Secure and auditable IoT data sharing system and method based on blockchain

Abstract

The present invention proposes a secure and auditable IoT data sharing system and method based on blockchain, which uses blockchain technology to improve the security of IoT data sharing. Attribute-based encryption is used to achieve fine-grained control of IoT data access rights, and outsourced decryption technology is used to reduce the computing overhead of the user end. A core function of this system is to control the number of user visits, and use algorithms such as synchronous aggregate signatures and verifiable random functions to manage each user's visit. In the paid use model, the system allocates a limited number of IoT data access rights based on the user's payment for the data. At the same time, the smart contract function of the blockchain provides the system with user management, signature verification and access auditing functions.

Description

Technical Field

[0001] The present invention belongs to the technical fields of information security, Internet of Things and information sharing, and in particular to a secure and auditable Internet of Things data sharing system and method based on blockchain. Background Art

[0002] 1. Blockchain and Smart Contracts

[0003] Blockchain is a chain data structure that combines data blocks in a sequential manner in chronological order, and a distributed ledger that is cryptographically guaranteed to be tamper-proof and unforgeable. In a broad sense, blockchain technology is a new distributed infrastructure and computing paradigm that uses block chain data structures to verify and store data, uses distributed node consensus algorithms to generate and update data, uses cryptography to ensure the security of data transmission and access, and uses smart contracts composed of automated script codes to program and operate data.

[0004] Smart contracts are special protocols used when developing contracts in the blockchain. They contain code functions and can interact with other contracts, make decisions, store data, and send ether. Smart contracts mainly provide verification and execution of the conditions set in the contract. Smart contracts allow trusted transactions without a third party. These transactions are traceable and irreversible.

[0005] 2. Ciphertext policy attribute-based encryption

[0006] Ciphertext-policy attribute based encryption (CP-ABE) can provide privacy-preserving fine-grained access control for data sharing. It includes four algorithms:

[0007] (1)Setup(1 λ )→(PP,MSK): Input security parameter λ, output system public parameter PP and master key MSK. Security parameter λ is used to define the security level of the system, public parameter PP is the default input of other algorithms, and master key MSK can generate attribute keys for users.

[0008] (2) Input PP, MSK and user attribute set Output the user attribute key SK. The user's attribute key SK and attribute set association, which can be used to decrypt access policies and Matching ciphertext.

[0009] (3) Input PP, message m and access policy Output message ciphertext CT. Since CT is consistent with the access policy Association, if the attribute set corresponding to the user attribute key SK Satisfy access policy Only users can decrypt CT.

[0010] (4) Dec(SK,CT)→m / ⊥: Input SK,CT, if the attribute set in SK Visits with CT match Then output message m, otherwise output ⊥ to indicate decryption error. User attribute key SK and attribute set Association, CT and Access Policy When the two match, the user can use SK to recover the plaintext m from CT.

[0011] 3. Synchronous Aggregate Signature

[0012] Synchronized aggregate signature (SAS: synchronized aggregate signature) includes six algorithms:

[0013] (1)Setup(1 λ )→PP: Input security parameter λ, output system public parameter PP. Security parameter λ is used to define the security level of the system, and public parameter PP is the default input for other algorithms.

[0014] (2) KeyGen(PP)→(pk,sk): Input PP, output public and private key pk / sk. This algorithm generates a key pair for the user.

[0015] (3) Sign(PP,sk,m,ω)→σ: Input PP, sk, message m and validity period ω, and output signature σ. The signature value is bound to the message and validity period and is used to verify the validity period of the message.

[0016] (4)Verify(PP,pk,m,σ)→1 / 0: Input PP,pk,m,σ, and output 1 if the signature is valid, otherwise output 0.

[0017] (5)Agg(PP,PK,Msg,Sig)→σ ∑ : Input PP, a set of public keys PK = (pk1, ..., pk l ), a group of messages Msg=(m1,…,m l ), a set of signatures Sig=(σ1,…,σ l ), output aggregate signature σ ∑ .

[0018] (6)AggVerify(PP,PK,Msg,σ∑ )→1 / 0: Input PP, PK, Msg, σ ∑ , output 1 if the aggregate signature is valid, otherwise output 0.

[0019] 4. Verifiable Random Function

[0020] Verifiable random function (VRF) is a pseudo-random function that can provide verification functions. It contains four algorithms:

[0021] (1)Setup(1 λ )→PP: Input security parameter λ and output system public parameter PP.

[0022] (2)KeyGen(PP)→(pk,sk): Input PP, output public / private key pk / sk.

[0023] (3)Prove(PP,sk,x)→(y,π): Input PP, sk and message x, and output VRF evaluation value y and proof value π.

[0024] (4)Verify(PP,pk,x,y,π)→1 / 0: Input PP,pk,x,y,π, and output 1 if (y,π) is a valid evaluation and proof value for x, otherwise output 0.

[0025] 5. Attribute collection access policy definition

[0026] Attribute set definition: This system uses symbol A to represent a single attribute. Let {A1, A2, …, A n} represents the set of all attributes. Represents a set of user attributes and satisfies Using n-bit strings to represent attribute sets where a i ∈{0,1} represents the bit value corresponding to the i-th attribute: if Then a i =1; if Then a i = 0. For example, assuming n = 6, then Represents a collection of attributes Contains attributes {A1,A3,A5,A6}.

[0027] Access policy definition: This system uses an AND gate and an attribute set {A1, A2, …, A n} access structure to define access policies Using n-bit strings to represent access policies where b i∈{0,1} represents the bit value corresponding to the i-th attribute: if Then b i =1; if Then b i = 0. For example, assuming n = 6, then Indicates that the access policy is satisfied Requires the inclusion of attributes {A3,A5}.

[0028] Attribute and access policy matching definition: For attribute collection and access policies If for all i∈{1,…,n}, a i ≥ b i , then it is called the attribute set and access policies Match, represented by

[0029] 6. The technical solution that is closest to the proposal of this application

[0030] (1) Blockchain-based data controlled circulation method CN202110564714.5

[0031] Description: This invention discloses a controlled data transfer method based on blockchain, which belongs to the field of network security; first, a data transfer alliance chain is established in an untrusted network environment, and a trusted third party, a data upload area and a download area are set up; secondly, a smart contract for data encryption upload is executed, and the flow data is encrypted and uploaded to the data flow middle station by setting an access control structure tree between different users; then a smart contract for data summary uploading is executed, and the summary information of the flow data is extracted and stored on the chain; then a smart contract for key generation is executed, and a trusted third party dynamically generates a resource access key according to the identity attribute of the data recipient; finally, a smart contract for data decryption is executed, and the data recipient uses the resource access key to decrypt and obtain the plaintext of the flow data, and verifies the authenticity of the flow data by comparing the data summaries on and off the chain. The present invention ensures that the data source is credible while controlling the flow range of the data.

[0032] Disadvantages: This invention uses access control policies to control data flow, but it cannot limit the number of times a user can use data resources. Once authorized, the data resources can be used an unlimited number of times.

