Block chain data trusted interaction method based on multi-permission attribute-based encryption

Abstract

The invention provides a block chain data credible interaction method based on multi-permission attribute-based encryption. The method comprises the following steps: step 1, initializing a system; the whole system generates initial parameters, including generation and uplink of public parameters and generation of public keys and private keys. And step 2, data encryption. A data owner in the system needs to organize and encrypt data and upload ciphertext information to a block chain. And step 3, generating a secret key. When a data user wants to access data of other data owners, the data user sends an access request to the block chain. After the access request of the data user is monitored, the block chain notifies the attribute authority to provide the access key. And 4, data decryption. And the data user who needs to access the encrypted data obtains the access key and then downloads the corresponding ciphertext. And the data user decrypts the ciphertext according to the system parameters and the attribute token to obtain the data.

Description

Technical Field

[0001] The present invention relates to the field of encryption methods and blockchains, and in particular to a blockchain data trusted interaction method based on multi-authority attribute-based encryption. Background Art

[0002] This section merely provides background information related to the present disclosure and is not necessarily prior art.

[0003] Cloud computing architecture has become the core model of modern computing, providing powerful data processing, analysis and storage capabilities, and is widely used in the fields of Internet of Things, intelligent transportation, smart industry, etc. Through cloud architecture, data can be efficiently processed and stored in a centralized cloud environment, thereby reducing the computing pressure of terminal devices and improving the scalability and response speed of the system. This architecture can not only cope with the concurrent needs of large-scale data, but also provide reliable computing support for various complex applications. With the advancement of technology, the application scope of cloud architecture is constantly expanding, and its role is becoming more and more indispensable.

[0004] However, with the surge in IoT devices and the continuous growth of data traffic, cloud architecture faces severe challenges in processing massive amounts of data. How to ensure that this data can be quickly and securely uploaded to the chain and processed with low latency is a technical problem that needs to be solved urgently. The dynamic changes in the network, the complexity of multi-source heterogeneous devices, and the large-scale concurrency of terminal nodes have increased the difficulty of managing cloud systems. Especially in terms of data sharing and communication, it is particularly important to ensure the full audit capability of communication events in order to maintain the transparency and trust of the system. This is not only a technical requirement, but also related to the user's trust in the system. Any data leakage or delayed processing will have serious consequences.

[0005] As a decentralized distributed ledger, blockchain technology provides a powerful tool for solving these problems with its tamper-proof and traceable characteristics. The cloud architecture combined with blockchain technology can ensure the transparency and security of the data chain process, and at the same time, through a distributed trust mechanism, ensure that all communications and operations in the system can be audited and tracked. The immutability and distributed trust brought by blockchain to the cloud environment further enhance the overall security and reliability of the cloud system. It is worth mentioning that blockchain has demonstrated its unique advantages in many fields, especially in the field of data security, and its application prospects are immeasurable.

[0006] In addition, the massive amounts of data generated in the fields of the Internet of Things, smart industry, and smart transportation not only require fast processing speeds, but also must ensure confidentiality and access control during data transmission. Multi-Authority Attribute-Based Encryption (MA-ABE) technology provides a fine-grained encryption scheme for data access in cloud architectures, allowing data access rights to be controlled based on user-specific attributes. This encryption method can effectively prevent unauthorized access and ensure that data remains secure in complex, distributed environments. This encryption method is also gradually becoming one of the industry standards for ensuring data security, and has received more and more attention and application from companies and institutions. Summary of the invention

[0007] Purpose of the invention: In view of the shortcomings of the prior art, the present invention provides a blockchain data trusted interaction method based on multi-authority attribute-based encryption to improve the problems existing in data trusted interaction under the existing cloud architecture, improve the security and reliability of the cloud system, and reduce the unreliable factors brought about in data interaction.

[0008] The present invention specifically provides a blockchain data trusted interaction method based on multi-authority attribute-based encryption, comprising the following steps:

[0009] Step 1: Initialize the system and generate initial parameters. The cloud server generates a global public parameter GP based on the security parameter λ, and the system generates a public key and a secret key based on GP.

[0010] Step 2: Encrypt the data according to the initialization parameters obtained in step 1, and the data owner uploads the ciphertext and the ciphertext hash value to the cloud server.

