A method and device for secure sharing of power data based on IPFS

Abstract

The present invention discloses a method and device for secure sharing of electric power data based on IPFS. The present invention uses an authentication cluster and a sharing cluster as collaborative participants of a DAPP system based on IPFS, encrypts the shared data in the data sharing scheme to obtain encrypted data, and uses the encryption key of the shared data as a shared input source, divides the secret orders generated according to the encryption key of the shared data into equal amounts, divides the data rights to obtain secret order shares, and enables each participating terminal to share electric power data with its own secret order share, which can differentiate the centralized control of data and ensure the decentralization of data rights, thereby improving the security of electric power data sharing and promoting the open sharing of electric power data.

Description

Technical Field

[0001] The present invention relates to the technical field of power data processing, and in particular to a method and device for securely sharing power data based on IPFS. Background Art

[0002] At present, in the field of power, the innovation of information technology has accelerated the networking process of power configuration and migration, and also provided a technical basis for equipment at all levels of the power system. For the power data collected by equipment at all levels of the power system, considering the confidentiality and concealment of power data, power data is widely stored in a centralized manner to centralize data rights.

[0003] However, in power data sharing, the centralization of data rights requires that power data sharers have absolute control over power data, which can easily lead to an imbalance of rights and interests between the two parties in power data sharing, make it difficult to improve the security of power data sharing, and restrict the open sharing of power data. Summary of the invention

[0004] In order to overcome the defects of the prior art, the present invention provides a method and device for secure sharing of power data based on IPFS, which can improve the security of power data sharing and promote the open sharing of power data.

[0005] In order to solve the above technical problems, in the first aspect, an embodiment of the present invention provides a method for securely sharing power data based on IPFS, comprising:

[0006] Initialize the IPFS-based DAPP system and generate public parameters of all participating nodes; wherein the participating nodes are system nodes where the participating terminals are located, and the participating terminals include the authentication server in the authentication cluster, the data holding terminal and the data access terminal in the sharing cluster;

[0007] For each of the data holding terminals, according to the public parameters of the system node where the data holding terminal is located, the data holding terminal is authenticated by the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all the data holding terminals;

[0008] For each of the data access terminals, according to the public parameters of the system node where the data access terminal is located, the data access terminal is authenticated by the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all the data access terminals;

[0009] According to the data sharing scheme collected by the authentication cluster, the system nodes where a preset number of authentication servers selected from the authentication cluster are located are used as signature nodes, and a Merkle tree is constructed according to the signatures of the shared data in the data sharing scheme by each of the signature nodes;

[0010] A Merkle root is generated according to the Merkle tree, and the shared data is encrypted using the Merkle root to obtain encrypted data. A secret key quota is generated according to the Merkle root through a system node where a main authentication server in the authentication cluster is located. The secret key quota is split into secret key shares and distributed to each of the participating terminals, so as to share power data among the participating terminals.

[0011] Furthermore, the IPFS-based power data security sharing method further includes:

[0012] In response to a data access request initiated by any of the data access terminals to any of the authentication servers, the system node where the data access terminal is currently located is used as an access node, and the system node where the authentication server is currently located is used as an authentication node;

[0013] Verifying the data access request through the authentication node, and obtaining access data from the data access request when the data access request passes the verification;

[0014] According to the data sharing scheme to which the access data belongs, taking the participating node associated with the access node as an associated node, and distributing the data access request to the participating terminals at the associated node through the authentication node;

[0015] The access data is decrypted according to the secret code share uploaded by the participating terminals at the authentication node and each of the associated nodes to obtain decrypted data, and the decrypted data is sent to the current data access terminal.

[0016] Furthermore, after the system node where the main authentication server in the authentication cluster is located generates a secret code quota according to the Merkle root, and splits the secret code quota into secret code shares and distributes them to each of the participating terminals, it also includes:

[0017] The verification result of the participating terminal on the password share is obtained, and when the verification result is a verification failure, a system node where the main authentication server in the authentication cluster is located is punished.

[0018] Furthermore, the IPFS-based power data security sharing method further includes:

[0019] When the cumulative number of penalties on the system node where the main authentication server in the authentication cluster is located exceeds a preset threshold, reselecting an authentication server from the authentication cluster as a new main authentication server;

[0020] A new password quota is generated according to the Merkle root by the system node where the new main authentication server is located, and the new password quota is split into new password shares and distributed to each of the participating terminals.

[0021] Further, for each of the data holding terminals, according to the public parameters of the system node where the data holding terminal is located, authenticating the data holding terminal through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all the data holding terminals, specifically includes:

[0022] When the data holding terminal is successfully authenticated, a first digital fingerprint and a first digital certificate are issued to the data holding terminal through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, and the first digital certificate is uploaded to IPFS.

[0023] Further, for each of the data access terminals, according to the public parameters of the system node where the data access terminal is located, the data access terminal is authenticated by the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all the data access terminals, specifically including:

[0024] When the data access terminal is successfully authenticated, a second digital fingerprint and a second digital certificate are issued to the data access terminal through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, and the second digital certificate is uploaded to IPFS.