[0033] (2) A multi-authority attribute-based encryption method based on blockchain CN202110411887.3

[0034] Description: The invention provides a multi-authority attribute-based encryption method based on blockchain, including system global initialization, generating system public parameters GP, and recording GP in the genesis block; attribute authority initialization, all attribute authorities use GP to generate a set of attribute public and private keys; data encryption, the encryptor uses symmetric encryption and attribute encryption algorithms to generate data ciphertext and key ciphertext; user private key generation, attribute authority generates a set of attribute private keys for the user; data decryption, the user uses the attribute private key to decrypt the ciphertext to obtain shared data; attribute revocation, due to the revocation of user attributes, its attribute set does not meet the access policy, and the updated ciphertext address cannot be obtained. The present invention uses blockchain to record the user's time-series attribute status, realizes the distributed distribution, storage and revocation of attribute private keys, improves the efficiency of key management of distributed attribute-based encryption mechanism, and enhances the security of data sharing in distributed environment.

[0035] Disadvantages: This invention uses attribute-based encryption to perform fine-grained control over data usage, but cannot outsource decryption functions, and users need to perform a lot of calculations to recover the ciphertext. In addition, the server needs to respond to all data requests and cannot resist distributed denial of service attacks.

[0036] (3) Security authentication method for power distribution Internet of Things based on blockchain CN202110718633.6

[0037] Description: This invention discloses a security authentication method for a power distribution Internet of Things based on blockchain, which includes: using each edge gateway as a blockchain node to build a blockchain, each power terminal device sends its corresponding device information and preset password to the edge gateway, and the edge gateway processes it to complete the registration, the edge gateway generates a first encrypted ciphertext and a second encrypted ciphertext, the edge gateway generates a target ciphertext combination based on the first encrypted ciphertext and the second encrypted ciphertext, and then chains the target ciphertext combination on the blockchain, the power terminal device sends authentication information to the edge gateway, the edge gateway obtains authentication data from it, the edge gateway obtains the first authentication data summary based on the authentication data, and extracts the second digital summary from the blockchain, the edge gateway implements the security authentication of the power terminal device by the edge gateway based on the first authentication data summary and the second digital summary. In this way, the identity authentication of the power terminal device can be completed more efficiently.

[0038] Disadvantages: This invention combines blockchain technology to realize identity authentication between IoT devices, but it cannot realize the secure sharing of IoT data, and does not consider fine-grained security control of data.

[0039] (4) A method for secure data sharing based on private chain CN202010409745.9

[0040] Description: The invention relates to a method for secure data sharing based on a private chain, and belongs to the field of blockchain and the Internet. The invention proposes a method for secure data sharing based on a private chain to connect data blocks into a data network to form a complete database with data storage and sharing functions. By utilizing the security characteristics of the blockchain and the distributed management of root zone data, it can be applied to the management of a large amount of privacy data to ensure the authenticity of the data. Huge and fragmented data can be processed in a timely and effective manner, and the permissions and communication management of IoT devices can better protect privacy issues. In addition, blockchain technology is combined with an off-chain database to separate data and data storage permissions, so that the central agency will not lose or leak data due to lack of management or equipment failure, thereby realizing a decentralized management system, thereby resisting DDoS attacks and achieving self-protection.

[0041] Disadvantages: This invention uses a private chain to share data securely. Its application scenarios are not as extensive as those of public chains and alliance chains. First of all, it is not suitable for Internet of Things systems for public services. In addition, there is no encryption of data and no fine-grained access control, which can easily lead to data leakage. This solution also cannot audit the use of data.

[0042] (5) A design method for IoT security proxy data sharing module using blockchain technology CN201910543004.7

[0043] Description: This invention discloses a design method for a secure proxy data sharing module for the Internet of Things using blockchain technology. A blockchain network is integrated, and its processing nodes act as proxy servers. When a user is a registered member of the network, the user can access the data through verification through the blockchain network. The proxy also re-encrypts the data by converting the policy set during the process of sharing the data. The blockchain network works in conjunction with the cloud server to ensure anti-collusion schemes. The invention also implements fine-grained access control to the data. Experimental results show that proxy re-encryption increases latency, but the use of blockchain records all interactions between entities, eliminating the reliance on trusted third parties and ensuring efficient and secure access to IoT data.

[0044] Disadvantages: This invention uses attribute base and proxy re-encryption functions to protect the security of IoT data, but the encryption and decryption processes of the scheme involve a large number of bilinear pairing operations and power exponential operations, which are not suitable for resource-constrained IoT devices, because a large amount of calculations will quickly exhaust the computing resources and power of the sensor nodes, and will occupy a large amount of communication bandwidth. In contrast, the computational overhead of the present invention is small, and a large amount of computing requirements are outsourced to the cloud platform and blockchain smart contract execution, which can reduce the amount of computing on the IoT device and the user end. In addition, the present invention can also manage and audit the number of times a user's data resources are used.

[0045] The following problems exist in existing technical solutions and systems, which hinder their deployment in practical applications. (1) The efficiency of the attribute-based encryption (ABE) algorithm. The ABE scheme can provide a flexible access control method, but the existing schemes have problems such as high communication and computing overhead and complex decryption process. In most existing schemes, the ciphertext length, bilinear pairing operations, and exponential operations increase linearly with the complexity of the access policy, which seriously hinders the use of ABE in IoT scenarios. Therefore, an important challenge is how to optimize communication and computing efficiency in a pay-per-use model. (2) Distributed denial of service attack (DDoS attack: decentralized denial of service attack) on ABE ciphertext. In the existing ABE scheme architecture, the cloud server cannot determine whether the user has the decryption permission for the ciphertext, so it needs to respond to all download requests. Malicious attackers or unauthorized users will exploit this vulnerability and frequently initiate data download requests to the cloud platform. In order to achieve the purpose of large-scale attacks, attackers can inject viruses into a large number of computers and manipulate multiple hosts to send requests to the cloud platform at the same time in a short period of time to obtain responses, causing the cloud platform's resources to be exhausted. This type of attack is called a denial of service attack. Therefore, the second challenge is how to prevent denial of service attacks against the ABE scheme. (3) Resource usage auditing problem. In order to achieve transparency in cloud service charges, data owners need to audit the actual consumption of cloud storage and cloud computing resources. Traditional signature-based auditing methods require data owners to download the signatures generated by each interaction between users and cloud platforms, and then verify the signature values ​​one by one, resulting in large communication and computing overhead. Therefore, the third major challenge is how to achieve efficient cloud resource auditing. Summary of the invention

[0046] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a secure and auditable IoT data sharing system and method based on blockchain. In order to achieve data privacy protection, the present invention uses blockchain technology to improve the security of IoT secure data sharing. It uses blockchain to provide evidence verification for the key nodes of the generation / encryption, extraction / decryption process of IoT data, greatly improves the reliability of information transmission, and reduces the computing overhead of the user end by outsourcing decryption technology.

[0047] Furthermore, the present invention also uses attribute-based encryption to achieve fine-grained control of IoT data access rights. It also controls the number of user accesses, and uses algorithms such as synchronized aggregate signatures and verifiable random functions to manage each user's access. In the paid use model, the system allocates a limited number of IoT data access rights based on the user's payment for the data. At the same time, the smart contract function of the blockchain can also provide the system with user management, signature verification and access audit functions.

