A data processing method, apparatus and device

Abstract

The application provides a data processing method, device and equipment, wherein the data processing method comprises the following steps: sending a decryption request to at least two data decryption nodes respectively; the decryption request carries a data access address; receiving a decryption result and first verification parameter information for the decryption result fed back by each data decryption node; obtaining decrypted data according to each decryption result and the first verification parameter information; wherein the decryption result comprises part of the decrypted content of the ciphertext data corresponding to the decryption request. This scheme can support the implementation of data decryption by using multiple data decryption nodes, and then the complete decrypted data is obtained according to the decryption results (part of the decrypted data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by single-point storage of asymmetric keys, and the problem of management difficulty caused by symmetric keys.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a data processing method, device and equipment. BACKGROUND

[0002] With the rapid development of digital economy and Internet technology, computing power network has become a new productivity in the era of digital economy. Computing power network is a new type of infrastructure for the integration of computing power and network. The stronger the computing power, the stronger the data processing capability, and the more accurate the useful data obtained. Computing power network connects distributed computing nodes, dynamically and real-time perceives the state of computing resources and network resources, forms a network with perceivable, allocatable and schedulable computing resources, and meets the requirements of new businesses and new applications for computing power.

[0003] Among them, one of the main uses of computing power network is data storage. Specifically, users may store their data on remote computing network nodes due to device limitations or access convenience needs. In addition, by storing data on computing network nodes, efficient and convenient data sharing between different institutions can also be achieved.

[0004] However, with the continuous increase of network security risks and the increasingly severe threat challenges, the data stored on the computing network nodes may also face various threats (existence of leakage or tampering problems). Based on this, in the prior art, the data provider DP can encrypt the data and send it to the computing network node for storage, and the data user can download the data and decrypt it to obtain the plaintext data. However, using this prior art, there are problems such as symmetric key management difficulty and low security of asymmetric key single-point storage.

[0005] From the above, the existing data processing scheme has the problems of symmetric key management difficulty and low security of asymmetric key single-point storage. SUMMARY

[0006] The purpose of the present application is to provide a data processing method, device and equipment to solve the problem of symmetric key management difficulty and low security of asymmetric key single-point storage in the existing data processing scheme.

[0007] To solve the above technical problems, the present application provides a data processing method applied to a data usage node, comprising:

[0008] sending a decryption request to at least two data decryption nodes respectively; the decryption request carries a data access address;

[0009] receiving the decryption result and the first verification parameter information for the decryption result fed back by each data decryption node;

[0010] obtaining decryption data according to the decryption results and the first verification parameter information;

[0011] The decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request.

[0012] Optionally, the obtaining of the decryption data according to the decryption results and the first verification parameter information comprises:

[0013] verifying the decryption results according to the first verification parameter information respectively;

[0014] obtaining decryption data according to the decryption results that pass the verification.

[0015] Optionally, the obtaining of the decryption data according to the decryption results that pass the verification comprises:

[0016] obtaining at least one candidate decryption result according to the decryption results that pass the verification;

[0017] obtaining a first random number according to the candidate decryption results and first and second bilinear mappings corresponding to the candidate decryption results respectively;

[0018] obtaining decryption data according to the first random number;

[0019] The mapping parameters of the first bilinear mapping include first public parameters and first data encryption parameters corresponding to the candidate decryption results.

[0020] The mapping parameters of the second bilinear mapping include second data encryption parameters and part of private keys of the data usage node.

[0021] Optionally, before the obtaining of the first random number according to the candidate decryption results and the first and second bilinear mappings corresponding to the candidate decryption results respectively, the method further comprises:

[0022] receiving the part of private keys sent by the key management node and obtaining second verification parameter information corresponding to the part of private keys;

[0023] verifying the part of private keys by using bilinear mapping, a generator, public key related parameters and the second verification parameter information;

[0024] in the case of passing the verification, saving the part of private keys;

[0025] The public key related parameter is obtained according to an identity identifier of the data use node and a first hash function, the first hash function is inputted with binary calculation of any length, and the first hash function is outputted with a q-order additive cyclic group, wherein q is a prime number greater than a threshold value, which is generated by the key management node according to inputted security parameters.

[0026] Optionally, the number of the candidate decryption results satisfies a first condition, wherein the first condition is n >= 2t-1, n represents the total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

[0027] The embodiment of the application further provides a data processing method applied to a data decryption node, comprising the following steps:

[0028] receiving a decryption request sent by a data use node, wherein the decryption request carries a data access address;

[0029] obtaining ciphertext data from a key network node according to the data access address;

[0030] obtaining a decryption result and first verification parameter information corresponding to the decryption result according to the ciphertext data;

[0031] sending the decryption result and the first verification parameter information to the data use node;

[0032] The decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request.

[0033] Optionally, the step of obtaining the decryption result and the first verification parameter information corresponding to the decryption result according to the ciphertext data comprises the following steps:

[0034] obtaining the decryption result and the first verification parameter information corresponding to the decryption result according to a second random number, the ciphertext data and partial key corresponding to the data use node.

[0035] Optionally, before the step of obtaining the decryption result and the first verification parameter information corresponding to the decryption result according to the ciphertext data and the partial key corresponding to the data use node, the method further comprises the following steps:

[0036] receiving the partial key sent by the key management node and obtaining third public parameter corresponding to the partial key;

[0037] verifying the partial key by using a bilinear mapping, a generator, a public key related parameter and the third public parameter;

[0038] in the case that the verification is passed, saving the partial key;

[0039] The public key related parameter is obtained according to an identity identifier of the data usage node and a first hash function, the first hash function is input of binary calculation of any length, and the first hash function is output of a q-order additive cyclic group, wherein q is a prime number greater than a threshold value generated by the key management node according to input security parameters.

[0040] Optionally, before the decryption result and the first verification parameter information for the decryption result are obtained according to the ciphertext data and the partial key corresponding to the data usage node, the method further comprises the following steps of:

[0041] randomly obtaining the second random number;

[0042] obtaining a first public parameter according to the second random number and a generator and publicly publishing the first public parameter.

[0043] The embodiment of the application further provides a data processing method applied to a data providing node, comprising the following steps of:

[0044] obtaining a first data encryption parameter according to the data to be encrypted, a first random number and a second public parameter;

[0045] obtaining ciphertext data according to the first data encryption parameter;

[0046] sending the ciphertext data to a network node.

[0047] The embodiment of the application further provides a data processing method applied to a key management node, comprising the following steps of:

[0048] obtaining a partial key of a data usage node and a third public parameter for each data decryption node in at least two data decryption nodes;

[0049] sending each partial key to a corresponding data decryption node through a secure channel;

[0050] publicly publishing each third public parameter.

[0051] Optionally, the method further comprises the following steps of:

[0052] obtaining a public key related parameter according to an identity identifier of a data usage node and a first hash function;

[0053] obtaining a partial private key of the data usage node and second verification parameter information for the partial private key according to a generator, a secret parameter randomly selected and the public key related parameter;

[0054] sending the partial private key to the data usage node through a secure channel and publicly publishing the second verification parameter information.

[0055] The embodiment of the present application further provides a data processing device applied to a data use node, comprising:

[0056] A first sending module is used for sending decryption requests to at least two data decryption nodes respectively, wherein the decryption requests carry data access addresses;

[0057] A first receiving module is used for receiving decryption results fed back by the data decryption nodes and first verification parameter information corresponding to the decryption results;

[0058] A first processing module is used for obtaining decryption data according to the decryption results and the first verification parameter information;

[0059] The decryption results comprise partial decryption contents of the ciphertext data corresponding to the decryption requests.

[0060] Optionally, the obtaining of the decryption data according to the decryption results and the first verification parameter information comprises:

[0061] The corresponding decryption results are verified according to the first verification parameter information respectively;

[0062] The decryption data is obtained according to the decryption results that pass the verification.

[0063] Optionally, the obtaining of the decryption data according to the decryption results that pass the verification comprises:

[0064] At least one candidate decryption result is obtained according to the decryption results that pass the verification;

[0065] A first random number is obtained according to the candidate decryption results and first bilinear mapping and second bilinear mapping corresponding to the candidate decryption results respectively;

[0066] The decryption data is obtained according to the first random number;

[0067] The mapping parameters of the first bilinear mapping comprise first public parameters and first data encryption parameters corresponding to the candidate decryption results;

[0068] The mapping parameters of the second bilinear mapping comprise second data encryption parameters and partial private keys of the data use node.

[0069] Optionally, the data processing device further comprises:

[0070] A second receiving module is used for receiving the partial private keys sent by a key management node and obtaining second verification parameter information corresponding to the partial private keys before the obtaining of the first random number according to the candidate decryption results and the first bilinear mapping and the second bilinear mapping corresponding to the candidate decryption results respectively;

[0071] The first verification module is configured to verify the partial private key by using a bilinear mapping, a generator, a public key related parameter, and the second verification parameter information.

[0072] The first saving module is configured to save the partial private key if the verification is passed.

[0073] The public key related parameter is obtained according to an identity identifier of the data using node and a first hash function, the first hash function is an arbitrary length binary calculation, the output of the first hash function is a q-order additive cyclic group, and the q is a prime number greater than a threshold value generated by the key management node according to an input security parameter.

[0074] Optionally, the number of the candidate decryption results satisfies a first condition, wherein the first condition is n≥2t-1, n represents the total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

[0075] Embodiments of the present application also provide a data processing device applied to a data decryption node, comprising:

[0076] The third receiving module is configured to receive a decryption request sent by a data using node, wherein the decryption request carries a data access address.

[0077] The first obtaining module is configured to obtain ciphertext data from a computing node according to the data access address.

[0078] The second processing module is configured to obtain a decryption result and first verification parameter information for the decryption result according to the ciphertext data.

[0079] The second sending module is configured to send the decryption result and the first verification parameter information to the data using node.