[0025] Further, the shared data is encrypted using the Merkle root to obtain encrypted data, specifically:

[0026] Based on the AES encryption algorithm, the Merkle root is used to encrypt the shared data to obtain the encrypted data, and the encrypted data is uploaded to IPFS.

[0027] Furthermore, the generating of the secret code according to the Merkle root is specifically:

[0028] Based on a threshold algorithm, the secret order equal weight value set by the authentication cluster and the Merkle root are combined to generate the secret order equal weight.

[0029] In a second aspect, an embodiment of the present invention provides an IPFS-based power data security sharing device, comprising:

[0030] DAPP system initialization module, used to initialize the IPFS-based DAPP system and generate public parameters of all participating nodes; wherein the participating nodes are system nodes where the participating terminals are located, and the participating terminals include the authentication server in the authentication cluster, the data holding terminal and the data access terminal in the sharing cluster;

[0031] a data holding terminal authentication module, configured to authenticate each of the data holding terminals through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, according to the public parameters of the system node where the data holding terminal is located, so as to authenticate all the data holding terminals;

[0032] A data access terminal authentication module, configured to authenticate each of the data access terminals according to the public parameters of the system node where the data access terminal is located, through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all the data access terminals;

[0033] A Merkle tree construction module, for, according to the data sharing scheme collected by the authentication cluster, using a preset number of system nodes where authentication servers selected from the authentication cluster are located as signature nodes, and constructing a Merkle tree according to the signatures of the shared data in the data sharing scheme by each of the signature nodes;

[0034] A password equal quota distribution module is used to generate a Merkle root according to the Merkle tree, use the Merkle root to encrypt the shared data to obtain encrypted data, and generate password equal quotas according to the Merkle root through the system node where the main authentication server in the authentication cluster is located, split the password equal quota into password shares and distribute them to each of the participating terminals, so as to share power data among each of the participating terminals.

[0035] Furthermore, the IPFS-based power data security sharing device further includes:

[0036] A data access request response module, used to respond to a data access request initiated by any of the data access terminals to any of the authentication servers, using the system node where the data access terminal currently resides as an access node and the system node where the authentication server currently resides as an authentication node;

[0037] A data access request verification module, configured to verify the data access request through the authentication node, and obtain access data from the data access request when the data access request passes the verification;

[0038] A data access request distribution module, configured to, according to the data sharing scheme to which the access data belongs, use a participating node associated with the access node as an associated node, and distribute the data access request to participating terminals at the associated node through the authentication node;

[0039] The access data decryption and distribution module is used to decrypt the access data according to the secret code share uploaded by the participating terminal at the authentication node and each of the associated nodes, obtain decrypted data, and distribute the decrypted data to the current data access terminal.

[0040] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0041] By using the authentication cluster and the sharing cluster as collaborative participants of the IPFS-based DAPP system, the shared data in the data sharing scheme is encrypted to obtain encrypted data, and the encryption key of the shared data is used as the shared input source. The passwords generated according to the encryption key of the shared data are equally divided, and the data rights are divided to obtain password shares. Each participating terminal can share power data with its own password share, which can differentiate the control of the data center and ensure the decentralization of data rights, thereby improving the security of power data sharing and promoting the open sharing of power data. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of a method for securely sharing power data based on IPFS in the first embodiment of the present invention;

[0043] Figure 2 Another flowchart of a method for securely sharing power data based on IPFS in the first embodiment of the present invention;

[0044] Figure 3 This is a flow chart of a method for securely sharing power data based on IPFS as exemplified in the first embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the structure of an IPFS-based power data security sharing device in the second embodiment of the present invention;

[0046] Figure 5 This is another structural schematic diagram of an IPFS-based power data security sharing device in the second embodiment of the present invention. DETAILED DESCRIPTION

[0047] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] It should be noted that the step numbers in the text are only for the convenience of explaining the specific embodiments and do not limit the order of execution of the steps. The method provided in this embodiment can be executed by a relevant terminal device, and the following description is based on the processor inside the DAPP system based on IPFS as the execution subject.

[0049] like Figure 1 As shown, the first embodiment provides a method for securely sharing power data based on IPFS, including steps S1 to S5:

[0050] S1. Initialize the DAPP system based on IPFS and generate public parameters of all participating nodes; the participating nodes are system nodes where the participating terminals are located, and the participating terminals include the authentication server in the authentication cluster, the data holding terminal and the data access terminal in the sharing cluster;

[0051] S2. For each data holding terminal, according to the public parameters of the system node where the data holding terminal is located, the data holding terminal is authenticated by the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all data holding terminals;

[0052] S3, for each data access terminal, according to the public parameters of the system node where the data access terminal is located, authenticate the data access terminal through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all data access terminals;

[0053] S4. According to the data sharing scheme collected by the authentication cluster, the system nodes where a preset number of authentication servers selected from the authentication cluster are located are used as signature nodes, and a Merkle tree is constructed based on the signatures of the shared data in the data sharing scheme by each signature node;

[0054] S5. Generate a Merkle root according to the Merkle tree, use the Merkle root to encrypt the shared data, obtain the encrypted data, and generate a secret key quota according to the Merkle root through the system node where the main authentication server in the authentication cluster is located, split the secret key quota into secret key shares and distribute them to each participating terminal, so as to share the power data among the participating terminals.

