An efficient access method and system for multi-level blockchain government data

Abstract

The present invention discloses an efficient access method and system for multi-level blockchain government data, which belongs to the field of data security sharing technology. The method is implemented by an access system controlled by multiple nodes, and the access system includes: a technical service platform that creates a hierarchical structure to initialize the system and set attribute sets, a government department node that performs double-layer encryption on the data, and an alliance member node that requests access to the data; the method is based on blockchain and attribute encryption technology, which can ensure that government department nodes at different levels perform efficient data chain storage and secure access operations, and at the same time keep relevant data operation records on the blockchain. Based on the distributed trust characteristics of blockchain technology, the timeliness, immutability and traceability of government data are achieved. Attribute encryption technology uses attribute sets to describe user identities and uses decryption strategies to define access rights, thereby achieving fine-grained access to government data and meeting multi-level data access requirements.

Description

Technical Field

[0001] The present invention relates to the field of data security sharing technology, and in particular to an efficient access method and system for multi-level blockchain government data. Background Art

[0002] With the development of society and the increase in government business, government departments with different powers and responsibilities have been created. However, many other problems have also been exposed, such as the storage, management and privacy security issues of a large amount of information and data, the mismatch between the management and services of government departments, and the mismatch between responsibilities and data. At the same time, in the data access process of traditional government systems, there are also three difficulties: (1) Incomplete directory coverage and update problems. As an important tool for data overall management, the directory lacks timely dynamic updates and a closed-loop management system. Different units attach different importance to directory sorting work, and the quality of directory sorting is uneven. On the municipal big data management platform, there are problems such as incomplete directory coverage, dead directories, and fake directories. It is difficult to support the "order-by-order" type of fast data supply and demand docking, resulting in high communication costs for data sharing docking between departments and levels. (2) Directory and data connection problems. At present, the directory system is not sufficiently related to the data itself, resulting in the common situation of having directories but no data on the municipal big data management platform, making it impossible to implement the docking of application department needs. (3) Imperfect data use, management and access mechanisms. Imperfect data classification and grading management, and inadequate supporting mechanisms and standards have led to conflicts and contradictions between departmental or industry management systems and the city's big data management system. Data providers have arbitrarily changed sharing permissions, interrupted or stopped data updates and services, and there is a lack of historical data in sharing and no guarantee of data quality. Summary of the Invention

[0003] The present invention provides a method and system for efficiently accessing multi-level blockchain government data. The technical solution is as follows:

[0004] On the one hand, an efficient access method for multi-level blockchain government data is provided. The method is implemented by an access system controlled by multiple nodes. The access system includes: a technical service platform that creates a hierarchical structure, government department nodes with data encryption authority, and alliance member nodes that request access to the data. The method includes the following steps:

[0005] S1: The technical service platform initializes the system and creates the system public parameters PK and the global public key MK;

[0006] S2: The government department node encrypts the data using the SM4 algorithm and the SM4 key. It then performs attribute encryption on the SM4 key using the PK and attribute password to obtain the key ciphertext CT.

[0007] S3: The government department node uploads the index generated by the key ciphertext CT and related public content to the multi-level directory blockchain to complete the chain locking;

[0008] S4: The government department node generates the corresponding level of decryption private key SK using the global public key MK and the attribute set that meets the access requirements;

[0009] S5: The alliance member node submits a data access request to the government department node. When the attribute set is met, the key ciphertext CT is decrypted by the decryption private key SK to obtain the national secret SM4 key; the national secret SM4 encrypted data is decrypted by the obtained national secret SM4 key to obtain the data plaintext and complete the access.

[0010] Furthermore, in step S1, the multi-level regional chain is divided through the technical service platform, and the division rules include:

[0011] The technical service platform divides the hierarchical structure of the multi-level directory blockchain system according to the administrative hierarchy; creates government blockchains for different government levels; and connects government blockchains at different levels to the same core blockchain through cross-chain technology.

[0012] The technical service platform divides the rights and responsibilities of each government department node on the same government blockchain according to the level of rights and responsibilities;

[0013] The technical service platform registers new department nodes in the government blockchain through the Register function, completing the definition of relevant role nodes in the government blockchain.

