Data processing method and device, electronic device, and storage medium

Abstract

An embodiment of the present invention provides a data processing method and device, an electronic device, and a storage medium. An initial ciphertext header is generated according to multiple authorization sets corresponding to target data, and the initial ciphertext header is saved in a blockchain network. The initial ciphertext header is used for multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header, and a first attribute key corresponding to a first device is generated according to a second attribute set, a system public key, and a master key. Therefore, the first device needs to obtain multiple ciphertext header shares from the blockchain network through the first attribute key in order to decrypt the encrypted data. When the first device does not have access rights to the target data, even if the cloud server backs up the encrypted data in advance, the first device cannot decrypt the encrypted data to obtain the target data, thereby reducing the dependence on the credibility of the cloud server and effectively improving the security of data sharing between devices.

Description

Technical Field

[0001] The present invention relates to the field of data encryption, and in particular to a data processing method and device, electronic equipment, and storage medium. Background Art

[0002] In the Industrial Internet, a vast number of industrial devices generate vast amounts of data. Due to the storage and computing limitations of these devices, timely storage and processing of this vast amount of data is difficult. Therefore, industrial devices often share this massive data through public cloud servers, which offer powerful storage and computing capabilities.

[0003] Ciphertext-Policy Attribute-based Encryption (CP-ABE) effectively meets the data security sharing needs of a large number of industrial devices. In CP-ABE, industrial devices' access rights to data resources are completely related to their attributes, and different industrial devices may have the same attributes. If a device no longer possesses a certain attribute, it should no longer have the corresponding access rights. Therefore, revoking the device's attributes can prevent unauthorized access.

[0004] In related technologies, ciphertext encrypted using CP-ABE is stored on a public cloud server. When an attribute revocation event occurs, the public cloud server must update the ciphertext to prevent the revoked device from accessing it. However, if a corrupted public cloud server backs up the ciphertext before performing the update, it could easily collude with the revoked device to gain unauthorized access, severely impacting data security. Summary of the Invention

[0005] In view of the above problems, a data processing method and device, electronic device, and storage medium are proposed to overcome or at least partially solve the above problems, including:

[0006] A data processing method, comprising:

[0007] In response to a request from a first device to obtain target data from a second device, obtaining a system public key, a master key, a first attribute set corresponding to the target data, and multiple authorization sets; wherein the first attribute set is a set of first attributes corresponding to all devices allowed to access the target data, and the authorization set is a set consisting of multiple first attributes;

[0008] Encrypting the target data according to the system public key and the first attribute set to obtain encrypted data, and saving the encrypted data to a cloud server;

[0009] Generating an initial ciphertext header according to the multiple authorization sets, and saving the initial ciphertext header to the blockchain network; the initial ciphertext header is used by multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header;

[0010] Obtaining a second attribute set corresponding to the first device, and generating a first attribute key corresponding to the first device according to the second attribute set, the system public key, and the master key;

[0011] The system public key and the first attribute key are sent to the first device, so that the first device obtains the multiple ciphertext header shares from the blockchain network according to the first attribute key, and obtains the encrypted data from the cloud server, and decrypts the encrypted data according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data.

[0012] Optionally, before obtaining the system public key, the master key, and the first attribute set and multiple authorization sets corresponding to the target data in response to the request of the first device to obtain the target data of the second device, the method further includes:

[0013] Obtaining the number of the multiple target nodes;

[0014] Obtaining a third attribute set corresponding to all devices, and determining a first attribute version number corresponding to each attribute in the third attribute set; wherein the third attribute set includes the first attribute set;

[0015] The system public key and the master key are generated according to the third attribute set, the number of the multiple target nodes, and the first attribute version number.

[0016] Optionally, the method further includes:

[0017] In response to a revocation event of a target attribute in the second attribute set, determining a second attribute version number corresponding to the target attribute in the first attribute version number and updating the second attribute version number to obtain a target attribute version number;

[0018] Update the system public key according to the target attribute version number to obtain the target system public key;

[0019] Generate a ciphertext update key and an attribute update key according to the second attribute version number, the target attribute version number, and the target system public key, and update the initial ciphertext header;

[0020] Sending the ciphertext update key to the cloud server so that the cloud server updates the encrypted data according to the ciphertext update key;

[0021] The attribute update key is sent to a third device that has not revoked the target attribute, so that the third device updates a second attribute key corresponding to the third device according to the attribute update key.

