A Personal Privacy Protection Method Based on Blockchain Traceability

Abstract

The present invention discloses a method for personal privacy protection based on blockchain traceability, which relates to the technical field of privacy protection. The specific content includes: system initialization, key generation, data encryption, data decryption, policy update, decryption key verification, and path tracing. The present invention is applicable to privacy protection and fine-grained data sharing on the blockchain, and greatly improves the efficiency of the original traceable CP-ABE scheme in terms of computing and storage costs. The present invention can not only track malicious users who leak private keys, but also prevent the illegal sharing and abuse of keys. In addition, the present invention allows the update of access control policies so that data owners can flexibly modify access control policies.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection, and more specifically, to a personal privacy protection method based on blockchain traceability. Background Art

[0002] A blockchain is a distributed peer-to-peer network that can prevent personal privacy data from being transmitted through third-party service institutions, improve data transmission speed, and reduce transmission latency. To securely store and transmit these data to ensure their integrity, validity, and authenticity, access control has also become an important research content for the secure sharing of personal privacy data. Therefore, many scholars have combined blockchain technology with existing access control models and carried out a series of research works. Zyskind and Nathan combined the discretionary access control model (DAC) and managed off-chain sensitive data through access control policies on the blockchain. Cruz et al. used the blockchain to solve the cross-organization access control problem in the role-based access control model (RBAC) and realized cross-organization authentication of user roles. Maesa et al. extended the standard workflow of the attribute-based access control model (ABAC), replaced the traditional database with the blockchain to store policies, and managed access policies in the form of transactions. However, the above methods are only applicable to specific scenarios, with single access control and not suitable for the one-to-many encryption scenario in personal information access.

[0003] Currently, the attribute-based encryption algorithm (ABE) is considered a method to solve the problem of secure access control. ABE is developed on the basis of IBE (Identity-based Encryption), and is particularly suitable for the one-to-many encryption scenario. When the decryptor meets certain requirements specified by the encryptor, the decryptor can successfully decrypt the ciphertext she / he wants to access. The ABE algorithm not only ensures the confidentiality of data, but also provides fine-grained access control for data. Therefore, in an environment where personal information needs to be shared, the ABE encryption algorithm can effectively solve the problem of secure access control for outsourced data.

[0004] ABE has a wide range of application scenarios, and many variants of the ABE scheme, including key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE), have been proposed. In the scenario of realizing one-to-many encrypted data sharing, the CP-ABE scheme is often used. However, the low efficiency of this scheme seriously hinders its application in practice. Bethencourt et al. proposed a CP-ABE scheme, which is suitable for practical applications due to its simple tree structure. In addition to the tree access structure, there are other ABE structures based on AND gates and linear secret sharing scheme (LSSS) matrices. In the application of the CP-ABE scheme, key abuse is one of the problems that data users may leak private key information to illegal users.

[0005] The protection of personal privacy information has increasingly become a hot issue of current concern, and the application of Internet technology has made the protection of personal information very difficult. Traditional personal information protection technologies can no longer fully guarantee the security of personal information. Therefore, how to protect personal information is an urgent problem for those skilled in the art to solve. Summary of the Invention

[0006] In view of this, the present invention provides a method for protecting personal privacy based on blockchain traceability to overcome the above defects.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A method for protecting personal privacy based on blockchain traceability, the specific steps are as follows:

[0009] System initialization: Initialize Shamir's threshold sharing scheme INS t,n Obtain the system public key PK and the master private key MSK;

[0010] Data encryption: Encrypt the message m with the first symmetric key k to generate the message ciphertext CT m , upload the message ciphertext CT m and the LSSS matrix access policy (M, ρ) to the IPFS storage server for storage; Generate the ciphertext CT according to the LSSS matrix access policy (M, ρ) and the first symmetric key k, and upload it to the blockchain for storage; Select a random number s from the mapping combination of the prime group attribute set and generate the random ciphertext Enc k' (s);

[0011] Key generation: Generate the decryption key according to the system public key PK, the master private key MSK, the user identity ID, and the user attribute set

[0012] Data decryption: Calculate the first symmetric key k by performing calculations on the ciphertext CT, the system public key PK, and the decryption key and decrypt the message ciphertext CT according to the first symmetric key k m to obtain the message m;

[0013] Policy update: Update the LSSS matrix access policy (M, ρ) to the to-be-updated access policy (M', ρ'), and decrypt the random ciphertext Enc k' (s) to obtain the random number s; Obtain the to-be-updated ciphertext CT' according to the to-be-updated access policy (M', ρ'), the random number s, and the RSA signature σ;

[0014] Policy Verification: Verify the correctness of the RSA signature σ through the RSA signature verification algorithm, compare the ciphertext CT' to be updated with the ciphertext CT to determine whether it holds; if it holds, obtain the updated ciphertext CT”; generate the updated policy block A' according to the updated ciphertext CT”.

