Blockchain-based attribute-based encryption data sharing method, system and device

Abstract

The application provides a blockchain-based attribute-based encryption data sharing method, system and device. The method comprises the following steps: selecting primary nodes from each node of a blockchain network based on a preset trust evaluation rule to form a multi-authorization center; based on each primary node in the multi-authorization center, a storage system outside the blockchain network and the blockchain network, realizing attribute-based encryption data sharing transactions between different nodes currently acting as data providers and data requesters in the blockchain network; monitoring the transaction state data and the number of malicious behaviors of each primary node in real time; and updating the trust value of each primary node to update the members of the multi-authorization center. The application can avoid the problem of easy data leakage caused by a single authorization center, can guarantee the security and privacy of attribute-based encryption data, and can improve the reliability and security of the attribute-based encryption data sharing process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain, in particular to an attribute-based encryption data sharing method, system and device based on blockchain. BACKGROUND

[0002] Attribute-Based Encryption (ABE) is a flexible encryption technology that allows encrypted data to be accessed based on a set of attributes and policies, rather than traditional public and private key pairs. This encryption method enables encryption and decryption operations to be performed based on user attributes, providing a more fine-grained access control mechanism. Attribute-based encryption technology has shown wide application potential in data sharing, cloud storage, and fine-grained access control. It addresses the limitations of traditional encryption methods in complex access control scenarios, allowing data owners to have more flexible and precise control over data access permissions. In addition, ABE technology enhances data security and privacy, as even if data is shared or transmitted in an insecure environment, users without the corresponding attributes cannot decrypt the data. With increasing digital information being shared on the Internet, the importance and application range of attribute-based encryption technology is expected to further expand.

[0003] However, existing attribute-based data encryption methods have the problem of excessive authority of a single authorization center in the encryption process, which can easily lead to data leakage and loss, thus failing to guarantee the security and privacy of user shared data. Therefore, there is an urgent need to design an attribute-based data encryption method that can guarantee the security and privacy of user shared data. SUMMARY

[0004] In view of this, the embodiments of the present application provide an attribute-based encryption data sharing method, system and device based on blockchain to eliminate or improve one or more defects in the prior art.

[0005] One aspect of the present application provides an attribute-based encryption data sharing method based on blockchain, comprising:

[0006] Based on a preset trust evaluation rule, a primary node is selected from each node in the current blockchain network to form a multi-authorization center, so that attribute-based encryption data sharing transactions between nodes acting as data providers and nodes acting as data requesters in the current blockchain network are realized based on each primary node in the multi-authorization center, a storage system outside the blockchain network, and the blockchain network;

[0007] Real-time monitoring of transaction state data and the number of malicious acts of each primary node, and updating the trust value of each primary node according to the transaction state data;

[0008] According to the trust value and the number of malicious behaviors of each primary node, it is determined whether the to-be-downgraded node is contained in each primary node, and if so, the same number of non-primary nodes as the current to-be-downgraded node is updated to a new primary node to join the multi-authorization center, and the current to-be-downgraded node is deleted from the multi-authorization center and updated to a new non-primary node.

[0009] In some embodiments of the present application, based on each primary node in the multi-authorization center, a preset storage system outside the blockchain network and the blockchain network, attribute-based encryption data sharing transactions between nodes currently acting as data providers and nodes currently acting as data requesters in the blockchain network are implemented, including:

[0010] Each primary node in the multi-authorization center generates and distributes public parameters to each non-primary node in the blockchain network;

[0011] The node currently acting as a data provider in the blockchain network selects a first random number and a second random number based on the public parameters to generate an encryption key, encrypts a target plaintext according to the encryption key, stores the generated target ciphertext after encryption to a storage system outside the blockchain network, and encrypts the access path of the second random number and the target ciphertext using a pre-obtained public key to form a policy ciphertext, publishes the policy ciphertext to the blockchain network, and sends the first random number to the node currently acting as a data requester in the blockchain network via a secure channel;

[0012] The node currently acting as a data requester in the blockchain network sends its attribute set to the multi-authorization center;

[0013] Each primary node of the multi-authorization center generates a private key component for the node acting as a data requester using an attribute-based encryption algorithm, and sends the private key component and the policy ciphertext to the node acting as a data requester;

[0014] The node acting as a data requester generates a private key matching the public key according to the private key component, and decrypts the policy ciphertext based on the private key to obtain the access path of the second random number and the target ciphertext, then calls the target ciphertext from the storage system based on the access path of the target ciphertext, and obtains the encryption key based on the first random number and the second random number, and decrypts the target ciphertext using the encryption key to obtain the target plaintext.

[0015] In some embodiments of the present application, based on a preset trust evaluation rule, primary nodes are selected from each node in the blockchain network to form a multi-authorization center, including:

[0016] numbering each of the nodes according to the order in which each of the nodes joins the blockchain network;

[0017] selecting a preset number of the nodes as current primary nodes from the order of the numbering of each of the nodes from small to large;

[0018] setting different initial global trust values for the primary nodes and the non-primary nodes as current respective trust values of each of the primary nodes and each of the non-primary nodes.

[0019] In some embodiments of the present application, the real-time monitoring of the transaction state data and the number of malicious behaviors of each of the primary nodes, and updating the trust value of each of the primary nodes according to the transaction state data, includes:

[0020] real-time monitoring of the transaction state data of each of the primary nodes, the transaction state data including: a transaction success state or a transaction failure state;

[0021] and real-time monitoring of whether each of the primary nodes has a malicious behavior that meets a preset malicious behavior judgment rule and recording the corresponding number of malicious behaviors;

[0022] calculating the current time decay factor of the primary node that performs the occurrence attribute-based encryption data sharing transaction, and calculating the current standardized trust value of the primary node according to the time decay factor of the primary node and the transaction state data, and updating the current trust value of the primary node based on the standardized trust value.

[0023] In some embodiments of the present application, the determination of whether each of the primary nodes contains a node to be downgraded according to the trust value of each of the primary nodes and the number of malicious behaviors, if yes, updating the same number of non-primary nodes as the current number of nodes to be downgraded to new primary nodes to join the multi-CA, and deleting the current nodes to be downgraded from the multi-CA and updating them to new non-primary nodes, includes:

[0024] determining whether there is any primary node in the current each of the primary nodes that has the current number of malicious behaviors greater than a preset number of threshold and / or the trust value updated based on the standardized trust value is less than a preset trust threshold, if yes, the primary node is determined as the current node to be downgraded;

[0025] selecting the same number of non-primary nodes as the current number of nodes to be downgraded and updating them to new primary nodes in the order of the trust value of each of the current non-primary nodes from large to small to join the multi-CA, and deleting the current nodes to be downgraded from the multi-CA and updating them to new non-primary nodes.

