Blockchain BIM data sharing system and method based on sgx and cp-ab

Abstract

The application discloses a kind of blockchain BIM data sharing system and method based on SGX and CP-ABE, belong to blockchain technical field.System includes SGX trusted encryption system, IPFS storage system and blockchain system;When carrying out user registration, the user attribute information inputted from outside is received and stored by blockchain system;When receiving BIM data upload request, the encryption system will receive the data to be uploaded and be encrypted, the encrypted data is uploaded to the storage system and is stored, and CID returned by the storage system is accepted, then the CID is input to blockchain system;When receiving BIM data download request, the encryption system obtains the CID of the data to be downloaded based on blockchain system, then obtains the data to be downloaded from the storage system based on the CID and outputs.The sharing system of the application can provide BIM data fine-grained sharing service for engineering department, and can ensure that BIM data and key are not leaked and tampered during sharing process.

Description

Technical Field

[0001] This invention belongs to the field of blockchain technology, specifically relating to a blockchain BIM data sharing system and method based on SGX (Software Guard Extensions) and CP-ABE (Ciphertext Policy Attribute Based Encryption). Background Technology

[0002] With the continuous advancement of information technology construction in the engineering field, engineering digitalization has developed rapidly. Building Information Modeling (BIM) has become a core technology for the design, construction, and management of complex engineering projects. Currently, BIM technology has been widely applied, providing detailed building information models, which not only improves the efficiency and quality of engineering projects but also promotes collaborative work among various stakeholders.

[0003] However, with the continuous expansion of BIM applications, the issue of reliable data sharing has become increasingly prominent, especially in ensuring reliable data management and secure sharing. For example, traditional centralized BIM data sharing platforms store BIM data in a centralized server and provide coarse-grained data sharing services to users through role-based division. This necessitates continuously adding new system roles to handle the ever-increasing volume of BIM data, leading to system role redundancy. Furthermore, traditional methods typically perform BIM data encryption and decryption locally on the central server, failing to protect data and keys from tampering during the sharing process. This results in low efficiency in multi-department collaboration and difficulty in assigning responsibility for problems.

[0004] Blockchain technology features immutability, decentralization, and security; in essence, it is a decentralized distributed ledger.

[0005] SGX (Software Guard Extensions) is a set of CPU instructions proposed by Intel in 2013. These instructions allow applications to create secure enclaves, protected regions within the application's address space that ensure the confidentiality and integrity of information within the terminal operating system environment. Data within a secure enclave can only be accessed by code within that enclave; attempts to access the enclave's memory contents from a software perspective are prohibited, thus providing hardware-level protection.

[0006] CP-ABE (Ciphertext Policy Attribute Based Encryption) is a public-key cryptosystem that controls a user's access to specific resources based on their attributes. Data can only be decrypted if and only if the user's attributes satisfy the access policy specified in the ciphertext. This encryption method provides users with fine-grained access control, thereby protecting sensitive data from unauthorized access.

[0007] Based on blockchain technology, SGX technology, and CP-ABE encryption scheme, a new BIM data sharing system can be built to solve the problems of insufficient granularity of permissions and easy leakage of keys and data during the BIM data sharing process, and effectively improve the collaborative efficiency between engineering departments. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides a blockchain-based BIM data sharing system and method based on SGX and CP-ABE. By introducing the hardware security mechanism of Intel SGX and combining it with the CP-ABE encryption scheme, and leveraging the immutability, decentralization, and automatic execution of smart contracts inherent in blockchain technology, a fine-grained and secure BIM data sharing system is constructed.

[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0010] In a first aspect, the present invention discloses a blockchain BIM data sharing system based on SGX and CP-ABE, including an SGX trusted encryption system, an IPFS storage system, and a blockchain system;

[0011] The SGX trusted encryption system includes an enclave memory protection area, which receives BIM data upload or download requests.

[0012] When a BIM data upload request is received, the SGX Trusted Encryption System receives the BIM data to be uploaded and encrypts it. Then, it uploads the encrypted BIM data to the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it outputs the unique identifier file CID of the data to the SGX Trusted Encryption System. The SGX Trusted Encryption System then inputs the CID into the blockchain system.

[0013] When a BIM data download request is received, the SGX trusted encryption system obtains the CID of the BIM data to be downloaded from the blockchain system based on the download request, and then obtains the BIM data to be downloaded from the IPFS storage system based on the CID and outputs it.

