Electricity-carbon data secure storage and access method and device based on alliance chain

Abstract

The invention provides an alliance chain-based electricity and carbon data secure storage and access method and device. According to the implementation scheme, the method comprises the following steps: in response to a data use request for first ciphertext electric carbon data, obtaining corresponding first ciphertext key fragments from nodes in an alliance chain; updating the reputation value of each node based on the synchronization condition of the timestamp of each first ciphertext key fragment; updating the minimum number of participants based on a default basic value corresponding to the minimum number of participants required for restoring the original key and the updated reputation value of each node; based on the updated minimum number of participants, performing key recovery on each first ciphertext key fragment to obtain a first ciphertext key; decrypting the first ciphertext key to obtain a first plaintext key; and based on the first plaintext key, decrypting the first ciphertext electric carbon data to obtain first plaintext electric carbon data. Therefore, the storage and access security of the data is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for secure storage and access of electric carbon data based on an alliance chain. Background Art

[0002] With the rapid development of Internet technology, cloud storage has become an important business model in daily life. It provides individuals and businesses with a variety of data storage services, allowing users to access Internet resources and share data anytime and anywhere, bringing great convenience to life.

[0003] However, this system relies solely on cloud storage service providers with robust storage capabilities to store and transmit data. This inevitably inherits the drawback of relying on third-party services as a single point of failure. Even if cloud storage systems implement data availability backups, cloud storage service providers may still be subject to force majeure (such as content censorship) that could prevent users from accessing their data. Centralized storage also creates numerous risks of information leakage and tampering.

[0004] Blockchain technology enables this decentralization, connecting cryptocurrencies with storage space, high-speed I / O, and cloud storage. Cloud platforms can be linked to blockchains through underlying interfaces, combining the advantages of both platforms while also deriving incentives from the blockchain. Therefore, data storage through blockchains can improve both reliability and privacy. Summary of the Invention

[0005] The present invention provides a method and device for secure storage and access of electric carbon data based on an alliance chain, which can solve at least one of the above technical problems.

[0006] According to one aspect of the present invention, a method for secure storage and access of electric carbon data based on a consortium chain is provided, comprising: In response to a data use request for the first encrypted electric carbon data, obtaining, from each node in the consortium chain, each first encrypted key shard corresponding to the first encrypted electric carbon data; Based on the synchronization status of the timestamps of the first ciphertext key shards, the reputation value of each node is updated to obtain an updated reputation value of each node; Updating the minimum number of parties based on a default base value corresponding to the minimum number of parties required to recover the original key and the updated reputation value of each of the nodes; Based on the updated minimum number of participants, performing key recovery on each of the first ciphertext key shards to obtain a first ciphertext key; Decrypting the first ciphertext key to obtain a first plaintext key; The first ciphertext electro-carbon data is decrypted based on the first plaintext key to obtain first plaintext electro-carbon data.

[0007] According to another aspect of the present invention, a device for secure storage and access of electric carbon data based on a consortium chain is provided, comprising: A key shard acquisition module, configured to, in response to a data use request for the first encrypted electric carbon data, acquire each first encrypted key shard corresponding to the first encrypted electric carbon data from each node in the consortium chain; a reputation value updating module, configured to update the reputation value of each of the nodes based on the synchronization of the timestamps of each of the first ciphertext key shards, to obtain an updated reputation value of each of the nodes; a minimum number updating module, configured to update the minimum number of parties required to recover the original key based on a default base value corresponding to the minimum number of parties required to recover the original key and the updated reputation value of each node; a key recovery module, configured to perform key recovery on each of the first ciphertext key shards based on the updated minimum number of participants to obtain a first ciphertext key; a key decryption module, configured to decrypt the first ciphertext key to obtain a first plaintext key; The data decryption module is used to decrypt the first ciphertext electro-carbon data based on the first plaintext key to obtain the first plaintext electro-carbon data.

[0008] Using the technical solution of the present invention, when a data use request for first ciphertext electro-carbon data is received, the first ciphertext key shards corresponding to the first ciphertext electro-carbon data are obtained from each node in the consortium chain. Based on the synchronization of the timestamps of each first ciphertext key shard, the reputation value of each node is updated to obtain an updated reputation value for each node. Based on the default base value corresponding to the minimum number of participants required to recover the original key and the updated reputation value of each node, the minimum number of participants can be updated. This ensures the availability of the synthesized key during subsequent key synthesis, avoiding the inability to recover the usable first ciphertext key. Furthermore, the first ciphertext key is decrypted to obtain a usable first plaintext key. Based on the first plaintext key, the first ciphertext electro-carbon data can be successfully decrypted to obtain the first plaintext electro-carbon data. This improves data access security. Subsequently, the updated minimum number of participants can be used to store other electro-carbon data, further improving data storage security.

