CN109873699B - Revocable identity public key encryption method - Google Patents

Abstract

The invention discloses a revocable identity public key encryption method. The method includes the following steps: (1) selecting parameters from a cryptography application function library, and generating a master private key and a master public key of the system; (2) ) According to the parameters of the system, the master private key of the system and the identity of the user, generate the private key of the user; (3) According to the parameters of the system, the master private key of the system, the identity of the user and the time parameter, generate the time key of the user; (4) Use The public key of the message receiver and the current time parameter calculate a temporary session key, and then use the temporary session key to encrypt the message; (5) After the receiver receives the ciphertext, it first uses bilinear mapping, its own private key and time key to calculate the session key, and then use the session key to decrypt the plaintext message. In the identity public key encryption system of the present invention, the revoked user cannot obtain the correct plaintext by decrypting the ciphertext, thereby ensuring the security of the identity public key system.

Description

A Revocable Identity Public Key Encryption Method

technical field

The invention belongs to the technical field of information security, in particular to a signature technology and an identity public key encryption technology, in particular to a revocable identity public key encryption method.

Background technique

Public key cryptography is an important technology to solve the increasingly prominent information security problems. In the public key cryptosystem, the first problem to be solved is the authenticity and validity of the public key. The traditional public key system realizes authentication by issuing public key certificates to users, but at the same time, the management of public key certificates requires huge overhead. Identity-Based Public Key Cryptography (IDPKC) better solves the complex certificate management problems in traditional public-key cryptography. IDPKC was proposed by the famous cryptographer Ad Shamir in 1984. In this system, the user's identity (such as mobile phone number, IP address and Email address) is the user's public key. In 2001, Boneh and Franklin used bilinear mapping Weil pair to design a practical identity public key encryption scheme for the first time, which made identity public key cryptography step into the threshold of practical application.

In 2008, the identity public key cryptographic algorithm (also known as the identification cryptographic algorithm) officially obtained the commercial secret algorithm model SM9 (GM/T 0044-2016) issued by the State Cryptography Administration, laying a solid foundation for the application of identity public key cryptography in my country. Base. The SM9 algorithm does not need to apply for a digital certificate. It is easy to use and easy to deploy. It can use mobile phone numbers or email addresses as public keys to realize data encryption, identity authentication, call encryption, channel encryption, etc. It is suitable for protecting the security of various emerging Internet applications. Such as cloud computing-based password services, email security, intelligent terminal protection, IoT security, cloud storage security, etc.

Every public key system must solve an important problem - the problem of user revocation. When the user's use rights expire, the user's private key is leaked, or the user operates illegally, the system needs to revoke such users. In traditional public key systems, revocation methods include revocation list CRLs, online certificate status protocol OCSP, etc., which are relatively mature technologies, but these technologies are not suitable for identity public key systems. According to the structural characteristics of the identity public key system, the current user revocation technology is mainly that the system periodically updates the user's private key, but each updated key must be transmitted to the user through a secret channel, and the establishment of the secret channel requires the system and the user. Lots of extra computing resources and communication overhead. Therefore, how to improve the operation efficiency of the user revocation mechanism under the identity public key system is an important problem that needs to be solved. At present, Boldyreva et al. have designed a scalable and revocable identity public key encryption (RIBE) scheme. Libert and Vergnaud have improved the scheme to improve security. Seo et al. proposed a solution to decryption at PKC2013. RIBE scheme for key compromise threats. However, the user revocation technology of the existing identity public key system still needs to be further improved in terms of efficiency and practicability.

SUMMARY OF THE INVENTION

Purpose of the invention: The present invention provides a revocable identity public key encryption method, which is designed based on the national secret standard SM9, and is safe, efficient and practical. The method can revoke users when the data is transmitted confidentially, so that users who do not meet the requirements cannot obtain correct plaintext messages, and the security of the system is guaranteed.