[0014] Furthermore, the method for generating the system public parameter PK and the global public key MK in step S1 includes:

[0015] S11: Determine the bilinear mapping function and multiplication cycle group used;

[0016] S12: Through the above functions and multiplication loop group, the technical service platform creates a set of attributes that each government department node is allowed to access;

[0017] S13: Use λ, U, T, and I as input values ​​of the function Setup(λ, U, T, I) to generate the output result:

[0018] PK=(G1,g,g b , e(g,g) a );MK=(b,g a );

[0019] Where PK is the system public parameter, MK is the global public key, λ is the security parameter, U is the number of attributes in the system, T is the depth of the time tree, and I is the identity set;

[0020] G1 is a multiplicative cyclic group of order p, g is the generator of G1, a and b are finite fields Z p Any two numbers in e(g,g) a Represents a bilinear map operation.

[0021] Furthermore, the national secret SM4 key is attribute encrypted through the attribute password to obtain the key ciphertext CT, including:

[0022] S21: The encryption function for the attribute password is: Encrypt(PK,M,T c ,R,A=(N,ρ));

[0023] S22: The government department node uses the national secret SM4 key as the encrypted text M, and encrypts the national secret SM4 key using PK and the attribute password of this level;

[0024] S23: Output key ciphertext CT;

[0025] Among them, the input in the function: A is the access structure, T cw is the decryptable time period, R is the revocable set;

[0026] The access structure A is built on the global attribute set, covering all attributes that are allowed to be accessed;

[0027] Where N is a l×n shared generator matrix, ρ is a function that defines the attribute labels i=1,…,l that meet the access requirements as ρ(i);

[0028] The encryption algorithm of the key ciphertext CT is:

[0029] C0=M·e(g,g) asμ

[0030] C0′=g sμ

[0031]

[0032]

[0033]

[0034] CT={C0,C′0,C″0,C i,j ,C′ i,j}

[0035] Among them, C is the ciphertext, s is the encryption index, and V is a random vector selected in the encryption algorithm. Used to share the encryption exponent s, where λ i =V·Ni , where i=1,...,l, vector N i corresponds to the i-th row of N; the algorithm also randomly selects μ1,...,μ r ∈Z p , so that μ=μ1+μ2+…+μ r ; According to the above encryption algorithm, the key ciphertext CT is finally obtained.

[0036] Furthermore, the government department node uploads the index generated by the key ciphertext CT and related public content to the multi-level directory blockchain to complete the chain locking, including:

[0037] S31: The government department node stores the data ciphertext, key ciphertext CT and decryption strategy in the data storage center respectively;

[0038] S32: The government department node uploads the index address, data check value, and decryption strategy generated by the data ciphertext to the government blockchain using SetEvidenceStr(id, data, chain);

[0039] Among them, id represents the identity of the technical service platform for the on-chain data; data is the on-chain data; and chain is the node of each government department that stores the data.

[0040] Furthermore, the government department node generates the corresponding level of decryption private key SK through the global public key MK and the attribute set that meets the access requirements, including:

[0041] S41: When a government department node is registered on the chain, the technical service platform will distribute a unique government department node ID, a list of attribute sets of the government department node, and a global public key MK of the government department node;

[0042] S42: Generate a decryption private key SK using the global public key MK through the function KeyGen(MK, ID, S, T);

[0043] Where ID is the global identity of the government department node on the chain; S is the accessible user attribute set; T is the validity period of the user key;

[0044] The algorithm is as follows:

[0045]

[0046]

[0047]

[0048] {K x =(g b·ID h x )-t} x∈S

[0049] get,

[0050] Where D represents the decryption algorithm.

[0051] Furthermore, the process of alliance member nodes accessing data includes:

[0052] S51. The alliance member node that requested access queries the government department that stores the relevant data based on the multi-level directory blockchain system, and generates a Merkle tree to quickly retrieve the required data, thereby obtaining the ciphertext index, data checksum, and decryption strategy of the corresponding government department node;

[0053] The data check value is the hash value generated after the data is hashed;

[0054] S52: The alliance member node finds the key ciphertext CT to be accessed based on the ciphertext index. If and only if the attribute set corresponding to the alliance member node's decryption private key SK satisfies the access data structure A implicit in the key ciphertext CT, it can use the generated decryption private key SK to decrypt the key ciphertext CT, thereby obtaining the national secret SM4 key.

