A data sharing system, method, device and electronic equipment

Abstract

Embodiments of the present application provide a data sharing system, method, device and electronic equipment, the system comprising: a data requester, a plurality of edge nodes and a data owner; the data requester is configured to send a data request to a first edge node; the first edge node is configured to obtain an authentication token from a specified block of a blockchain, and send verification information indicating that access is allowed to the data requester in the case of determining that access is allowed; the data requester is configured to generate its own public-private key pair and send the public key to the data owner; the data owner is configured to encrypt a target key using the public key to obtain an encrypted target key and send the encrypted target key to a second edge node; the second edge node is configured to send the encrypted target key and target data ciphertext to the data requester; and the data requester is configured to decrypt the encrypted target key using the private key to obtain the target key, and decrypt the target data ciphertext using the target key to obtain the target data. The embodiments of the present application realize secure sharing of data.

Description

Technical Field

[0001] This invention relates to the fields of network technology and security technology, and in particular to a data sharing system, method, apparatus and electronic device. Background Technology

[0002] Edge computing is a distributed computing approach that refers to building a network architecture or open platform that integrates core network, computing, storage, and application capabilities at the network edge, close to users or data sources. This provides services to application developers, service providers, and other users locally. Edge computing enables services such as cloud services and network environment services to be implemented through local devices without relying on the cloud. Data processing and transmission can be completed at the local edge computing layer, thereby reducing data transmission latency, improving data processing efficiency, providing users with faster service response times, and also reducing the load on cloud data centers.

[0003] In practical applications of edge computing, there is often a need for different edge nodes to access each other's data across domains. Therefore, improving the security of data sharing between edge nodes in edge computing application scenarios has become a key aspect of edge computing technology. Summary of the Invention

[0004] The purpose of this invention is to provide a data sharing system, method, apparatus, and electronic device to improve the security of data sharing between edge nodes. The specific technical solution is as follows:

[0005] In a first aspect, embodiments of the present invention provide a data sharing system, the system comprising: a data requester, multiple edge nodes, and a data owner;

[0006] The data requester is used to send a data request to the corresponding first edge node locally, wherein the data request includes a data identifier of the target data being requested;

[0007] The first edge node is configured to obtain an authentication token for the target data from a designated block of the blockchain based on the data identifier, and, if the data requester is allowed to access the target data based on the authentication token, send verification information indicating that access is permitted to the data requester, wherein the authentication token includes the access conditions for the target data;

[0008] The data requester is also configured to generate its own public-private key pair after receiving the verification information, and send its own public key to the data owner;

[0009] The data owner is used to encrypt the target data using the public key to obtain the encrypted target key, and then send it to the second edge node that stores the ciphertext of the target data.

[0010] The second edge node is used to send the encrypted target key and the target data ciphertext to the data requester after receiving the encrypted target key;

[0011] The data requester is also used to decrypt the encrypted target key using its own private key to obtain the target key; and to decrypt the target data ciphertext using the target key to obtain the target data.

[0012] In one embodiment of the present invention, the data request further includes: user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access.

[0013] The first edge node is specifically used to obtain the transaction record of the target data from the designated block, determine the second edge node that last encrypted the authentication token based on the node identifier in the transaction record, decrypt the encrypted authentication token using the node public key of the second edge node, and based on the decrypted authentication token, determine whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, determine that the data requester is allowed to access the target data and send the verification information to the data requester.

[0014] In one embodiment of the present invention, the first edge node is further configured to, after the data requester obtains the target data, encrypt the authentication token using its own node private key, and update the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; generate a new designated block from the updated transaction record and upload it to the blockchain;

[0015] The blockchain is also used to synchronize the new designated block to each of the edge nodes.

[0016] In one embodiment of the present invention, the data owner is further configured to encrypt the target data using the target key before the data requester sends a data request to the first edge node, to obtain the target data ciphertext; and upload the target data ciphertext and the access conditions of the target data to the second edge node;

[0017] The second edge node is further configured to request the allocation of a data identifier corresponding to the target data from the blockchain, and store the data identifier and the encrypted target data accordingly; generate an authentication token for the target data based on the access conditions of the target data, and encrypt the authentication token using its own node private key; generate a transaction record for the target data based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the encrypted target data; generate the transaction record into the designated block and upload it to the blockchain;

[0018] The blockchain is also used to synchronize the designated block to each of the edge nodes.

[0019] Secondly, embodiments of the present invention also provide a data sharing method applied to a data sharing system, the method comprising:

[0020] The data request is sent to the first edge node corresponding to the local data requester, wherein the data request includes the data identifier of the target data requested.

[0021] Using the first edge node, an authentication token for the target data is obtained from a designated block of the blockchain based on the data identifier. If the authentication token determines that the data requester is allowed to access the target data, verification information indicating that access is allowed is sent to the data requester. The authentication token includes the access conditions for the target data.

[0022] After receiving the verification information, the data requester generates its own public-private key pair and sends its public key to the data owner.

[0023] The data owner uses the public key to encrypt the target data, obtains the encrypted target key, and sends it to the second edge node storing the ciphertext of the target data.

[0024] After receiving the encrypted target key, the second edge node sends the encrypted target key and the target data ciphertext to the data requester.

[0025] The data requester uses its own private key to decrypt the encrypted target key to obtain the target key; then, the target key is used to decrypt the target data ciphertext to obtain the target data.

[0026] In one embodiment of the present invention, the data request further includes: user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access.

[0027] The process of using a first edge node to determine the authentication token of the target data from a designated block of the blockchain based on the data identifier, and sending verification information indicating permission to access the target data to the data requester based on the authentication token, includes:

[0028] The transaction records for obtaining the target data from the designated block using the first edge node are used. The second edge node that last encrypted the authentication token is determined based on the node identifier in the transaction records. The encrypted authentication token is decrypted using the public key of the second edge node. Based on the decrypted authentication token, it is determined whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it is determined that the data requester is allowed to access the target data, and the verification information is sent to the data requester.