[0015] Decryption Key Verification: According to the system public key PK, the system master private key MSK, and the decryption key Perform formal verification on the decryption key and perform corresponding operations according to the verification result;

[0016] Path Tracing: If the verification is successful, extract the user identity ID according to the decryption key

[0017] Optionally, the expression of the system public key PK is:

[0018]

[0019] where g and w are both random numbers in the prime group ; u, a, and b are all random numbers in the mapping combination of the prime group attribute set ; and are respectively the bilinear pair e and the prime group of order p obtained by the system operation group generation algorithm; H is the hash function.

[0020] Optionally, the expression of the master private key MSK is:

[0021] MSK = {α, a, b, u, k1, k2};

[0022] where α, u, a, and b are all random numbers in the mapping combination of the prime group attribute set ; k1 and k2 are both keys of the probabilistic encryption algorithm.

[0023] Optionally, the expression of the decryption key is:

[0024]

[0025] where K, K', L, and SK are all decryption key parameters; is the decryption key for any attribute in the user attribute set.

[0026] Optionally, the decryption process is specifically as follows:

[0027] Obtain the ciphertext CT;

[0028] Calculate the row set of the matrix according to the access policy of the user to be read;

[0029] ​Determine whether the parameter attributes in the row set satisfy the LSSS matrix access policy (M, ρ) of the ciphertext CT. If not, output ⊥; if so, obtain the first symmetric key k;

[0030] Decrypt the message ciphertext CT according to the first symmetric key k m Obtain the message m.

[0031] Optionally, the decryption process expression is:

[0032]

[0033] In the formula, e(·) represents a bilinear mapping; K, K', L, SK are all decryption key parameters; C is the ciphertext encrypted by the first symmetric key k; C i is; C1, C2 are both ciphertext parameters of the key ciphertext CT1; g, w are both random numbers of the prime group random numbers; σ is an RSA signature; c, α, u, a, b, h are all mapping combinations of the prime group attribute set random numbers; s is a random number; w i constant; H is a hash function; is the decryption key of any attribute in the user attribute set; attr i represents any one of the attributes in the user attribute set.

[0034] Optionally, the expression of the ciphertext CT' to be updated is:

[0035] CT' = {C, (M', ρ'), C'0, C'1, C'2, {C' i} i∈[l]};

[0036] In the formula, (M', ρ') is the access policy to be updated; C is the ciphertext encrypted by the first symmetric key k; C'0, C'1, C'2, C' i are all ciphertext parameters; l is the number of rows of M.

[0037] Optionally, the expression of the updated ciphertext CT” is:

[0038]

[0039] In the formula, C is the ciphertext encrypted by the first symmetric key k; C' i , C0, C1, C2 are all ciphertext parameters of the key ciphertext CT1.

[0040] Optionally, the condition for verifying the decryption key is:

[0041]

[0042] e(Sk, gb ) = e(w a w K′ , g b )(H(0) || 1 || 1 || 1), L);

[0043] e(K, g a g K′ ) = e(g, g) α e(g b , W a+K′ );

[0044] Wherein, K, K', L, and SK are all decryption key parameters; e(·) represents a bilinear mapping; α, a, and b are all random numbers of the prime group attribute set mapping combination ; g and w are both random numbers of the prime group ; H is a hash function.

[0045] Optionally, the specific steps of path tracing are as follows:

[0046] Obtain K' from the decryption key , and calculate

[0047] Judge whether (x', y') belongs to {(x1, y1), (x2, y2),...(x t-1 , y t-1 ), if so, obtain the user identity ID according to ; if not, combine the points (x1, y1), (x2, y2), …(x t-1 , y t-1 ) and (x', y') to recover the secret value a of INS t-1,n through the Lagrange interpolation formula * ;

[0048] Judge whether to output the user identity ID according to the secret value a * ;

[0049] Wherein, x and y are the coordinate values of any point; K' is a decryption key parameter.