[0026] In some embodiments of the present application, before the order from large to small according to the respective trust values of the current various non-primary nodes, further comprising:

[0027] If a message for any of the current primary nodes to exit the blockchain network is received, the primary node is determined as the current node to be degraded.

[0028] Another aspect of the present application provides a blockchain-based attribute-based encryption data sharing device, comprising:

[0029] An initial construction module is configured to select primary nodes from the current various nodes of a blockchain network based on preset trust evaluation rules to form a multi-CA, and to implement attribute-based encryption data sharing transactions between nodes acting as data providers and nodes acting as data requesters in the blockchain network based on the various primary nodes in the multi-CA, a storage system outside the blockchain network, and the blockchain network.

[0030] A state monitoring module is configured to monitor transaction state data and the number of malicious behaviors of each primary node in real time, and to update the trust value of each primary node according to the transaction state data.

[0031] A member updating module is configured to determine whether a node to be degraded is included in each primary node according to the trust value and the number of malicious behaviors of each primary node, and if so, to update the same number of non-primary nodes as the number of current nodes to be degraded as new primary nodes to join the multi-CA, and to delete the current nodes to be degraded from the multi-CA and update them as new non-primary nodes.

[0032] A third aspect of the present application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the blockchain-based attribute-based encryption data sharing method when executing the computer program.

[0033] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the blockchain-based attribute-based encryption data sharing method.

[0034] A fifth aspect of the present application provides an attribute-based encryption data sharing system, comprising: various nodes constituting a blockchain network, a multi-CA composed of primary nodes selected from the various nodes, and a storage system arranged outside the blockchain network; and each of the various nodes is in communication connection with the storage system.

[0035] The multi-authorization center is constructed based on a blockchain-based attribute-based encryption data sharing device and performs update of the primary nodes, and the blockchain-based attribute-based encryption data sharing device is used in the blockchain-based attribute-based encryption data sharing method.

[0036] Each primary node and a transaction identity of a non-primary node other than the primary node in the blockchain network include a node of a data provider and a data requester.

[0037] The sixth aspect of the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the blockchain-based attribute-based encryption data sharing method.

[0038] The blockchain-based attribute-based encryption data sharing method provided by the present application selects primary nodes from the current nodes of the blockchain network based on preset trust evaluation rules to form a multi-authorization center, and realizes attribute-based encryption data sharing transactions between nodes acting as data providers and nodes acting as data requesters in the blockchain network based on the primary nodes in the multi-authorization center, a storage system outside the blockchain network, and the blockchain network. The transaction state data and the number of malicious behaviors of each primary node are monitored in real time, and the trust value of each primary node is updated according to the transaction state data. Whether a to-be-downgraded node is included in each primary node is determined according to the trust value of each primary node and the number of malicious behaviors. If yes, the same number of non-primary nodes as the current number of to-be-downgraded nodes are updated to new primary nodes to join the multi-authorization center, and the current to-be-downgraded nodes are deleted from the multi-authorization center and updated to new non-primary nodes. This can avoid the problem of easy data leakage caused by a single authorization center, ensure the security and privacy of attribute-based encryption data, and further improve the reliability and security of the attribute-based encryption data sharing process.

[0039] Additional advantages, objects, and features of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0040] It will be understood by those skilled in the art that the objects and advantages of the present application are not limited to the above specifically described, and the above and other objects of the present application can be more clearly understood according to the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. The components in the drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the application. For purposes of clarity and understanding, some portions of the drawings can be exaggerated, and others can be omitted. In the drawings:

[0042] Figure 1 The first flowchart of the blockchain-based attribute-based encryption data sharing method in an embodiment of the present application.

[0043] Figure 2 The interaction diagram of the attribute-based encryption data sharing in an embodiment of the present application.

[0044] Figure 3 The second flowchart of the blockchain-based attribute-based encryption data sharing method in an embodiment of the present application.

[0045] Figure 4 The structure diagram of the blockchain-based attribute-based encryption data sharing device in an embodiment of the present application.

[0046] Figure 5 The flowchart of the blockchain-based trust evaluation model algorithm in an application example of the present application. DETAILED DESCRIPTION

[0047] In order to make the objects, technical solutions, and advantages of the present application clearer, the present application will be described in detail below with reference to the embodiments and drawings. Here, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but are not intended to limit the present application.

[0048] It should be noted that, in order to avoid obscuring the present application due to unnecessary details, only the structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0049] It should be emphasized that the term "comprises / comprising" when used in this text indicates the presence of the stated features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0050] It should be noted that, if not specifically stated, the term "connected" in this text can not only mean direct connection, but also indirect connection with the presence of an intermediate.

[0051] In the following, embodiments of the present application will be described with reference to the drawings. In the drawings, the same reference signs represent the same or similar components, or the same or similar steps.

[0052] In order to ensure the security and privacy of attribute-based encrypted data, the embodiments of the present application respectively provide a blockchain-based attribute-based encrypted data sharing method, a blockchain-based attribute-based encrypted data sharing device for executing the blockchain-based attribute-based encrypted data sharing method, an entity device and a computer readable storage medium, etc., which can prevent data leakage and loss caused by a single authorization center with too much power, thereby protecting the security of data.

[0053] The embodiments are specifically described as follows.

[0054] Based on this, the embodiments of the present application provide a blockchain-based attribute-based encrypted data sharing method which can be implemented by a blockchain-based attribute-based encrypted data sharing device, as shown in Figure 1 The blockchain-based attribute-based encrypted data sharing method specifically includes the following contents:

[0055] Step 100: Based on a preset trust evaluation rule, a primary node is selected from each node of a current blockchain network to form a multi-authorization center, and based on each of the primary nodes in the multi-authorization center, a storage system outside the blockchain network and the blockchain network, attribute-based encrypted data sharing transactions between nodes currently acting as data providers and nodes acting as data requesters in the blockchain network are implemented.

[0056] In one or more embodiments of the present application, other nodes in the blockchain network that are not designated as primary nodes can be referred to as non-primary nodes or secondary nodes, etc. Specifically, all nodes can be divided into two or more levels according to node hierarchical requirements.

[0057] It can be understood that blockchain technology is an innovative distributed ledger technology, which is known for its unique decentralized characteristics, unalterable data records, and high transparency and security. In essence, blockchain replicates and stores data on multiple nodes of a network, forming a series of data blocks connected by encryption, each of which contains a certain number of transaction records, and once added to the chain, these records cannot be changed or deleted. Blockchain technology has been extended to financial services, supply chain management, healthcare, management and other fields, bringing transparency, efficiency and trust to these fields. By ensuring the integrity and reliability of data, blockchain technology provides a unique solution to problems such as transaction security, data tampering and intermediary trust. With the continuous maturation of technology and the increase of application cases, blockchain is gradually recognized as a technology that can profoundly change the ecology of multiple industries.