[0011] Step 3: The data user initiates a data access request, and the system generates a key based on the data user's attributes.

[0012] Step 4: The data user decrypts the ciphertext CT according to the key and system parameters obtained in step 3.

[0013] Furthermore, in step 1, the initial parameters include the system's global public parameters GP, attribute permissions, and public and private key pairs of different roles.

[0014] Furthermore, in step 1, the global public parameter GP is initialized, the cloud server takes the security parameter λ as input, and the global public parameter GP as output. In the global setting, a bilinear group G with order N=p1p2p3 is selected, where p1, p2, and p3 are prime numbers. The global public parameter GP includes N and G p1 In addition, a one-way hash function H is defined that maps the global identity GID to the elements of G: {0, 1}* →G.

[0015] Attribute permissions are initialized. The system assigns a set of different attributes according to smart contract 1. Smart contract 1 checks whether the sender of attribute permissions is a cloud server. If yes, the attribute permissions are assigned to the attribute permission list and a threshold t is set. If not, the contract will not continue to execute and the system will feedback an error message to the contract caller.

[0016] The generation of public and private key pairs is based on the attribute permissions AA i The global public parameter GP outputs a pair of keys (sk i , pk i ). For each attribute a managed by the permission, the permission randomly selects two indices and publish As the public key. AA i Safekeeping. Public key pk i Will be saved in the blockchain.

[0017] In step 1, two key pair initialization algorithms are included. The first algorithm is the role initialization algorithm, which takes the global public parameter GP as input. Role initialization generates a pair of role keys (rsk, rpk) according to the global public parameter GP, where rsk is and rpk = g rsk A random value in the public key rpk, the public key rpk is stored in the blockchain.

[0018] The second algorithm is the cloud server database initialization algorithm, which is similar to the role initialization algorithm. The cloud server database initialization algorithm accepts the global public parameter GP as input and generates a pair of keys (vsk, vpk) for the database system.

[0019] The two pairs of keys are mainly used to encrypt the ciphertext CT to obtain the data hash value. The role key (rsk, rpk) is used to sign and verify the ciphertext, and the database system key (vsk, vpk) is used to perform signature verification when the cloud server uploads the ciphertext to the blockchain.

[0020] Furthermore, in step 1, the blockchain calculates the attribute key PK according to smart contract 2 a , the smart contract 2 collects enough public keys pk from different authorities AA for the blockchain i Then, the attribute key PK is calculated using the Shamir secret sharing scheme a , the public key pk that needs to be collected i The number is determined by the threshold t. Data users use the attribute key PK they hold aTo decrypt the encrypted message corresponding to a specific attribute.

[0021] Furthermore, in step 2, the role that uploaded the data executes the Encrypt algorithm. The encryption algorithm uses the data M and the n×l access matrix A, and the function ρ maps its rows to attributes. It selects a random and a random vector p as its first term. Let λ x Indicates A x v, where A x is the xth row of a, which also selects a random vector The first term is 0. Let ω x Indicates A x w. For each row of A x , randomly select one s is The random value in , α ρ(x) represents the value corresponding to the attribute ρ(x). The ciphertext is calculated as:

[0022] C0=Me(g1,g1) s

[0023]

[0024] Furthermore, after calculating the ciphertext, the data owner uses his own secret key rsk i Sign the ciphertext. The signed ciphertext CT sign Upload to the blockchain. Smart contract 3 will detect whether the sender of the ciphertext is the data owner, whether the receiver is the cloud server database, and save the ciphertext hash value.

[0025] Furthermore, in step 3, when a data user wants to access the data of other data owners, he will send an access request to the blockchain. After monitoring the access request of the data user, the blockchain notifies the attribute authority to provide the access key. According to the attributes of the role, the attribute authority uses its secret key sk to send the access key to the data user. The key is generated for the role with attribute a, and the authority is calculated as follows:

[0026]

[0027] Where GID is the global identity, α a and a for A random value in .

[0028] Furthermore, in step 4, before the decryption algorithm starts, the data user first uses the data owner's public key rpk i Verify the authenticity of the ciphertext CT.

