A trusted authentication method for data sharing based on blockchain

Abstract

The present invention discloses a data sharing trusted authentication method based on blockchain, which includes the following steps: S1: a data sharing user U1 sends a data sharing request R1 to a notarization authority and a data storage service provider; S2: NA and S verify R1, S allocates storage space to U1 whose request is legal, and sends the request processing result to a smart contract; S3: the smart contract verifies the request processing result, generates a data sharing certificate for the user, and stores the hash value of the certificate in a blockchain; S4: U1 sends a data storage request to S, S verifies the request and stores data for the user; S5: a data access user U2 sends R2 to U1; S6: U1 verifies R2, generates a data access certificate for the user corresponding to the legal request and stores the hash value of the certificate in the blockchain; S7: U2 sends a data access request to S, S verifies the request and completes data access for U2; S8: U1 controls U2's access rights through a certificate revocation list.

Description

Technical Field

[0001] The present invention relates to the technical field of trusted authentication for blockchain and secure data sharing, and specifically to a data sharing trusted authentication method based on blockchain. Background Art

[0002] Data sharing is a scheme for data owners to share their data with other users. The data sharing system provides data storage and access services in a semi-trusted environment. Users store their personal academic resources, medical records and other data in a third-party centralized storage server, and the storage server provides data access services. The data storage server can efficiently manage data and improve the convenience of data flow, but the premise is that users must trust that the data storage server will not take malicious actions against user data. In addition, shared data often involves important sensitive information of users, so it is necessary to provide access control lists for the data to ensure secure access to the data. In traditional schemes, attribute-based cryptographic schemes are usually introduced to achieve secure access control of data, and attribute authorities are also introduced to manage keys, but these additional cryptographic schemes often increase the overhead and burden of the system, and cannot get rid of the trust in some third-party institutions and data storage servers.

[0003] The emergence of blockchain technology can effectively solve the centralized trust problem of the system. It also provides a shareable transparent transaction history ledger to ensure that data will not be maliciously tampered with, allowing users who do not trust each other to reach a consensus on immutable and auditable data blocks without the participation of a third party. In addition, smart contracts are technologies extended on the basis of blockchain. They are executable programs running on blockchains, which can also be used as ordinary transaction content of blockchains and are packaged and published on the blockchain network. The nodes on the blockchain network automatically execute the program according to the logic in the smart contract, and this process is executed in a closed black box without human intervention and access. In addition, PKI is a technology widely used for identity authentication in the HTTPS protocol. It is an effective identity authentication technology, but the trust of the entity depends on the SSL / TLS certificate issued by the CA. Therefore, there may be problems such as CA single point failure and untrustworthy certificates, and traditional PKI is not suitable for data sharing solutions. To this end, we use blockchain and smart contracts to transform the traditional PKI model to apply to data sharing solutions, and propose a data sharing trusted authentication method based on blockchain. Summary of the invention

[0004] The purpose of the present invention is to provide a blockchain-based data sharing trusted authentication method to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] A data sharing trusted authentication method based on blockchain, comprising the following steps:

[0007] S1: The data sharing user constructs a four-tuple set of data sharing requests based on the data content to be shared, and sends the data sharing request to the notary authority and the data storage service provider;

[0008] S2: After receiving the data sharing request, the notary authority and the data storage service provider will check the legitimacy of the fields in the data sharing request. After all fields are verified, the data storage service provider will allocate data storage space to the data sharing user who initiated the request. The notary authority and the data storage service provider will generate a digital signature for the data sharing request and send their respective responses to the data sharing request to the smart contract.

[0009] S3: After receiving the response from the notarization authority and the data storage service provider, the smart contract verifies the specific data content in the response. After all responses are verified, the smart contract constructs the corresponding data sharing certificate according to the specific content of the data sharing request and the response to the data sharing request, sends the complete data sharing certificate to the data sharing user corresponding to the request, and generates a hash value corresponding to the data sharing certificate and stores it on the blockchain;

[0010] S4: After receiving the data sharing certificate, the data sharing user generates a hash value of the data sharing certificate, and then compares it with the hash value corresponding to the data sharing certificate on the blockchain to verify the validity of the data sharing certificate. The valid data sharing certificate, encrypted data content and corresponding digital signature are used to construct a data storage request, and the data storage request is sent to the data storage service provider. After receiving the data storage request, the data storage service provider verifies the data sharing certificate and digital signature in the data storage request, stores the encrypted data content for the user corresponding to the legal data storage request, and finally returns a bool type response result and a string type prompt information to the data sharing user;

