An information sharing method, system, device and storage medium

Abstract

The application discloses an information sharing method, system, device and storage medium, relates to the field of cryptography, and comprises the following steps: an initialization module is used for distributing the signature private key and the signature public key corresponding to the current user group and the public parameter information to each layer client in the current user group after the signature private key and the signature public key corresponding to the current user group and the public parameter information are generated, initializing the identity key information of the first layer client, and recording by using a block chain; a key distribution module is used for obtaining corresponding identity key information by configuring corresponding next layer clients by taking each layer client as a key generation party; an information encryption and sharing module is used for obtaining target ciphertext by encrypting the first target layer client, calling a preset block chain by using the identity key information of the second target layer client as an information receiver, verifying the preset block chain, and obtaining target contract events including the ciphertext after the verification is passed; and an information decryption module is used for decrypting and signing when the second target layer client listens to the target contract events. The system management burden is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography, in particular to an information sharing method, system, device and storage medium. BACKGROUND

[0002] At present, the information sharing system mostly relies on the public key certificate system to realize encrypted communication to ensure communication security. However, the certificate system needs to rely on an authoritative organization and a long certificate chain to perform a series of legality verification on the certificate, and also relies on a certificate revocation list (CRL) to confirm whether the certificate has been revoked, which brings a considerable communication and management burden. SUMMARY

[0003] Therefore, the purpose of the present application is to provide an information sharing method, system, device and storage medium, which can reduce the management burden of the system and improve the information sharing efficiency on the basis of ensuring data security and credibility. The specific scheme is as follows:

[0004] In a first aspect, the present application provides an information sharing system, comprising:

[0005] An initialization module is configured to, after generating a signature private key and a signature verification public key corresponding to a current user group and public parameter information through a key generation center, perform private key distribution and public parameter distribution on each layer of client in the current user group, perform identity key information initialization on the first layer of client in the current user group based on the public parameter information, obtain corresponding identity key information, and record information based on a preset blockchain;

[0006] A key assignment module is configured to, by sequentially taking each layer of client in the current user group as a key generation party, perform identity key information configuration on the corresponding next layer of client, to obtain the identity key information of each layer of client in the current user group except the first layer of client, and record information based on the preset blockchain;

[0007] An information encryption and sharing module is configured to, by a first target layer of client in the current user group as an information sender triggering an information sharing operation, encrypt plaintext data based on the public parameter information to obtain target ciphertext, and use the identity key information of a second target layer of client as a corresponding information receiver to call the preset blockchain for information verification, to obtain a corresponding target contract event including the target ciphertext after verification;

[0008] An information decryption module is configured to decrypt the target ciphertext in the target contract event to obtain the plaintext data and sign the plaintext data based on the signature private key when the second target layer client listens to the target contract event corresponding to itself.

[0009] Optionally, the initialization module comprises:

[0010] An identity key information initialization unit is configured to configure, through a key generation center, a current key update number, first identity information, a decryption number threshold, a key used number, and a violation revocation information base corresponding to a first layer client in a current user group, and obtain a first identity key corresponding to the first layer client based on the public parameter information and the first identity information.

[0011] A first information recording unit is configured to record the signature public key, the current key update number corresponding to the first layer client, the decryption number threshold, the key used number, and the violation revocation information base in a corresponding smart contract in a preset blockchain.

[0012] Optionally, the key distribution module comprises:

[0013] A first key information configuration unit is configured to configure, through the first layer client, a current key update number, second identity information, a decryption number threshold, a key used number, and a violation revocation information base corresponding to a second layer client in a current user group, and obtain a second identity key corresponding to the second layer client based on the public parameter information, the second identity information, and a first identity key in the identity key information of itself.

[0014] A second information recording unit is configured to record the current key update number corresponding to the second layer client, the decryption number threshold, the key used number, and the violation revocation information base in a corresponding smart contract in a preset blockchain.

[0015] Optionally, the information encryption and sharing module comprises:

[0016] A user identity ID configuration unit is configured to configure, through a first target layer client in a current user group as an information sender triggering an information sharing operation, a target user identity ID with data review authority corresponding to plaintext data to be shared.

[0017] A data encryption unit is configured to encrypt the plaintext data based on the public parameter information and the target user identity ID to obtain target ciphertext.

[0018] The blockchain calling unit is configured to call the preset blockchain by the target ciphertext and the identity key information of the second target layer client as a corresponding information receiver.

[0019] The blockchain verification unit is configured to determine whether the updated key usage times are not less than a target threshold after updating the key usage times corresponding to the first target layer client in the preset blockchain, to obtain a corresponding determination result; the target threshold is a threshold obtained by adding one to a decryption times threshold corresponding to the first target layer client in the preset blockchain.

