Kp-abe and blockchain-based user data trusted sharing method based on directed acyclic graph

Abstract

The application discloses a user data trusted sharing method based on a KP-ABE and a blockchain of a directed acyclic graph, which adopts a key construction scheme different from an existing attribute-based encryption, abstracts an original tree-shaped access control strategy based on a threshold gate into a directed acyclic graph (DAG), improves the efficiency problem of an attribute-based encryption algorithm when facing a large attribute space, optimizes the algorithm security, and generally provides a more efficient and secure scheme for static data access control.

Description

TECHNICAL FIELD

[0001] The present application relates to blockchain, zero-knowledge proof, cloud storage and key policy based attribute encryption technology, and in particular to a user data trusted sharing method based on KP-ABE and blockchain of directed acyclic graph. BACKGROUND

[0002] With the increasing demand of users for outsourcing data sharing storage, the requirement for data security of shared storage and the requirement for user privacy and fine-grained access control of shared data are also increasing. In view of the following two problems: 1) the existing user data cloud storage scheme is difficult to prove the integrity and availability of data from the perspective of service providers; 2) the existing scheme has two major pain points of large user access structure management and maintenance and key distribution, a new key policy based attribute encryption scheme based on directed acyclic graph (DAG) is introduced, which realizes the support for large user attribute space and meets the length of key data such as generated public parameters, keys and ciphertexts not linearly increasing with attribute space. At the same time, for the service provider trust problem that attribute encryption cannot solve, a user shared data trusted storage module is designed based on blockchain and non-interactive zero-knowledge proof technology. The present application can be widely applied to medical health data access control and other user permission based static large attribute space data authorization access fields. SUMMARY

[0003] The problem to be solved by the present application is to provide an access control scheme in a data cloud storage scenario based on a trusted authorization agency to manage user access structure and generate user keys, and to guarantee the trusted storage of data in cloud service providers based on blockchain technology and non-interactive zero-knowledge proof technology.

[0004] The present application provides a user data trusted sharing method based on KP-ABE (key policy attribute based encryption, key policy attribute based encryption) and blockchain of directed acyclic graph, according to the different roles of users in the whole data authorization access process, which can be divided into data owners and data accessers, the method comprises the following steps:

[0005] S1) The user and the trusted authorization agency determine the entity attributes and their permission sets that may appear in the subsequent steps, specifically, the user inputs his user identity information and corresponding permissions when registering;

[0006] S2) The trusted authorization agency performs the initialization step of attribute encryption based on directed acyclic graph according to the identity information and corresponding data access permissions of each user input in step S1), and generates a master public key and public parameters pp;

[0007] S3) When the user uploads the file as the data owner, the file to be shared, the description of the file attribute, and the master public key and public parameter pp generated by the trusted authority in step S2) are input into the ciphertext generation step of the attribute-based encryption based on the directed acyclic graph, and the ciphertext corresponding to the file is output, and uploaded to the cloud server;

[0008] S4) The cloud server generates a lightweight proof of the ciphertext corresponding to the file through a non-interactive zero-knowledge proof algorithm, and stores the verification key and other information required for verification as a transaction on the chain together with the ciphertext corresponding to the file and its corresponding lightweight proof;

[0009] S5) When the user is a data visitor and needs to download a file shared by another user, the unique sequence of the shared file is obtained through trusted communication with the cloud server;

[0010] S6) After obtaining the unique sequence of the shared file, the data visitor calls the verification contract and finds the transaction where the unique sequence is located on the chain, parses the verification parameters in it, and performs zero-knowledge proof on the shared file. If the shared file passes the verification contract, it is proved that the shared file is trustworthy, and the data visitor returns to the cloud server to download the shared file; if the shared file does not pass the verification contract, it means that the shared file has been tampered with, and the data visitor can submit an error report on the chain;

[0011] S7) After the data visitor finishes downloading the shared file, the key generation algorithm based on the directed acyclic graph attribute encryption is executed, and the data visitor access policy and the specific file attribute contained in the policy are input into the key generation algorithm. The algorithm converts the user access policy into a directed acyclic graph, and outputs the data visitor private key containing the directed acyclic graph;

[0012] S8) The data visitor performs the decryption step based on the private key based on the directed acyclic graph attribute encryption. If the file attribute description is contained in the data visitor access policy, the decryption is successful; if the file attribute description is not contained in the data visitor access policy, the user has insufficient permissions and cannot view the content of the shared file.

[0013] In step S7), the specific process of the key generation step is as follows:

[0014] 1. Directed acyclic graph (DAG) pre-generation: input access policy (including attribute set, algorithm threshold), output a corresponding initial directed acyclic graph DAG. Create a hash map H V and H E are used to store the vertices and edges of the directed acyclic graph DAG, and the specific file attributes contained in the input access policy are stored in the queue Q V If any attribute x is in QV If the value of attribute x is positive and non-negative, it is abstracted as a vertex and stored in H V If the value of attribute x is negative, it is marked as a virtual vertex. Based on the preset algorithm threshold, attribute combinations are generated for the input access structure, and the CREATE-EDGES method is executed to generate corresponding edges for the vertices in the current DAG, and the generated edges are stored in H E E V Finally, the final directed acyclic graph DAG is generated by retrieving H A .

