Data processing method and device, storage medium and electronic device

Abstract

The present application discloses a data processing method and device, a storage medium, and an electronic device. Relating to the field of data security technology, the method comprises: obtaining a data access request initiated by a target object; judging whether the target object has permission to access the first target data based on access attribute information and an encrypted first access policy; if the target object has permission to access the first target data, obtaining the encrypted first target data and the first target key ciphertext based on the storage address information; decrypting the encrypted first target data based on the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data. This application solves the problem in the related art of performing security verification through user identity information when a user accesses data, resulting in low data security.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and more specifically, to a data processing method and device, a storage medium, and an electronic device. Background Art

[0002] With the continuous development of edge cloud computing, edge servers, as a bridge between cloud services and IoT end users, play a key role in caching and disseminating data collected by IoT devices (such as wearable monitoring devices and smart sensors), as well as data stored in the cloud. This data can be shared with multiple users, which is conducive to the development of diversified businesses. For example, users can collect health data such as heart rate, respiratory rate, and body fat percentage through mobile terminals such as smart watches and mobile phones, and share it with doctors to help doctors assess the user's physical health and diagnose diseases. However, this data is often sensitive, so how to share it in a controllable and secure manner is crucial. In existing technologies, access control is often achieved through user identity information, but this approach has the problem of poor data security.

[0003] Currently, no effective solution has been proposed to address the problem in related technologies where security verification is performed using user identity information when users access data, resulting in low data security. Summary of the Invention

[0004] The main purpose of this application is to provide a data processing method and device, a storage medium and an electronic device to solve the problem in the related art that security verification is performed through user identity information when the user accesses data, resulting in low data security.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a data processing method is provided. The method comprises: obtaining a data access request initiated by a target object, wherein the data access request at least comprises: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target area. In a block chain; based on the access attribute information and the encrypted first access policy, determine whether the target object has the permission to access the first target data; if the target object has the permission to access the first target data, obtain the encrypted first target data and the first target key ciphertext based on the storage address information, wherein the first target key ciphertext is obtained by encrypting an access token, and the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data; decrypt the encrypted first target data based on the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0006] Furthermore, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain the encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0007] Furthermore, obtaining a data access request initiated by a target object includes: randomly generating a first random number and a second random number, and performing calculation based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key; generating the access policy hiding factor through the target blockchain, and performing calculation based on the access policy hiding factor and the target attribute private key to obtain the access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; and obtaining the data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0008] Furthermore, before performing calculation based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the method also includes: determining an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; generating a cyclic group based on a preset security value, and obtaining the master key based on the third random number; and obtaining the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0009] Furthermore, obtaining the master key based on the third random number includes: performing calculation based on the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation based on the target value and the prime order of the cyclic group to obtain the master key.

[0010] Furthermore, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0011] Furthermore, after obtaining the target attribute private key, the method also includes: performing calculation based on the second private key of the first attribute authorization center and the pseudo-identity information to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0012] Furthermore, before obtaining the data access request initiated by the target object, the method also includes: obtaining the access token and performing hashing on the access token to obtain the encryption key; encrypting the second target data based on the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information at least includes: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0013] Furthermore, after storing the metadata information in the target blockchain, the method also includes: determining second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining a second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating the access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain an encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0014] Furthermore, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating the second attribute information and the first public key based on the tenth random number to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0015] Furthermore, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating the second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0016] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a data processing device is provided. The device includes: a first acquisition unit, which is used to acquire a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; a judgment unit , used to determine whether the target object has the permission to access the first target data based on the access attribute information and the encrypted first access policy; a second acquisition unit, used to obtain the encrypted first target data and the first target key ciphertext based on the storage address information if the target object has the permission to access the first target data, wherein the first target key ciphertext is obtained by encrypting the access token, and the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; a first processing unit, used to decrypt the encrypted first target data based on the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0017] Furthermore, the processing unit includes: a first decryption subunit, used to decrypt the first target key ciphertext based on the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated by the first random number and the second random number; a transformation subunit, used to perform a hash transformation on the access token to obtain the encryption key; a second decryption subunit, used to decrypt the encrypted first target data based on the encryption key and the security parameter to obtain the first target data.

[0018] Furthermore, the first acquisition unit includes: a first generation subunit, used to randomly generate a first random number and a second random number, and calculate based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key; a second generation subunit, used to generate the access policy hiding factor through the target blockchain, and calculate based on the access policy hiding factor and the target attribute private key to obtain the access attribute information; a first determination subunit, used to obtain the target attribute private key based on the first attribute information corresponding to the target object; a second determination subunit, used to obtain the data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0019] Furthermore, the device also includes: a first determination unit, used to determine an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; a first generation unit, used to generate a cyclic group based on a preset security value, and obtain the master key based on the third random number; a second determination unit, used to obtain the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0020] Furthermore, the first generation unit includes: a first calculation subunit, used to calculate based on the prime order of the cyclic group and the third random number to obtain a target value; a second calculation subunit, used to calculate based on the target value and the prime order of the cyclic group to obtain the master key.

[0021] Furthermore, the first determination subunit includes: a determination module, used to determine the first attribute authorization center corresponding to the first attribute information, and obtain the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by a fourth random number and a fifth random number; an acquisition module, used to obtain the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; a random module, used to randomly generate a seventh random number, and obtain the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0022] Furthermore, the device also includes: a first calculation unit, used to, after obtaining the target attribute private key, perform calculation based on the second private key of the first attribute authorization center and the pseudo identity information to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; a signature unit, used to sign the target attribute private key based on the pseudo identity information and the signature private key to obtain an initial signature; a third determination unit, used to obtain a target signature based on the initial signature, the pseudo identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0023] Furthermore, the device also includes: a third acquisition unit, used to obtain the access token before obtaining the data access request initiated by the target object, and hash the access token to obtain the encryption key; a second processing unit, used to encrypt the second target data according to the encryption key to obtain encrypted second target data; a fourth acquisition unit, used to store the encrypted second target data in a cloud server, and obtain metadata information of the encrypted second target data from the cloud server, wherein the metadata information at least includes: the storage address and description information of the encrypted second target data; a storage unit, used to store the metadata information in the target blockchain.

