Data processing method, system and device

Abstract

The present disclosure provides a data processing method, system and device, the method comprising: each distribution authorization device generating a business private key according to a business identity of a business terminal device, a distribution private key of the distribution authorization device and a target attribute set of the distribution authorization device, and sending the business private key to the business terminal device; the business terminal device performing digital signature on business operation data by using a business attribute set, the business private key, a system public key and a distribution public key of the distribution authorization device to obtain signature data, and sending the signature data and the business operation data to a supervision terminal device; and the supervision terminal device verifying the signature data by using a target attribute set, a supervision attribute set, the system public key, the business operation data and the distribution public key. In the present disclosure, when part of the distribution authorization devices are attacked and the distribution private key is leaked, the security of the business private key of the business terminal device can be ensured, the security of the attribute private key of the business terminal device is ensured, and the data security of the business operation data is improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the technical field of digital signature, and particularly relate to a data processing method, system and device. BACKGROUND

[0002] With the rapid development of network communication technology, two devices can transmit data through a network, and there is a risk of data tampering, forgery and impersonation in the network. Digital signature technology is an asymmetric encryption technology that can avoid such risks and ensure data security.

[0003] In the prior art, the digital signature process can include: first, a third-party private key generation device generates a public key and a private key, and sends the private key to a sender user and the public key to all users; then, the sender user digitally signs enterprise operation data to be transmitted through the private key to obtain signature data, and transmits the signature data and the enterprise operation data to a receiver user; finally, the receiver user verifies the signature data through the public key, and after verification, the receiver user can modify the enterprise operation data, otherwise, the receiver user cannot modify the enterprise operation data.

[0004] However, the above digital signature scheme has the problem of poor security. SUMMARY

[0005] Embodiments of the present disclosure provide a data processing method, system and device to improve the security of enterprise operation data.

[0006] In a first aspect, embodiments of the present disclosure provide a data processing method applied to a data processing system, the data processing system comprising: at least two distributed authorization devices, an enterprise end device and a supervision end device, the method comprising:

[0007] Each of the distributed authorization devices generates an enterprise private key according to an enterprise identity of the enterprise end device, a distributed private key of the distributed authorization device and a target attribute set of the distributed authorization device, and sends the enterprise private key to the enterprise end device;

[0008] The enterprise end device digitally signs enterprise operation data to be sent through the enterprise private key, a system public key, a distributed public key of the distributed authorization device and the target attribute set, to obtain signature data, and sends the signature data and the enterprise operation data to the supervision end device;

[0009] The supervision end device verifies the signature data through the target attribute set of each of the distributed authorization devices, a supervision attribute set of the supervision end device, a system public key, the enterprise operation data and a distributed public key of the distributed authorization device.

[0010] Optionally, the each distribution authorization device generates an enterprise private key according to the enterprise identity of the enterprise terminal device, a distribution private key of the distribution authorization device, and a target attribute set of the distribution authorization device, comprising:

[0011] For each distribution authorization device, a polynomial function is determined according to the corresponding attribute number threshold and the enterprise identity, wherein an order of the polynomial function is the attribute number threshold minus 1, and a constant term of the polynomial function is obtained by inputting the enterprise identity into a pseudo-random function of the distribution authorization device;

[0012] For each distribution authorization device, each target attribute in the corresponding target attribute set is input into the corresponding polynomial function to obtain first polynomial data corresponding to each target attribute, respectively;

[0013] For each distribution authorization device, a first signature private key is generated according to the corresponding first polynomial data and the target attribute corresponding distribution private key of the distribution private key of the distribution authorization device;

[0014] A second signature private key is generated according to a system private key, the enterprise identity, and the polynomial function corresponding to each distribution authorization device;

[0015] For each distribution authorization device, a corresponding enterprise private key is generated according to the corresponding first signature private key and the second signature private key.

[0016] Optionally, the second signature private key is generated according to the system private key, the enterprise identity, and the polynomial function corresponding to each distribution authorization device, comprising:

[0017] For each distribution authorization device, the enterprise identity is input into the corresponding polynomial function to obtain second polynomial data;

[0018] The second signature private key is generated according to a sum of the second polynomial data corresponding to each distribution authorization device, respectively, and the system private key.

[0019] Optionally, the enterprise terminal device performs digital signature on enterprise operation data to be sent through the enterprise private key, a system public key, and a distribution public key of the distribution authorization device, and the target attribute set, to obtain signature data, comprising:

[0020] For each target attribute in the target attribute set corresponding to the distribution authorization device, first signature information is generated according to the target attribute, the first signature private key, and the system public key;

[0021] generating second signature information according to the target attribute and the distribution public key of the distribution authorization device;

[0022] generating third signature information according to the second signature private key, the system public key and the enterprise operation data;

[0023] generating fourth signature information according to the system public key;

[0024] generating the signature data according to the first signature information, the second signature information, the third signature information and the fourth signature information.

