A data security sharing method and system supporting data incremental updating and checking

Abstract

The present application provides a data security sharing method and system supporting data incremental updating and checking, combines chameleon hash algorithm with SGX, uses SGX to calculate data incremental updating and upload to the blockchain, provides a safe and reliable incremental updating and checking method for shared data without changing the data on the blockchain, makes up for the defects of the lack of data incremental updating mechanism in the existing solution, and effectively reduces the problems of data redundancy and large node data synchronization overhead caused by data incremental updating of the blockchain.

Description

Technical Field

[0001] This invention belongs to the field of data management and secure sharing, and particularly relates to a data secure sharing method and system that supports incremental data updates and verification. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] By sharing data, different entities can obtain more comprehensive and accurate information, enabling them to make more informed decisions and conduct more forward-looking research and innovation. Blockchain technology can provide a secure, transparent, and verifiable method of data exchange, offering a new solution for data sharing. Most existing blockchain-based shared data storage solutions employ a method of storing encrypted data off-chain and the encrypted hash value on-chain. However, this approach lacks a reliable mechanism for incremental data updates and verification, requiring the republication of data records during incremental updates, thus increasing the pressure on blockchain data storage and node synchronization. Furthermore, on-chain data changes also increase the overhead of the shared system in areas such as data ownership confirmation, access control, and billing. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, this invention provides a secure data sharing method and system that supports incremental data updates and verification. It utilizes SGX to calculate incremental data updates and uploads them to the blockchain, providing a secure and reliable incremental update and verification method for shared data without altering the data on the blockchain.

[0005] To achieve the above objectives, a first aspect of the present invention provides a data security sharing system that supports incremental data updates and verification, comprising:

[0006] The data owner terminal is used to encrypt the data owner's original data into ciphertext using a key and store it on an off-chain server, calculate the chameleon hash value of the ciphertext and upload it to the blockchain; and send the data owner's incremental data update request to the blockchain.

[0007] An off-chain server is used to store the encrypted data of the data owner and return the off-chain storage address to the data owner's terminal; and upload the encrypted data of the data owner to the SGX module;

[0008] The blockchain adopts an architecture that combines a main chain and sub-chains. The main chain is used to publish shared data resources, process shared transactions, and receive and verify data increment requests from data owners. If the verification is correct, it generates an off-chain execution permission for data increment updates and sends it to the SGX module. The sub-chain stores data increment update records and realizes the verification of incremental update data.

[0009] The SGX module is used to receive the off-chain execution permission for incremental data updates of the blockchain, verify the incremental update data sent by the data owner, and if the verification is valid, generate an update identifier for the incremental update data by using the incremental update algorithm with the key of the original data and the incremental update data, and upload the update identifier to the update sub-chain of the blockchain and the off-chain storage for updating and storage.

[0010] A second aspect of the present invention provides a data security sharing method supporting incremental data updates and verification, comprising:

[0011] The original data of the data owner is encrypted into ciphertext using a key and stored on an off-chain server. The chameleon hash value of the ciphertext is then calculated and uploaded to the blockchain.

[0012] The blockchain receives incremental data update requests from data owners and verifies them. If the verification is correct, it generates an off-chain execution permission for incremental data updates and sends it to the SGX module.

[0013] The SGX module receives the off-chain execution permission for incremental data updates from the blockchain and verifies the incremental update data from the data owner. If the verification is valid, the module uses the incremental update algorithm to generate an update identifier for the incremental update data and the key of the original data, and uploads the update identifier to the blockchain and the off-chain storage.

[0014] The above one or more technical solutions have the following beneficial effects:

[0015] In this invention, the Chameleon Hash algorithm is combined with SGX. SGX is used to calculate incremental data updates and upload them to the blockchain. Without changing the data on the blockchain, a secure and reliable incremental update and verification method is provided for shared data. This makes up for the lack of an incremental data update mechanism in existing solutions and effectively reduces the data redundancy and high node data synchronization overhead caused by incremental data updates to the blockchain.