[0024] Furthermore, the device also includes: a fourth determination unit, used to determine the second attribute information after storing the metadata information in the target blockchain, and generate a second access policy for the second target data based on the second attribute information; a fifth determination unit, used to determine the second attribute authorization center corresponding to the second attribute information, and obtain a third random number corresponding to the second attribute authorization center; a second generation unit, used to generate the access policy hidden factor through the target blockchain; a third processing unit, used to encrypt the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and store the encrypted second access policy in the target blockchain.

[0025] Furthermore, the device also includes: a third generation unit, used to randomly generate a tenth random number for the second attribute information in the second access policy before obtaining the data access request initiated by the target object; a fifth acquisition unit, used to obtain the first public key corresponding to the second attribute authorization center; a second calculation unit, used to calculate based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; a fourth generation unit, used to generate a second target key ciphertext based on the first initial ciphertext and the access token, and store the second target key ciphertext in the cloud server.

[0026] Furthermore, the fourth generation unit includes: a third generation subunit, used to randomly generate an eleventh random number, and generate a first vector based on the eleventh random number, and randomly generate a second vector; a third calculation subunit, used to calculate the first vector and the second access policy to obtain a first calculation result; a fourth calculation subunit, used to calculate the second vector and the second access policy to obtain a second calculation result; a confidentiality subunit, used to encrypt the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; and a fourth generation subunit, used to generate the second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0027] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, which stores a program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the data processing methods described above.

[0028] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is further provided, which includes one or more processors and a memory, and the memory is used to store the data processing method described above implemented by one or more processors.

[0029] Through this application, the following steps are adopted: obtaining a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, the access attribute information is obtained based on the access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; according to the access attribute information and the encrypted first access policy to determine whether the target object has permission to access the first target data; if the target object has permission to access the first target data, the encrypted first target data and the first target key ciphertext are obtained based on the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the encrypted first target data is decrypted based on the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data, thereby solving the problem in the related art of performing security verification based on user identity information when the user accesses data, resulting in low data security. In this solution, the target attribute private key is obtained based on the first attribute information of the target object, the access attribute information of the target object is obtained based on the access policy hidden factor and the target attribute private key, and the access attribute information is used to determine whether the target object has permission to access the first target data. If the target object has permission, the encrypted first target data needs to be decrypted based on the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key, thereby achieving the effect of improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0031] Figure 1 is a flow chart of a data processing method provided according to an embodiment of the present application;

[0032] Figure 2 is a schematic diagram of a data processing method provided according to an embodiment of the present application;

[0033] Figure 3 is a schematic diagram of a data processing device provided according to an embodiment of the present application;

[0034] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0036] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display and analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0039] The present invention will be described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a data processing method according to an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0040] Step S101: Obtain a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key, and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt a first access policy for the first target data, and the encrypted first access policy is stored in the target blockchain;

[0041] Optionally, the data processing method provided in the embodiment of the present application is applied to a dynamic data access control system, which mainly involves a target blockchain, an attribute authorization agency, a data owner, a data user, a distributed data storage system, and an edge server.

[0042] The target blockchain is primarily responsible for initializing the global system by generating system parameters. It also generates long-term public-private key pairs for blockchain nodes. The platform uses smart contracts to store metadata and verify access policies, while also immutably recording and transmitting user attribute private keys on-chain. Attribute Authorization Bodies, also known as "Attribute Authorization Nodes," are responsible for jointly managing large-scale attributes. It should be noted that attribute authorization nodes are blockchain nodes on the blockchain. Each attribute authorization node issues attribute private keys for attributes within its domain to users and sends these keys, along with a stealth signature (a digital signature generated using a stealth address algorithm), as an on-chain transaction. All attribute authorization nodes are consensus nodes and are incentivized to manage newly added attributes. Data owners register encrypted data as digital assets by invoking an on-chain data tokenization smart contract. Data owners encrypt symmetric keys using attribute encryption algorithms and upload the data to IPFS (InterPlanetary File System). Data owners formulate data access policies, compile them into smart contracts, and deploy them on the blockchain. Data users: Also known as "data access parties," once they possess sufficient attributes to satisfy the access policy, are authorized to obtain the ciphertext key from a nearby edge server and recover it to obtain the plaintext symmetric key, thereby decrypting the data. Distributed data storage systems: For example, IPFS (InterPlanetary File System) is used as a cloud storage provider (CSP) to store ciphertext data. Edge servers: Semi-trusted edge servers are responsible for invoking smart contracts to verify data user requests and provide the ciphertext key to the data user.

[0043] In an optional embodiment, the data user (i.e., the target object mentioned above) can initiate a data access request to the edge server. It should be noted that the data access request includes at least: the storage address information of the first target data to be accessed, the target attribute private key, the first auxiliary decryption key and the access attribute information.

[0044] For example, a data access request is Wherein, uid' is the pseudo-identity information of the target object, and UserSetup() can be run on the target blockchain to generate the user's public and private key pair (i.e., pseudo-identity information). S is the first attribute information mentioned above, dataURI is the storage address information of the first target data to be accessed, tpk is the first auxiliary decryption key mentioned above, which is obtained based on the security parameters and the master key, SK uid‘ is the target attribute private key mentioned above, For the access attribute information mentioned above.

[0045] It should be noted that the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, and the access attribute information is obtained based on the access policy hiding factor and the target attribute private key. The access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain.

[0046] Step S102: judging whether the target object has permission to access the first target data based on the access attribute information and the encrypted first access policy.

[0047] Optionally, after receiving the above-mentioned data access request, the edge server will call the smart contract on the chain to check whether the access attribute information in the data access request complies with the encrypted first access policy, that is, through the access attribute information and the encrypted first access policy, determine whether the target object has the authority to access the first target data.

[0048] For example, accessing attribute information is The attribute index set associated with the encrypted first access policy is Among them, the access strategy (M, ρ) is expressed using the linear secret sharing scheme (LSSS), where M is a lxn strategy matrix and the function ρ converts each row vector M x Mapped to attribute ρ(x), x∈[1,...,l]. S ρ’(x) Used to represent encrypted attribute information in access policies.

[0049] In an alternative embodiment, the and Whether the target object has the permission to access the first target data is determined by determining whether the target object is equal.