[0055] It is understandable that the InterPlanetary File System (IPFS) is a network transmission protocol designed to create persistent and distributed storage and sharing of files. The technology is a content-addressable peer-to-peer hypermedia distribution protocol. The nodes in the IPFS network will constitute a distributed file system. DAPP (decentralized application) is a software application that runs publicly on the network.

[0056] The authentication cluster is composed of several authentication servers, which are peer servers with identity authentication, data sharing solution generation and service forwarding. The sharing cluster is composed of several data holding terminals and several data access terminals. The data holding terminals are user terminals that access the IPFS-based DAPP system and hold power data. The data access terminals are user terminals that access the IPFS-based DAPP system and access power data. User terminals include mobile phones, computers, tablets and other communication devices that can be connected to the server.

[0057] In this embodiment, the authentication cluster and the sharing cluster are used as collaborative participants of the IPFS-based DAPP system, the shared data in the data sharing scheme is encrypting to obtain encrypted data, and the encryption key of the shared data is used as the shared input source, and the password generated according to the encryption key of the shared data is equally divided into passwords, and the data rights are divided to obtain password shares, so that each participating terminal can share power data with its own password share, which can differentiate the control right of the data center and ensure the decentralization of data rights, thereby improving the security of power data sharing and promoting the open sharing of power data.

[0058] like Figure 2 As shown, in a preferred embodiment, the IPFS-based power data secure sharing method further includes steps S6 to S9:

[0059] S6, responding to a data access request initiated by any data access terminal to any authentication server, using the system node where the current data access terminal is located as the access node, and using the system node where the current authentication server is located as the authentication node;

[0060] S7, verifying the data access request through the authentication node, and obtaining access data from the data access request when the data access request passes the verification;

[0061] S8. According to the data sharing scheme to which the access data belongs, the participating nodes associated with the access node are used as associated nodes, and the data access request is distributed to the participating terminals at the associated nodes through the authentication node;

[0062] S9. Decrypt the access data according to the secret code share uploaded by the participating terminals at the authentication node and each associated node, obtain decrypted data, and send the decrypted data to the current data access terminal.

[0063] As an example, Figure 3 As shown, in step S1, the IPFS-based DAPP system is initialized to generate public parameters of all participating nodes, namely, the system nodes where all authentication servers in the authentication cluster are located, the system nodes where all data holding terminals in the sharing cluster are located, and the system nodes where all data access terminals in the sharing cluster are located.

[0064] The specific operations for generating the public parameters of all participating nodes are as follows:

[0065] 1. The input parameter of the IPFS-based DAPP system is pd. Participant i randomly selects two p-order cyclic groups G1 and G2 according to the cryptographic service suite through the system node where he is located. g is the generator of G1 and G2, and randomly selects SK i ∈Z p * As the master secret key, the public key of participant i is PK i , PK i =g SKi ;

[0066] 2. According to the method of operation 1, the system node where the main authentication server in the authentication cluster is located generates the public parameters of the authentication cluster. The public parameters of the authentication cluster are {g a , PK a}, where g a It is the group generator generated by the system node where the main authentication server in the authentication cluster is located for the authentication cluster. PK a It is the public key generated for the authentication cluster by the system node where the main authentication server is located in the authentication cluster;

[0067] 3. According to the method of operation 1, the system nodes where the other authentication servers in the authentication cluster are located generate their own public parameters. The main public parameters are {PK i ,cert i}, PK i It is the public key of the system node where the authentication server numbered i in the authentication cluster is located. i It is the certificate of the system node where the authentication server numbered i in the authentication cluster is located;

[0068] 4. According to each data holding terminal / data access terminal in the shared cluster, determine the corresponding authentication server in the authentication cluster, and generate a secret key pair through the system node where the authentication server is located in accordance with the method of operation 1. <PK u , S.K. u>, PK u is the public key of the data holding terminal / data access terminal numbered u in the shared cluster, and is the public parameter of the system node where the data holding terminal / data access terminal numbered u in the shared cluster is located. SK u is the private key of the data holding terminal / data access terminal numbered u in the shared cluster.

[0069] In step S2, for each data holding terminal in the shared cluster, the authentication server corresponding to the data holding terminal in the authentication cluster is determined, and the data holding terminal is authenticated through the system node where the authentication server is located according to the public parameters of the system node where the data holding terminal is located, so that when all data holding terminals in the shared cluster are successfully identified, the authentication of all data holding terminals is completed.

