Block chain BIM data sharing system and method based on SGX and CP-ABE

Abstract

The invention discloses a block chain BIM data sharing system and method based on SGX and CP-ABE, and belongs to the technical field of block chains. The system comprises an SGX trusted encryption system, an IPFS storage system and a block chain system. When user registration is carried out, the block chain system receives externally input user attribute information and stores the user attribute information; when a BIM data uploading request is received, the encryption system receives and encrypts data to be uploaded, uploads the encrypted data to the storage system for storage, accepts a CID returned by the storage system, and inputs the CID to the block chain system; and when a BIM data downloading request is received, the encryption system obtains the CID of to-be-downloaded data based on the block chain system, and then obtains the to-be-downloaded data from the storage system based on the CID and outputs the to-be-downloaded data. According to the sharing system, BIM data fine-grained sharing service can be provided for engineering departments, and it can be guaranteed that BIM data and secret keys are not leaked or tampered in the sharing process.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain, and specifically relates to a blockchain BIM data sharing system and method based on SGX (Software Guard Extensions) and CP-ABE (Ciphertext Policy Attribute Based Encryption). Background Art

[0002] With the continuous advancement of information construction in the engineering field, engineering digitization has developed rapidly. Building Information Modeling (BIM) has become the core technology for designing, constructing and managing complex engineering projects. At present, BIM technology has been widely used. By providing detailed building information models, it not only improves the efficiency and quality of engineering projects, but also promotes collaborative work among stakeholders.

[0003] However, with the continuous expansion of BIM applications, the problem of trusted data sharing has become increasingly prominent, especially in ensuring trusted data management and secure sharing. For example, the traditional centralized BIM data sharing platform stores BIM data in a centralized server and provides users with coarse-grained data sharing services through role division. It can only handle the growing amount of BIM data by continuously adding new system roles, resulting in system role redundancy. At the same time, traditional methods usually perform BIM data encryption and decryption operations locally on the central server, which cannot protect the data and keys of the sharing process from being tampered with, resulting in low efficiency of multi-department collaboration and the inability to hold people accountable when problems arise.

[0004] Blockchain technology has the characteristics of immutability, decentralization and security. It is essentially a decentralized distributed ledger.

[0005] SGX (Software Guard Extensions) is a set of CPU instructions proposed by Intel in 2013. The instructions can support applications to create enclaves, which are protected areas in the application address space that ensure the confidentiality and integrity of information content on the terminal operating system environment. Data in the enclave can only be accessed by code in the enclave, and attempts to access the memory content of the enclave from a software perspective are not allowed, thus providing hardware-level protection capabilities.

[0006] CP-ABE (Ciphertext Policy Attribute Based Encryption) is a public key cryptographic system that controls the access rights of users to specific resources based on their attributes. Data can be decrypted only when the user's attributes meet the access policy in the ciphertext. This encryption method can provide users with fine-grained access control, thereby protecting sensitive data from unauthorized users.

[0007] Based on blockchain technology, SGX technology and CP-ABE encryption solution, a new BIM data sharing system can be built to solve the problems of insufficient permission granularity and easy leakage of keys and data in the BIM data sharing process, and effectively improve the collaboration efficiency between engineering departments. Summary of the invention

[0008] In view of the shortcomings of the prior art, the present invention provides a blockchain BIM data sharing system and method based on SGX and CP-ABE. By introducing the hardware security mechanism of IntelSGX and combining the CP-ABE encryption scheme, based on the characteristics of blockchain technology that cannot be tampered with, decentralization and automatic execution of smart contracts, a fine-grained, process-safe and reliable BIM data sharing system is constructed.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0010] In the first aspect, the present invention discloses a blockchain BIM data sharing system based on SGX and CP-ABE, including an SGX trusted encryption system, an IPFS storage system, and a blockchain system;

[0011] The SGX trusted encryption system includes an enclave memory protection area, which receives BIM data upload or download requests;

[0012] When receiving a BIM data upload request, the SGX trusted encryption system will receive and encrypt the BIM data to be uploaded, and then upload the encrypted BIM data to the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system, and the SGX trusted encryption system will input the CID into the blockchain system.

