A key distribution method, apparatus, electronic device, and storage medium

Abstract

This invention relates to a key distribution method, apparatus, electronic device, and storage medium. The method includes: generating a master key for a first user and generating a derived key based on the master key; encrypting the derived key based on a second user's public key, and sending the encrypted derived key and data ownership authorization to a consensus system, so that the second user can obtain the data ownership authorization and the encrypted derived key based on the consensus system; decrypting the encrypted derived key based on the second user's private key; encrypting user data using the decrypted derived key and uploading it to a storage system, or decrypting other user data in the storage system using the decrypted derived key. This invention improves the data security coefficient under a data ownership separation mechanism.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a key distribution method and device, electronic equipment and storage medium. BACKGROUND

[0002] Data is a key element of digital economy and has become an important strategic resource of the country, and is gradually becoming an extremely important new asset. In recent years, relevant technologies have clearly proposed the need to explore new models for data asset entry, which is of great significance for exploring the value of data elements measured by currency, promoting data assetization and capitalization, and better playing the multiplying effect of data on production efficiency improvement.

[0003] The whole process of data asset accounting mainly includes four links of "data asset confirmation-data asset evaluation-data asset measurement-data asset disclosure". The data asset confirmation link needs to clarify the "identity" and boundary of the data asset, establish a data right system, promote the classified and graded right authorization use of public data, enterprise data and personal data, establish a property right operation mechanism for the separation of data resource holding rights, data processing use rights and data product operation rights, and improve the data element right protection system.

[0004] Therefore, how to solve the problem of data security under the data property right separation mechanism and ensure the security of decentralized data is a technical problem that needs to be solved urgently. SUMMARY

[0005] Therefore, it is necessary to provide a key distribution method, device, electronic equipment and storage medium to solve the problem of data security under the data property right separation mechanism and ensure the security of decentralized data.

[0006] In order to solve the above problems, in a first aspect, the present application provides a key distribution method, comprising:

[0007] generating a master key of a first user, and generating a derived key based on the master key;

[0008] encrypting the derived key based on the public key of a second user, and sending the encrypted derived key and a data property right authorization to a consensus system, so that the second user obtains the data property right authorization and the encrypted derived key based on the consensus system, and decrypts the encrypted derived key based on the private key of the second user, encrypts user data using the decrypted derived key and uploads it to a storage system, or decrypts other user data in the storage system using the decrypted derived key.

[0009] Further, the consensus system is constructed by using a Merkle tree in a preset decentralized computing system;

[0010] The consensus system is constructed using a Merkle tree in a pre-defined decentralized computing system, including:

[0011] Based on a pre-defined proof mechanism, multiple decentralized computing systems are selected, and computing systems that meet the pre-defined conditions are selected as candidate consensus nodes.

[0012] A random algorithm is used to select some nodes from the candidate consensus nodes to construct the consensus system. The system verifies the key distribution process according to the longest chain principle and saves the key states in the key distribution process into a Merkle tree.

[0013] Furthermore, the method also includes:

[0014] During the verification of the key distribution process using the consensus system, if any consensus node fails to function, that node is removed from the consensus node list and the candidate consensus node list.

[0015] Furthermore, the storage system is constructed using a pre-defined decentralized computing system;

[0016] The storage system is constructed using a pre-defined decentralized computing system, including:

[0017] Multiple preset decentralized computing systems are selected as storage nodes to construct the storage system, wherein the number of selected storage nodes is greater than 1, and the selected storage nodes store data according to a storage consistency protocol.

[0018] Furthermore, the method also includes:

[0019] The storage nodes are maintained periodically, and if any storage node fails to function, other storage nodes are selected from the preset decentralized computing system.

[0020] Furthermore, the step of encrypting the derived key based on the second user's public key and sending the encrypted derived key and data ownership authorization to the consensus system includes:

[0021] Authorize the right to process or use data to a second user and obtain the second user's public key;

[0022] The derived key is encrypted based on the second user's public key.

[0023] Furthermore, the second user is an authorized data processor or data user; the second user obtains the data ownership authorization and the encrypted derived key based on the consensus system, and decrypts the encrypted derived key based on the second user's private key, encrypts user data using the decrypted derived key and uploads it to the storage system, or decrypts other user data in the storage system using the decrypted derived key, including:

[0024] The second user obtains the data ownership authorization corresponding to the second user from the consensus system so that the consensus system can verify the second user's signature. If the consensus system verifies the second user's signature, the second user obtains the encrypted derived key.

