A dynamic audit method for cross-chain data consistency based on chain of custody

Abstract

The present invention discloses a cross-chain data consistency dynamic audit method based on a supervision chain. When there is an audit demand, the supervision chain challenges the receiving chain to verify whether the access chain has sent complete and correct data to the receiving chain; the receiving chain generates an audit certificate based on the challenge information, and sends the audit certificate to the supervision chain; the supervision chain verifies the correctness of the audit certificate to judge the integrity of the cross-chain data. If the audit fails, the supervision chain sends an error message to the access chain so that the access chain finds the corresponding correct data and sends it to the receiving chain for storage; when the data owner has a data update demand, a data update request can be sent to the access chain, the access chain updates and stores the corresponding data, and also sends a data update request to the receiving chain so that it updates and stores the data. This method realizes accurate verification of the cross-chain interactive data integrity audit and protects privacy data; the method of the present invention also realizes the audit of batch files and improves the audit efficiency.

Description

Technical Field

[0001] The present invention relates to cloud computing security and data auditing technology, and specifically to a cross-chain data consistency dynamic auditing method based on a supervision chain. Background Art

[0002] After more than a decade of development, blockchain has formed a blockchain network with different characteristics and suitable for different application scenarios. However, due to the isolation and closedness of blockchain, as well as the high degree of heterogeneity between chains, the data circulation and value transfer between blockchains have become technical bottlenecks that hinder the widespread application of blockchain technology.

[0003] In order to deal with the above problems, many cross-chain technologies have been proposed. In the future, cross-chain technology will serve as a connector of blockchain networks, connecting more blockchain ecosystems, turning blockchain ecological islands into a truly meaningful blockchain world network, and greatly promoting the development of blockchain ecology. There are currently four mainstream cross-chain technologies: notary mode, relay / side chain mode, hash lock mode, and distributed private key mode. These cross-chain technologies are bridges connecting various blockchains, which can realize atomic transactions, asset conversion, communication of internal information between blockchains, and solve Oracle problems. However, these cross-chain technologies do not consider one problem: if the sender of the cross-chain does not send the real data to the receiver, but chooses to defraud the receiver, it will eventually damage the interests of the receiver.

[0004] At present, most data integrity auditing solutions appear in cloud auditing. With the development of the information age, the amount of information is constantly growing, and people's demand for cloud servers is also increasing. However, when users delete local data and upload all data to cloud servers, they will also worry about whether the cloud servers store their data correctly and completely. For example, cloud servers delete data that users rarely access for the sake of valuable storage resources. Therefore, many cloud auditing solutions have been proposed to solve such problems. But so far, few data integrity verification solutions for cross-chain interactions have been proposed.

[0005] In addition, after users upload data to the cloud server, they will have the need to update the data. Therefore, many dynamic update solutions in cloud auditing have also been proposed. Similarly, users also have the need to update data in cross-chain scenarios.

[0006] Therefore, a reasonable way is needed to solve the problem of integrity verification of dynamic data during cross-chain interactions to ensure the reliability and accuracy of regulatory results. Summary of the invention

[0007] In view of the fact that the above-mentioned prior art has insufficient data integrity verification for cross-chain interactions, the purpose of the present invention is to provide a dynamic audit method for cross-chain data consistency based on a supervision chain.

[0008] In order to achieve the above-mentioned object of the invention, the technical solution provided by the present invention is as follows.

[0009] A cross-chain data consistency dynamic audit method based on a custody chain, the method includes auditing a single file and batch auditing operations of multiple files, including the following steps:

[0010] (I) For the file processing of the data owner, access chain and receiving chain, the processing method of the original file includes blinding processing, initial parameter setting, data block signing and generation of audit information, and also includes the following processes:

[0011] (11) The data owner processes the original file F to obtain a file F′ and a first data group including audit parameter information, and sends the processed file F′ and the first data group to the data access chain.

[0012] (12) The access chain stores the file F′ and the first data group, and sends the file F′ and the second data group to the data receiving chain, which stores them in the blockchain. The second data group includes a root value signature of the ternary hash tree, a file version number signature, and a set of data block signatures.

[0013] (II) The audit of cross-chain data integrity by the chain of custody includes the following process:

[0014] (21) When the supervision chain performs an audit of a single file, the supervision chain generates a challenge message and sends the challenge message to the receiving chain to verify whether the data sent by the access chain to the receiving chain is complete and correct; after receiving the challenge message, the receiving chain generates a corresponding audit certificate and sends the audit certificate back to the supervision chain. The supervision chain verifies whether the data sent by the access chain to the receiving chain is complete and correct based on the received audit certificate, thereby completing the cross-chain data verification; when the supervision chain audit verification fails, the supervision chain sends an error message to the access chain. The access chain finds the error data block based on the error message and sends the correct data block to the receiving chain so that it can modify the error data block;

[0015] (22) When the custody chain performs a batch audit on more than one file, the custody chain generates challenge information for the corresponding file, and sends the file challenge information to the receiving chain to verify whether the data sent by the access chain to the receiving chain is complete and correct. After receiving the challenge information, the receiving chain generates a corresponding audit certificate and sends the corresponding file audit certificate back to the custody chain. The custody chain verifies whether the access chain has sent complete and correct data to the receiving chain based on the received file audit certificate.