[0009] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings are provided for a better understanding of the present invention and do not constitute a limitation of the present invention. Figure 1 This is a flow chart of a method for secure storage and access of electric carbon data based on a consortium chain according to an embodiment of the present invention; Figure 2 is a schematic diagram of a cloud platform access process according to an embodiment of the present invention; Figure 3 is a flow chart of data encryption and decryption according to an embodiment of the present invention; Figure 4A and Figure 4B is a flow chart of data encryption and decryption according to another embodiment of the present invention; Figure 5 This is a structural block diagram of a device for secure storage and access of electric carbon data based on a consortium chain according to an embodiment of the present invention; Figure 6 is a block diagram of an electronic device for implementing the method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0011] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, and various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0012] Explanation of relevant terms: Shamir's Secret Sharing Algorithm: The Shamir Secret Sharing algorithm allows a secret (such as a private key or encryption key) to be split into multiple parts (shares) and distributed to multiple participants. The secret can only be reconstructed when at least a specified number of participants (a threshold) provide their shares. This mechanism improves data security and availability.

[0013] Data owner: is the owner of the data and can request to upload his data to cloud storage.

[0014] Data users: are users of cloud data who can obtain data from cloud servers.

[0015] Attribute-based encryption (ABE): ABE is a public-key encryption technique that allows encrypted access control to be defined by attributes. This encryption approach allows for more flexible and granular data access control, making it suitable for scenarios where data needs to be shared between users with different permissions.

[0016] Homomorphic attribute-based encryption: This is a fusion of homomorphic encryption and homomorphic attribute-based encryption. The core idea of ​​homomorphic attribute-based encryption is that data encryption and decryption not only rely on traditional public / private key pairs, but also are linked to user attributes (such as role, department, time, etc.). Only users who meet specific conditions (i.e., possess the relevant attributes) can decrypt the data.

[0017] Asymmetric encryption: Asymmetric encryption uses a pair of keys (public and private). The public key can be shared publicly, while the private key must be kept secret. This makes key management more convenient, especially in scenarios where multiple users need to communicate securely.

[0018] DPOS: DPOS is a blockchain consensus mechanism that improves the efficiency and performance of blockchain networks by introducing proxy and voting mechanisms. DPOS aims to address the trade-offs between security, efficiency, and decentralization between traditional Proof of Work (PoW) and Proof of Stake (PoS). By reducing the number of validating nodes, DPOS increases block generation speed and network throughput while maintaining decentralization.

[0019] Cloud storage servers: Cloud storage servers are resource providers that allocate storage resources to data owners to store their data. Data owners encrypt their data before uploading it to the cloud. This ensures data confidentiality, a fundamental security requirement.

[0020] Figure 1 This is a flowchart of a method for secure storage and access of electric carbon data based on a consortium chain according to an embodiment of the present invention.

[0021] like Figure 1 As shown, the method for secure storage and access of electric carbon data based on the alliance chain may include: S110, in response to a data use request for the first encrypted electric carbon data, obtaining each first encrypted key shard corresponding to the first encrypted electric carbon data from each node in the consortium chain; S120, based on the synchronization status of the timestamps of the first ciphertext key shards, updating the reputation value of each node to obtain an updated reputation value of each node; S130, updating the minimum number of participants based on a default base value corresponding to the minimum number of participants required to recover the original key and the updated reputation value of each node; S140: Based on the updated minimum number of participants, perform key recovery on each first ciphertext key shard to obtain the first ciphertext key. S150, decrypting the first ciphertext key to obtain a first plaintext key; S160: Decrypt the first ciphertext electro-carbon data based on the first plaintext key to obtain the first plaintext electro-carbon data.

[0022] For example, the methods of the embodiments of the present disclosure can be applied to a cloud platform and executed by computing devices within the cloud platform. Encrypted electric carbon data is stored on the cloud platform. The cloud platform can allow whitelisted users to access and store data on the cloud platform. The keys and key shards of the embodiments of the present disclosure are stored in a consortium blockchain.

[0023] For example, a consortium chain may include multiple nodes, wherein a master node among the multiple nodes is used to encrypt plaintext key shards and decrypt key shards.

[0024] For example, the system architecture of the cloud platform can be as follows: the system consists of three layers, including the underlying blockchain network, the middleware layer, and the upper application layer. In order to meet various queries from the application layer, the middleware layer (cloud platform) extracts and reorganizes the data stored in the underlying blockchain and then stores them in the database.

[0025] For example, Figure 2 As shown in the figure, the data owner (information provider) can provide private electric carbon data to the cloud platform. The private information is symmetrically encrypted with a randomly generated key to generate ciphertext private information, which is then stored in the cloud platform and structured to increase access speed.

[0026] To prevent information tampering and leakage on the cloud platform, access control is implemented by the encryption mechanism (the master node of the consortium chain). When an information user's application initiates a request to the relational database, the encryption mechanism (the master node of the consortium chain) intercepts the SQL statements and uses them to query the database. Only information users with the consent of the encryption mechanism (the master node) can make a query request and obtain the encrypted private information. The attribute-based encryption algorithm used here enables more granular access control. Furthermore, this access control process participates in the consortium chain's consensus, which takes into account the cloud platform's index query method and speeds up queries of complex and large amounts of encrypted information.