[0011] S5: The data access user sends a data access certificate request to the data sharing user according to his / her data access needs;

[0012] S6: After receiving the data access certificate request from the data access user, the data sharing user verifies whether the data content in the data access certificate request is legal, generates a corresponding data access certificate for the legal data access certificate request, sends the data access certificate to the data access user, and then generates a hash value of the data access certificate and stores it on the blockchain;

[0013] S7: After receiving the data access certificate, the data access user generates a hash value of the data access certificate, and then compares it with the hash value corresponding to the data access certificate on the blockchain to verify the validity of the data access certificate. Then, the data access request is constructed using the valid data access certificate and the corresponding digital signature, and sent to the data storage service provider. After receiving the data access request, the data storage service provider verifies the data access certificate and digital signature in the data access request, completes the corresponding access operation for the data access corresponding to the legal data access request, and finally returns a bool type response result and a string type prompt information to the data access user;

[0014] S8: The data sharing user uses the certificate revocation list corresponding to the data sharing certificate to complete the authority control of the data access user.

[0015] Preferably, the content of the data sharing request in S1 is as follows: since the data sharing user sends a data sharing request, the certificate type is selected as a data sharing certificate; the data sharing user calculates the Byte size of the required shared data, and enters the corresponding data storage payment amount in the data sharing request, unit: Gwei; enter additional JSON format extended information content, and then uniformly encode it with Base64. The above four types of information constitute a four-tuple set of data sharing requests. In addition, after the data sharing user sends the data sharing request to the notary authority and the data storage service provider, the notary authority and the data storage service provider can obtain the blockchain account address of the data sharing user.

[0016] In the preferred S2, the contents of verifying the data sharing request and processing the response to the data sharing request are as follows: the notarial authority and the data storage service provider each verify whether the certificate type in the data sharing request is a data sharing certificate, whether the data size is legal, and whether the amount paid by the data sharing user who sends the data sharing request meets the corresponding data size. After the above contents are verified, the notarial authority and the data storage service provider select a signature algorithm to generate a digital signature for the data sharing request. The data storage service provider also allocates storage space for the data sharing user and returns a storage location index related to the data sharing user address. The response returned by the notarial authority includes: signature algorithm, digital signature, and the response returned by the data storage service provider includes: signature algorithm, digital signature, and storage address.

[0017] Preferably, in S3, the main contents of the response verification and data sharing certificate are as follows: the smart contract parses the digital signature according to the signature algorithm in the response to determine whether the signer is the notarization authority or data storage service provider that returns the response; the smart contract extracts the content in the legitimate data sharing request and response to construct a data sharing certificate, which includes the signature algorithm, digital signature, storage address, signer address, data sharing user's address, data information, and then converts the data sharing certificate into a JSON string, generates a hash value of the data sharing certificate through Keccak256, and stores it on the blockchain.

[0018] Preferably, in S4, the triplet set of data storage request includes:

[0019] Complete data sharing certificate, encrypted data, and digital signature of the certificate by the data sharing user using the private key;

[0020] The data storage service provider verifies the following:

[0021] Parse the digital signature to obtain the signer address, determine whether the signer address is consistent with the address of the sender of the data storage request, then obtain the hash value of the corresponding data sharing certificate on the blockchain, calculate whether the hash value of the data sharing certificate in the data storage request and the hash value of the corresponding data sharing certificate on the blockchain are equal, and thereby determine the validity of the data sharing certificate.

[0022] Preferably, in S5, the four-tuple set of data access certificate request includes:

[0023] Certificate type, requester address, data access type, data information.

[0024] Preferably, the structure of the data access certificate in S6 mainly includes:

[0025] Signature algorithm, certificate type, corresponding data sharing certificate, requester address, data storage address, digital signature, access type, and encrypted data decryption key.

[0026] Preferably, in S7, the triplet set of data access request includes:

[0027] Data access certificate, digital signature, data information;

[0028] The data storage service verification content is as follows:

[0029] Parse the digital signature to determine whether the data access certificate belongs to the requester, calculate the hash value of the data access certificate, compare it with the hash value of the corresponding data access certificate on the blockchain, and then determine whether the data access certificate is valid based on the certificate revocation list to which the data access certificate belongs.

[0030] Preferably, in S8, the content of the certificate revocation list includes:

[0031] The data sharing certificate to which it belongs; the serial number of the data access certificate to be revoked; the digital signature of the data sharing user on the revoked data access certificate.