[0025] Optionally, the supervision terminal device verifies the signature data through the target attribute set of each distribution authorization device, the supervision attribute set of the supervision terminal device, the system public key, the enterprise operation data and the distribution public key of the distribution authorization device, and the verification includes:

[0026] For each distribution authorization device, determining the intersection of the corresponding target attribute set and the supervision attribute set of the supervision terminal device to determine the number of distribution authorization devices whose attribute number in the intersection is greater than or equal to the attribute number threshold of the distribution authorization device;

[0027] If the number of distribution authorization devices is less than the device number threshold, determining that the verification fails;

[0028] If the number of distribution authorization devices is greater than or equal to the device number threshold, performing bilinear verification according to the signature data, the system public key, the enterprise operation data, the intersection, and the distribution public key.

[0029] Optionally, the data processing system further includes a central authorization device, and the method further includes:

[0030] The central authorization device generates a distribution private key, a distribution public key and an attribute number threshold for each distribution authorization device, the distribution private key of the distribution authorization device is associated with the target attribute set of the distribution authorization device, the distribution public key of the distribution authorization device is associated with the distribution private key of the distribution authorization device, and the attribute number threshold is randomly generated;

[0031] The central authorization device sends the distribution private key and the attribute number threshold to the corresponding distribution authorization device;

[0032] The central authorization device sends the distribution public key to the supervision terminal device and the enterprise terminal device, and sends the attribute number threshold to the supervision terminal device.

[0033] Optionally, the method further includes:

[0034] The central authorization device randomly generates a system public key and a system private key;

[0035] The central authorization device sends the system public key to the enterprise terminal device and the supervision terminal device;

[0036] The central authorization device sends the system private key to the supervision terminal device.

[0037] In a second aspect, the embodiments of the present disclosure provide a data processing system, comprising: at least two distributed authorization devices, an enterprise terminal device and a supervision terminal device;

[0038] Each of the distributed authorization devices is configured to generate an enterprise private key according to an enterprise identity of the enterprise terminal device, a distributed private key of the distributed authorization device and a target attribute set of the distributed authorization device, and send the enterprise private key to the enterprise terminal device;

[0039] The enterprise terminal device is configured to perform digital signature on enterprise operation data to be sent by using the enterprise private key, a system public key and a distributed public key of the distributed authorization device, and a target attribute set, to obtain signature data, and send the signature data and the enterprise operation data to the supervision terminal device;

[0040] The supervision terminal device is configured to verify the signature data by using a target attribute set of each of the distributed authorization devices, a supervision attribute set of the supervision terminal device, a system public key, the enterprise operation data, and a distributed public key of the distributed authorization device.

[0041] Optionally, each of the distributed authorization devices is further configured to:

[0042] determine a polynomial function according to a corresponding attribute number threshold and the enterprise identity, wherein an order of the polynomial function is the attribute number threshold minus 1, and a constant term of the polynomial function is obtained by inputting the enterprise identity into a pseudo-random function of the distributed authorization device;

[0043] input each target attribute in the corresponding target attribute set into the corresponding polynomial function respectively, to obtain first polynomial data corresponding to each target attribute respectively;

[0044] generate a first signature private key according to the corresponding first polynomial data and the target attribute corresponding distributed private key in the distributed private key of the distributed authorization device;

[0045] generate a second signature private key according to the system private key, the enterprise identity and the polynomial function corresponding to each of the distributed authorization devices;

[0046] generate a corresponding enterprise private key according to the corresponding first signature private key and the second signature private key.

[0047] Optionally, each of the distribution authorization devices is further configured to:

[0048] input the enterprise identity into the corresponding polynomial function to obtain second polynomial data;

[0049] generate the second signature private key according to a sum of the second polynomial data corresponding to each of the distribution authorization devices and the system private key.

[0050] Optionally, the enterprise-side device is further configured to:

[0051] for each target attribute in the target attribute set corresponding to the distribution authorization device, generate first signature information according to the target attribute, the first signature private key and the system public key;

[0052] generate second signature information according to the target attribute and the distribution public key of the distribution authorization device;

[0053] generate third signature information according to the second signature private key, the system public key and the enterprise operation data;

[0054] generate fourth signature information according to the system public key;

[0055] generate the signature data according to the first signature information, the second signature information, the third signature information and the fourth signature information.

[0056] Optionally, the supervision-side device is further configured to:

[0057] for each of the distribution authorization devices, determine an intersection of the corresponding target attribute set and a supervision attribute set of the supervision-side device, to determine a number of distribution authorization devices whose attribute number in the intersection is greater than or equal to an attribute number threshold of the distribution authorization device;

[0058] if the number of the distribution authorization devices is less than a device number threshold, determine that the verification fails;

[0059] if the number of the distribution authorization devices is greater than or equal to the device number threshold, perform bilinear verification according to the signature data, the system public key, the enterprise operation data, the intersection, the distribution public key.

[0060] Optionally, the data processing system further comprises a center authorization device, and the center authorization device is further configured to:

[0061] generate a distribution private key, a distribution public key and an attribute number threshold for each of the distribution authorization devices, the distribution private key of the distribution authorization device being associated with a target attribute set of the distribution authorization device, the distribution public key of the distribution authorization device being associated with the distribution private key of the distribution authorization device, and the attribute number threshold being randomly generated;

[0062] send the distribution private key and the attribute number threshold to the corresponding distribution authorization device;

[0063] send the distribution public key to the supervision end device and the enterprise end device, and send the attribute number threshold to the supervision end device.

