Original data delivery method and device based on trusted execution environment and block chain

Abstract

The invention discloses an original data delivery method based on a trusted execution environment and a block chain. The method comprises the following steps: data secondary encryption: a DC transmits data information related to a DP into enclave of trusted hardware, decrypts in the enclave to obtain a private key, decrypts by using the private key to obtain plaintext data # imgabs0 #, and performs secondary encryption on the data by using a secret key generated in the enclave; forwarding the encrypted data encryption key and a private key of the DP and sending the data encryption key and the private key to the TP for verification; establishing a data authorization protocol among the DA, the DP and the TP; in the process of delivering the data content from the data owner to the data user, the platform party does not obtain the data plaintext and the private key of the user in the whole process, so that the platform cannot obtain the related content of the data and cannot transact the data to the data user without the authorization of the data owner; and the data security can be ensured in the delivery process.

Description

Technical Field

[0001] The present invention relates to the field of software engineering technology, and in particular to a method, device and storage medium for delivering original data based on a trusted execution environment and blockchain. Background Art

[0002] With the advent of the big data era, data security and privacy protection have become urgent issues to be addressed. Traditional data delivery methods often rely on third parties for data transmission, which poses the risk of data leakage and tampering. At the same time, data may also be maliciously intercepted and copied during transmission, resulting in data privacy that cannot be guaranteed.

[0003] To address these challenges, researchers have begun exploring new data delivery methods. Trusted Execution Environment (TEE) provides a completely isolated environment that prevents other software applications, operating systems, and host owners from tampering with or even understanding the state of applications running in TEE, thereby ensuring the security and privacy of data during computing. However, the availability of TEE cannot be guaranteed, and it cannot reliably access the network or persistent storage. Although blockchain technology can guarantee strong availability and persistence of data, its computing power is limited and the entire state needs to be disclosed for verification.

[0004] To this end, the present invention proposes a method for delivering original data based on a trusted execution environment and blockchain. Summary of the invention

[0005] In view of the defects in the prior art, the present invention provides a method for delivering original data based on a trusted execution environment and a blockchain, comprising the following steps:

[0006] S1: Data secondary encryption;

[0007] S2: Establish a data authorization agreement between the data user DA, the data owner DP and the trusted third party TP;

[0008] S3: Establish a data download protocol between DA and TP.

[0009] Preferably, the step S1 comprises the following steps:

[0010] S11: DC sends DP data information Passed into the enclave of trusted hardware;

[0011] S12: Decrypt in enclave to obtain private key , and use the private key Decrypt to obtain plaintext data , using the key generated in the enclave Encrypt the data twice to obtain ; Forward the encrypted data encryption key and DP's private key to TP for verification;

[0012] S13: TP verifies the signature through DP's hub public key and confirms that the message comes from DC. DC has completed the secondary encryption of the data.

[0013] Preferably: in the step S12, the message content is .

[0014] Preferably: in the step S13, the stored data content of DC is .

[0015] Preferably: In the step S2, the DA data transaction request is defined as a hash and an asymmetric key. The transaction request initiated by DA is defined as ; The authorization certificate granted by DP is defined as the private key signature of the requesting DP .

[0016] Preferably: the step S2 specifically comprises the following steps:

[0017] S21: DA locally generates a pair of asymmetric keys, , use trusted hardware to bind the public key to encrypt the private key, and convert the ciphertext and transaction requests Upload to TP;

[0018] S22: After receiving the request message, TP hashes it Forward to the corresponding data owner DP;

[0019] S23: After receiving the message, DP verifies DA's signature and requested data with DA's public key. After confirming the data content of the transaction request, DP sends the authorization for the corresponding data to DS for transaction permission.

[0020] S24: After receiving the message content, TP confirms the initiation of the transaction task and forwards the corresponding authorization and the corresponding DP's private key to DC;

[0021] S25: The enclave in the DC uses the received authorization to verify the legitimacy of the request content. After the verification is passed, it decrypts the private key of the DP and decrypts it with the private key After obtaining the data easy key, use the DA's public key to encrypt the easy key to obtain the ciphertext , the algorithm output of the enclave in DC is , the resulting hash and signature are sent to TP to verify the legitimacy of the message, after which the output is stored in DC together with the twice-encrypted data ciphertext.

[0022] Preferably: in the step S23, the message content is .

[0023] Preferably: in the step S24, the message content is .

[0024] Preferably: in the step S25, the message content is .

[0025] Preferably: the step S3 comprises the following steps:

[0026] S31: DC stores the encrypted data after double encryption ;

[0027] S32: DA can complete the data chain delivery as long as it requests to download the corresponding data ciphertext.