[0014] The blockchain system comprises a blockchain network layer, a smart contract layer, and a blockchain ledger layer. The blockchain network layer is used to deploy multiple peer nodes and multiple sorting nodes. The smart contract layer is deployed on the peer nodes. Peer nodes are used to carry and run smart contracts and verify whether the results of smart contract execution among peer nodes are consistent. The sorting nodes are used to ensure that all nodes execute transactions in the correct order. The smart contract layer is used to interact with the blockchain network layer. The blockchain ledger layer is used to store information input by the SGX trusted encryption system.

[0015] The IPFS storage system is used to store BIM data and generate unique identifier files (CIDs).

[0016] Secondly, the present invention discloses a sharing method implemented using the system, comprising the following steps:

[0017] When registering a user, the user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes username, login password and private attributes. The private attributes include length of service, position and age. The user attribute control unit generates the user ID for the user. The key-value pairs are key-value pairs with user ID as the key and user attribute information as the key value. The key-value pairs corresponding to all users constitute the user attribute set.

[0018] When receiving a BIM data upload request, the SGX Trusted Encryption System receives the BIM data to be uploaded and the attribute access policy, generates a unique BIM data ID for the BIM data, calculates the hash value of the BIM data, and inputs the hash value into the blockchain system. The enclave memory protection area randomly generates an AES key and performs AES symmetric encryption on the BIM data. The encrypted data is then input into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it outputs the unique identifier file CID of the data to the SGX Trusted Encryption System. The enclave memory protection area performs CP-ABE encryption on the AES key and CID according to the attribute access policy, and inputs the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key, and the CID information into the blockchain system.

[0019] When a BIM data download request is received, the SGX trusted encryption system obtains the user's attribute information through the user attribute control unit based on the user ID requesting the download, and obtains the BIM metadata structure through the BIM data access control unit based on the requested BIM data ID. The enclave memory protection area obtains an attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If decryption fails, the BIM data download fails; if decryption succeeds, the CID, hash value, and AES key are obtained. The encrypted BIM data is retrieved from the IPFS storage system based on the CID, and decrypted using the AES key to obtain the BIM data to be downloaded and calculate its hash value. If the calculated hash value matches the decrypted hash value, the decrypted BIM data to be downloaded is output; otherwise, it is not output.

[0020] Furthermore, after the SGX Trusted Encryption System inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit queries the hash value list in the blockchain ledger layer and compares it to see if there is a hash value that is the same as the currently input hash value. If there is, the upload request is rejected; if not, the hash value is stored in the hash value list and a continue upload instruction is returned to the SGX Trusted Encryption System.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0022] 1. Based on the immutable and decentralized characteristics of blockchain technology, and relying on the access operation record unit, all operations performed by all users within the system will be recorded on the blockchain, providing transparent and reliable traceability capabilities.

[0023] 2. Based on the CP-ABE encryption algorithm, it provides attribute-based fine-grained BIM data access control services and supports the updating of user attributes, with real-time capability.

[0024] 3. SGX technology is used to build a hardware-level enclave memory protection area to ensure the security and immutability of BIM data and keys during encryption and decryption, effectively preventing malicious third-party attacks on the system.

[0025] 4. An IPFS-based storage system was built, which expanded the storage capacity of the blockchain and improved the execution efficiency of smart contracts on the blockchain. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the structure of a BIM data sharing system;

[0027] Figure 2System initialization flowchart for the BIM data sharing system;

[0028] Figure 3 This is a schematic diagram of a blockchain network structure.

[0029] Figure 4 A flowchart of the user registration process for the BIM data sharing system;

[0030] Figure 5 A flowchart of the BIM data upload process for the BIM data sharing system;

[0031] Figure 6 A schematic diagram of the access structure of a BIM data sharing system;

[0032] Figure 7 This is a flowchart of the BIM data download process for the BIM data sharing system. Detailed Implementation

[0033] The present invention will be further described and illustrated below with reference to specific embodiments. The embodiments described are merely examples of the content of this disclosure and do not limit the scope of the invention. The technical features of each embodiment in the present invention can be combined accordingly, provided that there is no mutual conflict.