[0048] In view of the problems of privacy leakage, vulnerability to denial of service attacks and hacker intrusion in traditional data sharing methods, the present invention designs a secure and auditable Internet of Things data sharing system based on blockchain in a paid business model. First, the Internet of Things device uses a ciphertext attribute policy-based encryption scheme to encrypt data, thereby limiting the attributes of data users, realizing fine-grained data sharing access control, and defining the number of user visits; secondly, a paid business model is introduced in the data sharing system, so that the cloud server can charge for the services provided, and generate corresponding resource usage certificates through verifiable random functions and synchronous aggregate signatures; then, the Internet of Things device manager can use blockchain smart contracts to automatically verify the certificates generated by the cloud server; finally, a large number of calculations are outsourced to the cloud server for calculation through outsourced computing methods, thereby reducing the decryption overhead of the user end. The advantages of the present invention are to resist distributed denial of service attacks on cloud storage ciphertexts, reduce the decryption overhead of users in fine-grained secure data sharing, and audit the services provided by the cloud platform using blockchain smart contracts. Multiple service certificates can be aggregated through synchronous aggregate signatures, thereby improving the efficiency of auditing.

[0049] The present invention specifically adopts the following technical solutions:

[0050] A secure and auditable IoT data sharing system based on blockchain, comprising the following elements: a key generation center KGC, a cloud server, a blockchain platform and IoT devices;

[0051] The key generation center is used to provide public and private key pairs to data users and IoT devices of the IoT, where the public key is used to submit evidence to the blockchain platform; provide the public key of the data user and the ciphertext conversion key to the cloud server;

[0052] The IoT device encrypts the data to generate ciphertext, generates a signature key pair according to the number of data accesses, and uploads the ciphertext and the signature key pair to the cloud server for storage. The cloud server sends the ciphertext to the blockchain platform for evidence storage;

[0053] The cloud server is used to provide data storage services for the Internet of Things and provide outsourced decryption services for data users;

[0054] The blockchain platform provides evidence storage services for the IoT data storage, sharing, access, and charging process;

[0055] When a data user applies for access to IoT encrypted data, the cloud server completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; the received converted ciphertext can only be decrypted to obtain plaintext after the correctness is verified by the blockchain smart contract.

[0056] Among them, the data user mentioned in the present invention can be understood as the entry device for the user to perform data access, which can be a smart device including but not limited to PC, mobile terminal and other smart devices, which has the function of decryption operation and other calculation processing.

[0057] Furthermore, the key generation center generates a public parameter PP and distributes keys to entities in the system, including: distributing a public-private key pair (PK O ,SK O ), distribute public-private key pairs (PK U ,SK U ), generates a ciphertext conversion key TK for the data user U and extract the key RK U ; The key generation center will (PK U ,SK U ,RK U ) is sent to the data user and (PK U ,TK U ) is sent to the cloud server; the key generation center sends the public parameter PP to the blockchain platform for evidence storage; the IoT device sends the public key PK O , the data user will use the public key PK U Send to the blockchain platform for evidence storage;

[0058] The IoT device is used to encrypt the generated data m and use the access control strategy User attributes that are allowed to access data The ciphertext CT is generated by limiting; assuming that the number of times the IoT device authorizes the data user to access the data is κ, the IoT device generates κ pairs of signature key pairs, and encrypts the signature private key to generate CK; the IoT device uploads the ciphertext CT and the signature key pair CK to the cloud server for storage, and the cloud server sends CT to the blockchain platform for evidence storage;

[0059] When a data user applies to access IoT encrypted data, the access request req is submitted to the cloud server, which completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; the converted ciphertext TCT is submitted to the blockchain smart contract for correctness verification. If the verification passes, the converted ciphertext TCT is decrypted to restore the plaintext m, and the data user generates a proof of data resource use proof;

[0060] The cloud server provides services to authorized data users according to the access control policy; after receiving the access proof from the data user, the cloud server submits the proof to the blockchain smart contract for verification.

[0061] Furthermore, for the cloud server, if the proof passes the verification, it is aggregated to generate an aggregate proof ∑ Submit to the IoT device to charge for the service provided; the IoT device calls the smart contract to proof the service of the cloud server ∑ Verify and then perform payment operations;

[0062] The blockchain platform uses smart contracts to verify the data usage and payment behavior of data users, as well as the aggregate proof generated by the cloud server. ∑ to verify.

[0063] And, a secure and auditable IoT data sharing method based on blockchain, characterized by:

[0064] The key generation center provides public and private key pairs to data users and IoT devices of the Internet of Things; the public key is used to submit evidence to the blockchain platform; and the public key and ciphertext conversion key of the data user are provided to the cloud server;

[0065] The IoT device encrypts the data to generate ciphertext, generates a signature key pair according to the number of data accesses, and uploads the ciphertext and the signature key pair to the cloud server for storage. The cloud server sends the ciphertext to the blockchain platform for evidence storage;

[0066] When a data user applies for access to IoT encrypted data, the cloud server completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; the received converted ciphertext can only be decrypted to obtain plaintext after the correctness is verified by the blockchain smart contract.

[0067] Further, the following steps are included:

[0068] Step S1: the key generation center performs system initialization;

[0069] Step S2: The key generation center generates keys; it generates public parameters PP and distributes keys to entities in the system, including: distributing public-private key pairs (PK O ,SK O ), distribute public-private key pairs (PK U ,SK U ), generates a ciphertext conversion key TK for the data user U and extract the key RK U ; The key generation center will (PK U ,SK U ,RK U ) is sent to the data user and (PK U ,TK U ) is sent to the cloud server; the key generation center sends the public parameter PP to the blockchain platform for evidence storage; the IoT device sends the public key PK O , the data user will use the public key PK U Send to the blockchain platform for evidence storage;

[0070] Step S3: The IoT device performs data encryption and sharing: it encrypts the generated data m and uses the access control strategy User attributes that are allowed to access data The ciphertext CT is generated by limiting; assuming that the number of times the IoT device authorizes the data user to access the data is κ, the IoT device generates κ pairs of signature key pairs, and encrypts the signature private key to generate CK; the IoT device uploads the ciphertext CT and the signature key pair CK to the cloud server for storage, and the cloud server sends CT to the blockchain platform for evidence storage;

[0071] Step S4: Data users make IoT data requests: When data users apply for access to IoT encrypted data, they submit access requests req to the cloud server, which completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage;

[0072] Step S5: The data user will have the received converted ciphertext verified by the blockchain smart contract for correctness, and then decrypt and certify the IoT data;

[0073] Step S6: After receiving the data user's access proof, the cloud server submits the proof to the blockchain smart contract for verification; if the proof passes the verification, it aggregates and generates an aggregate proof ∑ Submit to IoT devices to charge for services provided;

[0074] Step S7: The IoT device calls the smart contract to provide proof of service to the cloud server ∑ Perform verification and then make payment.