[0016] In step (22), for all the documents to be audited, the chain of custody randomly selects a set To represent the index of the data block to be challenged, the custody chain then selects |I| random values Where i∈I, the challenge information chal={(i,v i )} i∈I ;

[0017] (III) The data owner modifies, inserts, and deletes the data stored in the access chain and the receiving chain, including the following processes:

[0018] The data owner sends modification, insertion and deletion requests to the access chain respectively. After receiving the request, the access chain sends the file F′ stored on the blockchain to the data owner. After updating the file F′, the data owner sends the relevant update information to the access chain. The access chain generates an update certificate after completing the update according to the update information and sends it to the data owner. The data owner verifies the update certificate. If the verification is successful, the verification signature is sent to the access chain for storage for use in future data audits. Finally, the access chain sends an update request to the receiving chain to enable the receiving chain to update the data.

[0019] Furthermore, the processing of the original file F in step (1) of the method specifically includes the following steps:

[0020] Blinding treatment: represents the file sent by the data owner to the access chain, assuming that [n] = {1, 2, ..., n} represents the index of the data block, where Indicates the subscript of the private data block in the original file F. In order to protect the private data, the data owner randomly selects a value And calculate |K| blinding factors α i =f(i,k), where i∈K, is a pseudo-random function, and then the data owner uses equation m i ′=m i +α i Calculate the blinded data block, where i∈K, for the data block without privacy data, that is, m i ′=m i , the content of the data block will not change, and the processed file F′ is obtained after blinding processing;

[0021] Initial parameter setting: The data owner generates a bilinear group (p, g, G1, G2, e) and then selects two cryptographic hash functions H: {0, 1} * →G1 and h:G1→Z p , and choose a random value x←Z p, a random value s←G1, and calculate z←g x and ω←s x , where the private key is sk=x and the public key is pk=(z,ω,g,s);

[0022] Generate data block signature: The data owner gives each data block m of file F′ i Generate signature And the signature σ i Put the signature set Ω = {σ i}middle;

[0023] Generate audit information: The data owner calculates the hash value h of each data block i =H(m i ′) and build a ternary hash tree T, and then use the private key sk to sign the root of the ternary hash tree T and the version number version of the file F′ sig sk (H(R))=(H(R)) x , sig sk (version)=version x ;

[0024] Data transfer: The data owner sends the file F′, the ternary hash tree T, and the signature sig of the root value of the tree sk (H(R)), signature set Ω and signature sig for file version number sk (version) is sent to the access chain.

[0025] Furthermore, when performing a batch audit of multiple files, the initial parameter settings and data block signatures can be assigned and processed at the same time, as shown below:

[0026] Initialization parameter setting: T data owners each own file F t =(m t,1 ,...,m t,n ), where t∈{1,...,T}, then the T data owners each have a t After blinding processing, the processed file F is obtained t ′, and generate their own private keys sk t =x t and public key pk t =(z t ,ω t ,g t ,s t );

[0027] Generate data block signature: T data owners each sign data block m t,i 'Sign And put it into the signature set Ω t ={σ t,i}, where i∈{1,...,n}.

[0028] Furthermore, the audit of step (21) in step (2) of the method includes the following process:

[0029] Generate challenge information on the custody chain: For each audit task, the custody chain randomly selects a set To indicate the index of the data block to be challenged, the custody chain then selects |I| random values Where i∈I, the challenge information chal={(i,v i )} i∈I ;

[0030] The receiving chain generates an audit proof: the receiving chain selects a random value α←Z p , and calculate the values ​​of β, γ, σ respectively: β=(ω) α =(s x ) α , Finally, the audit certificate is obtained, which is expressed as follows:

[0031] proof={β,γ,σ,H(m i ′) i∈I ,sig sk (H(R)),sig sk (version)};

[0032] Chain of custody verifies cross-chain data integrity: After receiving the audit proof, the chain of custody uses the equation:

[0033] e(sig sk (H(R)),g)=e(H(R),g x )

[0034] e(sig sk (version),g)=e(version,g x )

[0035] First verify the root value signature sig of the ternary hash tree sk (H(R)) and file version number signature sig sk (versopm) is correct, if verification fails, the chain of custody audit fails, otherwise using the equation:

[0036]

[0037] The integrity is verified. If the equation holds, it proves that the access chain has sent the complete data to the receiving chain. Otherwise, the access chain has not sent the complete data to the receiving chain, where e:G×G→G is a bilinear pairing calculation.

[0038] Furthermore, the audit of step (22) includes the following process:

[0039] The receiving chain generates a multi-file audit proof: The receiving chain generates a random number α for each of the T data owners. t ∈Z p , and calculate σ, {γ t} 1≦t≦T , {β t} 1≦t≦T :

[0040] Finally, we get the multi-file audit proof proof = {σ, {γ t} 1≦t≦T ,{β t} 1≦t≦T ,H(m t,i ′) i∈I ,sig sk (H(R t )) 1≦t≦T ,sig sk (version t ) 1≦t≦T};

[0041] Data Integrity Verification: Chain of Custody, upon receipt of multi-document audit proof, utilizes the equation:

[0042]

[0043]

[0044] First verify the root value signature of the ternary hash tree And the file version number signature Correct, if verification fails, the chain of custody audit fails, otherwise using the equation:

[0045]

[0046] The integrity is verified. If the equation holds, it proves that the access chain has sent the complete data to the receiving chain. Otherwise, the access chain has not sent the complete data to the receiving chain. Among them, e:G×G→G is a bilinear pairing calculation.

