A data sharing method and system based on blockchain

Abstract

The present invention belongs to the technical field of ring signature zero-knowledge proof, and discloses a data sharing method and system based on blockchain, which collects heterogeneous data from different enterprises, determines the identity authentication of each participant through a decentralized identity DID, and pre-processes the collected data; defines a smart contract on the blockchain, uses ring signature zero-knowledge proof to allow authenticated participants to perform operations, and records data operations on the blockchain; uses data encryption and oblivious transmission to securely transmit shared data and transfer decryption keys; the data recipient initiates a sharing request based on the decentralized identity DID, and uses the ring signature zero-knowledge proof to prove its own authority; the present invention reduces the risk of single point failures through the introduction of ring signature zero-knowledge proof, improves overall robustness and credibility, and ensures that only participants who have been strictly verified can perform data operations.

Description

Technical Field

[0001] The present invention belongs to the technical field of ring signature zero-knowledge proof, and in particular to a data sharing method and system based on blockchain. Background Art

[0002] In recent years, with the rapid development of big data and Internet technology, cross-enterprise data sharing has gradually become a key factor in improving business collaboration efficiency and innovation capabilities; however, traditional data sharing methods often rely on centralized trust institutions, which not only increases the risk of data leakage, but may also cause data tampering; in order to overcome these problems, blockchain-based data sharing methods have gradually attracted attention; blockchain, with its decentralized, tamper-proof and transparent characteristics, provides a new solution for data sharing; by storing data transaction records in a distributed ledger, blockchain technology ensures the consistency and integrity of the data, thereby enhancing the security and reliability of data sharing; in addition, the application of smart contracts enables data access and operations to be automated, further reducing the possibility of human intervention.

[0003] Although blockchain technology has shown great potential in data sharing, existing methods still have several shortcomings. First, for the processing of heterogeneous data, existing technologies often lack effective pre-processing mechanisms, resulting in uneven data quality and difficulty in achieving efficient data integration and sharing. Second, existing identity authentication mechanisms mostly rely on centralized identity management systems, which not only increases the risk of single point failures, but also limits the autonomy and flexibility of participants. In addition, how to ensure the secure transmission of keys during data encryption and transmission is also an urgent problem to be solved. Existing methods usually use traditional encryption algorithms, which are difficult to meet the needs of high security and privacy protection. Finally, although zero-knowledge proof technology has been applied to data access control, existing zero-knowledge proof schemes often have high computational complexity, which is not conducive to large-scale applications. Summary of the invention

[0004] To solve the above problems, the present invention provides a data sharing method and system based on blockchain, which solves the problems of identity authentication, data preprocessing, permission management and privacy protection by introducing technologies such as decentralized identity DID, ring signature zero-knowledge proof, data encryption and oblivious transmission, thereby improving the security and efficiency of data sharing.

[0005] The data sharing method based on blockchain described in the present invention comprises the following steps:

[0006] S1. Collect heterogeneous data from different enterprises, determine the identity verification of each participant through decentralized identity DID, and pre-process the collected data;

[0007] S2. Perform hashing on the preprocessed data to construct a data transaction record with detailed information, and permanently record the data transaction record in the blockchain through the blockchain network consensus mechanism;

[0008] S3. Define smart contracts on the blockchain, use ring signature zero-knowledge proof to allow authenticated parties to perform operations, and record data operations on the blockchain;

[0009] S4. Use data encryption and oblivious transfer to securely transmit shared data and pass decryption keys;

[0010] S5. The data recipient initiates a sharing request based on the decentralized identity DID and uses a ring signature zero-knowledge proof to prove its own authority.

[0011] As a preferred solution of the blockchain-based data sharing method of the present invention, S1 is specifically:

[0012] Collect structured and unstructured data from different enterprises;

[0013] Categorize the collected data and mark the source;

[0014] Add metadata to each data set to record the data source and timestamp;

[0015] Use the W3C standard decentralized identity DID method to create a unique digital identity for each participant to identify and verify the identity of the participant;

[0016] The data is pre-processed using Apache NiFi in the ETL tool.

[0017] As a preferred solution of the blockchain-based data sharing method of the present invention, S2 is specifically:

[0018] Combine the preprocessed data X with time t to generate a hash fingerprint value, expressed as:

[0019] ,

[0020] in, is the generated hash fingerprint value, Represents bitwise exclusive binary operation;

[0021] Construct data transaction records with data descriptions, hash values, metadata, ownership information, and authorization information;

[0022] Use the Web3.js library to send data transaction records to the blockchain network;

[0023] Create blockchain transactions and send data transaction records to nodes in the blockchain network;

[0024] After receiving the data transaction record, the nodes in the blockchain network verify the data transaction record;

[0025] Confirm the validity of data transaction records through the consensus mechanism PoA;

[0026] The data that confirms the validity of the data transaction record is added to a new block and linked to the blockchain for permanent storage.