[0075] Furthermore, step S1 specifically includes the following process:

[0076] The key generation center is initialized to load KGC.Setup(1 λ )→(PP,MSK): The key generation center generates the elliptic curve group G=(p,E p (a,b),Q), where Q is the generator of the elliptic curve G, and the order of the group G is a prime number p; generate a bilinear pairing (p,G,G T ,e), where groups G and G T The order is a prime number p, and the bilinear pair mapping e:G×G→G T ; Let the global attribute set of the system be

[0077] The key generation center selects a random number in Calculate U = k1Q, V = k2Q, Q i =α i Q, U i =α i U, V i =α i V; Generate the public parameter PP of the CP-ABE algorithm ABE =(Q i ,U i ,V i ), master key MSK ABE =(α,k1,k2), where i∈[1,n];

[0078] The key generation center randomly selects h∈ R G, generates the public parameter PP of the VRF algorithm VRF =Q VRF =hQ;

[0079] The key generation center randomly selects w∈ R G, generate the public parameter PP of the SAS algorithm SAS =Q SAS =wQ;

[0080] The key generation center selects a key generation function KDF and requires that the length of the key output by KDF be the key length of the national secret algorithm SM1;

[0081] The key generation center selects a collision-resistant hash function H0:{0,1} * →G,

[0082] The key generation center outputs the system public parameter PP=(PP ABE ,PP VRF ,PP SAS ,KDF,H0,H1,H2), and the master key MSK=MSK ABE =(α, k1, k2); the key generation center sends the public parameter PP to the blockchain platform for evidence storage;

[0083] Step S2 specifically includes the following process:

[0084] KGC.KeyGen(PP,MSK,S)→(PK O ,SK O ,PK U ,SK U ,TK U ,RK U ): The key generation center generates keys for IoT devices and data users;

[0085] The key generation center randomly selects Generate a public-private key pair (PK O ,SK O )=(βQ,β) and the public-private key pair (PK U ,SK U )=(ηQ,η).

[0086] The key generation center inputs the user's attribute set Compute polynomial ring Z p Function on [α] The key generation center selects a random number Calculate s∈Z p So that the equation Established; the key generation center selects a reversible random number Calculate γ1 = (r + k1t)ζ - 1 modp,γ2=(s-k2t)ζ -1 modp; the ciphertext conversion key of the data user is The ciphertext extraction key is RK U =ζ;

[0087] The key generation center generates a public-private key pair (PK O ,SK O ) is sent to the IoT device, and (PK U ,SK U ,RK U ) is sent to the data user, and (PKU ,TK U ) is sent to the cloud server.

[0088] Furthermore, the IoT device uses a key encapsulation mechanism to encrypt the plaintext, that is, the plaintext message m is encrypted using a symmetric encryption algorithm and an encapsulation key EK, and then the encapsulation key EK is encrypted using a key-based encryption technique, and the access control policy is embedded in the ciphertext;

[0089] The encryption process in step S3 includes:

[0090] The IoT device uses a private key SK O and access control policies Encrypt the plaintext m; use the key encapsulation mechanism to encrypt the plaintext, that is, use the symmetric encryption algorithm and the encapsulation key EK to encrypt the plaintext message m, then use the key-based encryption technology to encrypt the encapsulation key EK, and embed the access control policy into the ciphertext;

[0091] Input data m and access control policy The IoT device selects a random number calculate k m =KDF(r m Q), Let f i Representing polynomials Medium α i The coefficient of the term; calculation Output ciphertext and encapsulation key EK = μ m , where i∈[1,n];

[0092] The IoT device computing

[0093] Use the SM1 national secret symmetric encryption algorithm to encrypt the message m and the VRF proof value P2 with the encapsulation key EK, and output the ciphertext C m =SM1.Enc(KDF(EK),(m||P2));

[0094] Assume that the authorized data user can access the IoT data file at most κ times, and the IoT device is randomly selected Calculate κ for the signature key pair Where i∈[1,κ]; SM1 national secret symmetric encryption algorithm and encapsulation key EK are used to sk i Encrypt and calculate the access key ciphertext CSK i =SM1.Enc(KDF(EK),sk i);

[0095] The IoT device outputs ciphertext Encapsulation key EK and set CK = {pk i ,CSK i} i∈[1,κ] , where CK represents the set of κ signature key pairs.

[0096] Furthermore, step S4 specifically includes the following process:

[0097] U.Req(PP,PK U ,SK U ,Info): The data user sends IoT data access request information Info and calculates Y=e(Q VRF ,(H1(Info)+SK U ) -1 Q VRF ),π=(H1(Info)+SK U ) -1 Q VRF , output req=(Info,PK U ,Y,π);

[0098] The cloud server performs the following verification and ciphertext conversion operations:

[0099] First, verify that the following conditions are met:

[0100] (1) Verify the equation whether it is established;

[0101] (2) Verification of TK U The attribute collection in and CT Is the access policy satisfied?

[0102] (3) Verify that the number of requests for CT by data users does not exceed κ times;

[0103] If the above verification conditions are met, the cloud server performs ciphertext conversion calculations for the data user;

[0104] Enter ciphertext and ciphertext conversion key if The user's attribute set and access control policy If the data user does not match, the output ⊥ indicates that the data user is an unauthorized user; if The cloud platform performs ciphertext conversion calculations

[0105]

[0106] According to the function If the access policy but Constitute a polynomial; otherwise, it does not hold; let η i represents the polynomial Λ(α) in which α i The coefficient of the term; Obviously, the coefficient of the zero-order term η0 of the polynomial Λ(α)≠0; Cloud platform calculation:

[0107]

[0108] Generate conversion ciphertext

[0109] The cloud server updates the number of requests for CT by the data user ctr=ctr+1, and stores (TCT,ctr) on the blockchain.

[0110] Furthermore, step S5 specifically includes the following process:

[0111] U.DecVerify(PP,PK O ,RK U ,TCT,CSK ctr )→(m,sk i ) / ⊥: The data user recovers the access key sk from the converted ciphertext i and plaintext message m;

[0112] The data user extracts the key RK using the ciphertext U =ζ to restore the original message m; first calculate:

[0113]

[0114] Then calculate k m =KDF(r m Q), Thus, the encapsulation key EK = μ is recovered m ;

[0115] Use the SM1 national secret symmetric decryption algorithm and the encapsulation key EK to calculate m||P2=SM1.Dec(KDF(EK),C m );

[0116] Verify that the following equation holds true

[0117] Calculate sk ctr =SM1.Dec(KDF(EK),CSK ctr ), output (m,ski );

[0118] Let ω be the current time period, the data user uses sk i =z i Calculate d=H1(req,ω), Φ1=H2(0,ω), Φ2=H0(1,ω), σ=z ctr Φ1+z ctr dΦ2, output proof ctr =(req,σ,ω), and Proof ctr Store evidence on the blockchain.