[0047] Further explanation, the error message in the method of the present invention is mainly for the verification failure of a single file, and the error message is recorded as error={F N ,sig sk(version),H(m i ′) i∈I}, where F N The name of the file F′ is represented, and the steps of finding the error data block are as follows:

[0048] The access chain uses H(m i ′) i∈I and stored in the block Construct a ternary hash tree T′ and traverse T and T′ to find the error data block {m Ei ′} i∈Q , where Q = {1,2...,q} represents the generation of an erroneous data block, and then the access chain finds the corresponding correct data block {m i ′} i∈Q sent to the receiving chain.

[0049] The data modification operation in step (iii) of the method is as follows:

[0050] Request modification: The data owner sends a modification request modify={F N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F′ and sends F′ to the data owner;

[0051] Modify data: The data owner finds the data block m to be modified in F′ i ′, and change it to m i ″, and according to the new data block m i Generate a new signature Then according to m i ″Regenerate the ternary hash tree T′ and replace {m i ″,σi′,F N} is sent to the data access chain, and the data access chain converts the m in file F′ i ′ is changed to m i ″, and generate a new block to store the updated file F″, the ternary hash tree T″ and σ i ′;

[0052] Verify the modification proof: The data access chain sends the root hash value H(R″) of T″ to the data owner. The data owner compares whether H(R′) is equal to H(R″). If not, it means that the data modification failed. If they are equal, the data owner signs H(R″) with sig sk (H(R″)) and sign the newly generated version number sig sk (version′);

[0053] Data transfer and storage: Data owners will sig sk (H(R″)) and sig sk (cersion′) is sent to the access chain for storage, and the access chain sends {F N ,σ i ′,m i ″,sig sk (H(R″)),sig sk (version′), Modify}, where Modify indicates a modification request. The data receiving chain directly locates the corresponding version F′ according to the state database. i ′ to m i ″After that, a new block is generated to store {F″,σ i ′,sig sk (H(R″)),sig sk (version′)} and update the status database content.

[0054] Furthermore, the data insertion operation in step (iii) is as follows:

[0055] Request insert: The data owner sends an insert request to the access chain. N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F′ and sends F′ to the data owner;

[0056] Insert data: the specific data block m in F′ of the data owner i 'After inserting the new data block m x and m y , and according to the m x and m y Generate new signatures respectively Then according to m x and m y Regenerate the ternary hash tree T′ and replace {i,m x ,m y ,σ x ′,σ y ′,F N} is sent to the access chain, where i represents the data block insertion position. The access chain inserts m after the i-th position in file F′. x and m y , and generate a new block to store the updated file F″, ternary hash tree T″, σ x ′ and σ y ′;

[0057] Verify the insertion proof: The data access chain sends the root hash value H(R″) of T″ to the data owner. The data owner compares whether H(R′) is equal to H(R″). If not, it means that the data insertion failed. If they are equal, the data owner signs H(R″) with a sig sk (H(R″)) and sign the newly generated version number sig sk (version′);

[0058] Data transfer and storage: The data owner will sig sk (H(R″)) and sig sk (version′) is sent to the access chain for storage, and the access chain sends {F N ,σ x ′,σ y ′,m x ,m y ,i,sig sk (H(R″)),sig sk (version′),Insert}, where Insert represents an insert request. The data receiving chain directly locates the corresponding version of F′ according to the state database and inserts m after position i of F′. x and m y Then a new block is generated to store {F″,σ x ′,σ y ′,sig sk (H(R″)),sig sk (version′)} and update the status database content.

[0059] Furthermore, the data deletion operation in step (iii) is as follows:

[0060] Request to delete: The data owner sends a delete request to the access chain. N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F′ and sends F′ to the data owner;

[0061] Deleting data: The data owner changes m in F′ x and m y After deletion, regenerate the ternary hash tree T′ and replace {x,y,F N} is sent to the access chain, where x and y represent the subscripts of the data blocks to be deleted. The data access chain finds and deletes the data blocks at positions x and y and the corresponding signatures in file F′, and generates a new block to store the updated file F″ and the ternary hash tree T″;

[0062] Verify the deletion proof: The data access chain sends the root hash value H(R″) of T″ to the data owner. The data owner compares whether H(R′) is equal to H(R″). If not, it means that the data deletion failed. If they are equal, the data owner signs H(R″) with a sig sk (H(R″)) and sign the newly generated version number sig sk (version′);

[0063] Data transfer and storage: Data owners will sig sk (H(R″)) and sig sk (version′) is sent to the access chain for storage, and the access chain sends {F N ,x,y,sig sk (H(R″)),sig sk (version′),Delete}, where Delete represents a deletion request. The receiving chain directly locates the corresponding version F′ according to the state database, deletes the data at the x and y positions of F′, and generates a new block to store {F″,sig sk (H(R″)),sig sk (version′)} and update the status database content.