[0027] Exemplarily, the caching mechanism of the cloud platform can be: if the metadata of the file exists in the cache, return it directly. If it does not exist in the cache, obtain the file metadata from the cloud storage service and store it in the Redis cache for subsequent access. The Redis storage server regularly cleans up the mirror data that has not been accessed recently based on the dynamically adjusted LRU cache replacement strategy. In image data retrieval, first search in Redis based on the keyword, and if it does not exist in Redis, search in the cloud platform. In cache retrieval, if the number of cloud platform accesses exceeds the maximum threshold designed by Redis, the privacy data will be stored in Redis. The cache structure of cloud platform + Redis data is used to ensure the safe and reliable storage of data, which improves the efficiency of data users in retrieving data. Set the cache validity period to one hour so that expired data can be automatically cleaned up to keep the cache up to date.

[0028] For example, a dynamically adjusted LRU strategy might look like this: Configure Redis to LRU mode to automatically clear the least-used data when the cache reaches its upper limit. Use tools such as Redis Monitor to monitor metrics such as cache hit rate and memory usage, and adjust the cache strategy accordingly. Load balance the application servers and Redis cluster based on traffic to improve overall system performance. Furthermore, the cache hit rate can be used to determine whether to increase or decrease cache capacity. When the cache hit rate is low, the cache capacity can be increased; when the hit rate is high, the cache can be reduced to avoid wasting resources.

[0029] For example, if cache access fails and the information is missing, the encryption mechanism (the consortium chain master node) will access the consortium chain and compare the query results with the calculated digest. If no tampering is detected, the middleware will access the cloud platform using the original SQL statement and return the query results to the user. If tampering is detected, the tampering detection module will perform detection.

[0030] For example, to ensure data validity in the cloud platform's middleware, each constructed database generates a fingerprint, which is a cryptographic hash of the database's content and attributes (such as name, size, and timestamp). This fingerprint is verified by the master node and further stored in the blockchain. Due to the blockchain's immutability, this verification scheme prevents any forged data from being stored in the middleware layer. Public users who do not trust the cloud service can also download the entire blockchain data to verify the database.

[0031] It can be understood that for each access to data, the above method can be used to update the credibility value of each node in the alliance chain and the minimum number of participants to recover the original key, which can improve the security of key storage and access, and thus improve the security of the electric carbon data of the cloud platform.

[0032] For example, in step S120 above, the synchronization of the timestamps of the first ciphertext key shards of the same ID in each node in the consortium chain can be used to score the performance of each node in the current data access cycle. Thus, the performance can be used to reward or punish each node.

[0033] For example, if a node performs well, its reputation value will gradually increase; conversely, if it performs poorly, its reputation value will gradually decrease. Reputation is a way to represent a node's trustworthiness. In a reputation-based DPOS system, the reputation value V is a real number between 0 and 1. The higher the value, the higher the reputation.

[0034] Moreover, when the total number of nodes in the alliance chain is insufficient, new nodes can be added. For newly added nodes in the alliance chain, their reputation value is initialized to 0.5.

[0035] Furthermore, if the reputation value of a node in the alliance chain is too low, the node can be deleted from the alliance chain. For example, if the reputation value of a node is less than 0.01, the node will be removed from the alliance chain, its access control permissions will be deleted, and a notice will be broadcast to all nodes.

[0036] Exemplarily, based on the updated reputation values ​​of each node, the default base value corresponding to the minimum number of participants required to recover the original key is adjusted to obtain an updated minimum number of participants. For example, if the updated reputation values ​​of each node are generally low, the minimum number of participants is increased based on the default base value. If the updated reputation values ​​of each node are generally high, the minimum number of participants is decreased based on the default base value. In this way, the availability of the synthesized key can be guaranteed during subsequent key synthesis, avoiding the possibility of being unable to recover a usable key.

[0037] Exemplarily, the Shamir algorithm may be used to perform key recovery on each first ciphertext key fragment based on the updated minimum number of participants to obtain the first ciphertext key.

[0038] For example, the process of sharding the plaintext key using the Shamir algorithm can be as follows: First, set the key and participant requirements: 1. The plaintext key can be a random key that needs to be distributed. 2. The number of participants is the total number of nodes in the consortium chain, set to N. 3. The dynamic adjustment threshold is the minimum number of participants required to recover the original key, set to t` (requires t` ≤ N).

[0039] Next, an appropriate threshold t' is selected, representing the minimum number of nodes required to recover the key. This threshold t' must meet certain security requirements. By evaluating the reputation, reliability, or other metrics of the participating nodes in the current system, the value of t' can be dynamically adjusted. For example, if some nodes are deemed unreliable, t' can be raised, requiring more nodes to cooperate in key recovery. Conversely, if nodes are in good condition, t' can be appropriately lowered to increase recovery flexibility.

[0040] The data owner then uses the modified Shamir secret sharing algorithm to split the random key into n shares. These decryption keys are then distributed to n master nodes, with each master node retaining only one decryption key. Using the modified Shamir sharing algorithm, the key is split into n or N shares.

[0041] Assume that the original key is S, and choose a prime number p that is large enough so that the original key S can be calculated modulo p. Set a random polynomial f(x) as the core of the secret sharing: ; in, is the original key, are randomly selected coefficients.