[0058] In one example of the present application, the trust evaluation rule can specifically adopt a trust evaluation model, which is first used in P2P networks. The calculation range is divided into two types of calculation, namely global trust calculation (Eigen Trust) and local trust calculation (Peer Trust). The Eigen Trust algorithm calculates the global trust value of each user by aggregating the trust scores of all users in the network. Eigen Trust uses complex mathematical models such as eigenvectors and iterative calculations to ensure that interactions in the network are as safe and trustworthy as possible. It improves the trust level of the entire network by reducing the impact of malicious users and increasing the visibility of well-behaved users. The Peer Trust algorithm focuses on online transaction environments, especially considering factors such as transaction feedback, transaction volume, and transaction quality to enhance trust management in online transaction platforms. Peer Trust calculates trust values by evaluating users' historical behavior and feedback from other users. This method allows the algorithm to dynamically adapt to changes in user behavior, providing a reliable trust evaluation mechanism for buyers and sellers in electronic markets.

[0059] Step 200: Real-time monitoring of transaction state data and number of malicious behaviors of each primary node, and updating the trust value of each primary node according to the transaction state data.

[0060] It should be noted that the basis for determining whether a node has committed malicious behavior can be to analyze the transactions initiated by the node and check for any abnormal or malicious patterns, such as the following behaviors:

[0061] (1) Frequent sending of invalid transactions, monitoring the number of invalid transactions sent by a single node within a short period of time. Frequent sending of such transactions can be determined as an attempt to interfere with the network or consume resources of other nodes.

[0062] (2) Transactions with format errors or unable to meet network rules (such as invalid signature, incorrect nonce value, etc.) can be considered as invalid transactions;

[0063] (3) Nodes attempting double spending, which refers to attempting to pay the same coin or digital currency to two or more recipients at the same time to deceive transaction recipients;

[0064] (4) Nodes with abnormal transaction rates, especially those that continue to initiate transactions at high speed when the network is not busy, can be considered as intending to conduct DDoS attacks.

[0065] Step 300: determining whether the to-be-downgraded node is contained in each of the primary nodes according to the trust value and the number of malicious behaviors of each of the primary nodes, and if yes, updating the same number of non-primary nodes as the current number of to-be-downgraded nodes as new primary nodes to join the multi-authorization center, and deleting the current to-be-downgraded nodes from the multi-authorization center and updating them as new non-primary nodes.

[0066] From the above description, it can be known that the attribute-based encryption data sharing method based on a block chain provided by the embodiment of the application can solve the problem of excessive rights of a single authorization center in the attribute-based encryption process. The embodiment of the application selects and constructs a multi-authorization center by using a block chain technology and a trust evaluation model, so as to realize the functions of generating public parameters and generating corresponding private keys for users in the attribute-based encryption process. The loss caused by data leakage due to excessive rights of a single authorization center is prevented, so as to protect the safety of data. The data sharing problem from a data provider to a data consumer in the data sharing scene is solved. On the basis of the attribute-based encryption of the multi-authorization center, the data sharing scheme is proposed. The application supports fine-grained data control and permission management. The data provider can define data use conditions according to needs, and the data consumer must meet these conditions to obtain decryption and access permissions, so that the safety of data sharing is effectively protected.

[0067] In order to further improve the effectiveness and security of the attribute-based encryption data sharing transaction process, in the attribute-based encryption data sharing method based on a block chain provided by the embodiment of the application, referring to Figure 2 Taking the storage system as an IPFS storage system as an example, the multi-authorization center, the storage system outside the block chain network and the block chain network mentioned in the step 100 realize the attribute-based encryption data sharing transaction between the nodes as data providers and the nodes as data requesters in the block chain network, and specifically contain the following contents:

[0068] (1) Each of the primary nodes in the multi-authorization center generates and distributes public parameters to each of the non-primary nodes in the block chain network.

[0069] Specifically, the initialization operation of the multi-authorization center inputs a security parameter, and then outputs a public parameter GP, a user identifier uid and an aid of the multi-authorization center.

[0070] GlobalSetup(λ)→(GP,aid,uid)

[0071] Wherein, GlobalSetup(λ) represents global parameter initialization.

[0072] The algorithm is executed by a primary node (i.e., a multi-authorization center AA), inputs a public parameter GP and an authority identifier aid, and then outputs a master key MSK aid and a public key PK aid :

[0073] AuthSetup(GP,aid)→(MSK aid ,PK aid )

[0074] wherein AuthSetup(GP,aid) represents an authorization center initialization.

[0075] An encryption key is generated, and a data provider randomly selects K1 and K2, and K1 and K2 are subjected to a SHA256 algorithm to obtain an encryption key K.

[0076] KEncrypt(K1,K2)→(K)

[0077] wherein KEncrypt(K1,K2) represents a key generation.

[0078] (2) A node currently acting as a data provider in the blockchain network generates an encryption key K based on the public parameter, selects a first random number K1 and a second random number K2, encrypts a target plaintext mes according to the encryption key K, stores the generated target ciphertext CT outside the blockchain network, and encrypts the second random number K2 and the access path of the target ciphertext CT using a pre-obtained public key PK to form a policy ciphertext C w (K2,L), publishes the policy ciphertext C w (K2,L) to the blockchain network, and sends the first random number K1 to a node currently acting as a data requester in the blockchain network via a secure channel.

[0079] Specifically, the data provider DO performs symmetric encryption on the data M to be shared, uploads the obtained ciphertext CT to the IPFS to obtain a corresponding path, and performs an attribute-based encryption algorithm on the key K. The specific steps are as follows:

[0080] A. The data provider DO inputs the data plaintext mes and the key K2, and finally outputs the ciphertext, and uploads the ciphertext CT to the IPFS to finally obtain the path L.

[0081] MesEncrypt(M,K2)→(CT)

[0082] wherein MesEncrypt(M,K2) represents a data encryption stage.

[0083] B. The data provider DO inputs a key K2, a path L, a public parameter GP, a public key PK, an access matrix (M, p), a message m, and finally outputs a policy ciphertext Cw(K2, L). The ciphertext identifier M_ID, the data provider representation uid, and the policy ciphertext Cw(K2, L) are published to the blockchain. The blockchain network receives the request and initiates the smart contract StoreCont to respond.

[0084] OwnerEncrypt(GP, PK, w, L, K2) → (C w (K2, L))

[0085] Wherein, OwnerEncrypt(GP, PK, w, L, K2) represents the attribute-based encryption phase.

