Multi-level data sharing anti-fraud method and system based on zero trust and blockchain

Abstract

The present invention provides a multi-level data sharing fraud prevention method and system based on zero trust and blockchain, belonging to the field of computer network information security technology. The method includes: initializing the system and defining participants; constructing an access control tree and encrypting the attributes of the upper-level data D to be shared to obtain a ciphertext C; uploading C to the blockchain and obtaining a transaction code Tx1 corresponding to D; establishing an index tree structure, encrypting the lower-level data Di of the upper-level data D based on the index code R to obtain encrypted data C_Di, uploading C_Di to the blockchain and obtaining a transaction code Tx2_i for sharing Di, thereby implementing an index-based multi-level data sharing mechanism; after the data receiver requests to share Di, it obtains Tx1 corresponding to the upper-level data D to which Di belongs, provided by the data sender; uses Tx1 to obtain R from the blockchain; uses R to obtain C_Di from the blockchain; decrypts C_Di to obtain Di, thereby implementing data reception and decryption.

Description

Technical Field

[0001] The present invention relates to the field of computer network information security technology, and in particular to a multi-level data sharing anti-fraud method and system based on zero trust and blockchain. Background Art

[0002] With the rapid development of the digital economy, multi-level data sharing has become a key strategy for improving operational efficiency and innovating business models across various industries. This sharing involves data interaction at different levels, enabling smooth information flow across organizational levels, thereby optimizing decision-making and business processes. Currently, mainstream multi-level data sharing technologies include the following: First, the traditional centralized data sharing model, in which data is centrally stored in a centralized data center, which is responsible for data collection and management. Data exchange is typically achieved through APIs or direct database access permissions. To ensure data security, this model relies on traditional authentication mechanisms and access control measures. Second, privacy-preserving computing technologies such as federated learning allow data to be shared without leaving the local server, enabling the sharing of data value through model training. These technologies utilize cryptographic methods such as homomorphic encryption and secure multi-party computation to protect data privacy and security, making them particularly suitable for machine learning scenarios where data privacy is crucial. Third, data sharing solutions based on blockchain technology leverage the immutable nature of blockchain to log all data operations. Smart contracts are used to manage who can access data and under what conditions, ensuring transparency and traceability throughout the data sharing process.

[0003] Existing technologies face several issues: First, security. Centralized architectures present a single point of failure risk, and once compromised, all data could be exposed. Traditional access control mechanisms are inadequate to address complex unauthorized access and internal fraud risks. Furthermore, data authenticity is difficult to guarantee and can be easily tampered with or forged, creating fraud risks. Second, efficiency. Existing blockchain solutions generally face performance bottlenecks, resulting in slow transaction processing. Privacy computing technology, due to its high computational overhead, is difficult to apply in scenarios requiring high real-time performance. Furthermore, cross-organizational identity authentication and permission management processes are complex, severely impacting inter-organizational collaboration efficiency. Furthermore, there are challenges with flexibility and compliance. Existing data sharing solutions mostly rely on pre-set trust models, which limits the ability to dynamically adjust trust relationships. Furthermore, inconsistent data formats and interface standards result in poor interoperability across systems, making seamless integration difficult. In addition, these solutions often find it difficult to meet the differentiated security needs in different scenarios and lack the flexibility to adapt to a changing business environment. In terms of data ownership and usage control, the existing mechanisms are still imperfect, making it difficult to achieve full auditability of data usage, which increases compliance risks. At the same time, there is a lack of effective data abuse prevention and accountability mechanisms, which may lead to legal and ethical risks in the data sharing process and affect the security and reliability of data sharing. Summary of the Invention

[0004] In view of this, the present invention provides a multi-level data sharing anti-fraud method and system based on zero trust and blockchain, which encrypts the superior data and subordinate data with subordinate relationships and uploads them to the blockchain respectively, and shares the subordinate data through index-based cross-validation, effectively improving the security and processing efficiency of data sharing, with the advantages of high flexibility and high compliance, and effectively preventing data abuse.