In order to achieve the above-mentioned purpose, the technical scheme disclosed by the present invention is: the private key generation center PKG utilizes the user's identity and time parameters to generate the user's private key and the time key, and revokes the non-compliance with the method of regularly updating the time key. user. Specific steps are as follows:

和

选取双线性映射

的生成元P₁,

的生成元P₂,选取两个不同的哈希函数H₀和H₁，选取系统主私钥ke,根据ke计算系统主公钥P_pub＝[ke]P₁，将参数

公开，系统主私钥ke保密，并且选取一个密钥导出函数KDF和消息认证码函数MAC。(1) System master key generation: The identity public key system selects a set of parameters from the computer programming language library JPBC library or PBC library, and the parameters include three cyclic groups whose orders are large prime numbers q

and

Choose Bilinear Map

The generator P ₁ of ,

The generator P ₂ of , selects two different hash functions H ₀ and H ₁ , selects the system master private key ke, calculates the system master public key P _pub =[ke]P ₁ according to ke, and sets the parameter

Open, the system master private key ke is kept secret, and a key derivation function KDF and a message authentication code function MAC are selected.

(2) user private key generation: the identity public key system uses the user's identity ID as the user's public key, and generates the user's private key SK _ID according to the ID and the system master private key ke;

(3) time key generation: according to the time parameter t, the user's identity ID and the system master private key ke, generate the user's time key TK _{ID, t} ;

(4) Encrypted transmission: The message sender calculates a temporary session key K by using the identity ID of the message receiver, the time parameter t and the system public parameter Params, and then uses the temporary session key K to encrypt the message M to obtain the ciphertext C , and send the ciphertext C to the receiver.

(5) Decryption step: the receiver uses bilinear mapping, its own private key SK _ID and time key TK _{ID, t} to calculate the temporary session key K, and then uses the session key K to decrypt the plaintext message M.

和

其中，

表示有限域Z_q去掉零元素后的乘法群。Further, two different hash functions selected in step (1)

and

in,

represents the multiplicative group of the finite field Z _q with zero elements removed.

The generation of the user's private key SK _ID described in step (2) comprises the following steps:

(2.1) The private key generation center PKG of the identity public key system calculates the hash function value H ₀ (ID) of the user identity ID;

(2.2) PKG calculates the user's private key, and its calculation formula is:

SK _ID = [(H ₀ (ID)+ke) ^-1 ke]P ₂ ,

Among them, [] represents the dot multiplication operation.

The time key TK _{ID of the described user of step (3), t} generates, comprises the following steps:

(3.1) Calculate the hash function value H ₁ (ID||t) of the user identity ID and the time parameter t;

(3.2) Calculate the time key again, and the calculation formula is as follows:

TK _{ID, t} = [(H ₁ (ID||t)+ke) ^-1 ke]P ₂

Among them, [] represents the dot multiplication operation, and || represents the bit order concatenation.

The described encrypted message M of step (4) comprises the steps:

(4.1) The sender uses the hash functions H ₀ and H ₁ to calculate Q _ID = [H ₀ (ID)]P ₁ +P _pub and Q _{ID respectively, t} = [H ₁ (ID||t)]P ₁ +P _pub ;

中随机选择两个数r₀和r₁,计算出部分密文C₀＝[r₀]Q_ID和C₁＝[r₁]Q_ID，t；(4.2) From

Randomly select two numbers r ₀ and r ₁ in , and calculate the partial ciphertext C ₀ =[r ₀ ]Q _ID and C ₁ =[r ₁ ]Q _ID,t ;

(4.3) Calculation using bilinear operation

(4.4) Using the key derivation function KDF, calculate the temporary session key used for encryption K=KDF(C ₀ , C ₁ , W, ID, Klen)=K ₁ ||K ₂ , where Klen represents the key length ;

符号

表示异或；(4.5) Encrypt the message M with the key K ₁ , and calculate the partial ciphertext

symbol

means exclusive or;

(4.6) Use the key K ₂ to calculate the partial ciphertext C ₃ =MAC(K ₂ , C ₂ ), and this partial ciphertext is used for the integrity verification of the ciphertext;

(4.7) Output the ciphertext C=(C ₀ , C ₁ , C ₂ , C ₃ ), and send it to the message receiver.

