Data processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a storage medium and electronic equipment. The method relates to the technical field of data security, and comprises the following steps: acquiring a data access request initiated by a target object; according to the access attribute information and the encrypted first access strategy, judging whether the target object has the authority of accessing the first target data or not; if the target object has the permission to access the first target data, acquiring encrypted first target data and a first target key ciphertext according to the storage address information; and decrypting the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data. Through the method and the device, the problem of relatively low data security caused by performing security verification through user identity information when a user accesses data in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data processing method and device, a storage medium, and an electronic device. Background Art

[0002] With the continuous development of edge cloud computing, edge servers, as a bridge between cloud services and IoT end users, play a key role in caching and disseminating data collected by IoT devices (such as wearable monitoring devices, smart sensors, etc.) and stored in the cloud. These data can be shared with multiple users, which is conducive to diversified business development. For example, users can collect health data such as heart rate, breathing rate, body fat percentage, etc. through mobile terminals such as smart watches and mobile phones, and share them with doctors to help doctors evaluate the user's physical health and diagnose diseases. However, these data are usually sensitive data, so how to share these data in a controllable and secure manner is crucial. In the prior art, access control is often achieved through user identity information, but this method has the problem of poor data security.

[0003] Currently, no effective solution has been proposed to address the problem in related technologies that security verification is performed through user identity information when users access data, resulting in low data security. Summary of the invention

[0004] The main purpose of the present application is to provide a data processing method and device, a storage medium and an electronic device to solve the problem in the related art that security verification is performed through user identity information when the user accesses data, resulting in low data security.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data processing method is provided. The method comprises: obtaining a data access request initiated by a target object, wherein the data access request at least comprises: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on security parameters and a master key, the security parameters and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt a first access policy of the first target data, and the encrypted first access policy is stored in the target area. In a block chain; according to the access attribute information and the encrypted first access policy, determine whether the target object has the permission to access the first target data; if the target object has the permission to access the first target data, obtain the encrypted first target data and the first target key ciphertext according to the storage address information, wherein the first target key ciphertext is obtained by encrypting an access token, and the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data; decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0006] Furthermore, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated from a first random number and a second random number; performing a hash transformation on the access token to obtain the encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0007] Furthermore, obtaining a data access request initiated by a target object includes: randomly generating a first random number and a second random number, and calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key; generating the access policy hidden factor through the target blockchain, and calculating based on the access policy hidden factor and the target attribute private key to obtain the access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; obtaining the data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0008] Furthermore, before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the method also includes: determining an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; generating a cyclic group based on a preset security value, and obtaining the master key based on the third random number; obtaining the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0009] Furthermore, obtaining the master key according to the third random number includes: performing calculation according to the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation according to the target value and the prime order of the cyclic group to obtain the master key.

[0010] Furthermore, according to the first attribute information corresponding to the target object, obtaining the target attribute private key includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key according to the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0011] Furthermore, after obtaining the target attribute private key, the method also includes: calculating based on the second private key of the first attribute authorization center and the pseudo-identity information to obtain a signature private key of the first attribute authorization center, wherein the second private key is obtained by an eighth random number and a ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0012] Furthermore, before obtaining the data access request initiated by the target object, the method also includes: obtaining the access token and performing hashing on the access token to obtain the encryption key; encrypting the second target data according to the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information at least includes: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0013] Furthermore, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating the access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0014] Furthermore, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating the second attribute information and the first public key based on the tenth random number to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0015] Furthermore, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating the second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0016] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a data processing device is provided. The device includes: a first acquisition unit, used to acquire a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on security parameters and a master key, the security parameters and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; a judgment unit , used to determine whether the target object has the authority to access the first target data based on the access attribute information and the encrypted first access policy; a second acquisition unit, used to obtain the encrypted first target data and the first target key ciphertext according to the storage address information if the target object has the authority to access the first target data, wherein the first target key ciphertext is obtained by encrypting an access token, and the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data; a first processing unit, used to decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0017] Furthermore, the processing unit includes: a first decryption subunit, used to decrypt the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated by the first random number and the second random number; a transformation subunit, used to perform a hash transformation on the access token to obtain the encryption key; a second decryption subunit, used to decrypt the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0018] Furthermore, the first acquisition unit includes: a first generation subunit, used to randomly generate a first random number and a second random number, and calculate according to the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key; a second generation subunit, used to generate the access policy hidden factor through the target blockchain, and calculate according to the access policy hidden factor and the target attribute private key to obtain the access attribute information; a first determination subunit, used to obtain the target attribute private key according to the first attribute information corresponding to the target object; a second determination subunit, used to obtain the data access request according to the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0019] Furthermore, the device also includes: a first determination unit, used to determine an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center before calculating according to the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; a first generation unit, used to generate a cyclic group according to a preset security value, and obtain the master key according to the third random number; a second determination unit, used to obtain the security parameter according to the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0020] Furthermore, the first generation unit includes: a first calculation subunit, used to calculate based on the prime order of the cyclic group and the third random number to obtain a target value; a second calculation subunit, used to calculate based on the target value and the prime order of the cyclic group to obtain the master key.