[0020] The event generation unit is configured to, when the determination result is less than, encrypt based on the identity key information to obtain a corresponding target contract event including the target ciphertext.

[0021] The calling failure unit is configured to, when the determination result is equal to, determine that the identity key in the identity key information of the first target layer client has expired, and return a corresponding calling failure response.

[0022] Optionally, the information decryption module comprises:

[0023] The event listening unit is configured to, after the second target layer client listens to an event of calling the preset blockchain by the identity key information of the second target layer client, transmit the target contract event to a security tool of the second target layer client.

[0024] The data decryption unit is configured to, by the security tool and based on the public parameter information, decrypt the target ciphertext in the target contract event to obtain corresponding plaintext data.

[0025] The data signature unit is configured to, by the security tool and using the signature private key and the target ciphertext, sign the plaintext data to obtain corresponding signature information, and display the signature information to the first target layer client.

[0026] Optionally, the system further comprises:

[0027] The key expiration update module is configured to, when it is determined based on the preset blockchain that the identity key in the identity key information of the first target layer client has expired, update the current key update times, identity key, and key usage times corresponding to the first target layer client saved in the preset blockchain, so that the identity key is updated locally after the first target layer client listens to an update event corresponding to itself.

[0028] Optionally, the system further comprises:

[0029] a violation discovery module configured to invoke the preset blockchain by using the target ciphertext, the plaintext data and the signature information when the plaintext data obtained after decryption by the second target layer client is found to be in violation;

[0030] a violation verification module configured to verify the signature information by using the signature verification public key saved in the preset blockchain by the second target layer client, and to compare and verify the plaintext data in sequence with violation revocation information bases of clients corresponding to a target path in the preset blockchain in a comparison order from a lower layer to an upper layer when the signature information is verified, to obtain a corresponding verification result; the target path is a search path corresponding to a search operation from a lower layer to an upper layer between the second target layer client and the first layer client;

[0031] a revocation module configured to generate a revocation user contract event corresponding to the first target layer client by using the preset blockchain when it is determined that there is a violation based on the verification result, so that the first target layer client performs a self-destruction operation on the locally saved identity key of the first target layer client when it listens to the revocation user contract event corresponding to itself.

[0032] In a second aspect, the present application provides an information sharing method, comprising:

[0033] After generating the signature private key and the signature verification public key, the public parameter information corresponding to the current user group by the key generation center, performing private key distribution and public parameter distribution on each layer client in the current user group, performing identity key information initialization on the first layer client in the current user group based on the public parameter information to obtain corresponding identity key information, and performing information recording based on the blockchain;

[0034] By taking each layer client in the current user group in sequence as a key generation party, performing identity key information configuration on the corresponding next layer client to obtain the identity key information of each layer client in the current user group except the first layer client, and performing information recording based on the preset blockchain;

[0035] By the first target layer client in the current user group as an information sender triggering an information sharing operation, encrypting plaintext data based on the public parameter information to obtain target ciphertext, and invoking the preset blockchain for information verification by using the identity key information of the second target layer client as a corresponding information receiver, to obtain a corresponding target contract event including the target ciphertext after verification;

[0036] When the second target layer client listens to the target contract event corresponding to itself, the target ciphertext in the target contract event is decrypted to obtain the plaintext data, and the plaintext data is signed based on the signature private key.

[0037] In a third aspect, the present application provides an electronic device, comprising:

[0038] a memory for saving a computer program;

[0039] a processor for executing the computer program to implement the steps of the information sharing method.

[0040] In a fourth aspect, the present application provides a computer readable storage medium for saving a computer program, which is executed by a processor to implement the steps of the information sharing method.

[0041] It can be seen that in the present application, the initialization module is configured to, after generating the signature private key and the signature public key corresponding to the current user group, the public parameter information by the key generation center, distribute the private key and the public parameter to each layer client in the current user group, initialize the identity key information of the first layer client in the current user group based on the public parameter information, obtain the corresponding identity key information, and record the information based on the preset blockchain; the key assignment module is configured to, by taking each layer client in the current user group as a key generation party in turn, configure the identity key information of the corresponding next layer client, so as to obtain the identity key information of each layer client in the current user group except the first layer client, and record the information based on the preset blockchain; the information encryption and sharing module is configured to, by the first target layer client in the current user group as an information sender triggering an information sharing operation, encrypt the plaintext data based on the public parameter information to obtain a target ciphertext, and use the identity key information of the second target layer client as a corresponding information receiver to call the preset blockchain for information verification, so as to obtain a target contract event including the target ciphertext after verification; and the information decryption module is configured to, when the second target layer client listens to the target contract event corresponding to itself, decrypt the target ciphertext in the target contract event to obtain the plaintext data, and sign the plaintext data based on the signature private key. It can be seen that in the present application, after initialization, the identity key information of each layer client is obtained by layered encryption, and the data is saved by the blockchain. In addition, when sharing information, the target contract event including the target ciphertext is obtained based on the identity key information of the second target layer client as an information receiver. In this way, on the basis of ensuring data security and credibility, the management burden of the system is reduced, and the information sharing efficiency is improved. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description only constitute a part of the embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of the provided drawings.