[0029] In one embodiment of the present invention, after the data requester decrypts the encrypted target key using its own private key to obtain the target key, and then uses the target key to decrypt the target data ciphertext to obtain the target data, the method further includes:

[0030] The first edge node encrypts the authentication token using its own node private key, and updates the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; the updated transaction record is then used to generate a new designated block and uploaded to the blockchain.

[0031] The new designated block is synchronized to each of the edge nodes using the blockchain.

[0032] In one embodiment of the present invention, before sending a data request to the first edge node corresponding to the local data requester, the method further includes:

[0033] The data owner encrypts the target data using the target key to obtain the target data ciphertext; the target data ciphertext and the access conditions of the target data are then uploaded to the second edge node.

[0034] The second edge node requests the allocation of a data identifier corresponding to the target data from the blockchain, and stores the data identifier and the encrypted target data accordingly; an authentication token for the target data is generated based on the access conditions of the target data, and the authentication token is encrypted using its own node private key; a transaction record for the target data is generated based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the encrypted target data; the transaction record is used to generate the designated block and uploaded to the blockchain;

[0035] The blockchain is used to synchronize the designated block to each edge node.

[0036] Thirdly, embodiments of the present invention also provide a data sharing device for use in a data sharing system, the device comprising:

[0037] The request sending module is used to send a data request to the local corresponding first edge node through the data request direction, wherein the data request includes the data identifier of the target data to be requested;

[0038] The information verification module is used to obtain an authentication token for the target data from a designated block of the blockchain based on the data identifier using the first edge node, and send verification information indicating permission to access the target data to the data requester if the data requester is allowed to access the target data based on the authentication token. The authentication token includes the access conditions for the target data.

[0039] The public key sending module is used to generate its own public-private key pair after the data requester receives the verification information, and send its own public key to the data owner;

[0040] The target key encryption module is used to encrypt the target key of the target data using the public key by the data owner, obtain the encrypted target key, and send it to the second edge node storing the ciphertext of the target data;

[0041] The ciphertext sending module is used to send the encrypted target key and the target data ciphertext to the data requester after the second edge node receives the encrypted target key;

[0042] The data acquisition module is used to decrypt the encrypted target key using the private key of the data requester to obtain the target key; and to decrypt the target data ciphertext using the target key to obtain the target data.

[0043] In one embodiment of the present invention, the data request further includes: user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access.

[0044] The information verification module is specifically used for:

[0045] The transaction records for obtaining the target data from the designated block using the first edge node are used. The second edge node that last encrypted the authentication token is determined based on the node identifier in the transaction records. The encrypted authentication token is decrypted using the public key of the second edge node. Based on the decrypted authentication token, it is determined whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it is determined that the data requester is allowed to access the target data, and the verification information is sent to the data requester.

[0046] In one embodiment of the present invention, the apparatus further includes:

[0047] The transaction record update module is used to encrypt the authentication token using the private key of the first edge node, and update the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; generate a new designated block from the updated transaction record and upload it to the blockchain;

[0048] The first block synchronization module is used to synchronize the new designated block to each edge node using the blockchain.

[0049] In one embodiment of the present invention, the apparatus further includes:

[0050] The data upload module is used to encrypt the target data using the target key by the data owner to obtain the target data ciphertext; and upload the target data ciphertext and the access conditions of the target data to the second edge node.

[0051] The transaction record generation module is used to request the allocation of a data identifier corresponding to the target data from the blockchain using a second edge node, and to store the data identifier and the encrypted target data accordingly; to generate an authentication token for the target data based on the access conditions of the target data, and to encrypt the authentication token using its own node private key; to generate a transaction record for the target data based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stored the encrypted target data; and to generate the transaction record into the designated block and upload it to the blockchain.

[0052] The second block synchronization module is used to synchronize the designated block to each edge node using the blockchain.

[0053] Fourthly, embodiments of the present invention also provide an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0054] Memory, used to store computer programs;

[0055] When a processor executes a program stored in memory, it implements any of the data sharing method steps described above.

[0056] Fifthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the data sharing method steps described above.

[0057] Beneficial effects of the embodiments of the present invention:

[0058] The data sharing system provided in this invention involves a data requester sending a data request, including a data identifier of the target data, to a local first edge node. The first edge node then determines an authentication token for the target data from a designated block in the blockchain based on the data identifier. If the authentication token indicates that access to the target data is permitted, the first edge node sends verification information indicating that access is allowed. Upon receiving the verification information, the data requester generates its own public-private key pair and sends its public key to the data owner. The data owner then uses the received public key to encrypt a target key for the target data and sends the encrypted target key to a second edge node storing the ciphertext of the target data. The second edge node then sends both the encrypted target key and the ciphertext of the target data to the data requester. Finally, the data requester uses its private key to decrypt the encrypted target key and then uses the decrypted target key to decrypt the ciphertext of the target data to obtain the target data.

[0059] The data sharing system provided in this invention uses blockchain to store authentication tokens for data. These tokens are used to control access permissions for cross-domain data sharing, leveraging the decentralized nature of blockchain to improve data sharing security. Furthermore, data is stored and accessed through edge nodes, reducing resource overhead on the user end and ensuring data transmission speed. Simultaneously, the data stored at the edge nodes is encrypted, and the key for the transmitted encrypted data is also encrypted. This key is only accessible to the data owner and the data requester authorized by the authentication token, achieving double encryption of the data. This reduces the risk of data exposure, enables cross-domain data access, further improves the security of data sharing between edge nodes, and enhances the universality and versatility of the cross-domain data sharing solution.