[0005] The technical solution adopted by the embodiment of the present invention to solve the technical problem is:

[0006] A multi-level data sharing fraud prevention method based on zero trust and blockchain, including:

[0007] Step S1, initializing the system, wherein the participants in the system include the data owner, the data sender, the data receiver, the certificate authority CA and the attribute authority;

[0008] Step S2: construct an access control tree and perform attribute encryption on the upper-level data D to be shared to obtain a ciphertext C, wherein the access control tree consists of an organization classification subtree and a business-related subtree;

[0009] Step S3: Upload the ciphertext C to the blockchain and obtain the transaction code Tx1 for sharing the upper-level data D; establish an index tree structure, encrypt the lower-level data Di of the upper-level data D based on the index code R to obtain encrypted data C_Di, upload the encrypted data C_Di to the blockchain and obtain the transaction code Tx2_i for sharing the lower-level data Di, thereby realizing an index-based multi-level data sharing mechanism;

[0010] In step S4, after the data recipient requests to share the lower-level data Di, it obtains the transaction code Tx1 corresponding to the upper-level data D to which the lower-level data Di belongs, provided by the data sender, and uses the transaction code Tx1 to obtain the index code R from the blockchain. The index code R is used to obtain the encrypted data C_Di from the blockchain, and the encrypted data C_Di is decrypted to obtain the lower-level data Di, thereby realizing data reception and decryption.

[0011] Preferably, the data sender includes an organization or individual, the data owner includes an organization or individual, the data recipient includes one or more organizations or individuals, the certificate authority CA includes one organization, and the attribute authority includes multiple organizations;

[0012] The step S1 comprises:

[0013] Step S11, defining the participants in the system;

[0014] Step S12, calculating the public key and private key of each participant in the system: selecting a random number as the private key of the participant, and using the elliptic curve encryption algorithm and the random number to calculate the public key of the participant;

[0015] Step S13, defining the business classification and access control attributes of the data, establishing an organization attribute set and a business attribute set, and defining attribute inheritance relationships and constraint rules; wherein the attribute inheritance relationships and constraint rules are mappings and rules between the organization attribute sets and the business attribute sets;

[0016] Step S14: system initialization, the certificate authority CA uses a multi-authorization attribute encryption key generation algorithm to generate a system master key MSK, a public parameter PP and a key SK of the authorized institution.

[0017] Preferably, the step S2 includes:

[0018] Step S21: construct an access control tree based on the organization attribute set and the business attribute set, define an organization classification subtree and a business-related subtree, and set a threshold value; the organization classification subtree is a tree structure representing the organizational structure, and the nodes in the organization classification subtree represent the departments or teams under the organization; the business-related subtree is a tree structure of business operations or processes, and the nodes in the business-related subtree represent the business roles or responsibilities; the threshold value is the number of conditions for granting access rights;

[0019] Step S22, converting the sequence of the upper-level data D into hexadecimal data, and calculating the ciphertext C using the public parameter PP, the access control tree and the multi-authority attribute encryption algorithm;

[0020] Step S23: the data sender performs a hash function calculation based on the hexadecimal data to obtain a first digital summary; and generates a signature S1 of the first digital summary using the data sender's private key and a digital signature algorithm;

[0021] Step S24: the data sender sends the ciphertext C and the signature S1 to the data owner;

[0022] Step S25: The data owner uses the key SK to decrypt the ciphertext C to obtain the upper-level data D, performs a hash function calculation based on the hexadecimal data of the upper-level data D to obtain a second digital digest; and generates a signature S2 of the second digital digest using the data owner's private key and a digital signature algorithm.

[0023] Step S26: The data owner sends the signature S2 to the data sender.

[0024] Preferably, the step S3 includes:

[0025] Step S31, the data sender generates an index code for the subordinate data Di to be sent, and serializes the subordinate data Di, wherein D={Di}, the subordinate data Di and the superior data D are in a subordinate relationship, i∈[1,+∞);

[0026] Step S32: The data sender initializes an index tree structure locally, generates a root node random number root and the index code R of the parent data D, and establishes an index tree hierarchy according to a business process rule, wherein the business process rule is a step of executing a business type by a department, and the first level of the index tree is the business type, the second level is the department, and the third level is the time.