[0064] Optionally, the center authorization device is further configured to:

[0065] randomly generate a system public key and a system private key;

[0066] send the system public key to the enterprise end device and the supervision end device;

[0067] send the system private key to the supervision end device.

[0068] In a third aspect, the embodiments of the present disclosure further provide an electronic device, comprising at least one processor and a memory;

[0069] the memory stores computer-executable instructions;

[0070] the at least one processor executes the computer-executable instructions stored in the memory, so that the electronic device implements the method of the first aspect.

[0071] In a fourth aspect, the embodiments of the present disclosure further provide a computer-readable storage medium, which stores computer-executable instructions, and when a computing device executes the computer-executable instructions, the computing device implements the method of the first aspect.

[0072] In a fifth aspect, the embodiments of the present disclosure further provide a computer program product for executing the method of the first aspect.

[0073] The data processing method, system and device provided by the embodiments of the present disclosure include: each distributed authorization device generates an enterprise private key according to an enterprise identity of an enterprise terminal device, a distributed private key of the distributed authorization device and a target attribute set of the distributed authorization device, and sends the enterprise private key to the enterprise terminal device; the enterprise terminal device performs digital signature on to-be-sent enterprise operation data by using an enterprise attribute set, the enterprise private key, a system public key and a distributed public key of the distributed authorization device, to obtain signature data, and sends the signature data and the enterprise operation data to a supervision terminal device; and the supervision terminal device verifies the signature data by using a target attribute set of each distributed authorization device, a supervision attribute set of the supervision terminal device, the system public key, the enterprise operation data and a distributed public key of the distributed authorization device. When part of the distributed authorization devices are attacked and the distributed private key is leaked, the embodiments of the present disclosure can also ensure the security of the enterprise private key of the enterprise terminal device, thereby ensuring the security of the attribute private key of the enterprise terminal device, and further improving the data security of the enterprise operation data. BRIEF DESCRIPTION OF DRAWINGS

[0074] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, further serve to explain the principles of the present disclosure.

[0075] Figure 1 FIG. 1 is a structural schematic diagram of a data processing system provided by the embodiments of the present disclosure;

[0076] Figure 2 FIG. 2 is a sequence schematic diagram of four algorithms in a data processing process provided by the embodiments of the present disclosure;

[0077] Figure 3 FIG. 3 is a step flowchart of a data processing method provided by the embodiments of the present disclosure.

[0078] The above-described drawings have shown specific embodiments consistent with the present disclosure, and more detailed descriptions will be given hereinafter. These drawings and descriptions are not intended to limit the scope of the concept of the present disclosure by any means, but to illustrate the concept of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0079] The exemplary embodiments will be described in detail herein with reference to the drawings. Unless otherwise specified, the same or similar components in different drawings are denoted by the same reference numerals, and repeated descriptions thereof will be omitted. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Rather, they are merely examples of devices and methods consistent with some aspects of the present disclosure, as detailed in the appended claims.

[0080] The data processing system of the embodiment of the present disclosure is used for digitally signing enterprise operation data to be sent, so as to ensure the security of the enterprise operation data in the process of sending the enterprise operation data from the enterprise to the regulatory department. Figure 1 is a structural schematic diagram of a data processing system provided by the embodiment of the present disclosure. Referring to Figure 1 the data processing system 100 of the embodiment of the present disclosure includes a central authorized device 101, at least two distributed authorized devices 102, an enterprise terminal device 103, and a regulatory terminal device 104. Figure 1 The central authorized device 101, the enterprise terminal device 103, and the regulatory terminal device 104 in the embodiment of the present disclosure can also be multiple, and the embodiment of the present disclosure takes one as an example for description.

[0081] The data processing process of the above data processing system includes four algorithms, Figure 2 is a sequence schematic diagram of the four algorithms in the data processing process provided by the embodiment of the present disclosure. Referring to Figure 2 the above four algorithms of the embodiment of the present disclosure include a system initialization algorithm, an enterprise key generation algorithm, a digital signature algorithm, and a signature verification algorithm.

[0082] The central authorized device 101 is a management device of the entire data processing system, and is used for executing the above system initialization algorithm to generate a system public key and a system private key, and sending the system public key and the system private key to the enterprise terminal device 103 and the regulatory terminal device 104. The central authorized device 101 is also used for generating a distributed private key and a distributed public key for each distributed authorized device 102, and sending the distributed private key and the distributed public key to the corresponding distributed authorized device 102.

[0083] Optionally, when the system initialization algorithm is executed, a security parameter needs to be input by a system administrator. When the input security parameter is correct, the system public key and the system private key can be generated. When the input security parameter is incorrect, the system public key and the system private key are not generated. It can be seen that the security parameter can be used for identity verification of the system administrator, so as to avoid non-system administrator operation on the data processing system, and the security of the data processing system is protected.