[0060] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0062] Figure 1a This is a schematic diagram of the structure of a data sharing system provided in an embodiment of the present invention;

[0063] Figure 1b A specific structural example diagram of a possible data sharing system provided in an embodiment of the present invention;

[0064] Figure 1c This is a structural example diagram of a designated block provided in an embodiment of the present invention;

[0065] Figure 2 A flowchart illustrating the first data sharing method provided in an embodiment of the present invention;

[0066] Figure 3a This is a flowchart illustrating the second data sharing method provided in an embodiment of the present invention;

[0067] Figure 3b This invention provides a flowchart illustrating a process by which a data requester accesses target data through a first edge node.

[0068] Figure 4a A flowchart illustrating the third data sharing method provided in this embodiment of the invention;

[0069] Figure 4b This is a flowchart illustrating a process by which a data owner uploads encrypted target data to a second edge node, as provided in an embodiment of the present invention.

[0070] Figure 5 This is a schematic diagram of the structure of a data sharing device provided in an embodiment of the present invention;

[0071] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0072] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of the present invention.

[0073] To address the challenge of secure data sharing between edge nodes in edge computing applications, this invention provides a data sharing system, method, apparatus, and electronic device.

[0074] The data sharing system provided in the embodiments of the present invention will be described in detail below through specific examples.

[0075] The system described in this invention is applied to an edge computing platform and can be deployed through such a platform. In practical use, it can also be mounted on physical electronic devices, virtual machines, etc.

[0076] See Figure 1a , Figure 1a A schematic diagram of a data sharing system provided in an embodiment of the present invention includes: a data requester 101, multiple edge nodes 102, and a data owner 103;

[0077] The data requester is used to send a data request to the corresponding first edge node locally, wherein the data request includes a data identifier of the target data being requested;

[0078] The first edge node is configured to obtain an authentication token for the target data from a designated block of the blockchain based on the data identifier, and, if the data requester is allowed to access the target data based on the authentication token, send verification information indicating that access is permitted to the data requester, wherein the authentication token includes the access conditions for the target data;

[0079] The data requester is also configured to generate its own public-private key pair after receiving the verification information, and send its own public key to the data owner;

[0080] The data owner is used to encrypt the target data using the public key to obtain the encrypted target key, and send it to the second edge node storing the ciphertext of the target data, wherein the ciphertext of the target data is the target data encrypted using the target key;

[0081] The second edge node is used to send the encrypted target key and the target data ciphertext to the data requester after receiving the encrypted target key;

[0082] The data requester is also used to decrypt the encrypted target key using its own private key to obtain the target key; and to decrypt the target data ciphertext using the target key to obtain the target data.

[0083] The data sharing system provided by this invention includes multiple edge nodes that are interconnected and deployed in different locations to be close to user terminals or data sources in different locations. Each edge node corresponds locally to the nearest user terminal or data source, providing faster network response. The edge node corresponding to the data requester is called the first edge node, and the edge node corresponding to the data owner is called the second edge node. The data owner encrypts the target data and uploads the resulting ciphertext to the second edge node. When the data requester requests access to the target data, it needs to send a data request to the first edge node to access the target data.

[0084] Blockchain is a decentralized distributed data management framework that has been applied to many distributed system scenarios. Through its decentralized and unforgeable computing model, it enables efficient and low-cost distributed trusted computing and transactions, and is currently widely used in finance, logistics, industrial manufacturing, healthcare, and the Internet of Things. In this embodiment of the invention, the aforementioned multiple edge nodes construct a blockchain; in one example, this could be a private chain or a consortium chain. The authentication tokens of the data stored in each edge node are stored in designated blocks of the blockchain, corresponding to their respective data identifiers.

[0085] After receiving a data request containing a data identifier from the data requester, the first edge node retrieves an authentication token for the target data corresponding to that data identifier from a designated block in the blockchain. The authentication token includes access conditions for the target data, indicating that access to the target data is only permitted if those conditions are met. Specifically, the access conditions for the target data can be: the data requester's information meets certain criteria, such as the data requester's identity attributes, ID (Identity Document), network information, and security level; the edge node's information meets certain criteria, such as the edge node's node ID, network path information with the second edge node, and security level; or the access time meets certain criteria.

[0086] The first edge node determines whether the current data requester is allowed to access the target data based on the access conditions in the authentication token of the target data. When the determination result is that the data requester is allowed to access the target data, the first edge node sends verification information indicating that access is allowed to the data requester.

[0087] After receiving the verification information from the first edge node, the data requester generates its own public-private key pair, including its own public key and private key. Specifically, the public and private keys are an asymmetric key pair. The public key is sent by the data requester to others for encrypting relevant data; the private key is held by the data requester and used to decrypt data encrypted with the public key. After generating the public-private key pair, the data requester sends the public key to the data owner.

[0088] After receiving the public key from the data requester, the data owner uses the requester's public key to encrypt the target data into a target key. This target key is the key used by the data owner to encrypt the target data and obtain its ciphertext. Specifically, the target key is a symmetric key, meaning the same key is used for both encrypting and decrypting the target data. The data owner obtains the target key encrypted with the public key and sends it to the second edge node storing the ciphertext of the target data.

[0089] After receiving the encrypted target key, the second edge node sends the encrypted target data stored within itself, along with the encrypted target key, to the data requester.

[0090] Upon receiving the target data ciphertext and the encrypted target key, the data requester first uses its own private key to decrypt the target key encrypted with the public key to obtain the target key. Then, it uses the target key to decrypt the target data ciphertext, thereby obtaining the target data.

[0091] As can be seen from the above, the data sharing system provided by this invention stores authentication tokens for data on the blockchain and uses these tokens to control access permissions for cross-domain data sharing. This leverages the decentralized nature of blockchain to improve the security of data sharing. Furthermore, by storing and accessing data through edge nodes, the resource overhead on the user end is reduced, thereby ensuring the transmission rate of data sharing. At the same time, the data stored on the edge nodes is encrypted ciphertext, and the key for the transmitted ciphertext is also encrypted. This key can only be obtained by the data owner and the data requester who has been authorized by the authentication token, achieving double encryption of the data, reducing the risk of data exposure, enabling cross-domain access to data, further improving the security of data sharing between edge nodes, and enhancing the universality and versatility of the cross-domain data sharing solution.