[0043] Figure 1 A schematic diagram of an information sharing system structure is provided for the present application.

[0044] Figure 2 A schematic diagram of an information sharing process is provided for the present application.

[0045] Figure 3 A schematic diagram of a specific client layer architecture in a user group is provided for the present application.

[0046] Figure 4 A specific information sharing process diagram is provided for the present application.

[0047] Figure 5 An information sharing method flow chart is provided for the present application.

[0048] Figure 6 An electronic device structure diagram is provided for the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments only constitute a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort fall within the scope of protection of the present application.

[0050] Currently, most information sharing systems rely on public key certificate systems to achieve encrypted communication to ensure communication security. However, the certificate system needs to rely on an authoritative agency and a long certificate chain to perform a series of legality verification on the certificate, and also relies on a certificate revocation list to confirm whether the certificate has been revoked, which brings a considerable communication and management burden. Therefore, the present application provides an information sharing scheme, which can reduce the management burden of the system and improve the information sharing efficiency on the basis of ensuring data security and credibility.

[0051] Referring to Figure 1 The embodiments of the present application disclose an information sharing system, which comprises:

[0052] The initialization module 11 is configured to, after generating the signature private key and the signature public key corresponding to the current user group and the public parameter information by the key generation center, distribute the private key and the public parameter to each layer of client in the current user group, initialize the identity key information of the first layer of client in the current user group based on the public parameter information, obtain the corresponding identity key information, and record the information based on the preset blockchain.

[0053] It should be understood that in the embodiment, the system includes a corresponding key generation center, a preset blockchain and a plurality of clients. In addition to generating and securely distributing keys to the user group, the key generation center also has the ability to call the blockchain and listen to the blockchain events. The blockchain system mainly records user identity information, revocation rules and encrypted shared information. Each client can also call the blockchain and listen to the blockchain, in addition, the client also has an internal security tool for securely distributing and receiving, storing and using the key.

[0054] Specifically, the system needs to be initialized before running, and the signature private key (denoted as sk sig ) and the signature public key (denoted as pk sig ) corresponding to the current user group are generated, and the identity layer encryption initialization algorithm Setup is run to generate the public parameter information (including the public parameter params and the master key msk) before the private key (sk sig ) and the public parameter (params) are distributed to each layer of client in the current user group, and then the first layer of client is initialized. That is, the initialization module 11 includes: an identity key information initialization unit configured to configure, by the key generation center, the current key update number (initial u A =1), the first identity information (I1=A||u A ), the decryption number threshold (m A ), the key used number (initial c A =0), and the rule revocation information library (r) corresponding to the first layer of client (denoted as A), and obtain the first identity key (denoted as dk A ) corresponding to the first layer of client based on the public parameter information and the first identity information; and a first information recording unit configured to record the signature public key (pk sig ), the current key update number corresponding to the first layer of client, the decryption number threshold, the key used number, and the rule revocation information library (that is, [A, u A , c A , m Aand r) record the corresponding smart contract in the preset blockchain. Wherein, the key extraction algorithm Extraction (params, msk, I1) is run to obtain dk A . And dk A is distributed to the security tool inside A for storage.

[0055] The key distribution module 12 is configured to configure the identity key information of the corresponding next layer client by sequentially taking each layer client in the current user group as a key generation party, to obtain the identity key information of each layer client in the current user group except the first layer client, and record the information based on the preset blockchain.