[0080] The decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request.

[0081] Optionally, the obtaining of the decryption result and the first verification parameter information for the decryption result according to the ciphertext data comprises:

[0082] The decryption result and the first verification parameter information for the decryption result are obtained according to the second random number, the ciphertext data, and the partial key corresponding to the data using node.

[0083] Optionally, the data processing device further comprises:

[0084] a fourth receiving module, configured to receive the partial key sent by the key management node and acquire a third public parameter corresponding to the partial key before obtaining a decryption result and first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data usage node;

[0085] a second verification module, configured to verify the partial key by using a bilinear mapping, a generator, a public key related parameter and the third public parameter;

[0086] a second saving module, configured to save the partial key in a case of passing the verification;

[0087] The public key related parameter is obtained according to an identity identifier of the data usage node and a first hash function, the first hash function is input of binary calculation of any length, the first hash function is output of a q-order additive cyclic group, and the q is a prime number greater than a threshold value generated by the key management node according to input security parameters.

[0088] Optionally, the data processing device further comprises:

[0089] a third processing module, configured to randomly acquire the second random number before obtaining the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data usage node;

[0090] a fourth processing module, configured to obtain a first public parameter and make the first public parameter public according to the second random number and the generator.

[0091] Embodiments of the present application further provide a data processing device applied to a data providing node, comprising:

[0092] a fifth processing module, configured to obtain a first data encryption parameter according to to-be-encrypted data, a first random number and a second public parameter;

[0093] a sixth processing module, configured to obtain ciphertext data according to the first data encryption parameter;

[0094] a third sending module, configured to send the ciphertext data to a network node.

[0095] Embodiments of the present application further provide a data processing device applied to a key management node, comprising:

[0096] a second acquiring module, configured to acquire a partial key of a data usage node and a third public parameter for each data decryption node in at least two data decryption nodes respectively;

[0097] A fourth sending module is configured to send each of the partial keys to the corresponding data decryption node via a secure channel.

[0098] A seventh processing module is configured to disclose each of the third public parameters.

[0099] Optionally, the method further comprises:

[0100] An eighth processing module is configured to obtain a public key related parameter according to the identity identifier of the data usage node and the first hash function.

[0101] A third obtaining module is configured to obtain a partial private key of the data usage node and second verification parameter information corresponding to the partial private key according to the generator, the secret parameter randomly selected, and the public key related parameter.

[0102] A ninth processing module is configured to send the partial private key to the data usage node via a secure channel and disclose the second verification parameter information.

[0103] Embodiments of the present application also provide a data processing device, which is a data usage node and comprises a processor and a transceiver.

[0104] The processor is configured to send decryption requests to at least two data decryption nodes respectively via the transceiver, wherein the decryption requests carry data access addresses.

[0105] The transceiver is configured to receive decryption results and first verification parameter information corresponding to the decryption results fed back by each of the data decryption nodes.

[0106] The decryption data is obtained according to each of the decryption results and the first verification parameter information.

[0107] The decryption results comprise partial decryption contents of the ciphertext data corresponding to the decryption requests.

[0108] Optionally, the decryption data is obtained according to each of the decryption results and the first verification parameter information, and the method comprises:

[0109] Each of the decryption results is verified according to each of the first verification parameter information.

[0110] The decryption data is obtained according to the decryption results that pass the verification.

[0111] Optionally, the decryption data is obtained according to the decryption results that pass the verification, and the method comprises:

[0112] At least one candidate decryption result is obtained according to the decryption results that pass the verification.

[0113] According to each of the candidate decryption results and respectively corresponding first bilinear mapping and second bilinear mapping, a first random number is obtained;

[0114] According to the first random number, decryption data is obtained;

[0115] The mapping parameters of the first bilinear mapping include first public parameters and first data encryption parameters corresponding to the candidate decryption results;

[0116] The mapping parameters of the second bilinear mapping include second data encryption parameters and part of the private key of the data use node.

[0117] Optionally, the processor is further configured to:

[0118] Before the first random number is obtained according to each of the candidate decryption results and respectively corresponding first bilinear mapping and second bilinear mapping, the part of the private key sent by the key management node is received through the transceiver, and second verification parameter information corresponding to the part of the private key is obtained;

[0119] The part of the private key is verified by using bilinear mapping, a generator, public key related parameters and the second verification parameter information;

[0120] In the case of passing the verification, the part of the private key is saved;

[0121] The public key related parameters are obtained according to the identity identifier of the data use node and a first hash function, the input of the first hash function is binary calculation of any length, the output of the first hash function is a q-order additive cyclic group, and the q is a prime number greater than a threshold value generated by the key management node according to input security parameters.

[0122] Optionally, the number of the candidate decryption results satisfies a first condition, wherein the first condition is: n≥2t-1, n represents the total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

[0123] Embodiments of the present application also provide a data processing device, the data processing device being a data decryption node, comprising: a processor and a transceiver;

[0124] The processor is configured to receive a decryption request sent by a data use node through the transceiver, wherein the decryption request carries a data access address;

[0125] According to the data access address, ciphertext data is obtained from an algorithm node;

[0126] According to the ciphertext data, a decryption result and first verification parameter information for the decryption result are obtained.

[0127] send the decryption result and first verification parameter information to the data usage node through the transceiver;

[0128] The decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request.

[0129] Optionally, the obtaining of the decryption result and the first verification parameter information for the decryption result according to the ciphertext data comprises:

[0130] obtaining the decryption result and the first verification parameter information for the decryption result according to the second random number, the ciphertext data and the partial key corresponding to the data usage node.

[0131] Optionally, the processor is further configured to:

[0132] before the obtaining of the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data usage node, receiving the partial key sent by the key management node through the transceiver and obtaining third public parameter corresponding to the partial key;

[0133] verifying the partial key by using a bilinear mapping, a generator, public key related parameters and the third public parameter;

[0134] in the case of passing the verification, saving the partial key;

[0135] The public key related parameters are obtained according to an identity identifier of the data usage node and a first hash function, the first hash function is input of binary calculation of any length, the first hash function is output of a q-order additive cyclic group, and q is a prime number greater than a threshold value generated by the key management node according to input security parameters.

[0136] Optionally, the processor is further configured to:

[0137] before the obtaining of the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data usage node, randomly obtaining the second random number;

[0138] obtaining the first public parameter according to the second random number and the generator and making the first public parameter public.

[0139] The embodiment of the application further provides a data processing device, which is a data providing node and comprises a processor and a transceiver.

[0140] The processor is configured to obtain a first data encryption parameter according to the data to be encrypted, the first random number and the second public parameter.

[0141] The ciphertext data is obtained according to the first data encryption parameter.

[0142] The transceiver is configured to send the ciphertext data to a network node.

[0143] Embodiments of the present application also provide a data processing device, which is a key management node, comprising a processor and a transceiver.

[0144] The processor is configured to obtain a partial key of the data usage node and a third public parameter for each data decryption node of at least two data decryption nodes.

[0145] The transceiver is configured to send each partial key to the corresponding data decryption node through a secure channel.

[0146] Each third public parameter is disclosed.

[0147] Optionally, the processor is further configured to:

[0148] A public key related parameter is obtained according to an identity identifier of the data usage node and a first hash function.

[0149] A partial private key of the data usage node and a second verification parameter information for the partial private key are obtained according to a generator, a secret parameter obtained by random selection and the public key related parameter.

[0150] The transceiver is configured to send the partial private key to the data usage node through a secure channel, and the second verification parameter information is disclosed.

[0151] Embodiments of the present application also provide a data processing device, comprising a memory, a processor and a program stored in the memory and executable on the processor; when the processor executes the program, the data processing method of the data usage node side, the data decryption node side, the data providing node side or the key management node side is implemented.

[0152] Embodiments of the present application also provide a readable storage medium, which stores a program, and when the processor executes the program, the steps of the data processing method of the data usage node side, the data decryption node side, the data providing node side or the key management node side are implemented.

[0153] The beneficial effects of the above technical solutions of the present application are as follows:

[0154] In the above scheme, the data processing method sends decryption requests to at least two data decryption nodes respectively; the decryption request carries a data access address; receives decryption results and first verification parameter information for the decryption results from each of the data decryption nodes; and obtains decrypted data based on each of the decryption results and the first verification parameter information; wherein, the decryption result includes: a partial decryption of the ciphertext data corresponding to the decryption request; it can support the use of multiple data decryption nodes to perform data decryption, and then obtain complete decrypted data based on the decryption results (partial decrypted data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the low security problem caused by single-point storage of asymmetric keys and the management difficulties caused by using symmetric keys; and this scheme can avoid data leakage caused by attacks on data user nodes, and reduce the risk of private key leakage caused by attacks on a single point (a single data decryption node), improving the security of data user private keys; in addition, this scheme requires multiple data decryption nodes and data user nodes to process together to obtain plaintext information (i.e., decrypted data), which can avoid the risk of data decryption nodes colluding to decrypt. Attached Figure Description

[0155] Figure 1 This is a schematic flowchart of the data processing method according to an embodiment of the present invention. Figure One ;

[0156] Figure 2 This is a schematic flowchart of the data processing method according to an embodiment of the present invention. Figure Two ;

[0157] Figure 3 This is a schematic flowchart of the data processing method according to an embodiment of the present invention. Figure Three ;

[0158] Figure 4 This is a schematic flowchart of the data processing method according to an embodiment of the present invention. Figure Four ;

[0159] Figure 5 This is a schematic diagram illustrating the implementation framework of the data processing method according to an embodiment of the present invention;

[0160] Figure 6 This is a schematic diagram of the data processing device structure according to an embodiment of the present invention. Figure One ;

[0161] Figure 7 This is a schematic diagram of the data processing device structure according to an embodiment of the present invention. Figure Two ;

[0162] Figure 8 This is a schematic diagram of the data processing device structure according to an embodiment of the present invention. Figure Three ;

[0163] Figure 9 Structure diagram of a data processing device according to an embodiment of the present application Figure Four

[0164] Figure 10 Structure diagram of a data processing device according to an embodiment of the present application Figure One

[0165] Figure 11 Structure diagram of a data processing device according to an embodiment of the present application Figure Two

[0166] Figure 12 Structure diagram of a data processing device according to an embodiment of the present application Figure Three

[0167] Figure 13 Structure diagram of a data processing device according to an embodiment of the present application Figure Four . DETAILED DESCRIPTION

[0168] In order to make the technical problems, technical solutions and advantages of the present application clearer, the following will be described in detail with reference to the accompanying drawings and specific embodiments.