[0042] Then, according to the polynomial Generate n key fragments { , ,···, }. Among them, each is a polynomial exist The value at: , i=1,2,···,n.

[0043] Finally, these key fragments { , ,····, }are stored in different nodes of the alliance chain respectively.

[0044] For example, after obtaining each plaintext key shard, a homomorphic encryption algorithm can be used to encrypt it and store it in each consortium chain node. For details, see the subsequent embodiments.

[0045] For example, the process of synthesizing the ciphertext key using the Shamir algorithm may be as follows: To recover the original key S, it is necessary to collect encrypted key fragments from at least t` nodes.

[0046] Assume that the slave node Get the encrypted key fragments respectively , . Combined with the dynamic threshold, the Lagrange interpolation formula is still used to calculate the key fragment , Perform synthesis to obtain an encrypted synthetic key.

[0047] Among them, the following formula can be used to restore S.

[0048] Understandably, the key fragment Homomorphic encryption is used for encryption, allowing necessary computational operations, such as interpolation, to be performed on the ciphertext, without decrypting the original data to recover the original key. However, it should be noted that the recovered key is still an encrypted key and requires subsequent decryption to obtain the final original key.

[0049] For example, the formula of the original key S is as follows: .

[0050] Exemplarily, for the above step S150, the corresponding public key in the homomorphic encryption algorithm can be used to decrypt the first ciphertext key to obtain the first plaintext key.

[0051] Exemplarily, when the first plaintext electro-carbon data is obtained, the data may be returned to the access terminal.

[0052] According to the above embodiment, when a data use request for the first ciphertext electric carbon data is obtained, each first ciphertext key shard corresponding to the first ciphertext electric carbon data is obtained from each node in the alliance chain, and based on the synchronization of the timestamps of each first ciphertext key shard, the reputation value of each node is updated to obtain the updated reputation value of each node, so that the minimum number of participants can be updated based on the default base value corresponding to the minimum number of participants required to restore the original key and the updated reputation value of each node. In this way, when the key is subsequently synthesized, the availability of the synthesized key can be guaranteed to avoid the inability to restore the available first ciphertext key. Then, the first ciphertext key is decrypted to obtain the available first plaintext key. Based on the first plaintext key, the first ciphertext electric carbon data can be successfully decrypted to obtain the first plaintext electric carbon data. Thus, the access security of the data is improved. Subsequently, the updated minimum number of participants is used to store other electric carbon data, which can also improve the storage security of the data.

[0053] The following describes an embodiment of data storage: In one embodiment, the above method may also include: in response to a data storage request for the second plaintext electric carbon data, encrypting the second plaintext electric carbon data based on the second plaintext key to obtain second ciphertext electric carbon data; sharding the second plaintext key based on the minimum number of participants and the total number of nodes in the alliance chain to obtain multiple second plaintext key shards; encrypting each second plaintext key shard separately to obtain multiple second ciphertext key shards; distributing and storing the multiple second ciphertext key shards to each node in the alliance chain; and storing the second ciphertext electric carbon data.

[0054] Exemplarily, the second encrypted electro-carbon data may be stored in a cloud platform.

[0055] Exemplarily, the process of sharding the second plaintext key can refer to the above example and will not be described in detail here.

[0056] For example, for each (second plaintext key) key fragment , these fragments can be encrypted using homomorphic attribute-based encryption (ABE) so that only users with specific attributes can decrypt them. That is, the encryptor is allowed to set an access control policy based on a set of attributes, and only users who meet the policy can decrypt the ciphertext.

[0057] For example, a set of whitelist attributes is defined { , ,····, }, each user will have a set of attributes { , ,····, }, you can obtain the corresponding decryption attributes by applying to the master node. The access control policy is defined as: Policy=( , ,····, ), IN { , ,····, }.

[0058] Thus, only if both properties , ,····, Only the information user can decrypt the ciphertext.

[0059] For example, the encryption process is: Generate ciphertext by using the homomorphic attribute-based encryption algorithm , the ciphertext contains the attribute Related encryption information.

[0060] Exemplarily, after obtaining multiple second ciphertext key shards, each second ciphertext key shard is distributed to each node in the consortium chain. For example, each node stores one second ciphertext key shard.

[0061] It is understandable that each second ciphertext key fragment has the same identity identifier. Subsequently, each second ciphertext key fragment can be collected and synthesized using the identity identifier.

[0062] According to the above implementation, the minimum number of participants is dynamically adjusted based on the reputation of the consortium chain nodes. This ensures that the original key can only be recovered if a sufficient number of nodes provide key fragments. Each key fragment is stored on the blockchain using asymmetric encryption, and key fragment recovery relies on smart contracts for node verification and permission management. This ensures that even if a node is attacked or the key is compromised, it cannot be easily leaked. This ensures the distributed storage and security of the key, prevents the risk of single-point leakage, and improves the storage security of encrypted electric carbon data.