[0092] In one embodiment of the present invention, the data request further includes: user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access.

[0093] The first edge node is specifically used to obtain the transaction record of the target data from the designated block, determine the second edge node that last encrypted the authentication token based on the node identifier in the transaction record, decrypt the encrypted authentication token using the node public key of the second edge node, and based on the decrypted authentication token, determine whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, determine that the data requester is allowed to access the target data and send the verification information to the data requester.

[0094] The designated blocks in the aforementioned blockchain are specifically used to store transaction records for the target data. Each edge node generates transaction records when storing or accessing the target data. Specifically, the transaction record includes the target data's data identifier, the time the target data was stored or accessed, the node identifier of the edge node that last stored or accessed the target data, the authentication token of the target data encrypted using the private key of the edge node that last stored or accessed the target data, and the ID of the target data's data owner. In one example, the transaction record may also include the identifier of the second edge node where the target data is stored, and the confidentiality level of the target data.

[0095] In this embodiment of the invention, after the data owner uploads and stores the encrypted target data to the second edge node, no third edge node has accessed or re-stored the target data before the first edge node. Therefore, the node identifier of the edge node that last stored or accessed the target data in the transaction record is the node identifier of the second edge node. The encrypted authentication token is encrypted using the private key of the second edge node. Therefore, after the first edge node determines from the transaction record that the edge node that last stored or accessed the target data was the second edge node, it uses the public key of the second edge node to decrypt and obtain the authentication token for the target data, thereby obtaining the access conditions for the target data in the authentication token.

[0096] The public keys of each edge node are used to decrypt data encrypted by that edge node using its corresponding private key. In one example, if the public keys of each edge node are stored in the blockchain, then when the first edge node determines the node identifier of the second edge node based on transaction records, it retrieves the second edge node's public key from the blockchain and uses it to decrypt the encrypted authentication token, thereby obtaining the access conditions for the target data within the authentication token. In another example, if each edge node stores the public keys of the other edge nodes, then when the first edge node determines the node identifier of the second edge node based on transaction records, it uses its stored public key of the second edge node to decrypt the encrypted authentication token, thereby obtaining the access conditions for the target data within the authentication token.

[0097] Access to the target data is permitted only when the user attribute information of the data requester matches the permitted user attribute information included in the access conditions of the target data, and the node attribute information of the first edge node also matches the permitted node attribute information included in the access conditions. In this case, a verification message indicating permission to access is sent to the data requester. If the user attribute information of the data requester does not match the permitted user attribute information included in the access conditions of the target data, or if the node attribute information of the first edge node does not match the permitted node attribute information included in the access conditions, access to the target data is denied. In this case, a verification message indicating denial of access is sent to the data requester.

[0098] In one example, the aforementioned user attribute information can refer to the identity attribute information of the data requester. Specifically, it could be the data requester's ID, the professional identity of the user corresponding to the data requester, etc. For instance, if the access conditions for the target data include the user's professional identity as an allowed user attribute, and the user is a university teacher, then access to the target data is allowed. Therefore, if the professional identity of the user corresponding to the data requester is a university teacher, the user attribute information of the data requester matches the allowed user attribute information included in the access conditions for the target data. Similarly, the aforementioned node attribute information can refer to the attribute information of edge nodes. Specifically, it could be the node ID of an edge node, the path information between it and a second edge node, etc. For instance, if the node attribute information included in the access conditions for the target data includes a list of allowed edge node IDs, then if the node ID of the first edge node is in this list, the node attribute information of the first edge node matches the allowed node attribute information included in the access conditions for the target data.

[0099] In one embodiment of the present invention, the first edge node is further configured to, after the data requester obtains the target data, encrypt the authentication token using its own node private key, and update the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; generate a new designated block from the updated transaction record and upload it to the blockchain;

[0100] The blockchain is also used to synchronize the new designated block to each of the edge nodes.

[0101] Once the data requester receives the target data, the access to the target data is considered complete. At this point, the first edge node re-encrypts the decrypted authentication token using its own node private key, uses its own node identifier as the node identifier of the edge node accessing the target data, records the time when the data requester received the target data as the access time, and updates the transaction record of the target data based on the re-encrypted authentication token, the first edge node's node identifier, and the time when the data requester received the target data. The updated transaction record generates a new designated block and uploads it to the blockchain, which then synchronizes the new designated block to all edge nodes.

[0102] As can be seen from the above, the data sharing system provided by this embodiment of the invention, when the first edge node obtains the transaction record of the target data from the designated block, and determines the second edge node of the last encrypted authentication token based on the node identifier in the transaction record, then uses the stored node public key of the second edge node to decrypt the encrypted authentication token. Based on the decrypted authentication token, it checks whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it determines that the data requester is allowed to access the target data; otherwise, it refuses the data requester's access to the target data. Furthermore, after the data requester obtains the target data, it updates the transaction record and synchronizes the updated transaction record through the blockchain. This utilizes the blockchain to achieve authorization authentication for cross-domain data access and synchronous updates of data transaction records, ensuring that both the data transaction records and access permissions are decentralized and trustworthy, thereby improving the security of data sharing. Furthermore, using edge nodes to encrypt and decrypt the authentication token reduces the encryption and decryption computational resource overhead for the data owner and improves the data sharing transmission rate.

[0103] In one embodiment of the present invention, the data owner is further configured to encrypt the target data using the target key before the data requester sends a data request to the first edge node, to obtain the target data ciphertext; and upload the target data ciphertext and the access conditions of the target data to the second edge node;

[0104] The second edge node is further configured to request the allocation of a data identifier corresponding to the target data from the blockchain, and store the data identifier and the encrypted target data accordingly; generate an authentication token for the target data based on the access conditions of the target data, and encrypt the authentication token using its own node private key; generate a transaction record for the target data based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the encrypted target data; generate the transaction record into the designated block and upload it to the blockchain;

[0105] The blockchain is also used to synchronize the designated block to each of the edge nodes.

