Data electronic fence processing system and method based on attribute encryption and block chain

Abstract

The invention relates to a data electronic fence method and system based on attribute encryption and a block chain. Comprising the following steps: designing a multi-authorization-based key generation method, and solving the problems of key escrow and single-point fault existing in a single authorization center; an efficient attribute revocation mechanism based on the smart contract is constructed, a hash value of an attribute key of the latest version of a data user is used as a pass, the access decision contract completes automatic verification of identity and access authority, and user attribute revocation can be realized only by updating the attribute key; a strategy updating mechanism which is low in calculation cost and combined with the block chain technology is built, when a service requires to update an access strategy, the symmetric key is re-encrypted according to the symmetric key index stored on the chain and a new access strategy, and the access permission is judged in combination with an access decision contract; and the block chain technology is combined to realize data sharing full-process credible evidence storage such as data resource release, data request access, data transmission, data acquisition, attribute revocation and strategy update.

Description

Technical Field

[0001] This invention relates to the field of data security, specifically to a data electronic fence processing system and method based on attribute encryption and blockchain. Background Technology

[0002] Currently, compared to Ciphertext-Policy Attribute-Based Encryption (CP-ABE), traditional access control models such as Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) still suffer from insufficient fine-grained control, isolation between encryption and access control, and limitations in dynamic policy adjustment. CP-ABE embeds the access policy into the ciphertext and the set of data user attributes into the key. Decryption and data retrieval can only be completed when the set of data user attributes satisfies the access policy, enabling fine-grained access control. CP-ABE is suitable for scenarios such as cloud storage and cross-institutional data sharing, and is naturally compatible with decentralized technologies. Blockchain technology possesses characteristics such as decentralization, data tamper resistance, and traceability. To achieve trusted data storage and secure sharing, data protection methods combining CP-ABE and blockchain technologies have been proposed.

[0003] Patent application CN202411462187.7 discloses a method and system for access control of user carbon emission data based on spatiotemporal attribute encryption. It employs an access strategy based on spatiotemporal attributes to encrypt data; decryption is only possible when the user attributes match the access strategy in the ciphertext, ensuring data security. However, it lacks consideration for multi-authorization, attribute revocation, and policy update functions, hindering its practical application to some extent. Patent application CN202411290837.4 discloses an access control method based on ciphertext policy attribute encryption on a blockchain, but it also lacks consideration for multi-authorization, attribute revocation, and policy update functions. Patent application CN202411553622.7 discloses a blockchain-based secure sharing method for intelligent video surveillance data storage in steel plants. It re-encrypts data using a hybrid proxy encryption algorithm based on ciphertext policies and includes attribute revocation functionality. It combines blockchain technology to enhance system security and robustness; however, it lacks consideration for multi-authorization mechanisms and does not address the key escrow issue.

[0004] Patent application CN202410047433.6 discloses a data access control system based on revocable attribute encryption. It achieves revocable attribute encryption by having an authorization center and an attribute center jointly determine the system version key and user attribute key. However, this system lacks a policy update mechanism, its flexibility needs improvement, and it cannot achieve full traceability of data sharing. Patent application CN202410626472.1 discloses an efficient, multi-functional access control method and system based on attribute encryption. This method distributes the computational burden of key construction to multiple authorization centers, solving the key custody problem. It also introduces version keys to achieve attribute revocation and provides a policy update mechanism to adapt to different scenarios and needs. However, this solution cannot provide decentralized trusted evidence storage and auditing capabilities, and its attribute revocation requires updating the encrypted data. Patent application CN202311551250.X discloses an access control method based on blockchain and CP-ABE. It achieves synchronous updates of attribute keys, data symmetric encryption keys, and data ciphertext based on proxy re-encryption, further enabling permission updates, but it does not solve the key custody problem.

[0005] As can be seen from the above, how to achieve a data protection method based on CP-ABE and blockchain that simultaneously possesses multiple authorization, attribute revocation, and policy update mechanisms is a problem to be solved in this field. At the same time, the attribute revocation and policy update mechanisms also need to meet the characteristics of low computational cost. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art, draw on the concept of electronic fences, and propose a data electronic fence processing system and method based on attribute encryption and blockchain. It designs a key generation method for multiple authorized data users, constructs an efficient attribute revocation mechanism based on smart contracts, builds a low-computation-cost policy update mechanism combined with blockchain technology, and finally realizes full-process evidence storage for data sharing and circulation through blockchain technology for data sharing auditing, thereby ensuring the trustworthy sharing and circulation of data.