[0169] Firstly, the related content of the present solution will be introduced.

[0170] The data stored on the computing network node in the prior art can face various threats, such as:

[0171] 1) Computing network node attack problem: Since the computing network node stores a large amount of user data, it can become the target of malicious attackers. If the computing network node is attacked, the data stored on the computing network node is at risk of leakage and tampering.

[0172] 2) Computing network node credibility problem: When an individual or an institution uploads sensitive data to the computing network node, the user loses control over the data, and some sensitive data can be viewed by the computing network node with low credibility.

[0173] 3) Data encryption key security problem: In order to protect the confidentiality of data, the data provider node will encrypt the data and upload it to the computing network node for storage and sharing. The decryption key of the single-point stored data can be attacked, resulting in leakage.

[0174] Specifically, to solve the above problems, the following methods can be used:

[0175] Method 1) The data provider DP sends the encrypted data to the computing network node for storage, and the data user downloads and decrypts the data to obtain the plaintext data. However, this method has the following disadvantages:

[0176] ​​​​a) Symmetric key management difficult problem: encryption and decryption need key support, many existing schemes may use the way of preset symmetric key, but in the algorithm network environment, the number of data providers, data users, algorithm network nodes and other roles is large, and the use of symmetric encryption technology will bring complex key management problems, and the key management center that is always online may become the main target of attackers.

[0177] b) Symmetric key leakage tracing difficult problem: using symmetric encryption technology using symmetric key, both parties will share the secret information, if there is key leakage, it is impossible to confirm which party leaked the key.

[0178] c) Non-symmetric key single-point storage security problem: due to the above problems of symmetric key in the algorithm network environment, many technical solutions will use certificate-based public key cryptography technology to encrypt and decrypt data, but the data user node device has limited protection capability (especially many Internet of Things (IoT) devices, such as unattended devices, etc.), and the single-point storage of data decryption key may be attacked and thus lead to leakage.

[0179] Method 2) To solve the non-symmetric key single-point storage security problem, the method of delegated decryption can be used: the data user synchronizes the decryption key to the algorithm network node with good protection measures for delegated decryption, which does not need the data user node to manage its own private key, but if the algorithm network node is attacked or has low trustworthiness, there is still a risk of private key leakage and data leakage.

[0180] Based on the above, the present application aims at the problems of symmetric key management difficulty and low security of non-symmetric key single-point storage in the existing data processing scheme, and provides a data processing method applied to a data use node, such as Figure 1 As shown in the figure, it comprises:

[0181] Step 11: sending a decryption request to at least two data decryption nodes respectively; the decryption request carries a data access address;

[0182] Step 12: receiving the decryption result fed back by each data decryption node and the first verification parameter information for the decryption result;

[0183] Step 13: obtaining the decrypted data according to each decryption result and the first verification parameter information; wherein the decryption result includes part of the decrypted content of the ciphertext data corresponding to the decryption request.

[0184] The data processing method provided by the embodiment of the application comprises the following steps: sending a decryption request to at least two data decryption nodes respectively, wherein the decryption request carries a data access address; receiving a decryption result and first verification parameter information corresponding to the decryption result which are fed back by each data decryption node; and obtaining decryption data according to each decryption result and the first verification parameter information, wherein the decryption result comprises partial decryption content of ciphertext data corresponding to the decryption request. The method can support data decryption by using multiple data decryption nodes, and then obtain complete decryption data according to the decryption results (partial decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by asymmetric key single-point storage, and the problem of management difficulty caused by symmetric key. The method can also avoid data leakage caused by an attack on a data use node, reduce the risk of private key leakage caused by an attack on a single point (a single data decryption node), and improve the security of the private key of a data user. In addition, the method requires multiple data decryption nodes and data use nodes to jointly process to obtain plaintext information (i.e., decryption data), thereby avoiding the risk of collusion decryption of data decryption nodes.

[0185] The method comprises the following steps: verifying each decryption result according to each first verification parameter information; and obtaining decryption data according to the decryption result that passes the verification.

[0186] In this way, the decryption result can be accurately obtained.

[0187] In the embodiment of the application, the method comprises the following steps: obtaining at least one candidate decryption result according to the decryption result that passes the verification; obtaining a first random number according to each candidate decryption result and a first bilinear mapping and a second bilinear mapping corresponding to the candidate decryption result respectively; and obtaining decryption data according to the first random number, wherein the mapping parameters of the first bilinear mapping comprise a first public parameter and a first data encryption parameter corresponding to the candidate decryption result, and the mapping parameters of the second bilinear mapping comprise a second data encryption parameter and a partial private key of the data use node.

[0188] In this way, the validity of the obtained decryption data can be ensured.

[0189] Further, before the first random number is obtained according to each of the candidate decryption results and the corresponding first bilinear mapping and second bilinear mapping respectively, the method further comprises: receiving the partial private key sent by the key management node, and obtaining second verification parameter information corresponding to the partial private key; verifying the partial private key by using a bilinear mapping, a generator, public key related parameters and the second verification parameter information; in the case of passing the verification, saving the partial private key; wherein the public key related parameters are obtained according to the identity identifier of the data using node and a first hash function, the first hash function is an input of binary calculation of any length, and the first hash function is an output of a q-order additive cyclic group, and the q is a prime number greater than a threshold value generated by the key management node according to an input security parameter.

[0190] In this way, the validity of the obtained partial private key can be ensured.

[0191] The number of the candidate decryption results satisfies a first condition, wherein the first condition is: n≥2t-1, n represents the total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

[0192] In this way, the delegated decryption operation can be ensured to be implemented.

[0193] The embodiment of the application further provides a data processing method applied to a data decryption node, as shown in the following table: Figure 2 The method comprises the following steps:

[0194] Step 21: receiving a decryption request sent by a data using node; the decryption request carries a data access address;

[0195] Step 22: obtaining ciphertext data from a computing node according to the data access address;

[0196] Step 23: obtaining a decryption result and first verification parameter information for the decryption result according to the ciphertext data;

[0197] Step 24: sending the decryption result and the first verification parameter information to the data using node; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request.

[0198] The data processing method provided by the embodiment of the application comprises the following steps: receiving a decryption request sent by a data using node; the decryption request carries a data access address; obtaining ciphertext data from a calculation network node according to the data access address; obtaining a decryption result and first verification parameter information for the decryption result according to the ciphertext data; and sending the decryption result and the first verification parameter information to the data using node; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request; the data using node can support data decryption by using multiple data decryption nodes, and then complete decryption data is obtained according to the decryption results (partial decryption data) obtained by each data decryption node, so that distributed delegated decryption is realized, the problem of low security caused by asymmetric key single-point storage is avoided, and the problem of management difficulty caused by symmetric key is avoided; in addition, the scheme can avoid data leakage caused by an attack on the data using node, reduce the risk of private key leakage caused by an attack on a single point (a single data decryption node), and improve the security of the private key of the data user; in addition, the scheme requires multiple data decryption nodes and data using nodes to jointly process to obtain plaintext information (i.e. decryption data), so that the risk of collusion decryption of the data decryption nodes can be avoided.

[0199] The method further comprises the following steps: obtaining the decryption result and the first verification parameter information for the decryption result according to the second random number, the ciphertext data and the partial key corresponding to the data using node.

[0200] In this way, the decryption result and the first verification parameter information for the decryption result can be accurately obtained.

[0201] Further, before obtaining the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data using node, the method further comprises the following steps: receiving the partial key sent by the key management node and obtaining third public parameters corresponding to the partial key; verifying the partial key by using a bilinear mapping, a generator, public key related parameters and the third public parameters; and saving the partial key in a case where the verification is passed; wherein the public key related parameters are obtained according to an identity identifier of the data using node and a first hash function, the first hash function is input of binary calculation of any length, and the first hash function is output of a q-order additive cyclic group, wherein q is a prime number greater than a threshold value generated by the key management node according to input security parameters.

[0202] In this way, the accuracy of the obtained partial key can be ensured.

[0203] In the embodiment of the present application, before the decryption result and the first verification parameter information corresponding to the decryption result are obtained according to the ciphertext data and the partial key corresponding to the data usage node, the method further comprises: randomly obtaining the second random number (and saving it); and obtaining the first public parameter according to the second random number and the generator and making the first public parameter public.

[0204] In this way, the data usage node can obtain the decrypted data according to the first public parameter.

[0205] The embodiment of the present application also provides a data processing method applied to a data providing node, as shown in the following table. Figure 3 The method comprises the following steps.

[0206] Step 31: obtaining a first data encryption parameter according to the data to be encrypted, the first random number and the second public parameter.

[0207] Step 32: obtaining ciphertext data according to the first data encryption parameter.

[0208] Step 33: sending the ciphertext data to a data network node.

[0209] The data processing method provided by the embodiment of the present application can support the data usage node to use multiple data decryption nodes to perform data decryption, and then obtain complete decrypted data according to the decryption results (partial decrypted data) obtained by the data decryption nodes, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by single-point storage of asymmetric keys and the problem of management difficulty caused by symmetric keys, and obtaining the first data encryption parameter according to the data to be encrypted, the first random number and the second public parameter, obtaining ciphertext data according to the first data encryption parameter, and sending the ciphertext data to a data network node.