[0106] Before a data requester requests access to target data through its local first edge node, the data owner must first upload and store the encrypted target data to its local second edge node. The data owner then uses the target key to encrypt the target data to obtain the encrypted target data, and then uploads the encrypted target data along with the access conditions to the second edge node.

[0107] After receiving the encrypted target data and the access conditions for the target data, the second edge node requests a unique data identifier from the blockchain and stores the data identifier and the encrypted target data accordingly. Then, it generates an authentication token for the target data based on the access conditions and encrypts this token using its own node private key. Based on the data identifier, the encrypted authentication token, the second edge node's node identifier, and the time the second edge node stored the encrypted target data, it generates the first transaction record for the target data and uploads this transaction record to the blockchain as a designated block. The blockchain then synchronizes this designated block to all edge nodes.

[0108] As can be seen from the above, in the data sharing system provided by this embodiment of the invention, the data owner encrypts the target data ciphertext obtained by encrypting the target key, and uploads it together with the access conditions of the target data to the second edge node. Then, the second edge node stores the unique corresponding data identifier assigned by the blockchain and stores it in correspondence with the target data ciphertext. Based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the target data ciphertext, the first transaction record of the target data is generated, and this transaction record is generated into a designated block and uploaded to the blockchain. This allows the blockchain to synchronize the designated block to each edge node. By using the transaction record and permission authentication identity of the data stored in the blockchain, it is ensured that neither the edge node storing or accessing the data nor the blockchain it constitutes can obtain the decrypted data, thus improving the security of data sharing.

[0109] In one embodiment of the present invention, such as Figure 1b As shown, Figure 1b A schematic diagram illustrating the specific structure of a possible data sharing system is provided. Edge nodes may include an attribute database, an encryption / decryption server, and a trusted user list. The attribute database stores node attributes such as node ID and path information, and also generates public / private key pairs for each edge node. The encryption / decryption server encrypts and decrypts authentication tokens, improving the encryption / decryption rate and further reducing data computation and transmission latency. The trusted user list stores information about registered users, indicating that only users on this list are allowed to send data requests, and also stores information about users corresponding to other allowed edge nodes.

[0110] The nodes corresponding to edge nodes in the aforementioned blockchain can include a distributed block ledger and a key database. The key database stores the public keys of all other edge computing nodes in the entire blockchain, as well as the public-private key pair of the current edge node. The distributed block ledger is used to synchronously store designated blocks generated with each transaction record update using the elder read / write module. Specifically, the structure of a designated block can be as follows: Figure 1c As shown, Figure 1cA structural example diagram of a specified block is provided, including a block header and a block body. The block header includes the version number of the specified block, the parent block hash, the timestamp, a random number, the current block hash, and the Merkle root. The block body includes multiple hashes, such as Hash1, Hash2, and Hash... 12 Hash3, Hash4, Hash 34 Hash 1234 It also includes the data identifier (F) of the target data. id ), ID of the data owner (U) do ), the node identifier (EC) of the second edge node for storing the target data A ), Authenticating token for encrypted target data Fid ), the node identifier (EC') of the edge node that last stored or accessed the target data. A ), Confidentiality level of target data (C) Fid The last time the target data was stored or accessed (TimeStamp) Fid The encrypted authentication token utilizes the private key (K) of the edge node that last accessed the target data, i.e., the second edge node. pri-A The encrypted authentication token includes user attribute information (ATT) that allows access to the target data. USER ) and edge node attribute information (ATT) EC Encrypted authentication tokens can be stored in the following manner:

[0111] AUTH Fid =Encrypt(K pri-A ,ATT USER &&ATT EC )

[0112] See Figure 2 The present invention also provides a flowchart of a first data sharing method, including:

[0113] Step S11: Send a data request to the corresponding first edge node locally via the data request direction.

[0114] The data request includes the data identifier of the target data being requested;

[0115] Step S12: Using the first edge node, obtain the authentication token of the target data from the designated block of the blockchain based on the data identifier. If the authentication token determines that the data requester is allowed to access the target data, send verification information indicating that access is allowed to the data requester.

[0116] The authentication token includes the access conditions for the target data;

[0117] Step S13: After receiving the verification information, the data requester generates its own public-private key pair and sends its public key to the data owner.

[0118] Step S14: The data owner uses the public key to encrypt the target data to obtain the encrypted target key, and sends it to the second edge node that stores the ciphertext of the target data.

[0119] The target data ciphertext is the target data encrypted using the target key;

[0120] Step S15: After receiving the encrypted target key, the second edge node sends the encrypted target key and the target data ciphertext to the data requester.

[0121] Step S16: The data requester decrypts the encrypted target key using its own private key to obtain the target key; the target key is then used to decrypt the target data ciphertext to obtain the target data.

[0122] As can be seen from the above, the data sharing method provided by the embodiments of the present invention uses blockchain to store authentication tokens for data, and uses these authentication tokens to perform permission authentication control for cross-domain data access. This leverages the decentralized nature of blockchain to improve the security of data sharing. Furthermore, by storing and accessing data through edge nodes, the resource overhead on the user end for data is reduced, thereby ensuring the transmission rate of data sharing. At the same time, the data stored on the edge nodes is encrypted ciphertext, and the key for the transmitted ciphertext is also encrypted. This key can only be obtained by the data owner and the data requester who has been authorized by the authentication token, achieving double encryption of the data, reducing the risk of data exposure, enabling cross-domain data access, further improving the security of data sharing between edge nodes, and enhancing the universality and versatility of the cross-domain data sharing scheme.