[0064] Beneficial effects: Compared with the prior art, the method of the present invention uses the custody chain to verify the integrity and consistency of cross-chain data, can locate the error data after the data error occurs, and uses the ternary hash tree structure to process the data, so that the present invention can meet the data modification, insertion and deletion functions. In addition, the present invention also uses bilinear aggregate signature technology to realize batch audit of data, improving audit efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a schematic diagram of a model role of the present invention;

[0066] Figure 2 It is a schematic diagram of the process flow of the initial stage and the signature generation stage of the present invention;

[0067] Figure 3 It is a flowchart of the audit phase of the present invention;

[0068] Figure 4 It is a schematic diagram of the process flow of the modification stage of the present invention;

[0069] Figure 5 It is a schematic flow diagram of the insertion stage of the present invention;

[0070] Figure 6 It is a schematic flow chart of the deletion phase of the present invention;

[0071] Figure 7 It is a schematic diagram of the process flow of the error location stage of the present invention. DETAILED DESCRIPTION

[0072] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention, so as to fully illustrate the technical solutions and implementation process provided by the present invention.

[0073] A dynamic audit method for cross-chain data consistency based on the custody chain, the main implementation steps of which can be summarized as follows:

[0074] Step 1: The data owner processes the original file F to obtain a file F′ and a first data group including audit parameter information, and sends the processed file F′ and the first data group to the data access chain. The processing method of the original file includes blinding processing, initial parameter setting, data block signing, and generating audit information;

[0075] Step 2: The access chain stores the file F′ and the first data group, and sends the file F′ and the second data group to the data receiving chain;

[0076] Step 3: When the custody chain audits the integrity of cross-chain data, the custody chain generates a challenge message and sends the challenge message to the receiving chain to verify whether the access chain has sent complete and correct data to the receiving chain;

[0077] Step 4: After receiving the challenge information, the receiving chain generates a corresponding audit certificate and sends the audit certificate back to the custody chain. The custody chain verifies whether the access chain has sent complete and correct data to the receiving chain based on the received audit certificate, that is, verifies the integrity of the cross-chain data. If the verification is successful, it indicates that the cross-chain data is complete, otherwise the cross-chain data is incomplete;

[0078] Step 5: When the audit verification of the custody chain fails, the custody chain sends an error message to the access chain. The access chain finds the error data block according to the error message and sends the correct data block to the receiving chain to modify the error data block.

[0079] Step 6: When the custody chain wants to perform batch audit on multiple files, the custody chain generates multi-file challenge information for the multiple files, and sends the multi-file challenge information to the receiving chain to verify whether the access chain has sent complete and correct data to the receiving chain. After receiving the multi-file challenge information, the receiving chain generates a corresponding multi-file audit certificate and sends the multi-file audit certificate back to the custody chain. The custody chain verifies whether the access chain has sent complete and correct data to the receiving chain based on the received multi-file audit certificate, that is, verifies the integrity of the cross-chain data. If the verification is successful, it indicates that the cross-chain data is complete, otherwise the cross-chain data is incomplete;

[0080] Step 7: When the data owner wants to modify, insert and delete the data stored in the access chain and the receiving chain, the data owner sends modification, insertion and deletion requests to the access chain respectively. After receiving the request, the access chain sends the file F′ stored on the blockchain to the data owner. After updating the file F′, the data owner sends the relevant update information to the access chain. After completing the update according to the update information, the access chain generates an update certificate and sends it to the data owner. The data owner verifies the update certificate. If the verification is successful, the verification signature is sent to the access chain for storage for future data auditing. Finally, the access chain sends an update request to the receiving chain to enable the receiving chain to update the data.

[0081] In combination with the above-mentioned implementation steps, the implementation of the method of the present invention can be further described as follows:

[0082] S1. Before the data owner sends the data to the access chain, the data is processed first. The processing process is as follows:

[0083] 11) represents the file sent by the data owner to the access chain, where [n] = {1, 2, ..., n} represents the index of the data block, Indicates the subscript of the private data block in the original file F. In order to protect the private data, the data owner randomly selects a value And calculate |K| blinding factors α i =F(i,k), where i∈K, is a pseudo-random function, and then the data owner uses equation m i ′=m i +α i Calculate the blinded data block, where i∈K, but for the data block without privacy data, m i ′=m i, the content of the data block will not change, and the processed file F′ can be obtained after blinding processing.

[0084] 12) The data owner generates a bilinear group (p, g, G1, G2, e) and selects two cryptographic hash functions H: {0, 1} * →G1 and h:G1→Z p , and choose a random value x←Z p , a random value s←G1, and calculate z←g x and ω←s x , where the private key is sk = x and the public key is pk = (z, ω, g, s). The data owner also needs to give each data block m of file F′ i Generate signature And the signature σ i Put the signature set Ω = {σ i}middle.

[0085] 13) The data owner calculates the hash value h of each data block i =H(m i ′) and build a ternary hash tree T, and then use the private key sk to sign the root of the ternary hash tree T and the version number version of the file F′ sig sk (H(R))=(H(R)) x , sig sk (version)=version x , and the file F′, the ternary hash tree T, and the root value signature sig of the tree sk (H(R)), signature set Ω and signature sig for file version number sk (version) is sent to the access chain.

[0086] After receiving the data, the access chain stores the data on the blockchain and signs the file F′ and the root value of the tree sig sk (H(R)), Sign the file version number sig sk The (version) and signature set Ω are sent to the receiving chain to store the data.