[0025] The encrypted derived key is decrypted using the second user's private key to obtain the decrypted derived key.

[0026] The data processor uses the decrypted derived key to encrypt user data and then uploads it to the storage system;

[0027] The data user uses the decrypted derived key to decrypt other user data in the storage system.

[0028] In a second aspect, the present invention also provides a key distribution apparatus, comprising:

[0029] A key generation module is used to generate a master key for the first user and generate a derived key based on the master key;

[0030] The key distribution module is used to encrypt the derived key based on the second user's public key, and send the encrypted derived key and data ownership authorization to the consensus system, so that the second user can obtain the data ownership authorization and the encrypted derived key based on the consensus system, and decrypt the encrypted derived key based on the second user's private key, use the decrypted derived key to encrypt user data and upload it to the storage system, or use the decrypted derived key to decrypt other user data in the storage system.

[0031] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps in the above-described key distribution method.

[0032] Fourthly, the present invention also provides a computer storage medium, which stores a computer program that, when executed by a processor, implements the steps in the key distribution method described above.

[0033] The beneficial effects of using the above embodiments are:

[0034] In this invention, a first user generates and holds their own master key, then uses this master key to generate a derived key. The derived key is then encrypted using a second user's public key. The encrypted derived key, along with data ownership authorization, is published to a decentralized consensus system. The second user is either a data processor or a data user. The data processor obtains their data ownership authorization and the encrypted derived key from the consensus system, decrypts the encrypted derived key using their private key, and then uses the derived key to encrypt the user's data before uploading it to a decentralized storage system. Similarly, the data user obtains their data ownership authorization and the encrypted derived key from the consensus system, decrypts the encrypted derived key using their private key, and then uses the derived key to decrypt the user data in the storage system. Through the decentralized consensus system and the distribution of keys based on user data ownership, data security is ensured. Data can only be correctly encrypted and decrypted for processing or use with the user's authorization. When data ownership authorization is deleted, the data processor or data user will be unable to obtain the encrypted derived key and will be unable to process or use the user data in the storage system. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating an embodiment of a key distribution method provided by the present invention;

[0036] Figure 2 This is a timing diagram of data processing during key distribution, provided in one embodiment of the present invention.

[0037] Figure 3 This invention provides a timing diagram of data usage during key distribution, as shown in one embodiment of the invention.

[0038] Figure 4 This is a schematic diagram of an embodiment of a key distribution device provided by the present invention;

[0039] Figure 5 This is a schematic diagram of an embodiment of an electronic device provided by the present invention. Detailed Implementation

[0040] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0041] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. Furthermore, "a plurality of" means two or more, unless otherwise explicitly specified. The reference to "embodiment" herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0042] Before describing the embodiments, the relevant terms are defined as follows:

[0043] Merkle Tree: A Merkle tree is a binary tree containing a set of nodes with basic information. The root node has numerous leaf nodes, a set of intermediate nodes (each node being a hash of its two child nodes), and finally, a root node, also formed by the hashes of its two child nodes, representing the "top" of the tree. The purpose of a Merkle tree is to allow data within a block to be transmitted piecemeal.

[0044] The specific embodiments are described in detail below:

[0045] Please see Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of a key distribution method provided by the present invention. A specific embodiment of the present invention discloses a key distribution method, including:

[0046] Generate the master key for the first user, and generate derived keys based on the master key;

[0047] The derived key is encrypted using the second user's public key, and the encrypted derived key and data ownership authorization are sent to the consensus system. This allows the second user to obtain data ownership authorization and the encrypted derived key based on the consensus system. The second user then decrypts the encrypted derived key using their private key, encrypts user data using the decrypted derived key, and uploads it to the storage system. Alternatively, the decrypted derived key can be used to decrypt other user data in the storage system.