[0084] Each distributed authorized device 102 is used for executing the above enterprise key generation algorithm to generate an enterprise private key and an enterprise public key for an enterprise according to a target attribute set managed by itself, and the terminal device corresponding to the enterprise is referred to as the enterprise terminal device 103, so that the distributed authorized device 102 needs to send the enterprise private key and the enterprise public key to the corresponding enterprise terminal device 103.

[0085] The enterprise terminal device 103 is a terminal device corresponding to the enterprise, and is used for executing the above digital signature algorithm to digitally sign the enterprise operation data to be sent according to the enterprise private key and the enterprise public key sent by each distributed authorized device 102, so as to send the digital signature and the enterprise operation data to the regulatory terminal device 104.

[0086] The regulatory terminal device 104 is a terminal device corresponding to a regulatory department, configured to execute the signature verification algorithm described above to verify the digital signature and the enterprise operation data, and to operate the enterprise operation data after verification. The operation here includes, but is not limited to, deletion, modification, addition, etc.

[0087] As can be seen, the embodiments of the present disclosure divide the enterprise attribute set of the enterprise terminal device into multiple target attribute sets, which are respectively assigned to multiple distributed authorization devices, and the multiple distributed authorization devices cannot communicate with each other, which helps to resist collusion. The target attribute sets managed by different distributed authorization devices are all part of the enterprise attribute set, and the target attribute sets managed by all distributed authorization devices correspond to the universal set of the enterprise attribute set. Thus, each distributed authorization device can generate a part of the enterprise private key according to part of the enterprise attribute set, and each enterprise terminal device needs the enterprise private key generated by each distributed authorization device when performing digital signature. That is, the enterprise private key used by the enterprise terminal device when performing digital signature depends on the distributed private keys of the multiple distributed authorization devices, which realizes distributed management of the enterprise private key. In this way, compared with the enterprise private key managed by the central authorization device, the security of the enterprise private key of the enterprise terminal device can be ensured when part of the distributed authorization devices are attacked and the distributed private key is leaked, thereby ensuring the security of the enterprise private key of the enterprise terminal device, and further improving the data security of the enterprise operation data.

[0088] Figure 3 is a step flowchart of a data processing method provided by the embodiments of the present disclosure, Figure 3 The data processing method shown in the figure is based on the data processing system described above. Please refer to Figure 3 The data processing method described above includes S201 to S203.

[0089] S201: Each distributed authorization device generates an enterprise private key according to the enterprise identity of the enterprise terminal device, the distributed private key of the distributed authorization device, and the target attribute set of the distributed authorization device, and sends it to the enterprise terminal device.

[0090] The enterprise identity is the unique identity of the enterprise, for example, the business license. The target attribute set includes part of the enterprise attribute set, and the enterprise attribute set can include, but is not limited to, business license, industrial and commercial management unit, establishment time, scope of business, etc. Thus, when the distributed authorization device includes two DE1 and DE2, the target attribute set of the distributed authorization device DE1 can include two target attributes of business license and industrial and commercial management unit, and the target attribute set of the distributed authorization device DE2 can include two target attributes of establishment time and scope of business.

[0091] Optionally, before the step S201, the method further comprises the following steps: firstly, the central authorization device randomly generates a system public key and a system private key, sends the system public key to the enterprise terminal device and the supervision terminal device, and sends the system private key to the supervision terminal device; then, the central authorization device generates a distribution private key, a distribution public key and an attribute number threshold for each distribution authorization device, the distribution private key of the distribution authorization device is associated with a target attribute set of the distribution authorization device, the distribution public key of the distribution authorization device is associated with the distribution private key of the distribution authorization device, and the attribute number threshold is randomly generated; then, the central authorization device sends the distribution private key and the attribute number threshold to the corresponding distribution authorization device; finally, the central authorization device sends the distribution public key to the supervision terminal device and the enterprise terminal device, and sends the attribute number threshold to the supervision terminal device.

[0092] Before the system public key and the system private key are generated, the following definitions need to be made: G1 and G2 are two multiplicative cyclic groups of order p, g is a generator of G1, and a bilinear pair e: G1 x G1→ G2 is defined on this basis, Z p is a set of data {0, 1,..., q-1} under the additive modulus q. Wherein, p and q are greater than 1.

[0093] The multiplicative cyclic group is a group, the group is a non-empty set, and the binary operation on the group satisfies the associative law, that is, for any three elements g3, g4 and g5 in the group, (g3 x g4) x g5 = g3 x (g4 x g5).

[0094] The above group also has a unit element e, that is, for any element g3 in the group, g3 x e = e x g3 = g3.

[0095] For any element g3 in the above group, there is an inverse element g3 , that is,

[0096] When the above group is a finite set, it is called a finite group, and the number of all elements in the finite group is the order of the finite group. When the above group is an infinite set, it is called an infinite group.

[0097] The multiplicative cyclic group is a group with the following characteristics: there is an element g, and for each element a, there is an i that can express a as g i . At this time, g can be referred to as the generator of the multiplicative cyclic group. i is a positive integer.