[0016] In this invention, Chameleon Hash is used as the on-chain storage digest of shared data. The Chameleon Hash private key is held by the data owner, which ensures the data owner's dynamic management rights over its on-chain shared data.

[0017] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0018] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0019] Figure 1 This is a data security sharing system that supports incremental data updates and verification, as described in Embodiment 1 of the present invention.

[0020] Figure 2 This refers to the data security sharing system module function that supports incremental data updates and verification in Embodiment 1 of the present invention;

[0021] Figure 3 This is the data security sharing method flow that supports incremental data updates and verification in Embodiment 1 of the present invention. Detailed Implementation

[0022] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0023] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.

[0024] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0025] Terminology Explanation

[0026] Chameleon hash is a one-way hash function with a trapdoor. If the trapdoor information is known, collisions with any input data can be efficiently calculated; that is, the input can be changed to any value without altering the hash value output by the hash function. If the trapdoor information is unknown, then the chameleon hash function is collision-resistant like a regular hash function. The chameleon hash function algorithm includes: key generation CH.KGen(1 λ )→(tk,hk), generate hash CH.Hash(hk,M)→(h,R), generate collision CH.Adapt(tk,(h,R,M),M′)→R′ and hash verification CH.verify(hk,h,R,M)→{0,1}.

[0027] SGX (Software Guard Extensions) is an extension to the Intel instruction set architecture that provides an encrypted, trusted execution region in memory, isolating data and programs from the host operating system and ensuring the correctness of output. SGX can act as an off-chain trusted execution entity, ensuring that code executes in a trusted space, unaffected by the external environment.

[0028] Example 1

[0029] This embodiment discloses a secure data sharing method that supports incremental data updates and verification, including:

[0030] The data owner terminal is used to encrypt the data owner's original data into ciphertext using a key and store it on an off-chain server, calculate the chameleon hash value of the ciphertext and upload it to the blockchain; and send the data owner's incremental data update request to the blockchain.

[0031] An off-chain server is used to store the encrypted data of the data owner and return the off-chain storage address to the data owner's terminal; and upload the encrypted data of the data owner to the SGX module;

[0032] The blockchain adopts an architecture that combines a main chain and sub-chains. The main chain is used to publish shared data resources, process shared transactions, and receive and verify data increment requests from data owners. If the verification is correct, it generates an off-chain execution permission for data increment updates and sends it to the SGX module. The sub-chain stores data increment update records and realizes the verification of incremental update data.

[0033] The SGX module is used to receive the off-chain execution permission for incremental data updates of the blockchain, verify the incremental update data sent by the data owner, and if the verification is valid, generate an update identifier for the incremental update data by using the incremental update algorithm with the key of the original data and the incremental update data, and upload the update identifier to the update sub-chain of the blockchain and the off-chain storage for updating and storage.

[0034] like Figures 2-3 As shown in the figure, this embodiment of a data security sharing system that supports incremental data updates and verification includes a data service module (i.e., a data owner terminal), an off-chain storage, a blockchain, and an SGX module.

[0035] The data service module enables functions such as encrypting, storing, and publishing data.

[0036] 1.1 The system initialization security parameter is λ, and the data owner executes the Chameleon Hash Key Generation Algorithm CH.KGen(1 λ )→(tk,hk), to obtain the Chameleon Hash public key hk and private key tk;

[0037] 1.2 Encrypting the original data: The data owner (DO) generates a symmetric encryption key through the data service module, and uses a symmetric encryption algorithm to encrypt the plaintext of the shared data to obtain the ciphertext;

[0038] 1.3 Storing the original data: The data owner DO executes the chameleon hash algorithm CH.Hash(hk,ED1)→(h,R1) to obtain the chameleon hash value h of the initial ciphertext ED1 and the initial random number R1. The data ciphertext ED1 is then stored in the off-chain storage server, and the off-chain storage address addr is obtained.