[0123] In one possible implementation, the data request further includes: user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that allow access; step S12 above utilizes the first edge node to determine the authentication token of the target data from a designated block of the blockchain based on the data identifier, and if it is determined based on the authentication token that the data requester is allowed to access the target data, sends verification information indicating that access is allowed to the data requester, including:

[0124] The transaction records for obtaining the target data from the designated block using the first edge node are used. The second edge node that last encrypted the authentication token is determined based on the node identifier in the transaction records. The encrypted authentication token is decrypted using the public key of the second edge node. Based on the decrypted authentication token, it is determined whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it is determined that the data requester is allowed to access the target data, and the verification information is sent to the data requester.

[0125] In one embodiment of the present invention, such as Figure 3a As shown in the figure, this embodiment of the invention also provides a flowchart of a second data sharing method. After the data requester decrypts the encrypted target key using its own private key to obtain the target key, and then uses the target key to decrypt the target data ciphertext to obtain the target data, the method further includes:

[0126] Step S21: The first edge node encrypts the authentication token using its own node private key, and updates the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; the updated transaction record is then used to generate a new designated block and uploaded to the blockchain.

[0127] Step S22: Use the blockchain to synchronize the new designated block to each edge node.

[0128] In one embodiment of the present invention, the flowchart illustrating the process by which the data requester accesses the target data through the first edge node can be as follows: Figure 3b As shown. Among them, EC B As the first edge node, DU is the data requester, and K is the data requester. pub-DU and K pri-DU For the data requester's public / private key pair, Encrypt for encryption, Decrypt for decryption, DO for data ownership, and CT for data decryption. k The target key is the encrypted target key, data is the target data, and CT is the target data. data This is the encrypted target data.

[0129] As can be seen from the above, the data sharing method provided by this embodiment of the invention, when the first edge node obtains the transaction record of the target data from the specified block, and determines the second edge node of the last encrypted authentication token based on the node identifier in the transaction record, then uses the stored node public key of the second edge node to decrypt the encrypted authentication token. Based on the decrypted authentication token, it checks whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it determines that the data requester is allowed to access the target data; otherwise, it refuses the data requester's access to the target data. Furthermore, after the data requester obtains the target data, it updates the transaction record and synchronizes the updated transaction record through the blockchain. This utilizes the blockchain to achieve authorization authentication for cross-domain data access and synchronized updates of data transaction records, ensuring that both the data transaction records and access permissions are decentralized and trustworthy, thereby improving the security of data sharing. Furthermore, using edge nodes to encrypt and decrypt the authentication token reduces the encryption and decryption computational resource overhead for the data owner and improves the data sharing transmission rate.

[0130] In one embodiment of the present invention, such as Figure 4a As shown in the figure, this embodiment of the invention also provides a flowchart of a third data sharing method. Before the data request is sent to the corresponding first edge node via the data request direction, the method further includes:

[0131] Step S31: The data owner encrypts the target data using the target key to obtain the target data ciphertext; the target data ciphertext and the access conditions of the target data are uploaded to the second edge node;

[0132] Step S32: Utilize the second edge node to request the allocation of a data identifier corresponding to the target data from the blockchain, and store the data identifier and the encrypted target data accordingly; generate an authentication token for the target data based on the access conditions of the target data, and encrypt the authentication token using its own node private key; generate a transaction record for the target data based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stored the encrypted target data; generate the designated block from the transaction record and upload it to the blockchain;

[0133] Step S33: Use the blockchain to synchronize the designated block to each edge node.

[0134] In one embodiment of the present invention, the flowchart illustrating the process by which the data owner uploads and stores the encrypted target data to the second edge node can be as follows: Figure 4b As shown.

[0135] As can be seen from the above, the data sharing method provided by this embodiment of the invention involves the data owner encrypting the target data ciphertext with the target key, along with the access conditions for the target data, and uploading it to the second edge node. The second edge node then stores the unique corresponding data identifier assigned by the blockchain, corresponding to the target data ciphertext. Based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the target data ciphertext, the first transaction record of the target data is generated, and this transaction record is used to generate a designated block and uploaded to the blockchain. This allows the blockchain to synchronize the designated block to each edge node. By utilizing the transaction records and authorization authentication of the data stored on the blockchain, it is ensured that neither the edge node storing or accessing the data nor the blockchain it constitutes can obtain the decrypted data, thus improving the security of data sharing.

[0136] See Figure 5 The present invention also provides a schematic diagram of a data sharing device, applied to a data sharing system, comprising:

[0137] The request sending module 501 is used to send a data request to the local corresponding first edge node through a data request direction, wherein the data request includes a data identifier of the target data to be requested;

[0138] The information verification module 502 is used to obtain an authentication token for the target data from a designated block of the blockchain based on the data identifier using the first edge node, and send verification information indicating permission to access the target data to the data requester if the data requester is allowed to access the target data based on the authentication token. The authentication token includes the access conditions for the target data.

[0139] The public key sending module 503 is used to generate its own public-private key pair after the data requester receives the verification information, and send its own public key to the data owner;

[0140] The target key encryption module 504 is used to encrypt the target data using the public key by the data owner to obtain the encrypted target key, and send it to the second edge node storing the target data ciphertext, wherein the target data ciphertext is the target data encrypted using the target key;

[0141] The ciphertext sending module 505 is used to send the encrypted target key and the target data ciphertext to the data requester after receiving the encrypted target key using the second edge node;

[0142] The data acquisition module 506 is used to decrypt the encrypted target key using the private key of the data requester to obtain the target key; and to decrypt the target data ciphertext using the target key to obtain the target data.

[0143] As can be seen from the above, the data sharing device provided in this embodiment of the invention uses blockchain to store authentication tokens for data, and uses these authentication tokens to perform permission authentication control for cross-domain data access. This leverages the decentralized nature of blockchain to improve the security of data sharing. Furthermore, by storing and accessing data through edge nodes, the resource overhead on the user end for data is reduced, thereby ensuring the transmission rate of data sharing. At the same time, the data stored on the edge nodes is encrypted ciphertext, and the key for the transmitted ciphertext is also encrypted. This key can only be obtained by the data owner and the data requester who has been authorized by the authentication token, achieving double encryption of the data, reducing the risk of data exposure, enabling cross-domain data access, further improving the security of data sharing between edge nodes, and enhancing the universality and versatility of the cross-domain data sharing scheme.