[0056] As shown in Figure 2 , in the embodiment, after initialization is completed, the key distribution stage needs to be entered, in which the user of the first layer identity generates a key for the second layer identity, and securely distributes and records the second layer identity information to the blockchain contract; and the user of the second layer identity generates a key for the third layer identity, securely distributes and records the third layer identity information to the blockchain contract; and so on, until a key is generated and securely distributed for the bottom layer identity, and the bottom layer identity information is recorded in the blockchain contract. That is, the key distribution module 12 includes: a first key information configuration unit, configured to configure, by the first layer client, the current key update number (initial u B1 =1), the second identity information (I2=B1||u B1 , the user identity set of the second layer is ID2=[I1, I2]), the decryption number threshold (m B1 ), the key used number (initial c B1 =0), the violation revocation information library (r A ) corresponding to the second layer client based on the public parameter information, the second identity information and the first identity key in the identity key information of itself, to obtain the second identity key (dk B1 ) corresponding to the second layer client; a second information recording unit, configured to record the current key update number, the decryption number threshold, the key used number and the violation revocation information library (that is, [B1, u B1 , c B1 , m B1 ] and r A ) corresponding to the second layer client to the corresponding smart contract in the preset blockchain. The Delegation (params, ID2, dk A ) algorithm is run to generate the key dk B1 of the department B1. And dk B1 is distributed to the security tool inside A for storage.

[0057] Afterwards, B1 configures the corresponding identity key information for the third layer client, and so on, until the identity key information of each layer client in the current user group is configured.

[0058] The information encryption sharing module 13 is configured to encrypt plaintext data based on the public parameter information to obtain target ciphertext, and call the preset blockchain to perform information verification by using the identity key information of the second target layer client as the corresponding information receiver, so as to obtain the target contract event including the target ciphertext after the verification is passed.

[0059] Specifically, in the embodiment, the information encryption sharing module 13 includes: a user identity ID configuration unit configured to configure a target user identity ID with data access permission corresponding to the plaintext data to be shared by the first target layer client as the information sender in the current user group triggering the information sharing operation; a data encryption unit configured to encrypt the plaintext data based on the public parameter information and the target user identity ID to obtain target ciphertext; a blockchain calling unit configured to call the preset blockchain by using the target ciphertext and the identity key information of the second target layer client as the corresponding information receiver; a blockchain verification unit configured to judge whether the updated key used number is not less than a target threshold after updating the key used number corresponding to the first target layer client in the preset blockchain, to obtain a corresponding judgment result; the target threshold is a threshold obtained by adding one to the decryption number threshold corresponding to the first target layer client in the preset blockchain; and an event generation unit configured to, when the judgment result is less than, encrypt based on the identity key information to obtain the target contract event including the target ciphertext.

[0060] Meanwhile, there is also a calling failure unit configured to, when the judgment result is equal to, determine that the identity key in the identity key information of the first target layer client has expired, and return a corresponding calling failure response.

[0061] The information decryption module 14 is configured to, when the second target layer client listens to the target contract event corresponding to itself, decrypt the target ciphertext in the target contract event to obtain the plaintext data, and sign the plaintext data based on the signature private key.

[0062] Specifically, in this embodiment, the information decryption module 14 comprises: an event listening unit, configured to, after the second target layer client listens to an event of calling the preset blockchain through the identity key information of the second target layer client, transmit the target contract event to a security tool of the second target layer client; a data decryption unit, configured to decrypt the target ciphertext in the target contract event through the security tool and based on the public parameter information, to obtain corresponding plaintext data; and a data signature unit, configured to sign the plaintext data through the security tool and using the signature private key and the target ciphertext, to obtain corresponding signature information, and display the signature information to the first target layer client.

[0063] Further, in combination with the Figure 2 As shown, in this embodiment, there are also a corresponding expiration update phase and a key revocation phase.

[0064] Regarding the expiration update phase, that is, the key expiration update module, when it is listened that the identity key in the identity key information of the first target layer client has expired based on the preset blockchain through the key generator corresponding to the first target layer client, the current key update times, identity key and key used times corresponding to the first target layer client saved in the preset blockchain are updated, so that the local identity key is updated after the first target layer client listens to the update event corresponding to itself.

[0065] Regarding the key revocation phase, there is a violation discovery module, configured to, when the plaintext data obtained after decryption is found to be in violation by the second target layer client, call the preset blockchain using the target ciphertext, the plaintext data and the signature information; a violation verification module, configured to, using the signature verification public key saved in the preset blockchain, verify the signature information by the second target layer client, and when the signature information is verified, the plaintext data is compared and verified with the violation revocation information base of the client corresponding to the target path in the preset blockchain in sequence according to the comparison order from the lower layer to the upper layer, to obtain the corresponding verification result; the target path is the search path corresponding to the search operation from the lower layer to the upper layer between the second target layer client and the first layer client; a revocation module, configured to, when it is determined that there has been a violation based on the verification result, generate a revocation user contract event corresponding to the first target layer client using the preset blockchain, so that the identity key of the first target layer client saved locally is deleted and destroyed when the first target layer client listens to the revocation user contract event corresponding to itself.