[0063] In one embodiment, based on the synchronization of the timestamps of each first ciphertext key shard, the reputation value of each node is updated to obtain the updated reputation value of each node, including: determining a reference mode based on the timestamp of each first ciphertext key shard; when the timestamp of the third ciphertext key shard in each first ciphertext key shard is different from the reference mode, increasing the reputation value of the node corresponding to the third ciphertext key shard to obtain the updated reputation value of the node corresponding to the third ciphertext key shard.

[0064] It can be understood that if the timestamp of the ciphertext key shard is the same as or close to the reference mode, the node corresponding to the shard is considered to have performed well, and therefore its reputation value can be increased.

[0065] Exemplarily, based on the current reputation value of the node, a certain value is added to obtain the updated reputation value of the node.

[0066] Exemplarily, an exponential function or a linear increasing function may be used to calculate the current reputation value of a node to obtain an updated reputation value of the node.

[0067] In one embodiment, the above method may also include: when the timestamp of the fourth ciphertext key shard in each first ciphertext key shard is the same as the reference mode, reducing the reputation value of the node corresponding to the fourth ciphertext key shard to obtain an updated reputation value of the node corresponding to the fourth ciphertext key shard.

[0068] Understandably, if the timestamp of the ciphertext key shard is significantly different from the reference mode, i.e., different or similar, the node corresponding to the shard is considered to have poor performance, and therefore the reputation value of the node can be reduced.

[0069] Exemplarily, the updated reputation value of the node is obtained by subtracting a certain value from the current reputation value of the node.

[0070] Illustratively, an exponential function or a linear increase / decrease function may be used to calculate the current reputation value of a node to obtain an updated reputation value of the node.

[0071] According to the above embodiment, based on the timestamps of each first ciphertext key fragment, the reference mode is determined, and then the timestamps of each fragment are compared with the reference mode. If they are consistent, the node is considered to have performed well and its reputation value is increased. If they are inconsistent, the node is considered to have performed poorly and its reputation value is reduced.

[0072] In one embodiment, increasing the reputation value of the node corresponding to the third ciphertext key shard includes: using a natural exponential function to calculate the negative number corresponding to the reputation value of the node corresponding to the third ciphertext key shard to obtain a first value; based on the difference between 1 and the first value, determining the updated reputation value of the node corresponding to the third ciphertext key shard.

[0073] For example, the reputation value may be updated using the following formula: .

[0074] in, Represents the updated reputation value of the node, Indicates the node's reputation value before the update.

[0075] According to the above embodiment, an exponential function may be used to increase the updated reputation value of a node based on the reputation value before the update. In this way, the reputation value may be gradually increased to avoid excessive increase in the reputation value.

[0076] In one embodiment, reducing the reputation value of the node corresponding to the fourth ciphertext key shard includes: determining a fourth value between the second value and the third value, wherein the second value is less than the third value, and the second value and the third value are both less than 1 and greater than zero; and determining an updated reputation value of the node corresponding to the fourth ciphertext key shard based on the product of the fourth value and the reputation value of the node corresponding to the fourth ciphertext key shard.

[0077] For example, the reputation value may be updated using the following formula: .

[0078] in, The function randomly selects a value between two numerical intervals.

[0079] According to the above embodiment, a different random value within a specified interval is used each time to reduce the node's updated reputation value based on the node's pre-update reputation value. In this way, the reputation value can be gradually reduced to avoid a large reduction in the reputation value.

[0080] In one embodiment, based on a default base value corresponding to the minimum number of participants required to recover the original key, the minimum number of participants is updated with the updated reputation value of each node, including: determining an average reputation value based on the updated reputation value of each node; determining a weighted reputation adjustment factor based on the weight and updated reputation value of each node, as well as the average reputation value; determining a load factor based on the current system load and the upper limit of the system load capacity; and updating the minimum number of participants based on the product of the default base value corresponding to the minimum number of participants, the weighted reputation adjustment factor, and the load factor.

[0081] Exemplarily, the updated reputation values ​​of the nodes are averaged to obtain an average reputation value.

[0082] Exemplarily, the weights of each node are summed, and the weights of each node and the updated reputation value and the average reputation value are weighted and summed. Then, the weighted reputation adjustment factor is determined based on the ratio between the previous sum value and the next sum value.

[0083] For example, the weighted reputation adjustment factor is calculated using the following formula: .

[0084] in, is the weight of node i, reflecting its importance in the consensus process. For example, the weight of the master node is larger, and the weight of the light node is smaller. It can be dynamically adjusted based on the node's role and historical contribution.

[0085] For example, if = ,but =0.9. This is the upper limit of the weighted reputation adjustment factor, which means that the reputation value of each node is high.

[0086] Exemplarily, the load factor is determined based on a ratio between the current system load and an upper limit of the system load capacity.

[0087] For example, the load factor is calculated using the following formula: .

[0088] in, represents the load factor, represents the adjustment factor, Indicates the current system load. Indicates the upper limit of system load capacity. The upper limit of system load capacity can be represented by Figure 2 Obtained from the blockchain listening module in .

[0089] If the system load is smaller, the load factor value is smaller; if the system load is too large, the load factor value is larger.