[0144] In one embodiment of the present invention, the data request further includes: user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access.

[0145] The information verification module is specifically used for:

[0146] The transaction records for obtaining the target data from the designated block using the first edge node are used. The second edge node that last encrypted the authentication token is determined based on the node identifier in the transaction records. The encrypted authentication token is decrypted using the public key of the second edge node. Based on the decrypted authentication token, it is determined whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it is determined that the data requester is allowed to access the target data, and the verification information is sent to the data requester.

[0147] In one embodiment of the present invention, the apparatus further includes:

[0148] The transaction record update module is used to encrypt the authentication token using the private key of the first edge node, and update the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; generate a new designated block from the updated transaction record and upload it to the blockchain;

[0149] The first block synchronization module is used to synchronize the new designated block to each edge node using the blockchain.

[0150] As can be seen from the above, the data sharing device provided in this embodiment of the invention, when the first edge node obtains the transaction record of the target data from the designated block, and determines the second edge node of the last encrypted authentication token based on the node identifier in the transaction record, then uses the stored node public key of the second edge node to decrypt the encrypted authentication token. Based on the decrypted authentication token, it checks whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it determines that the data requester is allowed to access the target data; otherwise, it refuses the data requester's access to the target data. Furthermore, after the data requester obtains the target data, it updates the transaction record and synchronizes the updated transaction record through the blockchain. This utilizes the blockchain to achieve authorization authentication for cross-domain data access and synchronous updates of data transaction records, ensuring that both the data transaction records and access permissions are decentralized and trustworthy, thereby improving the security of data sharing. Furthermore, using edge nodes to encrypt and decrypt the authentication token reduces the encryption and decryption computational resource overhead for the data owner and improves the data sharing transmission rate.

[0151] In one embodiment of the present invention, the apparatus further includes:

[0152] The data upload module is used to encrypt the target data using the target key by the data owner to obtain the target data ciphertext; and upload the target data ciphertext and the access conditions of the target data to the second edge node.

[0153] The transaction record generation module is used to request the allocation of a data identifier corresponding to the target data from the blockchain using a second edge node, and to store the data identifier and the encrypted target data accordingly; to generate an authentication token for the target data based on the access conditions of the target data, and to encrypt the authentication token using its own node private key; to generate a transaction record for the target data based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stored the encrypted target data; and to generate the transaction record into the designated block and upload it to the blockchain.

[0154] The second block synchronization module is used to synchronize the designated block to each edge node using the blockchain.

[0155] As can be seen from the above, the data sharing device provided in this embodiment of the invention allows the data owner to encrypt the target data ciphertext obtained by encrypting the target key, along with the access conditions for the target data, and upload it to the second edge node. Then, the second edge node stores the unique corresponding data identifier allocated by the blockchain and the target data ciphertext. Based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the target data ciphertext, the first transaction record of the target data is generated, and this transaction record is generated into a designated block and uploaded to the blockchain. This allows the blockchain to synchronize the designated block to each edge node. By using the transaction records and permission authentication identity of the data stored in the blockchain, it is ensured that neither the edge node storing or accessing the data nor the blockchain it constitutes can obtain the decrypted data, thus improving the security of data sharing.

[0156] This invention also provides an electronic device, such as... Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0157] Memory 603 is used to store computer programs;

[0158] When the processor 601 executes the program stored in the memory 603, it implements any of the data sharing method steps described above.

[0159] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0160] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0161] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0162] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0163] In another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of any of the above-described data sharing methods.

[0164] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the data sharing methods described above.

[0165] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0166] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0167] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the method, apparatus, electronic device, and storage medium embodiments are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0168] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A data sharing system, characterized in that, The system includes: a data requester, multiple edge nodes, and a data owner; The data requester is used to send a data request to the corresponding first edge node locally, wherein the data request includes a data identifier of the target data being requested; The first edge node is configured to obtain an authentication token for the target data from a designated block of the blockchain based on the data identifier, and, if the data requester is allowed to access the target data based on the authentication token, send verification information indicating that access is permitted to the data requester, wherein the authentication token includes the access conditions for the target data; The data requester is also configured to generate its own public-private key pair after receiving the verification information, and send its own public key to the data owner; The data owner is used to encrypt the target data using the public key to obtain the encrypted target key, and then send it to the second edge node that stores the ciphertext of the target data. The second edge node is used to send the encrypted target key and the target data ciphertext to the data requester after receiving the encrypted target key; The data requester is also used to decrypt the encrypted target key using its own private key to obtain the target key; and to decrypt the target data ciphertext using the target key to obtain the target data.

2. The system according to claim 1, characterized in that, The data request also includes: the user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access. The first edge node is specifically used to obtain the transaction record of the target data from the designated block, determine the second edge node that last encrypted the authentication token based on the node identifier in the transaction record, decrypt the encrypted authentication token using the node public key of the second edge node, and based on the decrypted authentication token, determine whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, determine that the data requester is allowed to access the target data and send the verification information to the data requester.

3. The system according to claim 1, characterized in that, The first edge node is further configured to, after the data requester obtains the target data, encrypt the authentication token using its own node private key, and update the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; generate a new designated block from the updated transaction record and upload it to the blockchain; The blockchain is also used to synchronize the new designated block to each of the edge nodes.