[0039] 1.4 Publishing Data: The data owner DO uploads the chameleon hash value h, initial random number R1, off-chain storage address, symmetric key ciphertext, and other data to the blockchain module to publish the data as a shared resource;

[0040] 1.5 Encrypting Incremental Update Data: The data owner encrypts the incremental update data using the same symmetric encryption key as the original data, obtaining the ciphertext of the incremental update data;

[0041] 2. Off-chain storage server: Off-chain storage server can be used to store encrypted data and send encrypted data.

[0042] 2.1 Storing encrypted data: Receives and stores encrypted data uploaded by the data owner (DO) and encrypted data updated incrementally;

[0043] 2.2 Sending encrypted data: Send the required encrypted data or encrypted data set to the SGX module. Specifically, send data according to the specific needs of SGX. If it is an incremental update, send the original data; if it is data sharing, send a dataset consisting of the original data and the incremental update.

[0044] 3. Blockchain module: This module enables data resource publishing, generation of incremental data update off-chain execution licenses, data usage authorization, and generation of data sharing transactions.

[0045] 3.1 Shared Data Resource Publication: Package the necessary information of the shared data, such as the chameleon hash value h of the data uploaded by the data owner DO, the corresponding initial random number R1, and the off-chain storage address, into a shared transaction for publication;

[0046] 3.2 Receive the access control conditions of the data owner (DO) for its data, and generate the corresponding access control policy;

[0047] 3.3 Generate Off-Chain Incremental Update Execution Permit: Receive incremental data update requests from data owner DO. After the on-chain smart contract verifies the incremental update request is correct, generate an off-chain SGX incremental update execution permit, and store the original data ED corresponding to the incremental update data in the update subchain. j and the corresponding random number R j The relevant records are sent to SGX;

[0048] 3.4 Receive the random number R generated by the SGX in the receiving chain for this incremental update. j+1 The incremental update record is generated and stored in the updated subchain.

[0049] 3.5 The data requester (DU) retrieves the required data on the blockchain and sends a data usage request to the blockchain;

[0050] 3.6 Generate a data sharing transaction: Based on the access control policy pre-set by the data owner (DO), determine whether the data requester (DU) meets the access policy. If it does, generate a data sharing transaction.

[0051] 3.7 Generate an off-chain SGX execution permit and pass the on-chain chameleon hash h and initial random number R to the shared data. j Information such as data incremental update records is sent to SGX; the shared data here consists of the original data and the incremental update dataset.

[0052] In this embodiment, the chameleon hash value of the original data and the incremental update data are the same, so only the chameleon hash value corresponding to the initial data needs to be uploaded to the chain, and the chameleon hash value of the subsequent incremental update data is the same as the chameleon hash value of the initial data.

[0053] 3.8 Record shared transaction information: Receive the execution completion information of the SGX off-chain shared transaction and generate the corresponding shared record.

[0054] It should be noted that the blockchain only records the chameleon hash digest value of the data. This is because the chameleon hash value remains unchanged after the person holding the private key updates the data; incremental updates do not need to be uploaded to the blockchain again, but only stored on an off-chain storage server. This embodiment is based on an on-chain / off-chain storage model, where the chameleon hash digest value of the data is stored on-chain, and the complete encrypted data is stored off-chain.

[0055] 4. The SGX module enables functions such as incremental data updates, incremental update data verification, and shared data calculation.

[0056] 4.1 Receive incremental data update execution permission sent by the blockchain module;

[0057] 4.2 Receiving Raw Data (ED)j Incremental update data ED j+1 The data owner's chameleon hash private key tk, and the original data ED. j Incremental update identifier random R j ;

[0058] 4.3 Incremental Data Update: Execute the incremental update algorithm CH.Adapt(tk,(h,R) j ED j ),ED j+1 → R j+1 Generate a random number R for this incremental update identifier. j+1 ;

[0059] 4.4 Update the random number identifier R for this incremental update j+1 Sign the update and upload the incremental update information to the update subchain in the blockchain module;

[0060] 4.5 Receive and verify the off-chain shared transaction execution permission sent by the blockchain module. After verification, proceed with the following steps.