[0021] Furthermore, the first determination subunit includes: a determination module, used to determine the first attribute authorization center corresponding to the first attribute information, and obtain the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; an acquisition module, used to obtain the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; a random module, used to randomly generate a seventh random number, and obtain the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0022] Furthermore, the device also includes: a first calculation unit, used to, after obtaining the target attribute private key, perform calculations based on the second private key of the first attribute authorization center and the pseudo-identity information to obtain a signature private key of the first attribute authorization center, wherein the second private key is obtained by an eighth random number and a ninth random number; a signature unit, used to sign the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; a third determination unit, used to obtain a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and a second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0023] Furthermore, the device also includes: a third acquisition unit, used to obtain the access token before obtaining the data access request initiated by the target object, and hash the access token to obtain the encryption key; a second processing unit, used to encrypt the second target data according to the encryption key to obtain the encrypted second target data; a fourth acquisition unit, used to store the encrypted second target data in a cloud server, and obtain metadata information of the encrypted second target data from the cloud server, wherein the metadata information at least includes: the storage address and description information of the encrypted second target data; a storage unit, used to store the metadata information in the target blockchain.

[0024] Furthermore, the device also includes: a fourth determination unit, used to determine the second attribute information after storing the metadata information in the target blockchain, and generate a second access policy for the second target data based on the second attribute information; a fifth determination unit, used to determine the second attribute authorization center corresponding to the second attribute information, and obtain a third random number corresponding to the second attribute authorization center; a second generation unit, used to generate the access policy hidden factor through the target blockchain; a third processing unit, used to encrypt the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and store the encrypted second access policy to the target blockchain.

[0025] Furthermore, the device also includes: a third generation unit, used to randomly generate a tenth random number for the second attribute information in the second access policy before obtaining the data access request initiated by the target object; a fifth acquisition unit, used to obtain the first public key corresponding to the second attribute authorization center; a second calculation unit, used to calculate based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; a fourth generation unit, used to generate a second target key ciphertext based on the first initial ciphertext and the access token, and store the second target key ciphertext in the cloud server.

[0026] Furthermore, the fourth generation unit includes: a third generation subunit, used to randomly generate an eleventh random number, generate a first vector based on the eleventh random number, and randomly generate a second vector; a third calculation subunit, used to calculate the first vector and the second access strategy to obtain a first calculation result; a fourth calculation subunit, used to calculate the second vector and the second access strategy to obtain a second calculation result; a confidentiality subunit, used to encrypt the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; a fourth generation subunit, used to generate the second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0027] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the storage medium stores a program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the data processing methods described above.

[0028] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is further provided, the electronic device includes one or more processors and a memory, and the memory is used to store the data processing method implemented by one or more processors as described above.

[0029] Through the present application, the following steps are adopted: obtaining a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on security parameters and a master key, the security parameters and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hidden factor and the target attribute private key, the access policy hidden factor is used to encrypt a first access policy for the first target data, and the encrypted first access policy is stored in the target blockchain; according to the access attribute information and the encrypted first access policy to determine whether the target object has the authority to access the first target data; if the target object has the authority to access the first target data, the encrypted first target data and the first target key ciphertext are obtained according to the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, which solves the problem of low data security caused by security verification through user identity information when the user accesses the data in the related technology. In this scheme, the target attribute private key is obtained through the first attribute information of the target object, the access attribute information of the target object is obtained through the access policy hidden factor and the target attribute private key, and the access attribute information is used to determine whether the target object has the authority to access the first target data. If the target object has the authority, the encrypted first target data needs to be decrypted through the first target key ciphertext, the target attribute private key and the first auxiliary decryption key, thereby achieving the effect of improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0031] Figure 1 is a flow chart of a data processing method provided according to an embodiment of the present application;

[0032] Figure 2 is a schematic diagram of a data processing method provided according to an embodiment of the present application;

[0033] Figure 3 is a schematic diagram of a data processing device provided according to an embodiment of the present application;

[0034] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0036] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0039] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a data processing method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0040] Step S101, obtaining a data access request initiated by a target object, wherein the data access request at least includes: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hidden factor and the target attribute private key, the access policy hidden factor is used to encrypt a first access policy for the first target data, and the encrypted first access policy is stored in the target blockchain;

[0041] Optionally, the data processing method provided in the embodiment of the present application is applied to a dynamic data access control system, which mainly involves a target blockchain, an attribute authorization agency, a data owner, a data user, a distributed data storage system, and an edge server.

[0042] Target blockchain: Mainly responsible for initializing the global system by generating system parameters. It also generates long-term public-private key pairs for blockchain nodes. The platform stores metadata and verifies access policies through smart contracts, while recording and transmitting user attribute private keys on the chain in an unchangeable manner. Attribute authorization agency: Also known as "attribute authorization node", responsible for jointly managing large-scale attributes. It should be noted that the attribute authorization node here is a blockchain node on the blockchain. Each attribute authorization node issues attribute private keys for attributes in its domain to users, and sends these keys together with hidden signatures (i.e. digital signatures generated by hidden address algorithms) as on-chain transactions to users. All attribute authorization nodes are consensus nodes and are incentivized to manage newly added attributes. Data owner: Encrypted data is registered as a digital asset by calling the data tokenization smart contract on the chain. The data owner uses the attribute encryption algorithm to encrypt the symmetric key and uploads the data to IPFS (InterPlanetary File System). The data owner formulates the data access policy, compiles it into a smart contract, and deploys it on the blockchain. Data users: Also known as "data access parties", once they have enough attributes to meet the access policy, they are authorized to obtain the ciphertext key through the nearby edge server and recover it to obtain the plaintext symmetric key to decrypt the data. Distributed data storage system: For example, IPFS, in this invention, IPFS (Interplanetary File System) is used as a cloud storage provider (CSP) to store ciphertext data. Edge server: The semi-trusted edge server is responsible for calling the smart contract to verify the data user's request and provide the ciphertext key to the data user.

[0043] In an optional embodiment, the data user (i.e., the target object mentioned above) can initiate a data access request to the edge server. It should be noted that the data access request includes at least: the storage address information of the first target data to be accessed, the target attribute private key, the first auxiliary decryption key and the access attribute information.