[0119] Furthermore, step S6 specifically includes the following process:

[0120] Blockchain.AggProof(PP,PK,Proof)→Proof Σ / ⊥:The cloud server calls the smart contract to aggregate the data users’ proof from the blockchain. Proof=(Proof1,…,Proof l ), the corresponding public key is PK=(PK1,…,PK l ); for i∈[1,l], the cloud server calls the smart contract to calculate d i =H1(req i ,ω), Φ1=H0(0,ω), Φ2=H0(1,ω); verification Is it true? If not, output ⊥; otherwise, perform proof aggregation operation; input PK=(PK1,…,PK l ), Req=(Req1,…,Req l ), Sig=(σ1,…,σ l ), the cloud server calls the smart contract to calculate Output Aggregation Proof Σ =(Req,σ Σ ,ω).

[0121] Furthermore, step S7 specifically includes the following process:

[0122] Blockchain.Verify(PP,PK,Proof Σ )→1 / 0: The IoT device calls the smart contract to verify the aggregate proof; if ω is not the current time period, or PK=(PK1,…,PK l ) appears at least twice in the set, the aggregate proof is false and outputs 0; for i∈[1,l], the IoT device calls the smart contract to calculate d i =H1(req i,ω), Φ1=H0(0,ω), Φ2=H0(1,ω), verification Is it true? If true, output 1; otherwise, output 0.

[0123] Compared with the prior art, the present invention and its preferred embodiment have the following beneficial effects:

[0124] (1) To improve the efficiency of the attribute-based encryption (ABE) algorithm, a ciphertext-based attribute-based encryption scheme based on outsourced decryption is used to outsource a large number of operations to the cloud server for calculation, thereby reducing the user's decryption calculation amount to a constant order of magnitude. This reduces the decryption overhead on the user side (i.e., reduces the computing overhead of the data user).

[0125] (2) Regarding how to prevent denial of service attacks against the ABE scheme (how to resist the distributed denial of service provisioning problem against cloud storage ciphertext), IoT devices use the ciphertext attribute policy-based encryption scheme to encrypt data, thereby limiting the attributes of data users, achieving fine-grained data sharing access control, and defining the number of user accesses. The cloud platform verifies the user's download and decryption permissions through the user's ciphertext conversion key TK. If the attribute set associated in TK is consistent with the one in the request ciphertext CT, If the two decryption algorithms match, the cloud platform executes the outsourced decryption algorithm; otherwise, the cloud platform rejects the user's data access request. In the system of the present invention, the data user needs to use his key to generate a download request before downloading the encrypted data. The verifiable random function can verify the download request to prevent impersonation attacks, that is, malicious attackers send download requests by impersonating legitimate users.

[0126] (3) In order to solve the problem of how to realize efficient cloud resource audit, the present invention uses synchronous aggregate signature to realize the audit operation of data, so as to realize the control of the number of data access. First, SAS aggregates the signatures of the same time period into a short aggregate signature, thereby avoiding sending a large number of signatures and their corresponding certificates to users. Users only need to verify a single aggregate signature to realize the audit operation of data resources. Secondly, in the encryption stage, the data owner prepares κ signature keys for the outsourced document, where κ represents the upper limit of the number of downloads within a time period. Each signature key can only be used to generate one signature and its certificate within a time period. Therefore, the number of data usages of all authorized users can be limited. Multiple service certificates can be aggregated through synchronous aggregate signatures, thereby improving the efficiency of auditing.

[0127] The design highlights include:

[0128] 1. Control the number of user visits and use algorithms such as synchronous aggregate signatures and verifiable random functions to manage each user's visit.

[0129] 2. In the pay-for-use model, the system allocates a limited number of IoT data access permissions based on the user's payment for the data.

[0130] 3. Use blockchain’s smart contracts to audit the services provided by the cloud platform, verify resource usage proof, and perform access audit functions.

[0131] 4. Aggregate multiple service certificates through synchronous aggregate signatures to improve audit efficiency.

[0132] 5. Reduce the decryption overhead of the user side. The advantage of the system of the present invention is that it can resist the distributed denial of service attack against the cloud storage ciphertext and reduce the computing overhead of users in fine-grained secure data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0133] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0134] Figure 1 The figure is a schematic diagram of the system architecture and workflow of an embodiment of the present invention. DETAILED DESCRIPTION

[0135] In order to make the features and advantages of this patent more obvious and easy to understand, the following embodiments are specifically described in detail as follows:

[0136] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0137] The system architecture of this embodiment is as follows Figure 1 As shown, the roles include a key generation center (KGC), a cloud server, a blockchain, an Internet of Things, and a data user. The functions of each entity in the system and the operations performed are summarized as follows. The symbol definitions in the system of this embodiment are shown in Table 1.

[0138] Key Generation Center: Responsible for establishing the system and generating public parameters PP, and distributing keys to entities in the system (step ①): distributing public-private key pairs (PK) to IoT devices O ,SK O ), distribute public-private key pairs (PK U ,SK U ), generate the ciphertext conversion key TK for the user U and extract the key RK U , will (PK U ,SK U ,RK U ) is sent to the data user and (PK U ,TK U) is sent to the cloud platform. The key generation center sends the public parameter PP to the blockchain platform for evidence storage. The IoT device sends the public key PK O , the user will use the public key PK U Sent to the blockchain platform for evidence storage.

[0139] Internet of Things: A network of physical objects embedded with sensors, software, and other technologies to connect and exchange data with other devices and systems over the Internet. To protect data privacy, IoT devices need to encrypt the data they generate and use access control policies. To set the user attributes that are allowed to access the data The ciphertext CT is generated by limiting. Assuming that the number of times the IoT device authorizes the user to access the data is κ, the IoT device generates a κ pair of signature key pairs and encrypts the signature private key to generate CK. Finally, the IoT device uploads the ciphertext CT and the signature key pair CK to the cloud platform for storage, and the cloud platform sends CT to the blockchain platform for evidence storage (step ②). The IoT manager needs to call the smart contract to prove the service of the cloud platform ∑ Verify and then proceed with payment (step ⑦).

[0140] Data user: Apply for access to IoT encrypted data and submit the access request req to the cloud server (step ③), which will complete the ciphertext conversion operation (step ④). The data user submits the received converted ciphertext TCT to the blockchain smart contract for correctness verification. If it is correct, it will be decrypted to restore the plaintext m. Then, the data user needs to generate proof of data resource use (step ⑤).

[0141] Cloud server: Provides data storage services for the Internet of Things, and outsourced decryption services for data users to reduce the amount of computing power for data users. Security requires that the cloud server cannot obtain sensitive data information in the Internet of Things files during the outsourced decryption process. The cloud server needs to reject access requests from unauthorized data users and provide services to authorized data users according to the access control policy (step ④). After receiving the data user's access proof, the cloud platform submits the proof to the blockchain smart contract for verification. If the verification is passed, aggregation is performed to generate an aggregate proof ∑ To charge for the services provided (step ⑥).

[0142] Blockchain: Provides evidence storage services for IoT data storage, sharing, access, and charging processes, and uses smart contracts to verify data users’ data usage, payment behavior, and the aggregate signature generated by the cloud server (steps ①②④⑥⑦).