[0050] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses a blockchain-based traceable personal privacy protection method, which is applicable to privacy protection and fine-grained data sharing on the blockchain, and greatly improves the efficiency of the original traceable CP-ABE scheme in terms of computing and storage costs; the present invention can not only track malicious users who leak private keys, but also prevent illegal sharing and abuse of keys; in addition, the present invention allows updating access control policies so that data owners can flexibly modify access control policies. Description of the Drawings

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained according to the provided drawings.

[0052] Figure 1 It is a schematic flowchart of the method of the present invention;

[0053] Figure 2 It is a schematic diagram of the operation process of the present invention. Detailed implementation manners

[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0055] Embodiment 1

[0056] An embodiment of the present invention discloses a method for protecting personal privacy based on blockchain traceability, as Figure 1 and Figure 2 shown, including the following steps:

[0057] Step 1) System initialization. (1 λ ) → (PK, MSK): The system runs a group generation algorithm to obtain a bilinear pair e and a prime group of order p and Define U as the attribute set, and then map the attribute set U to the combination Randomly select Randomly select a hash function This algorithm selects a probabilistic encryption algorithm (Enc, Dec) with two different keys k1 and k2. The system initializes Shamir's threshold sharing scheme INS t-1 , y t-1 ) by selecting a polynomial f(x) of degree t - 1 and storing t - 1 points (x1, y1), (x2, y2),... (x t,n ). The system public key PK and the master private key MSK are set as follows:

[0058]

[0059] MSK = {α, a, b, u, k1, k2};

[0060] Step 2) Encryption. (PK, ID, m, (M, ρ)) → (CT m , CT): Input the public key PK, the message m, and the LSSS matrix access policy (M, ρ). The data owner first sends his / her ID to the authority, which generates an RSA signature σ for the ID. Assume the matrix M has l rows and n columns, and the function ρ maps the matrix M to the user attribute set, and defines M i,j as the (i, j)-th element (the j-th column of the i-th row) of the matrix M. The data owner selects a symmetric key and encrypts the message m with k to obtain CT m = Enc k (m), and then uploads CT m and (M, ρ) to the IPFS storage server for storage. In addition, the restriction for storage is that the data user can obtain the message ciphertext CT from IPFS only when the attributes of the data user satisfy the access policy (M, ρ) m . Next, select a random number and pre-encrypt it using the symmetric encryption algorithm with the key k' and save it as the random ciphertext Enc k' (s). Encrypt the symmetric key k used for message encryption using the attribute-based encryption algorithm as follows.

[0061] (M, ρ), C = ke(g, g) σαs , C0 = g σs ;

[0062] C1 = g σas , C2 = g σbs ;

[0063]

[0064] The ciphertext is set as CT = {CT1, CT2}, where the key ciphertext CT1 = {C, C0, C1, C2}, and the access policy ciphertext CT2 = {(M, ρ), C i} i∈[l] . Finally, the ciphertext CT1 is stored as the transaction block TX, and the ciphertext CT2 is stored as the policy block A.

[0065] Step 3) Key generation. The user submits his / her identity ID, the attribute set (where attr i represents an attribute in the user attribute set) to the authority. The authority uses the system public key PK and the master private key MSK to generate the user's key. Calculate x = Enc k (ID), y = f(x), Randomly select to generate the decryption key for the user As follows:

[0066]

[0067] The decryption key of the user is set to:

[0068]

[0069] Step 4) Decryption. The data user accesses the blockchain, obtains the ciphertext CT1 from the blockchain transaction block TX, and obtains the ciphertext CT2 from the latest access policy block A corresponding to the transaction block TX. The data user first calculates the row set of the matrix M, that is where the attributes corresponding to the rows belong to the elements in the user attribute set If the user's attribute set satisfies the access policy in the ciphertext CT, the data user can calculate a set of constants {ω i} i∈I satisfying ∑ i∈I ω i M i =(1, 0, 0, …, 0), where M i is the i-th row of the matrix. Otherwise, the decryption algorithm outputs ⊥. The decryption process is as follows:

[0070]

[0071] The data user calculates the symmetric key k = C / Y, and then uses the key k to decrypt the ciphertext CT downloaded from the storage server m , and obtains the message m.