[0055] The decryption algorithm of the key ciphertext CT is the function Decrypt(CT, R, SK (ID,S,T) ), whose input includes the key ciphertext CT embedded with the access control structure A = (N, ρ), the revoked user list R, and the decryption key SK (ID,S,T) ;

[0056] Define I = {i:ρ(i)∈S}∈{1,2,...,l}; there exists a set of constants {w i ∈Z p} i∈I , so that ∑ i∈I w i λ i =s, where {λ i} is a valid sharing of any secret s according to N;

[0057] The algorithm is as follows:

[0058]

[0059] Let A = e(D 1,τ ,C′0)

[0060]

[0061] S53: Use the obtained SM4 key to decrypt the data encrypted by SM4 to obtain the plaintext data;

[0062] S54: Using the hash value obtained in step S51, the integrity of the data is verified through the function CheckBlockHash(block) to complete the data access.

[0063] On the one hand, a data access system is provided, which is applied to the above-mentioned efficient access method for multi-level blockchain government data, and the data access system includes: a technical service platform, government department nodes, and alliance member nodes;

[0064] The technical service platform is used to build a multi-level directory blockchain system framework based on administrative levels, create system public parameters PK and global public key MK; and create a set of attributes that each government department node is allowed to access;

[0065] Government department nodes are used to encrypt their data. Data is encrypted using the SM4 algorithm and the SM4 key. The SM4 key is used as encrypted text and attribute-encrypted using MK and an attribute set to obtain the key ciphertext CT, completing double-layer encryption of the data. The decryption private key SK for the corresponding level is generated using the global public key MK and an attribute set that meets the access requirements.

[0066] Alliance member nodes are used to request access to data, decrypt the key ciphertext CT using the decryption private key SK, and obtain the national secret SM4 key; they decrypt the national secret SM4 encrypted data using the obtained national secret SM4 key, obtain the data plaintext, and complete access.

[0067] Furthermore, the government department node is also used to store the data ciphertext, key ciphertext CT and decryption strategy in the data storage center respectively;

[0068] The government department node is also used to upload the index address, data check value and decryption strategy generated by the data ciphertext to the government blockchain using SetEvidenceStr(id,data,chain).

[0069] Furthermore, the alliance member node is used to find the key ciphertext CT to be accessed based on the ciphertext index, and only when the attribute set corresponding to the decryption private key SK of the alliance member node can satisfy the access data structure A implicit in the key ciphertext CT, can the generated decryption private key SK be used to decrypt the key ciphertext CT, thereby obtaining the national secret SM4 key.

[0070] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0071] The above plan proposes the use of blockchain technology to efficiently and collaboratively combine the responsibilities, directories, and data of various departments, creating a "directory blockchain system" with responsibilities as the root, directories as the trunk, and data as the leaves. The responsibility directories of each department and the key data directories are "chained" and locked to achieve logical management and control of the city's data, the implementation of data change detection, the full traceability of data access, and the orderly association of data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0073] Figure 1 This is a general flow chart of a data access system solution design provided by an embodiment of the present invention;

[0074] Figure 2 This is a diagram of the overall architecture of a government blockchain that provides an efficient access method for multi-level blockchain government data, as provided by an embodiment of the present invention;

[0075] Figure 3 This is a diagram of system initialization steps for an efficient access method for multi-level blockchain government data provided by an embodiment of the present invention;

[0076] Figure 4 This is a diagram of attribute password encryption steps for an efficient access method for multi-level blockchain government data provided by an embodiment of the present invention;

[0077] Figure 5 This is an example diagram of permission access control for an efficient access method for multi-level blockchain government data provided by an embodiment of the present invention;

[0078] Figure 6 This is a diagram of the steps for sharing encrypted data on-chain in an efficient access method for multi-level blockchain government data provided by an embodiment of the present invention;

[0079] Figure 7 This is a diagram of the steps for generating a decryption private key for an efficient access method for multi-level blockchain government data provided by an embodiment of the present invention;

[0080] Figure 8 This is a data access step diagram of an efficient access method for multi-level blockchain government data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0081] In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0082] An embodiment of the present invention provides an efficient access method for multi-level blockchain government data. The method is implemented by an access system controlled by multiple nodes. The access system includes: a technical service platform that creates a hierarchical structure, government department nodes with data encryption authority, and alliance member nodes that request access to the data.