[0007] The main feature of this data electronic fence processing system based on attribute encryption and blockchain is that the system includes: The data owner (DO) encrypts the data using the SM4 algorithm based on the encryption machine, protects the symmetric key through CP-ABE, uploads the ciphertext to IPFS storage, and uploads the data information to the blockchain.

[0008] Data user DU obtains a version key jointly generated by the centrally authorized CA and the attribute authorized AA. The version key contains a timestamp attribute. Data user DU can only decrypt and obtain data when the version key is the latest and the attribute set meets the access policy. The centrally authorized CA participates in system initialization, generates a global key for data users (DU), provides attribute key generation secret parameters for attribute authorization (AA), and uploads attribute information to the blockchain; Attribute authorization (AA) participates in system initialization and generates attribute keys for the data user (DU). Blockchain, through smart contracts, enables the on-chain storage, querying and updating of attribute and data information, automates the execution of access decision-making contracts, and realizes the evidence storage and auditing of the entire data sharing process; IPFS is used to store encrypted data; The encryption device locally uses the SM4 algorithm to encrypt data and provides SM4 symmetric key index bits.

[0009] Specifically, the data information includes the data owner ID. Symmetric key ciphertext ciphertext address Access policies Data ID Public key and encryption key index .

[0010] Specifically, the attribute information includes the data user ID. and the hash value of the attribute key .

[0011] The main feature of this data electronic fence processing method and system based on attribute encryption and blockchain is that the method includes the following steps: S1, System initialization; S2, Identity registration; S3, Data encryption; S4, Access decision and decryption; S5, Attribute revocation based on smart contracts; S6, Low-cost strategy update.

[0012] Specifically, step S1 includes the following steps: S11, Central Authorized CA Initialization, Central Authorized CA Execution Generate public key With master key .

[0013] S12, Attribute Authorization AA Initialization, Attribute Authorization AA Execution Generate master key .

[0014] S13, Blockchain Initialization, deploys smart contracts on the blockchain network. The smart contracts include attribute upload contract, data upload contract, attribute query contract, data query contract, access decision judgment contract, attribute revocation contract, and strategy update contract.

[0015] S14, Data owner DO initialization, data owner DO obtains a unique identity ID. and obtain the public key. .

[0016] Specifically, step S2 includes the following steps: S21, Data user DU provides information, and the centrally authorized CA generates a unique identity ID for the data user DU. Centrally authorized CA execution Enter the master key Generate a global key and .

[0017] S22, Attribute Authorization AA generates attribute keys for Data User DU, and multiple Attribute Authorization AAs execute respectively according to the distribution of the attribute set of Data User DU. The data user DU attribute set includes a fixed timestamp attribute field, which is used to determine whether it is the latest version key in order to make access permission decisions.

[0018] S23, Attribute Authorization AA calculates the attribute key hash value. Attribute Authorization AA calculates and obtains the attribute key hash value. This is to determine whether the attribute key has been tampered with and whether the data user DU has the necessary access rights.

[0019] S24, Data user DU combines to form a complete key. .

[0020] S25, the centrally authorized CA uploads attribute information to the blockchain, and the centrally authorized CA transmits the data user ID through the attribute upload contract. The hash value of the attribute key is uploaded to the blockchain.

[0021] Specifically, step S3 includes the following steps: S31, Data owner DO encrypts data, and data owner DO randomly selects an encryption key for storage index. The data is encrypted using the SM4 algorithm in the encryption machine.

[0022] S32, Data owner DO uploads encrypted text After the data owner (DO) uploads the encrypted data to IPFS, the storage address is returned. .

[0023] S33, CP-ABE encryption symmetric key. The data owner (DO) defines the access policy. ,implement Output symmetric key ciphertext .

[0024] S34, Data Owner DO uploads data to the blockchain. Data Owner DO uses the data upload contract to transfer the data owner ID. Symmetric key ciphertext ciphertext address Access policies Data ID Public key and encryption key index Uploaded to the blockchain.

[0025] Specifically, step S4 includes the following steps: S41, Data user DU requests access to data. Data user DU sends a request to the central authorized CA containing ID, data ID, public key and attribute key.

[0026] S42, Data User (DU) Access Permission Judgment and Decision: The Central Authorized CA uses SM3 to calculate and obtain the hash value of the attribute key. Then, the attribute query contract is called to obtain the latest attribute key hash value. Continue to call the access decision judgment contract to determine... and If the data user DU is consistent with the data user DU, then the data user DU's access request is terminated. If the data user DU is inconsistent with the data user DU, then the data user DU's access request is terminated.