[0143] Table 1 Symbols

[0144]

[0145]

[0146] Its operation process includes the following steps:

[0147] 1. System initialization phase

[0148] KGC.Setup(1 λ )→(PP,MSK): The key generation center generates the elliptic curve group G=(p,E p (a,b),Q), where Q is the generator of the elliptic curve G, and the order of the group G is a prime number p. Generate a bilinear pairing (p,G,G T ,e), where groups G and G T The order is a prime number p, and the bilinear pair mapping e:G×G→G T . Let the global attribute set of the system be

[0149] -KGC selects random number in Calculate U = k1Q, V = k2Q, Q i =α i Q, U i =α i U, V i =α i V. Generate the public parameters PP of the CP-ABE algorithm ABE =(Q i ,U i ,V i ), master key MSK ABE =(α,k1,k2), where i∈[1,n].

[0150] -KGC randomly selects h∈ R G, generates the public parameter PP of the VRF algorithm VRF =Q VRF =hQ.

[0151] -KGC randomly selects w∈ R G, generate the public parameter PP of the SAS algorithm SAS =Q SAS =wQ.

[0152] -KGC selects the key derivation function KDF (key derivation function), and requires that the length of the key output by KDF be the key length of the national secret algorithm SM1 (symmetric encryption scheme).

[0153] -KGC selects collision-resistant hash function H0:{0,1} * →G,

[0154] -KGC output system public parameter PP = (PP ABE ,PP VRF ,PP SAS ,KDF,H0,H1,H2), and the master key MSK=MSK ABE =(α, k1, k2). KGC sends the public parameter PP to the blockchain platform for storage.

[0155] 2. Key generation phase

[0156] KGC.KeyGen(PP,MSK,S)→(PK O ,SK O ,PK U ,SK U ,TK U ,RK U ): The key generation center generates keys for IoT devices and users.

[0157] -KGC random selection Generate a public-private key pair (PK O ,SK O )=(βQ,β) and the user's public-private key pair (PK U ,SK U )=(ηQ,η).

[0158] -KGC inputs the user's attribute set Compute polynomial ring Z p Function on [α] KGC selects random numbers Calculate s∈Z p So that the equation Established. KGC selects reversible random numbers Calculate γ1 = (r + k1t)ζ -1 modp,γ2=(s-k2t)ζ -1 modp. The user's ciphertext conversion key is The ciphertext extraction key is RK U =ζ.

[0159] -KGC will be the public-private key pair (PK O ,SK O ) is sent to the IoT device, and (PK U ,SK U ,RK U ) is sent to the user, and (PK U ,TKU ) is sent to the cloud platform.

[0160] 3. IoT data encryption and sharing stage

[0161] · IoT device private key SK O and access control policies Encrypt the plaintext m. This system uses a key encapsulation mechanism to encrypt the plaintext, that is, use a symmetric encryption algorithm and an encapsulation key EK to encrypt the plaintext message m, then use the key-based encryption technology to encrypt the encapsulation key EK, and embed the access control policy into the ciphertext. The advantage of using a key encapsulation mechanism is that the encryption algorithm has no restrictions on the type of data collected by the Internet of Things, so the Internet of Things data can come from different sensor devices.

[0162] - Input data m and access control policy IoT devices select random numbers calculate k m =KDF(r m Q), Let f i Representing polynomials Medium α i The coefficient of the term. Calculate Output ciphertext and encapsulation key EK = μ m , where i∈[1,n].

[0163] - IoT device computing

[0164] -Use the SM1 national secret symmetric encryption algorithm to encrypt the message m and the VRF proof value P2 with the encapsulation key EK, and output the ciphertext C m =SM1.Enc(KDF(EK),(m||P2)).

[0165] -Assume that the authorized data user can access the IoT data file at most κ times. IoT devices are randomly selected Calculate κ for the signature key pair Where i∈[1,κ]. Use the SM1 national secret symmetric encryption algorithm to encrypt sk with the encapsulation key EK i Encrypt and calculate the access key ciphertext CSK i =SM1.Enc(KDF(EK),sk i ).

[0166] - IoT devices output ciphertext Encapsulation key EK and set CK = {pk i ,CSK i} i∈[1,κ] , where CK represents the set of κ signature key pairs.

[0167] 4. IoT data request stage

[0168] ·U.Req(PP,PK U ,SK U ,Info): The data user sends IoT data access request information Info and calculates Y=e(Q VRF ,(H1(Info)+SK U ) -1 Q VRF ),π=(H1(Info)+SK U ) -1 Q VRF , output req=(Info,PK U ,Y,π).

[0169] The cloud server performs the following verification and ciphertext conversion operations. First, verify whether the following conditions are met:

[0170] (1) Verify the equation Is it true?

[0171] (2) Verification of TK U The attribute collection in and CT Is the access policy satisfied?

[0172] (3) Verify that the number of requests for CT by data users does not exceed κ times.

[0173] If all the above verification conditions are met, the cloud server performs ciphertext conversion calculations for the data user.

[0174] - Input ciphertext and ciphertext conversion key if The user's attribute set and access control policy If the data user does not match, then the output ⊥ indicates that the data user is an unauthorized user. The cloud platform performs ciphertext conversion calculations

[0175]

[0176] According to the function If the access policy but Constitute a polynomial; otherwise, it does not hold. η i represents the polynomial Λ(α) in which α i Obviously, the coefficient of the zero-order term of the polynomial Λ(α) η0≠0. Cloud platform computing

[0177]

[0178] Generate conversion ciphertext

[0179] -The cloud server updates the data user's request number for CT ctr = ctr + 1, and stores (TCT, ctr) on the blockchain.

[0180] 5. IoT data decryption and certification stage

[0181] U.DecVerify(PP,PK O ,RK U ,TCT,CSK ctr )→(m,sk i ) / ⊥: The data user recovers the access key sk from the converted ciphertext i and plaintext message m.

[0182] -Data users use ciphertext to extract the key RK U =ζ to restore the original message m. First calculate

[0183]

[0184] Then calculate k m =KDF(r m Q), Thus, the encapsulation key EK = μ is recovered m .

[0185] -Use SM1 national secret symmetric decryption algorithm and encapsulation key EK to calculate m||P2=SM1.Dec(KDF(EK),C m ).

[0186] -Verify that the following equation holds true

[0187] -Calculate sk ctr =SM1.Dec(KDF(EK),CSK ctr ), output (m,sk i ).

[0188] Let ω be the current time period, and the data user uses sk i =z iCalculate d=H1(req,ω), Φ1=H2(0,ω), Φ2=H0(1,ω), σ=z ctr Φ1+z ctr dΦ2, output proof ctr =(req,σ,ω), and Proof ctr Store evidence on the blockchain.

[0189] 6. Blockchain Aggregation Proof Phase

[0190] ·Blockchain.AggProof(PP,PK,Proof)→Proof Σ / ⊥: The cloud server calls the smart contract to aggregate the data users’ proof from the blockchain. Proof = (Proof1,…,Proof l ), the corresponding public key is PK=(PK1,…,PK l ). For i∈[1,l], the cloud server calls the smart contract to calculate d i =H1(req i ,ω), Φ1=H0(0,ω), Φ2=H0(1,ω). verify Is it true? If not, output ⊥. Otherwise, perform proof aggregation operation. Input PK=(PK1,…,PK l ), Req=(Req1,…,Req l ), Sig=(σ1,…,σ l ), the cloud server calls the smart contract to calculate Output Aggregation Proof Σ =(Req,σ Σ ,ω).