The described receiver of step (5) utilizes bilinear mapping, own private key SK _ID and time key TK _{ID, t} decrypts the ciphertext, and its steps are as follows:

(5.1) Calculate W=e(C ₀ , SK _ID ) e(C ₁ , TK _{ID, t} ) by using bilinear operation e, user’s private key SK _ID and time key TK _{ID, t} ;

(5.2) According to the W calculated in the previous step, calculate the temporary session key K=KDF(C ₀ , C ₁ , W, ID, Klen)=K ₁ ||K ₂ for decrypting the ciphertext;

否则，输出“密文无效”。(5.3) Verify the integrity of the ciphertext: Calculate C′ ₃ =MAC(K ₂ , C ₂ ), verify whether C′ ₃ is equal to the partial ciphertext C ₃ , if so, it means that the ciphertext has not been modified, and it can be Decrypt the message further

Otherwise, "Ciphertext is invalid" is output.

Beneficial effects: The present invention makes the users who do not meet the requirements in the system unable to decrypt the correct plaintext through the method of updating the time key, thereby realizing the revocation operation for the user. The updated time key only needs to be transmitted through an open channel, which saves communication overhead, and the identity public key encryption algorithm adopted in the present invention is the national commercial encryption algorithm SM9, which is practical.

Description of drawings

Fig. 1 is the identity public key system schematic diagram of the present invention;

FIG. 2 is a schematic diagram of the encryption and decryption process of the present invention.

Detailed ways

In order to describe the technical solutions disclosed in the present invention in detail, further description will be given below in conjunction with the accompanying drawings and specific embodiments of the description.

A revocable identity public key encryption system provided by the present invention is shown in Figure 1. First, the user's private key is generated by the private key generation center PKG of the encryption system, and then the user's private key is sent to each user through a secret channel At the terminal, users use their IDs as public keys to uniquely identify users.

For Fig. 1, the relevant technical terms of the present invention are described as follows:

(1) PKG is the "private key generation center" of the identity public key system, which is responsible for generating the user's private key and updating the time key.

(2) ID is the identity of the user, which uniquely identifies the user and is the user's public key, such as a mobile phone number or an email address.

As shown in Figure 2 is a specific step flow chart of a revocable identity public key encryption method, including the following steps:

Step 1. Generate the system master key:

和

(可采用256位的椭圆曲线y²＝x³+b)。P₁和P₂分别是群

和

的生成元,

是非对称双线性映射。选取两个不同的哈希函数

和

可以将任意长的比特串映射到

中，这里，

表示有限域Z_q去掉零元素后的乘法群。Select three cyclic groups with prime order q from JAVA's JPBC library (or C language PBC library)

and

(256-bit elliptic curve y ² =x ³ +b can be used). _P1 and _P2 are groups respectively

and

generator of ,

is an asymmetric bilinear map. Pick two different hash functions

and

Arbitrarily long bit strings can be mapped to

in, here,

represents the multiplicative group of the finite field Z _q with zero elements removed.

中随机选取一个元素ke,并计算P_pub＝[ke]P₁。秘密保存主私钥ke,公开系统参数

其中，[]表示点乘运算。PKG from

Randomly select an element ke in , and calculate P _pub =[ke]P ₁ . The master private key ke is kept secretly, and the system parameters are disclosed

Among them, [] represents the dot multiplication operation.

Step 2. Private key generation

Taking the user ID as input, PKG first calculates the hash function value H ₀ (ID) of the ID, and then adds H ₀ (ID) and ke mod q to obtain u=H ₀ (ID)+ke (mod q), Then use the extended Euclidean algorithm to inverse u modulo q, that is, u ^-1 (mod q), then multiply u ^-1 and ke, and the obtained product is multiplied by P _2. User private key SK _ID = [u ^-1 k]P ₂ , and transmit the private key SK _ID to the user through a secure channel.