[0029] Further, in step 4, the ciphertext CT and the decryption token K a，GID and global public parameters GP as input, and output data M. Assume that the ciphertext is encrypted under the access matrix (A, ρ). To decrypt the data, the data user DU obtains H(GID) from the random oracle model. If DU has A x The subset of has the secret key K ρ(x)，GID , so that (1, 0, …, 0) is in the span of these rows, then the decryption process of the data user DU is as follows.

[0030] For each such x, the decryptor is calculated as follows:

[0031]

[0032] The decryptor then chooses the constant So that∑ x c x A x =(1, 0, ..., 0), and calculate:

[0033]

[0034] Then the data M can be calculated as:

[0035]

[0036] In step 4, the data user finally obtains the data he wants to access through the blockchain and cloud server database.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] The access control of the present invention is highly granular. Through multi-authority attribute-based encryption, the method of the present invention can flexibly set access rights according to the attributes of different users. This means that the encryption and decryption rights of data can be managed by multiple independent authorization agencies, and only users who meet specific conditions or attributes can access the relevant data. This fine-grained control method greatly enhances the security and flexibility of the system, ensuring that only users with appropriate permissions can decrypt data, avoiding unauthorized access.

[0039] The present invention provides data security and privacy protection. In a blockchain environment, data security and privacy are core issues. The introduction of MA-ABE provides a powerful encryption scheme that can effectively protect the confidentiality of data. In a blockchain, although data transactions and interactions are public, through attribute-based encryption, the actual data can remain private, and only users who meet specific permission requirements can access plaintext data. This method effectively reduces the risk of data leakage and ensures data security, maintaining a high level of privacy protection even in a distributed environment.

[0040] Through the combination of cloud architecture and blockchain technology, the Internet of Things, smart industry, smart healthcare and other fields can better cope with the challenges of massive data processing and security. The efficient computing power of cloud architecture and the transparency and trust mechanism of blockchain technology work together to enable large-scale distributed systems to maintain higher security, reliability and traceability when processing complex data, thereby promoting further development in various fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the above and / or other advantages of the present invention will become more clear.

[0042] Figure 1 It is a flow chart of the steps of the present invention.

[0043] Figure 2 It is the basic framework diagram of the recommendation system model of the present invention. DETAILED DESCRIPTION

[0044] The present invention specifically provides a blockchain data trusted interaction method based on multi-authority attribute-based encryption, comprising the following steps:

[0045] Step 1: Initialize the system and generate initial parameters to ensure that the infrastructure of the entire system can operate normally. This step is the first step because the security and efficiency of the system largely depend on the correct generation of initialization parameters. System initialization is not only a simple setup process, but also includes complex cryptographic operations, which provide the basis for subsequent encryption and decryption operations.

[0046] Step 2: After generating the necessary initial parameters, encrypt the data according to these parameters, and then upload the ciphertext and related information. In this process, not only the security of data encryption should be considered, but also the uploaded data should be reliably transmitted and stored through the blockchain network. The encryption process can effectively protect the privacy of data, especially when dealing with sensitive information, ensuring the security of data during transmission.

[0047] Step 3: When a data user wants to access data, he or she must first initiate an access request. In this step, the data user not only simply requests data, but also obtains the necessary key. The generation and transmission of this key is also based on system parameters and user permissions. The transmission of the key not only needs to be carried out through a secure channel, but also involves strict permission control to ensure that only authorized users can decrypt the data.

[0048] Step 4: After the data user successfully obtains the ciphertext and has the corresponding key, the data user will decrypt the data according to the key and system parameters. The entire decryption process requires multiple complex calculation steps, and each step must ensure the integrity and correctness of the data. In particular, in this step, the system will use multiple cryptographic tools to ensure the security of data decryption and ultimately output the required data content.

[0049] In step 1, the initial parameters include the system's global public parameters GP, attribute permissions, and public and private key pairs of different roles.

[0050] In step 1, the cloud server takes the security parameter λ as input and the global public parameter GP as output. In the global setting, a bilinear group G with order N = p1p2p3 is selected. The global public parameter GP contains N and In addition, a one-way hash function H is defined that maps the global identity GID to the elements of G: {0, 1} * →G.