[0070] In step S3, for each data access terminal in the shared cluster, the authentication server corresponding to the data access terminal in the authentication cluster is determined, and the data access terminal is authenticated through the system node where the authentication server is located based on the public parameters of the system node where the data access terminal is located, thereby completing the authentication of all data access terminals when all data access terminals in the shared cluster are successfully authenticated.

[0071] The specific operations of authenticating the data access terminal / data holding terminal are as follows:

[0072] 1. The authentication information of the data access terminal / data holding terminal numbered u in the shared cluster is info u , the data access terminal / data holding terminal numbered u in the shared cluster signs its own information to be authenticated and encrypts it with the public key of the system node where its corresponding authentication server is located, and then integrates the authentication information set R u , and finally sent to the system node where its corresponding authentication server is located through a secure channel, as shown in formula (1):

[0073] R u <PK u ,sig(info u |PK u ),SK u ,e(info u |PK u )>→cas (1);

[0074] Formula (1), e(.) is asymmetric encryption, sig(.) is the information to be authenticated by the data access terminal / data holding terminal numbered u in the shared cluster. u signature;

[0075] 2. The system node cas where the authentication server is located receives the authentication information set R from the data access terminal / data holding terminal numbered u in the shared cluster. u , first decrypt it, and then use the third-party authentication to share the authentication information of the data access terminal / data holding terminal numbered u in the cluster. If the third-party authentication is passed, a digital fingerprint ID is generated for the data access terminal / data holding terminal numbered u in the shared cluster. u , and issue the certificate cert to the data access terminal / data holding terminal numbered u in the shared cluster u , and finally PK u Index cert as a palindrome u Upload to IPFS. At this time, the data access terminal / data holding terminal numbered u in the shared cluster is successfully authenticated, and PK u Add to the data set corresponding to the number u under pd.

[0076] In step S4, the successfully authenticated data holding terminal / data access terminal in the sharing cluster can interact with the authentication server in the authentication cluster to upload the data sharing plan, so that the authentication cluster collects the data sharing plan and uploads the collected data sharing plan to IPFS. According to the data sharing plan collected by the authentication cluster, the system nodes where a preset number of authentication servers selected from the authentication cluster are located are used as signature nodes, so that the system nodes where all selected authentication servers are located sign the data sharing plan, and construct a Merkle tree based on the signatures of the shared data in the data sharing plan by each signature node.

[0077] Among them, the shared data set collected by the authentication cluster is S, denoted by S=<q,sdata,n,pd,m> , q is the number of the data sharing scheme; sdata is the shared data; n is the total number of participants, n = k + j + h, k is the total number of data holding terminals, j is the total number of data access terminals, h is the total number of authentication servers, and the data holding terminals include the main station, substations and other types of data service stations; pd is the set of participants, denoted by pd = { <type i ,info i ,parmars i >|1≤i≤n}, i is the participant number, type i is the type of participant numbered i, type i When it is 0, it is the authentication server in the authentication cluster. i When it is 1, it is the data holding terminal, type i When it is 2, it is the data access terminal, info i The authentication information of the data holding terminal / data access terminal numbered i is to be authenticated, parmars iis the public parameter of the participant numbered i; m is the equal weight value of the secret order, and k+j<m<n.

[0078] The currently shared power data, that is, the shared data is sdata. The DAPP system randomly selects v authentication servers from the authentication cluster, and constructs a Merkle tree by signing the shared data sdata through the system nodes where these v authentication servers are located, with m as the secret threshold and as the system parameter.

[0079] In step S5, after the Merkle tree is constructed, a Merkle root is generated according to the Merkle tree, and the shared data is encrypted using the Merkle root to obtain encrypted data. A secret key quota is generated according to the Merkle root through the system node where the main authentication server in the authentication cluster is located, and the secret key quota is split into secret key shares and distributed to each participating terminal, so that each participating terminal can share power data together with its own secret key share.

[0080] The generated Merkle root is used as the encryption key root, and finally the shared data sdata is encrypted by AES using the encryption key root to obtain the encrypted data fdata, as shown in formula (2):

[0081] fdata=AES(merkleTree(.),{sig casi (PK casi |sdata)|0≤i≤v},sdata (2);

[0082] In formula (2), sig casi (PK casi |sdata) is the system node cas where the authentication server numbered i in the authentication cluster is located i The signature of the encrypted data fdata, and v=nkh, merkleTree(.) is the constructor of the Merkle tree.

[0083] Through the system node where the main authentication server in the authentication cluster is located, according to m, an m-order polynomial is randomly generated, as shown in formula (3):

[0084] f(x)=root+a1x+a2 2 x 2 +...+a m m x m mod p (3);

[0085] In formula (3), p is a large prime number.

[0086] Let x in formula (3) be the number of participant i, calculate f(x), and (i, f(i)) together constitute the participant's order equivalent. For the participants in the participant set pd, their order equivalent set ps is shown in formula (4):

[0087] ps={ <G i ,f(i)>|1≤i≤n} (4);

[0088] In formula (3), i is the participant number, G i is the set of calibration coefficients for participant number i, G i = <g root ,{g aj |1≤j≤m}>.