[0048] In this invention, a first user generates and holds their own master key, then uses this master key to generate a derived key. The derived key is then encrypted using a second user's public key. The encrypted derived key, along with data ownership authorization, is published to a decentralized consensus system. The second user is either a data processor or a data user. The data processor obtains their data ownership authorization and the encrypted derived key from the consensus system, decrypts the encrypted derived key using their private key, and then uses the derived key to encrypt the user's data before uploading it to a decentralized storage system. Similarly, the data user obtains their data ownership authorization and the encrypted derived key from the consensus system, decrypts the encrypted derived key using their private key, and then uses the derived key to decrypt the user data in the storage system. Through the decentralized consensus system and the distribution of keys based on user data ownership, data security is ensured. Data can only be correctly encrypted and decrypted for processing or use with the user's authorization. When data ownership authorization is deleted, the data processor or data user will be unable to obtain the encrypted derived key and will be unable to process or use the user data in the storage system.

[0049] In one embodiment of the present invention, the consensus system is constructed using a Merkle tree in a pre-defined decentralized computing system;

[0050] A consensus system is built using a Merkle tree in a pre-defined decentralized computing system, including:

[0051] Based on a pre-defined proof mechanism, multiple decentralized computing systems are selected, and computing systems that meet the pre-defined conditions are selected as candidate consensus nodes.

[0052] A consensus system is constructed by selecting some nodes from the candidate consensus nodes using a random algorithm. The system verifies the key distribution process according to the longest chain principle and saves the key states in the key distribution process into a Merkle tree.

[0053] It is understandable that multiple decentralized computing systems are used to build decentralized consensus systems and decentralized storage systems respectively. In the process of building a decentralized consensus system, a Merkle tree is used to manage the key distribution process. Each key state corresponds to a leaf node of the Merkle tree, which is stored in multiple decentralized computing systems.

[0054] Specifically, multiple users vote on multiple decentralized computing systems based on the delegated proof-of-stake mechanism, select some computing systems as candidate consensus nodes, and then use a random algorithm to randomly select some nodes from these candidate consensus nodes to become consensus nodes.

[0055] It should be noted that during the verification of the key distribution process using the consensus system, if any consensus node fails to function, that node will be removed from both the consensus node list and the candidate consensus node list. That is, each consensus node verifies the key distribution process according to the longest chain principle and saves the key states during the key distribution process in a Merkle tree. The consensus nodes form a consensus system to verify the key distribution process; if a node behaves improperly or fails to function effectively, that node will be removed from both the consensus node list and the candidate consensus node list.

[0056] More specifically, the consensus system will consist of multiple decentralized computing systems. These systems will be responsible for voting on key states during the key distribution process, reaching consensus based on the longest chain principle. These states include user-provided data ownership authorization and encrypted derived keys, queries by data processors or users regarding data ownership authorization and encrypted derived keys, and the consensus system's verification results. If consensus is reached, these key states will be stored in the leaf nodes of a Merkle tree.

[0057] In one embodiment of the present invention, the storage system is constructed using a pre-defined decentralized computing system;

[0058] The storage system is constructed using a pre-defined decentralized computing system, including:

[0059] Multiple pre-defined decentralized computing systems are selected as storage nodes to construct a storage system. The number of selected storage nodes is greater than 1, and the selected storage nodes store data according to a storage consistency protocol.

[0060] Understandably, multiple decentralized computing systems are selected by the user as storage nodes, with the number of selected storage nodes being greater than one. The storage system will consist of multiple decentralized computing systems, which will manage the user's data according to a storage consistency protocol. Upon receiving a storage request from a data processor, the storage system will store the user's encrypted data according to a decentralized data storage authorization and verification method. Upon receiving an access request from a data user, the storage system will provide the user's encrypted data according to a decentralized data query authorization and verification method.

[0061] It should be noted that the storage nodes need to be maintained regularly. If any storage node fails to work, another storage node should be selected from the pre-defined decentralized computing system.

[0062] In other words, storage nodes in a storage system store data according to a storage consistency protocol. Users perform regular maintenance on the storage nodes, and if a storage node behaves improperly or fails to work effectively, a new storage node is selected to replace it.

[0063] In one embodiment of the present invention, the derived key is encrypted based on the public key of the second user, and the encrypted derived key and data ownership authorization are sent to the consensus system, including:

[0064] Authorize a second user to process or use data, and obtain the second user's public key;

[0065] The derived key is encrypted using the second user's public key.

[0066] Understandably, the second user is either the data processor or the data user. The first user generates and holds their own master key, and uses the master key to generate derived keys, which will be used for data encryption and decryption. The first user encrypts the derived keys using the public key of the authorized data processor or data user, and publishes the encrypted derived keys along with the data ownership authorization to the decentralized consensus system. The key distribution process is then verified using the constructed decentralized consensus system.