[0027] As a preferred solution of the blockchain-based data sharing method of the present invention, S3 is specifically:

[0028] Develop data access rights rules based on business needs and agreements between stakeholders;

[0029] Define read permission levels, write permission levels, delete permission levels, and manage permission levels;

[0030] Define time range conditions, geographic location conditions, and data type conditions;

[0031] Write smart contract functions for data reading, writing and manipulation;

[0032] When a participant accesses data, the smart contract authenticates the participant through DID verification and ring signature zero-knowledge proof;

[0033] Use decentralized identity DID to identify participants and verify their identities;

[0034] The participants use the ring signature zero-knowledge proof to generate proof to prove that they have the corresponding authority;

[0035] The smart contract verifies the validity of the ring signature zero-knowledge proof and determines that the participating parties have the corresponding permissions;

[0036] Every data access and operation is recorded on the blockchain.

[0037] As a preferred solution of the blockchain-based data sharing method described in the present invention, the participants use the ring signature zero-knowledge proof to generate the proof, specifically:

[0038] Participants clearly understand their rights and permission levels to access specific data;

[0039] Select the ring signature zero-knowledge proof to generate the proof;

[0040] The administrator defines permission rules according to business requirements and converts the permission rules into Boolean circuits to generate public parameters for ring signature zero-knowledge proof;

[0041] Introduce verifiable delay functions VDFs to time-lock shared data and obtain time-locked encrypted data , the expression is:

[0042] ;

[0043] Where H is the hash function, is a generator on the elliptic curve, is the private key of the participant, is the time parameter, is a random number, It is the original data;

[0044] Participants generate their own private keys and set their own roles, departments, and permission information for accessing data time;

[0045] The participants perform the query data operation on the time-locked encrypted data, use the verifiable delay function VDFs to ensure the privacy of the data, and obtain the time-locked encrypted query results , the expression is:

[0046] ,

[0047] in, is the query result;

[0048] The participants lock the encrypted query results according to the time and generate a ring signature zero-knowledge proof to prove that their operations have the legitimacy of the query and the data reading authority;

[0049] The participants send the generated ring signature zero-knowledge proof to the verifier;

[0050] The verifier uses the public parameters generated by the administrator to verify the validity of the ring signature zero-knowledge proof and confirm that the participating party has the authority to access the data.

[0051] As a preferred solution of the blockchain-based data sharing method of the present invention, S4 is specifically:

[0052] Use the symmetric encryption algorithm AES to encrypt the data and generate encrypted data;

[0053] Generate an obliviously transmitted encrypted random array based on the data directory in the data transaction record recorded on the blockchain;

[0054] Assign a unique random number to each data directory, and generate a mapping relationship group based on the mapping relationship between each data address, number, description, hash value and random number;

[0055] Encrypting the mapping relationship using the public key of the data provider to generate first encrypted information;

[0056] The first encrypted information is stored on the blockchain, and after the data receiver decrypts the data, a hash fingerprint value of the decrypted data is calculated;

[0057] Compare the original data hash fingerprint value and the new hash fingerprint value after decryption to verify the consistency of the data.

[0058] As a preferred solution of the blockchain-based data sharing method of the present invention, S5 is specifically:

[0059] The data recipient uses a decentralized digital identity (DID) for identification;

[0060] The data sender verifies the receiver's permissions through smart contracts;

[0061] Introducing ring signature zero-knowledge proof, the data recipient can prove that the participant has access rights without revealing specific permission details;

[0062] Once the verification is passed, the inadvertent transmission key information is generated, the data is decrypted, and the key information is recorded on the blockchain;

[0063] The data receiver obtains the inadvertently transmitted key information from the blockchain;

[0064] Using the oblivious transmission key information to decrypt the encrypted mapping relationship group to obtain the actual decryption key;

[0065] The data recipient obtains the encrypted data from the data storage unit based on the data directory information previously on the blockchain;

[0066] Decrypt the encrypted data using the decryption key to restore the original data;

[0067] Calculate the hash value of the decrypted data and compare the calculated hash fingerprint value with the original hash fingerprint value recorded on the blockchain;

[0068] If the hash values ​​are consistent, it is determined that the data has not been tampered with and the data sharing is successful.

[0069] The present invention also provides a data sharing system based on blockchain, including a data acquisition and processing module, a hash module, a smart contract module, an encryption module and a sharing module; the data acquisition and processing module is used to collect heterogeneous data from different enterprises, determine the identity authentication of each participant through a decentralized identity DID, and pre-process the collected data; the hash module is used to hash the pre-processed data, construct a data transaction record with detailed information, and permanently record the data transaction record in the blockchain through a blockchain network consensus mechanism; the smart contract module is used to define smart contracts on the blockchain, use ring signature zero-knowledge proof to allow authenticated participants to perform operations, and record data operations on the blockchain; the encryption module is used to use data encryption and oblivious transfer method to securely transmit shared data and transfer decryption keys; the sharing module is used for the data recipient to initiate a sharing request based on the decentralized identity DID, and use the ring signature zero-knowledge proof to prove its own authority.