[0013] When receiving a BIM data download request, the SGX trusted encryption system obtains the CID of the BIM data to be downloaded from the blockchain system based on the download request, and then obtains the BIM data to be downloaded from the IPFS storage system based on the CID and outputs it;

[0014] The blockchain system includes a blockchain network layer, a smart contract layer and a blockchain ledger layer. The blockchain network layer is used to deploy multiple peer nodes and multiple sorting nodes of the blockchain, and the smart contract layer is deployed on the peer nodes; the peer nodes are used to carry and run smart contracts and verify whether the results of executing smart contracts between peer nodes are consistent, and the sorting nodes are used to ensure that all nodes have the correct transaction order; the smart contract layer is used to interact with the blockchain network layer for data; the blockchain ledger layer is used to store information input by the SGX trusted encryption system;

[0015] The IPFS storage system is used to store BIM data and generate a unique identification file CID.

[0016] In a second aspect, the present invention discloses a sharing method implemented by the system, comprising the following steps:

[0017] When registering a user, the user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes user name, login password and private attributes. The private attributes include length of service, position and age. The user attribute control unit generates a user ID for the user. The key-value pair is a key-value pair with the user ID as the key and the user attribute information as the key value. The key-value pairs corresponding to all users constitute a user attribute set.

[0018] When receiving a BIM data upload request, the SGX trusted encryption system will receive the BIM data to be uploaded and the attribute access policy, generate a unique BIM data ID for the BIM data, calculate the hash value of the BIM data and input the hash value into the blockchain system, the enclave memory protection area will randomly generate an AES key and perform AES symmetric encryption on the BIM data, and then input the encrypted data into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system, the enclave memory protection area will perform CP-ABE encryption on the AES key and CID according to the attribute access policy, and input the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key and the CID information into the blockchain system;

[0019] When receiving a BIM data download request, the SGX trusted encryption system obtains the user attribute information of the user through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download; the enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If the decryption fails, the BIM data download fails; if the decryption is successful, the CID, hash value and AES key are obtained, and the encrypted BIM data is obtained from the IPFS storage system according to the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data; if the calculated hash value is consistent with the decrypted hash value, the decrypted BIM data to be downloaded is output; otherwise, it is not output.

[0020] Furthermore, after the SGX trusted encryption system inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit will query the hash value list in the blockchain ledger layer, compare and determine whether the hash value list contains the same hash value as the currently input hash value. If so, the upload request will be rejected; if not, the hash value will be stored in the hash value list, and the instruction to continue uploading will be returned to the SGX trusted encryption system.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] 1. Based on the characteristics of blockchain technology such as immutability and decentralization, and relying on the access operation recording unit, all operations performed by all users in the system will be recorded on the blockchain, providing transparent and reliable traceability capabilities.

[0023] 2. Based on the CP-ABE encryption algorithm, it provides attribute-based fine-grained BIM data access control services, supports the update of user attributes, and is real-time.

[0024] 3. Use SGX technology to build a hardware-level enclave memory protection area to ensure the security and non-tamperability of BIM data and keys during encryption and decryption, and effectively prevent malicious third parties from attacking the system.

[0025] 4. Build a storage system based on IPFS, expand the storage capacity of blockchain, and improve the execution efficiency of smart contracts on blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a structural diagram of the BIM data sharing system;

[0027] Figure 2A system initialization flow chart for the BIM data sharing system;

[0028] Figure 3 This is a schematic diagram of the blockchain network structure;

[0029] Figure 4 Provide a user registration flow chart for the BIM data sharing system;

[0030] Figure 5 BIM data upload flow chart for BIM data sharing system;

[0031] Figure 6 This is a schematic diagram of the access structure of the BIM data sharing system;

[0032] Figure 7 This is the BIM data download flow chart for the BIM data sharing system. DETAILED DESCRIPTION

[0033] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0034] like Figure 1 As shown, the BIM data sharing system of the embodiment of the present invention includes an SGX trusted encryption system, an IPFS storage system and a blockchain system;

[0035] The SGX trusted encryption system is independent of the IPFS system and the blockchain system. It is used to create the enclave memory protection area required for AES symmetric encryption and CP-ABE encryption, perform AES symmetric encryption or CP-ABE encryption on the plaintext in the enclave memory protection area, and send the encrypted ciphertext to the IPFS system and the blockchain system after successful encryption, and obtain the return results from the IPFS system and the blockchain system.