[0051] In step 1, after the attribute permission is added to the system, a set of different attributes will be assigned according to smart contract 1. Smart contract 1 first checks whether the sender is a cloud server. If so, it assigns the attribute permission to the permission list of attribute a and sets the threshold t:

[0052] if Sender=CS then

[0053] attribute[a].authoritylist←AA(s);

[0054] attribute[a].threshold←t;

[0055] According to the attribute authority AA i The global public parameter GP outputs a pair of keys (sk i , pk i ). For each attribute a managed by the permission, the permission randomly selects two indices and publish As the public key. AA i Safekeeping. Public key pki Will be saved in the blockchain.

[0056] In step 1, there are two key pair initialization algorithms. The first algorithm is the role initialization algorithm, which takes the global public parameter GP as input. The role's key pair (rsk, rpk) is output, where rsk is and rpk = g rsk A random value in the public key rpk. The public key rpk is also stored in the blockchain.

[0057] The second algorithm is the cloud server database initialization algorithm, which is similar to the role initialization algorithm. The algorithm accepts the global public parameter GP as input and then generates a pair of keys (vsk, vpk) for PVD. These keys are mainly used to encrypt the ciphertext CT to obtain the data hash value.

[0058] In step 1, the blockchain collects enough public keys pk from different authorities AA i When the Shamir secret sharing scheme is used, the attribute key PK is calculated a The algorithm is defined by Smart Contract 2:

[0059]

[0060] Among them, count is the counter of attribute a, and threshold is the threshold for generating the key.

[0061] In step 2, the role that uploads the data executes the Encrypt algorithm to encrypt it. The encryption algorithm uses the data M and the n×l access matrix A, and the function ρ maps its rows to attributes. It selects a random and a random vector p as its first term. Let λ x Indicates A x v, where A x is the xth row of a, which also selects a random vector The first term is 0. Let ω x Indicates A x ·w. For each row of A x , randomly select one The ciphertext is calculated as:

[0062] C0=Me(g1,g1) s

[0063]

[0064] After calculating the ciphertext, the data owner uses his own secret key rsk i Sign the ciphertext. Then use smart contract 3 to send the signed ciphertext CT signUpload to the blockchain. Smart contract 3 will detect whether the sender of the ciphertext is the data owner:

[0065] if Sender=DO then

[0066] dataHash ← getData(CT sign ,rsk i );

[0067] Whether the recipient is a cloud server database and saves the ciphertext hash value:

[0068] if Receiver=CSD then

[0069] save dataHash;

[0070] In step 3, when a data user wants to access the data of other data owners, he will send an access request to the blockchain. After monitoring the access request of the data user, the blockchain notifies the attribute authority to provide the access key. According to the attributes of the role, the attribute authority uses its private key to send the access key to the data user. The key is generated for the role with attribute a, and the authority is calculated as follows:

[0071]

[0072] In step 4, before the decryption algorithm starts, according to smart contract 4, the data user first uses the public key rpk of the data owner i Verify the authenticity of the ciphertext CT:

[0073] if Receiver=DU then

[0074] (CT sign , rpk i )←getCT(dataHash);

[0075] K a，GID ←getKey(SK);

[0076] In step 4, the ciphertext CT and the decryption token K a，GID and global public parameters GP as input, and output data M. Assume that the ciphertext is encrypted under the access matrix (A, ρ). To decrypt the data, the data user DU obtains H(GID) from the random oracle model. If the data user DU has A x The subset of has the secret key K ρ(x)，GID , so that (1, 0, …, 0) is in the span of these rows, then the decryption process of the data user DU is as follows.

[0077] For each such x, the decryptor is calculated as follows:

[0078]

[0079] Decryptor selection constant So that∑ x c x A x =(1, 0, ..., 0), and calculate:

[0080]

[0081] Then the data M can be calculated as:

[0082]

[0083] The present invention provides a blockchain data trusted interaction method based on multi-authority attribute-based encryption. There are many methods and ways to implement the technical solution. The above is only a preferred implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the scope of protection of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A blockchain data trusted interaction method based on multi-authority attribute-based encryption, characterized in that: The following steps are involved: Step 1: Initialize the system and generate initial parameters. The cloud server generates a global public parameter GP based on the security parameter λ, and the system generates a public key and a secret key based on GP. Step 2: Encrypt the data according to the initialization parameters obtained in step 1, and the data owner uploads the ciphertext and the ciphertext hash value to the cloud server; Step 3: The data user initiates a data access request, and the system generates a key based on the data user's attributes; Step 4: The data user decrypts the ciphertext CT according to the key and system parameters obtained in step 3.

2. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 1 is characterized in that: In step 1, the initial parameters include the system's global public parameters GP, attribute permissions, and public and private key pairs of different roles.

3. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 2 is characterized in that: Step 1 System initialization includes, The global public parameter GP is initialized. The cloud server selects a bilinear group G of order N = p1p2p3 according to the security parameter λ, where p1, p2 and p3 are prime numbers, and defines a one-way hash function H:{0,1} * →G maps the global identity GID to the elements of G and outputs the global public parameter GP, which contains N and The generator g1. Attribute permission initialization: the system assigns a set of different attributes according to smart contract 1. Smart contract 1 checks whether the sender of attribute permission is a cloud server. If yes, the attribute permission is assigned to the attribute permission list and a threshold t is set. If not, the contract will not continue to execute and the system will feedback an error message to the contract caller. The generation of public and private key pairs, the system based on the attribute authority AA i The global public parameter GP outputs a pair of keys (sk i ,pk i ), for each attribute managed by the permission, the permission randomly selects two indices and publish As a public key, a secret key By attribute authority AA i Keep the public key pk i Stored in the blockchain.

4. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 3 is characterized in that: Step 1 System initialization includes, Role initialization, through the algorithm based on the global public parameter GP to generate a pair of role keys (rsk, rpk), where rsk is and rpk = g rsk A random value in , the public key rpk is stored in the blockchain; The cloud server database is initialized, and a pair of keys (vsk, vpk) is generated for the database system based on the global public parameter GP through an algorithm.

5. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 4 is characterized in that: In step 1, the blockchain calculates the attribute key PK according to smart contract 2 a , the smart contract 2 collects enough public keys pk from different authorities AA for the blockchain i Then, the attribute key PK is calculated using the Shamir secret sharing scheme a , the public key pk that needs to be collected i The number is determined by the threshold t.

6. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 5 is characterized in that: In step 2, the uploaded data is encrypted by the Encrypt algorithm, which uses data M and n×l access matrix A. The function ρ maps each row of the matrix to a set of attributes. The ciphertext is calculated as: C0=Me(g1,g1) s Among them, λ x Indicates A x v, where A x is the x-th row of the access matrix A, v is a random vector, where And the first term is a random number p, where ω x Indicates A x w, w is a random vector, where and the first item is 0, for each row of A x Select random number s is The random value in , α ρ(x) Represents the value corresponding to the attribute ρ(x).

7. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 6 is characterized in that: In step 2, after the data is encrypted, the data owner signs the ciphertext with his role key rsk, and sends the signed ciphertext CT to smart contract 3. sign After uploading to the blockchain, the smart contract 3 detects whether the sender of the ciphertext is the data owner, whether the receiver is the cloud server database, and saves the hash value of the ciphertext.

8. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 7 is characterized in that: In step 3, when a data user accesses the data of other data owners, he sends an access request to the blockchain. After monitoring the access request of the data user, the blockchain notifies the attribute authority to provide the access key. According to the attributes of the role, the attribute authority uses its secret key sk to send the access key to the data user. The role with attribute a generates the key. The authority is calculated as follows: Where GID is the global identity, α a and a for A random value in .

9. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 8 is characterized in that: In step 4, before the decryption algorithm starts, the data user verifies the authenticity of the ciphertext CT using the role public key rpk of the data owner.

10. The blockchain data trusted interaction method based on multi-authority attribute-based encryption according to claim 9 is characterized in that: In step 4, the ciphertext CT and the decryption token K a,GID and global public parameters GP as input, output data M, the ciphertext is encrypted under the access policy (A, ρ), and the data user DU will obtain H(GID) from the random Oracle model; if DU is A x The subset of has the secret key K ρ(x),GID , so that (1,0,…,0) is in the span of these rows, the decryption process of the data user DU is as follows: For each qualifying x, the decryptor is calculated using the following formula: Decryptor selection constant So that Σ x c x A x =(1,0,…,0), and calculate: Then the data M can be calculated as:

Images