[0089] Finally, each secret share is securely sent to each participant through the system node where the main authentication server in the authentication cluster is located, and the secret share is the only credential for recovering the shared data.

[0090] In step S6, when a data access terminal initiates a data access request to an authentication server, the system node where the current data access terminal is located is used as the access node, and the system node where the current authentication server is located is used as the authentication node in response to the data access request initiated by the current data access terminal to the current authentication server.

[0091] For example, for data sharing scheme q, a data access terminal initiates a data access request to a system node cas where an authentication server is located through its system node vi, as shown in formula (5):

[0092] RQ vi <sig(SK vi |req),req>→cas (5);

[0093] In formula (5), req is the request message of the data access request, the request message includes the number q of the requested data sharing scheme, and sig(.) is the signature of the request message by the system node vi where the data access terminal is located.

[0094] In step S7, the data access request is verified by the authentication node, and when the data access request passes the verification, access data is obtained from the data access request.

[0095] In step S8, according to the data sharing scheme to which the access data belongs, the participating nodes associated with the access node are used as associated nodes, and the data access request is distributed to the participating terminals at the associated nodes through the authentication node.

[0096] Among them, the authentication node cas receives the data access request RQ viWhen , first verify the correctness of the signature, according to the PK of the access node vi vi , query its digital certificate through IPFS to verify the legitimacy of its digital certificate. If the verification fails, the request to access node vi is rejected. If the verification passes, the authentication node cas queries the data sharing plan numbered q from IPFS and verifies PK vi The elements of the participant information are stored for the shared dataset S. If the verification fails, the request is rejected. If the verification passes, the data access request is signed and broadcast to each participant in the shared dataset S.

[0097] Other participants verify the identity of the access node vi and privately receive the secret code share. Each participant receives the data access request sent by the authentication node cas, verifies the correctness of its signature, verifies the legitimacy of the identity of the access node vi through the number q, obtains the shared data set S from IPFS and verifies whether the access node vi is a subset of the shared data set S. If the verification fails, the request is rejected. If the verification succeeds, the system secret code recovery protocol is used to write the held share as a parameter into the protocol request.

[0098] In step S9, the access data is decrypted according to the password share uploaded by the participating terminals at the authentication node and each associated node to obtain decrypted data, and the decrypted data is sent to the current data access terminal.

[0099] The DAPP system helps to recover the secret code share, decrypt and receive the data. The participant number in the current data sharing scheme numbered q is i, and the secret code held is r i =f(i), for a shared data set S, i∈S, when the number of secret codes submitted by participants in the secret code recovery protocol is n s =m, then the system protocol uses the Lagrange difference formula to recover the encryption key root, as shown in formula (6):

[0100]

[0101] Let x = 0 in formula (6), and we can get root. Then the system protocol retrieves the encrypted data on IPFS, verifies the completeness of its signature, and finally decrypts the access data through AES and sends it to the visitor. At this time, the visitor can receive the data stream and access the data.

[0102] In a preferred embodiment, after the system node where the main authentication server in the authentication cluster is located generates a password quota based on the Merkle root, splits the password quota into password shares and distributes them to each participating terminal, it also includes: obtaining the verification result of the participating terminal on the password share, and when the verification result is a verification failure, punishing the system node where the main authentication server in the authentication cluster is located.

[0103] In a preferred implementation of the present embodiment, the IPFS-based power data secure sharing method further includes: when the cumulative number of penalties on the system node where the main authentication server in the authentication cluster is located exceeds a preset threshold, re-selecting an authentication server from the authentication cluster as a new main authentication server; generating new password equal amounts according to the Merkle root through the system node where the new main authentication server is located, splitting the new password equal amounts into new password shares and distributing them to each participating terminal.

[0104] As an example, after the password is equally divided into password shares and distributed to each participating terminal, the participants verify and store the password shares. After receiving the password share, participant i first verifies the correctness of the password share, and its verification equation is shown in formula (7):

[0105]

[0106] If formula (7) holds true, f(i) is a valid secret share. Participant i uses this secret share as a data authentication credential and signs a receipt to accept the secret share message. If the system node where the main authentication server in the authentication cluster is located receives and verifies n acceptance secret share messages, it writes the n signatures into the shared data set S and then uploads it to IPFS. At this time, the data sharing plan numbered q takes effect.

[0107] If formula (7) is not true, participant i will reply with a failed message and broadcast it to other participants through the consensus protocol node, and make a decision to punish the system node where the main authentication server in the authentication cluster is located. If the cumulative number of penalties on the system node where the main authentication server in the authentication cluster is located exceeds the preset threshold pu, the DAPP system protocol will reselect the main authentication server and regenerate the secret share.

[0108] This embodiment can effectively ensure the decentralization of data rights, thereby improving the security of power data sharing and promoting the open sharing of power data.