[0032] The beneficial effects of the present invention are:

[0033] The present invention does not adopt complex access strategies and cryptographic algorithms in its overall design, and also realizes the security features necessary for a data sharing system. The method of the present invention can be connected to a traditional data sharing system. It only needs to provide the system entity with an interactive interface related to the present invention, and the system can be expanded without changing the original system structure. Therefore, it can be applied to general data sharing solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a schematic diagram of the steps of the data sharing method according to an embodiment of the present invention;

[0035] Figure 2 is a network system diagram of an embodiment of the present invention;

[0036] Figure 3 It is an entity interaction diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Example

[0039] See also Figure 1-3 The blockchain-based data sharing trusted authentication method provided by the embodiment of the present invention includes the following steps:

[0040] S1: Data sharing user U1 calculates the encrypted shared data size size and the corresponding amount value to be paid, then selects the certificate type ct of the sharing request, enters the additional message content ext, constructs the data sharing request set R1 = (ct, size, value, ext), and sends the request to the notary authority NA and the data storage service provider S. Because the recipient can obtain the user's address in the received request, there is no need to enter the user's address in the request.

[0041] S2: After receiving the request R1, the notary authority NA and the data storage service provider S extract the user address UA1 that sent the data sharing request, check whether ct in the data sharing request is a data sharing certificate type, and whether the input data size size corresponds to the payment amount value. If the above data sharing request contents are verified, the data storage service provider S will allocate storage space for the data sharing requester U1, and the storage address is expressed in the format of / str / UA1. The notary authority NA and the data storage service provider S use their respective signature algorithms alg and private keys sk to generate a digital signature signature = Signalg (content, sk) for the request, and construct the data sharing request processing result as a response set Rp = (alg, strAddr, signature, content, rpAddr), and send it to the smart contract;

[0042] S3: The smart contract receives the response collection array Rps = [(alg, strAddr, signature, content, rpAddr), (alg, signature, content, rpAddr)], parses the two corresponding collections in the array, verifies whether the sender address rpAddr of the response is the notarization authority NA and data storage service provider S set when the system is initialized; verifies the signature signature in the response according to the signature algorithm alg specified in the response, and determines whether the signer is the notarization authority NA and data storage service provider S set when the system is initialized to ensure the credibility of the request processing. After the above content is verified, the smart contract aggregates the content in the response collection array, constructs the data sharing certificate structure DSC = (num, (alg1, alg2), content, (rpAddr1, rpAddr2), (signature1, signature2), strAddr, UA1), sends DSC to U1, and calculates the hash value of the data sharing certificate DSC through the hash function Keccak256 (JSON (DSC)), and stores it on the blockchain. Data sharing users can obtain the hash value ocH of the data sharing certificate on the chain through the interface call;

[0043] S4: After receiving DSC, data sharing user U1 calculates the hash value of the data sharing certificate DSC through the hash function Keccak256 (JSON (DSC)), and then obtains the hash value ocH of the on-chain certificate through the interface call, and compares whether the two hash values ​​are equal to ensure that the certificate is complete and credible. After the certificate verification is passed, data sharing user U1 encrypts the data with its own private key sk1, sk2, signs DSC, constructs a data storage request set A (DSC, Signsk1 (DSC), Encsk2 (data)), and sends it to the data storage service provider S; after receiving request A, data storage service provider S calculates the hash value of the data sharing certificate DSC through the hash function Keccak256 (JSON (DSC)), and then obtains the hash value ocH of the on-chain certificate through the interface call, and compares whether the two hash values ​​are equal to ensure that the certificate is complete and credible, and then verifies the signature through the requester's public key pk1 to ensure that the requester is the owner of the data sharing certificate. After the above information is verified, the data storage service provider S stores the encrypted data for the data sharing user according to the data storage address strAddr, and returns the data storage result to the data sharing user U1;

[0044] S5: Data access user U2 inputs the data sharing certificate type ct, data sharing certificate serial number sNum, access type acsT ("READ", "UPDATE", "DEL"), and public key pk1 used to encrypt sk2 according to his own data access needs, constructs a data access certificate request R2 (ct, sNum, acsT, pk1), and sends it to data sharing user U1;

[0045] S6: After receiving the data access certificate request R2, the data sharing user U1 determines whether the sender UA2 of the data access certificate request is the access user permitted by him, and whether ct is the data access certificate type. After the above information is verified, the data encryption key sk1 is encrypted with pk1 to obtain encKey, and the data access certificate DAC (num, alg, ct, dscNum, UA2, signature, acsT, strAddr, encKey, content) is constructed, and DAC is sent to U2. The hash value of the data sharing certificate DAC is calculated through the hash function Keccak256 (JSON (DAC)) and stored on the blockchain. The data sharing user can obtain the hash value ocH of the data access certificate on the chain through the interface call;