[0050] Step S103: If the target object has permission to access the first target data, the encrypted first target data and the first target key ciphertext are obtained based on the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data;

[0051] Optionally, if the target object has permission to access the first target data, the edge server obtains the encrypted first target data and the first target key ciphertext based on the storage address information. It should be noted that the first target key ciphertext is obtained by encrypting the access token, which is used to obtain the encryption key, which is used to encrypt the first target data. Encrypting the first target data and the access token improves data security.

[0052] Step S104 : decrypting the encrypted first target data according to the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data.

[0053] Optionally, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0054] To sum up, the target attribute private key is obtained through the first attribute information of the target object, the access attribute information of the target object is obtained through the access policy hidden factor and the target attribute private key, and whether the target object has the authority to access the first target data is judged through the access attribute information. If the target object has the authority, the encrypted first target data needs to be decrypted through the first target key ciphertext, the target attribute private key and the first auxiliary decryption key, thereby achieving the effect of improving data security.

[0055] Optionally, in the data processing method provided in the embodiment of the present application, before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the following steps are adopted to obtain the master key and the security parameter: determine the attribute set, multiple attribute authorization centers and the third random number corresponding to each attribute authorization center, wherein the attribute set consists of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; based on a preset security value, generate a cyclic group, and based on the third random number, obtain the master key; based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key, obtain the security parameter.

[0056] In an optional embodiment, the attribute set currently involved is clarified and multiple attribute authorities Attribute authorization agencies are all blockchain nodes. A publicly computable function converts each user's attribute attr i,j Mapped to manage the attribute attr i Authorized by AA j Each authority AA in the attribute authority domain j Select a random number (the third random number mentioned above)

[0057] Then, set the security value τ∈N, and the blockchain runs the GlobalSetup() algorithm to generate a cyclic group Where p is the prime order of G, It is a symmetric bilinear map, g is the generator of G. Define three cryptographic hash functions, H:{0,1} * →G, and Here, F maps the attribute string to an element of the group G.

[0058] The global parameter GP and master key MSK are expressed as follows:

[0059]

[0060] MSK={μ}

[0061] Among them, the system master key

[0062] The global parameter GP and the master key MSK are obtained through the random number generated by the attribute authorization agency, realizing decentralized access control with the participation of multiple attribute authorization agencies.

[0063] Optionally, in the data processing method provided in an embodiment of the present application, obtaining the master key based on the third random number includes: performing calculation based on the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation based on the target value and the prime order of the cyclic group to obtain the master key.

[0064] In an optional embodiment, to ensure μ j To ensure confidentiality, the target value can be obtained by calculating the prime order of the cyclic group and the third random number, and then the master key can be obtained by calculating the target value and the prime order of the cyclic group.

[0065] For example, each attribute authority center passes (1+μ j ·p)\modp 2 The target value is calculated and uploaded to the target blockchain, which then uses the target value to obtain the master key.

[0066] For example, the target value above is calculated to obtain Then pass The above master key can be calculated.

[0067] Through the above steps, we can ensure that μ j To ensure confidentiality, it realizes decentralized access control with the participation of multiple attribute authorization agencies.

[0068] Optionally, in the data processing method provided in an embodiment of the present application, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by the fourth random number and the fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by the sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0069] In an optional embodiment, the target attribute private key can be obtained by the following steps: First, according to the first attribute information corresponding to the target object, the corresponding first attribute authorization center is determined. For example, the number of attribute authorization agencies associated with the user attribute set is The attribute authority participating in key generation selects a random number (i.e. the seventh random number mentioned above).

[0070] The first attribute authorization center runs AuthSetup(·) to randomly generate the first private key Among them, α j ,β j The first public key is obtained by using the first private key and the security parameter.

[0071] The attribute private key SK corresponding to the attribute set S (i.e., the attribute set composed of the first attribute information mentioned above) is calculated using the above information uid′ For example, the target attribute private key SK is calculated by the following formula: uid′ .

[0072]

[0073] Among them, uid′ is the pseudo identity information mentioned above, attr x This is the first attribute information mentioned above.

[0074] In an optional embodiment, the user pseudo identity uid′ is obtained by running UserSetup(·) on the blockchain platform. Each data user can randomly select As the one-time user private key ousk=φ, and calculate Φ=φg as the one-time user public key oupk=Φ, the one-time user private key ousk and the one-time user public key oupk are used as the above-mentioned pseudo identity information.

[0075] By uid′ The introduction of random number t can achieve the unlinkability of decryption keys (the same user attribute set has different decryption keys).

[0076] Optionally, in the data processing method provided in the embodiment of the present application, after obtaining the target attribute private key, the method further includes: calculating based on the second private key and pseudo-identity information of the first attribute authorization center to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining the target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0077] In an optional embodiment, in order to ensure the authenticity of the target attribute private key, the first attribute authorization center will sign the target attribute private key when generating the target attribute private key. For example, the first attribute authorization center calculates the signature private key of the first attribute authorization center based on the second private key and the pseudo-identity information.

[0078] It should be noted that the second private key of the first attribute authorization center is obtained by the following steps: the blockchain platform runs BNSetup(·) and selects two random numbers (i.e. the eighth random number and the ninth random number mentioned above) as the second private key of the authorization agency, i.e. The second public key can also be obtained through the second private key and security parameters

[0079] For example, by Calculate the signature private key, where oupk = Φ is the one-time public key of the data user, It's AA j The second private key of And Signed as That is, the target attribute private key is signed according to the pseudo identity information and the signature private key to obtain the initial signature.

[0080] The signed attribute private key Packaged as a transaction (ie the wooden target signature mentioned above), finally, through PoA + After verification by the consensus mechanism, the data is sent to the data users on the chain (i.e. the target objects mentioned above). timestamp information, aid j ' is composed of the second private key and the second public key mentioned above.

[0081] In an optional embodiment, the authenticity of the target attribute private key can be verified by the following steps:

[0082] Upon receiving the secret key SK from the relevant attribute authority uid′ After that, the data user (DU) verifies the signature {σ j}, the specific steps are as follows:

[0083] Step 1: Calculation

[0084] Step 2: Based on the received Tx j ,calculate

[0085] Step 3: Calculate the derived public / verification key for each attribute authority Among them, ousk=φ is the one-time private key of the data user, apk j ={E j ,V j} is AA j The second public key.

