C_3,Q)}^{{\mathrm{SK}}_V}),$ Then calculate and obtain the plaintext $m=C_1\⊕h_2\left(\mathrm{\σ}\right).$

Step 111: Calculate r=H ₃ (M,σ,id _V ,PK _V ), and judge whether C ₄ =r(H ₁ (id _V ,PK _V )Q+Q _Pub ) is true: if true, the plaintext M is valid ; Otherwise, the ciphertext is invalid and decryption fails.

When the ciphertext C is a proxy re-encrypted ciphertext, that is, C=(id _U , C ₁ ′, C ₂ ′, C ₃ ′, C ₄ ′, C ₅ ′), the decryption module 7 performs the following steps:

Step 112: According to the private key SK _V and the certificate Cert _V of the agent id _V , and the ciphertext C=(id _U , C ₁ ′, C ₂ ′, C ₃ ′, C ₄ ′, C ₅ ′), calculate in sequence and $\mathrm{\σ}={C_2}^{\′}\⊕h_4({\left({C_4}^{\′}\right)}^{1/t},{\left({C_3}^{\′}\right)}^{{1/\mathrm{SK}}_V}),$ Then calculate and obtain the plaintext $m={C_1}^{\′}\⊕h_2\left(\mathrm{\σ}\right).$

Step 113: Calculate r=H ₃ (M,σ,id _U ,PK _U ), and judge Whether and C ₄ ′=h ^r holds true: if true, the plaintext M is valid; otherwise, the ciphertext is invalid and the decryption fails.

Referring to accompanying drawing 3, the present invention also provides a kind of system based on certificate proxy re-encryption, said system includes: system parameter generation module, user key generation module, certificate generation module, encryption module, proxy re-encryption key generation module, Proxy re-encryption module and decryption module;

The system parameter generating module is used for the certificate center to generate the master key of the certificate center and the public parameter set of the cryptographic system according to the input security parameters.

The user key generation module is used for the system user to generate the user's public key and private key pair according to the public parameter set generated by the system parameter generation module and the user's identity information.

The certificate generation module is used for the certificate center to generate the user's certificate according to the master key and the public parameter set generated by the system parameter generation module, the user's identity information and the public key generated by the user key generation module.

The encryption module is used for the sender to generate the original ciphertext of the plaintext according to the public parameter set generated by the system parameter generation module, the plaintext to be encrypted, the identity information of the receiving user and the public key of the receiving user generated by the user key generation module.

The proxy re-encryption key generation module is used for the public parameter set generated by the client according to the system parameter generation module, the identity information of the client and the identity information of the accepting party, the private key of the client generated by the user key generation module and the acceptance The public key of the party and the certificate of the entrusting party generated by the certificate generation module generate a proxy re-encryption key.

The proxy re-encryption module is used to proxy the public parameter set generated by the encryption center according to the system parameter generation module, the original ciphertext input by the encryption module and the proxy re-encryption key generated by the proxy re-encryption key generation module to generate a re-encryption key arts.

The decryption module is used for the decryptor to generate the public parameter set according to the system parameter generation module, the original ciphertext generated by the encryption module or the re-encrypted ciphertext generated by the proxy re-encryption module, and the decryptor's private key generated by the user key generation module And the certificate of the decryptor generated by the certificate generation module, recovering the plaintext.

The decryption module specifically includes a ciphertext decryption unit and a ciphertext validity verification unit.

The ciphertext decryption unit is used for the decryptor to decrypt the ciphertext and recover the plaintext.

The ciphertext validity verification unit is used for the decryptor to verify the validity of the ciphertext, and then judge whether the plaintext output by the ciphertext decryption unit is valid.

The above is only a description of preferred embodiments of the present invention. For those skilled in the art, other advantages and modifications can be easily ascertained from the above embodiments. Therefore, the present invention is not limited to the above-mentioned embodiment, and it is merely a detailed and exemplary description of one aspect of the present invention as an example. Within the scope of not departing from the purpose of the present invention, ordinary changes and substitutions made by those skilled in the art within the scope of the technical solutions of the present invention shall be included in the protection scope of the present invention.