[0083] This embodiment relates to blockchain, blockchain systems, and attribute encryption, wherein blockchain is a chain data structure that combines data blockchains in a sequential manner in chronological order, and uses cryptography to ensure that the data cannot be tampered with or forged. Blockchain is essentially a decentralized database, a string of data blocks generated using cryptographic methods. Each data block contains information about a batch of network transactions, which is used to verify the validity of the information (anti-counterfeiting) and generate the next block. Blockchain can include a blockchain underlying technology service platform, a blockchain BaaS management platform, and an application service layer. The multi-level blockchain data access mechanism based on attribute encryption can be applied to government systems.

[0084] like Figure 1 FIG. 1 is a general flow chart of the scheme design provided by an embodiment of the present invention; the method includes the following steps:

[0085] S1: The technical service platform initializes the system and creates the system public parameters PK and the global public key MK;

[0086] S2: The government department node encrypts the data using the SM4 algorithm and the SM4 key. It then performs attribute encryption on the SM4 key using the PK and attribute password to obtain the key ciphertext CT.

[0087] S3: The government department node uploads the index generated by the key ciphertext CT and related public content to the multi-level directory blockchain to complete the chain locking;

[0088] S4: The government department node generates the corresponding level of decryption private key SK using the global public key MK and the attribute set that meets the access requirements;

[0089] S5: The alliance member node submits a data access request to the government department node. When the attribute set is met, the key ciphertext CT is decrypted by the decryption private key SK to obtain the national secret SM4 key; the national secret SM4 encrypted data is decrypted by the obtained national secret SM4 key to obtain the data plaintext and complete the access.

[0090] Figure 2This is the overall architecture diagram of the government blockchain provided by an embodiment of the present invention.

[0091] like Figure 2 As shown, in step S1, the multi-level regional chain is divided through the technical service platform, and the division rules include:

[0092] The technical service platform divides the hierarchical structure of the multi-level directory blockchain system according to the administrative hierarchy; creates government blockchains for different government levels; and connects government blockchains at different levels to the same core blockchain through cross-chain technology.

[0093] The administrative levels include: city, district, street, etc.;

[0094] The technical service platform divides the rights and responsibilities of each government department node on the same government blockchain according to the level of rights and responsibilities;

[0095] The levels of authority and responsibility include: the authority of the department to obtain data, job level, etc.

[0096] The technical service platform registers a new department node in the government blockchain through the Register function, completing the definition of relevant role nodes in the government blockchain;

[0097] For example: nodes of various government departments, password management nodes, data storage center nodes, supervisor nodes, etc.

[0098] In this embodiment, by referring to blockchain technology, the responsibilities, directories, and data of various departments are efficiently and collaboratively combined to create a "directory blockchain system" with responsibilities as the root, directories as the trunk, and data as the leaves.

[0099] like Figure 3 FIG. 1 is a diagram showing the system initialization steps according to an embodiment of the present invention.

[0100] In step S1, the method for generating the system public parameter PK and the global public key MK includes:

[0101] S11: Determine the bilinear mapping function and multiplication cycle group used;

[0102] S12: Through the above functions and multiplication loop group, the technical service platform creates a set of attributes that each government department node is allowed to access;

[0103] S13: Use λ, U, T, and I as input values ​​of the function Setup(λ, U, T, I) to generate the output result:

[0104] PK=(G1,g,g b , e(g,g) a );MK=(b,g a );

[0105] Where PK is the system public parameter, MK is the global public key, λ is the security parameter, U is the number of attributes in the system, T is the depth of the time tree, and I is the identity set;

[0106] G1 is a multiplicative cyclic group of order p, g is the generator of G1, a and b are finite fields Z p Any two numbers in e(g,g) a Represents a bilinear map operation.

[0107] Among them, the bilinear map is a function e:G1×G1→G2, which satisfies the following three properties:

[0108] (1) Bilinear: For any P, Q∈G1, a, b∈Z p , there is e(g a ,h b )=e(g,h) ab ;

[0109] (2) Non-degeneracy: e(g,g)≠1,

[0110] (3) Computability: For any P, Q∈G1, a polynomial time algorithm can be used to compute e(P, Q).

[0111] In order to prevent a single node of the blockchain technology service platform from possessing the master key, a parameter allocation scheme is proposed in the embodiment of the present invention: a The parameter a is selected by the blockchain service provider, and b is selected by the supervisor.

[0112] In this embodiment, the participation of the supervisor can effectively prevent a single node from cheating.

[0113] After the system public parameters PK and global public key MK are set, the government department node will perform double-layer encryption on the data.