[0086] Step 4: Check if this formula is valid If established, the data user accepts SK uid′ The output is valid; otherwise, the attribute keys are rejected and the output is invalid.

[0087] Aggregate hidden signature allows data users (DU) to verify the attribute authority AA without exposing the attribute authority's second public and private keys. j The digital signature of each AA is used to enhance its anonymity. Secondly, by verifying the signature using a different second public key provided by the same AA, malicious attackers are prevented from inferring the specific attributes managed by each AA. This approach ensures that transactions cannot be linked to an AA, thereby enhancing privacy and anonymity within the system.

[0088] Optionally, in the data processing method provided in the embodiment of the present application, obtaining a data access request initiated by the target object includes: randomly generating a first random number and a second random number, and calculating based on the first random number, the second random number, the security parameter and the master key to obtain a first auxiliary decryption key; generating an access policy hidden factor through the target blockchain, and calculating based on the access policy hidden factor and the target attribute private key to obtain access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; and obtaining a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0089] In an optional embodiment, the following steps are used to obtain the above data access request: Before initiating a data access request, the data user selects two random numbers and (i.e., the first random number and the second random number mentioned above) to generate a temporary auxiliary decryption key pair (tpk, tsk), i.e., the first auxiliary decryption key and the second auxiliary decryption key mentioned above. It should be noted that the second auxiliary decryption key tsk will be kept secret by the data user.

[0090] Then, the target blockchain generates the access policy hidden factor, e.g., for access policy Each attribute in attr x , the blockchain selects a random number As the access policy hiding factor, and calculate The access attribute information is obtained by calculating the access policy hidden factor and the target attribute private key. For example, the data user uses D x and target attribute key K 3,x Calculate {s ρ(x)} x∈S For example, accessing attribute information is as follows:

[0091]

[0092] Finally, a data access request is obtained through the first auxiliary decryption key, access attribute information, target attribute private key and storage address information of the first target data to be accessed. For example, the data access request is

[0093] Optionally, in the data processing method provided in the embodiment of the present application, before obtaining the data access request initiated by the target object, the method also includes: obtaining an access token and performing hashing on the access token to obtain an encryption key; encrypting the second target data based on the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0094] In an optional embodiment, before obtaining the data access request initiated by the target object, the data owner encrypts and uploads the data. First, given a set of files owned by multiple data owners (DOs), The data owner generates a key stream {k i} 1≤i≤d , then, symmetric homomorphic encryption technology is used to encrypt dynamic data. Specifically:

[0095] Let k i ′ is the key and is used to encrypt data f i The data owner calculates the ciphertext as where k i ′ is a composite key, and k i ′=k i -k i+1 .

[0096] Assume that the data owner wants to convert the data stream {f1,...,f n} Authorize to share with data users, since the key stream of the decryption key is generated according to the key derivation tree, and k i ′=k i -k i+1 ,To decrypt the aggregate ciphertext within a certain range, only two boundary keys are needed.

[0097]

[0098] In addition, k1 and k n It can be obtained through the shared node of the binary tree, that is, the access token mentioned above.

[0099] For example, if we want to share the data stream {f1,...,f7} with a data user, due to the properties of homomorphic encryption and decryption, we only need to share the two boundaries {k0,k7} with the user. These two boundaries can be obtained by applying the left and right hash functions H1(·) and H2(·) to the access token tk. Therefore, we only need to controllably share the access token tk.

[0100] Therefore, the encryption key can be obtained through the access token, and the second target data can be encrypted with the encryption key. The encrypted second target data, i.e.

[0101] The data owner uploads the ciphertext data (i.e. the encrypted second target data) to IPFS for off-chain storage. Then, the metadata of the data is generated. And store it as a JSON file. d is a description of the data (e.g., cardiac data collected by a cardiology department, etc.), CID d Is the CID hash address of the IPFS response. d =H1(CT f )and The data ciphertext and the hash value of the encryption key are respectively. Afterwards, the data owner calls the digital asset registration smart contract to register the metadata as a digital asset on the chain and outputs Tx asset and dataURI, where Tx asset Credential information generated by the digital asset registration smart contract.

[0102] By encrypting the target data, the security of the data can be further improved.

[0103] Optionally, in the data processing method provided in the embodiment of the present application, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating an access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0104] In an optional embodiment, in order to improve the security of the access policy, the method further includes: determining second attribute information that enables access to the second target data.

[0105] Each attribute authority uses its own μ j (i.e. the third random number mentioned above) calculates (1+μ j p), and exchange the results with other attribute authorities to determine B″ and B′, and then set B=g B′ Send to the target blockchain.

[0106]

[0107] For strategy Each attribute in attr x , the blockchain selects a random number As a strategy hidden factor. Blockchain will Each line of attr x Remapping to Hidden Policy In the method, the following is done:

[0108]

[0109] Then, the data owner uses s ρ′(x) Replace the attribute attr corresponding to the strategy matrix x The encrypted second access policy is obtained by using the value of , and the encrypted second access policy is stored in the target blockchain.

[0110] By calculating B″ and B′, the blockchain can obtain g from the master key (MSK) B′ , without having to obtain the master key fragment μ of each attribute authority (AA) j The aggregate master key μ is introduced to mask the attribute values ​​in the policy, in order to prevent the adversary from detecting the attribute values ​​by launching attribute value guessing attacks and thus improve data security.

[0111] Optionally, in the data processing method provided in the embodiment of the present application, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0112] In an optional embodiment, in order to improve the security of the encryption key, the method further includes: randomly generating a tenth random number for the second attribute information in the second access policy. Through the tenth random number, the second attribute information and the first public key Perform calculation to obtain the first initial ciphertext.

[0113] For example, the first initial ciphertext is ICT k :

[0114]

[0115]

[0116] It should be noted that since the first initial ciphertext will not change, it can be encrypted off-chain and can be reused to generate the second target key ciphertext CT tk , thereby reducing encryption overhead.

[0117] Finally, the second target key ciphertext is generated by using the first initial ciphertext and the access token, and the second target key ciphertext is stored in the cloud server. It should be noted that there is a corresponding relationship between the second target key ciphertext and the encrypted second target data.