[0072] Correctness:

[0073]

[0074] Step 5) Update the policy. (σ, Enc k′ (s), (M′, ρ′)) → CT′: Input the signature σ, the pre-saved Enc k′ (s) and the access policy (M′, ρ′) to be updated. Then output the updated ciphertext CT′. The data owner first updates the access policy (M, ρ) corresponding to CT in IPFS to (M′, ρ′). Then, the data owner uses the symmetric key k′ to decrypt Enc m (s) to obtain s, and then calculates CT′ as follows: k′ (s) to obtain s, and then calculates CT′ as follows:

[0075] C′0 = g σs , C′1 = g σas , C′2 = g σbs ;

[0076]

[0077] The ciphertext CT′ = {C, (M′, ρ′), C′0, C′1, C′2, {C′ i} i∈[l]}.

[0078] Step 6) Policy verification. (σ, CT′) → CT”: Input the signature σ and the ciphertext CT′. The blockchain node first verifies the correctness of the signature σ through the RSA signature verification algorithm, and then checks whether C′0 = C0, C′1 = C1, and C'2 = C2 hold. If they hold, the ciphertext is updated to CT” = {C, C0, C1, C2, {C′ i} i∈[l]}. Then upload {C' i} i∈[l] to generate a new policy block A'.

[0079] Step 7) Key check. Input the system public key PK, the system master private key MSK, and the user's decryption key User key in the form of which is first verified by the authoritative agency for the following three conditions:

[0080] 1)

[0081] 2) e(SK, g b ) = e(w a w K , g b )e(H(0)||1||1||1), L);

[0082] 3) e(K, g a g K′ ) = e(g, g) α e(g b , w a+K′ );

[0083] If the key meets the three conditions, return 1; otherwise, return 0.

[0084] Step 8) Path tracing. If the output of the key check algorithm is 0, the output of the path tracing algorithm is ⊥. Otherwise, it indicates that is a well - formed key, so the ID can be extracted from the following operations.

[0085] 1) The path tracing algorithm first obtains K′ from the user's key , and then obtains Let (x′ = x, y′ = y).

[0086] 2) If (x′, y′) ∈ {(x1, y1), (x2, y2), … (x t-1 , y t-1 )}, then calculate Otherwise, go to step (3).

[0087] 3) The algorithm combines the points (x1, y1), (x2, y2), … (x t-1 , y t-1 ) and (x′, y′) to recover the secret value a of INS t-1,n using the Lagrange interpolation formula. * . It verifies whether a * = f(0) holds. If it holds, then calculate Otherwise, the output of the algorithm is ⊥.

[0088] Example 2

[0089] As Figure 2 shown, first the system is initialized. The system runs a group generation algorithm to obtain a bilinear pairing e and a prime group of order p and Define U as the attribute set, and then map the attribute set U to the combination The algorithm selects a probabilistic encryption algorithm (Enc, Dec) with two different keys k1 and k2. The system initializes Shamir's threshold sharing scheme INS t-1 , y t-1 ) by selecting a polynomial f(x) of degree t–1 and storing t-1 points (x1, y1), (x2, y2), … (x t-1,n . The system public key PK and the master secret key MSK are set as follows:

[0090]

[0091] MSK = {α, a, b, u, k1, k2};

[0092] The privacy owner submits his / her ID to the authorization agency, and the authorization agency returns the signature σ of the privacy owner to the privacy owner. The user submits his / her identity ID and the attribute set to the authority. Using the system public key PK and the master secret key MSK, the authority generates the user's key. Calculate y = f(x), Randomly select to generate the decryption key for the user as follows.

[0093]

[0094] The decryption key of the user is set to:

[0095]

[0096] The symmetric key k of the privacy owner and the access policy (M, ρ) generate the ciphertext CT through ciphertext-policy attribute-based encryption (CP-ABE). The generated ciphertext CT is divided into CT1 and CT2, which are stored in the blockchain as the transaction block TX and the access policy block A respectively. Input the public key PK, the message m, and the LSSS matrix access policy (M, ρ). The data owner first sends his / her ID to the authority to generate the RSA signature σ for the ID. Assume that the matrix M has l rows and n columns, and the function ρ maps the matrix M to the user attribute set, and define M i,j as the (i, j)-th element of the matrix M. The data owner selects a symmetric key to encrypt the message m with k as CT m = Enc k (m), and then upload CT m and (M, ρ) to IPFS for storage. In addition, the restriction on the storage server is that the data user can obtain CT m from IPFS only when the attributes of the data user satisfy the access policy (M, ρ). Next, randomly select and pre-encrypt it using the symmetric encryption algorithm with the key k' and save it as Enc k' (s). Encrypt the symmetric key k used for message encryption using the attribute-based encryption algorithm as follows:

[0097] (M, ρ), C = ke(g, g) σαs , C0 = gσs ;

[0098] C1 = g σαs , C2 = g σbs ;

[0099]

[0100] The ciphertext is set to CT = {CT1, CT2}, where the key ciphertext CT1 = {C, C0, C1, C2}, and the access policy ciphertext CT2 = {(M, ρ), C i} i∈[l] . Finally, the ciphertext CT1 is stored as the transaction block TX, and the ciphertext CT2 is stored as the policy block A.

[0101] The cloud platform will encrypt the personal privacy data CT encrypted with the symmetric key k mStored in the IPFS server; the blockchain is used to store the encrypted k and access policies, which can achieve data anti-tampering and flexible modification of access control policies. Input the signature σ, the pre-saved Enc k′ (s) and the access policy (M′, ρ′) to be updated. Then output the updated ciphertext CT′. The data owner first uploads the cloud CT m corresponding access policy (M, ρ) to (M′, ρ′). Then, the data owner decrypts Enc k′ (s) with the symmetric key k′ to obtain s, and then calculates CT′ as follows.

[0102] C′0 = g σs , C′1 = g σas , C′2 = g σbs ;

[0103]

[0104] The ciphertext CT′ = {C, (M′, ρ′), C′0, C′1, C′2, {C′ i} i∈[l]}.

[0105] Enterprises or users who access user privacy need to submit their identity ID and the set of attributes they possess to the authorization agency, and the authorization agency will generate the corresponding key and return it to the applicant. After that, the privacy applicant can try to obtain k and decrypt the privacy data through Input the system public key PK, the system master private key MSK, and the user's decryption key The user key in the form of is first verified by the authoritative agency for the following three conditions:

[0106] 1)

[0107] 2) e(SK, g b ) = e(w a w K′ , g b ) e(H(0)|‖1||1||1), L);

[0108] 3) e(K, g a g K′ ) = e(g, g) α e(g b , w a+K′ );

[0109] If the key meets the three conditions, return 1, otherwise return 0.

[0110] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for personal privacy protection based on blockchain traceability, characterized in that, The specific steps are as follows: System initialization: Initialize Shamir's threshold sharing scheme INS t,n Obtain the system public key PK and the master private key MSK; Data Encryption: Encrypt the message m using the first symmetric key k to generate the ciphertext CT of the message m , and upload the ciphertext CT of the message m and the LSSS matrix access policy (M, ρ) to the IPFS storage server for storage; Generate ciphertext CT according to the LSSS matrix access policy (M, ρ) and the first symmetric key k, and upload it to the blockchain for storage; Mapping combination from the prime group attribute set Select a random number s from it, and generate a random ciphertext Enc k' (s); Key Generation: Generate a decryption key based on the system public key PK, the master private key MSK, the user identity ID, and the user attribute set Generate the decryption key Data decryption: By performing calculations on the ciphertext CT, the system public key PK, and the decryption key to obtain the first symmetric key k, and decrypting the message ciphertext CT according to the first symmetric key k m to obtain the message m; Policy update: Update the LSSS matrix access policy (M, ρ) to the access policy to be updated (M′, ρ′), and decrypt the random ciphertext Enc with the second symmetric key k'. k' (s) Obtain a random number s; Obtain the ciphertext CT′ to be updated according to the access policy to be updated (M′, ρ′), the random number s, and the RSA signature σ; Policy verification: The blockchain node first verifies the correctness of the signature σ through the RSA signature verification algorithm, and then compares whether C′0 = C0, C′1 = C1, C′2 = C2 hold. If they hold, the ciphertext is updated to CT” = {C, C0, C1, C2, {C′ i} i∈[l]}, and then uploads {C′ i} i∈[l] Generate a new policy block A′; Decryption key Verification: According to the system public key PK, the system master private key MSK, and the decryption key For the decryption key Perform formal verification, and according to the verification result, execute the corresponding operation; Path tracing: If the verification is successful, according to the decryption key Extract the user identity ID; The expression of the ciphertext CT' to be updated is: CT′ = {C, (M′, ρ′), C′0, C′1, C′2, {C′ i} i∈[l]}; where (M′, ρ′) is the access policy to be updated; C is the ciphertext encrypted with the first symmetric key k; C′0, C′1, C′2, C′ i are all ciphertext parameters; l is the number of rows of M; The expression of the updated ciphertext CT'' is: "CT" = {C, C0, C1, C2, {C' i} i∈[l]}; Where C is the ciphertext encrypted by the first symmetric key k; C' i , C0, C1, and C2 are all ciphertext parameters of the ciphertext CT1 of the key.