[0066] In conclusion, in the embodiment, the identity layered encryption technology is combined with the block chain system to construct a safe and reliable information sharing system. Compared with the information sharing system relying on the public key certificate system, the system uses the identity key of the receiver as the public key to encrypt the plaintext data to be shared, thereby reducing the burden of system management of certificates and keys; the revocation of the user key of the system is initiated by the client receiving the information, and after the contract is judged and the contract event is generated, the client key is triggered to delete and self-destruct, so that the automatic revocation of the key controlled by the contract not only reduces the management pressure of the user on the key revocation, but also makes the key revocation content public through the contract, thereby avoiding the defects of the traditional opaque and difficult-to-supervise revocation by the superior; the key update of the system is also driven by the contract event, which is conducive to reducing the pressure of the user on the management of the key update while enhancing the trust through the contract.

[0067] It can be seen that, in the embodiment of the present application, the initialization module is used to distribute the private key and the public parameter to each layer of client in the current user group after generating the signature private key and the signature public key corresponding to the current user group and the public parameter information through the key generation center, initialize the identity key information of the first layer of client in the current user group based on the public parameter information, obtain the corresponding identity key information, and record the information based on the preset block chain; the key assignment module is used to take each layer of client in the current user group as the key generation party in turn, configure the identity key information of the corresponding next layer of client, so as to obtain the identity key information of each layer of client in the current user group except the first layer of client, and record the information based on the preset block chain; the information encryption and sharing module is used to take the first target layer of client in the current user group as the information sender to trigger the information sharing operation, encrypt the plaintext data based on the public parameter information to obtain the target ciphertext, and call the preset block chain for information verification by using the identity key information of the second target layer of client as the corresponding information receiver, so as to obtain the corresponding target contract event including the target ciphertext after the verification is passed; the information decryption module is used to decrypt the target ciphertext in the target contract event to obtain the plaintext data when the second target layer of client listens to the target contract event corresponding to itself, and sign the plaintext data based on the signature private key. It can be seen that, in the present application, after initialization, the identity key information of each layer of client is obtained through layered encryption, and the data is saved through the block chain. In addition, the corresponding target contract event including the target ciphertext is obtained based on the identity key information of the second target layer of client as the information receiver when the information sharing is performed. In this way, on the basis of ensuring data security and credibility, the management burden of the system is reduced, and the information sharing efficiency is improved.

[0068] The following will be described in combination with Figure 3 and Figure 4The technical solutions of the embodiments of this application will be described in detail below.

[0069] by Figure 3 Taking the user group shown as an example, assume that the shared information system is running on a platform where... Figure 3 In the organizational structure shown, the system is used by first-tier client A, second-tier client B1, and two third-tier clients C1 and C2. The architecture of this shared information system is referenced below. Figure 4 (For ease of viewing, step A and its related steps are omitted from the diagram.) As shown: it contains a key generation center, a blockchain, and clients B1, C1, and C2.

[0070] After initialization, during the key distribution phase, the B1 client sets the key update count u for the third-layer client. C1 =1, its identity information I3=C1||u C1 The third-level user identity set is ID3=[I1,I2,I3], and Delegation(params,ID3,dk) is executed. B1 The algorithm generates the key dk for the C1 client. C1 and dk C1 Securely distributed to the internal confidentiality module of the C1 client.

[0071] Similarly, the B1 client sets the number of user key updates. C2 =1, I'3=C2||t, ID3=[I1,I2,I'3], run Delegation(params,ID3,dk B1 The algorithm generates the key dk for user C2. C2 and dk C2 Securely distributed to the internal confidentiality module of the information sharing system client for user C2.

[0072] Client B1 sets the maximum number of decryption attempts for the keys of clients C1 and C2 to m. C1 ,m C2 The number of times the key is used for decryption is c. C1 =0,c C2 =0, set the content library to be removed for violations. B Calling the blockchain system, [C1,u] C1 ,c C1 ,m C1 ]、[C2,u C2 ,c C2 ,m C2 ] and r B Recorded in a blockchain contract.

[0073] During the encrypted information sharing phase, the information sender (taking the C2 client as an example) generates a target contract event for information sharing through the blockchain and shares the message with the information receiver (taking the C1 client as an example).