[0191] 7. Blockchain aggregation verification stage

[0192] ·Blockchain.Verify(PP,PK,Proof Σ )→1 / 0: The IoT device calls the smart contract to verify the aggregated proof. If ω is not the current time period, or PK=(PK1,…,PK l ) appears at least twice in the set, the aggregate proof is false and the output is 0. For i∈[1,l], the IoT device calls the smart contract to calculate d i =H1(req i ,ω), Φ1=H0(0,ω), Φ2=H0(1,ω), verification Is it true? If true, output 1. Otherwise, output 0.

[0193] Obviously, the above embodiments of the present invention are only examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A secure and auditable IoT data sharing system based on blockchain, characterized in that: Includes the following elements: key generation center KGC, cloud server, blockchain platform and IoT devices; The key generation center is used to provide public and private key pairs to data users and IoT devices of the Internet of Things, where the public key is used to submit blockchain platform evidence; Provide the data user's public key and ciphertext conversion key to the cloud server; The IoT device encrypts the data to generate ciphertext, generates a signature key pair according to the number of data accesses, and uploads the ciphertext and the signature key pair to the cloud server for storage. The cloud server sends the ciphertext to the blockchain platform for evidence storage; The cloud server is used to provide data storage services for the Internet of Things and outsourced decryption services for data users; When a data user applies to access IoT encrypted data, the cloud server completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; the received converted ciphertext can only be decrypted to obtain the plaintext after the correctness is verified by the blockchain smart contract; The key generation center is used to generate public parameters PP and distribute keys to entities in the system, including: distributing public-private key pairs (PK O ,SK O ), distribute public-private key pairs (PK U ,SK U ), generates a ciphertext conversion key TK for the data user U and extract the key RK U ; The key generation center is used to convert (PK U ,SK U ,RK U ) is sent to the data user and (PK U ,TK U ) is sent to the cloud server; the key generation center is also used to send the public parameter PP to the blockchain platform for evidence storage; the IoT device sends the public key PK O , the data user will use the public key PK U Send to the blockchain platform for evidence storage; The IoT device is used to encrypt the generated data m, and use the access control policy A to limit the user attributes S that are allowed to access the data to generate the ciphertext CT; suppose the IoT device authorizes the data user to access the data a number of times κ, the IoT device generates κ pairs of signature key pairs, and encrypts the signature private key to generate CK; the IoT device uploads the ciphertext CT and the signature key pair CK to the cloud server for storage, and the cloud server sends CT to the blockchain platform for evidence storage; When a data user applies to access IoT encrypted data, the access request req is submitted to the cloud server, which completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; the converted ciphertext TCT is submitted to the blockchain smart contract for correctness verification. If the verification passes, the converted ciphertext TCT is decrypted to restore the plaintext m, and the data user generates a proof of data resource use proof; The cloud server provides services to authorized data users according to the access control policy; after receiving the data user's access proof, the cloud server submits the proof to the blockchain smart contract for verification; For the cloud server, if the proof passes the verification, it will be aggregated to generate the aggregate proof ∑ Submit to the IoT device to charge for the service provided; the IoT device calls the smart contract to proof the service of the cloud server ∑ Verify and then perform payment operations; The blockchain platform uses smart contracts to verify the data usage and payment behavior of data users, as well as the aggregate proof generated by the cloud server. ∑ to verify.

2. A secure and auditable IoT data sharing method based on blockchain, characterized by: The key generation center provides public and private key pairs to data users and IoT devices of the Internet of Things; the public key is used to submit evidence to the blockchain platform; and the public key and ciphertext conversion key of the data user are provided to the cloud server; The IoT device encrypts the data to generate ciphertext, generates a signature key pair according to the number of data accesses, and uploads the ciphertext and the signature key pair to the cloud server for storage. The cloud server sends the ciphertext to the blockchain platform for evidence storage; When a data user applies to access IoT encrypted data, the cloud server completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; the received converted ciphertext can only be decrypted to obtain plaintext after the correctness is verified by the blockchain smart contract; The following steps are involved: Step S1: the key generation center performs system initialization; Step S2: The key generation center generates keys; it generates public parameters PP and distributes keys to entities in the system, including: distributing public-private key pairs (PK O ,SK O ), distribute public-private key pairs (PK U ,SK U ), generates a ciphertext conversion key TK for the data user U and extract the key RK U ; The key generation center will (PK U ,SK U ,RK U ) is sent to the data user and (PK U ,TK U ) is sent to the cloud server; the key generation center sends the public parameter PP to the blockchain platform for evidence storage; the IoT device sends the public key PK O , the data user will use the public key PK U Send to the blockchain platform for evidence storage; Step S3: The IoT device performs data encryption and sharing: it encrypts the generated data m and uses the access control strategy User attributes that are allowed to access data The ciphertext CT is generated by limiting; assuming that the number of times the IoT device authorizes the data user to access the data is κ, the IoT device generates κ pairs of signature key pairs, and encrypts the signature private key to generate CK; the IoT device uploads the ciphertext CT and the signature key pair CK to the cloud server for storage, and the cloud server sends CT to the blockchain platform for evidence storage; Step S4: Data users make IoT data requests: When data users apply for access to IoT encrypted data, they submit access request req to the cloud server, which completes the ciphertext conversion operation and sends the converted ciphertext to the blockchain platform for evidence storage; Step S5: The data user will have the received converted ciphertext verified by the blockchain smart contract for correctness, and then decrypt and certify the IoT data; Step S6: After receiving the data user's access proof, the cloud server submits the proof to the blockchain smart contract for verification; if the proof passes the verification, it aggregates and generates an aggregate proof ∑ Submit to IoT devices to charge for services provided; Step S7: The IoT device calls the smart contract to provide proof of service to the cloud server ∑ Perform verification and then make payment.