[0086] In the smart contract StoreCont, as shown in Table 1, the first row is used to configure the blockchain, the second row records the current transaction time, the third row is used to store transaction records, and the last fourth row returns the transaction D.

[0087] Table 1

[0088]

[0089] The data provider establishes contact with the data requester through an SSL secure channel and sends K1 to the data requester through the secure channel.

[0090] SslPart(K1)

[0091] (3) The node currently acting as a data requester in the blockchain network sends its attribute set to the multi-authority center.

[0092] (4) Each first-level node of the multi-authority center generates a private key component SK i for the node acting as a data requester using an attribute-based encryption algorithm, and sends the private key component SK i and the policy ciphertext C w (K2, L) to the node acting as a data requester.

[0093] In this phase, the data requester sends an access request to the multi-authority center, and includes the attribute set of the data requester. After receiving the request, the multi-authority center triggers the smart contract and generates a corresponding private key component for the data requester. The specific steps are as follows:

[0094] Input public key PK, private key MK, attribute set s of data requester, run attribute-based encryption algorithm KeyGen key generation algorithm, wherein the private key component is generated by using distributed key generation technology, and t is the threshold number of DKG recovery key, so that t-1 node malicious attack can be resisted, the security of the user key is protected, and C w (K2, L) is sent to the data requester.

[0095] UserKeyGen(PK, MK, s, t)→(SK i )

[0096] Wherein, UserKeyGen(PK, MK, s, t) represents user key generation.

[0097] (5) The node as the data requester generates the private key SK matching the public key PK according to the private key component SK i , decrypts the policy ciphertext based on the private key SK to obtain the second random number K2 and the access path of the target ciphertext CT, then calls the target ciphertext CT from the storage system based on the access path of the target ciphertext CT, and obtains the encryption key K based on the first random number K1 and the second random number K2, and decrypts the target ciphertext CT by using the encryption key K to obtain the target plaintext mes.

[0098] Specifically, the private key component SKi, the ciphertext C w (K2, L) and the public key PK are input first, and the SK i obtained by the data requester is recovered by calling the Lagrange polynomial difference formula, and the C w (K2, L) is decrypted by calling the Decrypt decryption algorithm, and finally the K2 and L of the plaintext are output.

[0099] UserDecrypt(PK, SK i , C w (K2, L))→(SK, K2, L)

[0100] Wherein, UserDecrypt(PK, SK i , C w (K2, L)) represents the attribute-based encryption stage.

[0101] And after the data requester receives K1 and K2, the final encryption key K is obtained by using the SHA256 algorithm, the ciphertext CT is obtained on the IPFS by using the address L, and the plaintext mes is finally obtained by using K for decryption.

[0102] KDecrypt(K1, K2, L)→(mes)

[0103] In order to further improve the effectiveness and applicability of the attribute-based encryption data sharing based on the blockchain, in the attribute-based encryption data sharing method based on the blockchain provided by the embodiment of the present application, referring to Figure 3 , the step 100 of the attribute-based encryption data sharing method based on the blockchain specifically includes the following contents:

[0104] Step 110: numbering each node according to the order of joining the blockchain network.

[0105] Step 120: selecting a preset number of nodes as the current primary nodes from the order of the numbering of each node from small to large.

[0106] Step 130: setting different initial global trust values for the primary nodes and the non-primary nodes as the current respective trust values of each of the primary nodes and each of the non-primary nodes.

[0107] Specifically, in the initialization stage, it is assumed that the number of nodes in the blockchain network is N in the initialization stage, all the nodes are numbered according to the order of joining the network i~N, and the first P (P<N) nodes are selected as trusted nodes, the initial global trust value of the group of nodes is 1 / P, and the initial global trust value of the remaining N-P nodes is 1 / N. Then, node classification is performed, the P nodes are selected as trusted primary nodes as the core layer, participate in the consensus process of the blockchain network and are responsible for the work of the multi-authorization center in the future, and the other nodes are selected as secondary nodes as the ordinary layer, used to receive the consensus result of the core layer and the daily transaction. The nodes in the core layer can accumulate their own trust value by conducting transactions in the network. If the primary node behaves abnormally, it will be downgraded and cannot enter the core layer for a period of time. At the same time, the node with the highest trust value is selected from the ordinary layer as a primary node and added to the core layer.

[0108] In order to further improve the effectiveness and applicability of the attribute-based encryption data sharing based on the blockchain, in the attribute-based encryption data sharing method based on the blockchain provided by the embodiment of the present application, referring to Figure 3 , the step 200 of the attribute-based encryption data sharing method based on the blockchain specifically includes the following contents:

[0109] Step 210: real-time monitoring of the transaction state data of each of the primary nodes, the transaction state data including: a transaction success state or a transaction failure state.

[0110] And, step 220: real-time monitoring of whether each of the primary nodes has an abnormal behavior meeting a preset abnormal behavior judgment rule and recording the corresponding number of abnormal behaviors.

[0111] Step 230: calculating the time decay factor of the primary node currently generating the attribute-based encryption data sharing transaction, and calculating the normalized trust value of the primary node currently according to the time decay factor of the primary node and the transaction state data, and updating the trust value of the primary node currently based on the normalized trust value.

[0112] Specifically, in reality, there will be nodes doing evil, at this time, in order to ensure the normal operation of the system, it is necessary to dynamically update the nodes of the authorization center, and update the private key components of each authorization center node. The application sets the number of authorization center nodes to be fixed, so node evil or node exit from the blockchain network needs to be upgraded and downgraded.

[0113] ReSetup(σ i )→(σ′ i )

[0114] In order to further improve the application effectiveness and reliability of the multi-authorization center for attribute-based encryption data sharing, in an attribute-based encryption data sharing method based on a blockchain provided in an embodiment of the application, referring to Figure 3 , the step 300 of the attribute-based encryption data sharing method based on a blockchain specifically includes the following contents:

[0115] Step 310: among the current various primary nodes, it is judged whether there is any primary node whose current number of evil behaviors is greater than a preset number threshold and / or whose trust value updated based on the normalized trust value is less than a preset trust threshold, and if yes, the primary node is determined as a current node to be downgraded.

[0116] If no primary node whose number of evil behaviors is greater than a preset number threshold and / or whose trust value updated based on the normalized trust value is less than a preset trust threshold is found, no subsequent processing is performed, and the step 200 is returned to continue monitoring.

[0117] Step 320: according to the order of the trust values of the respective non-primary nodes from large to small, the same number of non-primary nodes as the number of the current nodes to be downgraded are selected and updated as new primary nodes to join the multi-authorization center, and the current nodes to be downgraded are deleted from the multi-authorization center and updated as new non-primary nodes.