[0118] Optionally, in the data processing method provided in an embodiment of the present application, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; and generating a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0119] In an optional embodiment, generating the second target key ciphertext includes: using a linear secret sharing scheme (LSSS) to express the access policy here, is a The strategy matrix is ​​defined in The function ρ converts each row vector Mapped to attribute ρ(x), where

[0120] First, randomly generate the eleventh random number and generate the vector (i.e. the first vector mentioned above) and (i.e. the second vector mentioned above), where,

[0121] Then, the first vector and the second access strategy are calculated to obtain a first calculation result; the second vector and the second access strategy are calculated to obtain a second calculation result. For example, the first calculation result The second calculation result ), where M x is the xth row of M.

[0122] For a certain access token tk, its on-chain ciphertext is calculated as follows:

[0123]

[0124] Therefore, the complete key ciphertext (ie, the second target key ciphertext mentioned above) is obtained:

[0125]

[0126] Optionally, in the data processing method provided in the embodiment of the present application, the encrypted first target data is decrypted based on the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext based on the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain an encryption key; and decrypting the encrypted first target data based on the encryption key and the security parameter to obtain the first target data.

[0127] In an optional embodiment, decrypting the encrypted first target data includes the following steps: obtaining CT tk (i.e. the first target key ciphertext mentioned above), SK uid′ and tpk, the edge server calculates the partial ciphertext PCT tk As shown below:

[0128]

[0129] Therefore, the edge server obtains the semi-decrypted ciphertext It is then sent to the data user.

[0130] Data users receive And use tsk to fully decrypt PCT tk , output the access token tk through the following formula:

[0131]

[0132] Finally, the data user uses the access token to obtain two boundary keys k1,k n .

[0133] (1) Based on the two boundary keys and the following formula, the aggregate encryption key can be obtained

[0134]

[0135] (2) To decrypt the given key k i ′’s plaintext data m i , you can perform decryption operations

[0136] (3) According to the aggregation key and aggregate ciphertext The aggregated plaintext data can be obtained through the following formula.

[0137]

[0138] In an alternative embodiment, the Figure 2 The schematic diagram realizes the control of data access, such as Figure 2 As shown, it is divided into the following stages: system initialization, data encryption and upload, attribute private key generation, access verification and data decryption.

[0139] Phase 1: System Initialization: The blockchain initialization system generates security parameters and a master key. It also generates long-term public / private key pairs (i.e., the aforementioned second public key and second private key) for users (including data owners, data users, and attribute authorities / attribute management authorization nodes). The attribute authority generates a public / private key pair (i.e., the aforementioned first public key and first private key) for the attributes it controls.

[0140] Phase 2: Data Encryption and Upload: The data owner encrypts their file data using a homomorphic encryption algorithm and uploads it to IPFS (the InterPlanetary File System, a distributed data storage system). Furthermore, the key for the encrypted data is encrypted using the "attribute encryption of ciphertext policies" algorithm using both on-chain and off-chain mechanisms, resulting in the key ciphertext (the first target key ciphertext mentioned above). Simultaneously, the access policy for the data is obfuscated and hidden on-chain.

[0141] Phase 3: Attribute private key generation: Multiple attribute authorities generate attribute private keys for users (i.e., data requesters / users) and digitally sign their own generated attribute private keys with hidden addresses.

[0142] Phase 4: Access Verification: The data user receives the transaction Tx of the signature key from the relevant attribute authority j The user verifies the hidden digital signature attached to the attribute private key. If the aggregated invisible signature of the attribute private key is valid, the user generates an access request to download the ciphertext based on the attribute private key and sends the data request to the edge server nearby.

[0143] Phase 5: Data decryption: The edge server calls the smart contract to verify whether the user's attribute set meets the access policy. After verifying that the user's attribute set meets the policy, the edge server downloads the ciphertext from IPFS and returns the decrypted partial ciphertext to the user. The user fully decrypts it to recover the plaintext key and data.

[0144] The data processing method provided by the embodiment of the present application obtains a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, the access attribute information is obtained based on the access policy hidden factor and the target attribute private key, the access policy hidden factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; according to the access attribute The method uses the first target key ciphertext, the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to decrypt the encrypted first target data. The method solves the problem of low data security caused by security verification based on user identity information when users access data in the related art. In this scheme, the target attribute private key is obtained through the first attribute information of the target object, the access attribute information of the target object is obtained through the access policy hidden factor and the target attribute private key, and the access attribute information of the target object is determined based on the access attribute information. If the target object has permission to access the first target data, the encrypted first target data and the first target key ciphertext are obtained based on the storage address information. The first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data. The method further improves data security by decrypting the encrypted first target data based on the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key.

[0145] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0146] The present application also provides a data processing device. It should be noted that the data processing device of the present application can be used to execute the data processing method provided in the present application. The data processing device provided in the present application is introduced below.

[0147] Figure 3 Schematic diagram of a data processing device according to an embodiment of the present application. Figure 3 As shown, the device includes: a first acquiring unit 301 , a judging unit 302 , a second acquiring unit 303 and a first processing unit 304 .

[0148] A first acquisition unit 301 is configured to acquire a data access request initiated by a target object, wherein the data access request includes at least: storage address information of first target data to be accessed, a target attribute private key, a first auxiliary decryption key, and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt a first access policy for the first target data, and the encrypted first access policy is stored in the target blockchain;

[0149] A determination unit 302 is configured to determine whether the target object has permission to access the first target data based on the access attribute information and the encrypted first access policy;

[0150] A second obtaining unit 303 is configured to obtain, if the target object has permission to access the first target data, the encrypted first target data and a first target key ciphertext based on the storage address information, wherein the first target key ciphertext is obtained by encrypting an access token, the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data;

[0151] The first processing unit 304 is configured to decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data.

[0152] Optionally, in the data processing device provided in the embodiment of the present application, the processing unit includes: a first decryption sub-unit, used to decrypt the first target key ciphertext based on the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated by the first random number and the second random number; a transformation sub-unit, used to perform a hash transformation on the access token to obtain an encryption key; and a second decryption sub-unit, used to decrypt the encrypted first target data based on the encryption key and the security parameter to obtain the first target data.