[0027] Step S33, the data sender uses the public parameter PP, the root node random number root, the access control tree and the multi-authority attribute encryption algorithm to calculate the ciphertext Cr of the root node random number root;

[0028] Step S34: The data sender uploads the ciphertext C, the signature S1, the signature S2, the ciphertext Cr, and the index code R to the blockchain, and obtains the transaction code Tx1;

[0029] Step S35: the data sender encodes all nodes of the index tree according to their positions to obtain node position codes, wherein the node position codes of the leaf nodes of the index tree are used as the position codes of the subordinate data Di;

[0030] Step S36, the data sender generates an initial key KR using the node position code, the root node random number root and a key derivation algorithm;

[0031] Step S37, the data sender uses the initial key KR and a symmetric encryption algorithm to encrypt the position code of each piece of the subordinate data Di to obtain an encrypted code C_i, i∈[1,+∞);

[0032] Step S38: The data sender uses the index code R, the encryption code C_i, and the initial key KR to generate a shared key K_i, and uses the shared key K_i and a symmetric encryption algorithm to encrypt the serialized lower-level data Di to obtain encrypted data C_Di.

[0033] Step S39: the data sender uses a hash function to calculate the serialized subordinate data Di to obtain a third digital summary Dig_i; and uses the data sender's private key and a digital signature algorithm to generate a signature S3_i of each of the third digital summaries Dig_i;

[0034] In step S310, the data sender uploads the encrypted data C_Di, the signature S3_i, the encryption code C_i, and the index code R to the blockchain, and obtains the transaction code Tx2_i.

[0035] Preferably, the step S4 includes:

[0036] Step S41, the data recipient sends a request to share the subordinate data Di and an organization code to the system;

[0037] Step S42: the attribute authorization agency uses multi-authority attribute encryption and the agency code to generate a key SK1 and sends it to the data recipient using a secure channel;

[0038] Step S43, the data sender searches out the upper-level data D to which the lower-level data Di belongs, and sends the transaction code Tx1 corresponding to the upper-level data D to the data receiver;

[0039] Step S44: The data recipient queries the transaction code Tx1 and obtains the ciphertext C, the signature S1, the signature S2, the ciphertext Cr, and the index code R from the blockchain. The recipient uses the key SK1 in S4.2 to decrypt the ciphertext C and the ciphertext Cr, and verifies the signature S1 using the public key of the data sender and the signature verification algorithm. The recipient also verifies the signature S2 using the public key of the data owner and the signature verification algorithm.

[0040] Step S45: The data receiving party establishes the same index tree as in step S32 and uses the node position code of the leaf node as the position code of the subordinate data Di;

[0041] Step S46, the data receiver uses the position code of the subordinate data Di, the root and a key derivation algorithm to derive the initial key KR;

[0042] Step S47: The data recipient searches the blockchain for the data corresponding to the index code R to obtain the encrypted data C_Di, the corresponding signature S3_i, and the encrypted code C_i.

[0043] Step S48: The data receiver uses the initial key KR, the encryption code C_i, and a symmetric encryption and decryption algorithm to calculate the shared key K_i;

[0044] Step S49, the data receiver uses the shared key K_i, the encrypted data C_Di and the symmetric encryption and decryption algorithm to calculate Di;

[0045] Step S410: The data receiver verifies the signature S3_i using the public key of the data sender and a signature verification algorithm.

[0046] Preferably, during the execution of step S42, when there is an institution classification subtree corresponding to the institution code, the attribute authorization agency generates the key SK1; if there is no institution classification subtree corresponding to the institution code, the attribute authorization agency generates null and sends it to the data recipient using a secure channel, and terminates the execution of step S4.

[0047] A multi-level data sharing anti-fraud system based on zero trust and blockchain, used to execute the method described in any one of claims 1 to 6, wherein the participants in the system include data owners, data senders, data receivers, certificate authorities CA and attribute authorization agencies.

[0048] Preferably, the data sender includes an organization or an individual, the data owner includes an organization or an individual, the data recipient includes one or more organizations or individuals, the certificate authority CA includes one organization, and the attribute authority includes multiple organizations.