Claims (10)

1. one kind based on certification agency re-encryption method, it is characterised in that described method comprises the steps of

Step A, generates system master key and the open parameter set of system；

Step B, generates PKI and the private key pair of user according to the identity information of the open parameter set of described system and user, and described user includes sender and recipient；

Step C, according to the open parameter set of described system master key and system, and the respective identity information of sender and recipient, PKI, generate the respective certificate of sender and recipient respectively；

Step D, according to the identity information of the open parameter set of described system, plaintext to be encrypted and recipient and PKI, generates original cipher text；

Step E, according to the open parameter set of described system, the identity information of sender, private key and certificate, and the identity information of recipient and PKI, generate and act on behalf of re-encrypted private key；

Step F, discloses parameter set, original cipher text according to described system and acts on behalf of re-encrypted private key, generates re-encryption ciphertext；

Step G, according to the private key of the open parameter set of described system, ciphertext to be decrypted and recipient and certificate, recovers expressly, and ciphertext to be decrypted includes original cipher text or re-encryption ciphertext.

2. one according to claim 1 is based on certification agency re-encryption method, it is characterised in that described step A detailed process is as follows:

Step 101, certificate center is according to the security parameter k ∈ Z set⁺, select the Big prime p of a k bit, and generate an a p rank addition cyclic group G and p factorial method cyclic group G_T, and definition is at group G and group G_TOn Bilinear map e:G × G → G_T；Wherein: Z⁺It is positive integer, Bilinear map e:G × G → G_TIt is crowd G cartesian product G × G to group G with self_TMapping, i.e. Bilinear map e:G × G → G_TRefer to function z=e (P₁,P₂), wherein P₁,P₂∈ G is independent variable, z ∈ G_TFor dependent variable；

Step 102, selects two from addition cyclic group G and generates unit P and Q and randomly chooseCalculate Q_pub=α Q, g=e (P, Q) and h=e (Q, Q)；Wherein: set

Step 103, defines five hash functionsH₂: { 0,1}ⁿ→ { 0,1}ⁿ、H₄:G_T×G_T→{0,1}ⁿAndWherein H₁It is cartesian product { 0,1}^*×G×G_TArriveCryptographic Hash function, H₂It is { 0,1}ⁿTo { 0,1}ⁿCryptographic Hash function, H₃It is { 0,1}^*ArriveCryptographic Hash function, H₄It is cartesian product G_T×G_TTo { 0,1}ⁿCryptographic Hash function, H₅It is cartesian product G_T×G_TArriveCryptographic Hash function, n represents bit length expressly, { 0,1}^*Represent the set of the uncertain binary string of length, { 0,1}ⁿRepresent the set of the binary string that length is n-bit, { 0,1}^*×G×G_TRepresent { 0,1}^*, group G and group G_TCartesian product, G_T×G_TRepresent group G_TCartesian product with self；

According to step 101 to step 103, the system master key that the central secret that Generates Certificate preserves is msk=α, and the open parameter set of system is params={p, G, G_T,e,n,P,Q,Q_pub,g,h,H₁,H₂,H₃,H₄,H₅}。

3. one according to claim 2 is based on certification agency re-encryption method, it is characterised in that described step B detailed process is as follows:

Identity is id_UUser first existIn randomly choose an integerPrivate key SK as oneself_U, i.e. SK_U=x_U；Then the open parameter set params of system is utilized to generate the PKI of oneself

4. one according to claim 3 is based on certification agency re-encryption method, it is characterised in that the detailed process of described step C is as follows:

Identity is id_UUser by the identity information id of oneself_UWith PKI PK_USubmit to certificate center；Certificate center produces user id_UCertificate Cert_U=(H₁(id_U,PK_U)+α)^-1Q, then by certificate Cert_UBeing sent to identity is id_UUser.

5. one according to claim 4 is based on certification agency re-encryption method, it is characterised in that described step D detailed process is as follows:

Sender uses the identity id of recipient_VAnd PKIEncryption length is the plaintext M of n-bit, and first sender randomly chooses σ ∈ { 0,1}ⁿAnd calculate r=H₃(M,σ,id_V,PK_V)；Then C is calculated respectively₁=M H₂(σ),C₃=rP and C₄=r (H₁(id_V,PK_V)Q+Q_Pub)；Finally by C=(C₁,C₂,C₃,C₄) it is sent to recipient id as the ciphertext of plaintext M_V。

6. one according to claim 5 is based on certification agency re-encryption method, it is characterised in that the detailed process of described step E is as follows:

Sender id_UAccording to recipient id_VPKIFirst randomly chooseAnd calculateThen the private key SK according to use oneself_UWith certificate Cert_UAnd recipient id_VPKICalculateWithFinally willAs acting on behalf of re-encrypted private key.