Step 3. Time key generation

PKG calculates the time key TK _ID according to the user identity ID, the time parameter t and the system master key ke, according to the formula TK _{ID, t} = [(H ₁ (ID||t)+ke) ^-1 ke]P _{2 , t} , the specific calculation process is similar to the calculation process of SK _ID , the difference is that the input of the hash function H ₁ has a time parameter t in addition to the user identity ID. The PKG transmits the TK _ID,t to the user through an open channel, and periodically recalculates the TK _ID,t for the user according to the new time parameters.

The time parameter t is the time to update the key, which can be determined according to the specific application scenario. The time parameter t can be set slightly shorter for the system that is frequently accessed, and the time parameter can be set slightly longer for the system that is not frequently accessed. , for example, the access control system in the cloud computing environment can set the time parameter to one month.

Step 4. Encrypt and transmit

(1) The message sender first calculates the hash values H ₀ (ID) and H ₁ (ID||t) according to the identity ID of the message receiver and the time parameter t, and performs the dot product [H ₀ (ID)] P ₁ and [H ₁ (ID||t)]P ₁ , and then calculate Q _ID =[H ₀ (ID)]P ₁ +P _pub and Q _{ID, t} =[H ₁ (ID||t)]P ₁ + _Ppub ;

中随机选择两个数r₀和r₁,计算C₀＝[r₀]Q_ID和C₁＝[r₁]Q_ID，t；(2) From

Randomly select two numbers r ₀ and r ₁ in , and calculate C ₀ =[r ₀ ]Q _ID and C ₁ =[r ₁ ]Q _ID,t ;

(3) Calculation

(4) Calculate the temporary session key K=KDF(C ₀ , C ₁ , W, IDKlen)=K ₁ ||K ₂ through the key derivation function KDF, where Klen represents the key length, and the symbol “||” Indicates bit order concatenation;

其中，符号

表示比特异或；(5) Encrypt message M with K ₁ to obtain partial ciphertext

Among them, the symbol

means bit exclusive OR;

(6) Calculate partial ciphertext C ₃ =MAC(K ₂ , C ₂ ) for integrity verification with K ₂ , where MAC is a message authentication code function;

(7) Obtain the complete ciphertext C=(C ₀ , C ₁ , C ₂ , C ₃ ), and send the ciphertext C to the receiver.

Step 6. Decryption

After receiving the ciphertext C=(C ₀ , C ₁ , C ₂ , C ₃ ), the receiver decrypts the plaintext message M according to its own private key SK _ID and time key TK _{ID, t} according to the following process:

(1) Calculate the product of the bilinear mapping e(C ₀ , SK _ID ) and e(C ₁ , TK _{ID, t} ), denoted as W, and the specific calculation formula is W=e(C ₀ , SK _ID )e( C ₁ , TK _{ID, t} );

(2) Calculate the temporary session key K=KDF(C ₀ , C ₁ , W, ID, Klen)=K ₁ ||K ₂ according to W;

计算出消息M,否则输出“密文无效”。(3) Calculate C′ ₃ =MAC(K ₂ , C ₂ ) according to K ₂ , and verify whether C′ ₃ is equal to C ₃ , if it is equal, follow the formula

Calculate the message M, otherwise output "invalid ciphertext".

Claims (5)

1. a revocable identity public key encryption method, is characterized in that, comprises the following steps: (1) System master key generation: The identity public key system selects a set of parameters from the computer programming language library JPBC library or PBC library, and the parameters include three cyclic groups whose orders are prime numbers q

and

Choose Bilinear Map

The generator P ₁ of ,

The generator P ₂ of , selects two different hash functions H ₀ and H ₁ , selects the system master private key ke, calculates the system master public key P _pub =[ke]P ₁ according to ke, and calculates the system public parameters