[0049] It can be seen from the above technical solution that the embodiment of the present invention provides a multi-level data sharing anti-fraud method based on zero trust and blockchain. First, the system is initialized. The participants in the system include the data owner, data sender, data receiver, certificate authority CA and attribute authorization agency; an access control tree is constructed and the attribute of the upper-level data D to be shared is encrypted to obtain the ciphertext C, where the access control tree consists of an organization classification subtree and a business-related subtree; the ciphertext C is uploaded to the blockchain and the transaction code Tx1 corresponding to the upper-level data D is obtained; an index tree structure is established, and the lower-level data Di of the upper-level data D is encrypted based on the index code R to obtain the encrypted data C_Di, and the encrypted data C_Di is uploaded to the blockchain and the transaction code Tx2_i for sharing the lower-level data Di is obtained to realize an index-based multi-level data sharing mechanism; after the data receiver requests to share the lower-level data Di, it obtains the transaction code Tx1 corresponding to the upper-level data D to which the lower-level data Di belongs provided by the data sender, uses the transaction code Tx1 to obtain the index code R from the blockchain, uses the index code R to obtain the encrypted data C_Di from the blockchain, decrypts the encrypted data C_Di to obtain Di, and realizes data reception and decryption. The present invention encrypts and uploads the superior data and subordinate data with subordinate relationships to the blockchain respectively, and shares the subordinate data through an index-based cross-validation method, effectively improving the security and processing efficiency of data sharing. It has the advantages of high flexibility and high compliance, effectively preventing data abuse, and can ensure the security, integrity and traceability of data during the sharing process, thereby realizing efficient data sharing and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Flowchart of a multi-level data sharing fraud prevention method based on zero trust and blockchain. DETAILED DESCRIPTION

[0051] The technical solutions and technical effects of the present invention are further described in detail below with reference to the accompanying drawings of the present invention.

[0052] The present invention provides a multi-level data sharing anti-fraud system based on zero trust and blockchain, the architecture is as follows Figure 1As shown, the participants in the system include data owners, data senders, data receivers, certificate authorities (CAs), and attribute authorization agencies, all of which share data through blockchain. The data sender is a single organization or individual, the data owner is a single organization or individual, the data receiver is one or more organizations or individuals, the certificate authority (CA) is a single organization, and the attribute authorization agencies are multiple organizations (multiple means at least two).

[0053] The system uses blockchain technology for data storage, ensuring immutability and traceability. Based on the principle of zero trust, the system implements a dual-authentication framework: "Identity + Data": A rigorous authentication and authorization process is implemented for each access request, with attribute encryption and anonymization. Furthermore, signature verification is implemented for all types of data, strengthening data integrity and credibility and mitigating fraud risks. After encryption, data is shared across the blockchain network, ensuring secure and efficient data transmission.

[0054] This system supports multi-level data sharing and can meet the data interaction needs between different levels and roles. Specifically, the system builds relationships between multi-level data and uses different encryption algorithms for encryption. For data at different levels, a combination of symmetric and asymmetric encryption algorithms can be used to balance security and performance. In addition, the system uses indexes to calculate encryption keys, generates indexes using index trees, and then calculates encryption keys based on the indexes. This ensures data security while reducing the complexity of key management. This approach can reduce the number of key exchanges and improve the efficiency of data sharing.

[0055] The specific implementation process of multi-level data sharing includes:

[0056] Step S1, initializing the system. The participants in the system include the data owner, data sender, data receiver, certificate authority CA and attribute authority;

[0057] Step S2: construct an access control tree and perform attribute encryption on the upper-level data D to be shared to obtain ciphertext C. The access control tree consists of an organization classification subtree and a business-related subtree.

[0058] Step S3: Upload the ciphertext C to the blockchain and obtain the transaction code Tx1 for sharing the upper-level data D; establish an index tree structure, encrypt the lower-level data Di of the upper-level data D based on the index code R to obtain encrypted data C_Di, upload the encrypted data C_Di to the blockchain and obtain the transaction code Tx2_i for sharing the lower-level data Di, thereby realizing an index-based multi-level data sharing mechanism;

[0059] In step S4, after the data recipient requests to share the lower-level data Di, it obtains the transaction code Tx1 corresponding to the upper-level data D to which the lower-level data Di belongs, provided by the data sender. It uses the transaction code Tx1 to obtain the index code R from the blockchain, and uses the index code R to obtain the encrypted data C_Di from the blockchain. It decrypts the encrypted data C_Di to obtain the lower-level data Di, thus realizing data reception and decryption.

[0060] As an optional implementation, the specific implementation of step S1 includes:

[0061] Step S11, defining the participants in the system;

[0062] Step S12, calculating the public key and private key of each participant in the system: selecting a random number as the private key of the participant, and using the elliptic curve encryption algorithm and the random number to calculate the public key of the participant;

[0063] Step S13: define the business classification and access control attributes of the data, establish the organization attribute set and the business attribute set, and define the attribute inheritance relationship and constraint rules; wherein the attribute inheritance relationship and constraint rules are the mapping and rules between each organization attribute set and each business attribute set;

[0064] Step S14: The system is initialized, and the certificate authority CA uses a multi-authorization attribute encryption key generation algorithm to generate a system master key MSK, a public parameter PP, and a key SK of the authorized institution.