7. one according to claim 6 is based on certification agency re-encryption method, it is characterised in that the detailed process of described step F is as follows:

According to sender id_UThat submits to acts on behalf of re-encrypted private keyAnd the identity id with sender_UWith PKI PK_UOriginal cipher text C=(the C of encryption₁,C₂,C₃,C₄), put C first respectively₁'=C₁, C₂'=C₂,Then calculateWithFinally by C '=(id_U,C₁′,C₂′,C₃′,C₄′,C₅') it is forwarded to recipient id as acting on behalf of re-encryption ciphertext_V。

8. one according to claim 7 is based on certification agency re-encryption method, it is characterised in that the detailed process of described step G is as follows:

Identity is id_VRecipient use oneself private key SK_VWith certificate Cert_VCiphertext C is deciphered, the type according to ciphertext C, is divided into the following two kinds situation:

If ciphertext C is the original cipher text without re-encryption, i.e. C=(C₁,C₂,C₃,C₄), recipient id_VFirst calculateAnd then calculate and obtain plaintext M=C₁⊕H₂(σ)；Then r=H is calculated₃(M,σ,id_V,PK_V), and judge C₄=r (H₁(id_V,PK_V)Q+Q_Pub) whether set up: if setting up, plaintext M is effective；Otherwise, ciphertext is invalid, deciphers unsuccessfully；

If C is for acting on behalf of re-encryption ciphertext, i.e. C=(id_U,C₁′,C₂′,C₃′,C₄′,C₅'), recipient id_VFirst calculate successivelyWithAnd then calculate and obtain plaintext M=C₁′⊕H₂(σ)；Then r=H is calculated₃(M,σ,id_U,PK_U), and judgeAnd C₄'=h^rWhether set up: if setting up, plaintext M is effective；Otherwise, ciphertext is invalid, deciphers unsuccessfully.

9. one kind based on certification agency re-encryption system, it is characterised in that including:

Systematic parameter generation module, for Generate Certificate according to the security parameter the inputted master key at center and the open parameter set of cryptographic system；

User key generation module, for the open parameter set generated according to systematic parameter generation module, and the identity information of user, generating PKI and the private key pair of user, described user includes sender and recipient；

Certificates constructing module, for the master key generated according to systematic parameter generation module and open parameter set, and the respective identity information of sender and recipient, PKI, generate the respective certificate of sender and recipient respectively；

Encrypting module, for the PKI of the recipient that the open parameter set generated according to systematic parameter generation module, plaintext to be encrypted, the identity information of recipient and user key generation module generate, generates original cipher text expressly；

Act on behalf of re-encrypted private key generation module, the private key of the sender generated for the open parameter set generated according to systematic parameter generation module, the identity information of sender and the identity information of recipient, user key generation module and the PKI of recipient, and the certificate of the sender of certificates constructing module generation, generate and act on behalf of re-encrypted private key；

Act on behalf of re-encryption module, for the original cipher text inputted according to the open parameter set of systematic parameter generation module generation, encrypting module and the re-encrypted private key of acting on behalf of acting on behalf of the generation of re-encrypted private key generation module, generation re-encryption ciphertext；

Deciphering module, the private key of the original cipher text generated for the open parameter set generated according to systematic parameter generation module, encrypting module or the recipient acting on behalf of the re-encryption ciphertext of re-encryption module generation, the generation of user key generation module, and the certificate of the recipient of certificates constructing module generation, recover expressly.

10. one according to claim 9 is based on certification agency re-encryption system, it is characterised in that described deciphering module specifically includes ciphertext decryption unit and ciphertext validation verification unit；Wherein:

Ciphertext is decrypted by described ciphertext decryption unit for deciphering person, recovers expressly；

The effectiveness of ciphertext is verified by described ciphertext validation verification unit for deciphering person, and then judges that whether the plaintext that ciphertext decryption unit exports is effective.