[0074] For the information m to be shared, the information sharing system client of department C2 administrator sets user identity ID=[I1,I2,I3], calls the encryption algorithm Encryption(params,ID,m) to encrypt m, obtains the ciphertext CT, and calls the blockchain system with the ciphertext CT and the recipient C1 as parameters; the blockchain system contract saves [C2,CT,C1]; and the contract contains c C1 The value is updated to c C1 +1, if c C1 ≥m c1 +1, that is, if c C1 =m c1 +1 generates a contract event indicating key expiration, and returns a failure message; otherwise, it directly returns a failure message.

[0075] Otherwise, if c C1 <m c1 +1 blockchain contracts generate contract events that share information involving [C2, CT, C1].

[0076] During the information decryption phase, after the C1 client detects the target contract event, it transmits the event to the internal security module, also known as the security tool. The internal security module then calls the decryption algorithm Decryption(params, CT, dk). C1 The encrypted text CT in the event is decrypted to obtain the decrypted plaintext information m'. The internal security module uses the signing private key sk. sig Sign the CT and m' pair and obtain the signature information sig. Then display CT, m', and sig to the C1 client.

[0077] During the revocation phase, if C1 discovers a violation in step m', it invokes the blockchain via the client with CT, m', and sig as parameters; the blockchain contract uses the stored pk. sig After verifying that the signature sig is correct, the sender C2 of the CT event is retrieved from the contract, and the violation plaintext information m' is sequentially compared with r. B r A The system compares and verifies violations. If a violation is verified, the blockchain generates a revocation event for the user contract containing [C2]. If no violation is verified, the revocation phase is exited. If the C2 client detects a revocation event for the user contract, it passes it to the internal protection module, triggering the key revocation of the internal protection module and deleting and self-destructing the key within the module.

[0078] Furthermore, if the C2 client contains lower-level users, C2 will generate a user contract revocation event containing the identity of the lower-level users through the information sharing client. The lower-level users of C2 will then perform key revocation, deletion, and self-destruction operations similar to those mentioned above.

[0079] During the expiration update phase, after the B1 client detects the contract event indicating that the blockchain verification key has expired, it retrieves C1 and u from the blockchain contract. C1 Calculate u C1 =u C1 +1, set identity information I'3=C1||u C1 The third-level user identity set is ID'3=[I1,I2,I'3], and Delegation(params,I'3,dk) is executed. B1 The algorithm generates a new key dk' for the C1 client. C1 .

[0080] Client B1 sets the user identity ID=[I1,I2,I3] and calls the encryption algorithm Encryption(params,ID,dk'). C1 ) for dk' C1 Encrypt the text to obtain the ciphertext CK.

[0081] B1 client settings c C1 =0, use u C1 c C1 The parameters CK and C1 invoke the blockchain contract to update the u in the contract. C1 c C1 The value generates a key update contract event containing [B1, CK, C1].

[0082] After the C1 client detects the key update contract event, it passes the event to the internal security module, which then calls Decryption(params, CT, dk). C1 After calculating the new key, replace the original identity key.

[0083] See Figure 5 As shown in the embodiments of this application, an information sharing method is also disclosed, including:

[0084] Step S11: After generating the signature private key, verification public key, and public parameter information corresponding to the current user group through the key generation center, the private key and public parameter are distributed to each layer of clients in the current user group. Based on the public parameter information, the identity key information of the first layer client in the current user group is initialized to obtain the corresponding identity key information, and the information is recorded based on the blockchain.

[0085] In step S12, the identity key information of each layer client in the current user group except the first layer client is obtained by configuring the identity key information of the corresponding next layer client by taking each layer client in the current user group as a key generator in turn, and recording the information based on the preset blockchain.

[0086] In step S13, the first target layer client in the current user group triggers the information sharing operation as an information sender, encrypts the plaintext data based on the public parameter information to obtain target ciphertext, and calls the preset blockchain to perform information verification by using the identity key information of the second target layer client as a corresponding information receiver, to obtain a target contract event including the target ciphertext after the verification is passed.

[0087] In step S14, when the second target layer client listens to the target contract event corresponding to itself, the target ciphertext in the target contract event is decrypted to obtain the plaintext data, and the plaintext data is signed based on the signature private key.

[0088] The more specific working processes of the above steps can refer to the corresponding contents disclosed in the foregoing embodiments, and will not be described here.

[0089] As can be seen, in the present application, after initialization, the identity key information of each layer client is obtained by layered encryption, and the data is saved by blockchain. In addition, when sharing information, the target contract event including the target ciphertext is obtained based on the identity key information of the second target layer client as an information receiver. In this way, on the basis of ensuring data security and credibility, the management burden of the system is reduced, and the information sharing efficiency is improved.

[0090] Further, the present application also discloses an electronic device, Figure 6 The electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application.