[0210] The embodiment of the present application also provides a data processing method applied to a data providing node, as shown in the following table. Figure 4 The method comprises the following steps.

[0211] Step 41: obtaining a partial key of a data usage node and a third public parameter for each data decryption node in at least two data decryption nodes.

[0212] Step 42: sending each partial key to the corresponding data decryption node through a secure channel; and making each third public parameter public.

[0213] Wherein, the sending of each of the partial keys to the corresponding data decryption node through a secure channel and the publicizing of each of the third public parameters are not distinguished in sequence.

[0214] The data processing method provided by the embodiment of the present application can support the implementation of data decryption by the data usage node using multiple data decryption nodes, and then obtaining complete decryption data according to the decryption results (partial decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by the asymmetric key single-point storage and the problem of management difficulty caused by the symmetric key, and improving the security of the private key of the data user. In addition, the present scheme needs multiple data decryption nodes and data usage nodes to jointly process to obtain the plaintext information (i.e. decryption data), which can avoid the risk of collusion decryption of the data decryption node.

[0215] Further, the data processing method further comprises: obtaining a public key related parameter according to the identity identifier of the data usage node and a first hash function; obtaining a partial private key of the data usage node and a second verification parameter information for the partial private key according to a generator, a secret parameter randomly selected, and the public key related parameter; sending the partial private key to the data usage node through a secure channel, and publicizing the second verification parameter information.

[0216] In this way, the data usage node can obtain the partial private key and verify according to the second verification parameter information.

[0217] The data processing method provided by the embodiment of the present application is illustrated below.

[0218] In view of the above technical problems, the embodiment of the present application provides a data processing method, which can be specifically implemented as a distributed delegation decryption method in a computing network environment, and specifically: first, an identity-based public key cryptography (IBC) is adopted, which does not need the support of a PKI (public key infrastructure) digital certificate, simplifies the public key of a user, uses the identity information (corresponding to the identity identifier of the data user node, such as an email address, an ID card number, a server domain name, etc.) of the user as the public key, is suitable for a communication environment of multiple nodes of a communication network, and provides a trusted key management for multiple parties such as a computing network node, a data provider, a data user, etc. Secondly, the present solution can also solve the problems of delegation decryption, storage and sharing of data on the computing network node. Meanwhile, the present solution can also solve the problems of secure storage and use of a data decryption private key, avoid the leakage of the private key by the computing network node, and obtain sensitive data.

[0219] Specifically, the implementation of the present solution can adopt the architecture diagram shown in Figure 5 The parts involved in the architecture diagram are introduced as follows:

[0220] A data provider node DPN (corresponding to the data provider node): a data owner device, which uses the storage and computing capacity provided by a computing network to manage the data owned by the device.

[0221] A data user node DUN (corresponding to the data user node): a data user device, which uses the storage and computing capacity provided by a computing network to use the data provided by a third party.

[0222] A computing network node CNN: a node responsible for providing storage and computing capacity in a computing network, which can be self-operated by a computing network operator or be a third party.

[0223] A computing network delegation decryption node DDN (corresponding to the data decryption node): a node providing delegation decryption capacity in a computing network, which can be self-operated by an operator or be a third party, and has a certain credibility.

[0224] A key management node KMN: which has high security and credibility, and is used to provide key distribution and management. In the embodiment of the present solution, an IBC (identity-based cryptography) cryptographic technology is adopted, the KMN can be equivalent to a PKG (private key generator) in the IBC, and provides key management for nodes.

[0225] Based on the above, the scheme can realize the security management of the public parameters in the system and the public parameters of the plurality of DDN nodes by introducing the key security distribution and management of the KMN to the DUN, and uses the identity-based public key cryptography to take the identity information of the user as the public key to provide the trusted key management for the plurality of parties such as the computing network node, the data provider, the data user and the like, and the data is stored by the CNN and is decrypted by the DDN, in the whole data flow process, the relevant network element cannot obtain the final plaintext data, thereby the security of the data is ensured, and the sensitive data is avoided to be obtained by the third-party computing network node with low trustworthiness.

[0226] Specifically, the scheme can include the following operations:

[0227] S1, system setup process:

[0228] 1) The key management node KMN generates a large prime number q (i.e. a prime number greater than a threshold value) according to the input security parameter k, selects G1 as a q-order additive cyclic group, G2 as a q-order multiplicative cyclic group, generates a generator P G1, gives a bilinear mapping e: G1x G1→ G2, and defines five secure Hash functions H1: {0,1} * → G1 (indicating a calculation from an arbitrary length binary to G1), H2: G2→ {0,1} n (indicating a calculation from G2 to a binary of length n), H3: {0,1} n → Z q (Z q indicates a modulo q additive group), H4: {0,1} n → {0,1} n , and H5: G2→ G1, where n represents the bit length of the message. It can also be understood that the key management node generates a large prime number q according to the input security parameter; and determines the additive cyclic group G1 corresponding to the large prime number q, the multiplicative cyclic group G2 corresponding to the large prime number q, and the generator P; determines the bilinear mapping e: G1x G1→ G2 according to the additive cyclic group and the multiplicative cyclic group, and determines the five Hash functions.

[0229] 2) The KMN randomly selects and secretly saves the system master key (indicating that s is randomly selected from the integer multiplicative group of modulo q), calculates the public key P pub = s·P. The KMN discloses the system parameters {G1, G2, n, q, e, P, P pub , H1, H2, H3, H4, H5}. It can also be understood that the KMN randomly selects and secretly saves the system master key, calculates the public key, determines the system parameters and discloses them; the system parameters include the additive cyclic group, the multiplicative cyclic group, the bit length of the message, the large prime number, the bilinear mapping, the generator, the public key and the five Hash functions.

[0230] 3) All DDN nodes participating in the commissioned decryption in the system (including newly added DDN nodes in the future) are initialized as follows: for the DDN i (i = 1, …, n), a random number is randomly selected and secretly saved (representing s DDN,i is randomly selected from the integer multiplicative group of modulo q, the second random number is randomly obtained by the above-mentioned data decryption node, and is saved), the public parameter S DDN,i = s DDN,i · P (corresponding to the first public parameter obtained according to the second random number and the generator and the publicization) can be understood as the initialization processing of the DDN nodes participating in the commissioned decryption.

[0231] S2, Key Extract process:

[0232] Suppose that there are n DDN nodes in the system, and the threshold value of the scheme is t, which satisfies n ≥ 2t-1, where t represents that at least t DDN nodes are required to complete the commissioned decryption operation (corresponding to the number of candidate decryption results satisfying the first condition).

[0233] 1) For the user node DUN, let its identity identifier be ID DUN , which can be used as the public key of DUN. KMN randomly selects a secret parameter (representing y randomly selected from the integer multiplicative group of modulo q), calculates Y DUN = y·Q DUN , Y' DUN = y·P (corresponding to the partial private key of the data use node and the second verification parameter information for the partial private key obtained according to the secret parameter randomly selected from the generator and the public key related parameter), wherein the public key related parameter Q DUN = H1(ID DUN ), corresponding to the public key related parameter obtained according to the identity identifier of the data use node and the first hash function; Y DUN is sent to DUN through a secure channel as the partial private key of DUN and is secretly saved, and the public parameter Y' DUN (corresponding to the second verification parameter information; used for verifying whether Y DUN is generated by the DUN numbered i) is disclosed; corresponding to the above-mentioned sending the partial private key to the data use node through a secure channel and disclosing the second verification parameter information. It can also be understood that the public key of the user node DUN is determined according to the identifier information of the user node DUN, and the secret parameter is randomly selected by KMN, Y DUN = y·Q DUN , Y'DUN = y P, where Q DUN = H1(ID DUN ), Y DUN is part of the private key of DUN sent to DUN secretly through a secure channel, and Y DUN is public.

[0234] 2) DUN verifies the validity of Y DUN by the following calculation, and if consistent, Y DUN is saved secretly, otherwise, an error message is returned to KMN (the process of this DUN node ends):

[0235] e(Y DUN , P) = e(Q DUN , Y DUN ); corresponding to the above receiving the key management node sending the part of the private key, and obtaining the second verification parameter information corresponding to the part of the private key; using bilinear mapping, generator, public key related parameters and the second verification parameter information, verifying the part of the private key; in the case of passing the verification, saving the part of the private key. Here, e in the formula and e involved in the following similar formula can be a bilinear mapping constructed when the system is established, but it is not limited thereto.

[0236] S3, initialization process (Initialize):

[0237] 1) KMN randomly selects ( represents a i randomly selected from the integer multiplication group of the module q), where i = 1,..., t-1, constructs a (target) function (for subsequent data restoration and decryption):

[0238] f(x) = s + y + a1x + a2x 2 + … + a t-1 x t-1 ;

[0239] 2) For DDN1,..., DDN n , KMN (according to the above function) calculates the part of the key S DUN,i = f(i) Q DUN of DUN and the public parameter F i = f(i) P (corresponding to the above for each data decryption node in at least two data decryption nodes, respectively obtaining the part of the key of the data use node and the third public parameter), S DUN,i is sent to DDN i through a secure channel respectively (corresponding to the above sending each part of the key through a secure channel to the corresponding data decryption node), F iAs public parameters (corresponding to the public disclosure of each of the aforementioned third public parameters), where 1 ≤ i ≤ n. This can also be understood as, for n DDN nodes, KMN calculates a partial key S for each DUN. DUN,i =f(i)·Q DUN and public parameter F i =f(i)·P, then S DUN,i Send to DDN through the secure channel i F i As a public parameter, where 1≤i≤n.

[0240] As shown above, in this scheme, KMN splits the DUN key into multiple parts and sends them to DNN separately.

