# US 2019/0173668 A1 · Data processing method and apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173668 A1 - Document ID: US20190173668A1 - Status: Published application - Kind: A1 - Application number: 16/262,674 - Filed: 2019-01-30 - Published: 2019-06-06 - Earliest claimed: 2016-08-05 - Assignees: Huawei International Pte. Ltd.; Singapore Management University - Applicants: Huawei International Pte. Ltd.; Singapore Management University - Inventors: Hui CUI; Robert H. DENG; Yingjiu LI; Guilin WANG; Tsz Hon YUEN - Web page: https://patentgrep.com/patent/US20190173668A1 ## CPC - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/16: the keys or algorithms being changed during operation - H04L 9/0869: {involving random numbers or seeds} - H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A data processing method and apparatus include: generating, by a terminal device, a first public key and a first private key; sending the first public key to a key generation center (KGC), where the first public key is used by the KGC or a server to generate a transform key, and the transform key is used by the server to transform data that is encrypted based on an attribute structure of the terminal device into data that is encrypted based on the first public key; receiving second data sent by the server, where the second data is data that is generated after the server processes first data according to the transform key; and decrypting the second data according to the first private key. In the data processing, main work is completed by the server with no need to use a secure channel to transmit a key. ## Claims ### Claim 1 A data processing system, comprising: a terminal device, a network entity that includes a key generation center (KGC), and a server, wherein: the terminal device is configured to generate a first public key and a first private key; the terminal device is configured to send the first public key to the KGC; the KGC is configured to: receive the first public key from the terminal device, and generate a second public key according to a system parameter, a master key, internal state information of the KGC, the first public key, and attribute information of the terminal device, wherein the system parameter is public information related to the KGC, and the master key is a private key of the KGC; the KGC is configured to send the second public key to the server; the server is configured to receive the second public key sent by the KGC; the server is configured to obtain first data, wherein the first data is data that is encrypted based on the attribute structure of the terminal device; the server is configured to transform the first data into second data according to the second public key; the server is configured to send the second data to the terminal device; and the terminal device is configured to: receive the second data sent by the server, and decrypt the second data according to the first private key. ### Claim 2 (depends on 1) The system according to claim 1, wherein: the terminal device is configured to generate the first public key and the first private key according to the system parameter and an identity parameter, wherein the system parameter is the public information related to the KGC, and the identity parameter is identification information of the terminal device. ### Claim 3 (depends on 1) The system according to claim 1, wherein: the KGC is further configured to generate a transform key according to the second public key and key update information; the KGC is further configured to: in response to the key update information indicating that the terminal device is revoked, generate an error prompt according to the second public key and the key update information, and send the error prompt to the server; or in response to the key update information indicating that the terminal device is not revoked, generate the transform key according to the second public key and the key update information, and send the transform key to the server; and the server is further configured to transform the first data into the second data according to the transform key. ### Claim 4 (depends on 1) The system according to claim 1, wherein: the server is further configured to receive key update information from the KGC, wherein the key update information is used to indicate whether the terminal device is revoked; and the server is further configured to: in response to the key update information indicating that the terminal device is revoked, generate the error prompt according to the second public key and the key update information; or in response to the key update information indicating that the terminal device is not revoked, generate a transform key according to the second public key and the key update information, and transform the first data into the second data according to the transform key. ### Claim 5 (depends on 1) The system according to claim 1, wherein the first public key and the first private key are a pair of a public key and a private key that match each other in a public-key cryptographic algorithm. ### Claim 6 A data processing method, wherein the method comprises: generating, by a terminal device, a first public key and a first private key; sending, by the terminal device, the first public key to a network entity that includes a key generation center (KGC), so that a server or the KGC generates a transform key according to the first public key; receiving, by the terminal device, second data sent by the server, wherein the second data is data that is generated after the server processes first data according to the transform key, and the first data is data that is encrypted based on an attribute structure of the terminal device and that is obtained by the server; and decrypting, by the terminal device, the second data according to the first private key. ### Claim 7 (depends on 6) The method according to claim 6, wherein the sending, by the terminal device, the first public key