[0044] For example, a data access request is Among them, uid' is the pseudo identity information of the target object, and UserSetup() can be run through the target blockchain to generate the user's public and private key pair (i.e. pseudo identity information). S is the above-mentioned first attribute information, dataURI is the storage address information of the above-mentioned first target data to be accessed, tpk is the above-mentioned first auxiliary decryption key, which is obtained based on the security parameter and the master key, SK uid‘ is the target attribute private key mentioned above, For the access attribute information mentioned above.

[0045] It should be noted that the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, the access attribute information is obtained based on the access policy hidden factor and the target attribute private key, the access policy hidden factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain;

[0046] Step S102: judging whether the target object has the authority to access the first target data according to the access attribute information and the encrypted first access policy.

[0047] Optionally, after receiving the above-mentioned data access request, the edge server will call the smart contract on the chain to check whether the access attribute information in the data access request complies with the encrypted first access policy, that is, through the access attribute information and the encrypted first access policy, it is determined whether the target object has the authority to access the first target data.

[0048] For example, accessing attribute information is The attribute index set associated with the encrypted first access policy is The access strategy (M, ρ) is expressed using a linear secret sharing scheme (LSSS), where M is a lxn strategy matrix and the function ρ converts each row vector M x Mapped to attribute ρ(x), x∈[1,...,l]. ρ’(x) Used to represent encrypted attribute information in access policies.

[0049] In an alternative embodiment, the and Whether the target object has the permission to access the first target data is determined by comparing the two data elements.

[0050] Step S103: if the target object has permission to access the first target data, the encrypted first target data and the first target key ciphertext are obtained according to the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data;

[0051] Optionally, if the target object has permission to access the first target data, the edge server obtains the encrypted first target data and the first target key ciphertext according to the storage address information. It should be noted that the first target key ciphertext is obtained by encrypting the access token, and the access token is used to obtain the encryption key, which is used to encrypt the first target data. The security of the data is improved by encrypting the first target data and the access token.

[0052] Step S104: decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0053] Optionally, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0054] To summarize, the target attribute private key is obtained through the first attribute information of the target object, the access attribute information of the target object is obtained through the access policy hidden factor and the target attribute private key, and whether the target object has the authority to access the first target data is determined through the access attribute information. If the target object has the authority, the encrypted first target data needs to be decrypted through the first target key ciphertext, the target attribute private key and the first auxiliary decryption key, thereby achieving the effect of improving data security.

[0055] Optionally, in the data processing method provided in the embodiment of the present application, before calculating based on the first random number, the second random number, the security parameters and the master key to obtain the first auxiliary decryption key, the following steps are used to obtain the master key and the security parameters: determine an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set consists of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; based on a preset security value, a cyclic group is generated, and based on the third random number, the master key is obtained; based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key, the security parameters are obtained.

[0056] In an optional embodiment, the attribute set currently involved is clarified and multiple attribute authorities The attribute authorization agencies are all blockchain nodes. A publicly computable function converts each user's attribute attr i,j Mapped to manage the attribute attr i AA j Each authority AA in the attribute authority domain j Select a random number (the third random number mentioned above)

[0057] Then, the security value τ∈N is set, and the blockchain runs the GlobalSetup() algorithm to generate a cyclic group Where p is the prime order of G, is a symmetric bilinear map, g is the generator of G. Define three cryptographic hash functions, H:{0,1} * →G, and Here, F maps the attribute string to an element of the group G.

[0058] The global parameter GP and the master key MSK are expressed as follows:

[0059]

[0060] MSK={μ}

[0061] Among them, the system master key

[0062] The global parameter GP and the master key MSK are obtained through the random number generated by the attribute authorization agency, realizing decentralized access control with the participation of multiple attribute authorization agencies.

[0063] Optionally, in the data processing method provided in an embodiment of the present application, obtaining a master key based on the third random number includes: performing calculation based on the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation based on the target value and the prime order of the cyclic group to obtain the master key.

[0064] In an optional embodiment, in order to ensure μ j To ensure confidentiality, the target value can be obtained by calculating the prime order of the cyclic group and the third random number, and then the master key can be obtained by calculating the target value and the prime order of the cyclic group.

[0065] For example, each attribute authority can be represented by (1+μ j ·p)\modp 2 The target value is calculated and uploaded to the target blockchain, which then uses the target value to obtain the master key.

[0066] For example, the above target value is used to calculate Then pass The above master key can be calculated.

[0067] Through the above steps, we can ensure that μ j To ensure confidentiality, decentralized access control is achieved with the participation of multiple attribute authorization agencies.

[0068] Optionally, in the data processing method provided in the embodiment of the present application, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameters and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameters, the master key and the first attribute information.

[0069] In an optional embodiment, the target attribute private key can be obtained by the following steps: First, according to the first attribute information corresponding to the target object, the corresponding first attribute authorization center is determined. For example, the number of attribute authorization agencies associated with the user attribute set is The attribute authority participating in key generation selects a random number (ie the seventh random number mentioned above).

[0070] The first attribute authorization center runs AuthSetup(·) to randomly generate the first private key Among them, α j ,β j The first public key is obtained by using the first private key and the security parameter.

[0071] The attribute private key SK corresponding to the attribute set S (i.e., the attribute set composed of the first attribute information mentioned above) is calculated through the above information uid′ For example, the target attribute private key SK is calculated by the following formula: uid′ .

[0072]

[0073] Among them, uid′ is the pseudo identity information mentioned above, attr x This is the first attribute information mentioned above.