[0061] 4.6 Receive data such as the chameleon hash value h and update record sent by the blockchain module, and use the private key to decrypt the symmetric key to obtain the plaintext;

[0062] 4.7 Obtain the encrypted data set stored in off-chain storage A data ciphertext set refers to a ciphertext set of the data owner's existing data, including the original data and the incrementally updated data;

[0063] 4.8 Incremental Update Data Verification: Verify the encrypted data ED1, ED2, ..., ED j+1 The data verification algorithm CH.verify(hk,h,R) is executed sequentially. i ED i If the result is 1, it proves that the data is valid incremental update data and can continue to participate in the following steps; otherwise, the data is discarded.

[0064] 4.9 Use a symmetric key to decrypt the qualified ciphertext to obtain the plaintext;

[0065] 4.10 Shared Data Calculation: Perform data calculations on plaintext data to obtain the calculation results;

[0066] 4.11 Encrypt the calculation result using the public key of the data requester DU and return it to the data requester DU;

[0067] 4.12 Sign the execution record of this sharing and upload it to the blockchain module for record keeping.

[0068] Example 2

[0069] The purpose of this embodiment is to provide a secure data sharing method that supports incremental data updates and verification, including:

[0070] The original data of the data owner is encrypted into ciphertext using a key and stored on an off-chain server. The chameleon hash value of the ciphertext is then calculated and uploaded to the blockchain.

[0071] The blockchain receives incremental data update requests from data owners and verifies them. If the verification is correct, it generates an off-chain execution permission for incremental data updates and sends it to the SGX module.

[0072] The SGX module receives the off-chain execution permission for incremental data updates from the blockchain and verifies the incremental update data from the data owner. If the verification is valid, the module uses the incremental update algorithm to generate an update identifier for the incremental update data and the key of the original data, and uploads the update identifier to the blockchain and the off-chain storage.

[0073] This embodiment of a data security sharing method supporting incremental data updates and verification specifically includes:

[0074] 1. Initialization: The system's security parameter is λ. The data owner DO executes the Chameleon Hash initialization algorithm CH.KGen(1 λ The Chameleon Hash public-private key pair (tk, hk) is obtained by )→(tk, hk). The Chameleon Hash algorithm and shared data calculation program code are deployed in SGX to implement related functions.

[0075] 2. Original data encryption storage: The data owner DO uses a symmetric cryptographic algorithm to encrypt the initial plaintext data MD1 to obtain the initial ciphertext ED1. Then, the chameleon hash algorithm CH.Hash(hk,ED1)→(h,R1) is executed to obtain the chameleon hash value h and the random number R1 of the ciphertext data ED1. The ciphertext ED1 is then uploaded to the off-chain storage server to obtain the storage address addr.

[0076] 3. Symmetric key encryption: The data owner DO uses the SGX public key to encrypt the symmetric key to obtain the corresponding ciphertext; the data owner uses the same symmetric encryption key as the original data to encrypt the incremental update data to obtain the incremental update data ciphertext.

[0077] 4. Publishing Data: The data owner DO publishes the chameleon hash value h of the encrypted data, along with the random number R1, the off-chain storage address addr, the symmetric key ciphertext, and other necessary information to the blockchain.

[0078] 5. Data Authorization: The data owner (DO) submits a data access policy to the access control smart contract in the blockchain.

[0079] 6. Request incremental data update: The data owner (DO) initiates an incremental data update request to the blockchain.

[0080] 7. Processing Incremental Update Requests: The blockchain processes incremental update requests sent by data owners.

[0081] 7.1 Verify whether the received incremental data update request is valid. If valid, generate an execution permit for off-chain SGX incremental update.

[0082] 7.2 Update the original data ED stored in the subchain. j Incremental update identifier R j The record and off-chain execution permission are sent to SGX.