[0091] Figure 6 A structure diagram of an electronic device 20 provided by the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to realize the related steps in the information sharing method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in the present embodiment can be an electronic computer.

[0092] In this embodiment, the power supply 23 is configured to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 is configured to create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which will not be specifically limited herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which will not be specifically limited herein.

[0093] In addition, the memory 22 as a carrier for storing resources can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0094] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the information sharing method executed by the electronic device 20 disclosed in any of the preceding embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0095] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the information sharing method disclosed above. For the specific steps of the method, please refer to the corresponding content disclosed in the preceding embodiments, which will not be described here.

[0096] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the same or similar parts between the embodiments, please refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and please refer to the method part for the relevant part.

[0097] The skilled person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0098] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM, flash memory, ROM, electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. The

[0099] Finally, it should be noted that the terms "first" and "second", and the like, are used herein only to distinguish one entity or action from another, and do not necessarily require or imply any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0100] The above provides a detailed description of the technical solutions of the present application. The principles and implementation modes of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range can be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. An information sharing system, characterized in that, include: The initialization module is used to distribute private keys and public parameters to each layer of clients in the current user group after generating the signature private key, verification public key, and public parameter information corresponding to the current user group through the key generation center. Based on the public parameter information, the module initializes the identity key information of the first layer of clients in the current user group to obtain the corresponding identity key information and records the information based on the preset blockchain. The key distribution module is used to configure the identity key information of each layer of clients in the current user group (excluding the first layer client) by taking each layer of clients in the current user group as key generators in turn, and configuring the identity key information of the corresponding next layer client, so as to obtain the identity key information of each layer of clients in the current user group (excluding the first layer client), and record the information based on the preset blockchain. The information encryption and sharing module is used to encrypt plaintext data based on the public parameter information of the first target layer client that triggers the information sharing operation as the information sender in the current user group, and obtain the target ciphertext by using the identity key information of the second target layer client that is the corresponding information receiver, and to call the preset blockchain for information verification, so as to obtain the corresponding target contract event including the target ciphertext after the verification is successful. The information decryption module is used to decrypt the target ciphertext in the target contract event to obtain the plaintext data when the second target layer client listens to the target contract event corresponding to itself, and to sign the plaintext data based on the signing private key; The initialization module includes: The identity key information initialization unit is used to configure the current key update count, first identity information, decryption count threshold, key usage count, and violation revocation information database corresponding to the first-layer client in the current user group through the key generation center, and to obtain the first identity key corresponding to the first-layer client based on the public parameter information and the first identity information. The first information recording unit is used to record the signature verification public key, the current key update count corresponding to the first-layer client, the decryption count threshold, the key usage count, and the violation revocation information database into the corresponding smart contract in the preset blockchain; The information encryption and sharing module includes: The user identity ID configuration unit is used to configure the target user identity ID with data viewing permission corresponding to the plaintext data to be shared, through the first target layer client that triggers the information sharing operation as the information sender in the current user group. A data encryption unit is used to encrypt the plaintext data based on the public parameter information and the target user identity ID to obtain the target ciphertext; A blockchain invocation unit is used to invoke the preset blockchain using the target ciphertext and the identity key information of the second target layer client, which is the corresponding information receiver. The blockchain verification unit is used to determine whether the updated key usage count is not less than a target threshold after updating the key usage count corresponding to the first target layer client in the preset blockchain, and to obtain a corresponding judgment result; the target threshold is the threshold obtained by adding one to the decryption count threshold corresponding to the first target layer client in the preset blockchain. An event generation unit is used to encrypt the identity key information based on the judgment result when the judgment result is less than the target ciphertext, thereby obtaining the corresponding target contract event including the target ciphertext. The call failure unit is used to determine that the identity key in the identity key information of the first target layer client has expired when the judgment result is equal to the value of the first target layer client, and to return the corresponding call failure response.

2. The information sharing system according to claim 1, characterized in that, The key distribution module includes: The first key information configuration unit is used to configure the current key update count, second identity information, decryption count threshold, key usage count, and violation revocation information database corresponding to the second-layer client in the current user group through the first-layer client, and to obtain the second identity key corresponding to the second-layer client based on the public parameter information, the second identity information, and the first identity key in its own identity key information; The second information recording unit is used to record the current key update count, the decryption count threshold, the key usage count, and the violation revocation information database corresponding to the second-layer client into the corresponding smart contract in the preset blockchain.