[0034] like Figure 1 As shown, the BIM data sharing system of this invention includes an SGX trusted encryption system, an IPFS storage system, and a blockchain system;

[0035] The SGX Trusted Encryption System, independent of the IPFS and blockchain systems, is used to create the enclave memory protection area required for AES symmetric encryption and CP-ABE encryption. Plaintext is encrypted using AES symmetric encryption or CP-ABE encryption within the enclave memory protection area. After successful encryption, the encrypted ciphertext is sent to the IPFS and blockchain systems, and the return results are obtained from the IPFS and blockchain systems.

[0036] The IPFS storage system, independent of the SGX trusted encryption system and blockchain system, provides off-chain distributed storage capabilities for persistent storage of encrypted BIM data. Upon successful storage of encrypted BIM data, it returns a unique identifier file (CID) for that data and provides the function of retrieving and downloading BIM data based on the CID.

[0037] In one specific embodiment of the present invention, the SGX trusted encryption system receives BIM data upload or download requests. When receiving a BIM data upload request, the SGX trusted encryption system receives the BIM data to be uploaded and the attribute access policy, generates a unique BIM data ID for the BIM data, calculates the hash value of the BIM data, and inputs the hash value into the blockchain system. The enclave memory protection area randomly generates an AES key and performs AES symmetric encryption on the BIM data. The encrypted data is then input into the IPFS storage system for storage. After successfully storing the data, the IPFS storage system outputs the unique identifier file (CID) of the data to the SGX trusted encryption system. The enclave memory protection area performs CP-ABE encryption on the AES key and CID according to the attribute access policy, and inputs the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key, and the CID information into the blockchain system. The blockchain system includes:

[0038] The blockchain network layer is used to deploy multiple peer nodes and multiple sorting nodes of the blockchain. The peer nodes are used to carry out smart contracts and verify whether the results of smart contract execution among peer nodes are consistent. The sorting nodes are used to ensure that all nodes are in the correct order of transactions.

[0039] The smart contract layer, deployed on peer nodes and running in a Docker environment with isolation, consistency, and security, includes a user attribute control unit, a BIM data access control unit, and an access operation record unit, used for data interaction with the underlying blockchain network.

[0040] The user attribute control unit operates on blockchain peer nodes. It is used for user registration, receiving externally inputted user attribute information and storing it as key-value pairs in the blockchain ledger layer. The user attribute information includes username, login password, and private attributes, such as length of service, job title, and age. The user attribute control unit generates a user ID for each user. The key-value pairs are those with the user ID as the key and the user attribute information as the value. All key-value pairs corresponding to all users constitute the user attribute set. Simultaneously, it automatically performs user attribute reporting and update operations to maintain the real-time performance of the user attribute set.

[0041] The BIM data access control unit, running on blockchain peer nodes, serializes hash values, attribute access policies, encrypted AES keys, and CID information into a BIM metadata structure and stores it in the blockchain ledger layer. The BIM metadata structure is stored in key-value pairs, with the BIM data ID as the key and the BIM metadata structure as the value. The BIM data access control unit receives hash values ​​and stores them in the blockchain ledger layer; all hash values ​​form a hash value list. It also provides access methods for the BIM metadata structure and the hash value list. The access operation record unit records all user operations within the system, including login / registration, accessing BIM data, and obtaining the BIM metadata structure, and provides access methods for these operation records.

[0042] The blockchain ledger layer is used to store a list of hash values, a set of user attributes, and a collection of BIM metadata structures.

[0043] Using a consortium blockchain based on Hyperledger Fabric as the underlying layer of the BIM data sharing system ensures that data in the blockchain ledger layer is only accessed by nodes participating in the consortium blockchain and will not leak outside the sharing system.

[0044] When constructing a blockchain-based BIM data sharing system using SGX and CP-ABE, the BIM data sharing system is initialized, and the process is as follows: Figure 2 As shown, the details are as follows:

[0045] 1.1 Constructing a blockchain network: In one specific embodiment of the present invention, a blockchain network is constructed as follows... Figure 3 The blockchain network shown uses three common departments in the railway engineering field—design, construction, and supervision—as the three organizations at the bottom layer of the blockchain. These three organizations are connected through Bim channels. Within each organization, four peer nodes and one sorting node are deployed. The election of the sorting node adopts the RAFT consensus mechanism.

[0046] 1.2 Deploy a smart contract layer on the blockchain network built in 1.1. The contract layer includes a user attribute control unit, a BIM data access control unit, and an access operation record unit. Once deployed, the smart contract cannot be modified during system operation.