[0028] Based on the same inventive concept, an embodiment of the present invention provides an original data delivery device based on a trusted execution environment and a blockchain, which is used to implement the aforementioned method, including:

[0029] A data secondary encryption module, which is used to implement the data secondary encryption in step S1;

[0030] A data authorization agreement establishment module, which is used to implement the establishment of a data authorization agreement between the DA, DP and TP in step S2;

[0031] The data download protocol establishment module is used to implement the data download protocol establishment between the DA and TP in step S3.

[0032] The embodiment of the present invention further provides a storage medium, which is used to store, read and write the aforementioned method.

[0033] The beneficial effects of the present invention are embodied in:

[0034] 1. In the process of delivering data content from the data owner to the data user, the platform of the present invention has never obtained the plain text of the data and the private key of the user, so that the platform cannot obtain the relevant content of the data, nor can it trade the data to the data user without the authorization of the data owner, so that the security of the data can be guaranteed during the delivery process.

[0035] 2. The present invention provides a safe and effective method for off-chain original data delivery, which can prevent unauthorized access and unauthorized transactions of data, while meeting the limited performance requirements of blockchain, ensuring the integrity and security of off-chain delivered data, and realizing trusted transactions between data users and data owners, effectively preventing malicious data forgery or unauthorized use of data by participants. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0037] Figure 1 It is a logical schematic diagram of the present invention;

[0038] Figure 2 is a flow chart of the present invention;

[0039] Figure 3 FIG. 4 is a diagram of the device architecture of the present invention. DETAILED DESCRIPTION

[0040] The following embodiments of the technical solution of the present invention are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and are therefore only used as examples, and cannot be used to limit the protection scope of the present invention.

[0041] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0042] Please refer to Figure 1 and Figure 2 , the original data delivery method based on the trusted execution environment and blockchain provided by the embodiment of the present invention comprises the following steps:

[0043] S1: Data secondary encryption;

[0044] S2: Establish a data authorization agreement between the data user DA, the data owner DP and the trusted third party TP;

[0045] S3: Establish a data download protocol between DA and TP.

[0046] The step S1 comprises the following steps:

[0047] S11: DC sends DP data information Passed into the enclave of trusted hardware;

[0048] S12: Decrypt in enclave to obtain private key , and use the private key Decrypt to obtain plaintext data , using the key generated in the enclave Encrypt the data twice to obtain ; Forward the encrypted data encryption key and DP's private key to TP for verification;

[0049] S13: TP verifies the signature through DP's hub public key and confirms that the message comes from DC. DC has completed the secondary encryption of the data.

[0050] In the step S12, the message content is ;

[0051] In step S13, the stored data content of DC is .

[0052] In the step S2, the data transaction request of DA is defined as a hash and asymmetric key. The transaction request initiated by DA is defined as ; The authorization certificate granted by DP is defined as the private key signature of the requesting DP ;

[0053] The S2 step specifically includes the following steps:

[0054] S21: DA locally generates a pair of asymmetric keys, , use trusted hardware to bind the public key to encrypt the private key, and convert the ciphertext and transaction requests Upload to TP;

[0055] S22: After receiving the request message, TP hashes it Forward to the corresponding data owner DP;

[0056] S23: After receiving the message, DP verifies DA's signature and requested data with DA's public key. After confirming the data content of the transaction request, DP sends the authorization for the corresponding data to DS for transaction permission.

[0057] S24: After receiving the message content, TP confirms the initiation of the transaction task and forwards the corresponding authorization and the corresponding DP's private key to DC;

[0058] S25: The enclave in the DC uses the received authorization to verify the legitimacy of the request content. After the verification is passed, it decrypts the private key of the DP and decrypts it with the private key After obtaining the data easy key, use the DA's public key to encrypt the easy key to obtain the ciphertext , the algorithm output of the enclave in DC is , the resulting hash and signature are sent to TP to verify the legitimacy of the message, after which the output is stored in DC together with the twice-encrypted data ciphertext.

[0059] In the step S23, the message content is .

[0060] In the step S24, the message content is ;

[0061] In the step S25, the message content is .

[0062] The step S3 comprises the following steps:

[0063] S31: DC stores the encrypted data after double encryption ;

[0064] S32: DA can complete the data chain delivery as long as it requests to download the corresponding data ciphertext.

[0065] In the above content, the symbols involved are defined as:

[0066] : A pair of asymmetric keys bound to the trusted hardware in the DC. After TP completes the trusted verification of the DC trusted hardware, it is used as a session key to encrypt another pair of asymmetric keys.

[0067] , : Binding: A pair of keys bound to the DP or DA identity, generated locally by the DP or DA and used to encrypt DP data or for digital signature.

[0068] : The key used to encrypt the data M is generated by the enclave in the TEE of the DC and is used to re-encrypt the data of DP in the DC and decrypt the data of DA.

[0069] : A function used to forward the private key of DP and DA, where Indicates the private key being forwarded, represents the public key used to encrypt the private key, Represents the hash of the trusted hardware enclave that produced the result.