[0046] S7: After receiving DAC, data access user U2 calculates the hash value of the data sharing certificate DSC through the hash function Keccak256 (JSON (DSC)), and then obtains the hash value ocH of the on-chain data access certificate through an interface call, and compares whether the two hash values ​​are equal to ensure that the certificate is complete and credible. After the data access certificate is verified, data access user U2 uses his private key sk to digitally sign DAC, construct a data access request set B (DAC, Signsk1 (DAC), content), and send it to the data storage service provider S; after receiving the data access request B, data storage service provider S calculates the hash value of the data access certificate DAC through the hash function Keccak256 (JSON (DAC)), and then obtains the hash value ocH of the on-chain certificate through an interface call, and compares whether the two hash values ​​are equal to ensure that the data access certificate is complete and credible. Then verify the signature through the public key pk of the data access requester to ensure that the data access requester is the certificate owner himself. Finally, check whether the certificate revocation list CRL to which the data access certificate belongs has revoked the certificate. After the above information is verified, the data storage service provider S returns the corresponding access result to the data access user U2 according to the data storage address strAddr. The data access user U2 uses his private key sk to decrypt the encKey in the data access certificate DAC, obtains the data decryption key, and finally uses the decryption key to obtain the original data content.

[0047] S8: The data sharing user U1 can set the array of data access certificates to be revoked DACs = [DAC1, DAC2, ..., DACn] and the signatures Signatures = [Signature1, Signature2, ..., Signaturen] for each revoked certificate in the certificate revocation list CRL corresponding to the data sharing certificate DSC. The data access certificate DAC appearing in the CRL indicates that it has been revoked. Using the revoked data sharing certificate to access the data storage service will cause the access to fail.

[0048] The above-mentioned embodiment of the present invention refers to the traditional PKI technology to specially design the data sharing certificate DSC and data access certificate DAC suitable for the data sharing system, and introduces the notarization authority NA in combination with the data storage service provider S to ensure the trusted authentication of the data sharing user identity and the data sharing certificate DSC. By introducing the blockchain to endorse the system certificate, the centralized trust problem of the data storage service provider S is solved, and the smart contract is used to complete the issuance of the data sharing certificate DSC and the verification and authentication operations required for some interactions. The present invention does not adopt complex access strategies and cryptographic algorithms in the overall design, and also realizes the necessary security features for a data sharing system, and can connect the method of the present invention to the traditional data sharing system, and only needs to provide the interactive interface related to the present invention for the entity of the system, and realize the expansion of the system without changing the original system structure, so it can be applied to general data sharing solutions.

[0049] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data sharing trusted authentication method based on blockchain, characterized in that: The steps include: S1: The data sharing user constructs a four-tuple set of data sharing requests based on the data content to be shared, and sends the data sharing request to the notary authority and the data storage service provider; S2: After receiving the data sharing request, the notary authority and the data storage service provider will check the legitimacy of the fields in the data sharing request. After all fields are verified, the data storage service provider will allocate data storage space to the data sharing user who initiated the request. The notary authority and the data storage service provider will generate a digital signature for the data sharing request and send their respective responses to the data sharing request to the smart contract. S3: After receiving the response from the notarization authority and the data storage service provider, the smart contract verifies the specific data content in the response. After all responses are verified, the smart contract constructs the corresponding data sharing certificate based on the specific content of the data sharing request and the response to the data sharing request, sends the complete data sharing certificate to the data sharing user corresponding to the request, and generates a hash value corresponding to the data sharing certificate and stores it on the blockchain; S4: After receiving the data sharing certificate, the data sharing user generates a hash value of the data sharing certificate, and then compares it with the hash value corresponding to the data sharing certificate on the blockchain to verify the validity of the data sharing certificate. The valid data sharing certificate, encrypted data content and corresponding digital signature are used to construct a data storage request, and the data storage request is sent to the data storage service provider. After receiving the data storage request, the data storage service provider verifies the data sharing certificate and digital signature in the data storage request, stores the encrypted data content for the user corresponding to the legal data storage request, and finally returns a bool type response result and a string type prompt information to the data sharing user; S5: The data access user sends a data access certificate request to the data sharing user according to his / her data access needs; S6: After receiving the data access certificate request from the data access user, the data sharing user verifies whether the data content in the data access certificate request is legal, generates a corresponding data access certificate for the legal data access certificate request, sends the data access certificate to the data access user, and then generates a hash value of the data access certificate and stores it on the blockchain; S7: After receiving the data access certificate, the data access user generates a hash value of the data access certificate, and then compares it with the hash value corresponding to the data access certificate on the blockchain to verify the validity of the data access certificate. Then, the data access request is constructed using the valid data access certificate and the corresponding digital signature, and sent to the data storage service provider. After receiving the data access request, the data storage service provider verifies the data access certificate and digital signature in the data access request, completes the corresponding access operation for the data access corresponding to the legal data access request, and finally returns a bool type response result and a string type prompt information to the data access user; S8: The data sharing user uses the certificate revocation list corresponding to the data sharing certificate to complete the authority control of the data access user.