[0118] In order to further improve the application effectiveness and reliability of the multi-authorization center for attribute-based encryption data sharing, in an attribute-based encryption data sharing method based on a blockchain provided in an embodiment of the application, referring to Figure 3 , the step 320 of the attribute-based encryption data sharing method based on a blockchain specifically includes the following contents before the step 320:

[0119] Step 301: If a message for exiting the blockchain network is received for any of the current primary nodes, the primary node is determined as the current node to be degraded.

[0120] The application also provides a blockchain-based attribute-based encryption data sharing device for performing all or part of the content of the blockchain-based attribute-based encryption data sharing method. Figure 4 The blockchain-based attribute-based encryption data sharing device specifically includes the following content:

[0121] An initial construction module 10 is configured to select primary nodes from the current nodes of the blockchain network based on preset trust evaluation rules to form a multi-CA, and to realize attribute-based encryption data sharing transactions between nodes acting as data providers and nodes acting as data requesters in the blockchain network based on the primary nodes in the multi-CA, a storage system outside the blockchain network, and the blockchain network.

[0122] A state monitoring module 20 is configured to monitor transaction state data and the number of malicious behaviors of each primary node in real time, and to update the trust value of each primary node according to the transaction state data.

[0123] A member updating module 30 is configured to determine whether a node to be degraded is included in each primary node according to the trust value and the number of malicious behaviors of each primary node, and if so, to update the same number of non-primary nodes as the number of current nodes to be degraded as new primary nodes to join the multi-CA, and to delete the current nodes to be degraded from the multi-CA and update them as new non-primary nodes.

[0124] The blockchain-based attribute-based encryption data sharing device provided by the application can be used to perform the processing flow of the blockchain-based attribute-based encryption data sharing method in the above embodiments, and its functions will not be repeated here. Please refer to the detailed description of the above blockchain-based attribute-based encryption data sharing method embodiments.

[0125] The part of the blockchain-based attribute-based encryption data sharing device for performing blockchain-based attribute-based encryption data sharing can be executed in a server or completed in a client device. Specifically, it can be selected according to the processing capacity of the client device and the restrictions of the user's use scenario. The application does not limit this. If all operations are completed in the client device, the client device can also include a processor for specific processing of the blockchain-based attribute-based encryption data sharing. At the same time, the nodes in the blockchain network of the application can be servers or client devices.

[0126] The client device described above can have a communication module (i.e., a communication unit) that can be in communication connection with a remote server to realize data transmission with the server. The server can include a server of a task scheduling center side, and in other implementation scenarios, can also include a server of an intermediate platform, such as a server of a third-party server platform that is in communication link with the server of the task scheduling center. The server can include a single computer device, or can include a server cluster composed of multiple servers, or a server structure of a distributed device.

[0127] The server and the client device can use any suitable network protocol to communicate, including a network protocol that has not been developed as of the filing date of the present application. The network protocol can include, for example, a TCP / IP protocol, a UDP / IP protocol, an HTTP protocol, an HTTPS protocol, and the like. Of course, the network protocol can also include, for example, a RPC protocol (Remote Procedure Call Protocol) used on top of the above-mentioned protocols, a REST protocol (Representational State Transfer), and the like.

[0128] As can be seen from the above description, the attribute-based encryption data sharing device based on a blockchain provided by the embodiments of the present application can avoid the problem of easy data leakage caused by a single authorization center, can ensure the security and privacy of attribute-based encryption data, and can further improve the reliability and security of the attribute-based encryption data sharing process.

[0129] Based on all or part of the contents of the foregoing attribute-based encryption data sharing method based on a blockchain, the present application further provides an embodiment of an attribute-based encryption data sharing system, which specifically includes the following contents:

[0130] Each node constituting a blockchain network, a multi-authorization center constituted by selected primary nodes from each of the nodes, and a storage system arranged outside the blockchain network; each of the nodes is in communication connection with the storage system;

[0131] The multi-authorization center is based on an attribute-based encryption data sharing device based on a blockchain to build and update the primary nodes, and the attribute-based encryption data sharing device based on a blockchain is used to execute the attribute-based encryption data sharing method based on a blockchain mentioned in the foregoing embodiments;

[0132] Among them, the transaction identity of each primary node and a non-primary node other than the primary node in the blockchain network includes: a node of a data provider and a data requester.

[0133] Specifically, from the perspective of system architecture, the scheme includes the following five roles:

[0134] Block-Chain NetWork (BN): BN is used to select a group of nodes as the attribute-based encryption authorization center through a trust evaluation model.

[0135] Attribute Authority (AA): AA is mainly responsible for generating and distributing keys.

[0136] Data Owner (DO): DO is mainly responsible for encrypting shared data and sending part of the key to the data requester.

[0137] Data Consumer (DC): DC provides its own attributes to the AA to obtain the corresponding private key, and can finally decrypt the ciphertext to obtain the plaintext.

[0138] IPFS storage system: IPFS is introduced for off-chain storage to solve the storage problem of the blockchain, and the returned index value is transmitted to enhance the security and efficiency of the system.

[0139] That is, the attribute-based encryption data sharing system provided by the embodiments of the present application provides an effective method for securely sharing user data. By introducing the mechanism of multiple authorization centers, the problem of excessive power of a single authorization center is eliminated, and once malicious behavior occurs, it can lead to user privacy leakage. The trust evaluation model is used to select the node with the highest trust value as the multi-authorization center to improve the efficiency and robustness of the system. The present application encrypts the shared data based on attributes, and the data provider can set appropriate access structures for fine-grained access control of shared data. The non-tamperable and public nature of the blockchain ensures the fairness and traceability of the entire process. At the same time, the shared data is stored on IPFS to achieve efficient and secure storage of large files. In order to prevent all authorization center nodes from collectively committing fraud and conspiring to generate decryption keys to decrypt ciphertexts, the encryption key is composed of two parts, one part is sent by the data provider to the data requester through a secure channel, and the other part is attribute-based encrypted, and finally the partial key is subjected to SHA256 operation to obtain the decryption key, which further protects the security of the data.

[0140] To further illustrate the above scheme, the present application also provides a blockchain data sharing method based on a trust evaluation model and attribute-based encryption. The method uses a trust evaluation model and blockchain technology to improve the problem of excessive power of attribute-based encryption authorization centers, and ensures security and trust during data sharing, and effectively protects the interests of data providers and data consumers. Referring to Figure 2 and Figure 5, Figure 5 In it, Y represents "yes" and N represents "no"; the blockchain data sharing method based on the trust evaluation model and attribute-based encryption specifically includes the following content:

[0141] (1) Step 1: Construction of the trust evaluation model

[0142] A. Initialization stage: Assume that in the initialization stage, the number of nodes in the blockchain network is N. All nodes are numbered from i to N according to the order of joining the network, and the earliest P (P < N) nodes joined are used as trusted nodes. The initial global trust value of this group of nodes is 1 / P, and the initial global trust value of the remaining N - P nodes is 1 / N.

