Data sharing method, device and equipment

Abstract

The invention provides a data sharing method, device and equipment. The method comprises the steps that a block chain node receives a data query request sent by first equipment, wherein the data query request comprises attribute information of the first equipment; the block chain node executes a first operation, wherein the first operation comprises at least one of the following items: determining a ciphertext corresponding to the data query request; the ciphertext is sent to the first device; and sending the data query request to a second device. In the application, due to the distributed characteristics and non-tampering characteristics of the block chain, the block chain node is taken as a trusted authorization center, so that the single-point fault problem caused by a third-party server can be avoided, and the security, authenticity, transparency and fairness of transaction information between devices can be ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data sharing method, device and equipment. Background Art

[0002] The full coverage of 6G will build an integrated network of air, land, and sea to achieve global interconnection. Through effective co-construction and sharing, different network resource providers can cooperate with each other, complement each other's strengths and weaknesses, and support seamless service access and provide enhanced services in an efficient and low-cost manner. In the network co-construction and sharing scenario, different network resource providers need to share data information with each other. However, in the co-construction and sharing scenario, not all information of the participants is open to other participants. Participants need to authenticate other participants and also need to perform fine-grained access control on the content of their requests.

[0003] In existing sharing scenarios, the authentication and access control of each participant are mostly offline manual negotiations, which are not automated and cannot achieve secure and controllable information data sharing. Summary of the invention

[0004] The purpose of this application is to provide a data sharing method, device and equipment to solve the problem that existing data sharing solutions cannot achieve secure and controllable information data sharing.

[0005] An embodiment of the present application provides a data sharing method, including:

[0006] The blockchain node receives a data query request sent by a first device, where the data query request includes attribute information of the first device;

[0007] The blockchain node performs a first operation, where the first operation includes at least one of the following:

[0008] Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device;

[0009] The data query request is sent to the second device.

[0010] Optionally, the method further includes:

[0011] generating a private key of the first device according to the data query request;

[0012] The private key is sent to the first device.

[0013] Optionally, the method further includes:

[0014] Generate system public key and system master key;

[0015] The system public key and the system master key are broadcasted.

[0016] Optionally, the method further includes:

[0017] Receive the ciphertext sent by the second device.

[0018] Optionally, the ciphertext carries an attribute-based access control structure;

[0019] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0020] The embodiment of the present application provides a data sharing method, including:

[0021] The first device sends a data query request to the blockchain node, where the data query request includes attribute information of the first device;

[0022] The first device receives the ciphertext corresponding to the data query request.

[0023] Optionally, the receiving the ciphertext corresponding to the data query request includes at least one of the following:

[0024] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0025] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0026] The ciphertext includes data and an attribute-based access control structure.

[0027] Optionally, the ciphertext carries an attribute-based access control structure;

[0028] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0029] Optionally, the method further comprises at least one of the following:

[0030] Obtain the system public key and system master key generated by the blockchain node;

[0031] Receive a private key corresponding to the first device sent by the blockchain node.

[0032] Optionally, the method further includes

[0033] The ciphertext is decrypted according to the private key and the system public key.

[0034] An embodiment of the present application provides a data sharing method, including:

[0035] The second device generates a ciphertext based on the first information;

[0036] The second device sends the ciphertext to the blockchain node and / or the first device.

[0037] Optionally, the first information includes at least one of the following:

[0038] System public key;

[0039] Attribute-based access control structure.

[0040] Optionally, the ciphertext carries an attribute-based access control structure;

[0041] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0042] Optionally, the method further includes:

[0043] Receive data query requests sent by blockchain nodes;

[0044] The data query request includes attribute information of the first device.

[0045] Optionally, the method further includes:

[0046] Obtain the system public key and system master key generated by the blockchain node.

[0047] An embodiment of the present application provides a network device, including: a memory, a transceiver, and a processor:

[0048] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0049] receiving a data query request sent by a first device, wherein the data query request includes attribute information of the first device;

[0050] Perform a first operation, where the first operation includes at least one of the following:

[0051] Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device;

[0052] The data query request is sent to the second device.

[0053] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0054] generating a private key of the first device according to the data query request;

[0055] The private key is sent to the first device.

[0056] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0057] Generate system public key and system master key;

[0058] The system public key and the system master key are broadcasted.

[0059] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0060] Receive the ciphertext sent by the second device.

[0061] Optionally, the ciphertext carries an attribute-based access control structure;

[0062] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0063] An embodiment of the present application provides a communication device, including: a memory, a transceiver, and a processor:

[0064] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0065] Sending a data query request to a blockchain node, wherein the data query request includes attribute information of the first device;

[0066] Receive the ciphertext corresponding to the data query request.

[0067] Optionally, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0068] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0069] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0070] The ciphertext includes data and an attribute-based access control structure.

[0071] Optionally, the ciphertext carries an attribute-based access control structure;

[0072] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0073] Optionally, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0074] Obtain the system public key and system master key generated by the blockchain node;

[0075] Receive a private key corresponding to the first device sent by the blockchain node.

[0076] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0077] The ciphertext is decrypted according to the private key and the system public key.

[0078] An embodiment of the present application provides a communication device, including: a memory, a transceiver, and a processor:

[0079] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0080] generating a ciphertext according to the first information;

[0081] The ciphertext is sent to the blockchain node and / or the first device.