[0070] The beneficial effects of the present invention are as follows: the present invention realizes unified management and high-quality preprocessing of data by collecting and preprocessing heterogeneous data of different enterprises and using decentralized identity DID for identity authentication, thereby improving the consistency and security of data; the preprocessed data is hashed and recorded on the blockchain to ensure the immutability and transparency of the data; the smart contract is defined and the ring signature zero-knowledge proof is used for authority verification to realize fine-grained access control and privacy protection, ensuring that only authorized parties can perform data operations, and using the symmetric encryption algorithm AES and the oblivious transmission method for data encryption and key transfer to ensure the security and privacy of data during transmission. The present invention uses a multi-layer encryption strategy, symmetric encryption, asymmetric encryption and ring signature technology to form three layers of encryption, significantly enhancing the security and anti-tampering ability of data, and through a dynamic key update mechanism, automatically generates new encryption keys regularly or based on specific events, reducing the risk of key leakage and cracking, and ensuring the security of data under different times and conditions. In addition, the introduction of ring signature zero-knowledge proof reduces the risk of single point failure, improves the overall robustness and credibility of the system, and ensures that only strictly verified parties can perform data operations, thereby enhancing the overall security and reliability of data sharing; data decryption is performed through off-chain computing nodes, and temporary authorization tokens and multi-layer encryption keys are used to decrypt data shards in sequence, which improves computing efficiency and reduces the burden on the blockchain network, while ensuring data security and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is a flowchart of the data sharing method based on blockchain in Example 1;

[0072] Figure 2This is a flow chart for collecting data identification and preprocessing the data in Example 1. DETAILED DESCRIPTION

[0073] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0074] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0075] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0076] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a data sharing method based on blockchain, comprising the following steps:

[0077] S1. Collect heterogeneous data from different enterprises, determine the identity verification of each participant through decentralized identity DID, and pre-process the collected data, specifically:

[0078] Collect structured and unstructured data from different enterprises;

[0079] Categorize the collected data and mark the source;

[0080] Add metadata to each data set to record the data source and timestamp;

[0081] Use the W3C standard decentralized identity DID method to create a unique digital identity for each participant to identify and verify the identity of the participant;

[0082] Use Apache NiFi in the ETL tool to preprocess the data, including cleaning, format conversion, and missing value filling.

[0083] S1.1. Preprocess the collected data, specifically:

[0084] Convert all structured data into JSON format;

[0085] For structured numerical data, use the median filling method to fill in the data;

[0086] For structured categorical data, the majority filling method is used to fill in the data;

[0087] Convert text data in unstructured data into a unified TXT format, remove stop words, punctuation, stem extraction, and lemmatization;

[0088] Unify the text encoding UTF-8 of text data in unstructured data;

[0089] Convert image data in unstructured data into a unified JPEG format, resize, crop and rotate images, and add metadata;

[0090] Convert video data in unstructured data into a unified MP4 format, clip, compress, adjust resolution, and add metadata;

[0091] Perform data quality checks on preprocessed structured data, identify and remove outliers using the IQR method, and use hash functions to detect duplicate data;

[0092] Perform data quality detection on preprocessed unstructured data, perform grammar and semantic checks on text data, and perform visual quality checks on image and video data.

[0093] It should be noted that decentralized identity DID determines the identity authentication of each participant. For example:

[0094] Assume that the participants are: hospital A, insurance company B and research institution C;

[0095] Each participant (hospital A, insurance company B, research institution C) creates a unique digital identity using the W3C standard DID method;

[0096] Hospital A generates its own DID digital identity: did:example:1234567890;

[0097] Insurance company B generates its own DID digital identity: did:example:0987654321;

[0098] Research institution C generates its own DID digital identity: did:example:5678901234;

[0099] Each participant registers its DID into a decentralized identifier system, usually through a DID document that describes the ownership and related properties of the DID;

[0100] Hospital A registers DID did:example:1234567890 and includes its public key and related information in the DID document;

[0101] Insurance company B registers DID did:example:0987654321 and includes its public key and related information in the DID document;

[0102] Research organization C registers DID did:example:5678901234 and includes its public key and related information in the DID document;

[0103] When hospital A needs to send patient health records to insurance company B, hospital A will sign the data using its own private key;

[0104] When hospital A needs to send patient health records to insurance company B, hospital A will sign the data using its own private key;

[0105] Similarly, when research institution C requests anonymized health data, hospital A also signs the data with its own private key, and research institution C uses the public key in hospital A’s DID document to verify the signature;

[0106] Define data access rights rules in smart contracts; for example, only parties with specific roles (such as “insurance company” or “research institution”) can access certain types of data;

[0107] If the verification is successful, Insurance Company B will be granted access; otherwise, the request will be denied;

[0108] Insurance company B can use ring signature zero-knowledge proof to prove that it has access to specific data without revealing specific identity information;

[0109] For example, Insurance Company B generates a ring signature zero-knowledge proof to prove that it is a certified insurance company and has read permissions within a specific time range;

[0110] The smart contract verifies the validity of this ring signature zero-knowledge proof. If the verification passes, Insurance Company B is allowed to access the data.