[0083] Off-chain incremental update: SGX performs the off-chain data incremental update process.

[0084] 8.1 Verify the execution license; if correct, proceed with the following steps.

[0085] 8.2 Obtain the Chameleon Hash Private Key tk and the new data ciphertext ED from the data owner DO and the off-chain storage server, respectively. j+1 Original data encrypted ED j ;

[0086] 8.3 Execute the incremental update algorithm CH.Adapt(tk,(h,R) j ED j ),ED j+1 → R j+1 And generate the data incremental update identifier μ for this data update. j+1 ;

[0087] 8.4 will add new data ED j+1 Stored on an off-chain storage server, and the incremental data update is identified by the identifier R. j+1 Sign the document and upload it to the updated subchain for storage.

[0088] 9. Data Usage Request: Data user DU initiates a request for the dataset to the blockchain. The request to use.

[0089] 10. Data Usage Authorization: Blockchain enables data usage authorization.

[0090] 10.1 Based on the access control conditions preset by the data owner DO, verify whether the data user DU's data usage request meets the conditions. If it does, execute the following steps.

[0091] 10.2 Generate data sharing transactions corresponding to the data owner (DO) and data user (DU);

[0092] 10.3 Initiate an off-chain SGX execution permission and send the chameleon hash value h, symmetric key ciphertext, etc. of the data to SGX;

[0093] 11. Off-chain execution: SGX executes the data sharing process.

[0094] 11.1 Use the private key to decrypt the symmetric key ciphertext of the encrypted data to obtain the symmetric key;

[0095] 11.2 Obtaining Ciphertext from Off-Chain Datasets For data ED1, ED2, ..., ED j+1 Execute the Chameleon Hash Verification Algorithm CH.verify(hk,h,R) i ED i If the result is 1, it proves that the data is valid incremental update data and can participate in subsequent data sharing calculations; otherwise, the data is discarded.

[0096] 11.3 Use a symmetric key to decrypt the verified ciphertext to obtain the plaintext.

[0097] 11.4 Perform data calculations and obtain the results;

[0098] 11.5 Encrypt the calculation result using the public key of the data requester DU and return it to the data requester DU;

[0099] 12. Results on the blockchain: Record the data sharing transaction information on the blockchain.

[0100] This application combines the Chameleon Hash algorithm with SGX to provide a secure and reliable incremental update and verification mechanism for shared data without altering the on-chain data. This effectively reduces problems such as data redundancy and high node data synchronization overhead caused by incremental updates. Furthermore, the unchanged on-chain records before and after the incremental update also avoids the overhead associated with data ownership confirmation, access control, and billing in the shared system.

[0101] This application employs a combination of a main chain and sub-chains. The main chain is responsible for the secure storage and sharing of data, while the sub-chains assist in storing incremental update records of shared data, ensuring the traceability of these records and facilitating the verification and filtering of shared data. Furthermore, the introduction of sub-chains effectively reduces the burden on the main blockchain.

[0102] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A data security sharing system supporting incremental data updates and verification, characterized in that, include: The data owner terminal is used to encrypt the data owner's original data into ciphertext using a key and store it on an off-chain storage server, calculate the chameleon hash value of the ciphertext and upload it to the blockchain; and send the data owner's incremental data update request to the blockchain. An off-chain storage server is used to store the encrypted data of the data owner and return the off-chain storage address to the data owner's terminal; and upload the encrypted data of the data owner to the SGX module; The blockchain adopts an architecture that combines a main chain and sub-chains. The main chain is used to publish shared data resources, process shared transactions, and receive and verify incremental data update requests from data owners. If the verification is correct, an off-chain execution permission for incremental data update is generated and sent to the SGX module. The sub-chain stores incremental data update records and realizes the verification of incremental update data. The SGX module is used to receive the off-chain execution permission for incremental data updates of the blockchain, verify the incremental update data sent by the data owner, and if the verification is valid, generate an update identifier for the incremental update data by using the incremental update algorithm with the key of the original data and the incremental update data, and upload the update identifier to the update sub-chain of the blockchain and the off-chain storage server for updating and storage.