[0065] As an optional implementation, the specific implementation of step S2 includes:

[0066] Step S21: Build an access control tree based on the organization attribute set and the business attribute set, define an organization classification subtree and a business-related subtree, and set a threshold value; the organization classification subtree is a tree structure representing the organizational structure, and the nodes in the organization classification subtree represent the departments or teams under the organization (the data owner, data sender, and data receiver are all nodes in the organization classification subtree); the business-related subtree is a tree structure of business operations or processes, and the nodes in the business-related subtree are business roles or responsibilities (business roles refer to the business involved in the department, and responsibilities refer to the members who manage the business); the threshold value is the number of conditions for granting access rights, and the main forms include or, and, a / b (a and b are numbers, a represents the number of conditions that need to be met, and b is the total number of conditions);

[0067] Step S22, converting the sequence of upper-level data D into hexadecimal data through hexadecimal data operation, and calculating the ciphertext C using the public parameter PP, access control tree and multi-authority attribute encryption algorithm of the above S14;

[0068] Step S23: The data sender performs a hash function calculation based on the hexadecimal data to obtain a first digital summary; and generates a signature S1 of the first digital summary using the data sender's private key and a digital signature algorithm.

[0069] Step S24: The data sender sends the ciphertext C and signature S1 to the data owner;

[0070] In step S25, the data owner uses the key SK from step S14 to decrypt the ciphertext C to obtain the upper-level data D, and performs a hash function calculation based on the hexadecimal data of the upper-level data D to obtain a second digital digest; and uses the data owner's private key and a digital signature algorithm to generate a signature S2 of the second digital digest;

[0071] In step S26, the data owner sends the signature S2 to the data sender.

[0072] As an optional implementation, the specific implementation of step S3 includes:

[0073] Step S31: The data sender generates an index code for the subordinate data Di to be sent, and serializes the subordinate data Di, where D = {Di}, the subordinate data Di and the superior data D are in a subordinate relationship, i∈[1,+∞);

[0074] In step S32, the data sender initializes the index tree structure locally, generates a random root number for the root node and an index code R for the parent data D, and establishes an index tree hierarchy according to the business process rules. The business process rules are steps for departments to perform business types. The first level of the index tree is business type, the second level is department, and the third level is time.

[0075] Step S33: The data sender uses the public parameter PP of S14, the root node random number root of S32, the access control tree, and the multi-authority attribute encryption algorithm to calculate the ciphertext Cr of the root node random number root;

[0076] Step S34: The data sender uploads the ciphertext C of S22, the signature S1 of S23, the signature S2 of S25, the ciphertext Cr of S33, and the index code R of S32 to the blockchain and obtains the transaction code Tx1.

[0077] Step S35: The data sender encodes all nodes of the index tree of S32 according to their positions to obtain node position codes, wherein the node position codes of the leaf nodes of the index tree are used as the position codes of the subordinate data Di.

[0078] Step S36: The data sender generates an initial key KR using the node position code, the root node random number root in S32, and the key derivation algorithm;

[0079] Step S37: The data sender uses the initial key KR of S36 and the symmetric encryption algorithm to encrypt the position code of each subordinate data Di to obtain the encrypted code C_i, i∈[1,+∞);

[0080] Step S38: The data sender uses the index code R of S32, the encryption code C_i of S37, and the initial key KR of S36 to generate a shared key K_i, and uses the shared key K_i and the symmetric encryption algorithm to encrypt the serialized lower-level data Di of S31 to obtain encrypted data C_Di.

[0081] Step S39: The data sender uses a hash function to calculate the serialized lower-level data Di to obtain a third digital summary Dig_i; and uses the data sender's private key and a digital signature algorithm to generate a signature S3_i of each third digital summary Dig_i;

[0082] In step S310, the data sender uploads the encrypted data C_Di of S38, the signature S3_i of S39, the encryption code C_i of S37, and the index code R of S32 to the blockchain, and obtains the transaction code Tx2_i.

[0083] As an optional implementation, the specific implementation of step S4 includes:

[0084] Step S41: The data receiver sends a request to share the lower-level data Di and an organization code to the system. The organization code is used to indicate the organization classification subtree in the access control tree.