[0047] 1.3 Based on SGX technology, a trusted execution environment is built, and an enclave memory protection area is generated to ensure that the memory protection area is unique and cannot be destroyed throughout the entire life cycle of the system.

[0048] The blockchain-based BIM data sharing method based on SGX and CP-ABE includes user registration, BIM data upload, and BIM data acquisition.

[0049] (I) User Registration

[0050] This phase involves user registration for the BIM data sharing system, and the process is as follows: Figure 4 As shown, the details are as follows:

[0051] Users provide user attribute information, and the user attribute control unit in the smart contract layer provides a user registration channel. The user attribute control unit generates the user ID for that user, and the user attribute information is stored in the blockchain ledger layer in the form of key-value pairs. The key-value pairs are key-value pairs with user ID as the key and user attribute information as the key. The key-value pairs corresponding to all users constitute the user attribute set.

[0052] (II) BIM Data Upload

[0053] This stage involves uploading BIM data, and the process is as follows: Figure 5 As shown, the details are as follows:

[0054] When receiving a BIM data upload request, the SGX trusted encryption system will receive the BIM data M to be uploaded. file The system implements an attribute access strategy, generates a unique BIM data ID for the BIM data, calculates the hash value of the BIM data, and inputs the hash value into the blockchain system. The SGX trusted encryption system uses a salted blake3 algorithm to calculate the hash value of the BIM data in parallel. bim The system uses the BIM data access control unit to query the hash value list in the blockchain ledger layer, compares the hash value list to see if there is a hash value that is the same as the currently input hash value. If there is, the upload request is rejected; if not, the hash value is stored in the hash value list and a continue upload instruction is returned to the SGX trusted encryption system.

[0055] When continuing to upload BIM data, the enclave memory protection area will randomly generate an AES key M. aes The BIM data is then subjected to AES symmetric encryption, and the encrypted data M is then... aes_file The data is input into the IPFS storage system for storage. After successfully storing the data, the IPFS storage system outputs a unique identifier file (CID) to the SGX trusted encryption system. The CID is the unique address of the file in the IPFS storage system, and the file can only be accessed through the CID. The enclave memory protection area performs CP-ABE encryption on the AES key and CID according to the attribute access policy, and inputs the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key, and the CID information into the blockchain system.

[0056] The attribute access strategy is a string containing attribute conditions and logical operations. In a specific embodiment of the present invention, the attribute access strategy is: Or(And(Identity = Department Head, Length of Service > 5), And(Identity = Designer, Length of Service > 8)). Based on the attribute access strategy, a string like this will be generated. Figure 6 The access structure τ shown is represented by a tree. Leaf nodes represent the values ​​or ranges that attributes must satisfy, and non-leaf nodes represent logical judgments. The access structure τ means that to access data, one of two conditions must be met: 1. The person is a department head and has worked for more than 5 years; 2. The person is a designer and has worked for more than 8 years.

[0057] (III) BIM Data Acquisition

[0058] like Figure 7 As shown, when receiving a BIM data download request, the SGX trusted encryption system obtains the user's attribute information through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the requested BIM data ID. The enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If decryption fails, the BIM data download fails (i.e., sharing fails). If decryption succeeds, the CID, hash value, and AES key are obtained. The encrypted BIM data is obtained from the IPFS storage system based on the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data. If the calculated hash value matches the decrypted hash value, the decrypted BIM data to be downloaded is output; otherwise, it is not output (i.e., BIM data download fails, sharing fails).

[0059] The generation process of the attribute private key SK is as follows: The SGX trusted encryption system randomly selects r∈z. p And randomly select r for each attribute j∈S j ∈z p The attribute private key SK = (g) is calculated. (y+r) / β , Where z p Let r, r'' be the set of integers modulo a prime number p. j , y and β are in z p The four selected random integers are S, j, and g, where S represents user attribute information, j represents a single attribute in the user attributes, and g represents the generator of a cyclic group of order p. This represents mapping a single attribute j to a cyclic group element and performing r. j Exponentiation.

[0060] If decryption fails when using the attribute private key SK, the sharing session fails; if decryption succeeds, the CID and AES key M of the BIM data are obtained. aes .