[0087] When the chain of custody verifies the integrity of cross-chain data, a challenge message is generated on the chain of custody. For each audit task, the chain of custody randomly selects a set of To indicate the index of the data block to be challenged, the custody chain then selects |I| random values Where i∈I, the challenge information chal={(i,v i )} i∈I , and sends the challenge information to the receiving chain.

[0088] S2. After receiving the challenge information, the receiving chain generates an audit certificate based on the challenge information. At the same time, the supervision chain begins to perform audit operations to verify the integrity and correctness of the data. The specific operations can be described as follows:

[0089] The receiving chain selects a random value α←Z p , and calculate the values ​​of β, γ, σ respectively: β=(ω) α =(s x ) α , Obtain the audit certificate:

[0090] proof={β,γ,σ,H(m i ′) i∈I ,sig sk (H(R)),sig sk (version)},

[0091] The audit proof is then sent to the chain of custody.

[0092] After receiving the audit certificate, the chain of custody uses the equation:

[0093] e(sig sk (H(R)),g)=e(H(R),g x )

[0094] e(sig sk (version),g)=e(version,g x )

[0095] First verify the root value signature sig of the ternary hash tree sk (H(R)) and file version number signature sig sk (version) is correct. If verification fails, the chain of custody determines that the audit has failed. Otherwise, the equation is used:

[0096]

[0097] The integrity is verified. If the equation holds true, it proves that the access chain has sent the complete data to the receiving chain. Otherwise, the access chain has not sent the complete data to the receiving chain.

[0098] If the integrity verification fails, the custody chain sends an error message error={F N ,sig sk (version),H(m i ′) i∈I} to the access chain, the access chain uses H(m i ′) i∈Iand stored in the block Construct a ternary hash tree T′ and traverse T and T′ to find the error data block {m Ei ′} i∈Q , where Q = {1,2...,q} represents the generation of an erroneous data block, and then the access chain finds the corresponding correct data block {m i ′} i∈Q The error information is sent to the receiving chain, and the receiving chain modifies the corresponding error data block. It is worth mentioning that the processing of error information in the method of the present invention is for single file auditing.

[0099] It is noted that in this step, when the chain of custody can audit multiple tasks at one time, the detailed process is as follows:

[0100] First, T data owners each own file F t =(m t,1 ,...,m t,n ), where t∈{1,...,T}, then T data owners each have a copy of the file F t After blinding processing, the processed file F is obtained t ′, and generate their own private keys sk t =x t and public key pk t =(z t ,ω t ,g t ,s t ). T data owners each have a share in data block m t,i 'Sign And put it into the signature set Ω t ={σ t,i}, where i∈{1,...,n}.

[0101] Second, for all documents to be audited, the chain of custody randomly selects a set To indicate the index of the data block to be challenged, the custody chain then selects |I| random values Where i∈I, the challenge information chal={(i,v i )} i∈I , and sends the challenge information to the receiving chain.

[0102] Again, the receiving chain generates random numbers α for each of the T data owners. t ∈Z p , and calculate σ, {γ t} 1≦t≦T , {β t} 1≦t≦T :

[0103] Finally, we get the multi-file audit proof proof = {σ, {γ t} 1≦t≦T ,{β t} 1≦t≦T ,H(m t,i ′) i∈I ,sig sk (H(R t )) 1≦t≦T ,sig sk (version t ) 1≦t≦T}.

[0104] Finally, the chain of custody, after receiving the multi-document audit proof, uses the equation:

[0105]

[0106]

[0107] First verify the root value signature of the tree And the file version number signature Is it correct? If verification fails, the chain of custody audit fails, otherwise using the equation:

[0108]

[0109] The integrity is verified. If the equation holds true, it proves that the access chain has sent the complete data to the receiving chain. Otherwise, the access chain has not sent the complete data to the receiving chain.

[0110] S3. The data owner performs modification, insertion, and deletion on the data stored on the access chain and the receiving chain.

[0111] 31) When the data owner wants to modify the data stored in the access chain and the receiving chain, the data owner first sends a modification request modify={F N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F′ and sends F′ to the data owner;

[0112] Secondly, the data owner finds the data block m to be modified in F′ i ′, and change it to m i ″, and according to the new data block m i Generate a new signature Then according to m i ″Regenerate the ternary hash tree T′ and replace {mi ″,σi′,F N} is sent to the data access chain, and the data access chain converts the m in file F′ i ′ is changed to m i ″, and generate a new block to store the updated file F′′, the ternary hash tree T″ and σ i ′;

[0113] Again, the data access chain sends the root hash value H(R″) of T″ to the data owner, who compares whether H(R′) is equal to H(R″). If not, it means that the data modification has failed. If they are equal, the data owner signs H(R″) with sig sk (H(R″)) and sign the newly generated version number sig sk (version′);

[0114] Finally, the data owner will sig sk (H(R″)) and sig sk (version′) is sent to the access chain for storage, and the access chain sends {F N ,σ i ′,m i ″,sig sk (H(R″)),sig sk (version′), Modify}, where Modify indicates a modification request. The data receiving chain directly locates the corresponding version F′ according to the state database. i ′ to m i ″After that, a new block is generated to store {F″,σ i ′,sig sk (H(R″)),sig sk (version′)} and update the status database content.