[0036] The IPFS storage system is independent of the SGX trusted encryption system and the blockchain system. The IPFS storage system provides off-chain distributed storage capabilities for persistent storage of encrypted BIM data. After the encrypted BIM data is successfully stored, the unique identification file CID of the data is returned, and the function of retrieving and downloading BIM data based on the CID is also provided.

[0037] In a specific embodiment of the present invention, the SGX trusted encryption system will receive a BIM data upload or download request; when receiving a BIM data upload request, the SGX trusted encryption system will receive the BIM data to be uploaded, the attribute access policy, and generate a unique BIM data ID for the BIM data, and calculate the hash value of the BIM data and input the hash value into the blockchain system, the enclave memory protection area will randomly generate an AES key and perform AES symmetric encryption on the BIM data, and then input the encrypted data into the IPFS storage system for storage, and after the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system, the enclave memory protection area will perform CP-ABE encryption on the AES key and CID according to the attribute access policy, and input the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key and the CID information into the blockchain system. The blockchain system includes:

[0038] The blockchain network layer is used to deploy multiple peer nodes and multiple sorting nodes of the blockchain. The peer nodes are used to carry and run smart contracts and verify whether the results of executing smart contracts between peer nodes are consistent. The sorting nodes are used to ensure that all nodes have the correct transaction order.

[0039] The smart contract layer is deployed on peer nodes and runs in a docker environment with isolation, consistency and security. It includes a user attribute control unit, a BIM data access control unit and an access operation recording unit, which are used to interact with the underlying blockchain network for data.

[0040] The user attribute control unit runs on the blockchain peer node. The user attribute control unit is used to register users. The user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes user name, login password and private attributes. The private attributes include length of service, position and age. The user attribute control unit will generate a user ID for the user. The key-value pair is a key-value pair with the user ID as the key and the user attribute information as the key value. The key-value pairs corresponding to all users constitute a user attribute set. At the same time, the user attribute reporting and update operations are automatically performed to maintain the real-time nature of the user attribute set.

[0041] The BIM data access control unit runs on the blockchain peer node. The BIM data access control unit is used to serialize the hash value, attribute access strategy, encrypted AES key and CID information into a BIM metadata structure and store it in the blockchain ledger layer. The BIM metadata structure is stored in the blockchain ledger layer in the form of a key-value pair, which is a key-value pair with the BIM data ID as the key and the BIM metadata structure as the key value; the BIM data access control unit receives the hash value and stores it in the blockchain ledger layer, and all hash values ​​constitute a hash value list; and provides a way to obtain the BIM metadata structure and hash value list. The access operation record unit is used to record all operation records of users in the system, including login registration, access to BIM data, and acquisition of BIM metadata structure, and provides a way to obtain operation records.

[0042] The blockchain ledger layer is used to store hash value lists, user attribute sets, and collections of BIM metadata structures.

[0043] Using a consortium chain based on Hyperledger Fabric as the underlying layer of the BIM data sharing system can ensure that the data in the blockchain ledger layer is only accessed by nodes participating in the consortium chain and will not be leaked outside the shared system.

[0044] When building a blockchain BIM data sharing system based on SGX and CP-ABE, the BIM data sharing system will be initialized. The process is as follows: Figure 2 As shown, the details are as follows:

[0045] 1.1 Constructing a blockchain network. In a specific embodiment of the present invention, constructing Figure 3 The blockchain network shown in the figure uses three common departments in the field of railway engineering: design department, construction department and supervision department as the three organizations at the bottom of the blockchain. The three organizations are connected through the Bim channel. Four peer nodes and one sorting node are deployed in each organization. The election of the sorting nodes adopts the RAFT consensus mechanism.