[0153] Optionally, in the data processing device provided in an embodiment of the present application, the first acquisition unit includes: a first generation subunit, used to randomly generate a first random number and a second random number, and calculate based on the first random number, the second random number, the security parameter and the master key to obtain a first auxiliary decryption key; a second generation subunit, used to generate an access policy hidden factor through the target blockchain, and calculate based on the access policy hidden factor and the target attribute private key to obtain access attribute information; a first determination subunit, used to obtain the target attribute private key based on the first attribute information corresponding to the target object; and a second determination subunit, used to obtain a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

[0154] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a first determination unit, used to determine the attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center before calculating based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; a first generation unit, used to generate a cyclic group based on a preset security value, and obtain the master key based on the third random number; a second determination unit, used to obtain the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0155] Optionally, in the data processing device provided in an embodiment of the present application, the first generation unit includes: a first calculation subunit, used to perform calculations based on the prime order of the cyclic group and the third random number to obtain a target value; a second calculation subunit, used to perform calculations based on the target value and the prime order of the cyclic group to obtain a master key.

[0156] Optionally, in the data processing device provided in the embodiment of the present application, the first determination subunit includes: a determination module, used to determine the first attribute authorization center corresponding to the first attribute information, and obtain the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by the fourth random number and the fifth random number; an acquisition module, used to obtain the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by the sixth random number; a random module, used to randomly generate a seventh random number, and obtain the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0157] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a first calculation unit, used to, after obtaining the target attribute private key, perform calculation based on the second private key and pseudo-identity information of the first attribute authorization center to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; a signature unit, used to sign the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; a third determination unit, used to obtain a target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0158] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a third acquisition unit, used to obtain an access token before obtaining a data access request initiated by the target object, and hash the access token to obtain an encryption key; a second processing unit, used to encrypt the second target data based on the encryption key to obtain encrypted second target data; a fourth acquisition unit, used to store the encrypted second target data in a cloud server, and obtain metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; a storage unit, used to store the metadata information in the target blockchain.

[0159] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a fourth determination unit, used to determine the second attribute information after storing the metadata information in the target blockchain, and generate a second access policy for the second target data based on the second attribute information; a fifth determination unit, used to determine the second attribute authorization center corresponding to the second attribute information, and obtain a third random number corresponding to the second attribute authorization center; a second generation unit, used to generate an access policy hidden factor through the target blockchain; a third processing unit, used to encrypt the second access policy based on the third random number and the access policy hidden factor to obtain the encrypted second access policy, and store the encrypted second access policy to the target blockchain.

[0160] Optionally, in the data processing device provided in the embodiment of the present application, the device also includes: a third generation unit, used to randomly generate a tenth random number for the second attribute information in the second access policy before obtaining the data access request initiated by the target object; a fifth acquisition unit, used to obtain the first public key corresponding to the second attribute authorization center; a second calculation unit, used to perform calculations based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; a fourth generation unit, used to generate a second target key ciphertext based on the first initial ciphertext and the access token, and store the second target key ciphertext in the cloud server.

[0161] Optionally, in the data processing device provided in the embodiment of the present application, the fourth generation unit includes: a third generation subunit, used to randomly generate an eleventh random number, and generate a first vector based on the eleventh random number, and randomly generate a second vector; a third calculation subunit, used to calculate the first vector and the second access policy to obtain a first calculation result; a fourth calculation subunit, used to calculate the second vector and the second access policy to obtain a second calculation result; a confidentiality subunit, used to encrypt the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; and a fourth generation subunit, used to generate a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0162] The data processing device provided by the embodiment of the present application obtains a data access request initiated by a target object through a first obtaining unit 301, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, the access attribute information is obtained based on the access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt the first access policy of the first target data, and the encrypted first access policy is stored in the target blockchain; the judgment unit 302 judges based on the access attribute information and the encrypted first access policy to determine whether the target object has permission to access the first target data; if the target object has permission to access the first target data, the second acquisition unit 303 obtains the encrypted first target data and the first target key ciphertext based on the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, which is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the first processing unit 304 is used to decrypt the encrypted first target data based on the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data, thereby solving the problem of security verification based on user identity information when the user accesses data in the related art, resulting in low data security. In this solution, the target attribute private key is obtained from the first attribute information of the target object, the access attribute information of the target object is obtained from the access policy hidden factor and the target attribute private key, and the access attribute information of the target object is determined based on the access attribute information. If the target object has permission, the encrypted first target data needs to be decrypted using the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key, thereby achieving the effect of improving data security.

[0163] The data processing device includes a processor and a memory. The above-mentioned first acquisition unit 301, judgment unit 302, second acquisition unit 303 and first processing unit 304 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0164] The processor contains a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels, and data access control is achieved by adjusting kernel parameters.

[0165] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0166] An embodiment of the present invention provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, a data processing method is implemented.

[0167] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a data processing method when it is run.

[0168] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, the device includes a processor, a memory and a program stored in the memory and capable of running on the processor, and the processor implements the following steps when executing the program: obtaining a data access request initiated by a target object, wherein the data access request includes at least: storage address information of the first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on the security parameter and the master key, the security parameter and the master key are obtained based on the cyclic group, the access attribute information is obtained based on the access policy hiding factor and the target attribute private key, and the access policy hiding factor is obtained using The first access policy for the first target data is encrypted, and the encrypted first access policy is stored in the target blockchain; based on the access attribute information and the encrypted first access policy, whether the target object has the permission to access the first target data is judged; if the target object has the permission to access the first target data, the encrypted first target data and the first target key ciphertext are obtained based on the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the encrypted first target data is decrypted based on the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0169] Optionally, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain an encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0170] Optionally, obtaining a data access request initiated by a target object includes: randomly generating a first random number and a second random number, and performing calculations based on the first random number, the second random number, the security parameter, and the master key to obtain a first auxiliary decryption key; generating an access policy hidden factor through the target blockchain, and performing calculations based on the access policy hidden factor and the target attribute private key to obtain access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; and obtaining a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key, and the storage address information of the first target data to be accessed.

[0171] Optionally, before performing calculation based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the method further includes: determining an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; generating a cyclic group based on a preset security value, and obtaining the master key based on the third random number; and obtaining the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0172] Optionally, obtaining the master key based on the third random number includes: performing calculation based on the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation based on the target value and the prime order of the cyclic group to obtain the master key.