[0114] like Figure 4 FIG. 1 shows a step diagram of attribute password encryption according to an embodiment of the present invention.

[0115] The government department node encrypts the data using the national secret SM4 algorithm and the national secret SM4 key; it encrypts the national secret SM4 key using the PK and attribute password to obtain the key ciphertext CT, which includes:

[0116] S21: The encryption function for the attribute password is: Encrypt(PK,M,T c ,R,A=(N,ρ));

[0117] S22: The government department node uses the national secret SM4 key as the encrypted text M, and encrypts the national secret SM4 key using PK and the attribute password of this level;

[0118] S23: Output the key ciphertext CT.

[0119] Among them, the input in the function: A is the access structure, T cw is the decryptable time period, R is the revocable set;

[0120] In this embodiment, attribute revocation can be divided into system attribute revocation, user attribute revocation and user identity revocation (i.e., revocation of all attributes of a user) according to the different execution precision of attribute revocation. Among them, the revocation of system attributes and user identity belongs to coarse-grained revocation, while the revocation of user attributes belongs to fine-grained revocation.

[0121] The access structure A is built on the global attribute set, covering all attributes that are allowed to be accessed;

[0122] Where N is a l×n shared generator matrix, ρ is a function that defines the attribute labels i=1,…,l that meet the access requirements as ρ(i);

[0123] like Figure 5 The following diagram shows an example of permission access control. The business context involves exempting enterprises that produce and assemble products for the disabled from corporate income tax. Before collecting taxes from an enterprise, the tax bureau must first inquire about the enterprise's business type with the Administration for Industry and Commerce. To access the information from the Administration for Industry and Commerce, the tax bureau must meet two attributes: Tax Bureau and Income Tax Department. Here, ρ(i) = {Tax Bureau && Income Tax Department}. The tax bureau also has similar access control requirements for data access from several other departments.

[0124] In this embodiment, access control involves setting a set of accessible attributes during encryption. As long as the attributes in this set are met, the user can decrypt the ciphertext. This can be applied to data access between departments with different responsibilities in government systems, effectively isolating departments without access rights.

[0125] The encryption algorithm for the key ciphertext CT is:

[0126] C0=M·e(g,g) asμ

[0127] C0′=g sμ

[0128]

[0129]

[0130]

[0131] CT={C0,C′0,C″0,Ci,j ,C′ i,j}

[0132] Among them, C is the ciphertext, s is the encryption index, and V is a random vector selected in the encryption algorithm. Used to share the encryption exponent s, where λ i =V·N i , where i=1,...,l, vector N i corresponds to the i-th row of N; the algorithm also randomly selects μ1,...,μ r ∈Z p , so that μ=μ1+μ2+…+μ r ; According to the above encryption algorithm, the key ciphertext CT is finally obtained.

[0133] In this embodiment, double-layer encryption is used to strengthen the security access operation of the overall data, and can ensure that government department nodes at different levels can perform efficient data chain storage and secure access operations.

[0134] like Figure 6 , which is a diagram of the steps for sharing encrypted data on-chain according to an embodiment of the present invention.

[0135] After data encryption is completed, the government department node uploads the index generated by the key ciphertext CT and related public content to the multi-level directory blockchain to complete the chain lock, including:

[0136] S31: The government department node stores the data ciphertext, key ciphertext CT and decryption strategy in the data storage center respectively;

[0137] S32: The government department node uploads the index address, data check value and decryption strategy generated by the data ciphertext to the government blockchain using SetEvidenceStr(id, data, chain);

[0138] Among them, id represents the identity of the technical service platform for the on-chain data; data is the on-chain data; and chain is the node of each government department that stores the data.

[0139] like Figure 7 , which is a diagram of the steps for generating a decryption private key according to an embodiment of the present invention.

[0140] After completing the above steps, proceed to step S4: the government department node generates the corresponding level of decryption private key SK using the global public key MK and the attribute set that meets the access requirements, including:

[0141] S41: When a government department node is registered on the chain, the technical service platform will distribute a unique government department node ID, a list of attribute sets of the government department node, and a global public key MK of the government department node;

[0142] S42: Generate a decryption private key SK using the global public key MK through the function KeyGen(MK, ID, S, T);

[0143] Where ID is the global identity identifier of the on-chain government department node; S is the accessible user attribute set; T is the validity period of the user key, which is set by the government department node; in this embodiment, the validity period of the key can be used to update and revoke the key of the node user.