[0067] In some preferred embodiments, the act of the data processor or data user obtaining the encrypted derived key must be authorized by the user. If the act of the data processor or data user obtaining the encrypted derived key is not authorized by the user, then the act is invalid.

[0068] In one embodiment of the present invention, the second user is an authorized data processor or data user; the second user obtains data ownership authorization and an encrypted derived key based on the consensus system, and decrypts the encrypted derived key based on the second user's private key, encrypts user data using the decrypted derived key and uploads it to the storage system, or decrypts other user data in the storage system using the decrypted derived key, including:

[0069] The second user obtains the data ownership authorization corresponding to the second user from the consensus system so that the consensus system can verify the second user's signature. If the consensus system verifies the second user's signature, the second user obtains the encrypted derived key.

[0070] The encrypted derived key is decrypted using the second user's private key to obtain the decrypted derived key.

[0071] The data processor uses the decrypted derived key to encrypt user data before uploading it to the storage system;

[0072] The data user uses the decrypted derived key to decrypt other user data in the storage system.

[0073] Understandably, users select multiple decentralized computing systems as storage nodes to form a storage system that stores their encrypted data and provides access interfaces. User data is stored on the storage system. After obtaining authorization from the user, the data processor or user obtains an encrypted derived key from the consensus system, then uses their own private key to decrypt the encrypted derived key. They then use the derived key to encrypt user data and store it in the storage system, or use the derived key to decrypt user data in the storage system. Please refer to [link to relevant documentation]. Figure 2 , Figure 3 , Figure 2 This is a timing diagram of data processing during key distribution, provided in one embodiment of the present invention. Figure 3 This is a timing diagram of data usage during a key distribution process, provided as an embodiment of the present invention.

[0074] This invention constructs a decentralized consensus system and a decentralized storage system using multiple decentralized computing systems. Users generate and hold their own master key, which is then used to generate derived keys for data encryption and decryption. Users encrypt the derived keys using the public key of an authorized data processor or user, and publish the encrypted derived keys along with the data ownership authorization to the decentralized consensus system. The data processor obtains its own data ownership authorization and the encrypted derived key from the consensus system, decrypts the encrypted derived key using its private key, then uses the derived key to encrypt the user's data before uploading it to the decentralized storage system. Finally, the data user obtains its own data ownership authorization and the encrypted derived key from the consensus system, decrypts the encrypted derived key using its private key, and then uses the derived key to decrypt the user data in the storage system.

[0075] This invention ensures data security through a decentralized consensus system and the distribution of keys based on user data ownership. Data can only be correctly encrypted and decrypted, and used for processing or purposes, with the user's authorization. When data ownership authorization is revoked, the data processor or user will be unable to obtain the encrypted derived key, and thus unable to process or use the user data in the storage system.

[0076] To better implement the key distribution method in the embodiments of the present invention, based on the key distribution method, please refer to the corresponding documentation. Figure 4 , Figure 4 This is a schematic diagram of an embodiment of a key distribution device provided by the present invention. The embodiment of the present invention provides a key distribution device 400, comprising:

[0077] The key generation module 401 is used to generate the master key of the first user and generate a derived key based on the master key;

[0078] The key distribution module 402 is used to encrypt the derived key based on the second user's public key, and send the encrypted derived key and data ownership authorization to the consensus system, so that the second user can obtain the data ownership authorization and the encrypted derived key based on the consensus system, and decrypt the encrypted derived key based on the second user's private key, use the decrypted derived key to encrypt user data and upload it to the storage system, or use the decrypted derived key to decrypt other user data in the storage system.

[0079] It should be noted that the device 400 provided in the above embodiments can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can be found in the corresponding content in the above method embodiments, and will not be repeated here.

[0080] Based on the above key distribution method, this embodiment of the invention also provides an electronic device, including: a processor and a memory, and a computer program stored in the memory and executable on the processor; when the processor executes the computer program, it implements the steps of the key distribution method as described in the above embodiments.

[0081] Figure 5 The diagram shows a structural schematic of an electronic device 500 suitable for implementing embodiments of the present invention. The electronic device in the embodiments of the present invention may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0082] The electronic device includes a memory and a processor, wherein the processor may be referred to as processing device 501 below, and the memory may include at least one of read-only memory (ROM) 502, random access memory (RAM) 503 and storage device 508 below, as detailed below:

[0083] like Figure 5As shown, the electronic device 500 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the electronic device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0084] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0085] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of the embodiments of the present invention.