[0074] In an optional embodiment, the user pseudo identity uid′ is obtained by running UserSetup(·) on the blockchain platform. Each data user can randomly select As the one-time user private key ousk=φ, and calculate Φ=φg as the one-time user public key oupk=Φ, the one-time user private key ousk and the one-time user public key oupk are used as the above-mentioned pseudo identity information.

[0075] By uid′ The introduction of random number t in can achieve the unlinkability of decryption keys (the same user attribute set has different decryption keys).

[0076] Optionally, in the data processing method provided in the embodiment of the present application, after obtaining the target attribute private key, the method also includes: calculating based on the second private key and pseudo-identity information of the first attribute authorization center to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining the target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0077] In an optional embodiment, in order to ensure the authenticity of the target attribute private key, the first attribute authorization center will sign the target attribute private key when generating the target attribute private key. For example, the first attribute authorization center calculates the signature private key of the first attribute authorization center based on the second private key and the pseudo-identity information.

[0078] It should be noted that the second private key of the first attribute authorization center is obtained by the following steps: The blockchain platform runs BNSetup(·) to select two random numbers (i.e. the eighth random number and the ninth random number mentioned above) as the second private key of the authorization agency, i.e. The second public key can also be obtained through the second private key and security parameters

[0079] For example, by The signature private key is calculated, where oupk = Φ is the one-time public key of the data user. Yes AA j The second private key of And Signed as That is, the target attribute private key is signed according to the pseudo-identity information and the signature private key to obtain the initial signature.

[0080] The signed attribute private key Package as a transaction (i.e. the wooden target signature mentioned above), finally, through PoA + After verification by the consensus mechanism, the data is sent to the data users on the chain (i.e. the target objects mentioned above). is the timestamp information, aid j ' is composed of the second private key and the second public key mentioned above.

[0081] In an optional embodiment, the authenticity of the target attribute private key can be verified by the following steps:

[0082] Upon receiving the secret key SK from the relevant attribute authority uid′ After that, the data user (DU) verifies the signature {σ j}, the specific steps are as follows:

[0083] Step 1: Calculation

[0084] Step 2: Based on the received Tx j ,calculate

[0085] Step 3: Calculate the derived public / verification key for each attribute authority Among them, ousk = φ is the one-time private key of the data user, apk j ={E j ,V j} is AA j The second public key.

[0086] Step 4: Check if this formula holds true If established, the data user accepts SK uid′ The output is valid; otherwise, the attribute keys are rejected and output is invalid.

[0087] Aggregate hidden signatures allow data users (DU) to verify the attribute authority AA without exposing the attribute authority's second public and private keys. j The digital signature of the transaction is used to enhance its anonymity. Secondly, by verifying the signature using a different second public key provided by the same attribute authority (AA), malicious attackers are prevented from inferring the specific attributes managed by each attribute authority. This approach ensures that transactions cannot be associated with attribute authorities, thereby enhancing privacy and anonymity within the system.

[0088] Optionally, in the data processing method provided in the embodiment of the present application, obtaining the data access request initiated by the target object includes: randomly generating a first random number and a second random number, and calculating based on the first random number, the second random number, the security parameter and the master key to obtain a first auxiliary decryption key; generating an access policy hidden factor through the target blockchain, and calculating based on the access policy hidden factor and the target attribute private key to obtain access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; obtaining the data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0089] In an optional embodiment, the following steps are used to obtain the above data access request: before initiating a data access request, the data user selects two random numbers: and (ie, the first random number and the second random number mentioned above) to generate a temporary auxiliary decryption key pair (tpk, tsk), namely, the first auxiliary decryption key and the second auxiliary decryption key mentioned above. It should be noted that the second auxiliary decryption key tsk will be kept secret by the data user.

[0090] Then, the target blockchain generates the access policy hidden factor, for example, for access policy Each attribute attr x , the blockchain selects a random number As the access policy hiding factor, and calculate The access attribute information is obtained by calculating the access policy hidden factor and the target attribute private key. For example, the data user uses D x and the target attribute key K 3,x Calculate {s ρ(x)} x∈S For example, accessing attribute information is as follows:

[0091]

[0092] Finally, a data access request is obtained through the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed. For example, the data access request is

[0093] Optionally, in the data processing method provided in the embodiment of the present application, before obtaining the data access request initiated by the target object, the method also includes: obtaining an access token and hashing the access token to obtain an encryption key; encrypting the second target data according to the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0094] In an optional embodiment, before obtaining the data access request initiated by the target object, the data owner encrypts and uploads the data. First, given a file set owned by multiple data owners (DOs), The data owner generates a key stream {k i} 1≤i≤d , then, symmetric homomorphic encryption technology is used to encrypt dynamic data. Specifically:

[0095] Let k i ′ is the key and is used to encrypt data f i The data owner calculates the ciphertext as where k i ′ is a composite key, and k i ′=k i -k i+1 .

[0096] Assume that the data owner wants to convert the data stream {f1,...,f n} Authorization is shared with data users, because the key stream of the decryption key is generated according to the key derivation tree, and k i ′=k i -k i+1 ,To decrypt the aggregate ciphertext within a certain range, only two boundary keys are needed.

[0097]

[0098] In addition, k1 and k n It can be obtained through the shared node of the binary tree, that is, the access token mentioned above.

[0099] For example, if you want to share the data stream {f1,...,f7} with data users, according to the properties of homomorphic encryption and decryption, you only need to share the two boundaries {k0,k7} with the user, and these two boundaries can be obtained by accessing the token tk through the left and right hash functions H1(·) and H2(·). Therefore, you only need to controllably share the access token tk.