[0111] It should be noted that by collecting heterogeneous data from different enterprises and using decentralized identity DID to ensure the identity authentication of each participant, the present invention realizes data classification, labeling and metadata addition; the preprocessing steps include using Apache NiFi for data cleaning, format conversion and missing value filling, unifying structured data into JSON format, processing unstructured data (such as text, images and videos), and performing data quality detection to identify and remove outliers and duplicate data.

[0112] S2. Perform hashing on the preprocessed data to construct data transaction records with detailed information, and permanently record the data transaction records in the blockchain through the blockchain network consensus mechanism, specifically:

[0113] Combine the preprocessed data X with time t to generate a hash fingerprint value, expressed as:

[0114] ,

[0115] in, is the generated hash fingerprint value, Represents bitwise exclusive binary operation;

[0116] Construct data transaction records with data descriptions, hash values, metadata, ownership information, and authorization information;

[0117] Use the Web3.js library to send data transaction records to the blockchain network;

[0118] Create a blockchain transaction, including data transaction records and necessary signature information, and send the data transaction records to nodes in the blockchain network;

[0119] After receiving the data transaction records, the nodes in the blockchain network verify them, including checking the integrity of the data, the validity of the signature, and the legitimacy of the transaction;

[0120] Confirm the validity of data transaction records through the consensus mechanism PoA;

[0121] The data that confirms the validity of the data transaction record is added to a new block and linked to the blockchain for permanent storage.

[0122] It should be noted that Explained as a bitwise XOR binary operation; bitwise XOR is a binary logic operation that performs a logical XOR operation on each bit of the two operands; specifically, for two binary numbers A and B, each bit of the bitwise XOR result C is calculated as follows:

[0123] If the corresponding bits of A and B are the same (both 0 or both 1), the corresponding bit of C is 0;

[0124] If the corresponding bits of A and B are different (one is 0 and the other is 1), then the corresponding bit of C is 1.

[0125] It should be noted that the bitwise difference is given as an example:

[0126] Assume there are two binary numbers A and B, their bitwise XOR operation can be expressed as:

[0127] A: 10101010; B: 11001100;

[0128] First position: 1 1=0;

[0129] Second digit: 0 1=1;

[0130] Third place: 1 0=1;

[0131] Fourth position: 0 0=0;

[0132] Fifth place: 1 1=0;

[0133] Sixth position: 0 1=1;

[0134] Seventh place: 1 0=1;

[0135] Eighth position: 0 0=0;

[0136] Therefore, A The result of B is: 01100110.

[0137] It should be noted that by hashing the preprocessed data to generate an unalterable data fingerprint, and constructing a data transaction record containing detailed information, the blockchain network consensus mechanism PoA is used to permanently record the data transaction record in the block; this process ensures the integrity and tamper-proofness of the data, and provides a transparent and traceable data management method; sending and verifying transaction records through the Web3.js library ensures the legitimacy and security of the data, and provides a reliable foundation for data sharing and management.

[0138] S3. Define smart contracts on the blockchain, use ring signature zero-knowledge proof to allow authenticated parties to perform operations, and record data operations on the blockchain, specifically:

[0139] Before data is linked, both parties need to reach a consensus agreement;

[0140] Develop data access rights rules based on business needs and agreements between stakeholders;

[0141] Define read permission levels, write permission levels, delete permission levels, and manage permission levels;

[0142] Define time range conditions, geographic location conditions, and data type conditions;

[0143] Write smart contract functions for data reading, writing and manipulation;

[0144] When a participant accesses data, the smart contract authenticates the participant through DID verification and ring signature zero-knowledge proof;

[0145] Use decentralized identity DID to identify participants and verify their identities;

[0146] The participants use the ring signature zero-knowledge proof to generate proof to prove that they have the corresponding authority;

[0147] The smart contract verifies the validity of the ring signature zero-knowledge proof and determines that the participating parties have the corresponding permissions;

[0148] Every data access and operation is recorded on the blockchain, ensuring transparency and traceability.

[0149] It should be noted that the agreements to be reached include:

[0150] Scope and purpose of data use;

[0151] Access to and use period of data;

[0152] Permission to read, write, delete and manage data;

[0153] Certain data type and geographic location restrictions;

[0154] Data privacy protection requirements;

[0155] Smart contract verification requests include: checking permission levels, timestamps, and data access history.