[0109] In a preferred embodiment, for each data holding terminal, according to the public parameters of the system node where the data holding terminal is located, the data holding terminal is authenticated through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all data holding terminals, specifically including: when the data holding terminal is authenticated successfully, the first digital fingerprint and the first digital certificate are issued to the data holding terminal through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, and the first digital certificate is uploaded to IPFS.

[0110] This embodiment uploads the first digital certificate to IPFS, which facilitates other participating terminals to subsequently verify the identity of the data holding terminal based on the first digital certificate.

[0111] In a preferred embodiment, for each data access terminal, based on the public parameters of the system node where the data access terminal is located, the data access terminal is authenticated through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all data access terminals, specifically including: when the authentication of the data access terminal is successful, the second digital fingerprint and the second digital certificate are issued to the data access terminal through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, and the second digital certificate is uploaded to IPFS.

[0112] This embodiment uploads the second digital certificate to IPFS, which facilitates other participating terminals to subsequently verify the identity of the data access terminal based on the second digital certificate.

[0113] In a preferred embodiment, the Merkle root is used to encrypt the shared data to obtain the encrypted data, specifically: based on the AES encryption algorithm, the Merkle root is used to encrypt the shared data to obtain the encrypted data, and the encrypted data is uploaded to IPFS.

[0114] This embodiment uses the Merkle root to encrypt shared data based on the AES encryption algorithm to obtain encrypted data, and uploads the encrypted data to IPFS, which is conducive to ensuring the confidentiality of power data.

[0115] In a preferred embodiment, the generation of password equal amounts according to the Merkle root is specifically: based on a threshold algorithm, the password equal amounts are generated in combination with the Merkle root set by the authentication cluster.

[0116] This embodiment generates a command equal amount based on a threshold algorithm combined with the command equal weight value set by the authentication cluster and the Merkle root, which is conducive to dividing the centralized control of power data to each participating terminal.

[0117] In view of the advantages of decentralized network technology, this embodiment combines the high-performance, low-cost, and high-security storage mechanism of IPFS, and is designed based on the principle of balanced data rights confirmation. In view of the drawbacks of unidirectional trust dependence and centralized data rights confirmation in data sharing, the authentication cluster is introduced as the main rights balancing mechanism. When the data sharing plan is generated, the authentication cluster generates encryption keys through the Merkle tree structure, which reduces the centralization of rights at the cluster level. Then, the shared data is encrypted with the encryption key and uploaded to IPFS to ensure data confidentiality. Finally, by generating a certifiable secret share for each participant, the centralization of data rights confirmation is removed from the participant role level, which makes The confirmation of rights of shared data is no longer centered on the data holder. When data accessors access shared data in a specific data sharing scheme, only when all participants authenticate each other and reach a consensus agreement, and jointly submit the secret code share to the DAPP system, can the final encryption key be decrypted and restored, and then the shared data can be decrypted. The equality of the secret code shares held by each participant ensures equal rights. No participant can tamper with or steal shared data by illegal means. The current shared party no longer relies on trust in the data holder. This trustless sharing mechanism ensures the balance of rights between participants, greatly protects the rights and interests of the shared party, and improves the security of power data sharing.

[0118] Based on the same inventive concept as the first embodiment, the second embodiment provides Figure 4 The device for securely sharing power data based on IPFS is shown, comprising:

[0119] DAPP system initialization module 21, used to initialize the IPFS-based DAPP system and generate public parameters of all participating nodes; wherein the participating nodes are system nodes where the participating terminals are located, and the participating terminals include the authentication server in the authentication cluster, the data holding terminal and the data access terminal in the sharing cluster;

[0120] The data holding terminal authentication module 22 is used to authenticate each data holding terminal according to the public parameters of the system node where the data holding terminal is located, through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all data holding terminals;

[0121] The data access terminal authentication module 23 is used to authenticate each data access terminal according to the public parameters of the system node where the data access terminal is located, through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all data access terminals;

[0122] The Merkle tree construction module 24 is used to use the system nodes where a preset number of authentication servers selected from the authentication cluster are located as signature nodes according to the data sharing scheme collected by the authentication cluster, and to construct a Merkle tree according to the signatures of the shared data in the data sharing scheme by each signature node;

[0123] The command equal quota distribution module 25 is used to generate a Merkle root according to the Merkle tree, use the Merkle root to encrypt shared data, obtain encrypted data, and generate command equal quotas according to the Merkle root through the system node where the main authentication server in the authentication cluster is located, and split the command equal quota into command shares and distribute them to each participating terminal to share power data among the participating terminals.