[0082] Optionally, the first information includes at least one of the following:

[0083] System public key;

[0084] Attribute-based access control structure.

[0085] Optionally, the ciphertext carries an attribute-based access control structure;

[0086] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0087] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0088] Receive data query requests sent by blockchain nodes;

[0089] The data query request includes attribute information of the first device.

[0090] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0091] Obtain the system public key and system master key generated by the blockchain node.

[0092] An embodiment of the present application provides a data sharing device, including:

[0093] A first receiving unit, configured to receive a data query request sent by a first device, wherein the data query request includes attribute information of the first device;

[0094] The first processing unit is configured to perform a first operation, where the first operation includes at least one of the following:

[0095] Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device;

[0096] The data query request is sent to the second device.

[0097] An embodiment of the present application provides a data sharing device, including:

[0098] A first sending unit, configured to send a data query request to a blockchain node, wherein the data query request includes attribute information of the first device;

[0099] The second receiving unit is used to receive the ciphertext corresponding to the data query request.

[0100] An embodiment of the present application provides a data sharing device, including:

[0101] A first generating unit, used to generate a ciphertext according to the first information;

[0102] The second sending unit is used to send the ciphertext to the blockchain node and / or the first device.

[0103] An embodiment of the present application provides a processor-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data sharing method are implemented.

[0104] The beneficial effects of the above technical solution of the present application are:

[0105] In an embodiment of the present application, a blockchain node receives a data query request sent by a first device, determines a corresponding ciphertext based on the data query request and sends it to the first device; and / or, after receiving a data query request sent by a first device, the blockchain node forwards the data query request to a second device, and the second device provides the corresponding ciphertext to the first device. Due to the distributed nature and tamper-proof characteristics of blockchain, using blockchain nodes as trusted authorization centers can avoid single point failure problems caused by third-party servers and ensure the security, authenticity, transparency and fairness of transaction information between devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0106] Figure 1A schematic diagram showing a flow chart of a data sharing method according to an embodiment of the present application;

[0107] Figure 2 One of the schematic diagrams showing the architecture of the blockchain nodes and devices of an embodiment of the present application;

[0108] Figure 3 A second flowchart diagram showing the data sharing method according to an embodiment of the present application;

[0109] Figure 4 A second schematic diagram showing the architecture of blockchain nodes and devices according to an embodiment of the present application;

[0110] Figure 5 A third flowchart of the data sharing method according to an embodiment of the present application is shown;

[0111] Figure 6 A fourth flowchart of the data sharing method according to an embodiment of the present application is shown;

[0112] Figure 7 A fifth flowchart of the data sharing method according to an embodiment of the present application is shown;

[0113] Figure 8 One of the structural schematic diagrams showing the data sharing device according to the embodiment of the present application;

[0114] Fig. 9 A second structural diagram showing a data sharing device according to an embodiment of the present application;

[0115] Fig.10 A third structural diagram showing a data sharing device according to an embodiment of the present application;

[0116] Fig.11 A schematic diagram showing the structure of a network device according to an embodiment of the present application;

[0117] Fig.12 One of the structural schematic diagrams of the communication device according to the embodiment of the present application is shown;

[0118] Fig.13 The second structural diagram of the communication device according to the embodiment of the present application. DETAILED DESCRIPTION

[0119] In order to make the technical problems, technical solutions and advantages to be solved by the application clearer, the following will be described in detail in conjunction with the accompanying drawings and specific embodiments. In the following description, specific details such as specific configurations and components are provided only to help fully understand the embodiments of the application. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the application. In addition, for clarity and brevity, the description of known functions and structures has been omitted.

[0120] It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0121] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0122] In the embodiments of the present application, the term "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0123] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0124] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0125] The embodiments of the present application provide a data sharing method, apparatus and device to solve the problem that existing data sharing solutions cannot achieve secure and controllable information data sharing.

[0126] Among them, the method and the device are based on the same application concept. Since the method and the device solve the problem in a similar principle, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0127] like Figure 1 As shown, an embodiment of the present application provides a data sharing method, which is applied to a blockchain node and specifically includes the following steps:

[0128] Step 101: A blockchain node receives a data query request sent by a first device, where the data query request includes attribute information of the first device.

[0129] Step 102: The blockchain node performs a first operation, where the first operation includes at least one of the following:

[0130] Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device;

[0131] The data query request is sent to the second device.

[0132] In this embodiment, the first device may be a data requester, that is, used to request access to data. The second device may be a data owner, that is, used to contribute data. It should be noted that the data requester and the data owner may exchange roles in other data request processes.

[0133] The blockchain node is a node in the blockchain network. In the embodiment of the present application, as a trusted authorization center, the blockchain node can be used to forward data query requests or ciphertext. The blockchain node can store the ciphertext reported by the second device. The first device sends the data query request to the blockchain node, and the blockchain node searches for the corresponding ciphertext according to the data query request and sends it to the first device; and / or, after receiving the data query request sent by the first device, the blockchain node forwards the data query request to the second device, and the second device sends the corresponding ciphertext to the first device.

[0134] In this embodiment, the data query request sent by the first device includes attribute information of the first device, and the attribute refers to the identity attribute of the device, such as: teacher, student, ordinary employee. The attribute information can be an attribute set (also referred to as an identity information set). The first device reports its own attribute information when requesting data, and the blockchain node and / or the second device can authenticate based on the attributes of the first device to implement access control to the data. In an embodiment of the present application, access control of data can be implemented based on the attribute information of the device.