[0085] In step S42, the attribute authorization agency uses multi-authority attribute encryption and the organization code to generate a key SK1 and sends it to the data recipient via a secure channel. During the execution of step S42, if an organization classification subtree corresponding to the organization code exists, the attribute authorization agency generates the key SK1; if no organization classification subtree corresponding to the organization code exists, the attribute authorization agency generates null and sends it to the data recipient via a secure channel, and terminates the execution of step S4.

[0086] Step S43: The data sender searches for the upper-level data D to which the lower-level data Di belongs, and sends the transaction code Tx1 corresponding to the upper-level data D in S34 to the data receiver;

[0087] In step S44, the data receiver queries the transaction code Tx1 and obtains the ciphertext C, signature S1, signature S2, ciphertext Cr, and index code R of S34 from the blockchain. It uses the key SK1 of S4.2 to decrypt the ciphertext C and ciphertext Cr, and verifies the signature S1 using the public key and signature verification algorithm of the data sender, and verifies the signature S2 using the public key and signature verification algorithm of the data owner.

[0088] Step S45: The data receiving party builds the same index tree as that in step S32 by referring to the process in step S32 and uses the node position code of the leaf node as the position code of the subordinate data Di;

[0089] Step S46: The data receiver uses the position code of the subordinate data Di, root, and the key derivation algorithm to derive the initial key KR;

[0090] Step S47: The data recipient searches the blockchain for the data corresponding to the index code R in S44 and obtains the encrypted data C_Di, the corresponding signature S3_i, and the encrypted code C_i in S310.

[0091] Step S48: The data receiver uses the initial key KR of S47, the encryption code C_i of S47, and the symmetric encryption and decryption algorithm to calculate the shared key K_i;

[0092] Step S49: The data receiver uses the shared key K_i of S48, the encrypted data C_Di of S47, and the symmetric encryption and decryption algorithm to calculate Di;

[0093] In step S410, the data receiver verifies the signature S3_i of S47 using the public key and signature verification algorithm of the data sender. When the signature S3_i is successfully verified, the subordinate data Di is deemed to be untampered data, and the data sharing process ends.

[0094] The multi-authority attribute encryption algorithm used in this invention is an attribute-based encryption technology that combines multiple authorization agencies to achieve fine-grained control over data access. In this algorithm, data encryption is based on a predefined set of attributes, which are assigned and managed by different authorization agencies. Each attribute represents a specific access control policy or user attribute, such as a user's role, department, or security level. During the encryption process, data is labeled with a combination of these attributes, and only when the user's attribute set matches the attribute label of the encrypted data can they decrypt and access the data. The multi-authority attribute encryption algorithm includes a key generation algorithm, an encryption algorithm, and a decryption algorithm. Algorithm reference: Rousselakis Y, Waters B. Efficient statically-secure large-universe multi-authority attribute-based encryption [C] / / International Conference on Financial Cryptography and Data Security. Berlin, Heidelberg: Springer Berlin Heidelberg, 2015: 315-332.

[0095] The multi-level data in this invention is defined as: Let D1 and D2 be two types of data, where D1 is a set of data instances. The relationship between D1 and D2 can be described as a mapping f:D1→D2.

[0096] The solution of the present invention has the following technical effects:

[0097] First, efficient key management:

[0098] The index tree structure simplifies the key management process, reduces the number of key exchanges, and supports an incremental key update mechanism to improve the efficiency and security of key management.

[0099] Second, optimized storage efficiency:

[0100] A unified storage model is used to process similar data, reduce redundant storage, and support fast retrieval to improve the efficiency and response speed of the storage system.

[0101] Third, flexible access control:

[0102] Implement fine-grained permission management, allow dynamic adjustment of access control policies, and provide multi-level security protection to adapt to the security needs of different users and scenarios.

[0103] Fourth, scalable architecture design:

[0104] It supports multi-party data sharing, the architecture is easy to integrate and expand, and has strong adaptability.

[0105] Fifth, a data sharing mechanism based on zero trust is proposed to ensure the security, integrity and traceability of data during the sharing process.

[0106] Sixth, we propose an index-based multi-level data sharing mechanism. This mechanism achieves efficient data sharing and access control by generating data encoding, building an index tree hierarchy, and generating initial and shared keys. This mechanism supports rapid retrieval and access to large-scale data while ensuring data security.