[0098] The multiplicative cyclic group has bilinearity, non-degeneracy and easy calculation. Wherein, the bilinearity means that for any element g3, g4 in G1, wherein, a and b belong to the set Z p , the set Z pLet G1 be {0, 1, ..., q-1}. Non-degeneracy means that there exist elements g3 and g4 in G1 such that e(g3, g4) ≠ e, and e is the identity element in G2. Computability means that for any elements g3 and g4 in G1, there exists an efficient algorithm to compute e(g3, g4).

[0099] Based on the above definition, the centrally authorized device is from set Z p We randomly select a value x from set G1 and a value g2 from set G2, and calculate g1 = g based on g and x. x Thus, the system private key sk and system public key pk can be obtained as follows:

[0100] sk=x (1)

[0101] pk=(g,g1,g2,G1,G2) (2)

[0102] After generating the system private key and system public key, the central authorization device can also generate a distributed private key and a distributed public key for each distributed authorization device. Let's assume there are k distributed authorization devices, and the i-th distributed authorization device is denoted as DE. i If i is greater than or equal to 1 and less than or equal to i, then the distributed authorized device DE will be used. i The set of target attributes for management is denoted as AD. i Therefore, the centrally authorized device can access the set Z. p In the middle is the distributed authorized device (DE) i Randomly select a value S i , and from set Z p In the middle is the distributed authorized device (DE) i The set of target attributes for management (AD) i The j-th target attribute AD i,j Randomly select a value t i,j j is the set of target attributes AD that is greater than or equal to 1 and less than or equal to 1. i The number of target attributes n1 i and calculate Therefore, distributed licensed devices (DEs) i The distributed private key is:

[0103]

[0104] Where n1 is the distributed licensing device DE i The set of target attributes for management (AD) i The number of target attributes in t i,1 , t i,2 , ..., t i,m For the target attribute set AD iThe values ​​corresponding to the first target attribute, the second target attribute, ..., the mth target attribute are respectively.

[0105] Distributed licensed devices (DE) i The distributed public key is:

[0106]

[0107] In addition, the central authorization equipment can also provide distributed authorization equipment (DE) according to actual application needs. i Set the threshold for the number of attributes y i .

[0108] After obtaining the aforementioned system private key, system public key, distributed private key, and distributed public key, steps S201 to S203 can be executed. During step S201, firstly, for each distributed authorization device, a polynomial function is determined based on the corresponding attribute quantity threshold and the enterprise identity identifier. The order of the polynomial function is the attribute quantity threshold minus 1, and the constant term of the polynomial function is obtained by inputting the enterprise identity identifier into the pseudo-random function of the distributed authorization device. Then, for each distributed authorization device, each target attribute in the corresponding target attribute set is input into its corresponding polynomial function to obtain the first polynomial data corresponding to each target attribute. A first signing private key is then generated based on the corresponding first polynomial data and the distributed private key corresponding to the target attribute in the distributed private key of the distributed authorization device. Next, a second signing private key is generated based on the system private key, the enterprise identity identifier, and the polynomial function corresponding to each distributed authorization device. Finally, for each distributed authorization device, a corresponding enterprise private key is generated based on the corresponding first and second signing private keys.

[0109] Using the i-th distributed authorization device DE i For example, the corresponding polynomial function q i (·)as follows:

[0110]

[0111] Among them, y i For distributed licensed devices (DE) i The corresponding number of attribute thresholds, a1, a2, ..., a yi-1 The parameters of the polynomial function are different distributed licensed devices (DE). i corresponding They can be different, thus corresponding to different polynomial functions. It combines the enterprise identity identifier u with the S in the aforementioned distributed private key apk. i The pseudo-random value obtained by inputting into the pseudo-random function.

[0112] target attribute set AD i AD in i，jInput into the polynomial function q i in the above formula, the AD i，j corresponding to the first polynomial data q i (j), therefore, the first signature private key d i，j can be calculated by the following formula:

[0113]

[0114] For each distribution authorized device, input the enterprise identity into the corresponding polynomial function to obtain the second polynomial data; then generate the second signature private key according to the sum of the second polynomial data corresponding to each distribution authorized device respectively, and the system private key. The second signature private key d u can be calculated by the following formula:

[0115]

[0116] Based on the first signature private key d i，j and the second signature private key d u , the enterprise private key can be obtained, including: the first signature private key d i，j generated by each target attribute in the target attribute set managed by all distribution authorized devices, and the second signature private key d u generated by all distribution authorized devices for enterprise end devices, that is, the enterprise private key can be

[0117] S202: The enterprise end device performs digital signature on the enterprise operation data to be sent through the enterprise private key, the system public key, the distribution public key of the distribution authorized device, and the target attribute set, to obtain signature data, so as to send the signature data and the enterprise operation data to the supervision end device.

[0118] Among them, the enterprise operation data can include various data of the enterprise in the operation process, which can include but is not limited to: the enterprise's income data, the outgoing account data, etc.