[0156] S3.1. The parties use the ring signature zero-knowledge proof to generate proof, specifically:

[0157] Participants clearly understand their rights and permission levels to access specific data; for example, doctor A needs to access patient B's health records and needs read permissions;

[0158] Choose a ring signature zero-knowledge proof to generate the proof; a ring signature allows participants to sign a message anonymously among a set of possible signers while keeping the signature unforgeable;

[0159] The administrator defines permission rules according to business needs and converts the permission rules into Boolean circuits to generate public parameters for zero-knowledge proof of ring signatures; public parameters include elliptic curve parameters, hash functions, security parameters, public key sets, and ring signature parameters;

[0160] Introduce verifiable delay functions (VDFs) to time-lock shared data and obtain time-locked encrypted data , the expression is:

[0161] ;

[0162] Where H is a hash function; It is a generator on the elliptic curve, mainly used for key generation and encryption operations in elliptic curve cryptography; is the private key of the participant; is a time parameter, indicating that the data is Inaccessible during the time period; is a random number; It is the original data;

[0163] It should be noted that a Verifiable Delay Function (VDFs) is a function that takes a certain amount of time to calculate, but the result can be verified quickly;

[0164] Storing time-locked encrypted data on the blockchain;

[0165] Participants generate their own private keys and set their own roles, departments, and permission information for accessing data time;

[0166] The participants perform the query data operation on the time-locked encrypted data, use the verifiable delay function VDFs to ensure the privacy of the data, and obtain the time-locked encrypted query results , the expression is:

[0167] ,

[0168] in, is the query result;

[0169] The participants will encrypt the query results according to the time lock and generate a ring signature zero-knowledge proof to prove that their operations have the legitimacy of the query and the data reading authority. The expression is:

[0170] ;

[0171] in, It is based on the ring signature zero-knowledge proof generation function. is the query circuit, are public input parameters;

[0172] The participants send the generated ring signature zero-knowledge proof to the verifier;

[0173] The verifier uses the public parameters generated by the administrator to verify the validity of the ring signature zero-knowledge proof and confirm that the participant has the right to access the data. The expression is:

[0174] ;

[0175] in, It is the ring signature zero-knowledge proof verification function.

[0176] It should be noted that the parties use ring signature zero-knowledge proof to generate proofs. For example:

[0177] Doctor A clearly needs to access patient B's health records and needs read permission;

[0178] Doctor A chooses a zero-knowledge proof algorithm based on ring signatures; ring signatures allow participants to sign messages anonymously among a group of possible signers while keeping the signature unforgeable;

[0179] Administrators define permission rules based on business requirements and convert permission rules into Boolean circuits;

[0180] Generate public parameters based on zero-knowledge proof of ring signature, including: elliptic curve parameters (such as secp256k1), hash function (such as SHA-256), security parameters (such as key length), public key set (including all possible signer public keys) and ring signature parameters (such as temporary parameters, challenge value and response value);

[0181] Use VDFs to time-lock shared data, ensuring that data is inaccessible for a certain period of time;

[0182] Generate time-locked encrypted data , the expression is:

[0183] ;

[0184] Assume the values ​​are:

[0185] Using the secp256k1 curve, the generator is a fixed point on the curve, such as =5;

[0186] The hash function is SHA-256;

[0187] Doctor A's private key ;

[0188] Time parameters ;

[0189] Random Numbers ;

[0190] Raw data ;

[0191] Query results ;

[0192] calculate , , ;

[0193] Assume that the hash function H returns a simple number, such as (In practice, the hash function returns a string of fixed length), calculate for: ;

[0194] Results Time-locked encrypted data ;

[0195] Doctor A generates his own private key , and set your role as a registered doctor, department as internal medicine, and time range as 9:00-17:00;

[0196] Doctor A's encrypted data is locked in time Execute the query operation on the server to obtain the encrypted query result based on time lock , expressed as:

[0197] ;

[0198] Substitute the data to calculate the encrypted query result based on time lock, expressed as:

[0199] ;

[0200] Doctor A generates a ring signature zero-knowledge proof P based on the time-locked encrypted query result, expressed as:

[0201] ;

[0202] Assuming that the generated ring signature zero-knowledge proof is a simple value, for example, P=123, then the generated ring signature zero-knowledge proof P=123;

[0203] Doctor A sends the generated ring signature zero-knowledge proof P=123 to the verifier (e.g., the hospital’s data manager).

[0204] The verifier uses the public parameters generated by the administrator to verify the validity of the ring signature zero-knowledge proof P, expressed as:

[0205] ;

[0206] Assume that the verification result is ;

[0207] Then the verification is passed, confirming that doctor A does have the permission to access the data;

[0208] The verifier confirms that Doctor A does have access to the data and records the verification result on the blockchain.

[0209] It should be noted that by defining data usage protocols and permission rules, the compliance and refined control of data usage are ensured, legal disputes are reduced and user trust is enhanced; the ring signature zero-knowledge proof realizes anonymous verification of user identity, protects privacy while ensuring that the signature cannot be forged, and enhances the security of the system; the introduction of verifiable delay functions VDFs to time-lock data increases the security layer of the time window, prevents the risk of immediate leakage, and supports time-sensitivity requirements; the overall security, privacy protection and flexibility of data management are improved, which is suitable for the efficient management and control of sensitive data.