4. The system according to claim 1, characterized in that, The data owner is further configured to encrypt the target data using the target key before the data requester sends a data request to the first edge node, to obtain the target data ciphertext; and upload the target data ciphertext and the access conditions of the target data to the second edge node; The second edge node is also used to request the blockchain to allocate a data identifier corresponding to the target data, and to store the data identifier and the encrypted target data accordingly; Generate an authentication token for the target data based on the access conditions of the target data, and encrypt the authentication token using its own node private key; Based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the ciphertext of the target data, a transaction record for the target data is generated; the transaction record is used to generate the designated block and uploaded to the blockchain; The blockchain is also used to synchronize the designated block to each of the edge nodes.

5. A data sharing method, applied to a data sharing system, characterized in that, The method includes: The data request is sent to the first edge node corresponding to the local data requester, wherein the data request includes the data identifier of the target data requested. Using the first edge node, an authentication token for the target data is obtained from a designated block of the blockchain based on the data identifier. If the authentication token determines that the data requester is allowed to access the target data, verification information indicating that access is allowed is sent to the data requester. The authentication token includes the access conditions for the target data. After receiving the verification information, the data requester generates its own public-private key pair and sends its public key to the data owner. The data owner uses the public key to encrypt the target data, obtains the encrypted target key, and sends it to the second edge node storing the ciphertext of the target data. After receiving the encrypted target key, the second edge node sends the encrypted target key and the target data ciphertext to the data requester. The data requester uses its own private key to decrypt the encrypted target key to obtain the target key; then, the target key is used to decrypt the target data ciphertext to obtain the target data.

6. The method according to claim 5, characterized in that, The data request also includes: the user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access. The process of using a first edge node to determine the authentication token of the target data from a designated block of the blockchain based on the data identifier, and sending verification information indicating permission to access the target data to the data requester based on the authentication token, includes: The transaction records for obtaining the target data from the designated block using the first edge node are used. The second edge node that last encrypted the authentication token is determined based on the node identifier in the transaction records. The encrypted authentication token is decrypted using the public key of the second edge node. Based on the decrypted authentication token, it is determined whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it is determined that the data requester is allowed to access the target data, and the verification information is sent to the data requester.

7. The method according to claim 5, characterized in that, After the data requester decrypts the encrypted target key using its own private key to obtain the target key, and then uses the target key to decrypt the target data ciphertext to obtain the target data, the method further includes: The first edge node encrypts the authentication token using its own node private key, and updates the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; the updated transaction record is then used to generate a new designated block and uploaded to the blockchain. The new designated block is synchronized to each of the edge nodes using the blockchain.

8. The method according to claim 5, characterized in that, Before sending a data request to the corresponding first edge node via the data request direction, the method further includes: The data owner encrypts the target data using the target key to obtain the target data ciphertext; the target data ciphertext and the access conditions of the target data are then uploaded to the second edge node. The second edge node requests the allocation of a data identifier corresponding to the target data from the blockchain, and stores the data identifier and the encrypted target data accordingly; an authentication token for the target data is generated based on the access conditions of the target data, and the authentication token is encrypted using its own node private key; a transaction record for the target data is generated based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stores the encrypted target data; the transaction record is used to generate the designated block and uploaded to the blockchain; The blockchain is used to synchronize the designated block to each edge node.

9. A data sharing device, applied to a data sharing system, characterized in that, The device includes: The request sending module is used to send a data request to the local corresponding first edge node through the data request direction, wherein the data request includes the data identifier of the target data to be requested; The information verification module is used to obtain an authentication token for the target data from a designated block of the blockchain based on the data identifier using the first edge node, and send verification information indicating permission to access the target data to the data requester if the data requester is allowed to access the target data based on the authentication token. The authentication token includes the access conditions for the target data. The public key sending module is used to generate its own public-private key pair after the data requester receives the verification information, and send its own public key to the data owner; The target key encryption module is used to encrypt the target key of the target data using the public key by the data owner, obtain the encrypted target key, and send it to the second edge node storing the ciphertext of the target data; The ciphertext sending module is used to send the encrypted target key and the target data ciphertext to the data requester after the second edge node receives the encrypted target key; The data acquisition module is used to decrypt the encrypted target key using the private key of the data requester to obtain the target key; and to decrypt the target data ciphertext using the target key to obtain the target data.

10. The apparatus according to claim 9, characterized in that, The data request also includes: the user attribute information of the data requester, and the access conditions include: user attribute information and node attribute information that are allowed to access. The information verification module is specifically used for: The transaction records for obtaining the target data from the designated block using the first edge node are used. The second edge node that last encrypted the authentication token is determined based on the node identifier in the transaction records. The encrypted authentication token is decrypted using the public key of the second edge node. Based on the decrypted authentication token, it is determined whether the user attribute information of the data requester and the node attribute information of the first edge node match the access conditions in the authentication token. If they match, it is determined that the data requester is allowed to access the target data, and the verification information is sent to the data requester.

11. The apparatus according to claim 9, characterized in that, The device further includes: The transaction record update module is used to encrypt the authentication token using the private key of the first edge node, and update the transaction record of the target data based on the encrypted authentication token, the node identifier of the first edge node, and the time when the data requester obtains the target data; generate a new designated block from the updated transaction record and upload it to the blockchain; The first block synchronization module is used to synchronize the new designated block to each edge node using the blockchain.

12. The apparatus according to claim 9, characterized in that, The device further includes: The data upload module is used to encrypt the target data using the target key by the data owner to obtain the target data ciphertext; and upload the target data ciphertext and the access conditions of the target data to the second edge node. The transaction record generation module is used to request the allocation of a data identifier corresponding to the target data from the blockchain using a second edge node, and to store the data identifier and the encrypted target data accordingly; to generate an authentication token for the target data based on the access conditions of the target data, and to encrypt the authentication token using its own node private key; to generate a transaction record for the target data based on the data identifier, the encrypted authentication token, the node identifier of the second edge node, and the time when the second edge node stored the encrypted target data; and to generate the transaction record into the designated block and upload it to the blockchain. The second block synchronization module is used to synchronize the designated block to each edge node using the blockchain.

13. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 5-8.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 5-8.

Images