[0241] 3) DDN i (i = 1, ..., n) receives S DUN,i Afterwards (each DDN node receives key S) DUN,i (Afterwards), S is verified through the following calculations. DUN,i Validity:

[0242] e(S DUN,i ,P)=e(Q DUN ,F i The partial key is received from the key management node and a third public parameter corresponding to the partial key is obtained. The partial key is then verified using bilinear mapping, generators, public key related parameters, and the third public parameter.

[0243] If they match, then secretly save S. DUN,i (Corresponding to the above, if the verification is successful, the partial key is saved), otherwise an error message is returned to KMN.

[0244] S4. Data Encryption Process:

[0245] 1) When the DPN has data M (corresponding to the data to be encrypted mentioned above) that needs to be shared with the DUN via the computing network, the DPN obtains the DUN's public information ID from the KMN bulletin board. DUN (That is, the identifier of DUN, which is also the public key of DUN).

[0246] 2) DPN randomly selects a random number (corresponding to the first random number mentioned above). (Indicates that α is randomly selected from the integer multiplication group modulo q), calculate r = H3(α, M), V = r·P, U = r·Y' DUN (Corresponding to the above-mentioned method of obtaining the first data encryption parameters based on the data to be encrypted, the first random number, and the second publicly disclosed parameters), Obtain the encrypted ciphertext C DUN= (U, V, W, T); here C DUN = (U, V, W, T) is the encrypted ciphertext (corresponding to the above-mentioned ciphertext data obtained according to the first data encryption parameter). Among them, V, U, W and T are part of the encrypted ciphertext.

[0247] 3) DPN can select a suitable CNN (such as a relatively close CNN) through security, credibility and other principles, and send the ciphertext C DUN to the CNN storage (corresponding to the above-mentioned sending the ciphertext data to the algorithm node).

[0248] S5, data decryption process (Decrypt):

[0249] 1) When DUN needs to use the data shared by DPN, DUN sends the access address (such as URL, etc.) of the data to DDN i (i = 1, …, n), that is, to all DDN, to initiate a decryption request, DDN i obtains the ciphertext data C DUN = (U, V, W, T) from the CNN. Corresponding to the above-mentioned data use node sending a decryption request to at least two data decryption nodes respectively; the decryption request carries the data access address; the data decryption node receives the decryption request sent by the data use node; the decryption request carries the data access address; according to the data access address, obtain the ciphertext data from the algorithm node.

[0250] 2) DDN i (i = 1, …, n) calculates A DUN,i = e (V, S i + s DUN,i Y' DDN,i ), A' DUN = s i ·H5 (A DDN,i ), corresponding to the above-mentioned obtaining the decryption result and the first verification parameter information for the decryption result according to the second random number, the ciphertext data and the part of the key corresponding to the data use node; send (A i , A' i ) to DUN, corresponding to the above-mentioned sending the decryption result and the first verification parameter information to the data use node. Among them, (A i , A' i ) represents the decryption result and the first verification parameter information.

[0251] 3) DUN receives (A i , A' i )(i = 1, …, n), and verifies (A i , A' i ) through the following calculationi ) is valid:

[0252] e(H5(A i ),s DUN,i ·P) = e(A i ·P) ; corresponding to the above, according to each of the first verification parameter information, respectively, the corresponding decryption result is verified;

[0253] If consistent, it is a valid partial decryption result (corresponding to the above, according to the decryption result of the verification, the decryption data is obtained), otherwise it is an invalid partial decryption result, which may be DDN attack, etc., which can be reduced according to the case The credibility of the DDN.

[0254] 4) DUN randomly constructs a set from the valid decryption results (set as n' elements) And |T| = t (that is, the number of elements of set T is t; corresponding to the above, according to the decryption result of the verification, at least one candidate decryption result is obtained), the partial decryption result A i Reconstruction:

[0255]

[0256] Where Is the Lagrange coefficient. S DUN Indicates the real private key (complete) of DUN, which is determined by KMN, and DUN does not know, which can be S DUN = s·Q DUN But not limited to this.

[0257] 5) Calculate Get alpha (corresponding to the above, according to each of the candidate decryption results and the first and second bilinear mapping corresponding respectively, the first random number is obtained), and calculate the decryption message Corresponding to the above, according to the first random number, the decryption data is obtained.

[0258] From the above, the scheme can provide trusted key management for multiple parties such as algorithm network nodes, data providers, data users, etc., solve the problems of delegated decryption, storage and sharing of data on algorithm network nodes, and the safe storage and use of decryption private key, avoid the leakage of private key of algorithm network node, and the leakage of sensitive data. Specifically, the scheme involves the following contents:

[0259] 1) The scheme is applicable to the distributed delegated decryption system architecture in the algorithm network environment, and introduces KMN to realize the security distribution and management of DUN's key, and can realize the security management of the public parameters in the system and the public parameters of multiple DDN nodes.

[0260] 2) In this scheme, the private key of DUN is not saved and managed by DUN single point, and DUN itself does not have complete private key information, but the transformed private key is managed by n DDN nodes and DUN, which reduces the risk of private key leakage due to single point attack.

[0261] 3) The initialization process, key extraction process and other processes with less execution times of this scheme need the support of secure channel, and the data encryption and data decryption processes with more execution times do not need the support of secure channel, which reduces the communication load of the system.

[0262] 4) In the system establishment process, all DDN nodes participating in the decryption of the system generate initialization parameters s DDN,i , S DDN,i , which are used for subsequent verification of partial decryption messages of DDN i .

[0263] 5) In the key extraction process 1), KMN calculates part of the private key Y DUN , which is used for subsequent decryption, so that DUN must be involved to decrypt, avoiding the risk of DDN node collusion decryption.

[0264] 6) In the key extraction process 2), DUN can verify the validity of Y DUN through the public Y' DUN , avoiding the risk of forging part of the private key.

[0265] 7) In the data encryption process 1), by introducing U = rY' DUN , the ciphertext and part of the private key Y DUN are associated.

[0266] 8) In the data decryption process 2), the partial decryption information (A i , A' i ) does not expose any information of the plaintext or the private key information of DDN.

[0267] 9) In the data decryption process 3), DUN can verify the validity of (A i , A' i ), so as to locate the problematic DDN node and reduce the credibility of the DDN according to the situation, and also avoid decryption failure due to receiving incorrect parameters.

[0268] 10) In the data decryption process 4), DUN can select t DDN nodes according to the situation, and decrypt the plaintext through the partial key saved by DUN, and the plaintext information can be decrypted only by the joint decryption of at least t DDN nodes and DUN.

[0269] In summary, the scheme has the following advantages:

[0270] 1) This scheme uses IBC encryption technology, does not require the support of PKI digital certificate, simplifies the user's public key, uses the identity information of the node (such as server domain name, server name, organization name, etc.) as the public key, and is suitable for the communication environment of multiple nodes of the communication network, providing trusted key management for DPN, DUN and other multi-parties.

[0271] 2) This scheme can solve the problem of delegated encryption storage and sharing of data on the algorithm network node. DPN, DUN and KMN nodes do not need to be online for a long time, but are delegated to DDN and CNN for secure storage and sharing of data.

[0272] 3) In this scheme, the private key of DUN is not saved and managed by DUN single point, and DUN itself does not have complete private key information. The deformed private key is jointly managed by n DDN nodes and DUN, which reduces the risk of private key leakage due to single point attack and improves the security of the private key of data user.

[0273] 4) Since DUN does not have a complete decryption key, even if DUN is compromised and some private keys are leaked, DUN only needs to apply for key revocation to KMN or DDN node, so that DDN cannot complete decryption, and the attacker cannot decrypt the complete plaintext.

[0274] 5) Each DDN node also does not have a complete decryption key, and even if the private key of part of the node is leaked, it will not lead to complete private key leakage, and the attacker cannot decrypt the complete plaintext. It can reduce or avoid the risk of key misuse and key loss caused by the complete control of a certain algorithm network node, and can reduce the risk of system paralysis caused by the complete control of a certain node by the attacker, improve the fault tolerance and security of the system.

[0275] 6) This scheme must be decrypted by at least t DDN nodes and DUN to decrypt the plaintext information, avoiding the risk of DDN node collusion decryption.

[0276] 7) In the process of delegated decryption of this scheme, DUN can verify the validity of part of the decrypted message, so as to locate the problematic DDN node, and reduce the credibility of the DDN according to the situation, and can also avoid decryption failure due to receiving incorrect parameters.

[0277] 8) In this scheme, data is stored by CNN and decrypted by DDN. In the whole data flow process, relevant network elements cannot obtain the final plaintext M, thereby ensuring the confidentiality of data and avoiding the possibility of sensitive data being obtained by a third-party algorithm network node with low credibility.

[0278] 9) The initialization process, key extraction process and other processes with less execution times of the scheme need secure channel support, and the data encryption and data delegated decryption processes with more execution times do not need secure channel support, thereby reducing the communication load of the system.

[0279] To sum up, the scheme provides a distributed delegated decryption method in a computing power network environment, which can be applied to the computing power network environment, protects data security and has a wide application prospect.

[0280] The embodiment of the application also provides a data processing device applied to a data using node, as shown in the figure, which comprises: Figure 6

[0281] The first sending module 61 is used for sending decryption requests to at least two data decryption nodes respectively, and the decryption request carries a data access address.

[0282] The first receiving module 62 is used for receiving decryption results fed back by each data decryption node and first verification parameter information for the decryption results.

[0283] The first processing module 63 is used for obtaining decryption data according to each decryption result and first verification parameter information.

[0284] The decryption result comprises part of the decryption content of the ciphertext data corresponding to the decryption request.

[0285] The data processing device provided by the embodiment of the application can support data decryption by using multiple data decryption nodes, and then obtain complete decryption data according to the decryption results (part of the decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by asymmetric key single-point storage and the problem of management difficulty caused by symmetric key, avoiding data leakage caused by attacks on the data using node, reducing the risk of private key leakage caused by attacks on a single point (a single data decryption node), improving the security of the private key of the data user, and avoiding the risk of collusion decryption of the data decryption nodes.