2. The method for protecting personal privacy based on blockchain traceability according to claim 1, wherein The expression of the system public key PK is: Wherein, both g and w are random numbers of a prime group ; u, a, and b are all mapping combinations of prime group attribute sets random numbers; and are respectively the bilinear pair e and the prime group of order p obtained by the system operation group generation algorithm; H is a hash function.

3. A method for protecting personal privacy based on blockchain traceability according to claim 1, characterized in that, The expression of the master private key MSK is: MSK = {α, a, b, u, k1, k2}; where α, u, a, and b are all mapping combinations of the prime group attribute set random numbers; k1 and k2 are both keys of the probabilistic encryption algorithm.

4. A method for protecting personal privacy based on blockchain traceability according to claim 1, characterized in that, The expression of the decryption key is: Wherein, K, K′, L, and SK are all decryption key parameters; is the decryption key for any attribute in the user attribute set.

5. A method for protecting personal privacy based on blockchain traceability according to claim 1, characterized in that, The specific decryption process is: The data user accesses the blockchain, obtains ciphertext CT1 from the blockchain transaction block TX, and obtains ciphertext CT2 from the latest access policy block A corresponding to the transaction block TX; The data user first calculates the row set of matrix M, that is where the attributes corresponding to the rows belong to the user attribute set and are elements in If the user's attribute set satisfies the access policy of the ciphertext CT, the data user can calculate a set of constants {ω i} i∈I satisfying ∑ i∈I ω i M i =(1, 0, 0, …, 0), where M i is the i-th row of the matrix; the data user calculates the symmetric key k = C / Y; Otherwise, the decryption algorithm outputs ⊥; Decrypt the ciphertext CT downloaded from the storage server using the key k m to obtain the message m.

6. A method for protecting personal privacy based on blockchain traceability according to claim 1, characterized in that The expression of the decryption process is: Where, e(·) represents a bilinear mapping; K, K′, L, and SK are all decryption key parameters; C is the ciphertext encrypted by the first symmetric key k; C i , C1, and C2 are all ciphertext parameters of the ciphertext CT1 of the key; g and w are both random numbers of the prime group ; σ is an RSA signature; c, α, u, a, b, and h are all mapping combinations of the prime group attribute set random numbers; s is a random number; ω i is a constant; H is a hash function; is the decryption key of any attribute in the user attribute set; attr i represents any one attribute in the user attribute set; 7. A method for protecting personal privacy based on blockchain traceability according to claim 1, characterized in that Decryption key The verification condition is: e(SK,g b ) = e(w a w K′ ,g b )e(H(0)||1||1||1),L); e(K,g a g K′ ) = e(g,g) α e(g b ,w a+K′ ); where K, K′, L, and SK are all decryption key parameters; e(·) represents a bilinear mapping; α, a, and b are all mapping combinations of prime group attribute sets random numbers; g and w are both prime groups random numbers; H is a hash function.

8. A method for protecting personal privacy based on blockchain traceability according to claim 1, characterized in that, The specific steps of path tracing are: Obtain K′ from the decryption key and obtain The path tracing algorithm first obtains K′ from the user's secret key and then obtains Let (x′ = x, y′ = y); Determine whether (x′, y′) belongs to {(x1, y1), (x2, y2), … (x t-1 , y t-1 )}, if so, obtain the user identity ID according to ID = ; if not, combine the points (x1, y1), (x2, y2), … (x t-1 , y t-1 ) and (x′, y′) to recover the secret value a of INS t-1,n through the Lagrange interpolation formula * ; Based on the secret value a * Determine whether to output the user identity ID; Where x and y are the coordinate values of any point; K' is the decryption key parameter.

Images