[0015] 2. Constructing a directed acyclic graph (UDAG) for a specific user: input the user attribute set attr, the user identifier A, and the final directed acyclic graph DAG constructed in step 1. Prune the user attribute set attr to remove unnecessary redundant attributes, and the virtual vertex and its corresponding edges are included in the final directed acyclic graph DAG. Finally, output the user's directed acyclic graph UDAG.

[0016] 3. Calculate the UDAG path weight: calculate the weight of each path in the input UDAG by traversing it (the edge and the path are not the same), and complete the secret sharing for the user. Use the depth-first algorithm (DFS) to access the source vertex of the input UDAG, and stop when the next node is the destination vertex. The total weight of the UDAG path is equal to the product of the weights of all edges in the graph. Mark the visited nodes as read to avoid infinite loops. Finally, output the path weight, and generate the user's private key K A based on the path weight.

[0017] The present application adopts a scheme different from the existing attribute-based encryption key construction scheme, and abstracts the original threshold gate-based tree access control strategy into a directed acyclic graph (DAG), which improves the efficiency of the attribute-based encryption algorithm when facing large attribute space, optimizes the security of the algorithm, and overall provides a more efficient and secure scheme for static data access control. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is the trusted sharing system architecture diagram of the present application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings.

[0020] As Figure 1As shown, the user data trusted sharing method based on DAG-KP-ABE and blockchain adopts a user data trusted sharing system based on DAG-KP-ABE and blockchain, which can be composed of a trusted authority (TA), a medical data blockchain platform (ETH), a cloud service provider (CSP) and a user when applied to a medical health data access control scene, wherein the user can be abstracted as a medical data owner (DO) and a medical data visitor (DV), a new key policy attribute-based encryption protocol is selected as an encryption method, and fiat-shamir is selected as a non-interactive zero-knowledge proof protocol.

[0021] The user data trusted sharing method based on DAG-KP-ABE and blockchain includes the following steps when the user DO needs to share his own medical health file M and the user DV needs to download the shared file:

[0022] 1) Before the user DO starts registration, the TA performs the following steps for the subsequent user registration and user key generation:

[0023] A preprocessing phase is performed, in which the TA determines the user attribute domain U, the user DO registers, and inputs the attribute set describing M.

[0024] 2) The DO communicates with the TA and sends the access structure of the DO, which includes the user attribute set attr and the threshold value. The TA pre-generates a directed acyclic graph (DAG) based on the existing access structure, and obtains the path weight in the pre-generated DAG through a path weight algorithm s where x d is the source vertex, x DO is the destination vertex, and ew is the weight of each path from the source vertex to the destination vertex (i is the node number). The TA performs an initialization algorithm G (cryptographic initialization, which does not need to be described in detail) to generate public parameters pp and a master secret key msk.

[0025] 3) After obtaining the master key msk and the public parameters pp, the TA performs a key generation algorithm to construct a DAG based on the DO attributes and the pre-generated DAG. First, the path weight P is calculated based on the input user attribute set attr, and if the input user attribute set attr satisfies the access structure, the user DO will be able to recover the medical health file. Next, the private key set K of the user DO is calculated and output T .

[0026] 4) The DO sends the file M (original) to be shared to the TA, and the TA calculates and outputs the ciphertext C based on the public parameters pp generated in step 2) and the attribute set of M, by uniformly randomly selecting a secret element s. TCSP with anti-collision pseudo-random function for the ciphertext C T Generate a unique serial number sn M , the generated serial number sn M and its corresponding C T Spliced to get {C T ,sn M}, and then {C T ,sn M} is uploaded to CSP.

[0027] 5) CSP saves the ciphertext C T in the database, and starts to execute the proof generation phase of the Fiat-shamir protocol. CSP randomly selects prime numbers p, q, a group G of order p, a generator g of the group G, and an anti-collision hash function H(*) that needs to be used when CSP generates challenges, and maps the ciphertext C T of DO to an element x in the group , where the group is a set of positive integers less than q, let Y = g x , select a random element v on , and calculate the commitment t = g v based on v; then DO acts as a prover, uses the unpredictability of the anti-collision hash function H(*) to issue a challenge c = H(g, Y, t)

[0028] (hash function calculation), then CSP calculates r = v-cxmodp, and sends the evidence pair (t, r) to the medical data chain in the form of a transaction.

[0029] 6) The steps of medical data access user DV registration and private key generation are the same as described in 1), 2) and 3). DV queries CSP to find the target medical health file, and reads its serial number sn M .

[0030] 7) DV accesses the medical data client (based on the Ethereum client), calls the retrieval smart contract, and inputs sn M . If the serial number exists, the smart contract returns the zero-knowledge proof pair (t, r) of the corresponding medical health file, and the parameters {g, H(*), Y} required for verifying the zero-knowledge proof. DV calls the verification contract on the medical data chain with the above parameters as input, and the verification contract returns a boolean verification result. If it is 1, the target medical health file is stored in a trusted manner, and the user DV can safely download it; if it is 0, the medical health file is tampered with, and the user DV should report the error to CSP.