[0286] ​The decrypted data is obtained according to the decryption results that pass the verification.

[0287] In the embodiment, the decrypted data is obtained according to the decryption results that pass the verification, including: obtaining at least one candidate decryption result according to the decryption results that pass the verification; obtaining a first random number according to each candidate decryption result and a first bilinear mapping and a second bilinear mapping corresponding to each candidate decryption result respectively; and obtaining the decrypted data according to the first random number; wherein the mapping parameters of the first bilinear mapping include a first public parameter and a first data encryption parameter corresponding to the candidate decryption result; and the mapping parameters of the second bilinear mapping include a second data encryption parameter and a partial private key of the data usage node.

[0288] Further, the data processing device further includes: a second receiving module, configured to receive the partial private key sent by the key management node and obtain second verification parameter information corresponding to the partial private key before obtaining the first random number according to each candidate decryption result and a first bilinear mapping and a second bilinear mapping corresponding to each candidate decryption result respectively; a first verification module, configured to verify the partial private key by using a bilinear mapping, a generator, public key related parameters and the second verification parameter information; and a first saving module, configured to save the partial private key in the case of passing the verification; wherein the public key related parameters are obtained according to an identity identifier of the data usage node and a first hash function, the first hash function is an input of binary calculation of any length, and the first hash function is an output of a q-order additive cyclic group, wherein q is a prime number greater than a threshold value generated by the key management node according to an input security parameter.

[0289] In the embodiment, the number of candidate decryption results satisfies a first condition, wherein the first condition is n≥2t-1, n represents the total number of the at least two data decryption nodes, and t represents the number of candidate decryption results.

[0290] The implementation embodiments of the data processing method on the data usage node side are applicable to the embodiments of the data processing device and can achieve the same technical effects.

[0291] The embodiment of the application further provides a data processing device, which is applied to a data decryption node, as shown in Figure 7 The data processing device includes:

[0292] A third receiving module 71 is configured to receive a decryption request sent by a data usage node, wherein the decryption request carries a data access address.

[0293] The first obtaining module 72 is configured to obtain ciphertext data from the computing node according to the data access address.

[0294] The second processing module 73 is configured to obtain a decryption result and first verification parameter information for the decryption result according to the ciphertext data.

[0295] The second sending module 74 is configured to send the decryption result and the first verification parameter information to the data using node.

[0296] The decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request.

[0297] The data processing apparatus provided by the embodiment of the present application receives a decryption request sent by a data using node, the decryption request carries a data access address, obtains ciphertext data from a computing node according to the data access address, obtains a decryption result and first verification parameter information for the decryption result according to the ciphertext data, sends the decryption result and the first verification parameter information to the data using node, and the decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request. The data using node can use multiple data decryption nodes to perform data decryption, and then obtain complete decryption data according to the decryption results (partial decryption data) obtained by the data decryption nodes, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by asymmetric key single-point storage and the problem of management difficulty caused by symmetric key, avoiding data leakage caused by attacks on the data using node, reducing the risk of private key leakage caused by attacks on a single point (a single data decryption node), improving the security of the private key of the data user, and avoiding the risk of collusion decryption of the data decryption nodes.

[0298] The obtaining of the decryption result and the first verification parameter information for the decryption result according to the ciphertext data includes obtaining the decryption result and the first verification parameter information for the decryption result according to a second random number, the ciphertext data and a partial key corresponding to the data using node.

[0299] Further, the data processing apparatus further comprises: a fourth receiving module, configured to receive the partial key sent by the key management node and acquire a third public parameter corresponding to the partial key before obtaining a decryption result according to the ciphertext data and the partial key corresponding to the data usage node and first verification parameter information corresponding to the decryption result; a second verification module, configured to verify the partial key by using a bilinear mapping, a generator, a public key related parameter and the third public parameter; and a second saving module, configured to save the partial key in a case that the verification is passed; wherein the public key related parameter is obtained according to an identity identifier of the data usage node and a first hash function, an input of the first hash function is binary calculation of any length, and an output of the first hash function is a q-order additive cyclic group, wherein q is a prime number greater than a threshold value generated by the key management node according to an input security parameter.

[0300] In the embodiment of the application, the data processing apparatus further comprises: a third processing module, configured to randomly acquire the second random number (and save) before obtaining a decryption result according to the ciphertext data and the partial key corresponding to the data usage node and first verification parameter information corresponding to the decryption result; and a fourth processing module, configured to obtain a first public parameter according to the second random number and the generator and make the first public parameter public.

[0301] The implementation embodiments of the data decryption node side data processing method can be applied to the embodiments of the data processing apparatus and achieve the same technical effects.

[0302] The embodiment of the application further provides a data processing apparatus applied to a data providing node, as shown in the figure, comprising: Figure 8 as shown in the figure, comprising:

[0303] A fifth processing module 81 is configured to obtain a first data encryption parameter according to the data to be encrypted, the first random number and the second public parameter.

[0304] A sixth processing module 82 is configured to obtain ciphertext data according to the first data encryption parameter.

[0305] A third sending module 83 is configured to send the ciphertext data to a network node.

[0306] The data processing device provided by the embodiment of the application can obtain a first data encryption parameter according to to-be-encrypted data, a first random number and a second public parameter, obtain ciphertext data according to the first data encryption parameter, and send the ciphertext data to a computing network node, so that the data use node can use multiple data decryption nodes to perform data decryption, and then obtain complete decryption data according to decryption results (part of the decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by single-point storage of asymmetric keys, and the problem of management difficulty caused by symmetric keys, avoiding data leakage caused by attacks on the data use node, reducing the risk of private key leakage caused by attacks on a single point (a single data decryption node), improving the security of the private key of the data user, and avoiding the risk of collusion decryption of the data decryption node.

[0307] The implementation embodiments of the data processing method on the data providing node side are applicable to the embodiments of the data processing device, and the same technical effects can be achieved.

[0308] The embodiment of the application further provides a data processing device applied to a key management node, as shown in the following formula (1) : Figure 9 The data processing device comprises the following modules:

[0309] The second acquisition module 91 is configured to acquire, for each data decryption node in the at least two data decryption nodes, a part of the private key of the data use node and a third public parameter;

[0310] The fourth sending module 92 is configured to send each part of the private key to the corresponding data decryption node through a secure channel.

[0311] The seventh processing module 93 is configured to publicly disclose each third public parameter.

[0312] The data processing apparatus provided by the embodiment of the present application can support the data usage node to use multiple data decryption nodes to perform data decryption, and then obtain complete decryption data according to the decryption results (partial decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by asymmetric key single-point storage and the problem of management difficulty caused by symmetric key, and improving the security of the private key of the data user. In addition, the present solution needs multiple data decryption nodes and data usage nodes to jointly process to obtain plaintext information (i.e. decryption data), which can avoid the risk of collusion decryption of data decryption nodes.

[0313] Further, the data processing apparatus further comprises an eighth processing module configured to obtain a public key related parameter according to an identity identifier of the data usage node and a first hash function; a third obtaining module configured to obtain a partial private key of the data usage node and second verification parameter information for the partial private key according to a generator, a secret parameter randomly selected, and the public key related parameter; and a ninth processing module configured to send the partial private key to the data usage node through a secure channel and disclose the second verification parameter information.

[0314] The implementation embodiments of the data processing method on the key management node side are applicable to the embodiments of the data processing apparatus and can achieve the same technical effects.

[0315] The embodiment of the present application further provides a data processing device, and the data processing device is a data usage node, as shown in the accompanying drawings, comprising a processor 101 and a transceiver 102. Figure 10

[0316] The processor 101 is configured to send a decryption request to at least two data decryption nodes through the transceiver 102, and the decryption request carries a data access address.

[0317] The transceiver 102 is configured to receive a decryption result and first verification parameter information for the decryption result fed back by each data decryption node.

[0318] According to each decryption result and first verification parameter information, decryption data is obtained.

[0319] ​The decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request.

[0320] The data processing device provided by the embodiment of the application sends decryption requests to at least two data decryption nodes respectively, carries a data access address in the decryption request, receives decryption results and first verification parameter information corresponding to the decryption results fed back by each data decryption node, obtains decryption data according to each decryption result and the first verification parameter information, wherein the decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request, and the data decryption can be implemented by using multiple data decryption nodes, and then the complete decryption data is obtained according to the decryption results (partial decryption data) obtained by each data decryption node, thereby realizing distributed entrusted decryption, avoiding the problem of low security caused by asymmetric key single-point storage and the problem of management difficulty caused by symmetric key, avoiding data leakage caused by attacks on the data use node, reducing the risk of private key leakage caused by attacks on the single point (single data decryption node), improving the security of the private key of the data user, and avoiding the risk of collusion decryption of the data decryption node.

[0321] The decryption data is obtained according to each decryption result and the first verification parameter information, including verifying each decryption result according to each first verification parameter information, and obtaining decryption data according to the decryption result that passes the verification.

[0322] In the embodiment of the application, the decryption data is obtained according to the decryption result that passes the verification, including obtaining at least one candidate decryption result according to the decryption result that passes the verification, obtaining a first random number according to each candidate decryption result and a first bilinear mapping and a second bilinear mapping corresponding to each candidate decryption result respectively, and obtaining decryption data according to the first random number, wherein the mapping parameter of the first bilinear mapping includes a first public parameter and a first data encryption parameter corresponding to the candidate decryption result, and the mapping parameter of the second bilinear mapping includes a second data encryption parameter and a part of the private key of the data use node.