[0210] S4. Use data encryption and oblivious transmission to securely transmit shared data and pass decryption keys, specifically:

[0211] To ensure the security of data transmission, the symmetric encryption algorithm AES is used to encrypt the data and generate encrypted data;

[0212] Generate an obliviously transmitted encrypted random array based on the data directory in the data transaction record recorded on the blockchain;

[0213] Assign a unique random number to each data directory, and generate a mapping relationship group based on the mapping relationship between each data address, number, description, hash value and random number;

[0214] Encrypting the mapping relationship using the public key of the data provider to generate first encrypted information;

[0215] The first encrypted information is stored on the blockchain, and after the data receiver decrypts the data, a hash fingerprint value of the decrypted data is calculated;

[0216] Compare the original data hash fingerprint value and the new hash fingerprint value after decryption to verify the consistency of the data.

[0217] It should be noted that the mapping relationship group is a structured data set, which contains the corresponding relationship between each data directory item and the random number; specifically, the mapping relationship group consists of the following elements:

[0218] Data address: the location or URL of the data in the storage system;

[0219] Number: unique identifier of the data item;

[0220] Description: A brief description or metadata information of the data item;

[0221] Hash value: The hash fingerprint of a data item, used to verify data integrity;

[0222] Random number: A unique random number assigned to each data directory entry, used for oblivious transmission;

[0223] Get the storage location or URL of each data item from the data transaction record on the blockchain;

[0224] Assign a unique number to each data item, usually extracted from the data transaction record;

[0225] Get description or metadata information for each data item;

[0226] Obtain the hash fingerprint of each data item from the data transaction record;

[0227] Generate a set of random numbers based on the size of the data directory. Each data directory entry corresponds to a unique random number; these random numbers can be generated using a cryptographically secure pseudo-random number generator CSPRNG;

[0228] Associate the information of each data directory item (data address, number, description and hash value) with the corresponding random number to form a mapping table;

[0229] Use the public key of the data provider to encrypt the entire mapping relationship group;

[0230] The encrypted mapping relationship group (first encrypted information) is stored on the blockchain to ensure that it cannot be tampered with;

[0231] The data receiver obtains the encrypted mapping relationship group from the blockchain;

[0232] Decrypt the mapping relationship group using the private key of the data receiver to obtain the original mapping table;

[0233] According to the decrypted mapping relationship group, find the random number corresponding to the required data, and use the random number as the decryption key;

[0234] After the data receiver decrypts the data, the hash fingerprint value of the decrypted data is calculated;

[0235] The calculated hash value is compared with the original hash value recorded on the blockchain to verify the consistency and integrity of the data.

[0236] It should be noted that by adopting the symmetric encryption algorithm AES and the oblivious transfer method, this solution ensures the secure transmission of shared data and the secure delivery of decryption keys; after the data is encrypted, the generated mapping relationship group is encrypted using the public key of the data provider and saved on the blockchain to ensure that it cannot be tampered with; after decrypting the data, the data recipient verifies the consistency of the data by comparing the hash fingerprint value, thereby ensuring the security and integrity of data transmission and preventing the data from being tampered with or leaked during transmission.

[0237] S5. The data recipient initiates a sharing request based on the decentralized identity DID and uses the ring signature zero-knowledge proof to prove its own authority, specifically:

[0238] The data recipient uses a decentralized digital identity (DID) for identification;

[0239] The data sender verifies the receiver's permissions through smart contracts;

[0240] Introducing ring signature zero-knowledge proof, the data recipient can prove that the participant has access rights without revealing specific permission details;

[0241] Once the verification is passed, the inadvertent transmission key information is generated, the data is decrypted, and the key information is recorded on the blockchain;

[0242] The data receiver obtains the inadvertently transmitted key information from the blockchain;

[0243] Using the oblivious transmission key information to decrypt the encrypted mapping relationship group to obtain the actual decryption key;

[0244] The data recipient obtains the encrypted data from the data storage unit based on the data directory information previously on the blockchain;

[0245] Decrypt the encrypted data using the decryption key to restore the original data;

[0246] Calculate the hash value of the decrypted data and compare the calculated hash fingerprint value with the original hash fingerprint value recorded on the blockchain;

[0247] If the hash values ​​are consistent, it is determined that the data has not been tampered with and the data sharing is successful.

[0248] It should be noted that the data recipient uses a decentralized identity DID to initiate a sharing request and verifies its access rights through a ring signature zero-knowledge proof; after verification by the sender's smart contract, the inadvertently transmitted key information is generated and recorded on the blockchain; the recipient obtains the key information from the blockchain, decrypts the mapping relationship group to obtain the actual decryption key, and then decrypts the data; by comparing the decrypted hash value with the original hash value on the blockchain, it ensures that the data has not been tampered with, thereby achieving secure and reliable data sharing and access control.