[0124] like Figure 5 As shown, in a preferred embodiment, the IPFS-based power data security sharing device further includes:

[0125] The data access request response module 26 is used to respond to a data access request initiated by any data access terminal to any authentication server, and use the system node where the current data access terminal is located as the access node and the system node where the current authentication server is located as the authentication node;

[0126] A data access request verification module 27, used to verify the data access request through the authentication node, and obtain access data from the data access request when the data access request passes the verification;

[0127] The data access request distribution module 28 is used to distribute the data access request to the participating terminals at the associated nodes through the authentication nodes according to the data sharing scheme to which the access data belongs, taking the participating nodes associated with the access node as associated nodes;

[0128] The access data decryption and distribution module 29 is used to decrypt the access data according to the secret code share uploaded by the participating terminals at the authentication node and each associated node, obtain the decrypted data, and distribute the decrypted data to the current data access terminal.

[0129] In a preferred embodiment, the password equal quota distribution module 25 is also used to generate password equal quotas according to the Merkle root at the system node where the main authentication server in the authentication cluster is located, split the password equal quota into password shares and distribute them to each participating terminal, and then obtain the verification result of the password share by the participating terminal, and when the verification result is verification failure, punish the system node where the main authentication server in the authentication cluster is located.

[0130] In a preferred implementation of the present embodiment, the password equal quota distribution module 25 is also used to re-select an authentication server from the authentication cluster as a new main authentication server when the cumulative number of penalties on the system node where the main authentication server is located in the authentication cluster exceeds a preset threshold; generate new password equal quotas according to the Merkle root through the system node where the new main authentication server is located, split the new password equal quota into new password shares and distribute them to each participating terminal.

[0131] In a preferred embodiment, the data holding terminal authentication module 22 is specifically used to send a first digital fingerprint and a first digital certificate to the data holding terminal through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located when the data holding terminal authentication is successful, and upload the first digital certificate to IPFS.

[0132] In a preferred embodiment, the data access terminal authentication module 23 is specifically used to send a second digital fingerprint and a second digital certificate to the data access terminal through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located when the data access terminal authentication is successful, and upload the second digital certificate to IPFS.

[0133] In a preferred embodiment, the secret code equal distribution module 25 is specifically used to encrypt shared data based on the AES encryption algorithm using the Merkle root to obtain encrypted data and upload the encrypted data to IPFS.

[0134] In a preferred embodiment, the password equal-amount distribution module 25 is specifically used to generate password equal-amounts based on a threshold algorithm in combination with the password equal-weight value set by the authentication cluster and the Merkle root.

[0135] In summary, the implementation of the embodiments of the present invention has the following beneficial effects:

[0136] By using the authentication cluster and the sharing cluster as collaborative participants of the IPFS-based DAPP system, the shared data in the data sharing scheme is encrypted to obtain encrypted data, and the encryption key of the shared data is used as the shared input source. The passwords generated according to the encryption key of the shared data are equally divided, and the data rights are divided to obtain password shares. Each participating terminal can share power data with its own password share, which can differentiate the control of the data center and ensure the decentralization of data rights, thereby improving the security of power data sharing and promoting the open sharing of power data.

[0137] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

[0138] Those skilled in the art can understand that all or part of the processes in the above embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

Claims

1. A method for secure sharing of power data based on IPFS, characterized in that: include: Initialize the IPFS-based DAPP system and generate public parameters for all participating nodes; wherein the participating node is the system node where the participating terminal is located, and the participating terminal includes the authentication server in the authentication cluster, the data holding terminal and the data access terminal in the sharing cluster; the public parameters include the public key generated for the authentication cluster by the system node where each authentication server in the authentication cluster is located, the group generator generated for the authentication cluster by the system node where the main authentication server is located, the certificates of the system nodes where the remaining authentication servers are located except the main authentication server, the public key of the data holding terminal and the public key of the data access terminal; For each of the data holding terminals, according to the public parameters of the system node where the data holding terminal is located, the data holding terminal is authenticated by the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all the data holding terminals; For each of the data access terminals, according to the public parameters of the system node where the data access terminal is located, the data access terminal is authenticated by the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all the data access terminals; According to the data sharing scheme collected by the authentication cluster, the system nodes where a preset number of authentication servers selected from the authentication cluster are located are used as signature nodes, and a Merkle tree is constructed according to the signatures of the shared data in the data sharing scheme by each of the signature nodes; A Merkle root is generated according to the Merkle tree, and the shared data is encrypted using the Merkle root to obtain encrypted data. A secret key quota is generated according to the Merkle root through a system node where a main authentication server in the authentication cluster is located. The secret key quota is split into secret key shares and distributed to each of the participating terminals, so as to share power data among the participating terminals.

2. The method for securely sharing power data based on IPFS as claimed in claim 1, characterized in that: Also includes: In response to a data access request initiated by any of the data access terminals to any of the authentication servers, the system node where the data access terminal is currently located is used as an access node, and the system node where the authentication server is currently located is used as an authentication node; Verifying the data access request through the authentication node, and obtaining access data from the data access request when the data access request passes the verification; According to the data sharing scheme to which the access data belongs, taking the participating node associated with the access node as an associated node, and distributing the data access request to the participating terminals at the associated node through the authentication node; The access data is decrypted according to the secret code share uploaded by the participating terminals at the authentication node and each of the associated nodes to obtain decrypted data, and the decrypted data is sent to the current data access terminal.