comprises: sending, by the terminal device, the first public key and certification information to the KGC, wherein the certification information indicates that the terminal device stores the first private key. ### Claim 8 (depends on 6) The method according to claim 6, wherein the generating, by the terminal device, the first public key and the first private key comprises: generating, by the terminal device, the first public key and the first private key according to a system parameter, wherein the system parameter is public information related to the KGC. ### Claim 9 (depends on 8) The method according to claim 8, wherein the decrypting, by the terminal device, the second data according to the first private key comprises: decrypting, by the terminal device, the second data according to the system parameter and the first private key. ### Claim 10 (depends on 6) The method according to claim 6, wherein the first public key and the first private key are a pair of a public key and a private key that match each other in a public-key cryptographic algorithm. ### Claim 11 A data processing method, wherein the method comprises: receiving, by a key generation center (KGC) included in a network entity, a first public key from a terminal device; generating, by the KGC, the second public key according to a system parameter, a master key, the first public key, attribute information of the terminal device, and internal state information of the KGC, wherein the system parameter is public information related to the KGC, and the master key is a private key of the KGC; and sending, by the KGC, the second public key or a transform key to a server, wherein the transform key is generated according to the second public key and key update information. ### Claim 12 (depends on 11) The method according to claim 11, wherein before the generating, by the KGC, the second public key, the method further comprises: receiving, by the KGC, certification information from the terminal device, wherein the certification information is used to indicate that the terminal device stores a first private key. ### Claim 13 (depends on 11) The method according to claim 11, further comprising: generating, by the KGC, the transform key according to the second public key and key update information, wherein generating, by the KGC, the transform key comprises: generating, by the KGC, the transform key according to the second public key, the key update information, the system parameter, and an identity parameter, wherein the key update information indicates that the terminal device is not revoked. ### Claim 14 (depends on 11) The method according to claim 11, wherein the first public key and the first private key are a pair of a public key and a private key that match each other in a public-key cryptographic algorithm. ### Claim 15 A data processing method, wherein the method comprises: receiving, by a server, a second public key from a key generation center (KGC) included in a network entity, wherein the second public key is generated by the KGC according to a first public key, attribute information of a terminal device, a system parameter, a master key, and internal state information of the KGC, wherein the system parameter is public information related to the KGC, the master key is a private key of the KGC, and the first public key is a public key of the terminal device; obtaining, by the server, first data, wherein the first data is data that is encrypted based on the attribute structure of the terminal device; transforming, by the server, the first data into second data according to the second public key; and sending, by the server, the second data to the terminal device, so that the terminal device decrypts the second data according to a first private key. ### Claim 16 (depends on 15) The method according to claim 15, wherein after the receiving, by the server, the second public key, the method further comprises: receiving, by the server, key update information from the KGC, wherein the key update information indicates whether the terminal device is revoked; wherein the transforming, by the server, the first data into the second data according to the second public key comprises: in response to the key update information indicating that the terminal device is not revoked, generating, by the server, the transform key according to the second public key and the key update information; and transforming, by the server, the first data into the second data according to the transform key. ### Claim 17 (depends on 16) The method according to claim 16, wherein the generating, by the server, the transform key according to the second public key and the key update information comprises: generating, by the server, the transform key according to the second public key, the key update information, the system parameter, and an identity parameter, wherein the system parameter is the public information related to the KGC, and the identity parameter is identification information of the terminal device or a user of the terminal device. ### Claim 18 (depends on 17) The method according to claim 17, wherein the transforming, by the server, the first data into the second data according to the transform key comprises: transforming, by the server, the first data into the second data according to one or more of the transform key, the system parameter, the attribute information of the terminal device, the identity parameter, or a time parameter, wherein the system parameter is the public information related to the KGC, the identity parameter is the identification information of the terminal device or the user of the terminal device, and the time parameter is used to indicate a time during which the server is allowed to use the transform key. ### Claim 19 (depends on 15) The method according to claim 15, wherein the first public key and the first private key are a pair of a public key and a private key that match each other in a public-key cryptographic algorithm.