[0107] The above disclosure is only a preferred embodiment of the present invention, and it is certainly not intended to limit the scope of the present invention. A person skilled in the art can understand that all or part of the processes of the above embodiment and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A multi-level data sharing anti-fraud method based on zero trust and blockchain, characterized in that: include: Step S1, initializing the system, wherein the participants in the system include the data owner, the data sender, the data receiver, the certificate authority CA and the attribute authority; Step S2: Construct an access control tree and perform attribute encryption on the superior data D to be shared to obtain ciphertext C. The access control tree is composed of an organization classification subtree and a business-related subtree. The organization classification subtree is a tree structure representing the organizational structure, and the nodes in the organization classification subtree represent the departments or teams under the organization. The business-related subtree is a tree structure representing business operations or processes, and the nodes in the business-related subtree represent business roles or responsibilities. Step S3: Upload the ciphertext C to the blockchain and obtain the transaction code Tx1 for sharing the upper-level data D; establish an index tree structure, encrypt the lower-level data Di of the upper-level data D based on the index code R to obtain encrypted data C_Di, upload the encrypted data C_Di to the blockchain and obtain the transaction code Tx2_i for sharing the lower-level data Di, thereby realizing an index-based multi-level data sharing mechanism; In step S4, after the data recipient requests to share the lower-level data Di, it obtains the transaction code Tx1 corresponding to the upper-level data D to which the lower-level data Di belongs, provided by the data sender, and uses the transaction code Tx1 to obtain the index code R from the blockchain. The index code R is used to obtain the encrypted data C_Di from the blockchain, and the encrypted data C_Di is decrypted to obtain the lower-level data Di, thereby realizing data reception and decryption.

2. The multi-level data sharing anti-fraud method based on zero trust and blockchain as claimed in claim 1 is characterized by: The data sender includes an organization or individual, the data owner includes an organization or individual, the data recipient includes one or more organizations or individuals, the certificate authority CA includes one organization, and the attribute authority includes multiple organizations; The step S1 comprises: Step S11, defining the participants in the system; Step S12, calculating the public key and private key of each participant in the system: selecting a random number as the private key of the participant, and using the elliptic curve encryption algorithm and the random number to calculate the public key of the participant; Step S13, defining the business classification and access control attributes of the data, establishing an organization attribute set and a business attribute set, and defining attribute inheritance relationships and constraint rules; wherein the attribute inheritance relationships and constraint rules are mappings and rules between the organization attribute sets and the business attribute sets; Step S14: system initialization, the certificate authority CA uses a multi-authorization attribute encryption key generation algorithm to generate a system master key MSK, a public parameter PP and a key SK of the authorized institution.

3. The multi-level data sharing anti-fraud method based on zero trust and blockchain as claimed in claim 2 is characterized in that: The step S2 comprises: Step S21, constructing an access control tree based on the organization attribute set and the business attribute set, defining an organization classification subtree and a business-related subtree, and setting a threshold value; the threshold value is the number of conditions for granting access rights; Step S22, converting the sequence of the upper-level data D into hexadecimal data, and calculating the ciphertext C using the public parameter PP, the access control tree and the multi-authority attribute encryption algorithm; Step S23: the data sender performs a hash function calculation based on the hexadecimal data to obtain a first digital summary; and generates a signature S1 of the first digital summary using the data sender's private key and a digital signature algorithm; Step S24: the data sender sends the ciphertext C and the signature S1 to the data owner; Step S25: The data owner uses the key SK to decrypt the ciphertext C to obtain the upper-level data D, performs a hash function calculation based on the hexadecimal data of the upper-level data D to obtain a second digital digest; and generates a signature S2 of the second digital digest using the data owner's private key and a digital signature algorithm. Step S26: The data owner sends the signature S2 to the data sender.