Open, the system master private key ke is kept secret, and a key derivation function KDF and a message authentication code function MAC are selected; (2) user private key generation: the identity public key system uses the user's identity ID as the user's public key, and generates the user's private key SK _ID according to the ID and the system master private key ke; (3) time key generation: according to the time parameter t, the user's identity ID and the system master private key ke, generate the user's time key TK _{ID, t} ; (4) Encrypted transmission: the message sender calculates a temporary session key K by using the identity ID _R of the message receiver, the time parameter t and the system public parameter Params, and then uses the temporary session key K to encrypt the message M to obtain the ciphertext C, send the ciphertext C to the receiver; (5) Decryption step: the receiver uses bilinear mapping, his own private key

and time key

Calculate the temporary session key K, and then use the session key K to decrypt the plaintext message M; The time key TK _{ID of the described user of step (3), t} generates, comprises the following steps: (3.1) Calculate the hash function value H ₁ (ID||t) of the user identity ID and the time parameter t; (3.2) Calculate the time key again, and the calculation formula is as follows: TK _{ID, t} = [(H ₁ (ID||t)+ke) ^-1 ke]P ₂ Among them, [ ] represents the dot multiplication operation, which represents the bit order concatenation. 2. a kind of revocable identity public key encryption method according to claim 1, is characterized in that, two different hash functions that step (1) is selected

and

in,

represents the multiplicative group of the finite field Z _q with zero elements removed. 3. a kind of revocable identity public key encryption method according to claim 1, is characterized in that, the described user private key SK _ID of step (2) generates, comprises the following steps: (2.1) The private key generation center PKG of the identity public key system calculates the hash function value H ₀ (ID) of the user identity ID; (2.2) PKG calculates the user's private key, and its calculation formula is: SK _ID = [(H ₀ (ID)+ke) ^-1 ke]P ₂ , Among them, [] represents the dot multiplication operation. 4. a kind of revocable identity public key encryption method according to claim 1, is characterized in that, the described encrypted message M of step (4) comprises the steps: (4.1) The sender uses the hash functions H ₀ and H ₁ to calculate Q _ID = [H ₀ (ID)]P ₁ +P _pub and Q _{ID respectively, t} = [H ₁ (ID||t)]P ₁ +P _pub ; (4.2) From

Randomly select two numbers r ₀ and r ₁ in , and calculate the partial ciphertext C ₀ =[r ₀ ]Q _ID and C ₁ =[r ₁ ]Q _ID,t ;

represents the multiplicative group of the finite field Z _q after removing zero elements; (4.3) Calculation using bilinear mapping

(4.4) Using the key derivation function KDF, calculate the temporary session key used for encryption K=KDF(C ₀ , C ₁ , W, ID, Klen)=K ₁ ||K ₂ , where Klen represents the key length ; (4.5) Encrypt the message M with the key K ₁ , and calculate the partial ciphertext

symbol

means exclusive or; (4.6) Use the key K ₂ to calculate the partial ciphertext C ₃ =MAC(K ₂ , C ₂ ), and this partial ciphertext is used for the integrity verification of the ciphertext; (4.7) Output the ciphertext C=(C ₀ , C ₁ , C ₂ , C ₃ ), and send it to the message receiver. 5. a kind of revocable identity public key encryption method according to claim 4 is characterized in that, the receiver described in step (5) utilizes bilinear mapping, own private key

and time key

To decrypt the ciphertext, the specific steps are as follows: (5.1) Using bilinear mapping e, user's private key

and time key

calculate

Ciphertext C=(C ₀ , C ₁ , C ₂ , C ₃ ); (5.2) According to the W calculated in the previous step, calculate the temporary session key K=KDF(C ₀ , C ₁ , W, ID, Klen)=K ₁ ||K ₂ for decrypting the ciphertext; Klen represents the key length, K ₁ and K ₂ are keys; (5.3) Verify the integrity of the ciphertext: Calculate C ₃ ′=MAC(K ₂ , C ₂ ), and verify whether C ₃ ′ is equal to the partial ciphertext C ₃ , if so, it means that the ciphertext has not been modified. further decrypt the message

Otherwise, "Ciphertext is invalid" is output.

Images