[0143] B. Node classification: These P nodes are used as the trusted first-level nodes as the core layer, participating in the blockchain network consensus process and being responsible for the work of multiple authorization centers later. Other nodes are second-level nodes as the ordinary layer, used to receive the consensus results and transactions of the core layer, and update the trust value after each transaction.

[0144] To describe this step by instantiation, the specific algorithm description is given in the application example of this application.

[0145] First, the application example of this application also introduces the time decay factor γ through the sigmoid function, and the calculation method is as follows:

[0146]

[0147] In the formula, t trans represents the time when the transaction occurs, and t now represents the current time. That is, the closer the transaction is to the current time, the smaller the decay degree of γ, and vice versa.

[0148] After introducing the time decay factor, the trust value is calculated after each transaction is successful or failed.

[0149] The evaluation for satisfaction is:

[0150]

[0151] The evaluation for dissatisfaction is:

[0152]

[0153] Among them and are respectively the evaluation for success and the evaluation for failure after the transaction between node i and node j at time t. α and β are respectively the weights when evaluating the trust value, where α + β = 1.

[0154] Finally, the calculation formula for the trust value is obtained:

[0155] s ij = sat(i,j) - unsat(i,j)

[0156] The normalized trust value calculation formula is:

[0157]

[0158] C. The nodes in the core layer can accumulate their own trust values by transacting in the network. If a primary node commits a malicious act, it will be downgraded and cannot enter the core layer for a period of time. At the same time, the node with the highest trust value is selected from the normal layer as a primary node and added to the core layer.

[0159] To instantiate this step, the application examples give a specific algorithm description:

[0160]

[0161]

[0162] where x represents the number of times of node malpractice, C ij is the trust value before updating, C ij represents the updated trust value.

[0163] (II) Step 2: initialization phase

[0164] A. The initialization operation of the multi-authorization center, input the security parameter, then output the public parameter GP and the user identifier uid and the aid of the multi-authorization center.

[0165] GlobalSetup(λ)→(GP,aid,uid)

[0166] To instantiate this step, the application examples give a specific algorithm description. The algorithm inputs a security parameter λ, and then selects two multiplicative groups G and G T with order p, g is the generator of G, and the bilinear mapping e: G × G→ G T . The algorithm selects three hash functions respectively as H: {0,1} * → G, selects an extractor h∈ and a symmetric encryption scheme SE. Finally, a unique identity identifier uid and uid is allocated for each AA and user, and the public parameter GP = {ρ, G, G T , g, e, H, H1, H2, h, SE} is output.

[0167] B. The algorithm is executed by the AA, input the public parameter GP, the authority identifier aid, then output the sub-private key MSK aidand child public key PK aid

[0168] AuthSetup(GP, aid)→(MSK aid , PK aid )

[0169] To instantiate this step, the application gives a specific algorithm description. After each authority center completes the initialization algorithm, it generates a child private key and a child public key. Next, it needs to generate a master public key and a master private key. This is achieved through the idea of threshold sharing. Let (t, T) be the threshold, which means that the secret needs to be recovered by t authorities to be effective, and T is the set of authorities.

[0170] 1. All authorities A participating in secret recovery i Randomly select d i , k i , establish a t-1 order polynomial f i (x) mod q, f i (x) as follows:

[0171] f i (x) = f i (0) + a 1i x + a 1i x 2 + … + a i,i-1 x t-1 mod q

[0172] 2. All authorities need to calculate and publish to other nodes in the network. The authority also needs to calculate the private key component σ i,j = f i (aid j ) mod q. Encrypt the calculation result with the other party's public key and send it to the other party.

[0173] 3. When the authority center receives messages from at least t-1 other authorities, it decrypts σ j,i with its own private key to obtain σ j,i , and verifies whether it is legal using the equation . Finally

[0174] 4. After each authority center completes the above three steps, it can obtain the following formulas:

[0175]

[0176]

[0177]

[0178] 5. When all the authorized centers in the set T have received the data of the other t-1 authorized centers, the private key component can be calculated by the Lagrange polynomial interpolation formula where P is a constant.

[0179]

[0180] Finally, the system public key y = g F(0) R mod q, the system private key

[0181] C. Generate encryption key, the data provider randomly selects K1 and K2, and K1 and K2 are subjected to SHA256 algorithm to obtain the encryption key K.

[0182] KEncrypt(K1, K2)→(K)

[0183] (Three) Step 3: Data encryption phase

[0184] In this phase, the DO symmetrically encrypts the data plaintext mes to be shared, uploads the obtained ciphertext CT to the IPFS to obtain the corresponding path, and performs attribute-based encryption algorithm on the key K2. The specific steps are as follows:

[0185] A. The data provider DO inputs the data plaintext mes and the key K2, and finally outputs the ciphertext, and uploads the ciphertext CT to the IPFS to finally obtain the path L.

[0186] MesEncrypt(mes, K2)→(CT)

[0187] B. The data provider DO inputs the key K2, the path L, the public parameter GP, the public key PK, the access matrix (M, p), the shared data plaintext mes, and finally outputs the ciphertext C w (K2, L), and finally publishes the ciphertext identifier M_ID, the data provider representation uid, and the ciphertext C w (K2, L) to the blockchain, and the blockchain network receives the request and responds by launching the smart contract StoreCont.

[0188] OwnerEncrypt(GP, PK, (M, p), L, K2)→(C w (K2, L))

[0189] To instantiate this step, the application provides a specific algorithm description. In this phase, the data provider first generates an l*n access matrix M, a function p is mapped to each row attribute of the matrix M, i.e. p(i), and a random number s∈Z p is selected. Vector and 0 as a random vector Let Then calculate C0=Re(g,g) s , Finally, the ciphertext about K2, L is CT(K2, L)={(M, p), C0, C 1,i , 2,i , 3,i} i∈[1,l] .

[0190] (IV) Step 4: Data request phase

[0191] In this phase, the data requester sends an access request to the multi-authorization center, and contains the attribute set of the data requester. After receiving the request, the multi-authorization center triggers the smart contract and generates the corresponding private key component for the data requester. The specific steps are as follows:

[0192] Input public key PK, private key MK, attribute set s of data requester, run attribute-based encryption algorithm KeyGen key generation algorithm, where the private key component is generated by using distributed key generation technology, and t is the threshold number of DKG recovery key, which can resist t-1 node malicious attack and protect the security of user key. Finally, the private key component SK i and CT(K2, L) are sent to the data requester.