[0027] S43, Data user DU queries to obtain decryption parameters. Once data user DU has access permissions, it calls the data query contract to obtain the encrypted storage address in IPFS. Public key and symmetric key ciphertext .

[0028] S44, Data user DU decrypts and obtains data, Data user DU executes. Output symmetric key Then, the data user DU uses the SM4 algorithm to decrypt the ciphertext data and obtain the plaintext data. .

[0029] Specifically, step S5 includes the following steps: S51, Attribute Authorization AA generates the latest attribute key for Data User DU, and multiple Attribute Authorization AAs execute. Generate the latest attribute key The process involves updating the timestamp attribute field, and then authorizing the AA for each attribute to execute the SM3 algorithm to calculate the hash value of the latest attribute key. All data is aggregated by a centrally authorized CA. And obtain the complete attribute key hash value .

[0030] S52, Data user DU combines to form a key .

[0031] S53, the centrally authorized CA calls the attribute to revoke the contract, and modifies the hash value of the data user DU attribute key to... .

[0032] Specifically, step S6 includes the following steps: S61, the data owner DO re-encrypts the symmetric key, and the data owner DO calls the data query contract to obtain the ciphertext of the symmetric key. and encryption key index According to the updated access policy And obtain the symmetric key inside the encryption machine based on the encryption key index, and execute... Output the updated symmetric key ciphertext. .

[0033] S62, the data owner (DO) calls the data to modify the contract, changing the access policy. Modified to Symmetric key ciphertext Modified to Data ID Modified to .

[0034] The data electronic fence method and system based on attribute encryption and blockchain of the present invention have the following significant advantages: (1) Design a key generation method for data users based on multiple authorizations to alleviate the computational pressure of key generation in a single authorization center and solve the key custody and single point of failure problems in a single authorization center; (2) Construct an efficient attribute revocation mechanism based on smart contracts, using the hash value of the latest version of the attribute key of DU as the DU's pass, and the access decision contract to complete the automated verification of DU identity and access rights. Compared with existing patents, this mechanism does not require updating the ciphertext or updating the DU key. It only needs to update the attribute key to realize the user attribute revocation, further reducing the cost of attribute revocation. (3) Construct a low-computation-cost strategy update mechanism combined with blockchain technology. DO completes data encryption through an encryption machine and encrypts the symmetric key through CP-ABE. When the business needs to update the access strategy, it only needs to re-encrypt the symmetric key according to the symmetric key index stored on the chain and the new access strategy. Combined with the access decision contract to judge the DU identity, the ciphertext can only be decrypted and obtained when the key is the latest version and the attribute set meets the access strategy. (4) Combine blockchain technology to realize the trusted evidence storage of the entire process of data sharing, including data resource release, data request access, data transmission, data acquisition, attribute revocation, and strategy update. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the data electronic fence processing system based on attribute encryption and blockchain of the present invention.

[0036] Figure 2 This is a flowchart of the data electronic fence processing method based on attribute encryption and blockchain according to the present invention. Detailed Implementation

[0037] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings. The following examples or drawings are used to illustrate the present invention, but do not limit the scope of the invention.

[0038] To achieve a data protection method based on CP-ABE and blockchain that simultaneously possesses multiple authorizations, efficient attribute revocation, and low-cost policy update mechanisms, this application discloses a data electronic fence processing system and method based on attribute encryption and blockchain.

[0039] Please refer to Figure 1 The diagram shows the structure of the data electronic fence processing system based on attribute encryption and blockchain according to the present invention. The data owner (DO) is responsible for encrypting the data and using a symmetric key, uploading the encrypted data to IPFS, and uploading the data information to the blockchain. The data user (DU) receives a key jointly generated by the central authorized CA and the attribute authorized AA. Data can only be decrypted and retrieved if the key is the latest version and the attribute set meets the access policy. The central authorized CA is responsible for system initialization, generating a global key for the data user (DU), and providing secret parameters for key generation to the attribute authorized AA. The attribute authorized AA is responsible for initialization and generating attribute keys for the data user (DU). The blockchain mainly uses smart contracts to realize the uploading, querying, and updating of attribute information and data information, and automatically executes access decisions. IPFS stores the encrypted data. The encryption machine is mainly used to encrypt the data.