[0090] For example, the minimum number of participants is obtained by multiplying the product of the default base value corresponding to the minimum number of participants, the weighted reputation adjustment factor, and the load factor by an upward value. The minimum number of participants can be constrained to be less than or equal to the total number of nodes in the consortium chain and greater than 2.

[0091] For example, the minimum number of participants can be calculated using the following formula: .

[0092] in, The default base value, for example 0.5.

[0093] In this example, if all nodes participating in the Shamir algorithm are trustworthy, then =1, About 0.9; if the current system load responsible for coordinating the Shamir algorithm is far from reaching the maximum load capacity, then About 0.8, which ensures When all indicators are intact or nearly intact, their values ​​are ensured to decrease gradually to optimize performance and sharing speed. In the formula, After obtaining evidence upward, participate in min operation with N to ensure The maximum value is N but not more than N, and the max calculation is performed with 2 to ensure t The minimum value is 2.

[0094] like Figure 3 and Figure 4AAs shown, during the data storage process, to protect the randomly generated symmetric encryption from leakage and tampering, the random key and operations on the random key must be stored in the consortium chain. In this scheme, the random key is sharded using an improved Shamir algorithm and encrypted with a homomorphic attribute base by the encryption mechanism belonging to the consortium chain master node before being stored in each consortium chain node. This step also participates in the consensus of the consortium chain nodes. When the asymmetric encrypted random key is stored in the consortium chain, although the trustworthiness of the consortium chain participants is high, due to the small number of participants, the possibility of more than 51% of nodes cheating will affect the trustworthiness of the entire system. To ensure complete trustworthiness, the encryption key is sharded using an improved Shamir algorithm and stored in each blockchain node. Homomorphic encryption is used on the sharded random key, allowing each fragment to be synthesized into a single random key in an encrypted state when the master node calls a smart contract.

[0095] In order to find the master node, the data owner sends a transaction to OQU-Contract. DQU-Contract will execute the transaction after receiving it and return the addresses of n available master nodes to the data owner. In addition, the data owner is also responsible for creating and deploying OQU-Contract (accepting transactions) and DQU-Contract (executing transactions to find master nodes) on the blockchain. like Figure 3 and Figure 4A As shown in Figure 1, if a data user sends a download request to a cloud storage server, the cloud server verifies the data user's access rights by executing a smart contract by sending a transaction to the blockchain master node. Upon receiving a response from the blockchain, if the data user has access rights, the cloud platform will send the encrypted data to them.

[0096] like Figure 4A and Figure 4BAs shown, the information user obtains the corresponding key ID from the encryption organization (master node) and then sends a decryption key request to the master node (it doesn't matter if the master node is untrusted; it only has permission to call smart contracts and cannot see information such as key shards). The master node executes the corresponding smart contract to decrypt the key. The master node sends a transaction to DQU-Contract, which executes the transaction and finds the addresses of t master nodes that store key fragments with the same ID. After receiving the decryption key fragments (the key fragments with the same ID), the master node reconstructs the corresponding decryption key and uses a timestamp discriminator to determine whether the timestamps of all fragments are consistent. If they are consistent, the encrypted random key has been obtained. If not, the master node calls the smart contract faction and outputs the master node whose ID the inconsistent key fragment belongs to. Master nodes with extremely low reputation values ​​are deleted through the reputation-based DPOS consensus mechanism, and their permissions and corresponding public key decryption whitelist are removed (the encryption organization is a member of the consortium chain, and the cost of cheating is very high). The key fragments are then reassembled. Even if several fragments are missing, the improved Shamir algorithm can still recover the encrypted random key. (However, if there are too many problems, it cannot be recovered). After obtaining the encrypted random key, the information user applies for the corresponding public key from the relevant encryption agency for decryption to obtain the random key.

[0097] According to the disclosed embodiments, the system utilizes symmetric encryption and homomorphic attribute-based encryption technologies. Data is encrypted using randomly generated encryption keys and homomorphic attribute-based encryption is used to implement refined access control. The encrypted data is stored via a blockchain consensus mechanism, ensuring it cannot be tampered with or forged. Homomorphic attribute-based encryption ensures that only users who meet specific conditions can decrypt the data.

[0098] To address query efficiency issues, the system uses a Redis cache mechanism combined with an LRU (Least Recently Used) strategy. By caching frequently used data, data access speed is significantly improved by avoiding the need to load data from the cloud platform each time. The LRU strategy ensures that the data in the cache is recently accessed data and regularly clears infrequently used data to maximize cache space utilization. Dynamic adjustment of the LRU cache strategy and load balancing mechanism can automatically adjust cache capacity or allocate computing resources based on changes in access volume to meet varying load demands. Dynamic adjustment of the LRU cache strategy and load balancing mechanism can automatically adjust cache capacity or allocate computing resources based on changes in access volume to meet varying load demands.

