CN116366247A - A Proxy Re-encryption Method Based on Geographically Addressable Network Based on Server Dynamic Selection Threshold - Google Patents

Abstract

The application discloses a server dynamic selection threshold proxy re-encryption method based on a geographical location addressable network dynamic selection threshold proxy re-encryption method. The server dynamic selection threshold proxy re-encryption method based on the geographic location addressable network includes collecting the geographic location of each server in the proxy server cluster, and constructing a network map of the cluster distribution geographic location; when the data user needs to select multiple servers closest to himself When applying for authorization, the proxy server dynamic selection operation is performed; the identity information of multiple proxy servers relatively closest to the data user is sent to the data user, and the data user executes the authorization application operation; to achieve the purpose of dynamically selecting the threshold proxy server, It ensures that data users can obtain the authorization of multiple servers that are geographically closest to each other, and then solves the problem of how data applicants can dynamically select multiple servers that are closest to themselves for authorization applications during the threshold proxy re-encryption process.

Description

A server dynamically selects threshold proxy weight based on geographically addressable network encryption method

The present application relates to the field of privacy computing, and in particular, relates to a server dynamic selection threshold proxy re-encryption method based on a geographic location addressable network.

Background technique

Proxy re-encryption is a special public-key encryption scheme that allows a semi-trusted proxy server to convert encrypted ciphertext from one public key to another without knowing the plaintext or the private key. The data owner first creates a "re-encryption key" to authorize the data agent to convert the ciphertext, so that the data user can directly decrypt the ciphertext converted by the data agent, so as to realize the safe transmission and sharing of data. Transformation through a proxy server enables data access by data users without the need for direct transmission of data to data users.

In the traditional proxy re-encryption scheme, the proxy party completely controls the re-encryption authority of user data, which may lead to the risk of malicious behavior or attacks by the proxy party. Threshold proxy re-encryption is based on proxy re-encryption, converting a single semi-trusted proxy server fully holding the re-encryption key into multiple proxy servers to form a cluster, converting one re-encryption key into multiple key shares, Each proxy server holds one of the secret key shares, and uses its own share to carry out the proxy re-add process. Only when the authorization obtained by the data user meets the threshold condition, the proxy servers in the cluster can cooperate to decrypt the ciphertext. Compared with the traditional proxy re-encryption scheme, threshold proxy re-encryption improves the security and reliability of the scheme, and the system scalability can also be improved by setting the threshold value.

In the threshold proxy re-encryption scheme, the data user needs to select multiple authorization applications from N proxy servers. If the number of authorizations obtained is not less than the threshold threshold t, it is considered to be fully authorized to decrypt the data; otherwise, continue to apply, Until the number of authorizations is greater than the threshold threshold. However, when the threshold proxy re-encryption scheme is deployed in actual scenarios, it often adopts the form of building clusters in different places. The servers in the cluster are widely distributed and the distance is long. To ensure the running speed, users should choose the n servers closest to themselves to apply for authorization (generally n=t), to reduce the time loss during data transmission.

No effective solution has been proposed so far for the problem of how data users dynamically select multiple servers closest to themselves for authorization application in the threshold proxy re-encryption process.

Contents of the invention

The main purpose of this application is to provide a threshold proxy re-encryption method to solve the problem of how data users dynamically select multiple servers closest to themselves for authorization application during the threshold proxy re-encryption process.

In order to achieve the above object, according to one aspect of the present application, a proxy re-encryption method based on a server dynamically selecting a threshold based on a geographic location addressable network is provided.

According to the threshold proxy re-encryption method of the present application, the method includes: collecting the geographic location of each server in the proxy server cluster, and constructing a cluster distribution geographical location network map; Dynamic selection operation; send the identity information of n proxy servers relatively closest to the user to the user, and the user performs the authorization application operation.

Further, constructing a cluster distribution geographic network map includes:

，其信息包括代理服务器身份信息ID，代理服务器定位经度数据X，代理服务器定位纬度数据Y，代理服务器有效位O，筛选出在线的服务器，构建服务器集群分布地理位置网络图/>

，其信息包括代理服务器总数N。Collect geographic location information for each proxy server in the cluster

, its information includes proxy server identity information ID, proxy server location longitude data X, proxy server location latitude data Y, proxy server effective bit O, filter out online servers, and build a server cluster distribution geographic location network map/>

, whose information includes the total number N of proxy servers.