[0040] Please see Figure 2 The diagram illustrates the blockchain-based data electronic fence processing method of the present invention, which includes the following steps: S1, system initialization; S2, identity registration; S3, data encryption; S4, access decision and decryption; S5, attribute revocation based on smart contracts; and S6, low-cost strategy update. Each step will be described in detail below.

[0041] Specifically, S1, system initialization.

[0042] S11, Central Authorized CA Initialization, Central Authorized CA Execution Randomly select parameters As a security parameter of the system, it is used to generate public key components. and ; A randomly selected exponent is used to calculate the public key component. and ; The index is randomly selected; It is a random number; For the group Generator, For the group Generator, For a bilinear mapping, perform the following calculations: ; ; S12, Attribute Center AA initialization, Attribute Center AA execution. Master key .

[0043] S13, Blockchain Initialization, deploys smart contracts on the blockchain network. The smart contracts include attribute upload contract, data upload contract, attribute query contract, data query contract, access decision judgment contract, attribute modification contract, and strategy update contract.

[0044] S14, Data owner DO initialization, data owner DO obtains a unique identity ID. and obtain the public key. .

[0045] Specifically, S2 is identity registration.

[0046] S21, Data user DU provides information, and the centrally authorized CA generates a unique identity ID for the data user DU. Centrally authorized CA execution Enter the master key Random selection Used for blinding keys. Generate global key parameters and ,in, Bilinear mapping calculations used in the decryption process. Used to compensate for secret sharing For the group Generator, For the group Generator, Master key parameters A hash function maps strings to groups. Perform the following calculations: ; ; ; S22, Attribute Authorization AA generates attribute keys for Data User DU, and multiple Attribute Authorization AAs execute respectively according to the distribution of the attribute set of Data User DU. The master key The centrally authorized CA will generate random numbers. , and random numbers for the target attribute of Securely share the parameters with each attribute-authorized account (AA). The attribute-authorized AA uses these parameters to calculate the attribute key portion. Map strings to groups, for attributes ,parameter Perform the following calculations: ; Specifically, the DU attribute set includes a fixed timestamp attribute field. This is used to determine whether it is the latest version of the key, in order to make access permission decisions.

[0047] S23, Attribute Authorization AA calculates the attribute key hash value, Attribute Authorization AA calculates and obtains the attribute key. hash value This is to determine whether the attribute key has been tampered with and whether the data user DU has the necessary access rights.

[0048] S24, Data user DU combines to form a complete key. , Generated by a centrally authorized CA , and attribute keys generated by AA for all attribute authorizations Combining, that is .

[0049] S25, the centrally authorized CA uploads attribute information to the blockchain. The centrally authorized CA uploads the hash value of the data user ID and attribute key through the attribute upload contract. Uploaded to the blockchain.

[0050] Specifically, S3 stands for data encryption.

[0051] S31, Data owner DO encrypts data, and data owner DO randomly selects an encryption key for storage index. Data is encrypted using the SM4 algorithm in the encryption machine to obtain the ciphertext. .

[0052] S32, Data owner DO uploads encrypted text After the data owner (DO) uploads the encrypted data to IPFS, the storage address is returned. .

[0053] S33, CP-ABE encryption symmetric key. The data owner (DO) defines the access policy. ,implement ,for ,in It is the access strategy, represented as an LSSS matrix. , , ,index , To make the matrix the The function that maps rows to an attribute in the access policy is calculated as follows: ; ; ; So .

[0054] S34, Data Owner DO uploads data to the blockchain. Data Owner DO uses the data upload contract to transfer the data owner ID. Symmetric key ciphertext ciphertext address Access policies Data ID Public key and encryption key index Uploaded to the blockchain.

[0055] Specifically, S4, access decision and decryption.

[0056] S41, Data user DU requests access to data. Data user DU sends a request to the central authorized CA containing ID, data ID, public key and attribute key.

[0057] S42, Data User (DU) Access Permission Judgment and Decision: The Central Authorized CA uses SM3 to calculate and obtain the hash value of the attribute key. Then, the attribute query contract is called to obtain the latest attribute key hash value. Continue to call the access decision judgment contract to determine... and If they match, the user (DU) is considered to have access rights; otherwise, the user's access request to the user (DU) is terminated.

[0058] The access decision-making contract algorithm can be described as follows: ; S43, Data user DU queries to obtain decryption parameters. Once data user DU has access permissions, it calls the data query contract to obtain the encrypted storage address in IPFS. Public key and symmetric key ciphertext .