[0115] 32) When the data owner wants to insert data stored in the access chain and the receiving chain, the data owner first sends an insert request to the access chain. N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F′ and sends F′ to the data owner;

[0116] Secondly, the data owner has a specific data block m in F′ i 'After inserting the new data block m x and m y , and according to m x and my Generate new signatures respectively Then according to m x and m y Regenerate the ternary hash tree T′ and replace {i,m x ,m y ,σ x ′,σ y ′,F N} is sent to the access chain, where i represents the data block insertion position. The access chain inserts m after the i-th position in file F′. x and m y , and generate a new block to store the updated file F″, ternary hash tree T″, σ x ′ and σ y ′;

[0117] Again, the access chain sends the root hash value H(R″) of T″ to the data owner, who compares whether H(R′) is equal to H(R″). If not, it means that the data insertion failed. If they are equal, the data owner signs H(R″) with sig sk (H(R″)) and sign the newly generated version number sig sk (version′);

[0118] Finally, the data owner will sig sk (H(R″)) and sig sk (version′) is sent to the access chain for storage, and the access chain sends {F N ,σ x ′,σ y ′,m x ,m y ,i,sig sk (H(R″)),sig sk (version′),Insert}, where Insert represents an insert request. The data receiving chain directly locates the corresponding version of F′ according to the state database and inserts m after position i of F′. x and m y Then a new block is generated to store {F″,σ x ′,σ y ′,sig sk (H(R″)),sig sk (version′)} and update the status database content.

[0119] 33) When the data owner wants to delete the data stored in the access chain and the receiving chain, first, the data owner sends a delete request to the access chain. N ,sig sk(version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F′ and sends F′ to the data owner;

[0120] Secondly, the data owner converts m in F′ x and m y After deletion, regenerate the ternary hash tree T′ and replace {x,y,F N} is sent to the access chain, where x and y represent the subscripts of the data blocks to be deleted. The data access chain finds and deletes the data blocks at positions x and y and the corresponding signatures in file F′, and generates a new block to store the updated file F″ and the ternary hash tree T″;

[0121] Again, the data access chain sends the root hash value H(R″) of T″ to the data owner, who compares whether H(R′) is equal to H(R″). If not, it means that the data deletion failed. If they are equal, the data owner signs H(R″) with a sig sk (H(R″)) and sign the newly generated version number sig sk (version′);

[0122] Finally, the data owner will sig sk (H(R″)) and sig sk (version′) is sent to the access chain for storage, and the access chain sends {F N ,x,y,sig sk (H(R″)),sig sk (version′),Delete}, where Delete represents a deletion request. The receiving chain directly locates the corresponding version F′ according to the state database, deletes the data at the x and y positions of F′, and generates a new block to store {F″,sig sk (H(R″)),sig sk (version′)} and update the status database content.

[0123] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

[0124] Example 1

[0125] In combination with the steps implemented by the present invention, the data block size is set to 4KB, the file size is set to 2M, and the number of files is set to 25, 50, 75, 100, 125, 150, 175, and 200, respectively. On this basis, the time spent on single file audit and multi-file batch audit is statistically analyzed, and the statistical results are shown in Table 1. Analysis of Table 1 shows that under the same number of files, the time spent on batch audit is less than that on single file audit, and as the number of files increases, the time difference between the two audits becomes larger, that is, when the number of files is huge, batch audit can greatly improve the audit efficiency.

[0126] Table 1 Comparison of time costs between single file audit and batch file audit

[0127]

[0128] In view of the different file sizes, the present invention has statistically analyzed the time spent on batch auditing of files, and the statistical results are shown in Table 2, where the file sizes are 2M, 4M, 8M, and 16M, respectively, and the number of files is consistent with the previous text. Analysis of Table 2 shows that for files of different sizes, when the number of files is the same, the time spent on batch auditing is roughly the same, that is, no matter how large the file size is, the time spent on batch auditing is not much different from the time spent on auditing small files. This is because in the present invention, the chain of custody only selects random blocks for auditing during auditing, rather than auditing the entire file, which greatly improves the efficiency of auditing large files.

[0129] Table 2 Comparison of time costs for batch auditing files of different sizes

[0130]

[0131] It can be seen from the above embodiments that the audit method of the present invention uses bilinear aggregate signature technology to achieve batch auditing. At the same time, the chain of custody only selects random blocks for auditing during auditing, which not only improves the efficiency of multi-file auditing, but also improves the efficiency of auditing larger files. The method has good auditing efficiency and is an efficient auditing algorithm.