3. The information sharing system according to claim 1, characterized in that, The information decryption module includes: An event listening unit is used to transmit the target contract event to the confidentiality tool of the second target layer client after the second target layer client listens to an event that calls the preset blockchain through its own identity key information; The data decryption unit is used to decrypt the target ciphertext in the target contract event using the security tool and based on the public parameter information to obtain the corresponding plaintext data; The data signature unit is used to sign the plaintext data using the confidentiality tool and the signature private key and the target ciphertext to obtain the corresponding signature information, and to display the signature information to the first target layer client.

4. The information sharing system according to claim 1, characterized in that, Also includes: The key expiration update module is used to update the current key update count, identity key, and key usage count stored in the preset blockchain when the key generator corresponding to the first target layer client detects that the identity key in the identity key information of the first target layer client has expired based on the preset blockchain. This is so that when the first target layer client detects an update event corresponding to itself, it can update its local identity key.

5. The information sharing system according to claim 1, characterized in that, Also includes: The violation detection module is used to call the preset blockchain using the target ciphertext, the plaintext data, and the signature information when the plaintext data obtained after decryption is found to be illegal by the second target layer client. The violation verification module is used to verify the signature information by the second target layer client using the signature verification public key stored in the preset blockchain. After the signature information is verified, the plaintext data is compared with the violation revocation information database of the client corresponding to the target path in the preset blockchain in the order of comparison from the lower layer to the upper layer to obtain the corresponding verification result. The target path is the search path corresponding to the search operation from the lower layer to the upper layer between the second target layer client and the first layer client. The revocation module is used to generate a revocation user contract event corresponding to the first target layer client using the preset blockchain when it is determined that a violation has occurred based on the verification result. This allows the first target layer client to delete and self-destruct its locally stored identity key when it detects the revocation user contract event corresponding to itself.

6. An information sharing method, characterized in that, include: After generating the signature private key, verification public key, and public parameter information corresponding to the current user group through the key generation center, the private key and public parameter are distributed to each layer of clients in the current user group. Based on the public parameter information, the identity key information of the first layer of clients in the current user group is initialized to obtain the corresponding identity key information, and the information is recorded based on the preset blockchain. By sequentially using each layer of clients in the current user group as key generators, and configuring identity key information for the corresponding next layer of clients, the identity key information of each layer of clients in the current user group other than the first layer client is obtained, and the information is recorded based on the preset blockchain. The first target layer client, which is the information sender in the current user group and triggers the information sharing operation, encrypts the plaintext data based on the public parameter information to obtain the target ciphertext. Then, using the identity key information of the second target layer client, which is the corresponding information receiver, the preset blockchain is called to verify the information. After the verification is successful, the corresponding target contract event including the target ciphertext is obtained. When the second target layer client listens to the target contract event corresponding to itself, it decrypts the target ciphertext in the target contract event to obtain the plaintext data, and signs the plaintext data based on the signing private key; The process of distributing private keys and public parameters to clients at each level of the current user group, initializing identity key information for the first-level clients in the current user group based on the public parameter information to obtain corresponding identity key information, and recording the information based on a preset blockchain includes: The key generation center configures the current key update count, first identity information, decryption count threshold, key usage count, and violation revocation information database corresponding to the first-level client in the current user group. Based on the public parameter information and the first identity information, the first identity key corresponding to the first-level client is obtained. The signature verification public key, the current key update count corresponding to the first-layer client, the decryption count threshold, the key usage count, and the violation revocation information database are recorded in the corresponding smart contract within the preset blockchain; The first target layer client, which triggers the information sharing operation as the information sender in the current user group, encrypts the plaintext data based on the public parameter information to obtain the target ciphertext, and uses the identity key information of the second target layer client, which is the corresponding information receiver, to call the preset blockchain for information verification, including: Configure the target user identity ID with data viewing permission corresponding to the plaintext data to be shared by the first target layer client that triggers the information sharing operation as the information sender in the current user group; The plaintext data is encrypted based on the public parameter information and the target user's identity ID to obtain the target ciphertext. The preset blockchain is invoked using the target ciphertext and the identity key information of the second target layer client, which is the corresponding information receiver. After updating the key usage count corresponding to the first target layer client in the preset blockchain, it is determined whether the updated key usage count is not less than a target threshold, and a corresponding judgment result is obtained; the target threshold is the threshold obtained by adding one to the decryption count threshold corresponding to the first target layer client in the preset blockchain; When the judgment result is less than, encryption is performed based on the identity key information to obtain the corresponding target contract event including the target ciphertext; When the judgment result is equal, it is determined that the identity key in the identity key information of the first target layer client has expired, and the corresponding call failure response is returned.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the information sharing method as described in claim 6.

8. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the information sharing method as described in claim 6.

Images