[0046] 1.2 Deploy the smart contract layer on the blockchain network constructed in 1.1. The contract layer includes a user attribute control unit, a BIM data access control unit and an access operation recording unit. The deployed smart contract is not allowed to be modified during the operation of the system.

[0047] 1.3 Build a trusted execution environment based on SGX technology and generate an enclave memory protection area to ensure that the memory protection area is unique and cannot be destroyed throughout the entire life cycle of the system.

[0048] The blockchain BIM data sharing method based on SGX and CP-ABE includes user registration, BIM data uploading and BIM data acquisition.

[0049] 1. User Registration

[0050] In this stage, user registration of the BIM data sharing system is completed. The process is as follows: Figure 4 As shown, the details are as follows:

[0051] The user provides user attribute information, and the user attribute control unit of the smart contract layer provides a user registration channel. The user attribute control unit generates a user ID for the user. The user attribute information is stored in the blockchain ledger layer in the form of a key-value pair, where the key-value pair uses the user ID as the key and the user attribute information as the key value. The key-value pairs corresponding to all users constitute a user attribute set.

[0052] (II) BIM data upload

[0053] This stage completes the BIM data upload, and the process is as follows: Figure 5 As shown, the details are as follows:

[0054] When receiving a BIM data upload request, the SGX trusted encryption system will receive the BIM data M to be uploaded. file , attribute access strategy, and generate a unique BIM data ID for the BIM data and calculate the hash value of the BIM data and input the hash value into the blockchain system. The SGX trusted encryption system uses the salted blake3 algorithm to calculate the hash value of the BIM data in parallel. bim , use the BIM data access control unit to query the hash value list in the blockchain ledger layer, compare and determine whether the hash value list contains the same hash value as the currently input hash value, if so, reject the upload request; if not, store the hash value in the hash value list, and return the continue upload instruction to the SGX trusted encryption system;

[0055] When continuing to upload BIM data, the enclave memory protection area will randomly generate an AES key M aes The BIM data is then encrypted with AES symmetric encryption. aes_file Input into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system. CID is the unique address of the file in the IPFS storage system, and the file in the IPFS storage system can only be accessed through CID; the enclave memory protection area will perform CP-ABE encryption on the AES key and CID according to the attribute access policy, and input the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key and the CID information into the blockchain system.

[0056] The attribute access strategy is a string containing attribute conditions and logical operations. In a specific embodiment of the present invention, the attribute access strategy is: Or(And(identity = department head, length of service > 5), And(identity = designer, length of service > 8)). Based on the attribute access strategy, the following will be generated: Figure 6 The access structure τ shown is represented by a tree. Leaf nodes represent the values ​​or ranges that attributes must satisfy, and non-leaf nodes represent logical judgments. The access structure τ means that if data is to be accessed, one of the two conditions must be met: 1. The person is a department manager and has worked for more than 5 years; 2. The person is a designer and has worked for more than 8 years.

[0057] (III) BIM data acquisition

[0058] like Figure 7 As shown, when receiving a BIM data download request, the SGX trusted encryption system obtains the user attribute information of the user through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download; the enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If the decryption fails, the BIM data download fails (i.e., sharing fails); if the decryption is successful, the CID, hash value and AES key are obtained, and the encrypted BIM data is obtained from the IPFS storage system according to the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data; if the calculated hash value is consistent with the decrypted hash value, the decrypted BIM data to be downloaded is output; otherwise, it is not output (i.e., the BIM data download fails and the sharing fails).

[0059] The generation process of the attribute private key SK is as follows: The SGX trusted encryption system randomly selects r∈z p , and randomly select r for each attribute j∈S j ∈z p , calculate the attribute private key SK = (g (y+r) / β , where z p represents the set of integers modulo a prime number p, r, r j , y and β are p where S represents the user attribute information, j represents a single attribute in the user attribute, and g represents the cyclic group generator with an order of prime number p. Represents mapping a single attribute j to a cyclic group element and making r j Power operation.