[0119] Specifically, first, for each target attribute in the target attribute set corresponding to the distribution authorized device, generate the first signature information according to the target attribute, the first signature private key and the system public key; then generate the second signature information according to the target attribute and the distribution public key of the distribution authorized device; then generate the third signature information according to the second signature private key, the system public key and the enterprise operation data; generate the fourth signature information according to the system public key; finally, generate the signature data according to the first signature information, the second signature information, the third signature information and the fourth signature information.

[0120] The first signature information σ1 i,j can be obtained by the following formula:

[0121]

[0122] wherein r is a value randomly selected from a set Z i,j p i i,j

[0123] The second signature information σ2 i,j may be obtained by the following formula:

[0124]

[0125] The third signature information σ3may be obtained by the following formula:

[0126]

[0127] wherein r is a value randomly selected from a set Z p

[0128] The fourth signature information σ4may be obtained by the following formula:

[0129] σ4=g1 r (11)

[0130] Based on the first signature information and the second signature information corresponding to all distributed authorization devices, and the third signature information and the fourth signature information, signature data can be generated, and the signature data is

[0131] S203: The supervision end device verifies the signature data through the target attribute set of each distributed authorization device, the supervision attribute set of the supervision end device, the system public key, the enterprise operation data, and the distributed public key of the distributed authorization device.

[0132] Specifically, for each distributed authorization device, the intersection of the corresponding target attribute set and the supervision attribute set of the supervision end device is determined to determine the number of distributed authorization devices whose attribute number in the intersection is greater than or equal to the attribute number threshold of the distributed authorization device; then, it is determined whether the number of distributed authorization devices is less than the device number threshold, if the number of distributed authorization devices is less than the device number threshold, it is determined that the verification fails; if the number of distributed authorization devices is greater than or equal to the device number threshold, a bilinear verification is performed according to the signature data, the system public key, the enterprise operation data, the intersection, and the distributed public key.

[0133] ​​​​​The determination of the number of the target distribution authorization devices can include: first, intersecting the target attribute set of each distribution authorization device and the supervision attribute set of the supervision terminal device; then, for each distribution authorization device, determining whether the number of attributes in the corresponding intersection is greater than or equal to the attribute number threshold of the distribution authorization device, if yes, the distribution authorization device can be taken as a target distribution authorization device, otherwise, the distribution authorization device is not taken as a target distribution authorization device; finally, taking the number of the target distribution authorization devices as the number of the distribution authorization devices.

[0134] The number of the target distribution authorization devices can be used for preliminary verification, and when the preliminary verification fails, the verification can be determined to fail without bilinear verification according to the signature data, the system public key, the enterprise operation data, the intersection, and the distribution public key, so that the calculation complexity required for verification can be reduced, and the verification speed can be improved.

[0135] When the preliminary verification passes, second verification is needed through bilinear verification, and the bilinear verification can be represented by the following formula:

[0136]

[0137] wherein, Z = e(g1, g2), when the formula (12) is established, the verification is successful, and when the formula (12) is not established, the verification fails.

[0138] Corresponding to the method embodiment, Figure 1 is a structural schematic diagram of a data processing system provided by an embodiment of the present disclosure. Please refer to Figure 1 The data processing system includes at least two distribution authorization devices 102, an enterprise terminal device 103, and a supervision terminal device 104.

[0139] Each distribution authorization device 102 is configured to generate an enterprise private key according to an enterprise identity of the enterprise terminal device 103, a distribution private key of the distribution authorization device 102, and a target attribute set of the distribution authorization device 102, and send the enterprise private key to the enterprise terminal device 103.

[0140] The enterprise terminal device 103 is configured to perform digital signature on enterprise operation data to be sent by using the enterprise private key, a system public key, and a distribution public key and a target attribute set of the distribution authorization device 102, to obtain signature data, and send the signature data and the enterprise operation data to the supervision terminal device 104.

[0141] The supervision terminal device 104 is configured to verify the signature data by using a target attribute set of each of the distributed authorization devices 102, a supervision attribute set of the supervision terminal device 104, a system public key, the enterprise operation data, a distributed public key of the distributed authorization device 102.

[0142] Optionally, each of the distributed authorization devices 102 is further configured to:

[0143] determine a polynomial function according to the corresponding attribute quantity threshold and the enterprise identity, wherein an order of the polynomial function is the attribute quantity threshold minus 1, and a constant term of the polynomial function is obtained by inputting the enterprise identity into a pseudo-random function of the distributed authorization device 102.

[0144] input each target attribute in the corresponding target attribute set into the corresponding polynomial function respectively to obtain first polynomial data corresponding to each target attribute respectively.

[0145] generate a first signature private key according to the corresponding first polynomial data and a distributed private key corresponding to the target attribute in the distributed private key of the distributed authorization device 102.

[0146] generate a second signature private key according to a system private key, the enterprise identity and the polynomial function corresponding to each of the distributed authorization devices 102.

[0147] generate a corresponding enterprise private key according to the corresponding first signature private key and the second signature private key.