Further, the proxy server dynamic selection operation includes:

，其中所有代理服务器定位经度数据X都大于X₀，小于X₁；所有代理服务器定位经度数据Y都大于y₀，小于y₁；Determine the geographical distribution range according to the latitude and longitude information of each server in the cluster distribution geographical location network diagram

, wherein all proxy server positioning longitude data X are greater than X ₀ and less than X ₁ ; all proxy server positioning longitude data Y are greater than y ₀ and less than y ₁ ;

First query whether the total number of servers N in the initial range (X, Y) is not less than the threshold t, if N<t, continue to wait for new servers to join the cluster, otherwise use the CAN algorithm to segment the server range;

，并将原范围切分成/>

和

两部分，检测数据拥有者地理位置所属范围，假设属于范围1(X₁,Y)，则计算范围1内服务器数目N，若N<t，则确认服务器地理范围为初始范围（X,Y），并将初始范围（X,Y）内服务器信息发送给数据使用者。否则，继续执行动态选择过程；calculate

, and split the original range into />

and

Two parts, detecting the scope of the geographical location of the data owner. Assuming it belongs to scope 1 (X ₁ , Y), calculate the number of servers N in scope 1. If N<t, confirm that the geographical scope of the server is the initial scope (X, Y) , and send the server information in the initial range (X, Y) to the data user. Otherwise, continue with the dynamic selection process;

，并将范围1/>

切分成

和/>

两部分，检测数据拥有者地理位置所属范围，假设属于范围2(X₁,Y₂)，则计算范围2内服务器数目N，若N<t，则确认服务器地理范围为范围1（X₁,Y），并将其范围内服务器信息发送给数据使用者。否则，继续执行动态选择过程；calculate

, and set the range 1/>

cut into

and />

Two parts, detecting the scope of the geographical location of the data owner. Assuming it belongs to scope 2 (X ₁ , Y ₂ ), calculate the number of servers N in scope 2. If N<t, confirm that the geographic scope of the server is scope 1 (X ₁ , Y), and send the server information within its range to the data user. Otherwise, continue with the dynamic selection process;

In this way, the range is segmented in turn with the parallel lines of the X and Y axes, until the segmented range satisfies the condition of N<t, then the range before the last segment is the minimum geographical distribution range of servers, and the servers within this range are the selected ones of eligible servers.

Further, the authorization application operation performed by the user includes:

Send the list of servers that meet the conditions to the data user, the data user applies for authorization, and collects the proxy server share fragment cFrag;

Count the number n of cFrags, and if n is greater than or equal to the threshold t, the decryption operation will be performed. Otherwise, send back the identity information of the unsuccessfully authorized server, set its valid bit as offline, reconstruct the geographical distribution network map of the server cluster, and perform the dynamic selection operation of the proxy server again;

In the embodiment of this application, the server dynamic selection threshold proxy re-encryption method based on the geographical location addressable network is adopted, and the geographical location network map of the server cluster distribution is constructed by collecting the geographical location information of the server; The location addressable network algorithm calculates the minimum range and selects the server; sends the list of servers that meet the conditions to the user for authorization application, if the authorization fails, the server distribution network diagram is modified, and the process is repeated; the purpose of dynamically selecting the threshold proxy server is achieved. Then it solves the problem of how the data applicant dynamically selects multiple servers closest to itself for authorization application in the threshold proxy re-encryption process.

Description of drawings

The accompanying drawings, which constitute a part of this application, are included to provide a further understanding of the application and make other features, objects and advantages of the application apparent. The drawings and descriptions of the schematic embodiments of the application are used to explain the application, and do not constitute an improper limitation to the application. In the attached picture.

Fig. 1 is a schematic flowchart of a proxy re-encryption method based on a server dynamically selecting a threshold based on a geographic location addressable network according to an embodiment of the present application.

Fig. 2 is a working schematic diagram of a proxy re-encryption method based on a server dynamically selecting a threshold based on a geographical location addressable network according to a preferred embodiment of the present application.

Detailed ways

In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiment of the application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the application. Obviously, the described embodiment is only It is an embodiment of a part of the application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the scope of protection of this application.

It should be noted that the terms "first" and "second" in the description and claims of the present application and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It should be understood that the data so used may be interchanged under appropriate circumstances for the embodiments of the application described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and embodiments.

According to an embodiment of the present invention, a server dynamic selection threshold proxy re-encryption method based on a geographic addressable network is provided. As shown in FIGS. 1 and 2 , the method includes the following steps S101 to S103.

Step S101 , constructing a cluster distribution geographic network map.