[0100] Therefore, the encryption key can be obtained through the access token, and the second target data can be encrypted by the encryption key. The encrypted second target data, i.e.

[0101] The data owner uploads the ciphertext data (i.e. the encrypted second target data mentioned above) to IPFS for off-chain storage. Then, the metadata of the data is generated. And store it as a JSON file. d is a description of the data (e.g., cardiac data collected by a cardiology department, etc.), CID d Is the CID hash address of the IPFS response. d =H1(CT f )and They are the hash values ​​of the data ciphertext and the encryption key respectively. Afterwards, the data owner calls the digital asset registration smart contract to register the metadata as a digital asset on the chain and outputs Tx asset and dataURI, where Tx asset Credential information generated by the digital asset registration smart contract.

[0102] By encrypting the target data, the security of the data can be further improved.

[0103] Optionally, in the data processing method provided in an embodiment of the present application, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating an access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and storing the encrypted second access policy to the target blockchain.

[0104] In an optional embodiment, in order to improve the security of the access policy, it also includes: determining second attribute information that can access the second target data.

[0105] Each attribute authority uses its own μ j (i.e. the third random number mentioned above) calculates (1+μ j p), and exchange the results with other attribute authorities to determine B″ and B′, and then set B=g B′ Send to the target blockchain.

[0106]

[0107] For strategy Each attribute attr x , the blockchain selects a random number As a hidden factor of strategy. Blockchain will Each row of attr x Remap to Hidden Policy In the method, the following is done:

[0108]

[0109] Then, the data owner uses s ρ′(x) Replace the attribute attr corresponding to the strategy matrix x The encrypted second access policy is obtained by using the value of , and the encrypted second access policy is stored in the target blockchain.

[0110] By calculating B″ and B′, the blockchain can obtain g from the master key (MSK) B′ , without obtaining the master key fragment μ of each attribute authority (AA) j The aggregate master key μ is introduced to mask the attribute values ​​in the strategy, in order to prevent the adversary from detecting the attribute values ​​by launching attribute value guessing attacks and improve data security.

[0111] Optionally, in the data processing method provided in the embodiment of the present application, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0112] In an optional embodiment, in order to improve the security of the encryption key, the method further includes: randomly generating a tenth random number for the second attribute information in the second access policy. Through the tenth random number, the second attribute information and the first public key Perform calculation to obtain the first initial ciphertext.

[0113] For example, the first initial ciphertext is ICT k :

[0114]

[0115]

[0116] It should be noted that since the first initial ciphertext will not change, it can be encrypted off-chain and can be reused to generate the second target key ciphertext CT tk , thereby reducing encryption overhead.

[0117] Finally, the second target key ciphertext is generated through the first initial ciphertext and the access token, and the second target key ciphertext is stored in the cloud server. It should be noted that there is a corresponding relationship between the second target key ciphertext and the encrypted second target data.

[0118] Optionally, in the data processing method provided in the embodiment of the present application, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access strategy to obtain a first calculation result; calculating the second vector and the second access strategy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0119] In an optional embodiment, generating the second target key ciphertext includes: using a linear secret sharing scheme (LSSS) to express the access policy here, is a The strategy matrix is ​​defined in The function ρ converts each row vector Mapped to attribute ρ(x), where

[0120] First, randomly generate the eleventh random number And generate the vector (i.e. the first vector mentioned above) and (i.e. the second vector mentioned above), where

[0121] Then, the first vector and the second access strategy are calculated to obtain a first calculation result; the second vector and the second access strategy are calculated to obtain a second calculation result. For example, the first calculation result The second calculation result ), where M x is the xth row of M.

[0122] For a certain access token tk, its on-chain ciphertext is calculated as follows:

[0123]

[0124] Therefore, the complete key ciphertext (ie, the second target key ciphertext mentioned above) is obtained:

[0125]

[0126] Optionally, in the data processing method provided in the embodiment of the present application, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain an encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0127] In an optional embodiment, decrypting the encrypted first target data includes the following steps: obtaining CT tk (i.e. the first target key ciphertext mentioned above), SK uid′ and tpk, the edge server calculates the partial ciphertext PCT tk As shown below:

[0128]

[0129] Therefore, the edge server obtains the semi-decrypted ciphertext It is then sent to the data user.

[0130] Data users receive And use tsk to fully decrypt PCT tk , the access token tk is output by the following formula:

[0131]

[0132] Finally, the data user uses the access token to obtain two boundary keys k1, k n .

[0133] (1) Based on the two boundary keys and the following formula, the aggregate encryption key can be obtained:

[0134]

[0135] (2) To decrypt a given key k i ′The plaintext data m i , you can perform decryption operations

[0136] (3) Based on the aggregate key and aggregate ciphertext The aggregated plaintext data can be obtained through the following formula.

[0137]

[0138] In an alternative embodiment, the Figure 2 The schematic diagram of data access control is implemented as follows: Figure 2 As shown, it is divided into the following stages: system initialization, data encryption and upload, attribute private key generation, access verification and data decryption.

[0139] Phase 1: System initialization: The blockchain initialization system generates security parameters and master keys, and generates long-term public / private key pairs (i.e., the second public key and the second private key mentioned above) for users (including data owners, data users, attribute authorities / attribute management authorization nodes). The attribute authority generates a public / private key pair (i.e., the first public key and the first private key mentioned above) for the attributes it controls.

[0140] Phase 2: Data encryption and upload: The data owner uses a homomorphic encryption algorithm to encrypt its file data and uploads it to IPFS (InterPlanetary File System, a distributed data storage system). In addition, the key for the encrypted data is encrypted using the "attribute encryption of ciphertext strategy" algorithm using on-chain and off-chain mechanisms to obtain the key ciphertext (i.e., the first target key ciphertext mentioned above). At the same time, the access policy for the data is also obfuscated and hidden on the chain.