[0148] Optionally, each of the distributed authorization devices 102 is further configured to:

[0149] input the enterprise identity into the corresponding polynomial function to obtain second polynomial data.

[0150] generate the second signature private key according to a sum of the second polynomial data corresponding to each of the distributed authorization devices 102 respectively and the system private key.

[0151] Optionally, the enterprise terminal device 103 is further configured to:

[0152] generate first signature information according to the target attribute, the first signature private key and the system public key for each target attribute in the target attribute set corresponding to the distributed authorization device 102.

[0153] generate second signature information according to the target attribute and a distributed public key of the distributed authorization device 102.

[0154] generate third signature information according to the second signature private key, the system public key and the enterprise operation data.

[0155] generating fourth signature information according to the system public key.

[0156] generating the signature data according to the first signature information, the second signature information, the third signature information and the fourth signature information.

[0157] Optionally, the supervision terminal device 104 is further configured to:

[0158] For each of the distribution authorization devices 102, determining an intersection of a corresponding target attribute set and a supervision attribute set of the supervision terminal device 104, to determine a distribution authorization device quantity in which a quantity of attributes in the intersection is greater than or equal to an attribute quantity threshold of the distribution authorization device 102.

[0159] If the distribution authorization device quantity is less than a device quantity threshold, determining that the verification fails.

[0160] If the distribution authorization device quantity is greater than or equal to the device quantity threshold, performing bilinear verification according to the signature data, a system public key, the enterprise operation data, the intersection, and a distribution public key.

[0161] Optionally, the data processing system further comprises a central authorization device 101, and the central authorization device 101 is further configured to:

[0162] generating, for each of the distribution authorization devices 102, a distribution private key, a distribution public key and an attribute quantity threshold, the distribution private key of the distribution authorization device 102 being associated with a target attribute set of the distribution authorization device 102, the distribution public key of the distribution authorization device 102 being associated with the distribution private key of the distribution authorization device 102, and the attribute quantity threshold being randomly generated.

[0163] sending the distribution private key and the attribute quantity threshold to the corresponding distribution authorization device 102.

[0164] sending the distribution public key to the supervision terminal device 104 and the enterprise terminal device 103, and sending the attribute quantity threshold to the supervision terminal device 104.

[0165] Optionally, the central authorization device 101 is further configured to:

[0166] randomly generating a system public key and a system private key.

[0167] sending the system public key to the enterprise terminal device 103 and the supervision terminal device 104.

[0168] sending the system private key to the supervision terminal device 104.

[0169] The system embodiment described above is a corresponding embodiment of the method embodiment, and has the same technical effects as the method embodiment. The detailed description of the system embodiment can refer to the detailed description of the method embodiment, which will not be repeated here.

[0170] The embodiments of the present disclosure further provide a computer readable storage medium, and the computer readable storage medium stores computer execution instructions. When a computing device executes the computer execution instructions, the computing device implements the data processing method.

[0171] The embodiments of the present disclosure further provide a computer program product, and the computer program product is used to execute the data processing method.

[0172] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles, or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or further include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or device including the element.

[0173] The above-mentioned serial numbers of the embodiments of the present disclosure are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0174] The above is only the preferred embodiment of the present disclosure, and does not limit the patent scope of the present disclosure. Any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, which is made by using the content of the present disclosure specification and drawings, is also included in the patent protection scope of the present disclosure.

Claims

1. A data processing method, characterized by, The application is applied to a data processing system, the data processing system comprises at least two distributed authorization devices, an enterprise terminal device and a supervision terminal device, and the method comprises: Each of the distributed authorization devices generates an enterprise private key according to an enterprise identity of the enterprise terminal device, a distributed private key of the distributed authorization device and a target attribute set of the distributed authorization device, and sends the enterprise private key to the enterprise terminal device; The enterprise terminal device performs digital signature on to-be-sent enterprise operation data by using the enterprise private key, a system public key, distributed public keys of the distributed authorization devices and the target attribute set, obtains signature data, and sends the signature data and the enterprise operation data to the supervision terminal device; The supervision terminal device verifies the signature data by using a target attribute set of each of the distributed authorization devices, a supervision attribute set of the supervision terminal device, a system public key, the enterprise operation data and distributed public keys of the distributed authorization devices; The enterprise terminal device generates an enterprise private key according to an enterprise identity of the enterprise terminal device, a distributed private key of the distributed authorization device and a target attribute set of the distributed authorization device, and sends the enterprise private key to the enterprise terminal device, comprising: For each of the distributed authorization devices, a polynomial function is determined according to a corresponding attribute number threshold and the enterprise identity, the order of the polynomial function is the attribute number threshold minus 1, and the constant term of the polynomial function is obtained by inputting the enterprise identity into a pseudo-random function of the distributed authorization device; For each of the distributed authorization devices, each target attribute in the corresponding target attribute set is input into the corresponding polynomial function to obtain first polynomial data corresponding to each target attribute; For each of the distributed authorization devices, a first signature private key is generated according to the corresponding first polynomial data and the target attribute corresponding distributed private key in the distributed private key of the distributed authorization device; A second signature private key is generated according to a system private key, the enterprise identity and the corresponding polynomial function of each of the distributed authorization devices; For each of the distributed authorization devices, a corresponding enterprise private key is generated according to the corresponding first signature private key and the second signature private key.