[0060] When using the attribute private key SK for decryption, if the decryption fails, the sharing fails; if the decryption succeeds, the CID and AES key M of the BIM data are obtained. aes .

[0061] An embodiment of the present invention also provides a sharing method implemented by using the system, comprising the following steps:

[0062] When registering a user, the user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of a key-value pair in the blockchain ledger layer. The user attribute information includes a user name, password, and private attributes. The user attribute control unit generates a user ID for the user. The key-value pair is a key-value pair with the user ID as the key and the user attribute information as the key value. The key-value pairs corresponding to all users constitute a user attribute set.

[0063] When receiving a BIM data upload request, the SGX trusted encryption system will receive the BIM data to be uploaded and the attribute access policy, generate a unique BIM data ID for the BIM data, calculate the hash value of the BIM data and input the hash value into the blockchain system, the enclave memory protection area will randomly generate an AES key and perform AES symmetric encryption on the BIM data, and then input the encrypted data into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system, the enclave memory protection area will perform CP-ABE encryption on the AES key and CID according to the attribute access policy, and input the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key and the CID information into the blockchain system;

[0064] When receiving a BIM data download request, the SGX trusted encryption system obtains the user attribute information of the user through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download; the enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If the decryption fails, the BIM data download fails; if the decryption is successful, the CID, hash value and AES key are obtained, and then the encrypted BIM data is obtained from the IPFS storage system according to the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data; if the calculated hash value is consistent with the decrypted hash value, the decrypted BIM data to be downloaded is output; otherwise, it is not output.

[0065] Furthermore, after the SGX trusted encryption system inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit will query the hash value list in the blockchain ledger layer, compare and determine whether the hash value list has the same hash value as the currently input hash value, and if so, reject the upload request; if not, store the hash value in the hash value list, and return the continue upload instruction to the SGX trusted encryption system. The performance test results of the two encryption methods CP-ABE and AES involved in the present invention in the enclave memory protection area constructed by SGX and in the conventional environment are shown in Table 1, which proves that the present invention significantly improves the encryption and decryption key and process security by adopting the enclave memory protection area constructed based on SGX, while the time loss is within the tolerable range, and also takes into account performance and availability.

[0066] Table 1 Encryption performance test table

[0067]

[0068] The above-mentioned embodiments only express several implementation modes of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A blockchain BIM data sharing system based on SGX and CP-ABE, characterized in that: Including SGX trusted encryption system, IPFS storage system and blockchain system; The SGX trusted encryption system includes an enclave memory protection area, which receives BIM data upload or download requests; When receiving a BIM data upload request, the SGX trusted encryption system will receive and encrypt the BIM data to be uploaded, and then upload the encrypted BIM data to the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system, and the SGX trusted encryption system will input the CID into the blockchain system. When receiving a BIM data download request, the SGX trusted encryption system obtains the CID of the BIM data to be downloaded from the blockchain system based on the download request, and then obtains the BIM data to be downloaded from the IPFS storage system based on the CID and outputs it; The blockchain system includes a blockchain network layer, a smart contract layer and a blockchain ledger layer. The blockchain network layer is used to deploy multiple peer nodes and multiple sorting nodes of the blockchain, and the smart contract layer is deployed on the peer nodes; the peer nodes are used to carry and run smart contracts and verify whether the results of executing smart contracts between peer nodes are consistent, and the sorting nodes are used to ensure that all nodes have the correct transaction order; the smart contract layer is used to interact with the blockchain network layer for data; the blockchain ledger layer is used to store information input by the SGX trusted encryption system; The IPFS storage system is used to store BIM data and generate a unique identification file CID.