[0141] Phase 3: Attribute private key generation: Multiple attribute authorities generate attribute private keys for users (i.e., data requesters / users) and digitally sign their own generated attribute private keys with hidden addresses.

[0142] Phase 4: Access verification: The data user receives the transaction Tx of the signature key from the relevant attribute authority j The user verifies the hidden digital signature attached to the attribute private key. If the aggregated hidden signature of the attribute private key is valid, the user generates an access request to download the ciphertext based on the attribute private key and sends the data request to the edge server near it.

[0143] Phase 5: Data decryption: The edge server calls the smart contract to verify whether the user's attribute set meets the access policy. After verifying that the user's attribute set meets the policy, the edge server downloads the ciphertext from IPFS and returns the decrypted partial ciphertext to the user. The user fully decrypts to recover the plaintext key and data.

[0144] The data processing method provided by the embodiment of the present application obtains a data access request initiated by a target object, wherein the data access request at least includes: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, the access attribute information is obtained based on the access policy hidden factor and the target attribute private key, the access policy hidden factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; according to the access attribute Information and the encrypted first access policy are used to determine whether the target object has the authority to access the first target data; if the target object has the authority to access the first target data, the encrypted first target data and the first target key ciphertext are obtained according to the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, which solves the problem of low data security caused by security verification through user identity information when the user accesses the data in the related technology. In this scheme, the target attribute private key is obtained through the first attribute information of the target object, the access attribute information of the target object is obtained through the access policy hidden factor and the target attribute private key, and the access attribute information is used to determine whether the target object has the authority to access the first target data. If the target object has the authority, the encrypted first target data needs to be decrypted through the first target key ciphertext, the target attribute private key and the first auxiliary decryption key, thereby achieving the effect of improving data security.

[0145] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0146] The embodiment of the present application also provides a data processing device. It should be noted that the data processing device of the embodiment of the present application can be used to execute the data processing method provided by the embodiment of the present application. The data processing device provided by the embodiment of the present application is introduced below.

[0147] Figure 3 is a schematic diagram of a data processing device according to an embodiment of the present application. Figure 3 As shown, the device includes: a first acquisition unit 301, a judgment unit 302, a second acquisition unit 303 and a first processing unit 304.

[0148] A first acquisition unit 301 is used to acquire a data access request initiated by a target object, wherein the data access request at least includes: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, and the access attribute information is obtained based on the access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain;

[0149] A judging unit 302, configured to judge whether the target object has the authority to access the first target data according to the access attribute information and the encrypted first access policy;

[0150] The second acquisition unit 303 is used to acquire the encrypted first target data and the first target key ciphertext according to the storage address information if the target object has the permission to access the first target data, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data;

[0151] The first processing unit 304 is used to decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0152] Optionally, in the data processing device provided in the embodiment of the present application, the processing unit includes: a first decryption sub-unit, used to decrypt the first target key ciphertext based on the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated by the first random number and the second random number; a transformation sub-unit, used to perform a hash transformation on the access token to obtain an encryption key; and a second decryption sub-unit, used to decrypt the encrypted first target data based on the encryption key and the security parameter to obtain the first target data.

[0153] Optionally, in the data processing device provided in an embodiment of the present application, the first acquisition unit includes: a first generation subunit, used to randomly generate a first random number and a second random number, and calculate based on the first random number, the second random number, the security parameter and the master key to obtain a first auxiliary decryption key; a second generation subunit, used to generate an access policy hidden factor through the target blockchain, and calculate based on the access policy hidden factor and the target attribute private key to obtain access attribute information; a first determination subunit, used to obtain a target attribute private key based on the first attribute information corresponding to the target object; a second determination subunit, used to obtain a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0154] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a first determination unit, used to determine an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; a first generation unit, used to generate a cyclic group based on a preset security value, and obtain the master key based on the third random number; a second determination unit, used to obtain the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0155] Optionally, in the data processing device provided in an embodiment of the present application, the first generation unit includes: a first calculation subunit, used to perform calculations based on the prime order of the cyclic group and a third random number to obtain a target value; a second calculation subunit, used to perform calculations based on the target value and the prime order of the cyclic group to obtain a master key.

[0156] Optionally, in the data processing device provided in the embodiment of the present application, the first determination subunit includes: a determination module, used to determine the first attribute authorization center corresponding to the first attribute information, and obtain the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by the fourth random number and the fifth random number; an acquisition module, used to obtain the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by the sixth random number; a random module, used to randomly generate a seventh random number, and obtain the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0157] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a first calculation unit, used to, after obtaining the target attribute private key, perform calculations based on the second private key and pseudo-identity information of the first attribute authorization center to obtain a signature private key of the first attribute authorization center, wherein the second private key is obtained by an eighth random number and a ninth random number; a signature unit, used to sign the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; a third determination unit, used to obtain a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0158] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a third acquisition unit, used to obtain an access token before obtaining a data access request initiated by the target object, and hash the access token to obtain an encryption key; a second processing unit, used to encrypt the second target data according to the encryption key to obtain encrypted second target data; a fourth acquisition unit, used to store the encrypted second target data in a cloud server, and obtain metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; a storage unit, used to store the metadata information in the target blockchain.

[0159] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a fourth determination unit, used to determine the second attribute information after storing the metadata information in the target blockchain, and generate a second access policy for the second target data based on the second attribute information; a fifth determination unit, used to determine the second attribute authorization center corresponding to the second attribute information, and obtain a third random number corresponding to the second attribute authorization center; a second generation unit, used to generate an access policy hidden factor through the target blockchain; a third processing unit, used to encrypt the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and store the encrypted second access policy to the target blockchain.