Claims

1. A dynamic audit method for cross-chain data consistency based on the chain of custody, characterized in that: The method includes auditing a single file and batch auditing multiple files, and includes the following steps: (I) For the file processing of the data owner, access chain and receiving chain, the processing method of the original file includes blinding processing, initial parameter setting, data block signing and generation of audit information, and also includes the following processes: (11) The data owner processes the original file F to obtain a file F' and a first data group including audit parameter information, and sends the processed file F' and the first data group to the data access chain; (12) The access chain stores the file F' and the first data group, and sends the file F' and the second data group to the data receiving chain, which stores them in the blockchain. The second data group includes a root value signature of the ternary hash tree, a file version number signature, and a set of data block signatures. The processing of the original file F specifically includes the following steps: Blinding treatment: represents the file sent by the data owner to the access chain, assuming that [n] = {1, 2, ..., n} represents the index of the data block, where Indicates the subscript of the private data block in the original file F. In order to protect the private data, the data owner randomly selects a value And calculate |K| blinding factors α i =f(i,k), where i∈K, f: is a pseudo-random function, and then the data owner uses equation m i '=m i +α i Calculate the blinded data block, where i∈K, for the data block without privacy data, that is, m i '=m i , the content of the data block will not change, and the processed file F' is obtained after blinding processing; Initial parameter setting: The data owner generates a bilinear group (p, g, G1, G2, e) and then selects two cryptographic hash functions H: {0, 1} * →G1 and h:G1→Z p , and choose a random value x←Z p , a random value s←G1, and calculate z←g x and ω←s x , where the private key is sk=x and the public key is pk=(z,ω,g,s); Generate data block signature: The data owner gives each data block m of file F' i 'Generate signature And the signature σ i Put the signature set Ω = {σ i }middle; Generate audit information: The data owner calculates the hash value h of each data block i =H(m i ') and build a ternary hash tree T, and then use the private key sk to sign the root of the ternary hash tree T and the version number version of the file F' sig sk (H(R))=(H(R)) x , sig sk (version)=version x ; Data transfer: The data owner sends the file F', the ternary hash tree T, and the root value signature sig sk (H(R)), signature set Ω and signature sig for file version number sk (version) is sent to the access chain; (II) The audit of cross-chain data integrity by the chain of custody includes the following process: (21) When the supervision chain performs an audit of a single file, the supervision chain generates a challenge message and sends the challenge message to the receiving chain to verify whether the data sent by the access chain to the receiving chain is complete and correct; after receiving the challenge message, the receiving chain generates a corresponding audit certificate and sends the audit certificate back to the supervision chain. The supervision chain verifies whether the data sent by the access chain to the receiving chain is complete and correct based on the received audit certificate, thereby completing the integrity verification of the cross-chain data; when the supervision chain audit verification fails, the supervision chain sends an error message to the access chain. The access chain finds the error data block based on the error message and sends the correct data block to the receiving chain so that it can modify the error data block; The audit in step (21) includes the following process: Generate challenge information on the custody chain: For each audit task, the custody chain randomly selects a set To indicate the index of the data block to be challenged, the custody chain then selects |I| random values Where i∈I, the challenge information chal={(i,v i )} i∈I ; The receiving chain generates an audit proof: the receiving chain selects a random value α←Z p , and calculate the values ​​of β, β, σ respectively: β=(ω) α =(s x ) α , Finally, the audit certificate is obtained, which is expressed as follows: proof={β,γ,σ,h(m i ') i∈I ,sig sk (H(R)),sig sk (version)}; Chain of custody verifies cross-chain data integrity: After receiving the audit proof, the chain of custody uses the equation: and(sig sk (h(R)),g)=e(H(R),g x ) e(sig sk (version),g)=e(version,g x ) First verify the root value signature sig of the ternary hash tree sk (H(R)) and file version number signature sig sk (version) is correct. If verification fails, the chain of custody determines that the audit has failed. Otherwise, the equation is used: Verify the integrity. If the equation holds, it proves that the access chain has sent the complete data to the receiving chain. Otherwise, the access chain has not sent the complete data to the receiving chain. Where, e:G×G→G is a bilinear pairing calculation. (22) When the custody chain performs a batch audit on more than one file, the custody chain generates challenge information for the corresponding file, and sends the file challenge information to the receiving chain to verify whether the data sent by the access chain to the receiving chain is complete and correct. After receiving the challenge information, the receiving chain generates a corresponding audit certificate and sends the corresponding file audit certificate back to the custody chain. The custody chain verifies whether the access chain has sent complete and correct data to the receiving chain based on the received file audit certificate. In step (22), for all the documents to be audited, the chain of custody randomly selects a set To represent the index of the data block to be challenged, the custody chain then selects |I| random values Where i∈I, the challenge information chal={(i,v i )} i∈I ; When performing batch audit of multiple files, the initial parameter settings and data block signatures can be assigned and processed at the same time, as shown below: Initial parameter setting: T data owners each own file F t =(m t,1 ,...,m t,n ), where t∈{1,...,T}, then the T data owners each have a t After blinding processing, the processed file F is obtained t ', and generate their own private keys sk t =x t and public key pk t =(z t ,ω t ,g t ,s t ); Generate data block signature: T data owners each sign data block m t,i 'Sign And put it into the signature set Ω t ={σ t,i }, where i∈{1,...,n}; The audit of step (22) includes the following process: The receiving chain generates a multi-file audit proof: The receiving chain generates a random number α for each of the T data owners. t ∈Z p , and calculate σ, {γ t } 1≦t≦T , {β t } 1≦t≦T : Finally, we get the