[0099] To address key management issues, the system uses an improved Shamir secret sharing algorithm to divide the encryption key into multiple fragments and store them distributedly across different blockchain nodes. The threshold of the improved Shamir secret sharing algorithm can be dynamically adjusted based on the reputation of the consortium chain nodes. Only when a sufficient number of nodes provide key fragments can the original key be recovered. Each key fragment is stored on the blockchain using asymmetric encryption, and key fragment recovery relies on smart contracts for node verification and permission management. This ensures that even if a node is attacked or the key is reversed, it cannot be easily leaked. The improved Shamir algorithm ensures distributed storage and security of keys, preventing the risk of single-point leakage.

[0100] The system strictly manages data access through smart contracts. All key decryption requests, node behavior, and permission verification are automatically executed through smart contracts, without relying on a central authority. Masternodes participate in system decision-making and execution by executing smart contracts, ensuring system autonomy and transparency.

[0101] The system uses blockchain to store fingerprint information and smart contract verification mechanisms to ensure the consistency and integrity of data on the cloud platform. Users can verify the authenticity of data through blockchain and smart contracts.

[0102] Figure 5 This is a structural block diagram of a device for secure storage and access of electric carbon data based on a consortium chain according to an embodiment of the present invention.

[0103] like Figure 5 As shown, the electric carbon data security storage and access device based on the alliance chain may include: The key shard acquisition module 510 is configured to, in response to a data use request for the first encrypted electric carbon data, acquire each first encrypted key shard corresponding to the first encrypted electric carbon data from each node in the consortium chain; A reputation value updating module 520 is configured to update the reputation value of each node based on the synchronization of the timestamps of each of the first ciphertext key shards to obtain an updated reputation value of each node; A minimum number updating module 530 is configured to update the minimum number of parties required to recover the original key based on a default base value corresponding to the minimum number of parties required to recover the original key and the updated reputation value of each node; A key recovery module 540 is configured to perform key recovery on each of the first ciphertext key shards based on the updated minimum number of participants to obtain a first ciphertext key; a key decryption module 550, configured to decrypt the first ciphertext key to obtain a first plaintext key; The data decryption module 560 is configured to decrypt the first ciphertext electro-carbon data based on the first plaintext key to obtain first plaintext electro-carbon data.

[0104] In one embodiment, the above device further comprises: A data encryption module, configured to, in response to a data storage request for the second plaintext electro-carbon data, encrypt and store the second plaintext electro-carbon data based on a second plaintext key; a key sharding module, configured to shard the second plaintext key based on the minimum number of participants and the total number of nodes in the consortium chain to obtain a plurality of second plaintext key shards; a key encryption module, configured to encrypt each of the second plaintext key fragments to obtain a plurality of second ciphertext key fragments; The key shard storage module is used to distribute and store the multiple second ciphertext key shards to each node in the alliance chain.

[0105] In one embodiment, the reputation value updating module 520 includes: a mode determining unit, configured to determine a reference mode based on the timestamps of the respective first ciphertext key fragments; A reputation value increasing unit is used to increase the reputation value of the node corresponding to the third ciphertext key shard when the timestamp of the third ciphertext key shard in each of the first ciphertext key shards is different from the reference mode, so as to obtain an updated reputation value of the node corresponding to the three ciphertext key shards.

[0106] In one embodiment, the reputation value updating module 520 further includes: A reputation value reducing unit is used to reduce the reputation value of the node corresponding to the fourth ciphertext key shard when the timestamp of the fourth ciphertext key shard in each of the first ciphertext key shards is the same as the reference mode, so as to obtain an updated reputation value of the node corresponding to the four ciphertext key shards.

[0107] In one embodiment, the reputation value increasing unit is specifically configured to: Using a natural exponential function, calculate the negative number corresponding to the reputation value of the node corresponding to the third ciphertext key shard to obtain a first value; Based on the difference between 1 and the first value, an updated reputation value of the node corresponding to the three ciphertext key shards is determined.

[0108] In one embodiment, the reputation value reducing unit is specifically configured to: Determine a fourth value between a second value and a third value, wherein the second value is smaller than the third value, and both the second value and the third value are smaller than 1 and greater than zero; Based on the product of the fourth value and the reputation value of the node corresponding to the fourth ciphertext key shard, an updated reputation value of the node corresponding to the fourth ciphertext key shard is determined.

[0109] In one embodiment, the minimum quantity updating module 530 includes: an average calculation unit, configured to determine an average reputation value based on the updated reputation values ​​of the nodes; a first factor calculation unit, configured to determine a weighted reputation adjustment factor based on the weights and updated reputation values ​​of the respective nodes and the average reputation value; a second factor calculation unit, configured to determine a load factor based on a current system load and an upper limit of the system load capacity; A value updating unit is configured to update the minimum number of participants based on a default base value corresponding to the minimum number of participants, the product of the weighted reputation adjustment factor and the load factor.

[0110] For the description of specific functions and examples of each module and submodule of the system in the embodiment of the present invention, please refer to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0111] In the technical solution of the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0112] According to an embodiment of the present invention, the present invention further provides a system and a readable storage medium.

[0113] Figure 6 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0114] like Figure 6As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. Computing unit 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to bus 804.