[0160] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a third generation unit, used to randomly generate a tenth random number for the second attribute information in the second access policy before obtaining the data access request initiated by the target object; a fifth acquisition unit, used to obtain the first public key corresponding to the second attribute authorization center; a second calculation unit, used to calculate based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; a fourth generation unit, used to generate a second target key ciphertext based on the first initial ciphertext and the access token, and store the second target key ciphertext in the cloud server.

[0161] Optionally, in the data processing device provided in the embodiment of the present application, the fourth generation unit includes: a third generation subunit, used to randomly generate an eleventh random number, generate a first vector based on the eleventh random number, and randomly generate a second vector; a third calculation subunit, used to calculate the first vector and the second access strategy to obtain a first calculation result; a fourth calculation subunit, used to calculate the second vector and the second access strategy to obtain a second calculation result; a confidentiality subunit, used to encrypt the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; and a fourth generation subunit, used to generate a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0162] The data processing device provided by the embodiment of the present application obtains a data access request initiated by a target object through a first acquisition unit 301, wherein the data access request at least includes: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, and the access attribute information is obtained based on the access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; the judgment unit 302 determines the access attribute information based on the access attribute information and the encrypted first access policy, to determine whether the target object has the authority to access the first target data; the second acquisition unit 303, if the target object has the authority to access the first target data, obtains the encrypted first target data and the first target key ciphertext according to the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the first processing unit 304, is used to decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, which solves the problem of low data security caused by security verification through user identity information when the user accesses the data in the related technology. In this solution, the target attribute private key is obtained through the first attribute information of the target object, the access attribute information of the target object is obtained through the access policy hidden factor and the target attribute private key, and the access attribute information is used to determine whether the target object has the authority to access the first target data. If the target object has the authority, the encrypted first target data needs to be decrypted through the first target key ciphertext, the target attribute private key and the first auxiliary decryption key, thereby achieving the effect of improving data security.

[0163] The data processing device includes a processor and a memory. The above-mentioned first acquisition unit 301, judgment unit 302, second acquisition unit 303 and first processing unit 304 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0164] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and data access control is achieved by adjusting kernel parameters.

[0165] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0166] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a data processing method is implemented.

[0167] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a data processing method when it is run.

[0168] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, the device includes a processor, a memory and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: obtaining a data access request initiated by a target object, wherein the data access request at least includes: storage address information of a first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, and the access policy hiding factor is used The method comprises the steps of: encrypting a first access policy for first target data, and storing the encrypted first access policy in a target blockchain; judging whether the target object has the permission to access the first target data according to the access attribute information and the encrypted first access policy; obtaining the encrypted first target data and the first target key ciphertext according to the storage address information if the target object has the permission to access the first target data, wherein the first target key ciphertext is obtained by encrypting an access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; decrypting the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0169] Optionally, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain an encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0170] Optionally, obtaining a data access request initiated by a target object includes: randomly generating a first random number and a second random number, and calculating based on the first random number, the second random number, the security parameter and the master key to obtain a first auxiliary decryption key; generating an access policy hidden factor through the target blockchain, and calculating based on the access policy hidden factor and the target attribute private key to obtain access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; obtaining a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0171] Optionally, before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the method also includes: determining an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; generating a cyclic group based on a preset security value, and obtaining the master key based on the third random number; obtaining the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0172] Optionally, obtaining the master key according to the third random number includes: performing calculation according to the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation according to the target value and the prime order of the cyclic group to obtain the master key.

[0173] Optionally, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0174] Optionally, after obtaining the target attribute private key, the method also includes: calculating based on the second private key and pseudo-identity information of the first attribute authorization center to obtain a signature private key of the first attribute authorization center, wherein the second private key is obtained by an eighth random number and a ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and security parameters, and the target signature is used to verify the authenticity of the target attribute private key.

[0175] Optionally, before obtaining the data access request initiated by the target object, the method also includes: obtaining an access token and hashing the access token to obtain an encryption key; encrypting the second target data according to the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0176] Optionally, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating an access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0177] Optionally, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0178] Optionally, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0179] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0180] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: obtaining a data access request initiated by a target object, wherein the data access request at least includes: storage address information of a first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, and the access policy hiding factor is used to access the first target data. The first access policy is encrypted, and the encrypted first access policy is stored in the target blockchain; based on the access attribute information and the encrypted first access policy, it is determined whether the target object has the authority to access the first target data; if the target object has the authority to access the first target data, the encrypted first target data and the first target key ciphertext are obtained based on the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the encrypted first target data is decrypted based on the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0181] Optionally, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain an encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0182] Optionally, obtaining a data access request initiated by a target object includes: randomly generating a first random number and a second random number, and calculating based on the first random number, the second random number, the security parameter and the master key to obtain a first auxiliary decryption key; generating an access policy hidden factor through the target blockchain, and calculating based on the access policy hidden factor and the target attribute private key to obtain access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; obtaining a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0183] Optionally, before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the method also includes: determining an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; generating a cyclic group based on a preset security value, and obtaining the master key based on the third random number; and obtaining the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0184] Optionally, obtaining the master key according to the third random number includes: performing calculation according to the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation according to the target value and the prime order of the cyclic group to obtain the master key.

[0185] Optionally, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0186] Optionally, after obtaining the target attribute private key, the method also includes: calculating based on the second private key and pseudo-identity information of the first attribute authorization center to obtain a signature private key of the first attribute authorization center, wherein the second private key is obtained by an eighth random number and a ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and security parameters, and the target signature is used to verify the authenticity of the target attribute private key.