[0144] This embodiment uses the R-CP-ABE algorithm, which features tracking, attribute revocation, and access control. The tracking function locates individuals and authorized institutions that misuse keys and cause key leaks in the ABE system. In the government affairs system of the present invention, this effectively holds departmental nodes responsible for leaking encrypted data accountable.

[0145] The algorithm is as follows:

[0146]

[0147]

[0148]

[0149] {K x =(g b·ID h x ) -t} x∈S

[0150] get,

[0151] Where D represents the decryption algorithm.

[0152] In this embodiment, leveraging the distributed trust characteristics of blockchain technology, we can implement security mechanisms such as timeliness, immutability, and traceability for government data. Attribute encryption technology uses attribute sets to describe user identities and decryption policies to define access rights, enabling fine-grained access to government data and meeting multi-level data access requirements.

[0153] like Figure 8 FIG. 1 is a diagram showing the data access steps according to an embodiment of the present invention.

[0154] The process of alliance member nodes accessing data includes:

[0155] S51. The alliance member node that requested access queries the government department that stores the relevant data based on the multi-level directory blockchain system, and generates a Merkle tree to quickly retrieve the required data, thereby obtaining the ciphertext index, data checksum, and decryption strategy of the corresponding government department node;

[0156] The data check value is a hash value generated after the data is hashed;

[0157] In this embodiment, data tamper resistance is achieved through the characteristics of the hash function. The characteristic of the hash function is that tampering with any character will cause the generated hash value to change significantly.

[0158] S52: The alliance member node finds the key ciphertext CT to be accessed based on the ciphertext index. If and only if the attribute set corresponding to the alliance member node's decryption private key SK satisfies the access data structure A implicit in the key ciphertext CT, it can use the generated decryption private key SK to decrypt the key ciphertext CT, thereby obtaining the national secret SM4 key.

[0159] The decryption algorithm of the key ciphertext CT is the function Decrypt(CT, R, SK (ID,S,T) ), whose input includes the key ciphertext CT embedded with the access control structure A = (N, ρ), the revoked user list R, and the decryption key SK (ID,S,T) ;

[0160] In this embodiment, if any one of the following two conditions 1) and 2) is met in the decryption environment, the decryption algorithm outputs an invalid symbol ⊥:

[0161] 1) The attribute set S of the data demander satisfies the access structure A, but the corresponding identifier ID∈R;

[0162] 2) The data requester's decryption period T c is not completely contained in T, that is, τ c and all its prefixes are not in T. Otherwise, the data requester's ID does not exist in the revoked user list R, and its attribute set S satisfies the access structure A.

[0163] Define I = {i:ρ(i)∈S}∈{1,2,...,l}; there exists a set of constants {w i ∈Z p} i∈I , so that ∑ i∈I w i λ i =s, where {λ i} is a valid sharing of any secret s according to N;

[0164] The algorithm is as follows:

[0165]

[0166] Let A = e(D 1,τ ,C′0)

[0167]

[0168] S53: Use the obtained SM4 key to decrypt the data encrypted by SM4 to obtain the plaintext data;

[0169] S54: Using the hash value obtained in step S51, the integrity of the data is verified through the function CheckBlockHash(block) to complete the data access.

[0170] In this embodiment, the tamper-proof nature of government data is ensured by a hash function, user identity is described by an attribute set, and access rights are defined using a decryption policy, enabling fine-grained access to government data for valid users and making the overall access mechanism more efficient and secure.

[0171] An embodiment of the present invention further provides a data access system, which is applied to the efficient access method for multi-level blockchain government data as described in claims 1-7, and the data access system includes: a technical service platform, a government department node, and an alliance member node;

[0172] The technical service platform is used to build a multi-level directory blockchain system framework based on administrative levels, create system public parameters PK and global public key MK; and create a set of attributes that each government department node is allowed to access;

[0173] Government department nodes are used to encrypt their data. Data is encrypted using the SM4 algorithm and the SM4 key. The SM4 key is used as encrypted text and attribute-encrypted using MK and an attribute set to obtain the key ciphertext CT, completing double-layer encryption of the data. The decryption private key SK for the corresponding level is generated using the global public key MK and an attribute set that meets the access requirements.