2. The method of claim 1, wherein, The second signature private key is generated according to a system private key, the enterprise identity and the corresponding polynomial function of each of the distributed authorization devices, comprising: For each of the distributed authorization devices, the enterprise identity is input into the corresponding polynomial function to obtain second polynomial data; The second signature private key is generated according to the sum of the second polynomial data corresponding to each of the distributed authorization devices and the system private key.

3. The method of claim 2, wherein, The enterprise terminal device performs digital signature on to-be-sent enterprise operation data by using the enterprise private key, a system public key, distributed public keys of the distributed authorization devices and the target attribute set, obtains signature data, and sends the signature data and the enterprise operation data to the supervision terminal device, comprising: For each target attribute in the target attribute set corresponding to the distributed authorization device, first signature information is generated according to the target attribute, the first signature private key and the system public key; generating second signature information according to the target attribute and the distribution public key of the distribution authorization device; generating third signature information according to the second signature private key, the system public key and the enterprise operation data; generating fourth signature information according to the system public key; generating the signature data according to the first signature information, the second signature information, the third signature information and the fourth signature information.

4. The method of claim 3, wherein, The supervision terminal device verifies the signature data through the target attribute set of each distribution authorization device, the supervision attribute set of the supervision terminal device, the system public key, the enterprise operation data, and the distribution public key of the distribution authorization device, and the verification includes: For each distribution authorization device, determining the intersection of the corresponding target attribute set and the supervision attribute set of the supervision terminal device to determine the number of distribution authorization devices whose attribute number in the intersection is greater than or equal to the attribute number threshold of the distribution authorization device; If the number of distribution authorization devices is less than the device number threshold, it is determined that the verification fails; If the number of distribution authorization devices is greater than or equal to the device number threshold, the bilinear verification is performed according to the signature data, the system public key, the enterprise operation data, the intersection, and the distribution public key.

5. The method according to any one of claims 1 to 4, characterized in that, The data processing system further includes a central authorization device, and the method further includes: The central authorization device generates a distribution private key, a distribution public key and an attribute number threshold for each distribution authorization device, the distribution private key of the distribution authorization device is associated with the target attribute set of the distribution authorization device, the distribution public key of the distribution authorization device is associated with the distribution private key of the distribution authorization device, and the attribute number threshold is randomly generated; The central authorization device sends the distribution private key and the attribute number threshold to the corresponding distribution authorization device; The central authorization device sends the distribution public key to the supervision terminal device and the enterprise terminal device, and sends the attribute number threshold to the supervision terminal device.

6. The method of claim 5, wherein, The method further includes: The central authorization device randomly generates a system public key and a system private key; The central authorization device sends the system public key to the enterprise terminal device and the supervision terminal device; The central authorization device sends the system private key to the supervision terminal device.

7. A data processing system, characterized by It includes: At least two distribution authorization devices, an enterprise terminal device and a supervision terminal device; Each distribution authorization device is configured to generate an enterprise private key according to an enterprise identity of the enterprise terminal device, a distribution private key of the distribution authorization device and a target attribute set of the distribution authorization device, and send the enterprise private key to the enterprise terminal device; The enterprise terminal device is configured to digitally sign enterprise operation data to be sent through the enterprise private key, a system public key and a distribution public key of the distribution authorization device, and the target attribute set, to obtain signature data, and send the signature data and the enterprise operation data to the supervision terminal device; The supervision terminal device is configured to verify the signature data by using a target attribute set of each of the distributed authorization devices, a supervision attribute set of the supervision terminal device, a system public key, the enterprise operation data, and a distributed public key of the distributed authorization device; Each of the distributed authorization devices is configured to generate an enterprise private key according to the enterprise identity of the enterprise terminal device, a distributed private key of the distributed authorization device, and the target attribute set of the distributed authorization device, and specifically configured to: For each of the distributed authorization devices, a polynomial function is determined according to the corresponding attribute number threshold and the enterprise identity, an order of the polynomial function is the attribute number threshold minus 1, and a constant term of the polynomial function is obtained by inputting the enterprise identity into a pseudo-random function of the distributed authorization device; For each of the distributed authorization devices, each target attribute in the corresponding target attribute set is input into the corresponding polynomial function to obtain first polynomial data corresponding to each target attribute; For each of the distributed authorization devices, a first signature private key is generated according to the corresponding first polynomial data and the target attribute corresponding distributed private key in the distributed private key of the distributed authorization device; A second signature private key is generated according to a system private key, the enterprise identity, and the polynomial function corresponding to each of the distributed authorization devices; For each of the distributed authorization devices, a corresponding enterprise private key is generated according to the corresponding first signature private key and the second signature private key.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and when the computing device executes the computer execution instructions, the computing device implements the method in any one of claims 1 to 6.

9. A computer program product, characterised in that, The computer program product is used to execute the method in any one of claims 1 to 6.

Images