[0187] Optionally, before obtaining the data access request initiated by the target object, the method also includes: obtaining an access token and hashing the access token to obtain an encryption key; encrypting the second target data according to the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0188] Optionally, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating an access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0189] Optionally, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0190] Optionally, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0191] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0192] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0193] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0194] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0195] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0196] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0197] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0198] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0199] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0200] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A data processing method, It is characterized in that include: Obtain a data access request initiated by a target object, wherein the data access request includes at least: storage address information of a first target data to be accessed, a target attribute private key, a first auxiliary decryption key, and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, wherein the access policy hiding factor is used to encrypt a first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; Determining whether the target object has permission to access the first target data according to the access attribute information and the encrypted first access policy; If the target object has permission to access the first target data, obtaining the encrypted first target data and the first target key ciphertext according to the storage address information, wherein the first target key ciphertext is obtained by encrypting an access token, the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data; The encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

2. The method according to claim 1, It is characterized in that Decrypting the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data includes: Decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated by the first random number and the second random number; Performing a hash transformation on the access token to obtain the encryption key; The encrypted first target data is decrypted according to the encryption key and the security parameter to obtain the first target data.

3. The method according to claim 1, It is characterized in that The data access request initiated by the target object includes: Randomly generate a first random number and a second random number, and perform calculation according to the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key; Generate the access policy hidden factor through the target blockchain, and calculate according to the access policy hidden factor and the target attribute private key to obtain the access attribute information; Obtaining the target attribute private key according to the first attribute information corresponding to the target object; The data access request is obtained according to the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

4. The method according to claim 3, It is characterized in that Before obtaining the first auxiliary decryption key by performing calculation according to the first random number, the second random number, the security parameter, and the master key, the method further includes: Determine an attribute set, a plurality of attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set consists of a plurality of attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; Generate a cyclic group according to a preset security value, and obtain the master key according to the third random number; The security parameter is obtained according to the cyclic group, the attribute set, the multiple attribute authority centers and the master key.

5. The method according to claim 4, It is characterized in that Obtaining the master key according to the third random number includes: Calculating according to the prime order of the cyclic group and the third random number to obtain a target value; The master key is obtained by performing calculation according to the target value and the prime order of the cyclic group.

6. The method according to claim 3, It is characterized in that Obtaining the target attribute private key according to the first attribute information corresponding to the target object includes: Determine a first attribute authorization center corresponding to the first attribute information, and obtain a first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and a first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; Acquire pseudo identity information of the target object, wherein the pseudo identity information is obtained by a sixth random number; A seventh random number is randomly generated, and the target attribute private key is obtained according to the seventh random number, the pseudo identity information, the first public key, the security parameter, the master key and the first attribute information.

7. The method according to claim 6, It is characterized in that After obtaining the target attribute private key, the method further includes: Calculate according to the second private key of the first attribute authorization center and the pseudo identity information to obtain a signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; Signing the target attribute private key according to the pseudo identity information and the signature private key to obtain an initial signature; A target signature is obtained based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

8. The method according to claim 1, It is characterized in that Before obtaining the data access request initiated by the target object, the method further includes: Obtain the access token, and perform hashing on the access token to obtain the encryption key; Encrypting the second target data according to the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information at least includes: a storage address and description information of the encrypted second target data; The metadata information is stored in the target blockchain.

9. The method according to claim 8, It is characterized in that After storing the metadata information in the target blockchain, the method further includes: Determine second attribute information, and generate a second access policy for the second target data based on the second attribute information; Determine a second attribute authorization center corresponding to the second attribute information, and obtain a third random number corresponding to the second attribute authorization center; Generate the access policy hidden factor through the target blockchain; The second access policy is encrypted according to the third random number and the access policy hidden factor to obtain an encrypted second access policy, and the encrypted second access policy is stored in the target blockchain.

10. The method according to claim 9, It is characterized in that Before obtaining the data access request initiated by the target object, the method further includes: For the second attribute information in the second access policy, randomly generate a tenth random number; Obtaining a first public key corresponding to the second attribute authorization center; Calculate according to the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; A second target key ciphertext is generated according to the first initial ciphertext and the access token, and the second target key ciphertext is stored in the cloud server.

11. The method according to claim 10, It is characterized in that Generating a second target key ciphertext according to the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector according to the eleventh random number, and randomly generating a second vector; Calculating the first vector and the second access strategy to obtain a first calculation result; Calculating the second vector and the second access strategy to obtain a second calculation result; Encrypting the access token according to the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; The second target key ciphertext is generated according to the first initial ciphertext and the second initial ciphertext.

12. A data processing device, It is characterized in that include: a first acquisition unit, configured to acquire a data access request initiated by a target object, wherein the data access request at least includes: storage address information of a first target data to be accessed, a target attribute private key, a first auxiliary decryption key, and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt a first access policy of the first target data, and the encrypted first access policy is stored in a target blockchain; a judging unit, configured to judge whether the target object has permission to access the first target data according to the access attribute information and the encrypted first access policy; a second acquisition unit, configured to acquire the encrypted first target data and a first target key ciphertext according to the storage address information if the target object has permission to access the first target data, wherein the first target key ciphertext is obtained by encrypting an access token, the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data; The first processing unit is used to decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

13. A computer-readable storage medium, It is characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the storage medium is controlled to execute the data processing method according to any one of claims 1 to 11 on a device.

14. An electronic device, It is characterized in that It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the data processing method described in any one of claims 1 to 11.

Images