2. The system according to claim 1, characterized in that When receiving a BIM data upload request, the SGX trusted encryption system will also receive an externally input attribute access policy, generate a unique BIM data ID for the BIM data, calculate the hash value of the BIM data, and input it into the blockchain system; the enclave memory protection area will randomly generate an AES key and perform AES symmetric encryption on the BIM data to be uploaded, and the encrypted data will be input into the IPFS storage system; The enclave memory protection area will perform CP-ABE encryption on the AES key and CID according to the attribute access policy, and input the BIM data ID, hash value of the BIM data, attribute access policy, encrypted AES key and CID information into the blockchain system.

3. The system according to claim 2, characterized in that The smart contract layer includes a user attribute control unit and a BIM data access control unit; The user attribute control unit is used to register a user. The user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of a key-value pair in the blockchain ledger layer. The user attribute information includes a user name, a login password, and private attributes. The private attributes include length of service, position, and age. The user attribute control unit generates a user ID for the user. The key-value pair is a key-value pair with the user ID as the key and the user attribute information as the key value. The key-value pairs corresponding to all users constitute a user attribute set. The BIM data access control unit is used to serialize the hash value, attribute access strategy, encrypted AES key and CID information into a BIM metadata structure and store it in the blockchain ledger layer. The BIM metadata structure is stored in the blockchain ledger layer in the form of a key-value pair, where the key-value pair is a key-value pair with the BIM data ID as the key and the BIM metadata structure as the key value; the BIM data access control unit receives the hash value and stores it in the blockchain ledger layer, and all hash values ​​constitute a hash value list.

4. The system according to claim 3, characterized in that The smart contract layer also includes an access operation recording unit, which is used to record all operation records of logging in and registering, accessing BIM data, and obtaining BIM metadata structures in the sharing system, and provides a way to obtain the operation records.

5. The system according to claim 3, characterized in that After the SGX trusted encryption system inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit will query the hash value list in the blockchain ledger layer, and compare and determine whether the hash value list contains the same hash value as the currently input hash value. If so, the upload request will be rejected; If not, store the hash value in the hash value list and return to continue uploading instructions to the SGX trusted encryption system.

6. The system according to claim 3, characterized in that When the SGX trusted encryption system receives a BIM data download request, the SGX trusted encryption system obtains the user attribute information of the user through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download; the enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If the decryption fails, the BIM data download fails; If the decryption is successful, the CID, hash value and AES key are obtained. The encrypted BIM data is obtained from the IPFS storage system according to the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data; If the calculated hash value is consistent with the decrypted hash value, the decrypted BIM data to be downloaded is output; Otherwise, no output.

7. A sharing method implemented by using the system of claim 6, characterized in that: The following steps are involved: When registering a user, the user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes user name, login password and private attributes. The private attributes include length of service, position and age. The user attribute control unit generates a user ID for the user. The key-value pair is a key-value pair with the user ID as the key and the user attribute information as the key value. The key-value pairs corresponding to all users constitute a user attribute set. When receiving a BIM data upload request, the SGX trusted encryption system will receive the BIM data to be uploaded and the attribute access policy, generate a unique BIM data ID for the BIM data, calculate the hash value of the BIM data and input the hash value into the blockchain system, the enclave memory protection area will randomly generate an AES key and perform AES symmetric encryption on the BIM data, and then input the encrypted data into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it will output the unique identification file CID of the data to the SGX trusted encryption system, the enclave memory protection area will perform CP-ABE encryption on the AES key and CID according to the attribute access policy, and input the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key and the CID information into the blockchain system; When receiving a BIM data download request, the SGX trusted encryption system obtains the user attribute information of the user through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download; the enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If the decryption fails, the BIM data download fails; If the decryption is successful, the CID, hash value and AES key are obtained. Then, the encrypted BIM data is obtained from the IPFS storage system according to the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data. If the calculated hash value is consistent with the decrypted hash value, the decrypted BIM data to be downloaded is output; Otherwise, no output.

8. The method according to claim 7, characterized in that After the SGX trusted encryption system inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit will query the hash value list in the blockchain ledger layer, compare and determine whether the hash value list has the same hash value as the currently input hash value. If so, the upload request will be rejected; if not, the hash value will be stored in the hash value list and the continue upload instruction will be returned to the SGX trusted encryption system.

Images