[0061] An embodiment of the present invention also provides a sharing method implemented using the system, comprising the following steps:

[0062] When registering a user, the user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes username, password and private attributes. The user attribute control unit generates the user ID for the user. The key-value pairs are key-value pairs with user ID as the key and user attribute information as the key value. The key-value pairs corresponding to all users constitute the user attribute set.

[0063] When receiving a BIM data upload request, the SGX Trusted Encryption System receives the BIM data to be uploaded and the attribute access policy, generates a unique BIM data ID for the BIM data, calculates the hash value of the BIM data, and inputs the hash value into the blockchain system. The enclave memory protection area randomly generates an AES key and performs AES symmetric encryption on the BIM data. The encrypted data is then input into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it outputs the unique identifier file CID of the data to the SGX Trusted Encryption System. The enclave memory protection area performs CP-ABE encryption on the AES key and CID according to the attribute access policy, and inputs the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key, and the CID information into the blockchain system.

[0064] When a BIM data download request is received, the SGX trusted encryption system obtains the user's attribute information through the user attribute control unit based on the user ID requesting the download, and obtains the BIM metadata structure through the BIM data access control unit based on the requested BIM data ID. The enclave memory protection area obtains an attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If decryption fails, the BIM data download fails; if decryption succeeds, the CID, hash value, and AES key are obtained. The encrypted BIM data is then retrieved from the IPFS storage system based on the CID, and decrypted using the AES key to obtain the BIM data to be downloaded and calculate its hash value. If the calculated hash value matches the decrypted hash value, the decrypted BIM data to be downloaded is output; otherwise, it is not output.

[0065] Furthermore, after the SGX trusted encryption system inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit queries the hash value list in the blockchain ledger layer to compare and determine if there is a hash value in the hash value list that is the same as the currently input hash value. If so, the upload request is rejected; if not, the hash value is stored in the hash value list, and a continue upload instruction is returned to the SGX trusted encryption system. The performance test results of the CP-ABE and AES encryption methods involved in this invention in the SGX-built enclave memory protection area and in a conventional environment are shown in Table 1. These results demonstrate that the present invention significantly improves the security of encryption and decryption keys and processes by adopting an SGX-based enclave memory protection area, while the resulting time loss is within a tolerable range, balancing performance and availability.

[0066] Table 1 Encryption Performance Test Table

[0067]

[0068] The above-described embodiments are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. Those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A blockchain-based BIM data sharing system based on SGX and CP-ABE, characterized in that, This includes the SGX trusted encryption system, the IPFS storage system, and the blockchain system; The SGX trusted encryption system includes an enclave memory protection area, and the SGX trusted encryption system receives BIM data upload or download requests. When a BIM data upload request is received, the SGX Trusted Encryption System receives the BIM data to be uploaded and encrypts it. Then, it uploads the encrypted BIM data to the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it outputs the unique identifier file CID of the data to the SGX Trusted Encryption System. The SGX Trusted Encryption System then inputs the CID into the blockchain system. When a BIM data download request is received, the SGX trusted encryption system obtains the CID of the BIM data to be downloaded from the blockchain system based on the download request, and then obtains the BIM data to be downloaded from the IPFS storage system based on the CID and outputs it. The blockchain system includes a blockchain network layer, a smart contract layer, and a blockchain ledger layer. The smart contract layer includes a user attribute control unit and a BIM data access control unit. The IPFS storage system is used to store BIM data and generate unique identifier files (CIDs). When receiving a BIM data upload request, the SGX trusted encryption system also receives the attribute access policy input from the outside, generates a unique BIM data ID for the BIM data, calculates the hash value of the BIM data and inputs it into the blockchain system; the enclave memory protection area will randomly generate an AES key and perform AES symmetric encryption on the BIM data to be uploaded, and the encrypted data will be input into the IPFS storage system. The enclave memory protection area will CP-ABE encrypt the AES key and CID according to the attribute access policy, and input the BIM data ID, BIM data hash value, attribute access policy, encrypted AES key and CID information into the blockchain system. When the SGX trusted encryption system receives a BIM data download request, it obtains the user's attribute information through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download. The enclave memory protection area obtains an attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If decryption fails, the BIM data download fails. If decryption is successful, the CID, hash value, and AES key are obtained. The encrypted BIM data is retrieved from the IPFS storage system based on the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data. If the calculated hash value matches the decrypted hash value, then the decrypted BIM data to be downloaded will be output.