[0059] S44, Data user DU decrypts and obtains data, Data user DU executes. The calculation is as follows: ; ; So Then, the data user DU uses the SM4 algorithm to decrypt the ciphertext data and obtain the plaintext data. .

[0060] Specifically, in S5, attribute revocation based on smart contracts only requires updating the hash value of the attribute key. The computation time for one attribute revocation depends primarily on the number of attributes of the data user DU. This includes generating new attribute keys. Subgroup operation and one SM3 hash calculation, in typical scenarios ( The computation time can be controlled in the millisecond range. For example, for attribute revocation based on ciphertext updates, the computational cost is reduced from... Reduce to (F represents the file size).

[0061] S51, Attribute Authorization AA generates the latest attribute key for Data User DU, and multiple Attribute Authorization AAs execute. Generate the latest attribute key The update timestamp attribute field is Then, for each attribute, the authorized AA executes the SM3 algorithm to calculate the hash value of the latest attribute key. All data is aggregated by a centrally authorized CA. And obtain the complete attribute key hash value ,for The calculation is as follows.

[0062] ; S52, Data user DU combines to form a key .

[0063] S53, the centrally authorized CA invokes the attribute to revoke the contract and modifies the data user DU attribute key to... .

[0064] Specifically, S6, a low-cost strategy update.

[0065] Compared to traditional policy update schemes, this scheme only re-encrypts the symmetric key ciphertext. Rather than the entire encrypted data This achieves orders-of-magnitude optimization in terms of computational overhead and network communication. Traditional solutions require re-encrypting and uploading the entire data file, with computational and communication costs proportional to the file size. Proportional, that is This solution only requires the use of a new access policy. Re-encrypting a fixed-length symmetric key (e.g., 128 bits) and updating the corresponding record on the blockchain, with both computational and communication overhead at the constant level. .

[0066] S61, the data owner DO re-encrypts the symmetric key, and the data owner DO calls the data query contract to obtain the ciphertext of the symmetric key. and encryption key index According to the updated access policy And obtain the symmetric key inside the encryption machine based on the encryption key index, and execute... Output the updated symmetric key ciphertext. ,for LSSS matrix , , , The calculation process is as follows: ; ; ; So .

[0067] S62, the data owner (DO) calls the data to modify the contract, changing the access policy. Modified to Symmetric key ciphertext Modified to Data ID Modified to .

[0068] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0069] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0070] The above description is merely an example and illustration of the concept of the present invention and is not intended to limit the present invention. Those skilled in the art can make various modifications or additions to the specific examples described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in the claims, all of which should fall within the protection scope of the present invention.

Claims

1. A data electronic fence processing system based on attribute encryption and blockchain, characterized in that, The system includes: The data owner (DO) encrypts the data using the SM4 algorithm based on the encryption machine, protects the symmetric key through CP-ABE, uploads the ciphertext to IPFS storage, and uploads the data information to the blockchain. Data user DU obtains a version key jointly generated by the centrally authorized CA and the attribute authorized AA. The version key contains a timestamp attribute. Data user DU can only decrypt and obtain data when the version key is the latest and the attribute set meets the access policy. The centrally authorized CA participates in system initialization, generates a global key for data users (DU), provides attribute key generation secret parameters for attribute authorization (AA), and uploads attribute information to the blockchain; Attribute authorization (AA) participates in system initialization and generates attribute keys for the data user (DU). Blockchain, through smart contracts, enables the on-chain storage, querying and updating of attribute and data information, automates the execution of access decision-making contracts, and realizes the evidence storage and auditing of the entire data sharing process; IPFS is used to store encrypted data; The encryption device locally uses the SM4 algorithm to encrypt data and provides SM4 symmetric key index bits.

2. The data electronic fence processing system based on attribute encryption and blockchain according to claim 1, characterized in that, The data information includes the data owner ID. Symmetric key ciphertext ciphertext address Access policies Data ID Public key and encryption key index .

3. The data electronic fence processing system based on attribute encryption and blockchain according to claim 1, characterized in that, The attribute information includes the data user ID. and the hash value of the attribute key .