[0135] In an embodiment of the present application, a blockchain node receives a data query request sent by a first device, determines a corresponding ciphertext based on the data query request and sends it to the first device; and / or, after receiving a data query request sent by a first device, the blockchain node forwards the data query request to a second device, and the second device provides the corresponding ciphertext to the first device. Due to the distributed nature and tamper-proof characteristics of blockchain, using blockchain nodes as trusted authorization centers can avoid single point failure problems caused by third-party servers and ensure the security, authenticity, transparency and fairness of transaction information between devices.

[0136] As an optional embodiment, the method further includes:

[0137] Generate a private key of the first device according to the data query request; and send the private key to the first device.

[0138] In this embodiment, after receiving the data query request, the blockchain node can generate a user private key according to the device attribute information in the data query request, and send the private key to the first device. The blockchain node can be a smart contract of the blockchain. The first device initiates a data query request to the blockchain network, and the blockchain node generates a corresponding private key (U-SK) for the user according to the attribute set (S), system public key (S-PK) and system master key (S-MK) submitted by the data requester (i.e., the first device).

[0139] As an optional embodiment, the method further includes: generating a system public key and a system master key; and broadcasting the system public key and the system master key.

[0140] In this embodiment, during the initialization phase, the blockchain node can generate a system public key (S-PK) and a system master key (S-MK) based on implicit security parameters, and broadcast them to each device. The device can generate a ciphertext based on the system public key. The security parameters can be preconfigured or predefined, and can be random parameters.

[0141] As an optional embodiment, the method further includes: receiving a ciphertext sent by the second device.

[0142] Optionally, the ciphertext carries an attribute-based access control structure; wherein the ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0143] In this embodiment, the second device is the data owner, and the second device can generate attribute-encrypted ciphertext based on the system public key, the message content to be encrypted, and the access control structure. The ciphertext implicitly includes an access control structure, which allows the ciphertext to be decrypted only by users who have attributes that meet the access control structure. For example: the ciphertext reported by the second device is encrypted based on the access control structure of the "teacher" attribute, then users with the attribute "teacher" can decrypt the ciphertext, while users with the attribute "student" cannot decrypt the ciphertext.

[0144] When the first device decrypts the ciphertext, it needs to decrypt the ciphertext based on the system public key and the device's own private key. If the attribute information in the key meets the access control structure of the ciphertext, the corresponding plaintext message can be obtained using the decryption algorithm.

[0145] The implementation process of the data sharing method is described below through specific embodiments.

[0146] Optionally, it is assumed that the ciphertext of the data owner in this embodiment is uploaded to the blockchain network. Figure 2 and Figure 3 As shown, the method includes:

[0147] Step 31: Initialization: Generate the system public key (S-PK) and system master key (S-MK) according to the implicit security parameter (λ), broadcast them, and send them to each device.

[0148] This step is executed by the smart contract of the blockchain, and the implicit security parameters can be specified by the system. The system parameters generated in this step provide parameter support for the subsequent steps.

[0149] Step 32: The data requester (first device) sends a data query request to the blockchain network, which carries an attribute set S.

[0150] Step 33: Key generation: Generate a corresponding private key for the user based on the attribute set submitted by the data requester (first device), the system public key (S-PK) and the system master key (S-MK).

[0151] This step is performed by the smart contract of the blockchain, which is used to generate a user private key (U-SK) and send the private key to the data requester (first device). Specifically, the data requester (first device) initiates a data query request to the blockchain network, and the data query request carries the attribute set (identity information set) of the data requester (first device). According to the attribute set (identity information set), system public key and system master key submitted by the data requester, a corresponding private key is generated for the user.

[0152] Step 34: Data encryption: The data owner (second device) generates a ciphertext CT based on attribute encryption according to the system public key (S-PK), the message m to be encrypted and the access control structure A, and uploads it to the blockchain network.

[0153] In this step, the data owner (second device) generates an attribute-encrypted ciphertext CT according to the system public key (S-PK), the message m and the access control structure A. The ciphertext can only be decrypted by users who have attributes that satisfy the access control structure A, that is, A is implicitly included in the ciphertext CT.

[0154] The data owner (second device) returns the generated ciphertext to the blockchain network, and the blockchain network returns the requested ciphertext CT to the data requester (first device).

[0155] It should be noted that the execution order between step 33 and step 34 is not limited here.

[0156] Step 35: Data decryption: The data requester (first device) uses its own private key (U-SK) and system public key (S-PK) to decrypt the ciphertext CT and obtain the plaintext message m.

[0157] This step is to decrypt the encrypted data uploaded to the blockchain network. The data requester (first device) uses its own private key (U-SK) and the system public key (S-PK) to decrypt the ciphertext. If the attribute set S in the key satisfies the access control structure A, the corresponding plaintext message m is obtained through the decryption algorithm.

[0158] In this embodiment, in some data sharing scenarios, there is a situation where third-party servers are not trusted to store data. In this embodiment, the data is encrypted at the data owner and uploaded to the blockchain network for storage, which enables the data requester to directly download the data he needs from the blockchain network for decryption, avoiding the frequent encryption and transmission of data by the data owner when multiple data requesters request data in turn. As a trusted authorization center, the blockchain network uploads and downloads ciphertext through the blockchain network due to the distributed characteristics and tamper-proof characteristics of the blockchain, and performs access control on data requests based on attributes, which can ensure the authenticity, transparency and fairness of transaction information, thereby ensuring the security of data.