[0173] Optionally, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by the fourth random number and the fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by the sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0174] Optionally, after obtaining the target attribute private key, the method further includes: calculating based on the second private key and pseudo-identity information of the first attribute authorization center to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining the target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0175] Optionally, before obtaining the data access request initiated by the target object, the method also includes: obtaining an access token and performing hashing on the access token to obtain an encryption key; encrypting the second target data based on the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0176] Optionally, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating an access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain an encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0177] Optionally, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0178] Optionally, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0179] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0180] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: obtaining a data access request initiated by a target object, wherein the data access request includes at least: storage address information of a first target data to be accessed, a target attribute private key, a first auxiliary decryption key and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, and the access policy hiding factor is used to access the first target data. The first access policy is encrypted, and the encrypted first access policy is stored in the target blockchain; based on the access attribute information and the encrypted first access policy, it is determined whether the target object has the permission to access the first target data; if the target object has the permission to access the first target data, the encrypted first target data and the first target key ciphertext are obtained based on the storage address information, wherein the first target key ciphertext is obtained by encrypting the access token, the access token is used to obtain the encryption key, and the encryption key is used to encrypt the first target data; the encrypted first target data is decrypted based on the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data.

[0181] Optionally, the encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key and the first auxiliary decryption key to obtain the first target data, including: decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain an access token, wherein the second auxiliary decryption key pair is calculated from the first random number and the second random number; performing a hash transformation on the access token to obtain an encryption key; and decrypting the encrypted first target data according to the encryption key and the security parameter to obtain the first target data.

[0182] Optionally, obtaining a data access request initiated by a target object includes: randomly generating a first random number and a second random number, and performing calculations based on the first random number, the second random number, the security parameter, and the master key to obtain a first auxiliary decryption key; generating an access policy hidden factor through the target blockchain, and performing calculations based on the access policy hidden factor and the target attribute private key to obtain access attribute information; obtaining the target attribute private key based on the first attribute information corresponding to the target object; and obtaining a data access request based on the first auxiliary decryption key, the access attribute information, the target attribute private key, and the storage address information of the first target data to be accessed.

[0183] Optionally, before performing calculation based on the first random number, the second random number, the security parameter and the master key to obtain the first auxiliary decryption key, the method also includes: determining an attribute set, multiple attribute authorization centers and a third random number corresponding to each attribute authorization center, wherein the attribute set is composed of multiple attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; generating a cyclic group based on a preset security value, and obtaining the master key based on the third random number; and obtaining the security parameter based on the cyclic group, the attribute set, the multiple attribute authorization centers and the master key.

[0184] Optionally, obtaining the master key based on the third random number includes: performing calculation based on the prime order of the cyclic group and the third random number to obtain a target value; and performing calculation based on the target value and the prime order of the cyclic group to obtain the master key.

[0185] Optionally, obtaining the target attribute private key based on the first attribute information corresponding to the target object includes: determining the first attribute authorization center corresponding to the first attribute information, and obtaining the first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and the first private key of the first attribute authorization center, and the first private key is obtained by the fourth random number and the fifth random number; obtaining the pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by the sixth random number; randomly generating a seventh random number, and obtaining the target attribute private key based on the seventh random number, the pseudo-identity information, the first public key, the security parameter, the master key and the first attribute information.

[0186] Optionally, after obtaining the target attribute private key, the method further includes: calculating based on the second private key and pseudo-identity information of the first attribute authorization center to obtain the signature private key of the first attribute authorization center, wherein the second private key is obtained by the eighth random number and the ninth random number; signing the target attribute private key based on the pseudo-identity information and the signature private key to obtain an initial signature; obtaining the target signature based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

[0187] Optionally, before obtaining the data access request initiated by the target object, the method also includes: obtaining an access token and performing hashing on the access token to obtain an encryption key; encrypting the second target data based on the encryption key to obtain encrypted second target data; storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information includes at least: the storage address and description information of the encrypted second target data; and storing the metadata information in the target blockchain.

[0188] Optionally, after storing the metadata information in the target blockchain, the method also includes: determining the second attribute information, and generating a second access policy for the second target data based on the second attribute information; determining the second attribute authorization center corresponding to the second attribute information, and obtaining a third random number corresponding to the second attribute authorization center; generating an access policy hidden factor through the target blockchain; encrypting the second access policy based on the third random number and the access policy hidden factor to obtain an encrypted second access policy, and storing the encrypted second access policy in the target blockchain.

[0189] Optionally, before obtaining the data access request initiated by the target object, the method also includes: randomly generating a tenth random number for the second attribute information in the second access policy; obtaining the first public key corresponding to the second attribute authorization center; calculating based on the tenth random number, the second attribute information and the first public key to obtain a first initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the access token, and storing the second target key ciphertext in the cloud server.

[0190] Optionally, generating a second target key ciphertext based on the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector based on the eleventh random number, and randomly generating a second vector; calculating the first vector and the second access policy to obtain a first calculation result; calculating the second vector and the second access policy to obtain a second calculation result; encrypting the access token based on the first calculation result, the second calculation result and the security parameter to obtain a second initial ciphertext; generating a second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

[0191] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0192] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0193] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0194] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0195] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0196] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0197] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0198] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0199] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A data processing method, characterized in that: include: Obtaining a data access request initiated by a target object, wherein the data access request includes at least: storage address information of first target data to be accessed, a target attribute private key, a first auxiliary decryption key, and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, wherein the access policy hiding factor is used to encrypt a first access policy for the first target data, and the encrypted first access policy is stored in the target blockchain; Determining whether the target object has permission to access the first target data based on the access attribute information and the encrypted first access policy; If the target object has permission to access the first target data, obtaining the encrypted first target data and a first target key ciphertext according to the storage address information, wherein the first target key ciphertext is obtained by encrypting an access token, the access token is used to obtain an encryption key, and the encryption key is used to encrypt the first target data; decrypting the encrypted first target data according to the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data; The encrypted first target data is decrypted according to the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data, including: Decrypting the first target key ciphertext according to the target attribute private key, the first auxiliary decryption key, and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated using the first random number and the second random number; Performing a hash transformation on the access token to obtain the encryption key; The encrypted first target data is decrypted according to the encryption key and the security parameter to obtain the first target data.