[0323] Further, the processor is further configured to: before obtaining the first random number according to each of the candidate decryption results and the corresponding first bilinear mapping and second bilinear mapping respectively, receive the partial private key sent by the key management node through the transceiver, and obtain second verification parameter information corresponding to the partial private key; verify the partial private key by using a bilinear mapping, a generator, public key related parameters and the second verification parameter information; and in the case of passing the verification, save the partial private key; wherein the public key related parameters are obtained according to the identity identifier of the data using node and a first hash function, the first hash function is an input of binary calculation of any length, and the output of the first hash function is a q-order additive cyclic group, and the q is a prime number greater than a threshold value generated by the key management node according to an input security parameter.

[0324] In the embodiment of the application, the number of the candidate decryption results satisfies a first condition, wherein the first condition is: n≥2t-1, n represents the total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

[0325] The implementation embodiments of the data processing method on the data using node side are all applicable to the embodiments of the data processing device, and the same technical effects can be achieved.

[0326] The embodiment of the application further provides a data processing device, which is a data decryption node, as shown in the figure, comprising a processor 111 and a transceiver 112. Figure 11

[0327] The processor 111 is configured to receive a decryption request sent by a data using node through the transceiver 112, wherein the decryption request carries a data access address.

[0328] According to the data access address, obtain ciphertext data from a computing node;

[0329] According to the ciphertext data, obtain a decryption result and first verification parameter information for the decryption result;

[0330] Send the decryption result and the first verification parameter information to the data using node through the transceiver 112.

[0331] The decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request.

[0332] ​The data processing device provided in the embodiment of the application receives a decryption request sent by a data use node; the decryption request carries a data access address; ciphertext data is obtained from a calculation network node according to the data access address; a decryption result and first verification parameter information for the decryption result are obtained according to the ciphertext data; and the decryption result and the first verification parameter information are sent to the data use node; wherein the decryption result includes partial decryption content of the ciphertext data corresponding to the decryption request; the data use node can support data decryption by using multiple data decryption nodes, and then complete decryption data is obtained according to the decryption results (partial decryption data) obtained by each data decryption node, so that distributed delegated decryption is realized, the problem of low security caused by single-point storage of asymmetric keys is avoided, and the problem of management difficulty caused by symmetric keys is avoided; and the scheme can avoid data leakage caused by attacks on the data use node, reduce the risk of private key leakage caused by attacks on a single point (a single data decryption node), and improve the security of the private key of the data user; in addition, the scheme requires multiple data decryption nodes and data use nodes to jointly process to obtain plaintext information (i.e., decryption data), so that the risk of collusion decryption of the data decryption nodes can be avoided.

[0333] The first verification parameter information for the decryption result includes a second random number, the ciphertext data, and a partial key corresponding to the data use node.

[0334] Further, the processor is further configured to: before obtaining the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data use node, receive the partial key sent by a key management node through the transceiver and obtain third public parameters corresponding to the partial key; verify the partial key by using a bilinear mapping, a generator, public key related parameters, and the third public parameters; and save the partial key in a case where the verification is passed; wherein the public key related parameters are obtained according to an identity identifier of the data use node and a first hash function, the first hash function is input of binary calculation of any length, and the first hash function is output of a q-order additive cyclic group, q is a prime number greater than a threshold value generated by the key management node according to input security parameters.

[0335] In the embodiment of the application, the processor is further configured to: before obtaining the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data use node, randomly obtain the second random number (and save it); and obtain first public parameters according to the second random number and the generator and make the first public parameters public.

[0336] The implementation embodiments of the data processing method on the data providing node side are applicable to the implementation embodiments of the data processing device, and the same technical effects can be achieved.

[0337] The data processing device is a data providing node, as shown in Figure 12 The data processing device includes a processor 121 and a transceiver 122.

[0338] The processor 121 is configured to obtain a first data encryption parameter according to to-be-encrypted data, a first random number, and a second public parameter.

[0339] The processor 121 is configured to obtain ciphertext data according to the first data encryption parameter.

[0340] The transceiver 122 is configured to send the ciphertext data to a data network node.

[0341] The data processing device provided in the embodiments of the present application can support the data using node to use multiple data decryption nodes to perform data decryption, and then obtain complete decryption data according to the decryption results (part of the decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by asymmetric key single-point storage, and the problem of management difficulty caused by symmetric key, and avoiding data leakage caused by an attack on the data using node, reducing the risk of private key leakage caused by an attack on a single point (a single data decryption node), and improving the security of the private key of the data user. In addition, the present application requires multiple data decryption nodes and data using nodes to jointly process to obtain plaintext information (i.e., decryption data), which can avoid the risk of collusion decryption of the data decryption nodes.

[0342] The implementation embodiments of the data processing method on the data providing node side are applicable to the implementation embodiments of the data processing device, and the same technical effects can be achieved.

[0343] The data processing device is a data providing node, as shown in Figure 13 The data processing device includes a processor 131 and a transceiver 132.

[0344] The processor 131 is configured to obtain, for each data decryption node in at least two data decryption nodes, part of the key of the data using node and a third public parameter.

[0345] send each of the partial keys to the corresponding data decryption node through a secure channel via the transceiver 132;

[0346] publicize each of the third public parameters.

[0347] The data processing device provided by the embodiment of the present application can support the data usage node to utilize multiple data decryption nodes to perform data decryption, and then obtain complete decryption data according to the decryption results (partial decryption data) obtained by each data decryption node, thereby realizing distributed delegated decryption, avoiding the problem of low security caused by asymmetric key single-point storage and the problem of management difficulty caused by symmetric key, and improving the security of the private key of the data user. In addition, the present solution needs multiple data decryption nodes and data usage nodes to jointly process to obtain plaintext information (i.e. decryption data), which can avoid the risk of collusion decryption of the data decryption nodes.

[0348] Further, the processor is further configured to: obtain a public key related parameter according to the identity identifier of the data usage node and a first hash function; obtain a partial private key of the data usage node and a second verification parameter information for the partial private key according to a generator, a secret parameter randomly selected, and the public key related parameter; send the partial private key to the data usage node through a secure channel via the transceiver, and publicize the second verification parameter information.

[0349] The implementation embodiments of the data processing method on the key management node side are applicable to the embodiments of the data processing device, and can achieve the same technical effects.

[0350] The embodiment of the present application further provides a data processing device, which comprises a memory, a processor, and a program stored in the memory and executable on the processor; the processor implements the data processing method on the data usage node side, the data decryption node side, the data providing node side, or the key management node side when executing the program.

[0351] The implementation embodiments of the data processing method on the data usage node side, the data decryption node side, the data providing node side, or the key management node side are applicable to the embodiments of the data processing device, and can achieve the same technical effects.

[0352] The embodiment of the present application also provides a readable storage medium, which stores a program, and the program is executed by a processor to realize the steps in the data processing method on the data using node side, the data decryption node side, the data providing node side or the key management node side.

[0353] The implementation embodiments of the data processing method on the data using node side, the data decryption node side, the data providing node side or the key management node side are all applicable to the embodiment of the readable storage medium, and the same technical effects can be achieved.

[0354] It should be noted that many of the functional units described in this specification are referred to as modules in order to more particularly emphasize their implementation independence.

[0355] In the embodiments of the present application, the modules can be implemented by software, so as to be executed by various types of processors. For example, an identified executable code module can include one or more physical or logical blocks of computer instructions. For example, it can be structured as an object, a procedure or a function. However, the executable code of the identified module need not be physically located together, but can include different instructions stored in different locations which, when joined logically together, comprise the module and achieve the stated purpose for the module.

[0356] In fact, the executable code module can be a single instruction or a plurality of instructions, and can even be distributed on a plurality of different code segments, in different programs, and across a plurality of memory devices. Similarly, the operation data can be identified within the module, and can be implemented in any appropriate form and organized in any appropriate type of data structure. The operation data can be collected as a single data set, or can be distributed on different locations (including different storage devices), and can exist at least partially as an electronic signal on a system or network.

[0357] When the modules can be implemented by software, the modules implemented by software can be built into corresponding hardware circuitry by those skilled in the art without considering the cost, and the hardware circuitry includes conventional very large scale integration (VLSI) circuitry or gate array, and existing semiconductors such as logic chips, transistors and other discrete elements. The modules can also be implemented by programmable hardware devices such as field programmable gate array, programmable array logic, programmable logic device and the like.

[0358] The above is the preferred embodiment of the present application, and it should be noted that those skilled in the art can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A data processing method applied to a data usage node, characterized in that, The method comprises the following steps: sending a decryption request to at least two data decryption nodes respectively; the decryption request carries a data access address; receiving a decryption result and first verification parameter information corresponding to the decryption result fed back by each data decryption node; obtaining decrypted data according to each decryption result and first verification parameter information; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request; wherein the data processing method further comprises: receiving a part of the private key of the data use node sent by the key management node, and obtaining second verification parameter information corresponding to the part of the private key; verifying the part of the private key by using bilinear mapping, a generator, public key related parameters and the second verification parameter information; in the case of passing the verification, saving the part of the private key; The public key related parameter is obtained according to the identity identifier of the data using node and a first hash function, the first hash function is binary calculation of any length, and the output of the first hash function is An additive cyclic group of order, the A prime number greater than a threshold value generated by the key management node according to input security parameters.

2. The data processing method according to claim 1, characterized in that, the obtaining of the decrypted data according to each decryption result and first verification parameter information comprises: verifying each decryption result according to each first verification parameter information respectively; obtaining the decrypted data according to the decryption result passing the verification.

3. The data processing method according to claim 2, characterized in that, the obtaining of the decrypted data according to the decryption result passing the verification comprises: obtaining at least one candidate decryption result according to the decryption result passing the verification; obtaining a first random number according to each candidate decryption result and a first bilinear mapping and a second bilinear mapping corresponding to each candidate decryption result respectively; obtaining the decrypted data according to the first random number; wherein the mapping parameters of the first bilinear mapping comprise first public parameters and first data encryption parameters corresponding to the candidate decryption result; the mapping parameters of the second bilinear mapping comprise second data encryption parameters and the part of the private key of the data use node.