[0249] This embodiment also provides a blockchain-based data sharing system, including: a data collection and processing module, a hash module, a smart contract module, an encryption module and a sharing module; the data collection and processing module is used to collect heterogeneous data from different enterprises, determine the identity authentication of each participant through a decentralized identity DID, and pre-process the collected data; the hash module is used to hash the pre-processed data, build a data transaction record with detailed information, and permanently record the data transaction record in the blockchain through a blockchain network consensus mechanism; the smart contract module is used to define smart contracts on the blockchain, use ring signature zero-knowledge proof to allow authenticated participants to perform operations, and record data operations on the blockchain; the encryption module is used to use data encryption and oblivious transfer method to securely transmit shared data and transfer decryption keys; the sharing module is used for the data recipient to initiate a sharing request based on the decentralized identity DID, and use the ring signature zero-knowledge proof to prove its own authority.

[0250] In summary, through ring signatures, the present invention enables participants to anonymously sign messages among a group of possible signers, ensuring the anonymity and unforgeability of the identity; zero-knowledge proof allows participants to prove that they have corresponding data access rights without revealing specific permission details; this combination not only enhances the granularity and security of data access control, but also protects the privacy of participants; in addition, the introduction of ring signature zero-knowledge proof reduces the risk of single point failure, improves the overall robustness and credibility of the system, and ensures that only strictly verified participants can perform data operations, thereby enhancing the overall security and reliability of data sharing.

[0251] Example 2, referring to Table 1, is the second example of the present invention. In order to further verify the technical solution of the present invention, experimental simulation data of the data sharing method based on blockchain is provided.

[0252] This experiment studies the data collection, processing, sharing and secure transmission between hospital A and insurance company B in the scenario of medical data sharing;

[0253] First, collect electronic medical records and medical images from hospital A, and collect claim application texts from insurance company B; classify and annotate the data, and add metadata; use Apache NiFi tools for preprocessing, including cleaning, format conversion, and missing value filling;

[0254] Secondly, generate hash fingerprints for the preprocessed data and construct data transaction records containing data description, hash value, metadata, and ownership information; use the Web3.js library to send the records to the Ethereum network, confirm their validity through the PoA consensus mechanism, and store them in the block;

[0255] Next, a smart contract is written to define the data access rights rules. When Insurance Company B requests access to the data, DID and ring signature zero-knowledge proof are used to verify its permissions. All data operation activities are recorded on the blockchain to ensure transparency and traceability.

[0256] Finally, the AES algorithm is used to encrypt the data, and a random array is generated according to the data transaction record to form a mapping relationship group, which is encrypted with the public key of the data provider; the receiver decrypts the mapping relationship group to obtain the decryption key, decrypts the data and verifies the hash value to ensure that the data has not been tampered with.

[0257] Table 1 Data processing and security technology performance comparison

[0258]

[0259] As can be seen from Table 1, the data preprocessing time is shortened from 60 minutes to 32 minutes, which not only saves time but also improves data quality and consistency. The present invention uses the automated Apache NiFi tool to replace manual cleaning, format conversion and missing value filling, significantly improving efficiency; the hash processing time is reduced from 10 seconds to 2 seconds. The present invention adopts an optimized hash algorithm, which is more efficient than the traditional hash algorithm, significantly improving the response speed of the system and the real-time performance of data management; the smart contract verification time is reduced from 5 seconds to 1.5 seconds, speeding up the verification process. The present invention uses a blockchain-based smart contract to replace the verification based on a centralized server, improving the speed and security of verification; the ring signature zero-knowledge proof generation time is reduced from 10 seconds to about 3 seconds, simplifying the permission verification process;

[0260] The present invention introduces the ring signature zero-knowledge proof technology, which replaces the traditional identity authentication method and provides higher security and privacy protection; the decentralized identity authentication time is reduced from 2 seconds to 0.8 seconds, which improves the identity authentication efficiency and makes data sharing more convenient and secure; the present invention uses a decentralized identity authentication system, which replaces the centralized identity authentication system and enhances the security and reliability of the system.