[0159] Optionally, it is assumed that the ciphertext of the data owner in this embodiment does not need to be uploaded to the blockchain network. Figure 4 and Figure 5 As shown, the method includes:

[0160] Step 51: Initialization: Generate a system public key (S-PK) and a system master key (S-MK) according to an implicit security parameter (λ), broadcast them, and send them to each device.

[0161] This step is executed by the smart contract of the blockchain, and the implicit security parameters can be specified by the system. The system parameters generated in this step provide parameter support for the subsequent steps.

[0162] Step 52: The data requester (first device) sends a data query request to the blockchain network, which carries an attribute set S.

[0163] Step 53: Key generation: Generate a corresponding private key for the user based on the attribute set submitted by the data requester (first device), the system public key (S-PK) and the system master key (S-MK).

[0164] This step is performed by the smart contract of the blockchain, which is used to generate a user private key (U-SK) and send the private key to the data requester (first device). Specifically, the data requester (first device) initiates a data query request to the blockchain network, and the data query request carries the attribute set (identity information set) of the data requester (first device). According to the attribute set (identity information set), system public key and system master key submitted by the data requester, a corresponding private key is generated for the user.

[0165] Step 54: The blockchain network forwards the data query request to the data owner (second device).

[0166] Step 55: Data encryption: The data owner (second device) generates a ciphertext CT based on attribute encryption according to the system public key (S-PK), the message m to be encrypted and the access control structure A.

[0167] In this step, the data owner (second device) generates a ciphertext CT based on attribute encryption according to the system public key (S-PK), the message m and the access control structure A. The ciphertext can only be decrypted by users who have attributes that satisfy the access control structure A, that is, A is implicitly included in the ciphertext CT. Only when the attribute set owned by the user satisfies the access control structure A can the ciphertext CT be correctly decrypted.

[0168] The data owner (second device) sends the generated ciphertext directly to the data requester (first device).

[0169] Step 56: Data decryption: The data requester (first device) uses its own private key (U-SK) and system public key (S-PK) to decrypt the ciphertext CT and obtain the plaintext message m.

[0170] This step is to decrypt the encrypted data sent by the data owner (second device). The data requester (first device) uses its own private key (U-SK) and the system public key (S-PK) to decrypt the ciphertext. If the attribute set S in the key satisfies the access control structure A, the corresponding plaintext message m is obtained through the decryption algorithm.

[0171] In this embodiment, in some scenarios, there is a situation where the amount of data is too large. If the storage capacity of the blockchain network is limited and the data reuse rate is not high, point-to-point data transmission can be used, that is, the ciphertext is not transmitted to the blockchain network, and the blockchain network only forwards the data query request. As a trusted authorization center, the blockchain network can ensure the authenticity, transparency and fairness of transaction information by forwarding data query requests through the blockchain network due to the distributed characteristics and tamper-proof characteristics of the blockchain. Access control of data requests based on attributes can ensure the security of data transmission.

[0172] The embodiment of the present application makes transaction information traceable, open and transparent by introducing the blockchain network; at the same time, the blockchain network serves as a trusted authorization center for data information sharing among all participants in the co-construction and sharing process, and uses its smart contract to initialize the system, generate user private keys, system public keys, master keys and other parameters, and avoid single point failure problems caused by third-party servers. In the co-construction and sharing scenario, based on the blockchain as a trusted authorization center, a ciphertext-policy attribute encrypted access control mechanism is adopted, so that network resource providers can perform data access control and data requester authentication through data request policies, thereby improving the efficiency of data sharing.

[0173] like Figure 6 As shown, the embodiment of the present application also provides a data sharing method, which is applied to a first device, including:

[0174] Step 601: The first device sends a data query request to a blockchain node, where the data query request includes attribute information of the first device;

[0175] Step 602: The first device receives the ciphertext corresponding to the data query request.

[0176] In this embodiment, the first device may be a data requester, that is, used to request access to data. The blockchain node is a node in the blockchain network, and in this embodiment of the application, as a trusted authorization center, the blockchain node may be used to forward data query requests or to forward ciphertext.

[0177] The first device sends a data query request to the blockchain node, and the data query request includes the attribute information of the first device, and the attribute refers to the identity attribute of the device. The blockchain node can store the ciphertext reported by the second device. After receiving the data query request, the blockchain node searches for the corresponding ciphertext according to the data query request and sends it to the first device; and / or, after receiving the data query request sent by the first device, the blockchain node forwards the data query request to the second device, and the second device sends the corresponding ciphertext to the first device.

[0178] In the embodiment of the present application, the first device sends a data query request to the blockchain node, and the blockchain node and / or the second device can determine the corresponding ciphertext according to the data query request and send it to the first device. Due to the distributed characteristics and tamper-proof characteristics of the blockchain, using the blockchain node as a trusted authorization center can avoid single point failure problems caused by third-party servers and ensure the security, authenticity, transparency and fairness of transaction information between devices.

[0179] As an optional embodiment, the receiving the ciphertext corresponding to the data query request includes at least one of the following:

[0180] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0181] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0182] The ciphertext includes data and an attribute-based access control structure.