[0174] Alliance member nodes are used to request access to data, decrypt the key ciphertext CT using the decryption private key SK, and obtain the national secret SM4 key; they decrypt the national secret SM4 encrypted data using the obtained national secret SM4 key, obtain the data plaintext, and complete access.

[0175] Among them, the government department node is also used to store data ciphertext, key ciphertext CT and decryption strategy in the data storage center respectively;

[0176] Among them, the government department node is also used to upload the index address, data verification value and decryption strategy generated by the data ciphertext to the government blockchain using SetEvidenceStr(id,data,chain).

[0177] The alliance member node is used to find the key ciphertext CT to be accessed based on the ciphertext index, and only when the attribute set corresponding to the decryption private key SK of the alliance member node can satisfy the access data structure A implicit in the key ciphertext CT, can the generated decryption private key SK be used to decrypt the key ciphertext CT, thereby obtaining the national secret SM4 key.

[0178] Based on blockchain and attribute encryption technology, this system ensures efficient data storage and secure access by government department nodes at different levels, while also maintaining records of data operations on the blockchain. Leveraging blockchain technology's distributed trust and other characteristics, it enables security mechanisms such as timeliness, immutability, and traceability for government data. Attribute encryption technology uses attribute sets to describe user identities and decryption policies to define access rights, enabling fine-grained access to government data and meeting multi-level data access requirements.

[0179] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An efficient access method for multi-level blockchain government data, characterized by: The method is implemented by a multi-node controlled access system, which includes: a technical service platform that creates a hierarchical structure, government department nodes with data encryption authority, and alliance member nodes that request data access; the method includes the following steps: S1: The technical service platform initializes the system and creates system public parameters PK and global public key MK; S2: The government department node encrypts the data using the national secret SM4 algorithm and the national secret SM4 key; performs attribute encryption on the national secret SM4 key using the PK and attribute password to obtain the key ciphertext CT; The method of encrypting the national secret SM4 key with the PK and the attribute password to obtain the key ciphertext CT includes: S21: The encryption function for the attribute password is: Encrypt(PK, M, T c , R, A=(N, ρ)); S22: The government department node uses the national secret SM4 key as the encrypted text M, and encrypts the national secret SM4 key using PK and the attribute password of this level; S23: Output key ciphertext CT; Among them, the input in the function: A is the access structure, T c is the decryptable time period, R is the revocable set; The access structure A is built on the global attribute set, covering all attributes that are allowed to be accessed; Among them, N is a l × n shared generation matrix, ρ is a function that converts the attribute labels i = 1,…, l Defined as ρ(i); S3: The government department node uploads the index generated by the key ciphertext CT and related public content to the multi-level directory blockchain to complete the chain locking; S4: The government department node generates a decryption private key SK of the corresponding level using the global public key MK and a set of attributes that meet the access requirements; S5: The alliance member node makes a data access request to the government department node. When the attribute set is met, the key ciphertext CT is decrypted by the decryption private key SK to obtain the national secret SM4 key; the national secret SM4 encrypted data is decrypted by the obtained national secret SM4 key to obtain the data plaintext and complete the access.

2. The efficient access method for multi-level blockchain government data according to claim 1 is characterized in that: In step S1, the multi-level regional chain is divided through the technical service platform. The division rules include: The technical service platform divides the hierarchical structure of the multi-level directory blockchain system according to the administrative hierarchy; creates government blockchains for different government levels; and connects government blockchains at different levels to the same core blockchain through cross-chain technology; The technical service platform divides the rights and responsibilities of each government department node on the same government blockchain according to the level of rights and responsibilities; The technical service platform registers a new department node in the government blockchain through the Register function, completing the definition of relevant role nodes in the government blockchain.

3. The efficient access method for multi-level blockchain government data according to claim 1 is characterized in that: The method for generating the system public parameter PK and the global public key MK in step S1 includes: S11: Determine the bilinear mapping function and multiplication cycle group used; S12: Through the above functions and multiplication loop group, the technical service platform creates a set of attributes that each government department node is allowed to access; S13: Use λ, U, T, and I as input values ​​of the function Setup(λ, U, T, I) to generate the output result: PK = (G1,g,g b , e (g, g) a );MK= (b, g a ); Where PK is the system public parameter, MK is the global public key, λ is the security parameter, U is the number of attributes in the system, T is the depth of the time tree, and I is the identity set; G1 is a multiplicative cyclic group of prime order p, g is a generator of G1, a and b are finite fields Z p Any two numbers in, e(g, g) a Represents a bilinear map operation.