3. The secure and auditable IoT data sharing method based on blockchain according to claim 2 is characterized in that: Step S1 specifically includes the following process: The key generation center is initialized to load KGC.Setup(1 λ )→(PP,MSK): The key generation center generates the elliptic curve group G=(p,E p (a,b),Q), where Q is the generator of the elliptic curve G, and the order of the group G is a prime number p; generate a bilinear pairing (p,G,G T ,e), where groups G and G T The order is a prime number p, and the bilinear pair mapping e:G×G→G T ; Let the global attribute set of the system be The key generation center selects a random number in Calculate U = k1Q, V = k2Q, Q i =α i Q, U i =α i U, V i =α i V; Generate the public parameter PP of the CP-ABE algorithm ABE =(Q i ,U i ,V i ), master key MSK ABE =(α,k1,k2), where i∈[1,n]; The key generation center randomly selects h∈ R G, generates the public parameter PP of the VRF algorithm VRF =Q VRF =hQ; The key generation center randomly selects w∈ R G, generate the public parameter PP of the SAS algorithm SAS =Q SAS =wQ; The key generation center selects a key generation function KDF and requires that the length of the key output by KDF be the key length of the national secret algorithm SM1; The key generation center selects a collision-resistant hash function H0:{0,1} * →G, The key generation center outputs the system public parameter PP=(PP ABE ,PP VRF ,PP SAS ,KDF,H0,H1,H2), and the master key MSK=MSK ABE =(α, k1, k2); the key generation center sends the public parameter PP to the blockchain platform for evidence storage; Step S2 specifically includes the following process: KGC.KeyGen(PP,MSK,S)→(PK O ,SK O ,PK U ,SK U ,TK U ,RK U ): The key generation center generates keys for IoT devices and data users; The key generation center randomly selects Generate a public-private key pair (PK O ,SK O )=(βQ,β) and the public-private key pair (PK U ,SK U )=(ηQ,η); The key generation center inputs the user's attribute set Compute polynomial ring Z p Function on [α] The key generation center selects a random number Calculate s∈Z p So that the equation F(α,S) -1 ≡k1s+k2rmodp holds; the key generation center selects a reversible random number Calculate γ1 = (r + k1t)ζ -1 modp,γ2=(s-k2t)ζ -1 modp; the ciphertext conversion key of the data user is The ciphertext extraction key is RK U =ζ; The key generation center generates a public-private key pair (PK O ,SK O ) is sent to the IoT device, and (PK U ,SK U ,RK U ) is sent to the data user, and (PK U ,TK U ) is sent to the cloud server.

4. The secure and auditable IoT data sharing method based on blockchain according to claim 3 is characterized in that: The IoT device uses a key encapsulation mechanism to encrypt the plaintext, that is, the plaintext message m is encrypted using a symmetric encryption algorithm and an encapsulation key EK, and then the encapsulation key EK is encrypted using a key-based encryption technique, and the access control policy is embedded in the ciphertext; The encryption process in step S3 includes: The IoT device uses a private key SK O and access control policies Encrypt the plaintext m; use the key encapsulation mechanism to encrypt the plaintext, that is, use the symmetric encryption algorithm and the encapsulation key EK to encrypt the plaintext message m, then use the key-based encryption technology to encrypt the encapsulation key EK, and embed the access control policy into the ciphertext; Input data m and access control policy The IoT device selects a random number calculate k m =KDF(r m Q), Let f i Representing polynomials Medium α i The coefficient of the term; calculate Output ciphertext and encapsulation key EK = μ m , where i∈[1,n]; The IoT device computing Use the SM1 national secret symmetric encryption algorithm to encrypt the message m and the VRF proof value P2 with the encapsulation key EK, and output the ciphertext C m =SM1.Enc(KDF(EK),(m||P2)); Assume that the authorized data user can access the IoT data file at most κ times, and the IoT device is randomly selected Calculate κ for the signature key pair Where i∈[1,κ]; SM1 national secret symmetric encryption algorithm and encapsulation key EK are used to sk i Encrypt and calculate the access key ciphertext CSK i =SM1.Enc(KDF(EK),sk i ); The IoT device outputs ciphertext Encapsulation key EK and set CK = {pk i ,CSK i } i∈[1,κ] , where CK represents the set of κ signature key pairs.

5. The secure and auditable IoT data sharing method based on blockchain according to claim 4 is characterized in that: Step S4 specifically includes the following process: U.Req(PP,PK U ,SK U ,Info): The data user sends IoT data access request information Info and calculates Y=e(Q VRF ,(H1(Info)+SK U ) -1 Q VRF ),π=(H1(Info)+SK U ) -1 Q VRF , output req=(Info,PK U ,Y,π); The cloud server performs the following verification and ciphertext conversion operations: First, verify that the following conditions are met: (1) Verify the equation whether it is established; (2) Verification of TK U The attribute collection in and CT Is the access policy satisfied? (3) Verify that the number of requests for CT by data users does not exceed κ times; If the above verification conditions are met, the cloud server performs ciphertext conversion calculations for the data user; Enter ciphertext and ciphertext conversion key if The user's attribute set and access control policy If the data user does not match, the output ⊥ indicates that the data user is an unauthorized user; if The cloud platform performs ciphertext conversion calculations According to the function If the access policy but Constitute a polynomial; otherwise, it does not hold; let c i =a i -b i , η i represents the polynomial Λ(α) in which α i The coefficient of the term; Obviously, the coefficient of the zero-order term η0 of the polynomial Λ(α)≠0; Cloud platform calculation: Generate conversion ciphertext The cloud server updates the number of requests for CT by the data user ctr=ctr+1, and stores (TCT,ctr) on the blockchain.

6. The secure and auditable IoT data sharing method based on blockchain according to claim 5 is characterized in that: Step S5 specifically includes the following process: U.DecVerify(PP,PK O ,RK U ,TCT,CSK ctr )→(m,sk i ) / ⊥: The data user recovers the access key sk from the converted ciphertext i and plaintext message m; The data user extracts the key RK using the ciphertext U =ζ to restore the original message m; first calculate: Then calculate k m =KDF(r m Q), Thus, the encapsulation key EK = μ is recovered m ; Use the SM1 national secret symmetric decryption algorithm and the encapsulation key EK to calculate m||P2=SM1.Dec(KDF(EK),C m ); Verify that the following equation holds true Calculate sk ctr =SM1.Dec(KDF(EK),CSK ctr ), output (m,sk i ); Let ω be the current time period, the data user uses sk i =z i Calculate d=H1(req,ω), Φ1=H2(0,ω), Φ2=H0(1,ω), σ=z ctr Φ1+z ctr dΦ2, output proof ctr =(req,σ,ω), and Proof ctr Store evidence on the blockchain.

7. The secure and auditable IoT data sharing method based on blockchain according to claim 6 is characterized in that: Step S6 specifically includes the following process: Blockchain.AggProof(PP,PK,Proof)→Proof Σ / ⊥:The cloud server calls the smart contract to aggregate the data users’ proof from the blockchain. Proof=(Proof1,…,Proof l ), the corresponding public key is PK=(PK1,…,PK l ); for i∈[1,l], the cloud server calls the smart contract to calculate d i =H1(req i ,ω), Φ1=H0(0,ω), Φ2=H0(1,ω); verification Is it true? If not, output ⊥; otherwise, perform proof aggregation operation; input PK=(PK1,…,PK l ), Req=(Req1,…,Req l ), Sig=(σ1,…,σ l ), the cloud server calls the smart contract to calculate Output Aggregation Proof Σ =(Req,σ Σ ,ω).

8. The secure and auditable IoT data sharing method based on blockchain according to claim 7 is characterized in that: Step S7 specifically includes the following process: Blockchain.Verify(PP,PK,Proof Σ )→1 / 0: The IoT device calls the smart contract to verify the aggregate proof; if ω is not the current time period, or PK=(PK1,…,PK l ) appears at least twice in the set, the aggregate proof is false and outputs 0; for i∈[1,l], the IoT device calls the smart contract to calculate d i =H1(req i ,ω), Φ1=H0(0,ω), Φ2=H0(1,ω), verification Is it true? If true, output 1; otherwise, output 0.

Images