[0183] In this embodiment, the blockchain node can be used to forward data query requests or to forward ciphertext. The blockchain node can store the ciphertext reported by the second device, the first device sends the data query request to the blockchain node, and the blockchain node searches for the corresponding ciphertext according to the data query request and sends it to the first device; and / or, after receiving the data query request sent by the first device, the blockchain node forwards the data query request to the second device, and the second device sends the corresponding ciphertext to the first device.

[0184] Optionally, the ciphertext carries an attribute-based access control structure; wherein the ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0185] In this embodiment, the second device is the data owner, and the second device can generate attribute-encrypted ciphertext based on the system public key, the message content to be encrypted, and the access control structure. The ciphertext implicitly includes an access control structure, which allows the ciphertext to be decrypted only by users who have attributes that meet the access control structure. When the first device decrypts the ciphertext, it needs to decrypt the ciphertext based on the system public key and the device's own private key. If the attribute information in the key meets the access control structure of the ciphertext, the corresponding plaintext message can be obtained using the decryption algorithm.

[0186] Optionally, the method further comprises at least one of the following:

[0187] Obtain the system public key and system master key generated by the blockchain node;

[0188] Receive a private key corresponding to the first device sent by the blockchain node.

[0189] In this embodiment, during the initialization phase, the blockchain node can generate a system public key (S-PK) and a system master key (S-MK) based on implicit security parameters, and broadcast them to each device. The device can generate a ciphertext based on the system public key. The security parameters can be preconfigured or predefined, and can be random parameters.

[0190] After receiving the data query request from the first device, the blockchain node can generate a user private key according to the device attribute information in the data query request, and send the private key to the first device.

[0191] Optionally, the method further includes: decrypting the ciphertext according to the private key and the system public key.

[0192] After receiving the ciphertext, the first device uses its own private key and the system public key to decrypt the ciphertext. If the attribute set in the key satisfies the access control structure of the ciphertext, the corresponding plaintext message can be obtained through the decryption algorithm.

[0193] In the embodiment of the present application, the first device sends a data query request to the blockchain node, and the blockchain node and / or the second device can determine the corresponding ciphertext according to the data query request and send it to the first device. Due to the distributed characteristics and tamper-proof characteristics of the blockchain, using the blockchain node as a trusted authorization center can avoid single point failure problems caused by third-party servers and ensure the security, authenticity, transparency and fairness of transaction information between devices.

[0194] like Figure 7 As shown, the embodiment of the present application also provides a data sharing method, which is applied to a second device, including:

[0195] Step 701: The second device generates a ciphertext according to the first information;

[0196] Step 702: The second device sends the ciphertext to the blockchain node and / or the first device.

[0197] In this embodiment, the first device may be a data requester, that is, used to request access to data. The second device may be a data owner, that is, used to contribute data. It should be noted that the data requester and the data owner may exchange roles in other data request processes.

[0198] The blockchain node is a node in the blockchain network. In the embodiment of the present application, as a trusted authorization center, the blockchain node can be used to forward data query requests or ciphertext. The second device can generate ciphertext based on the first information and upload the ciphertext to the blockchain node for storage; when the first device requests data from the blockchain node, the blockchain node sends the ciphertext to the first device. And / or, the first device sends a data query request to the blockchain node, the blockchain node forwards the data query request to the second device, and the second device directly sends the ciphertext to the first device after generating the ciphertext.

[0199] In the embodiment of the present application, after generating the ciphertext, the second device can upload the ciphertext to the blockchain node, which will store it and send it to the first device; the second device can also directly send the ciphertext to the first device. Due to the distributed and tamper-proof characteristics of the blockchain, using the blockchain node as a trusted authorization center can avoid single point failure problems caused by third-party servers and ensure the security, authenticity, transparency and fairness of transaction information between devices.

[0200] Optionally, the first information includes at least one of the following:

[0201] System public key;

[0202] Attribute-based access control structure.

[0203] In this embodiment, the second device generates a ciphertext CT based on attribute encryption according to the system public key (S-PK), the message m and the access control structure A. The ciphertext can only be decrypted by users who have attributes that satisfy the access control structure A, that is, A is implicitly included in the ciphertext CT.

[0204] Optionally, the ciphertext carries an attribute-based access control structure; wherein the ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0205] In this embodiment, the second device is the data owner, and the second device can generate attribute-encrypted ciphertext based on the system public key, the message content to be encrypted, and the access control structure. The ciphertext implicitly includes an access control structure, which allows the ciphertext to be decrypted only by users who have attributes that meet the access control structure. For example: the ciphertext reported by the second device is encrypted based on the access control structure of the "teacher" attribute, then users with the attribute "teacher" can decrypt the ciphertext, while users with the attribute "student" cannot decrypt the ciphertext.

[0206] Optionally, the method also includes: receiving a data query request sent by a blockchain node; the data query request includes attribute information of the first device.

[0207] In this embodiment, the first device sends a data query request to the blockchain node. After receiving the data query request sent by the first device, the blockchain node forwards the data query request to the second device, and the second device sends the corresponding ciphertext to the first device. The data query request includes attribute information of the first device, and the attribute refers to the identity attribute of the device. The attribute information can be an attribute set (also called an identity information set). The first device reports its own attribute information when requesting data. The blockchain node and / or the second device can perform authentication based on the attributes of the first device to achieve access control to the data. In an embodiment of the present application, access control of data can be achieved based on the attribute information of the device.