2. A data security sharing system supporting incremental data updates and verification as described in claim 1, characterized in that, The data owner terminal is also used to upload the encryption key and ciphertext of the original data to the blockchain via the off-chain storage address of the off-chain storage server; it is also used to encrypt incrementally updated data using the same symmetric encryption key as the original data.

3. A data security sharing system supporting incremental data updates and verification as described in claim 1, characterized in that, The blockchain is also used to share and publish the chameleon hash value, key, and off-chain storage address of the encrypted text uploaded by the data owner's terminal.

4. A data security sharing system supporting incremental data updates and verification as described in claim 1, characterized in that, The SGX module is further configured to obtain the Chameleon Hash private key, the ciphertext of the incremental update data, and the ciphertext of the original data from the data owner terminal and the off-chain storage server, respectively; perform an incremental update algorithm on the obtained Chameleon Hash private key, the ciphertext of the incremental update data, and the ciphertext of the original data to generate a data incremental update identifier; store the data incremental update identifier in the off-chain storage server; and upload the signed data incremental update identifier to the update sub-chain of the blockchain for storage.

5. A data security sharing system supporting incremental data updates and verification as described in claim 1, characterized in that, The blockchain is also used to receive data requests sent by data requesters, and to verify whether the data request meets the conditions according to preset access control conditions. If the request meets the conditions, an off-chain SGX execution license is sent to the SGX module.

6. A data security sharing system supporting incremental data updates and verification as described in claim 1, characterized in that, The SGX module is also used to perform a chameleon hash verification algorithm on the acquired ciphertext, and verify whether it is valid incremental update data based on the calculation result. If it is valid incremental update data, the valid incremental update data is shared for calculation, and the shared transaction is uploaded to the blockchain.

7. A data security sharing method supporting incremental data updates and verification, characterized in that, include: The original data of the data owner is encrypted into ciphertext using a key and stored on an off-chain storage server. The chameleon hash value of the ciphertext is then calculated and uploaded to the blockchain. The blockchain receives incremental data update requests from data owners and verifies them. If the verification is correct, it generates an off-chain execution permission for incremental data updates and sends it to the SGX module. The SGX module receives the off-chain execution permission for incremental data updates from the blockchain and verifies the incremental update data from the data owner. If the verification is valid, the module uses the incremental update algorithm to generate an update identifier for the incremental update data and the key of the original data, and uploads the update identifier to the blockchain and the off-chain storage server.

8. A data security sharing method supporting incremental data updates and verification as described in claim 7, characterized in that, Also includes: The data owner terminal uses the same symmetric encryption key as the original data to encrypt incrementally updated data; The SGX module obtains the Chameleon Hash private key, the ciphertext of the incremental update data, and the original data ciphertext from the data owner terminal and the off-chain storage server, respectively. It then performs an incremental update algorithm on the obtained Chameleon Hash private key, the ciphertext of the incremental update data, and the original data ciphertext to generate a data incremental update identifier. The data incremental update identifier is stored in the off-chain storage server. Finally, the data incremental update identifier is signed and uploaded to the update sub-chain of the blockchain for storage.

9. A data security sharing method supporting incremental data updates and verification as described in claim 7, characterized in that, Also includes: The blockchain is used to receive data requests sent by data requesters and verify whether the data request meets the conditions according to preset access control conditions. If the request meets the conditions, an off-chain SGX execution license is sent to the SGX module.

10. A data security sharing method supporting incremental data updates and verification as described in claim 7, characterized in that, Also includes: The SGX module performs a chameleon hash verification algorithm on the acquired ciphertext. Based on the calculation result, it verifies whether the data is valid incremental update data. If it is valid incremental update data, the valid incremental update data is shared for calculation, and the shared execution record is signed and uploaded to the blockchain.

Images