4. The multi-level data sharing anti-fraud method based on zero trust and blockchain as claimed in claim 3 is characterized in that: The step S3 comprises: Step S31, the data sender serializes the subordinate data Di to be sent, wherein D={Di}, the subordinate data Di and the superior data D are in a subordinate relationship, i∈[1,+∞); Step S32: The data sender initializes an index tree structure locally, generates a root node random number root and the index code R of the parent data D, and establishes an index tree hierarchy according to a business process rule, wherein the business process rule is a step of executing a business type by a department, and the first level of the index tree is the business type, the second level is the department, and the third level is the time. Step S33, the data sender uses the public parameter PP, the root node random number root, the access control tree and the multi-authority attribute encryption algorithm to calculate the ciphertext Cr of the root node random number root; Step S34: The data sender uploads the ciphertext C, the signature S1, the signature S2, the ciphertext Cr, and the index code R to the blockchain, and obtains the transaction code Tx1; Step S35: the data sender encodes all nodes of the index tree according to their positions to obtain node position codes, wherein the node position codes of the leaf nodes of the index tree are used as the position codes of the subordinate data Di; Step S36, the data sender generates an initial key KR using the node position code, the root node random number root and a key derivation algorithm; Step S37, the data sender uses the initial key KR and a symmetric encryption algorithm to encrypt the position code of each piece of the subordinate data Di to obtain an encrypted code C_i, i∈[1,+∞); Step S38: The data sender uses the index code R, the encryption code C_i, and the initial key KR to generate a shared key K_i, and uses the shared key K_i and a symmetric encryption algorithm to encrypt the serialized lower-level data Di to obtain encrypted data C_Di. Step S39: the data sender uses a hash function to calculate the serialized subordinate data Di to obtain a third digital summary Dig_i; and uses the data sender's private key and a digital signature algorithm to generate a signature S3_i of each of the third digital summaries Dig_i; In step S310, the data sender uploads the encrypted data C_Di, the signature S3_i, the encryption code C_i, and the index code R to the blockchain, and obtains the transaction code Tx2_i.

5. The multi-level data sharing anti-fraud method based on zero trust and blockchain as claimed in claim 4 is characterized in that: The step S4 comprises: Step S41, the data recipient sends a request for the subordinate data Di and an organization code to the system; Step S42: the attribute authorization agency uses multi-authority attribute encryption and the agency code to generate a key SK1 and sends it to the data recipient using a secure channel; Step S43, the data sender searches out the upper-level data D to which the lower-level data Di belongs, and sends the transaction code Tx1 corresponding to the upper-level data D to the data receiver; Step S44: The data recipient queries the transaction code Tx1 and obtains the ciphertext C, the signature S1, the signature S2, the ciphertext Cr, and the index code R from the blockchain. The data recipient uses the key SK1 to decrypt the ciphertext C and the ciphertext Cr, and verifies the signature S1 using the public key of the data sender and the signature verification algorithm. The data recipient also verifies the signature S2 using the public key of the data owner and the signature verification algorithm. Step S45: The data receiving party establishes the same index tree as in step S32 and uses the node position code of the leaf node as the position code of the subordinate data Di; Step S46, the data receiver uses the position code of the subordinate data Di, the root and a key derivation algorithm to derive the initial key KR; Step S47: The data recipient searches the blockchain for the data corresponding to the index code R to obtain the encrypted data C_Di, the corresponding signature S3_i, and the encrypted code C_i. Step S48: The data receiver uses the initial key KR, the encryption code C_i, and a symmetric encryption and decryption algorithm to calculate the shared key K_i; Step S49, the data receiver uses the shared key K_i, the encrypted data C_Di and the symmetric encryption and decryption algorithm to calculate Di; Step S410: The data receiver verifies the signature S3_i using the public key of the data sender and a signature verification algorithm.

6. The multi-level data sharing anti-fraud method based on zero trust and blockchain as claimed in claim 5 is characterized in that: During the execution of step S42, when there is an institution classification subtree corresponding to the institution code, the attribute authorization agency generates the key SK1. If there is no institution classification subtree corresponding to the institution code, the attribute authorization agency generates null and sends it to the data recipient using a secure channel, and terminates the execution of step S4. Null represents an empty value, indicating that the received request is an invalid request.

7. A multi-level data sharing anti-fraud system based on zero trust and blockchain, characterized by: Used to execute the method according to any one of claims 1 to 6, the participants in the system include a data owner, a data sender, a data receiver, a certificate authority CA and an attribute authority.

8. The multi-level data sharing anti-fraud system based on zero trust and blockchain as claimed in claim 7, characterized in that: The data sender includes an organization or an individual, the data owner includes an organization or an individual, the data receiver includes one or more organizations or individuals, the certificate authority CA includes one organization, and the attribute authority includes multiple organizations.

Images