Collect the geographical location of each server in the proxy server cluster, construct a network map of the geographical location of the cluster distribution, and provide data support for further confirming the minimum range of servers and selecting the corresponding server.

According to an embodiment of the present invention, preferably, constructing a cluster distribution geographic location network diagram includes:

，其中ID为代理服务器身份信息，X为代理服务器定位经度数据，Y为代理服务器定位纬度数据，O为代理服务器有效位，以表示服务器授权功能执行状态，并通过筛选在线的服务器，构建服务器集群分布地理位置网络图/>

，其信息包括代理服务器总数N；Collect geographic location information for each proxy server in the cluster

, where ID is the identity information of the proxy server, X is the longitude data of the proxy server location, Y is the latitude data of the proxy server location, and O is the effective bit of the proxy server to indicate the execution status of the server authorization function, and build a server cluster by screening online servers Geographical distribution network map/>

, whose information includes the total number of proxy servers N;

A mathematical model is used to express the distribution range and location of the proxy server cluster. In this way, the minimum distribution range of the servers required by the data user can be determined by converting the actual problem into a mathematical problem and answering the mathematical problem;

The mathematical representation of cluster distribution locations can be realized through the construction of server cluster distribution geographic location network diagrams. In this way, correct judgments can be made when selecting the minimum distribution range of servers required by data users, providing guarantee for subsequent dynamic selection of proxy servers .

Step S102 , when the data user needs to select multiple servers closest to the user to apply for authorization, the dynamic selection operation of the proxy server is performed.

After the construction of the geographical location network diagram of the server cluster distribution above, the distribution of the server cluster can be determined, and the dynamic selection operation of the proxy server can be performed.

According to an embodiment of the present invention, preferably, performing a proxy server dynamic selection operation includes:

内中可用的服务器总数N是否不小于阈值t，若N<t则继续等待新服务器加入集群，否则使用CAN算法对服务器范围进行切分，以选取最小范适用范围；First query the initial range

Whether the total number of available servers N is not less than the threshold t, if N<t, continue to wait for new servers to join the cluster, otherwise, use the CAN algorithm to segment the server range to select the minimum applicable range;

，并将原范围切分成/>

和

两部分，检测数据使用者地理位置所属范围，假设属于范围1(X₁,Y)，则计算范围1内服务器数目N，若N<t，则确认服务器地理范围为初始范围（X,Y），并将其初始范围（X,Y）内服务器信息发送给数据申请者。否则，继续执行动态选择过程；calculate

, and split the original range into />

and

Two parts, detecting the scope of the geographical location of the data user. Assuming it belongs to scope 1 (X ₁ , Y), calculate the number of servers N in scope 1. If N<t, confirm that the geographical scope of the server is the initial scope (X, Y) , and send the server information within its initial range (X, Y) to the data applicant. Otherwise, continue with the dynamic selection process;

，并将范围1/>

切分成

和/>

两部分，检测数据使用者地理位置所属范围，假设属于范围2(X₁,Y₂)，则计算范围2内服务器数目N，若N<t，则确认服务器地理范围为范围1（X₁,Y），并将其范围内服务器信息发送给数据申请者。否则，继续执行动态选择过程；calculate

, and put range 1/>

cut into

and />

Two parts, detecting the scope of the geographical location of the data user. Assuming it belongs to scope 2 (X ₁ , Y ₂ ), calculate the number of servers N in scope 2. If N<t, confirm that the geographic scope of the server is scope 1 (X ₁ , Y), and send the server information within its range to the data applicant. Otherwise, continue with the dynamic selection process;

The scope is segmented by repeatedly using the geographically addressable network algorithm, and finally the distribution range of servers that meet the conditions is selected.

Step S103 , sending the identity information of multiple proxy servers relatively closest to the data user to the data user, and the data user executes an authorization application operation.

According to the embodiment of the present invention, preferably, the data user's execution of the authorization application operation includes:

After filtering out the server distribution range that meets the conditions, send the server information within the range to the data user;

The data user applies for authorization to the server within the range, collects the proxy server share fragment cFrag and judges whether the number n of cFrag is greater than or equal to the threshold t, if n<t, then returns the identity information of the unsuccessfully authorized server and makes it valid Set the bit to offline, reconstruct the geographical network map of the server cluster distribution, and perform the dynamic selection operation of the proxy server again. Otherwise, combine the existing cFrags into cFrags and perform decryption;

A judging procedure is set up to judge whether the authorized fragments obtained by the data user meet the requirements of the threshold threshold. If not, the server range selection process will be carried out again, and a second authorization application will be made, thus effectively ensuring that the data applicant can obtain the final authorized.