[0115] Various components in device 800 are connected to I / O interface 805, including an input unit 806, such as a keyboard, mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, optical disk, etc.; and a communication unit 809, such as a network card, modem, wireless communication transceiver, etc. The communication unit 809 allows device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0116] The computing unit 801 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the method for secure storage and access of electric carbon data based on a consortium blockchain. For example, in some embodiments, the method for secure storage and access of electric carbon data based on a consortium blockchain can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the method for secure storage and access of electric carbon data based on a consortium blockchain described above can be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute the alliance chain-based electric carbon data secure storage and access method in any other appropriate manner (for example, by means of firmware).

[0117] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0118] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0119] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0121] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0122] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0123] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present invention can be achieved. This is not limited herein.

[0124] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for secure storage and access of electric carbon data based on alliance chain, characterized in that: include: In response to a data use request for the first encrypted electric carbon data, obtaining, from each node in the consortium chain, each first encrypted key shard corresponding to the first encrypted electric carbon data; Based on the synchronization status of the timestamps of the first ciphertext key shards, the reputation value of each node is updated to obtain an updated reputation value of each node; Updating the minimum number of parties based on a default base value corresponding to the minimum number of parties required to recover the original key and the updated reputation value of each of the nodes; Based on the updated minimum number of participants, performing key recovery on each of the first ciphertext key shards to obtain a first ciphertext key; Decrypting the first ciphertext key to obtain a first plaintext key; The first ciphertext electro-carbon data is decrypted based on the first plaintext key to obtain first plaintext electro-carbon data.

2. The method according to claim 1, characterized in that Also includes: In response to a data storage request for second plaintext electro-carbon data, encrypting and storing the second plaintext electro-carbon data based on a second plaintext key; Based on the minimum number of participants and the total number of nodes in the consortium chain, sharding the second plaintext key to obtain multiple second plaintext key shards; Encrypting each of the second plaintext key fragments to obtain multiple second ciphertext key fragments; The multiple second ciphertext key fragments are distributed and stored in each node in the alliance chain.

3. The method according to claim 1, characterized in that The updating of the reputation value of each node based on the synchronization of the timestamps of each of the first ciphertext key shards to obtain the updated reputation value of each node includes: Determining a reference mode based on the timestamps of each of the first ciphertext key shards; When the timestamp of the third ciphertext key shard in each of the first ciphertext key shards is different from the reference mode, the reputation value of the node corresponding to the third ciphertext key shard is increased to obtain an updated reputation value of the node corresponding to the three ciphertext key shards.

4. The method according to claim 3, characterized in that Also includes: When the timestamp of the fourth ciphertext key shard in each of the first ciphertext key shards is the same as the reference mode, the reputation value of the node corresponding to the fourth ciphertext key shard is reduced to obtain an updated reputation value of the node corresponding to the four ciphertext key shards.

5. The method according to claim 4, characterized in that Increasing the reputation value of the node corresponding to the third ciphertext key shard includes: Using a natural exponential function, calculate the negative number corresponding to the reputation value of the node corresponding to the third ciphertext key shard to obtain a first value; Based on the difference between 1 and the first value, an updated reputation value of the node corresponding to the three ciphertext key shards is determined.

6. The method according to claim 4, characterized in that The reducing the reputation value of the node corresponding to the fourth ciphertext key shard includes: Determine a fourth value between a second value and a third value, wherein the second value is smaller than the third value, and both the second value and the third value are smaller than 1 and greater than zero; Based on the product of the fourth value and the reputation value of the node corresponding to the fourth ciphertext key shard, an updated reputation value of the node corresponding to the fourth ciphertext key shard is determined.

7. The method according to claim 1, characterized in that The updating of the minimum number of participants based on a default base value corresponding to the minimum number of participants required to recover the original key and using the updated reputation value of each node includes: Determining an average reputation value based on the updated reputation values ​​of each of the nodes; Determining a weighted reputation adjustment factor based on the weights and updated reputation values ​​of the respective nodes and the average reputation value; Determine the load factor based on the current system load and the upper limit of the system load capacity; The minimum number of participants is updated based on a default base value corresponding to the minimum number of participants, the product of the weighted reputation adjustment factor and the load factor.

8. A device for secure storage and access of electric carbon data based on alliance chain, characterized in that: include: A key shard acquisition module, configured to, in response to a data use request for the first encrypted electric carbon data, acquire each first encrypted key shard corresponding to the first encrypted electric carbon data from each node in the consortium chain; a reputation value updating module, configured to update the reputation value of each of the nodes based on the synchronization of the timestamps of each of the first ciphertext key shards, to obtain an updated reputation value of each of the nodes; a minimum number updating module, configured to update the minimum number of parties required to recover the original key based on a default base value corresponding to the minimum number of parties required to recover the original key and the updated reputation value of each node; a key recovery module, configured to perform key recovery on each of the first ciphertext key shards based on the updated minimum number of participants to obtain a first ciphertext key; a key decryption module, configured to decrypt the first ciphertext key to obtain a first plaintext key; The data decryption module is used to decrypt the first ciphertext electro-carbon data based on the first plaintext key to obtain the first plaintext electro-carbon data.

9. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images