[0193] UserKeyGen(PK, MK, s, t)→(SK i )

[0194] (V) Step 5: Data decryption phase

[0195] A. The data provider establishes contact with the data requester through the SSL secure channel, and sends K1 to the data requester through the secure channel.

[0196] SslPart(K1)

[0197] B. Input private key component SK i , ciphertext C w (K2, L) and public key PK, the data requester will obtain SK i through calling Lagrange polynomial difference formula to recover and obtain the private key SK, and call Decrypt decryption algorithm to decrypt C w (K2, L), finally output the plaintext K2 and L.

[0198] UserDecrypt(PK, K i ,C w (K2, L))→(Sk, K2, L)

[0199] To instantiate this step, the application gives a specific algorithm description.

[0200] 1. If the access attribute s of the user does not satisfy the access policy (M, p), the algorithm terminates.

[0201] 2. If the access attribute s of the user satisfies the access policy (M, p), select a that satisfies x c i M i = (1, 0,..., 0) constant For i e {1, 2,..., l}, calculate:

[0202] Finally, the decrypted plaintext (K2, L) is obtained.

[0203] C. After the data requester receives K1 and K2, the final encryption key K is obtained through the SHA256 algorithm, the ciphertext CT is obtained through the address L on the IPFS, and the plaintext M is finally obtained by decrypting with K.

[0204] KDecrypt(K1, K2, L)→(M)

[0205] (6) Step 6: Core layer node update

[0206] In reality, there will be nodes that are malicious, so in order to ensure the normal operation of the system, m is needed to dynamically update the nodes of the authorization center, and update the private key components of each authorization center node. The application example sets the number of authorization center nodes to be fixed, so node malpractice or node exit from the blockchain network needs to be upgraded and downgraded.

[0207] ReSetup(σ i )→(σ′ i )

[0208] Node update can be divided into the following two cases:

[0209] 1. The node exits the blockchain network, at this time it can be considered that the node is trusted, so the old node can directly exchange data with the new node.

[0210] 2. The node is degraded due to malicious behavior, and a new node needs to be added to the ordinary layer, and then a node is deleted from the core layer. The newly added node is AA', AA' needs to randomly select k' and d', and construct a t-1 order polynomial f(x) mod q, and σ i+1,j = f i+1 (ID j ) mod q can be calculated by repeating step 2, and the calculation result is encrypted and signed and sent to other authorization center nodes in the network. When AA jReceive σ i+1,j Then, calculate σ j,i+1 = f j (ID i+1 ) mod q, and return to AA', while updating its own private key component σ' j = (σ j + σ i+1,j ) mod q. Repeat the step with other authorized center nodes in the blockchain. When AA' synchronizes with other nodes, it can obtain its own private key component After that, the malicious node AA z is downgraded, and other authorized center nodes update their private key components to σ' i = (σ i - σ z ) mod q.

[0211] The application example proposes an innovative data sharing method, which ingeniously combines trust evaluation model and blockchain technology, aiming to provide a multi-authorized center framework for attribute-based encryption technology. By selecting nodes with high trust values as authorized centers in the blockchain, the application not only enhances the security and credibility in the data sharing process, but also improves the flexibility and scalability of the system. This unique combination allows the data sharing and protection mechanism to be innovatively improved in a decentralized environment, providing users with a more secure and efficient data interaction experience.

[0212] The attribute-based encryption data sharing method based on trust evaluation model and blockchain provides innovative and secure solutions for multiple fields. In the field of cloud computing, this method can ensure the security of sensitive data in cloud storage and cloud services, allowing only users with specific attributes to access the data, greatly improving the security and privacy of data processing and storage. In the field of Internet of Things, with the increasing number of devices and the increasing complexity of inter-device connectivity, this method can effectively manage and control data access permissions between devices, ensuring secure data transmission between devices and preventing unauthorized access and data leakage. It also has broad application prospects in the fields of medical health and financial services.

[0213] At the same time, to successfully implement this method, it is necessary to rely on a reliable blockchain network, establish an effective trust evaluation model to evaluate and screen authorized centers, and develop a comprehensive attribute management mechanism and security strategy. In addition, ensuring the authenticity of user and device identity and attributes is also crucial, which requires a strict authentication process. By meeting these conditions, this method not only enhances the security and credibility of the data exchange process, but also provides sufficient flexibility and scalability to adapt to changing business needs and technical environments, providing new solutions for secure and reliable data sharing.

[0214] The electronic device can comprise a processor, a memory, a receiver and a transmitter. The processor is configured to perform the attribute-based encryption data sharing method based on blockchain mentioned in the above embodiments. The processor and the memory can be connected by a bus or other means. The receiver can be connected to the processor and the memory by wired or wireless means.

[0215] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, or a combination thereof.

[0216] The memory is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the attribute-based encryption data sharing method based on blockchain in the embodiments of the present application. The processor performs various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, implements the attribute-based encryption data sharing method based on blockchain in the above method embodiments.

[0217] The memory can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function. The data storage area can store data created by the processor and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely disposed relative to the processor, which can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0218] The one or more modules are stored in the memory and executed by the processor to perform the attribute-based encryption data sharing method based on blockchain in the embodiments.

[0219] In some embodiments of the present application, the user equipment can include a processor, a memory, and a transceiver which can include a receiver and a transmitter, the processor, the memory, the receiver and the transmitter can be connected through a bus system, the memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver to transceive signals.

[0220] As an implementation manner, the functions of the receiver and the transmitter in the present application can be implemented by a transceiving circuit or a dedicated transceiving chip, and the processor can be implemented by a dedicated processing chip, a processing circuit or a general-purpose chip.

[0221] As another implementation manner, the server provided by the embodiments of the present application can be implemented by using a general-purpose computer. That is, the program codes for implementing the functions of the processor, the receiver and the transmitter are stored in the memory, and the general-purpose processor implements the functions of the processor, the receiver and the transmitter by executing the codes in the memory.

[0222] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the aforementioned attribute-based encryption data sharing method based on a block chain. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0223] Those of ordinary skill in the art should understand that the example components, systems and methods described in connection with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. The choice between hardware and software implementation depends on specific application and design constraints. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave in a transmission medium or a communication link.

[0224] It is to be expressly understood that the application is not limited to the described and illustrated particular configurations and processes. For the sake of clarity, detailed descriptions of known methods are omitted. In the above described embodiments, several specific steps are described and illustrated as examples. However, the method processes of the application are not limited to the specific steps described and illustrated, and the skilled person can make various changes, modifications and additions, or change the order of the steps, after having understood the spirit of the application.