2. The data sharing trusted authentication method based on blockchain according to claim 1 is characterized in that: In step S1, the content of the data sharing request is as follows: since the data sharing user sends a data sharing request, the certificate type is selected as a data sharing certificate; the data sharing user calculates the Byte size of the required shared data and enters the corresponding data storage payment amount in the data sharing request, in units of Gwei; additional JSON format extended information content is entered and then uniformly encoded in Base64. The above certificate type, data size, data storage payment amount and extended information constitute a four-tuple set of data sharing requests. In addition, after the data sharing user sends the data sharing request to the notary authority and the data storage service provider, the notary authority and the data storage service provider can obtain the blockchain account address of the data sharing user.

3. The data sharing trusted authentication method based on blockchain according to claim 1 is characterized in that: In step S2, the contents of verifying the data sharing request and processing the response to the data sharing request are as follows: the notarial authority and the data storage service provider each verify whether the certificate type in the data sharing request is a data sharing certificate, whether the data size is legal, and whether the amount paid by the data sharing user who sent the data sharing request meets the corresponding data size. After the above contents are verified, the notarial authority and the data storage service provider select a signature algorithm to generate a digital signature for the data sharing request. The data storage service provider also allocates storage space for the data sharing user and returns a storage location index related to the data sharing user address; The response returned by the notarization authority includes: signature algorithm, digital signature, and the response returned by the data storage service provider includes: signature algorithm, digital signature, and storage address.

4. The data sharing trusted authentication method based on blockchain according to claim 3 is characterized in that: In step S3, the main contents of the response verification and data sharing certificate are as follows: the smart contract parses the digital signature according to the signature algorithm in the response to determine whether the signer is the notarization authority or data storage service provider that returns the response; the smart contract extracts the content in the legitimate data sharing request and response to construct a data sharing certificate, which includes the signature algorithm, digital signature, storage address, signer address, data sharing user's address, data information, and then converts the data sharing certificate into a JSON string, generates a hash value of the data sharing certificate through Keccak256, and stores it on the blockchain.

5. The data sharing trusted authentication method based on blockchain according to claim 4 is characterized in that: In step S4, the triple set of data storage request includes: Complete data sharing certificate, encrypted data, and digital signature of the certificate by the data sharing user using the private key; The data storage service provider verifies the following: Parse the digital signature to obtain the signer address, determine whether the signer address is consistent with the address of the sender of the data storage request, then obtain the hash value of the corresponding data sharing certificate on the blockchain, calculate whether the hash value of the data sharing certificate in the data storage request and the hash value of the corresponding data sharing certificate on the blockchain are equal, and judge the validity of the data sharing certificate.

6. The data sharing trusted authentication method based on blockchain according to claim 1 is characterized in that: In the step S5, The four-tuple set of data access certificate request includes: certificate type, requester address, data access type, and data information.

7. The data sharing trusted authentication method based on blockchain according to claim 1 is characterized in that: The structure of the data access certificate in step S6 mainly includes: Signature algorithm, certificate type, corresponding data sharing certificate, requester address, data storage address, digital signature, access type, and encrypted data decryption key.

8. The blockchain-based data sharing trusted authentication method according to claim 1 is characterized in that: In step S7, the triplet set of data access request includes: Data access certificate, digital signature, data information; The data storage service verification content is as follows: Parse the digital signature to determine whether the data access certificate belongs to the requester, calculate the hash value of the data access certificate, compare it with the hash value of the corresponding data access certificate on the blockchain, and then determine whether the data access certificate is valid based on the certificate revocation list to which the data access certificate belongs.

9. The data sharing trusted authentication method based on blockchain according to claim 1 is characterized in that: In step S8, the content of the certificate revocation list includes: The data sharing certificate to which it belongs; the serial number of the data access certificate to be revoked; the digital signature of the data sharing user on the revoked data access certificate.

Images