[0086] Based on the above key distribution method, the present invention also provides a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps in the key distribution method of the above embodiments.

[0087] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0088] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A key distribution method characterized by comprising: The method comprises the following steps: generating a master key of a first user and generating a derived key based on the master key; encrypting the derived key based on a public key of a second user and sending the encrypted derived key and a data property right authorization to a consensus system, so that the second user obtains the data property right authorization and the encrypted derived key based on the consensus system, and decrypts the encrypted derived key based on a private key of the second user, encrypts user data using the decrypted derived key and then uploads the user data to a storage system, or decrypts other user data in the storage system using the decrypted derived key; the step of encrypting the derived key based on the public key of the second user comprises the following steps: authorizing the second user with a data processing right or a data use right, and obtaining the public key of the second user; encrypting the derived key based on the public key of the second user.

2. The key distribution method according to claim 1, wherein, The consensus system is constructed by using a Merkle tree in a preset decentralized computing system; constructing the consensus system by using a Merkle tree in a preset decentralized computing system comprises the following steps: selecting a computing system that meets a preset condition as a candidate consensus node based on a preset proof mechanism from a plurality of decentralized computing systems; selecting part of the nodes as consensus nodes from the candidate consensus nodes by using a random algorithm, and constructing the consensus system, wherein the consensus system verifies a key distribution process according to a longest chain principle, and saves a key state in the key distribution process to a Merkle tree.

3. The key distribution method according to claim 2, wherein, The method further comprises the following steps: in the process of verifying the key distribution process by using the consensus system, if any consensus node cannot work, the node is removed from a consensus node list and a candidate consensus node list.

4. The key distribution method according to claim 1, wherein, The storage system is constructed by using a preset decentralized computing system; constructing the storage system by using a preset decentralized computing system comprises the following steps: selecting a plurality of preset decentralized computing systems as storage nodes to construct the storage system, wherein the number of the selected storage nodes is greater than 1, and the selected storage nodes store data according to a storage consistency protocol.

5. The key distribution method according to claim 4, wherein, The method further comprises the following steps: maintaining the storage nodes at a regular time, and if any storage node cannot work, selecting other storage nodes from the preset decentralized computing systems.

6. The key distribution method according to claim 5, wherein, The second user is an authorized data processor or a data user; the second user obtains the data property right authorization and the encrypted derived key based on the consensus system, and decrypts the encrypted derived key based on a private key of the second user, encrypts user data using the decrypted derived key and then uploads the user data to a storage system, or decrypts other user data in the storage system using the decrypted derived key, which comprises the following steps: the second user obtains a data property right authorization corresponding to the second user from the consensus system, so that the consensus system verifies a signature of the second user, and if the verification of the signature of the second user is passed, the second user obtains the encrypted derived key; decrypting the encrypted derived key based on the private key of the second user to obtain a decrypted derived key; The data processing party uses the decrypted derived key to encrypt user data and then uploads the encrypted user data to a storage system; The data using party uses the decrypted derived key to decrypt other user data in the storage system.

7. A key distribution apparatus characterized by comprising: The method comprises the following steps: generating a master key of a first user, and generating a derived key based on the master key; encrypting the derived key based on a public key of a second user, and sending the encrypted derived key and a data property authorization to a consensus system, so that the second user obtains the data property authorization and the encrypted derived key based on the consensus system, and decrypts the encrypted derived key based on a private key of the second user, uses the decrypted derived key to encrypt user data and then uploads the encrypted user data to a storage system, or uses the decrypted derived key to decrypt other user data in the storage system; The step of encrypting the derived key based on the public key of the second user comprises the following steps: authorizing the second user with data processing right or data using right, and obtaining the public key of the second user; encrypting the derived key based on the public key of the second user.

8. An electronic device, comprising: The method comprises a memory and a processor, wherein the memory is used to store a program; the processor is coupled with the memory and is used to execute the program stored in the memory to realize the steps in the key distribution method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer readable program or instruction is stored, and the program or instruction is executed by a processor to realize the steps in the key distribution method in any one of claims 1 to 6.

Images