3. The method for securely sharing power data based on IPFS as claimed in claim 1, characterized in that: After the system node where the main authentication server in the authentication cluster is located generates a secret code quota according to the Merkle root, and the secret code quota is split into secret code shares and distributed to each of the participating terminals, the method further includes: The verification result of the participating terminal on the password share is obtained, and when the verification result is a verification failure, a system node where the main authentication server in the authentication cluster is located is punished.

4. The method for securely sharing power data based on IPFS as claimed in claim 3, characterized in that: Also includes: When the cumulative number of penalties on the system node where the main authentication server in the authentication cluster is located exceeds a preset threshold, reselecting an authentication server from the authentication cluster as a new main authentication server; A new password quota is generated according to the Merkle root by the system node where the new main authentication server is located, and the new password quota is split into new password shares and distributed to each of the participating terminals.

5. The method for securely sharing power data based on IPFS as claimed in claim 1, characterized in that: The step of authenticating each of the data holding terminals according to the public parameters of the system node where the data holding terminal is located by using the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, so as to authenticate all the data holding terminals, specifically includes: When the data holding terminal is successfully authenticated, a first digital fingerprint and a first digital certificate are issued to the data holding terminal through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, and the first digital certificate is uploaded to IPFS.

6. The method for securely sharing power data based on IPFS according to claim 1, characterized in that: The step of authenticating each of the data access terminals according to the public parameters of the system node where the data access terminal is located by authenticating the data access terminal through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all the data access terminals, specifically includes: When the data access terminal is successfully authenticated, a second digital fingerprint and a second digital certificate are issued to the data access terminal through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, and the second digital certificate is uploaded to IPFS.

7. The method for securely sharing power data based on IPFS as claimed in claim 1, characterized in that: The shared data is encrypted using the Merkle root to obtain encrypted data, specifically: Based on the AES encryption algorithm, the Merkle root is used to encrypt the shared data to obtain the encrypted data, and the encrypted data is uploaded to IPFS.

8. The method for securely sharing power data based on IPFS as claimed in claim 1, characterized in that: The generation of the secret code according to the Merkle root is specifically: Based on a threshold algorithm, the secret order equal weight value set by the authentication cluster and the Merkle root are combined to generate the secret order equal weight.

9. A power data security sharing device based on IPFS, characterized in that: include: DAPP system initialization module, used to initialize the IPFS-based DAPP system and generate public parameters of all participating nodes; wherein the participating node is the system node where the participating terminal is located, and the participating terminal includes the authentication server in the authentication cluster, the data holding terminal and the data access terminal in the sharing cluster; the public parameters include the public key generated for the authentication cluster by the system node where each authentication server in the authentication cluster is located, the group generator generated for the authentication cluster by the system node where the main authentication server is located, the certificates of the system nodes where the remaining authentication servers are located except the main authentication server, the public key of the data holding terminal and the public key of the data access terminal; a data holding terminal authentication module, configured to authenticate each of the data holding terminals through the system node where the authentication server corresponding to the data holding terminal in the authentication cluster is located, according to the public parameters of the system node where the data holding terminal is located, so as to authenticate all the data holding terminals; A data access terminal authentication module, configured to authenticate each of the data access terminals according to the public parameters of the system node where the data access terminal is located, through the system node where the authentication server corresponding to the data access terminal in the authentication cluster is located, so as to authenticate all the data access terminals; A Merkle tree construction module, for, according to the data sharing scheme collected by the authentication cluster, using a preset number of system nodes where authentication servers selected from the authentication cluster are located as signature nodes, and constructing a Merkle tree according to the signatures of the shared data in the data sharing scheme by each of the signature nodes; A password equal quota distribution module is used to generate a Merkle root according to the Merkle tree, use the Merkle root to encrypt the shared data to obtain encrypted data, and generate password equal quotas according to the Merkle root through the system node where the main authentication server in the authentication cluster is located, split the password equal quota into password shares and distribute them to each of the participating terminals, so as to share power data among each of the participating terminals.

10. The IPFS-based power data security sharing device according to claim 9, characterized in that: Also includes: A data access request response module, used to respond to a data access request initiated by any of the data access terminals to any of the authentication servers, using the system node where the data access terminal currently resides as an access node and the system node where the authentication server currently resides as an authentication node; A data access request verification module, configured to verify the data access request through the authentication node, and obtain access data from the data access request when the data access request passes the verification; A data access request distribution module, configured to, according to the data sharing scheme to which the access data belongs, use a participating node associated with the access node as an associated node, and distribute the data access request to participating terminals at the associated node through the authentication node; The access data decryption and distribution module is used to decrypt the access data according to the secret code share uploaded by the participating terminal at the authentication node and each of the associated nodes, obtain decrypted data, and distribute the decrypted data to the current data access terminal.

Images