4. The data processing method according to claim 3, characterized in that, The number of the candidate decryption results satisfies a first condition, wherein the first condition is: n represents a total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

5. A data processing method applied to a data decryption node, comprising: The method comprises the following steps: receiving a decryption request sent by a data use node; the decryption request carries a data access address; obtaining ciphertext data from a computing node according to the data access address; obtaining a decryption result and first verification parameter information corresponding to the decryption result according to the ciphertext data; sending the decryption result and first verification parameter information to the data use node; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request; wherein the data processing method further comprises: receiving a part of the private key of the data use node sent by the key management node, and obtaining second verification parameter information corresponding to the part of the private key; verifying the part of the private key by using bilinear mapping, a generator, public key related parameters and the second verification parameter information; in the case of passing the verification, saving the part of the private key; The public key related parameter is obtained according to the identity identifier of the data using node and a first hash function, the first hash function is binary calculation of any length, and the output of the first hash function is An additive cyclic group of order, the A prime number greater than a threshold value generated by the key management node according to input security parameters.

6. The data processing method according to claim 5, characterized in that, the obtaining of the decrypted data according to each decryption result and first verification parameter information comprises: obtaining a decryption result and first verification parameter information corresponding to the decryption result according to a second random number, the ciphertext data and the part of the private key of the data use node.

7. The data processing method according to claim 6, characterized in that, before the obtaining of the decrypted data and the first verification parameter information corresponding to the decryption result according to the ciphertext data and the part of the private key of the data use node, the method further comprises: randomly obtaining the second random number; According to the second random number and the generator, a first public parameter is obtained and is disclosed.

8. A data processing method applied to a key management node, characterized in that, The method comprises the steps of: For each data decryption node of the at least two data decryption nodes, a partial key of the data usage node and a third public parameter are obtained respectively; Each of the partial keys is sent to the corresponding data decryption node through a secure channel; Each of the third public parameters is disclosed; The data processing method further comprises the steps of: According to the identity identifier of the data usage node and a first hash function, a public key related parameter is obtained; According to the generator, a secret parameter obtained by random selection, and the public key related parameter, a partial private key of the data usage node and a second verification parameter information corresponding to the partial private key are obtained; The partial private key corresponding to the second verification parameter information is sent to the data usage node through a secure channel, and the second verification parameter information is disclosed.

9. A data processing apparatus applied to a data usage node, characterized in that, The method comprises the steps of: The first sending module is configured to send a decryption request to at least two data decryption nodes respectively; The decryption request carries a data access address; The first receiving module is configured to receive a decryption result fed back by each of the data decryption nodes and a first verification parameter information corresponding to the decryption result; The first processing module is configured to obtain decryption data according to each of the decryption results and the first verification parameter information; The decryption result comprises a partial decryption content of the ciphertext data corresponding to the decryption request; The data processing apparatus further comprises: The second receiving module is configured to receive a partial private key of the data usage node sent by the key management node and obtain a second verification parameter information corresponding to the partial private key; The first verification module is configured to verify the partial private key by using a bilinear mapping, a generator, a public key related parameter, and the second verification parameter information; The first saving module is configured to save the partial private key if the verification is passed; The public key related parameter is obtained according to the identity identifier of the data using node and a first hash function, the first hash function is binary calculation of any length, and the output of the first hash function is An additive cyclic group of order, the A prime number greater than a threshold value generated by the key management node according to input security parameters.

10. The data processing apparatus according to claim 9, characterized by The obtaining of the decryption data according to each of the decryption results and the first verification parameter information comprises the steps of: Each of the decryption results is verified according to each of the first verification parameter information; Decryption data is obtained according to the decryption result that passes the verification.

11. The data processing apparatus according to claim 10, characterized by The obtaining of the decryption data according to the decryption result that passes the verification comprises the steps of: At least one candidate decryption result is obtained according to the decryption result that passes the verification; A first random number is obtained according to each of the candidate decryption results and a first bilinear mapping and a second bilinear mapping corresponding to each of the candidate decryption results respectively; Decryption data is obtained according to the first random number; Mapping parameters of the first bilinear mapping comprise a first public parameter and a first data encryption parameter corresponding to the candidate decryption result; Mapping parameters of the second bilinear mapping comprise a second data encryption parameter and a partial private key of the data usage node.

12. The data processing apparatus according to claim 11, characterized by The number of the candidate decryption results satisfies a first condition, wherein the first condition is: n represents a total number of the at least two data decryption nodes, and t represents the number of the candidate decryption results.

13. A data processing apparatus applied to a data decryption node, characterized in that, The method comprises the steps of: The third receiving module is configured to receive a decryption request sent by a data usage node; The decryption request carries a data access address; The first obtaining module is configured to obtain ciphertext data from a computing node according to the data access address; a second processing module, configured to obtain a decryption result and first verification parameter information for the decryption result according to the ciphertext data; a second sending module, configured to send the decryption result and the first verification parameter information to the data usage node; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request; wherein the data processing apparatus further comprises: a fourth receiving module, configured to receive the partial key corresponding to the data usage node sent by the key management node, and obtain third public parameters corresponding to the partial key; a second verification module, configured to verify the partial key by using a bilinear mapping, a generator, public key related parameters, and the third public parameters; a second saving module, configured to save the partial key if the verification is passed; The public key related parameter is obtained according to the identity identifier of the data using node and a first hash function, the first hash function is binary calculation of any length, and the output of the first hash function is An additive cyclic group of order, the A prime number greater than a threshold value generated by the key management node according to input security parameters.

14. The data processing apparatus according to claim 13, characterized by the obtaining of the decryption result and the first verification parameter information for the decryption result according to the ciphertext data comprises: obtaining the decryption result and the first verification parameter information for the decryption result according to a second random number, the ciphertext data, and the partial key corresponding to the data usage node.

15. The data processing apparatus according to claim 14, characterized in that, further comprising: a third processing module, configured to randomly obtain the second random number before obtaining the decryption result and the first verification parameter information for the decryption result according to the ciphertext data and the partial key corresponding to the data usage node; a fourth processing module, configured to obtain first public parameters according to the second random number and the generator, and make the first public parameters public.

16. A data processing apparatus applied to a key management node, characterized in that, comprising: a second obtaining module, configured to obtain, for each data decryption node in at least two data decryption nodes, a partial key of a data usage node and third public parameters; a fourth sending module, configured to send each partial key to the corresponding data decryption node through a secure channel; a seventh processing module, configured to make each third public parameter public; wherein the data processing apparatus further comprises: an eighth processing module, configured to obtain public key related parameters according to an identity identifier of the data usage node and a first hash function; a third obtaining module, configured to obtain a partial private key of the data usage node and second verification parameter information for the partial private key according to the generator, a secret parameter randomly selected, and the public key related parameters; a ninth processing module, configured to send the partial private key corresponding to the second verification parameter information to the data usage node through a secure channel, and make the second verification parameter information public.

17. A data processing device, the data processing device being a data usage node, characterized in that comprising: a processor and a transceiver; the processor is configured to send a decryption request to at least two data decryption nodes through the transceiver respectively; the decryption request carries a data access address; receive, through the transceiver, a decryption result and first verification parameter information for the decryption result fed back by each data decryption node; obtain decryption data according to each decryption result and first verification parameter information; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request; wherein the processor is further configured to: receive, by the transceiver, a partial private key of the data usage node sent by the key management node, and obtain second verification parameter information corresponding to the partial private key; verify the partial private key by using a bilinear mapping, a generator, a public key related parameter, and the second verification parameter information; in a case of passing the verification, save the partial private key; The public key related parameter is obtained according to the identity identifier of the data using node and a first hash function, the first hash function is binary calculation of any length, and the output of the first hash function is An additive cyclic group of order, the A prime number greater than a threshold value generated by the key management node according to input security parameters.

18. A data processing device, said data processing device being a data decryption node, characterized in that comprise: a processor and a transceiver; the processor is configured to receive, by the transceiver, a decryption request sent by a data usage node; the decryption request carries a data access address; obtain ciphertext data from a computing node according to the data access address; obtain a decryption result and first verification parameter information for the decryption result according to the ciphertext data; send, by the transceiver, the decryption result and the first verification parameter information to the data usage node; wherein the decryption result comprises partial decryption content of the ciphertext data corresponding to the decryption request; wherein the processor is further configured to: receive, by the transceiver, a partial key corresponding to the data usage node sent by the key management node, and obtain third public parameter corresponding to the partial key; verify the partial key by using a bilinear mapping, a generator, a public key related parameter, and the third public parameter; in a case of passing the verification, save the partial key; The public key related parameter is obtained according to the identity identifier of the data using node and a first hash function, the first hash function is binary calculation of any length, and the output of the first hash function is An additive cyclic group of order, the A prime number greater than a threshold value generated by the key management node according to input security parameters.

19. A data processing device, the data processing device being a key management node, characterized in that, comprise: a processor and a transceiver; the processor is configured to obtain, for each data decryption node in at least two data decryption nodes, a partial key of a data usage node and third public parameter respectively; send, by the transceiver, each partial key to the corresponding data decryption node through a secure channel; publicize each third public parameter; wherein the processor is further configured to: obtain a public key related parameter according to an identity identifier of a data usage node and a first hash function; obtain a partial private key of the data usage node and second verification parameter information for the partial private key according to a generator, a secret parameter randomly selected, and the public key related parameter; send, by the transceiver, the partial private key corresponding to the second verification parameter information to the data usage node through a secure channel, and publicize the second verification parameter information.

20. A data processing device comprising a memory, a processor, and a program stored on the memory and executable on the processor; characterized in that, The processor executes the program to implement the data processing method of any one of claims 1 to 8.

21. A readable storage medium, having a program stored thereon, characterized in that, The program is executed by the processor to implement the steps in the data processing method of any one of claims 1 to 8.

Images