[0261] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data sharing method based on blockchain, characterized in that: The following steps are involved: S1. Collect heterogeneous data from different enterprises, determine the identity verification of each participant through decentralized identity DID, and pre-process the collected data; S2. Perform hashing on the preprocessed data to construct a data transaction record with detailed information, and permanently record the data transaction record in the blockchain through the blockchain network consensus mechanism; S3. Define smart contracts on the blockchain, use ring signature zero-knowledge proof to allow authenticated parties to perform operations, and record data operations on the blockchain, specifically: Develop data access rights rules based on business needs and agreements between stakeholders; Define read permission levels, write permission levels, delete permission levels, and manage permission levels; Define time range conditions, geographic location conditions, and data type conditions; Write smart contract functions for data reading, writing and manipulation; When a participant accesses data, the smart contract authenticates the participant through DID verification and ring signature zero-knowledge proof; Use decentralized identity DID to identify participants and verify their identities; The participants use the ring signature zero-knowledge proof to generate proof to prove that they have the corresponding authority; The smart contract verifies the validity of the ring signature zero-knowledge proof and determines that the participating parties have the corresponding permissions; Record every data access and operation on the blockchain; Among them, the participants use the ring signature zero-knowledge proof to generate the proof, as follows: Participants clearly understand their rights and permission levels to access specific data; Select the ring signature zero-knowledge proof to generate the proof; The administrator defines permission rules according to business requirements and converts the permission rules into Boolean circuits to generate public parameters for ring signature zero-knowledge proof; Introduce verifiable delay functions VDFs to time-lock shared data and obtain time-locked encrypted data , the expression is: ； Where H is the hash function, is a generator on the elliptic curve, is the private key of the participant, is the time parameter, is a random number, It is the original data; Participants generate their own private keys and set their own roles, departments, and permission information for accessing data time; The participants perform the query data operation on the time-locked encrypted data, use the verifiable delay function VDFs to ensure the privacy of the data, and obtain the time-locked encrypted query results , the expression is: ， in, is the query result; The participants lock the encrypted query results according to the time and generate a ring signature zero-knowledge proof to prove that their operations have the legitimacy of the query and the data reading authority; The participants send the generated ring signature zero-knowledge proof to the verifier; The verifier uses the public parameters generated by the administrator to verify the validity of the ring signature zero-knowledge proof and confirm that the participant has the authority to access the data; S4. Use data encryption and oblivious transmission to securely transmit shared data and pass decryption keys; specifically: Use the symmetric encryption algorithm AES to encrypt the data and generate encrypted data; Generate an obliviously transmitted encrypted random array based on the data directory in the data transaction record recorded on the blockchain; Assign a unique random number to each data directory, and generate a mapping relationship group based on the mapping relationship between each data address, number, description, hash value and random number; Encrypting the mapping relationship using the public key of the data provider to generate first encrypted information; The first encrypted information is stored on the blockchain, and after the data receiver decrypts the data, a hash fingerprint value of the decrypted data is calculated; Compare the original data hash fingerprint value with the new hash fingerprint value after decryption to verify the consistency of the data; S5. The data recipient initiates a sharing request based on the decentralized identity DID and uses the ring signature zero-knowledge proof to prove its own authority, specifically: The data recipient uses a decentralized digital identity (DID) for identification; The data sender verifies the receiver's permissions through smart contracts; Introducing ring signature zero-knowledge proof, the data recipient can prove that the participant has access rights without revealing specific permission details; Once the verification is passed, the inadvertent transmission key information is generated, the data is decrypted, and the key information is recorded on the blockchain; The data receiver obtains the inadvertently transmitted key information from the blockchain; Using the oblivious transmission key information to decrypt the encrypted mapping relationship group to obtain the actual decryption key; The data recipient obtains the encrypted data from the data storage unit based on the data directory information previously on the blockchain; Decrypt the encrypted data using the decryption key to restore the original data; Calculate the hash value of the decrypted data and compare the calculated hash fingerprint value with the original hash fingerprint value recorded on the blockchain; If the hash values ​​are consistent, it is determined that the data has not been tampered with and the data sharing is successful.

2. A data sharing method based on blockchain according to claim 1, characterized in that: S1 is specifically: Collect structured and unstructured data from different enterprises; Categorize the collected data and mark the source; Add metadata to each data set to record the data source and timestamp; Use the W3C standard decentralized identity DID method to create a unique digital identity for each participant to identify and verify the identity of the participant; The data is pre-processed using Apache NiFi in the ETL tool.

3. A data sharing method based on blockchain according to claim 2, characterized in that: S2 is specifically: Combine the preprocessed data X with time t to generate a hash fingerprint value, expressed as: ， in, is the generated hash fingerprint value, Represents a bitwise XOR binary operation; Construct data transaction records with data descriptions, hash values, metadata, ownership information, and authorization information; Use the Web3.js library to send data transaction records to the blockchain network; Create blockchain transactions and send data transaction records to nodes in the blockchain network; After receiving the data transaction record, the nodes in the blockchain network verify the data transaction record; Confirm the validity of data transaction records through the consensus mechanism PoA; The data that confirms the validity of the data transaction record is added to a new block and linked to the blockchain for permanent storage.

4. A data sharing system based on blockchain, characterized in that: Used to implement the blockchain-based data sharing method according to any one of claims 1 to 3, the system includes a data acquisition and processing module, a hash module, a smart contract module, an encryption module and a sharing module; The data collection and processing module is used to collect heterogeneous data from different enterprises, determine the identity verification of each participant through the decentralized identity DID, and pre-process the collected data; The hash module is used to perform hash processing on the preprocessed data, construct a data transaction record with detailed information, and permanently record the data transaction record in the blockchain through the blockchain network consensus mechanism; The smart contract module is used to define smart contracts on the blockchain, use ring signature zero-knowledge proof to allow authenticated parties to perform operations, and record data operations on the blockchain; The encryption module is used to securely transmit the shared data and transfer the decryption key by using data encryption and oblivious transmission method; The sharing module is used by the data recipient to initiate a sharing request based on the decentralized identity DID, and use the ring signature zero-knowledge proof to prove its own authority.

Images