2. The system according to claim 1, characterized in that, The blockchain network layer is used to deploy multiple peer nodes and multiple sorting nodes of the blockchain. The smart contract layer is deployed on the peer nodes. The peer nodes are used to carry and run smart contracts and verify whether the results of smart contract execution among peer nodes are consistent. The sorting nodes are used to ensure that all nodes have the correct transaction order. The smart contract layer is used to interact with the blockchain network layer. The blockchain ledger layer is used to store the information input by the SGX trusted encryption system. The user attribute control unit is used for user registration. The user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes username, login password and private attributes. The private attributes include length of service, position and age. The user attribute control unit generates the user ID for the user. The key-value pairs are key-value pairs with user ID as the key and user attribute information as the key value. The key-value pairs corresponding to all users constitute the user attribute set. The BIM data access control unit is used to serialize hash values, attribute access policies, encrypted AES keys, and CID information into a BIM metadata structure and store it in the blockchain ledger layer. The BIM metadata structure is stored in the blockchain ledger layer in the form of key-value pairs, where the BIM data ID is the key and the BIM metadata structure is the value. The BIM data access control unit receives hash values ​​and stores them in the blockchain ledger layer, and all hash values ​​constitute a hash value list.

3. The system according to claim 2, characterized in that, After the SGX trusted encryption system inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit will query the hash value list in the blockchain ledger layer and compare it to determine whether there is a hash value in the hash value list that is the same as the currently input hash value. If there is, the upload request will be rejected. If not, store the hash value in the hash value list and return the continue upload instruction to the SGX trusted encryption system.

4. The system according to claim 2, characterized in that, The smart contract layer also includes an access operation record unit, which is used to record all operation records of logging in and registering, accessing BIM data and obtaining BIM metadata structures in the shared system, and provides a way to obtain operation records.

5. A sharing method implemented using the system according to any one of claims 1-4, characterized in that, Includes the following steps: When registering a user, the user attribute control unit receives externally input user attribute information and stores the user attribute information in the form of key-value pairs in the blockchain ledger layer. The user attribute information includes username, login password and private attributes. The private attributes include length of service, position and age. The user attribute control unit generates the user ID for the user. The key-value pairs are key-value pairs with user ID as the key and user attribute information as the key value. The key-value pairs corresponding to all users constitute the user attribute set. When receiving a BIM data upload request, the SGX Trusted Encryption System receives the BIM data to be uploaded and the attribute access policy, generates a unique BIM data ID for the BIM data, calculates the hash value of the BIM data, and inputs the hash value into the blockchain system. The enclave memory protection area randomly generates an AES key and performs AES symmetric encryption on the BIM data. The encrypted data is then input into the IPFS storage system for storage. After the IPFS storage system successfully stores the data, it outputs the unique identifier file CID of the data to the SGX Trusted Encryption System. The enclave memory protection area performs CP-ABE encryption on the AES key and CID according to the attribute access policy, and inputs the BIM data ID, the hash value of the BIM data, the attribute access policy, the encrypted AES key, and the CID information into the blockchain system. When a BIM data download request is received, the SGX trusted encryption system obtains the user's attribute information through the user attribute control unit based on the user ID requesting the BIM data download, and obtains the BIM metadata structure through the BIM data access control unit based on the BIM data ID requested for download. The enclave memory protection area obtains the attribute private key based on the obtained user attribute information and the CP-ABE attribute private key generation method, and decrypts the obtained BIM metadata structure based on the attribute private key. If decryption fails, the BIM data download fails. If decryption is successful, the CID, hash value, and AES key are obtained. The encrypted BIM data is then retrieved from the IPFS storage system based on the CID, and the encrypted BIM data is decrypted based on the AES key to obtain the BIM data to be downloaded and calculate the hash value of the data. If the calculated hash value matches the decrypted hash value, then the decrypted BIM data to be downloaded will be output.

6. The method according to claim 5, characterized in that, After the SGX Trusted Encryption System inputs the hash value of the BIM data to be uploaded into the blockchain system, the BIM data access control unit queries the hash value list in the blockchain ledger layer and compares it to see if there is a hash value that is the same as the currently input hash value. If there is, the upload request is rejected; if not, the hash value is stored in the hash value list and a continue upload instruction is returned to the SGX Trusted Encryption System.

Images