From the above description, it can be seen that the present invention achieves the following technical effects:

In the embodiment of the present application, a server dynamic selection threshold proxy re-encryption method based on a geographic location addressable network is adopted to construct a cluster distribution geographic location network map by collecting the geographic location of each server in the proxy server cluster; when the data user When it is necessary to select multiple servers closest to itself for authorization application, the proxy server dynamic selection operation is performed; the identity information of multiple proxy servers relatively closest to the data user is sent to the data user, and the data user executes the authorization application operation ;Achieve the purpose that the data owner and the data user do not need to participate in the dynamic refresh adjustment process of the proxy encryption segment, thereby realizing the technical effect that the data user can quickly and effectively obtain the data usage authorization, and then solve the threshold proxy re-encryption In the process, how does the data user dynamically select multiple servers closest to itself to apply for authorization.

It should be noted that the steps shown in the flowcharts of the accompanying drawings may be performed in a computer system, such as a set of computer-executable instructions, and that although a logical order is shown in the flowcharts, in some cases, The steps shown or described may be performed in an order different than here.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the present application. For those skilled in the art, there may be various modifications and changes in the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application shall be included within the protection scope of this application.

Claims (4)

1. A server dynamic selection threshold agent re-encryption method based on geographical location addressable network, it is characterized in that, comprising: Collect the geographical location of each server in the proxy server cluster, and build a geographical distribution network map of the cluster; When the data user needs to select multiple servers closest to himself to apply for authorization, the proxy server dynamic selection operation is performed; Send the identity information of multiple proxy servers relatively closest to the data user to the data user, and the data user executes the authorization application operation. 2. a kind of server dynamic selection threshold agent re-encryption method based on geographical location addressable network according to claim 1, it is characterized in that, constructing cluster distribution geographical location network diagram comprises: Collect geographic location information for each proxy server in the cluster

, its information includes proxy server identity information ID, proxy server location longitude data X, proxy server location latitude data Y, proxy server effective bit O, filter out online servers, and build a server cluster distribution geographic location network map/>

, whose information includes the total number N of proxy servers. 3. A kind of server dynamic selection threshold agent re-encryption method based on geographical location addressable network according to claim 1, it is characterized in that, when the data user needs to select a plurality of servers closest to oneself to apply for authorization , the dynamic proxy server selection operation includes: Determine the geographical distribution range according to the latitude and longitude information of each server in the cluster distribution geographical location network diagram

, wherein all proxy server positioning longitude data X are greater than X ₀ and less than X ₁ ; all proxy server positioning longitude data Y are greater than y ₀ and less than y ₁ ; First query whether the total number of servers N in the initial range (X, Y) is not less than the threshold t, if N<t, continue to wait for new servers to join the cluster, otherwise continue to execute the dynamic selection process; calculate

, and split the original range into />

and

Two parts, detecting the scope of the user's geographic location. Assuming it belongs to scope 1 (X ₁ , Y), calculate the number of servers N in scope 1. If N<t, confirm that the geographic scope of the server is the initial scope (X, Y)

, and send the server information within its range to the data applicant. Otherwise, continue with the dynamic selection process; computed, and range 1

cut into />

and

Two parts, detecting the scope of the user's geographic location. Assuming it belongs to scope 2 (X ₁ , Y ₂ ), calculate the number of servers N in scope 2. If N<t, confirm that the geographical scope of the server is scope 1 (X ₁ , Y) , and send the server information within its range to the data applicant. Otherwise, continue with the dynamic selection process; In this way, the geographic location addressable network algorithm is used to segment the range with parallel lines of the X and Y axes in turn until the segmented range satisfies the condition of N<t, then the range before segmentation is the minimum geographical distribution range of servers, within this range The server is the selected server that satisfies the conditions. 4. a kind of server dynamic selection threshold proxy re-encryption method based on geographical location addressable network according to claim 1, it is characterized in that, a plurality of proxy server identity information relatively recent from data user is sent to user, Data users perform authorization application operations including: Send the list of servers that meet the conditions to the data user, the data user applies for authorization, and collects the proxy server share fragment cFrag; Count the number n of cFrags, and if n is greater than or equal to the threshold t, the decryption operation will be performed. Otherwise, send back the identity information of the unsuccessfully authorized server, set its effective bit as offline, reconstruct the geographical distribution network map of the server cluster, and perform the dynamic selection operation of the proxy server again.

Images