[0070] DA: data user.

[0071] DP: data owner.

[0072] TP: Trusted Third Party.

[0073] DC: compute node.

[0074] From the above description, it can be known that during the process of delivering data content from the data owner to the data user, the platform of the present invention has never obtained the plaintext data and the user's private key, making it impossible for the platform to obtain the relevant content of the data, nor to trade the data to the data user without the authorization of the data owner, thereby ensuring the security of the data during the delivery process.

[0075] The present invention provides a safe and effective method for off-chain original data delivery, which can prevent unauthorized access and unauthorized transactions of data, while meeting the limited performance requirements of the blockchain, ensuring the integrity and security of off-chain delivered data, and realizing trusted transactions between data users and data owners, effectively preventing malicious data forgery or unauthorized use of data by participants.

[0076] Please refer to Figure 3 , an embodiment of the present invention provides an original data delivery device based on a trusted execution environment and a blockchain, which is used to implement the above method, including:

[0077] A data secondary encryption module, which is used to implement the data secondary encryption in step S1;

[0078] A data authorization agreement establishment module, which is used to implement the establishment of a data authorization agreement between the DA, DP and TP in step S2;

[0079] The data download protocol establishment module is used to implement the data download protocol establishment between the DA and TP in step S3.

[0080] The embodiment of the present invention further provides a storage medium, which is used to store, read and write the aforementioned method.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A method for delivering raw data based on a trusted execution environment and blockchain, characterized in that: The following steps are involved: S1: Data secondary encryption; S2: Establish a data authorization agreement between the data user DA, the data owner DP and the trusted third party TP; S3: Establish data download protocol between DA and TP; The step S1 comprises the following steps: S11: DC sends DP data information Passed into the enclave of trusted hardware; S12: Decrypt in enclave to obtain private key , and use the private key Decrypt to obtain plaintext data , using the key generated in the enclave Encrypt the data twice to obtain ; Forward the encrypted data encryption key and DP's private key to TP for verification; S13: TP verifies the signature through DP's hub public key and confirms that the message comes from DC. DC has completed the secondary encryption of the data. In the step S2, the data transaction request of DA is defined as a hash and asymmetric key. The transaction request initiated by DA is defined as ; The authorization certificate granted by DP is defined as the private key signature of the requesting DP ; The S2 step specifically includes the following steps: S21: DA locally generates a pair of asymmetric keys. , use trusted hardware to bind the public key to encrypt the private key, and convert the ciphertext and transaction requests Upload to TP; S22: After receiving the request message, TP hashes it Forward to the corresponding data owner DP; S23: After receiving the message, DP verifies DA's signature and requested data with DA's public key. After confirming the data content of the transaction request, DP sends the authorization for the corresponding data to DS for transaction permission. S24: After receiving the message content, TP confirms the initiation of the transaction task and forwards the corresponding authorization and the corresponding DP's private key to DC; S25: The enclave in the DC uses the received authorization to verify the legitimacy of the request content. After the verification is passed, it decrypts the private key of the DP and decrypts it with the private key After obtaining the data easy key, use the DA's public key to encrypt the easy key to obtain the ciphertext , the algorithm output of the enclave in DC is , the resulting hash and signature are sent to TP to verify the legitimacy of the message, and then the output is stored in DC together with the twice-encrypted data ciphertext; The step S3 comprises the following steps: S31: DC stores the encrypted data after double encryption ; S32: DA can complete the data chain delivery as long as it requests to download the corresponding data ciphertext.

2. The original data delivery method based on a trusted execution environment and blockchain according to claim 1, characterized in that: In the step S12, the message content is .

3. The original data delivery method based on a trusted execution environment and blockchain according to claim 1, characterized in that: In step S13, the stored data content of DC is .

4. The original data delivery method based on a trusted execution environment and blockchain according to claim 1, characterized in that: In the step S23, the message content is .

5. The original data delivery method based on a trusted execution environment and blockchain according to claim 1, characterized in that: In the step S24, the message content is .

6. The original data delivery method based on a trusted execution environment and blockchain according to claim 1, characterized in that: In the step S25, the message content is .

7. A device for delivering original data based on a trusted execution environment and blockchain, which is used to implement a method for delivering original data based on a trusted execution environment and blockchain as described in any one of claims 1 to 6, characterized in that: include: A data secondary encryption module, which is used to implement the data secondary encryption in step S1; A data authorization agreement establishment module, which is used to implement the establishment of a data authorization agreement between the DA, DP and TP in step S2; The data download protocol establishment module is used to implement the data download protocol establishment between the DA and TP in step S3.

8. A storage medium, characterized in that: It is used to store, read and write data in an original data delivery device based on a trusted execution environment and blockchain as described in claim 7.

Images