2. The method according to claim 1, characterized in that The data access request initiated by the target object includes: Randomly generate a first random number and a second random number, and perform calculation based on the first random number, the second random number, the security parameter, and the master key to obtain the first auxiliary decryption key; Generate the access policy hidden factor through the target blockchain, and calculate based on the access policy hidden factor and the target attribute private key to obtain the access attribute information; Obtaining the target attribute private key according to the first attribute information corresponding to the target object; The data access request is obtained according to the first auxiliary decryption key, the access attribute information, the target attribute private key and the storage address information of the first target data to be accessed.

3. The method according to claim 2, characterized in that Before obtaining the first auxiliary decryption key by performing calculation based on the first random number, the second random number, the security parameter, and the master key, the method further includes: Determine an attribute set, a plurality of attribute authorization centers, and a third random number corresponding to each attribute authorization center, wherein the attribute set consists of a plurality of attribute information, and there is a one-to-one correspondence between the attribute authorization center and the attribute information; Generate a cyclic group based on a preset security value, and obtain the master key based on the third random number; The security parameter is obtained according to the cyclic group, the attribute set, the multiple attribute authority centers and the master key.

4. The method according to claim 3, characterized in that Obtaining the master key according to the third random number includes: Performing calculation based on the prime order of the cyclic group and the third random number to obtain a target value; The master key is obtained by performing calculation based on the target value and the prime order of the cyclic group.

5. The method according to claim 2, characterized in that Obtaining the target attribute private key according to the first attribute information corresponding to the target object includes: Determining a first attribute authorization center corresponding to the first attribute information, and obtaining a first public key corresponding to the first attribute authorization center, wherein the first public key is obtained based on the security parameter and a first private key of the first attribute authorization center, and the first private key is obtained using a fourth random number and a fifth random number; Acquire pseudo-identity information of the target object, wherein the pseudo-identity information is obtained by a sixth random number; A seventh random number is randomly generated, and the target attribute private key is obtained according to the seventh random number, the pseudo identity information, the first public key, the security parameter, the master key and the first attribute information.

6. The method according to claim 5, characterized in that After obtaining the target attribute private key, the method further includes: performing calculation based on the second private key of the first attribute authority and the pseudo identity information to obtain a signature private key of the first attribute authority, wherein the second private key is obtained from the eighth random number and the ninth random number; Signing the target attribute private key according to the pseudo identity information and the signature private key to obtain an initial signature; A target signature is obtained based on the initial signature, the pseudo-identity information, the signature private key, the second private key and the second public key, wherein the second public key is obtained based on the second private key and the security parameter, and the target signature is used to verify the authenticity of the target attribute private key.

7. The method according to claim 1, characterized in that Before obtaining the data access request initiated by the target object, the method further includes: Obtaining the access token and performing hashing on the access token to obtain the encryption key; encrypting the second target data according to the encryption key to obtain encrypted second target data; Storing the encrypted second target data in a cloud server, and obtaining metadata information of the encrypted second target data from the cloud server, wherein the metadata information at least includes: a storage address and description information of the encrypted second target data; The metadata information is stored in the target blockchain.

8. The method according to claim 7, characterized in that After storing the metadata information in the target blockchain, the method further includes: determining second attribute information, and generating a second access policy for the second target data based on the second attribute information; Determine a second attribute authorization center corresponding to the second attribute information, and obtain a third random number corresponding to the second attribute authorization center; Generate the access policy hidden factor through the target blockchain; The second access policy is encrypted according to the third random number and the access policy hiding factor to obtain an encrypted second access policy, and the encrypted second access policy is stored in the target blockchain.

9. The method according to claim 8, characterized in that Before obtaining the data access request initiated by the target object, the method further includes: For the second attribute information in the second access policy, randomly generate a tenth random number; Obtaining a first public key corresponding to the second attribute authority; performing calculation based on the tenth random number, the second attribute information, and the first public key to obtain a first initial ciphertext; A second target key ciphertext is generated based on the first initial ciphertext and the access token, and the second target key ciphertext is stored in the cloud server.

10. The method according to claim 9, characterized in that Generating a second target key ciphertext according to the first initial ciphertext and the access token includes: randomly generating an eleventh random number, generating a first vector according to the eleventh random number, and randomly generating a second vector; Calculating the first vector and the second access strategy to obtain a first calculation result; Calculating the second vector and the second access strategy to obtain a second calculation result; Encrypting the access token according to the first calculation result, the second calculation result, and the security parameter to obtain a second initial ciphertext; Generate the second target key ciphertext based on the first initial ciphertext and the second initial ciphertext.

11. A data processing device, characterized in that: include: a first acquiring unit, configured to acquire a data access request initiated by a target object, wherein the data access request includes at least: storage address information of first target data to be accessed, a target attribute private key, a first auxiliary decryption key, and access attribute information, wherein the target attribute private key is obtained based on the first attribute information corresponding to the target object, the first auxiliary decryption key is obtained based on a security parameter and a master key, the security parameter and the master key are obtained based on a cyclic group, and the access attribute information is obtained based on an access policy hiding factor and the target attribute private key, the access policy hiding factor is used to encrypt a first access policy for the first target data, and the encrypted first access policy is stored in the target blockchain; a judging unit, configured to judge whether the target object has permission to access the first target data based on the access attribute information and the encrypted first access policy; a second obtaining unit, configured to obtain, if the target object has permission to access the first target data, the encrypted first target data and a first target key ciphertext according to the storage address information, wherein the first target key ciphertext is obtained by encrypting an access token, the access token being used to obtain an encryption key, and the encryption key being used to encrypt the first target data; a first processing unit, configured to decrypt the encrypted first target data according to the first target key ciphertext, the target attribute private key, and the first auxiliary decryption key to obtain the first target data; Among them, the processing unit includes: a first decryption sub-unit, used to decrypt the first target key ciphertext based on the target attribute private key, the first auxiliary decryption key and the second auxiliary decryption key to obtain the access token, wherein the second auxiliary decryption key pair is calculated by the first random number and the second random number; a transformation sub-unit, used to perform hash transformation on the access token to obtain the encryption key; a second decryption sub-unit, used to decrypt the encrypted first target data based on the encryption key and the security parameter to obtain the first target data.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the storage medium is controlled to execute the data processing method according to any one of claims 1 to 10 on a device.

13. An electronic device, characterized in that: The device comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the data processing method according to any one of claims 1 to 10.

Images