[0208] Optionally, the method also includes: obtaining a system public key and a system master key generated by the blockchain node.

[0209] In this embodiment, during the initialization phase, the blockchain node can generate a system public key (S-PK) and a system master key (S-MK) based on implicit security parameters, and broadcast them to each device. The device can generate a ciphertext based on the system public key. The security parameters can be preconfigured or predefined, and can be random parameters.

[0210] In the embodiment of the present application, after generating the ciphertext, the second device can upload the ciphertext to the blockchain node, which will store it and send it to the first device; the second device can also directly send the ciphertext to the first device. Due to the distributed and tamper-proof characteristics of the blockchain, using the blockchain node as a trusted authorization center can avoid single point failure problems caused by third-party servers and ensure the security, authenticity, transparency and fairness of transaction information between devices.

[0211] The above embodiments introduce the data sharing method of the present application. The following embodiments will further illustrate the corresponding device in conjunction with the accompanying drawings.

[0212] Specifically, Figure 8 As shown, the embodiment of the present application provides a data sharing device 800, which is applied to a blockchain node, including:

[0213] A first receiving unit 810 is configured to receive a data query request sent by a first device, where the data query request includes attribute information of the first device;

[0214] The first processing unit 820 is configured to perform a first operation, where the first operation includes at least one of the following:

[0215] Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device;

[0216] The data query request is sent to the second device.

[0217] Optionally, the device further comprises:

[0218] A second generating unit, configured to generate a private key of the first device according to the data query request;

[0219] The third sending unit is used to send the private key to the first device.

[0220] Optionally, the device further comprises:

[0221] A third generating unit, used for generating a system public key and a system master key;

[0222] The broadcast unit is used to broadcast the system public key and the system master key.

[0223] Optionally, the device further comprises:

[0224] The third receiving unit is used to receive the ciphertext sent by the second device.

[0225] Optionally, the ciphertext carries an attribute-based access control structure;

[0226] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0227] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the blockchain node, and can achieve the same technical effect. The parts and beneficial effects that are the same as those in the method embodiment in this embodiment will not be specifically repeated here.

[0228] Specifically, Fig. 9 As shown, the embodiment of the present application provides a data sharing device 900, which is applied to a first device and includes:

[0229] A first sending unit 910 is used to send a data query request to a blockchain node, where the data query request includes attribute information of the first device;

[0230] The second receiving unit 920 is used to receive the ciphertext corresponding to the data query request.

[0231] Optionally, the second receiving unit is configured to perform at least one of the following:

[0232] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0233] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0234] The ciphertext includes data and an attribute-based access control structure.

[0235] Optionally, the ciphertext carries an attribute-based access control structure;

[0236] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0237] Optionally, the device further includes: a second processing unit, configured to perform at least one of the following:

[0238] Obtain the system public key and system master key generated by the blockchain node;

[0239] Receive a private key corresponding to the first device sent by the blockchain node.

[0240] Optionally, the device further comprises:

[0241] A decryption unit is used to decrypt the ciphertext according to the private key and the system public key.

[0242] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the first device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0243] Specifically, Fig.10 As shown, the embodiment of the present application provides a data sharing device 1000, which is applied to a second device, including:

[0244] A first generating unit 1010, configured to generate a ciphertext according to the first information;

[0245] The second sending unit 1020 is used to send the ciphertext to the blockchain node and / or the first device.

[0246] Optionally, the first information includes at least one of the following:

[0247] System public key;

[0248] Attribute-based access control structure.

[0249] Optionally, the ciphertext carries an attribute-based access control structure;

[0250] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0251] Optionally, the device further comprises:

[0252] A fourth receiving unit, used to receive a data query request sent by a blockchain node;

[0253] The data query request includes attribute information of the first device.

[0254] Optionally, the device further comprises:

[0255] The acquisition unit is used to obtain the system public key and the system master key generated by the blockchain node.

[0256] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the second device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0257] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0258] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0259] like Fig.11As shown, an embodiment of the present application further provides a network device, which may be a blockchain node, including: a memory 1120, a transceiver 1100, and a processor 1110; wherein the memory 1120 is used to store a computer program; the transceiver 1100 is used to receive and send data under the control of the processor 1110; the processor 1110 is used to read the computer program in the memory and perform the following operations:

[0260] receiving a data query request sent by a first device, wherein the data query request includes attribute information of the first device;

[0261] Perform a first operation, where the first operation includes at least one of the following:

[0262] Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device;

[0263] The data query request is sent to the second device.

[0264] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0265] generating a private key of the first device according to the data query request;

[0266] The private key is sent to the first device.

[0267] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0268] Generate system public key and system master key;

[0269] The system public key and the system master key are broadcasted.

[0270] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0271] Receive the ciphertext sent by the second device.

[0272] Optionally, the ciphertext carries an attribute-based access control structure;

[0273] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0274] Among them, Fig.11In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1110 and memory represented by memory 1120. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1100 may be a plurality of components, namely including a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1110 is responsible for managing the bus architecture and general processing, and the memory 1120 may store data used by the processor 1110 when performing operations.

[0275] The processor 1110 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0276] It should be noted here that the above-mentioned network device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment applied to the blockchain node, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be specifically repeated here.