multi-file audit proof proof = {σ, {γ t } 1≦t≦T ,{β t } 1≦t≦T ,H(m t,i ') i∈I ,sig sk (H(R t )) 1≦t≦T ,sig sk (version t ) 1≦t≦T }; Data Integrity Verification: Chain of Custody, upon receipt of multi-document audit proof, utilizes the equation: First verify the root value signature of the ternary hash tree And the file version number signature Correct, if verification fails, the chain of custody audit fails, otherwise using the equation: Verify the integrity. If the equation holds, it proves that the access chain has sent the complete data to the receiving chain. Otherwise, the access chain has not sent the complete data to the receiving chain. e:G×G→G is a bilinear pairing calculation. (III) The data owner modifies, inserts, and deletes the data stored in the access chain and the receiving chain, including the following processes: The data owner sends modification, insertion and deletion requests to the access chain respectively. After receiving the request, the access chain sends the file F' stored on the blockchain to the data owner. After updating the file F', the data owner sends the relevant update information to the access chain. The access chain generates an update certificate after completing the update according to the update information and sends it to the data owner. The data owner verifies the update certificate. If the verification is successful, the verification signature is sent to the access chain for storage for future data auditing. Finally, the access chain sends an update request to the receiving chain to enable the receiving chain to update the data; The data modification operations are as follows: Request modification: The data owner sends a modification request modify={F N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F' and sends F' to the data owner; Modify data: The data owner finds the data block m to be modified in F' i ', change it to m i ", and according to the new data block m i Generate new signature Then according to m i "Regenerate the ternary hash tree T' and replace {m i ”,σ i ',F N } is sent to the data access chain, and the data access chain converts the m in file F' i 'Change to m i ", and generate new blocks to store the updated file F'', the ternary hash tree T" and σ i '; Verify the modification proof: The data access chain sends the root hash value H(R") of T" to the data owner. The data owner compares whether H(R') is equal to H(R"), if not, it means that the data modification failed. If they are equal, the data owner signs H(R") sk (H(R")), and sign the newly generated version number sig sk (version'); Data transfer and storage: The data owner will sig sk (H(R")) and sig sk (version') is sent to the access chain for storage, and the access chain sends {F N ,σ i ',m i ”,sig sk (H(R")),sig sk (version'), Modify}, where Modify indicates a modification request. The data receiving chain directly locates the corresponding version F' according to the state database, and i 'Change to m i "After that, a new block is generated to store {F",σ i ',sig sk (H(R")),sig sk (version')} and update the status database content; The data insertion operation is as follows: Request insert: The data owner sends an insert request to the access chain. N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F' and sends F' to the data owner; Insert data: The data owner's specific data block m in F' i 'After inserting new data block m x and m y , and according to the m x and m y Generate new signatures respectively Then according to m x and m y Regenerate the ternary hash tree T' and replace {i,m x ,m y ,σ x ',σ y ',F N } is sent to the access chain, where i represents the data block insertion position. The access chain inserts m after the i-th position in file F'. x and m y , and generate new blocks to store the updated file F', ternary hash tree T', σ x ' and σ y '; Verify the insertion proof: The data access chain sends the root hash value H(R") of T" to the data owner. The data owner compares whether H(R') is equal to H(R"), if not, it means that the data insertion failed. If they are equal, the data owner signs H(R") sk (H(R")), and sign the newly generated version number sig sk (version'); Data transfer and storage: The data owner will sig sk (H(R")) and sig sk (version') is sent to the access chain for storage, and the access chain sends {F N ,σ x ',σ y ',m x ,m y ,i,sig sk (H(R")),sig sk (version'),Insert}, where Insert represents an insert request. The data receiving chain directly locates the corresponding version of F' according to the state database and inserts m after position i of F'. x and m y Then a new block is generated to store {F”,σ x ',σ y ',sig sk (H(R")),sig sk (version')} and update the status database content; The data deletion operations are as follows: Request to delete: The data owner sends a delete request to the access chain. N ,sig sk (version)}, the access chain is in the block according to the file name F N and sig sk (version) finds the corresponding version file F' and sends F' to the data owner; Deleting data: The data owner deletes m in F' x and m y After deletion, regenerate the ternary hash tree T' and replace {x,y,F N } is sent to the access chain, where x and y represent the subscripts of the data blocks to be deleted. The data access chain finds and deletes the data blocks at positions x and y and the corresponding signatures in file F', and generates a new block to store the updated file F" and the ternary hash tree T"; Verify the deletion proof: The data access chain sends the root hash value H(R") of T" to the data owner. The data owner compares whether H(R') is equal to H(R"), if not, it means that the data deletion failed. If they are equal, the data owner signs H(R") sk (H(R")), and sign the newly generated version number sig sk (version'); Data transfer and storage: Data owners will sig sk (H(R")) and sig sk (version') is sent to the access chain for storage, and the access chain sends {F N ,x,y,sig sk (H(R")),sig sk (version'),Delete}, where Delete indicates a deletion request. The receiving chain directly locates the corresponding version F' according to the state database, deletes the data at the x and y positions of F', and generates a new block to store {F",sig sk (H(R")),sig sk (version')} and update the status database content.

2. The cross-chain data consistency dynamic audit method based on the custody chain according to claim 1 is characterized in that: If the verification of a single file audit fails, the error message is recorded as error={F N ,sig sk (version),H(m i ') i∈I }, where F N The name of the file F' is represented, and the steps of finding the error data block are as follows: The access chain uses H(m i ') i∈I and stored in the block Construct a ternary hash tree T' and traverse T and T' to find the error data block {m Ei '} i∈Q , where Q = {1,2...,q} represents the generation of an erroneous data block, and then the access chain finds the corresponding correct data block {m i '} i∈Q sent to the receiving chain.

Images