4. A method for processing data electronic fences based on attribute encryption and blockchain using the system described in any one of claims 1 to 3, characterized in that, The method includes the following steps: (1) System initialization: The central authorized CA, attribute authorized AA, blockchain and data owner DO are all initialized; (2) Identity registration: Multiple authorization centers work together to generate the version key and identity ID of the data user DU, and upload the attribute information to the blockchain through the central authorized CA; (3) Data encryption: The data owner DO generates encrypted data based on a combination of encryption machine and CP-ABE; (4) Access decision judgment and decryption: The system combines the version key access decision contract and automatically judges the access permissions, and the data user DU performs the decryption process; (5) Attribute revocation: Attribute revocation based on smart contracts is achieved by updating the hash value of the attribute key; (6) Policy update: Data owner DO achieves low-cost policy update by re-encrypting symmetric key ciphertext and combining it with blockchain.

5. The data electronic fence processing method based on attribute encryption and blockchain according to claim 4, characterized in that, Step (1) specifically includes: Centrally authorized CA initialization, execution Generate public key With master key ; Attribute authorization AA initialization, execution Generate master key ; Blockchain initialization involves deploying smart contracts to the blockchain. Data user DO initialization, obtain a unique identity ID With public key .

6. The data electronic fence processing method based on attribute encryption and blockchain according to claim 5, characterized in that, The smart contracts include attribute upload contract, data upload contract, attribute query contract, data query contract, access decision judgment contract, attribute cancellation contract, and strategy update contract.

7. The data electronic fence processing method based on attribute encryption and blockchain according to claim 4, characterized in that, Step (2) specifically includes the following steps: (2.1) Data user DU provides identity information, and the centrally authorized CA generates a unique identity ID. ,implement Generate a global key and and ; (2.2) Attribute authorization AA performs the following actions based on the attribute set of the data user DU: Generate attribute keys for the data user DU. And add a fixed timestamp attribute field; (2.3) Attribute Authorization AA calculates and obtains the hash value of the attribute key. Data user DU uses this information to form a complete key. The attribute information is uploaded to the blockchain by a centrally authorized CA.

8. The data electronic fence processing method based on attribute encryption and blockchain according to claim 4, characterized in that, Step (3) specifically includes: Data user DU randomly selects the symmetric key index of the SM4 algorithm within the local encryption machine. The data is encrypted using the SM4 algorithm; the data owner (DO) uploads the encrypted data to IPFS to obtain a storage address. The data user DU formulates access policies. ,implement Output symmetric key ciphertext The data information is uploaded to the blockchain by the data user DU.

9. The data electronic fence processing method based on attribute encryption and blockchain according to claim 4, characterized in that, Step (4) specifically includes the following steps: (4.1) Data user DU requests access to data and performs access permission judgment and decision-making; (4.2) The centrally authorized CA uses the SM3 algorithm to calculate the attribute key hash value of the data user DU. And call the attribute query contract to obtain the latest attribute key hash value. Continue to call the access decision judgment contract to determine... and If they match, the data user DU is considered to have access rights; otherwise, the data user DU's access request is terminated. (4.3) Data user DU calls the data query contract to obtain the encrypted storage address in IPFS. Public key and symmetric key ciphertext ; (4.4) Data user DU decrypts and obtains data, and executes... Output symmetric key The ciphertext data was decrypted using the SM4 algorithm to obtain the plaintext data. .

10. The data electronic fence processing method based on attribute encryption and blockchain according to claim 4, characterized in that, Step (5) specifically includes: Attribute Authorization (AA) generates the latest attribute key for Data User (DU), and multiple Attribute Authorization (AA) operations are performed. Generate the latest attribute key The update timestamp attribute field is performed, and for each attribute authorization, the SM3 algorithm is executed to calculate the hash value of the latest attribute key. All data is aggregated by a centrally authorized CA. And obtain the complete attribute key hash value ; Data user DU combines to form a key The centrally authorized CA invokes the attribute to revoke the contract, modifying the attribute key hash value of the data user DU to... .

11. The data electronic fence processing method based on attribute encryption and blockchain according to claim 10, characterized in that, Step (5) based on the attribute revocation of the smart contract only requires updating the hash value of the attribute key. The calculation time for one attribute revocation depends on the number of attributes of the data user DU. This includes generating new attribute keys. Secondary group operation and one SM3 hash calculation.

12. The data electronic fence processing method based on attribute encryption and blockchain according to claim 4, characterized in that, Step (6) specifically includes: The data owner (DO) re-encrypts the symmetric key and calls the data query contract to retrieve the ciphertext of the symmetric key. and encryption key index According to the updated access policy With the encryption key index, execute This will output the updated symmetric key ciphertext. ; The data owner (DO) calls the data to modify the contract, changing the access policy. Modified to Symmetric key ciphertext Modified to Data ID Modified to .

Images