[0277] like Fig.12 As shown, an embodiment of the present application further provides a communication device, which may be a first device, including: a memory 1220, a transceiver 1200, and a processor 1210; wherein the memory 1220 is used to store a computer program; the transceiver 1200 is used to receive and send data under the control of the processor 1210; the processor 1210 is used to read the computer program in the memory and perform the following operations:

[0278] Sending a data query request to a blockchain node, wherein the data query request includes attribute information of the first device;

[0279] Receive the ciphertext corresponding to the data query request.

[0280] Optionally, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0281] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0282] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0283] The ciphertext includes data and an attribute-based access control structure.

[0284] Optionally, the ciphertext carries an attribute-based access control structure;

[0285] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0286] Optionally, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0287] Obtain the system public key and system master key generated by the blockchain node;

[0288] Receive a private key corresponding to the first device sent by the blockchain node.

[0289] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0290] The ciphertext is decrypted according to the private key and the system public key.

[0291] Among them, Fig.12 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1210 and memory represented by memory 1220. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1200 may be a plurality of components, namely including a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1210 is responsible for managing the bus architecture and general processing, and the memory 1220 may store data used by the processor 1210 when performing operations.

[0292] The processor 1210 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0293] It should be noted here that the above-mentioned communication device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the first device, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0294] like Fig.13 As shown, an embodiment of the present application further provides a communication device, which may be a second device, including: a memory 1320, a transceiver 1300, and a processor 1310; wherein the memory 1320 is used to store a computer program; the transceiver 1300 is used to receive and send data under the control of the processor 1310; the processor 1310 is used to read the computer program in the memory and perform the following operations:

[0295] generating a ciphertext according to the first information;

[0296] The ciphertext is sent to the blockchain node and / or the first device.

[0297] Optionally, the first information includes at least one of the following:

[0298] System public key;

[0299] Attribute-based access control structure.

[0300] Optionally, the ciphertext carries an attribute-based access control structure;

[0301] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0302] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0303] Receive data query requests sent by blockchain nodes;

[0304] The data query request includes attribute information of the first device.

[0305] Optionally, the processor is configured to read the computer program in the memory and perform the following operations:

[0306] Obtain the system public key and system master key generated by the blockchain node.

[0307] Among them, Fig.13In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1310 and memory represented by memory 1320. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1300 may be a plurality of components, namely including a transmitter and a transceiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1310 is responsible for managing the bus architecture and general processing, and the memory 1320 may store data used by the processor 1310 when performing operations.

[0308] The processor 1310 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0309] It should be noted here that the above-mentioned communication device provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiment applied to the second device, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0310] In addition, a specific embodiment of the present application further provides a processor-readable storage medium on which a computer program is stored, wherein the program, when executed by the processor, implements the steps of the above-mentioned data sharing method and can achieve the same technical effect. To avoid repetition, it is not repeated here. The readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0311] It should be noted that the technical solution provided in the embodiment of the present application can be applicable to a variety of systems, especially 5G systems. For example, the applicable system can be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet radio service (GPRS) system, a long term evolution (LTE) system, a LTE frequency division duplex (FDD) system, a LTE time division duplex (TDD) system, an advanced long term evolution (LTE-A) system, a universal mobile telecommunication system (UMTS), a world-wide interoperability for microwave access (WiMAX) system, a 5G new radio (NR) system, etc. These various systems include terminal equipment and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0312] The terminal device involved in the embodiment of the present application may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE). A wireless terminal device can communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or a "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges language and / or data with a wireless access network. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs) and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, and a user device, but is not limited in the embodiments of the present application.

[0313] The network device involved in the embodiment of the present application may be a base station, which may include multiple cells providing services for the terminal. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in the access network that communicates with the wireless terminal device through one or more sectors on the air interface, or other names. The network device may be used to interchange received air frames with Internet Protocol (IP) packets, and serve as a router between the wireless terminal device and the rest of the access network, wherein the rest of the access network may include an Internet Protocol (IP) communication network. The network device may also coordinate the attribute management of the air interface. For example, the network device involved in the embodiments of the present application may be a network device (Base Transceiver Station, BTS) in the Global System for Mobile communications (Global System for Mobile communications, GSM) or Code Division Multiple Access (Code Division Multiple Access, CDMA), or a network device (NodeB) in Wide-band Code Division Multiple Access (WCDMA), or an evolutionary network device (evolutional Node B, eNB or e-NodeB) in the long term evolution (long term evolution, LTE) system, a 5G base station (gNB) in the 5G network architecture (next generation system), or a home evolved Node B (Home evolved Node B, HeNB), a relay node, a home base station (femto), a pico base station (pico), etc., which is not limited in the embodiments of the present application. In some network structures, the network device may include a centralized unit (CU) node and a distributed unit (DU) node, and the centralized unit and the distributed unit may also be arranged geographically separately.

[0314] Network devices and terminal devices can each use one or more antennas for multiple-input multiple-output (MIMO) transmission. MIMO transmission can be single-user MIMO (SU-MIMO) or multi-user MIMO (MU-MIMO). Depending on the form and number of antenna combinations, MIMO transmission can be 2D-MIMO, 3D-MIMO, FD-MIMO or massive-MIMO, or it can be diversity transmission, precoded transmission or beamforming transmission, etc.