[0031] 8) By the target medical health file after verification, DV can download the new KP-ABE decryption step based on directed acyclic graph, decryption step only need to input ciphertext C T And the private key K of DV DV , before the decryption step, first check the input K DV The number of keys in C T The number of ciphertexts in C is equal, if not equal, exit the decryption step, return error; if equal, in the case of user DV private key satisfies the medical health file sharing user (i.e. user DO) access structure, with the help of existing linear secret sharing scheme in the Vandermonde matrix, restore the medical health file plaintext M.

[0032] The above only for the preferred embodiments of the present application, and not to limit the present application, any modification, equivalent replacement and improvement within the spirit and principles of the present application, etc., should be included in the protection scope of the present application.

Claims

1. A method for user data trusted sharing based on KP-ABE and blockchain with directed acyclic graph, characterized in that, The method is realized by using a user data trusted sharing system based on a directed acyclic graph KP-ABE and a blockchain, when applied to a medical health data access control scene, the system is composed of a trusted authority TA, a medical data blockchain platform ETH, a cloud service provider CSP and a user, wherein the user can be abstracted as a medical data owner DO and a medical data visitor DV, a new key policy based attribute encryption protocol is selected as an encryption method, and fiat-shamir is selected as a non-interactive zero-knowledge proof protocol; The user data trusted sharing method based on the directed acyclic graph KP-ABE and the blockchain comprises the following steps: 1) Before the user DO starts registration, the TA performs a preprocessing stage for the subsequent user registration and user key generation, in which stage the TA determines a user attribute domain U, the user DO registers and inputs an attribute set describing M; 2) DO communicates with TA, sends access structure of DO, the access structure includes user attribute set attr, door threshold value; TA pre-generates directed acyclic graph DAG based on existing access structure, and obtains path weight in the pre-generated directed acyclic graph DAG through path weight algorithm wherein x s is the source vertex, x d is the destination vertex, ew is the weight of each path from the source vertex to the destination vertex, i is the node serial number, TA executes the initialization algorithm G to generate the public parameter pp and the master secret key msk; 3) After obtaining the master key msk and the public parameter pp, the TA executes the key generation algorithm, and constructs a directed acyclic graph DAG based on the DO attribute and the pre-generated directed acyclic graph DAG: first, the path weight P is calculated based on the input user attribute set attr, if the input user attribute set attr satisfies the access structure, then the user DO will be able to restore the medical health file, next, the private key set K of the user DO is calculated and output DO ; 4) DO sends the file M to be shared to TA. Based on the public parameter pp generated in step 2) and the attribute set of M, TA calculates and outputs the ciphertext C by uniformly and randomly selecting the secret element s. T CSP uses a collision-resistant pseudo-random function to ciphertext C T Generate a unique serial number sn M The generated serial number sn M and its corresponding C T After splicing, we get {C T ,sn M }, then {C T ,sn M Upload to CSP; 5) CSP will cipher C T Save in the database, start to execute the proof generation phase of Fiat-shamir agreement, CSP selects prime p, q, the group G of p order, randomly selects a generator g of group G, and the anti-collision hash function H (*) needed by CSP to generate challenge, maps the cipher C of DO T To the element x of group On, where group Is a set of positive integers less than q, let Y=g x On Select a random element v, and calculate the commitment t=g v Based on v; then DO as the prover, uses the unpredictability of anti-collision hash function H (*) to challenge itself c=H(g,Y,t), then CSP calculates r=v-cx mod p, and sends the evidence pair (t,r) to the medical data chain in the form of transaction; 6) Medical data visitor DV registration and user private key K DV The generation step is the method described in steps 1) - 3); the DV finds the target medical health file by querying the CSP, reads its serial number sn M ; 7) DV accesses the medical data client, calls the retrieval smart contract, and inputs sn M If the serial number exists, the smart contract returns the zero-knowledge proof pair (t, r) of the corresponding medical health file and the {g, H(*), Y} parameters required for verifying the zero-knowledge proof. The DV takes the above parameters as inputs, calls the verification contract on the medical data chain, and the verification contract returns a Boolean verification result. If the Boolean verification result is 1, the target medical health file is stored in a trusted manner, and the user DV can safely download it. If the Boolean verification result is 0, the medical health file is tampered with, and the user DV should report the error to the CSP. 8) By the target medical health file after verification, DV download after execution based on the new KP-ABE decryption steps of directed acyclic graph, decryption steps only need to input ciphertext C T And the private key K of DV DV , before the decryption step, first check the input K DV The number of keys in C T The number of ciphertexts in the ciphertext is equal, if not equal, exit the decryption step, return error; if equal, in the case of user DV private key satisfies the medical health file sharing user DO access structure, with the existing linear secret sharing scheme in the Vandermonde matrix, restore the medical health file plaintext M.

2. The method of claim 1, wherein, The medical data client is constructed based on an Ethereum client.

Images