[0225] In this application, features described and / or illustrated with respect to one embodiment can be used in the same or similar manner in one or more other embodiments and / or combined with or substituted for features of other embodiments.

[0226] The above only describes the preferred embodiments of the application, and is not intended to limit the application. The skilled in the art can make various changes and modifications to the embodiments of the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A blockchain-based attribute-based encryption data sharing method, characterized by, The application comprises the following steps: Based on the preset trust evaluation rules, the first-level nodes are selected from the current nodes of the blockchain network to form a multi-authority center, and based on the first-level nodes in the multi-authority center, the storage system outside the blockchain network and the blockchain network, the attribute-based encryption data sharing transaction between the nodes currently acting as data providers and the nodes currently acting as data requesters in the blockchain network is realized; The transaction state data and the number of malicious behaviors of each first-level node are monitored in real time, and the trust value of each first-level node is updated according to the transaction state data; According to the trust value and the number of malicious behaviors of each first-level node, it is determined whether the to-be-downgraded node is contained in each first-level node, if yes, the same number of non-first-level nodes as the current to-be-downgraded nodes are updated to new first-level nodes to join the multi-authority center, and the current to-be-downgraded nodes are deleted from the multi-authority center and updated to new non-first-level nodes. 2.The blockchain-based attribute-based encryption data sharing method of claim 1, wherein, The multi-authority center comprises the following steps: Each first-level node in the multi-authority center generates and distributes public parameters to each non-first-level node in the blockchain network; The nodes currently acting as data providers in the blockchain network select a first random number and a second random number based on the public parameters to generate an encryption key, encrypt the target plaintext according to the encryption key, store the generated target ciphertext after encryption to the storage system outside the blockchain network, and encrypt the access path of the second random number and the target ciphertext using the pre-acquired public key to form a policy ciphertext, publish the policy ciphertext to the blockchain network, and send the first random number to the nodes currently acting as data requesters in the blockchain network via a secure channel; The nodes currently acting as data requesters in the blockchain network send their attribute sets to the multi-authority center; Each first-level node of the multi-authority center generates a private key component for the nodes acting as data requesters using an attribute-based encryption algorithm, and sends the private key component and the policy ciphertext to the nodes acting as data requesters; The nodes acting as data requesters generate a private key matching the public key according to the private key component, decrypt the policy ciphertext based on the private key to obtain the access path of the second random number and the target ciphertext, then call the target ciphertext from the storage system based on the access path of the target ciphertext, and obtain the encryption key based on the first random number and the second random number, and decrypt the target ciphertext using the encryption key to obtain the target plaintext. 3.The blockchain-based attribute-based encryption data sharing method of claim 1, wherein, The application comprises the following steps: numbering each node in the blockchain network according to the order in which each node joins the blockchain network; selecting a preset number of nodes as the current first-level nodes in the order from small to large of the numbering of each node; setting different initial global trust values for the first-level nodes and the non-first-level nodes as the current respective trust values of each first-level node and each non-first-level node. 4.The blockchain-based attribute-based encryption data sharing method of claim 1, wherein, The real-time monitoring of the transaction state data and the number of malicious behaviors of each first-level node, and updating the trust value of each first-level node according to the transaction state data, includes: real-time monitoring of the transaction state data of each first-level node, the transaction state data including: transaction success state or transaction failure state; and, real-time monitoring of whether each first-level node has a malicious behavior that meets the preset malicious behavior judgment rule and recording the corresponding number of malicious behaviors; calculating the current time decay factor of the first-level node of the attribute-based encryption data sharing transaction, and calculating the current standardized trust value of the first-level node according to the time decay factor of the first-level node and the transaction state data, and updating the current trust value of the first-level node based on the standardized trust value. 5.The blockchain-based attribute-based encryption data sharing method of claim 4, wherein, The determination of whether each first-level node contains a node to be downgraded according to the trust value of each first-level node and the number of malicious behaviors, if so, updating the same number of non-first-level nodes as the current number of nodes to be downgraded to new first-level nodes to join the multi-authorization center, and deleting the current nodes to be downgraded from the multi-authorization center and updating them to new non-first-level nodes, includes: determining whether there is any first-level node in the current each first-level node whose current number of malicious behaviors is greater than a preset number of threshold and / or whose trust value updated based on the standardized trust value is less than a preset trust threshold, if so, the first-level node is determined as the current node to be downgraded; selecting the same number of non-first-level nodes as the current number of nodes to be downgraded and updating them to new first-level nodes in the order from large to small of the respective trust values of the current each non-first-level node, to join the multi-authorization center, and deleting the current nodes to be downgraded from the multi-authorization center and updating them to new non-first-level nodes. 6.The blockchain-based attribute-based encryption data sharing method of claim 5, wherein, Before the order from large to small of the respective trust values of the current each non-first-level node, it also includes: if a message is received for any current first-level node to exit the blockchain network, the first-level node is determined as the current node to be downgraded. 7.A blockchain-based attribute-based encryption data sharing apparatus characterized by comprising: It includes: an initial construction module for selecting first-level nodes from the current each node in the blockchain network to form a multi-authorization center based on a preset trust evaluation rule, to realize attribute-based encryption data sharing transactions between nodes acting as data providers and nodes acting as data requesters in the blockchain network based on each first-level node in the multi-authorization center, a preset storage system outside the blockchain network, and the blockchain network; A state monitoring module is configured to monitor transaction state data and the number of malicious behaviors of each first-level node in real time, and update the trust value of each first-level node according to the transaction state data; A member updating module is configured to determine whether each first-level node contains a node to be degraded according to the trust value and the number of malicious behaviors of each first-level node, and if yes, update a same number of non-first-level nodes as the number of the nodes to be degraded to be new first-level nodes to join the multi-CA, and delete the nodes to be degraded from the multi-CA and update the nodes to be degraded to be new non-first-level nodes.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the attribute-based encryption data sharing method based on a blockchain according to any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the attribute-based encryption data sharing method based on a blockchain according to any one of claims 1 to 6.

10. An attribute-based encryption data sharing system, characterized by, It comprises: Each node constituting a blockchain network, a multi-CA constituted by first-level nodes selected from each node, and a storage system arranged outside the blockchain network; each node is in communication connection with the storage system; The multi-CA is based on an attribute-based encryption data sharing device based on a blockchain to construct and update the first-level nodes, and the attribute-based encryption data sharing device based on a blockchain is configured to execute the attribute-based encryption data sharing method based on a blockchain according to any one of claims 1 to 6; Each first-level node and the transaction identity of a non-first-level node other than the first-level node in the blockchain network both include a node of a data provider and a data requester.

Images