[0315] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0316] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing a process or multiple processes in the flowchart and / or a box or multiple boxes in the block diagram.

[0317] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0318] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are performed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0319] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data sharing method, characterized in that: include: The blockchain node receives a data query request sent by a first device, where the data query request includes attribute information of the first device; The blockchain node performs a first operation, where the first operation includes at least one of the following: Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device; The data query request is sent to the second device.

2. The method according to claim 1, characterized in that: The method further comprises: generating a private key of the first device according to the data query request; The private key is sent to the first device.

3. The method according to claim 1, characterized in that The method further comprises: Generate system public key and system master key; The system public key and the system master key are broadcasted.

4. The method according to claim 1, characterized in that The method further comprises: Receive the ciphertext sent by the second device.

5. The method according to claim 1 or 4, characterized in that: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

6. A data sharing method, characterized in that: include: The first device sends a data query request to the blockchain node, where the data query request includes attribute information of the first device; The first device receives the ciphertext corresponding to the data query request.

7. The method according to claim 6, characterized in that The receiving the ciphertext corresponding to the data query request includes at least one of the following: Receiving the ciphertext corresponding to the data query request sent by the blockchain node; Receiving a ciphertext corresponding to the data query request sent by the second device; The ciphertext includes data and an attribute-based access control structure.

8. The method according to claim 6 or 7, characterized in that: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

9. The method according to claim 6, characterized in that The method further comprises at least one of the following: Obtain the system public key and system master key generated by the blockchain node; Receive a private key corresponding to the first device sent by the blockchain node.

10. The method according to claim 9, characterized in that The method further comprises: The ciphertext is decrypted according to the private key and the system public key.

11. A data sharing method, characterized in that: include: The second device generates a ciphertext based on the first information; The second device sends the ciphertext to the blockchain node and / or the first device.

12. The method according to claim 11, characterized in that The first information includes at least one of the following: System public key; Attribute-based access control structure.

13. The method according to claim 11 or 12, characterized in that: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

14. The method according to claim 11, characterized in that The method further comprises: Receive data query requests sent by blockchain nodes; The data query request includes attribute information of the first device.

15. The method according to claim 11, characterized in that The method further comprises: Obtain the system public key and system master key generated by the blockchain node.

16. A network device, characterized in that: include: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: receiving a data query request sent by a first device, wherein the data query request includes attribute information of the first device; Perform a first operation, where the first operation includes at least one of the following: Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device; The data query request is sent to the second device.

17. The network device according to claim 16, characterized in that: The processor is configured to read the computer program in the memory and perform the following operations: generating a private key of the first device according to the data query request; The private key is sent to the first device.

18. The network device according to claim 16, characterized in that: The processor is configured to read the computer program in the memory and perform the following operations: Generate system public key and system master key; The system public key and the system master key are broadcasted.

19. The network device according to claim 16, characterized in that: The processor is configured to read the computer program in the memory and perform the following operations: Receive the ciphertext sent by the second device.

20. The network device according to claim 16 or 19, characterized in that: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

21. A communication device, characterized in that: include: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Sending a data query request to a blockchain node, wherein the data query request includes attribute information of the first device; Receive the ciphertext corresponding to the data query request.

22. The communication device according to claim 21, characterized in that The processor is configured to read the computer program in the memory and perform at least one of the following operations: Receiving the ciphertext corresponding to the data query request sent by the blockchain node; Receiving a ciphertext corresponding to the data query request sent by the second device; The ciphertext includes data and an attribute-based access control structure.

23. The communication device according to claim 21 or 22, characterized in that: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

24. The communication device according to claim 21, characterized in that The processor is configured to read the computer program in the memory and perform at least one of the following operations: Obtain the system public key and system master key generated by the blockchain node; Receive a private key corresponding to the first device sent by the blockchain node.

25. The communication device according to claim 24, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: The ciphertext is decrypted according to the private key and the system public key.

26. A communication device, characterized in that: include: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: generating a ciphertext according to the first information; The ciphertext is sent to the blockchain node and / or the first device.

27. The communication device according to claim 26, characterized in that The first information includes at least one of the following: System public key; Attribute-based access control structure.

28. The communication device according to claim 26 or 27, characterized in that: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

29. The communication device according to claim 26, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Receive data query requests sent by blockchain nodes; The data query request includes attribute information of the first device.

30. The communication device according to claim 26, characterized in that The processor is configured to read the computer program in the memory and perform the following operations: Obtain the system public key and system master key generated by the blockchain node.

31. A data sharing device, characterized in that: include: A first receiving unit, configured to receive a data query request sent by a first device, wherein the data query request includes attribute information of the first device; The first processing unit is configured to perform a first operation, where the first operation includes at least one of the following: Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device; The data query request is sent to the second device.

32. A data sharing device, characterized in that: include: A first sending unit, configured to send a data query request to a blockchain node, wherein the data query request includes attribute information of the first device; The second receiving unit is used to receive the ciphertext corresponding to the data query request.

33. A data sharing device, characterized in that: include: A first generating unit, used to generate a ciphertext according to the first information; The second sending unit is used to send the ciphertext to the blockchain node and / or the first device.

34. A processor-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the data sharing method as described in any one of claims 1 to 5, or implements the steps of the data sharing method as described in any one of claims 6 to 10, or implements the steps of the data sharing method as described in any one of claims 11 to 15.

Images