4. The efficient access method for multi-level blockchain government data according to claim 1 is characterized in that: The government department node uploads the index generated by the key ciphertext CT and related public content to the multi-level directory blockchain to complete the chain locking, including: S31: The government department node stores the data ciphertext, key ciphertext CT and decryption strategy in the data storage center respectively; S32: The government department node uploads the index address, data check value and decryption strategy generated by the data ciphertext to the government blockchain using SetEvidenceStr(id, data, chain); Among them, id represents the identity of the technical service platform for the on-chain data; data is the on-chain data; and chain is the node of each government department that stores the data.

5. The efficient access method for multi-level blockchain government data according to claim 1 is characterized in that: The government department node generates the corresponding level of decryption private key SK using the global public key MK and a set of attributes that meet the access requirements, including: S41: When a government department node is registered on the chain, the technical service platform will distribute a unique government department node ID, a list of attribute sets of the government department node, and a global public key MK of the government department node; S42: Generate a decryption private key SK using the global public key MK through the function KeyGen(MK, ID, S, T); Where ID is the global identity of the government department node on the chain; S is the accessible user attribute set; and T is the validity period of the user key.

6. The efficient access method for multi-level blockchain government data according to claim 5 is characterized in that: The process of alliance member nodes accessing data includes: S51. The alliance member node that requested access queries the government department that stores the relevant data based on the multi-level directory blockchain system, and generates a Merkle tree to quickly retrieve the required data, thereby obtaining the ciphertext index, data checksum, and decryption strategy of the corresponding government department node; The data check value is a hash value generated after the data is hashed; S52: The alliance member node finds the key ciphertext CT to be accessed based on the ciphertext index. If and only if the attribute set corresponding to the alliance member node's decryption private key SK satisfies the access data structure A implicit in the key ciphertext CT, it can use the generated decryption private key SK to decrypt the key ciphertext CT, thereby obtaining the national secret SM4 key. The decryption algorithm of the key ciphertext CT is the function Decrypt(CT, R, SK (ID,S,T) ), whose input includes the key ciphertext CT embedded with the access control structure A= (N,ρ), the revoked user list R, and the decryption key SK (ID,S,T) ; definition ; There exists a set of constants , making ,in is a valid sharing of any secret s in terms of N; S53: Use the obtained SM4 key to decrypt the data encrypted by SM4 to obtain the plaintext data; S54: Using the hash value obtained in step S51, the integrity of the data is verified through the function CheckBlockHash(block) to complete the data access.

7. A data access system, characterized in that: The system is used to implement the efficient access method for multi-level blockchain government data according to any one of claims 1 to 6, and the data access system includes: a technical service platform, a government department node, and an alliance member node; The technical service platform is used to build a multi-level directory blockchain system framework based on administrative levels, create system public parameters PK and global public key MK; and create a set of attributes that each government department node is allowed to access; The government department node is used to encrypt its data; the data is encrypted using the national secret SM4 algorithm and the national secret SM4 key; the national secret SM4 key is used as the encrypted text, and the national secret SM4 key is attribute-encrypted using MK and the attribute set to obtain the key ciphertext CT, completing the double-layer encryption of the data; the decryption private key SK of the corresponding level is generated using the global public key MK and the attribute set that meets the access requirements; The alliance member node is used to make access requests to the data, decrypt the key ciphertext CT by using the decryption private key SK, and obtain the national secret SM4 key; decrypt the national secret SM4 encrypted data by using the obtained national secret SM4 key, obtain the data plaintext, and complete the access.

8. The data access system according to claim 7, characterized in that: The government department node is also used to store the data ciphertext, key ciphertext CT and decryption strategy in the data storage center respectively; The government department node is also used to upload the index address, data check value and decryption strategy generated by the data ciphertext to the government blockchain using SetEvidenceStr(id, data, chain).

9. The data access system according to claim 8, characterized in that: The alliance member node is used to find the key ciphertext CT to be accessed according to the ciphertext index, and can only use the generated decryption private key SK to decrypt the key ciphertext CT if and only if the attribute set corresponding to the decryption private key SK of the alliance member node can satisfy the access data structure A implicit in the key ciphertext CT, thereby obtaining the national secret SM4 key.

Images