[0022] Optionally, the step of enabling the first device to obtain the multiple ciphertext header shares from the blockchain network according to the first attribute key includes:

[0023] generating a secret share for the master key for each of the plurality of target nodes, and sending the secret share to the blockchain network;

[0024] Generate a ciphertext header request according to the first attribute key by the first device, and send the ciphertext header request to the blockchain network;

[0025] The ciphertext header request is received through the blockchain network, the multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request, and the multiple ciphertext header shares are sent to the first device.

[0026] Optionally, the generating, by the first device, a ciphertext header request according to the first attribute key includes:

[0027] Determine an attribute key version number corresponding to the first attribute key according to the second attribute set and the system public key;

[0028] The ciphertext header request is generated by the first device according to the attribute key version number and the first attribute key.

[0029] Optionally, receiving the ciphertext header request through the blockchain network, and generating the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request, includes:

[0030] receiving, through the blockchain network, a ciphertext header request from the first device, and extracting the attribute key version number from the ciphertext header request;

[0031] Determine the public key version number corresponding to the system public key, and compare the public key version number with the attribute key version number;

[0032] If the public key version number is consistent with the attribute key version number, the multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request.

[0033] Optionally, the multiple target nodes include a leader node and multiple candidate nodes corresponding to the leader node; wherein the leader node is used to manage nodes in the blockchain network other than the leader node.

[0034] A data processing device, comprising:

[0035] a request response module, configured to, in response to a request from a first device to obtain target data from a second device, obtain a system public key, a master key, a first attribute set corresponding to the target data, and multiple authorization sets; wherein the first attribute set is a set of first attributes corresponding to all devices allowed to access the target data, and the authorization set is a set consisting of multiple first attributes;

[0036] an encryption module, configured to encrypt the target data according to the system public key and the first attribute set to obtain encrypted data, and save the encrypted data to a cloud server;

[0037] A ciphertext header share generation module is configured to generate an initial ciphertext header based on the multiple authorization sets and store the initial ciphertext header in the blockchain network; the initial ciphertext header is used by multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header;

[0038] a first attribute key generation module, which obtains a second attribute set corresponding to the first device, and generates a first attribute key corresponding to the first device according to the second attribute set, the system public key, and the master key;

[0039] The first attribute key sending module sends the system public key and the first attribute key to the first device, so that the first device obtains the multiple ciphertext header shares from the blockchain network according to the first attribute key, and obtains the encrypted data from the cloud server, and decrypts the encrypted data according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data.

[0040] Optionally, the device further comprises:

[0041] A target node quantity acquisition module, configured to acquire the quantity of the plurality of target nodes;

[0042] a first attribute version number determination module, configured to obtain a third attribute set corresponding to all devices and determine a first attribute version number corresponding to each attribute in the third attribute set; wherein the third attribute set includes the first attribute set;

[0043] A system public key and master key generation module is configured to generate the system public key and the master key according to the third attribute set, the number of the plurality of target nodes, and the first attribute version number.

[0044] Optionally, the device further comprises:

[0045] a target attribute version number determining module, configured to, in response to a revocation event of a target attribute in the second attribute set, determine a second attribute version number corresponding to the target attribute from the first attribute version number and update the second attribute version number to obtain a target attribute version number;

[0046] A target system public key determination module, configured to update the system public key according to the target attribute version number to obtain a target system public key;

[0047] an update key module, configured to generate a ciphertext update key and an attribute update key according to the second attribute version number, the target attribute version number, and the target system public key, and to update the initial ciphertext header;

[0048] a ciphertext update key sending module, configured to send the ciphertext update key to the cloud server, so that the cloud server updates the encrypted data according to the ciphertext update key;

[0049] The attribute update key sending module is configured to send the attribute update key to a third device whose target attribute has not been revoked, so that the third device updates a second attribute key corresponding to the third device according to the attribute update key.

[0050] Optionally, the first attribute key sending module further includes:

[0051] a secret share generation submodule, configured to generate a secret share for the master key for each of the plurality of target nodes, and send the secret share to the blockchain network;

[0052] a ciphertext header request processing submodule, configured to generate a ciphertext header request according to the first attribute key through the first device, and send the ciphertext header request to the blockchain network;

[0053] The ciphertext header share processing submodule is used to receive the ciphertext header request through the blockchain network, generate the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request, and send the multiple ciphertext header shares to the first device.

[0054] Optionally, the ciphertext header request processing submodule includes:

[0055] an attribute key version number determining unit, configured to determine an attribute key version number corresponding to the first attribute key according to the second attribute set and the system public key;

[0056] The ciphertext header request generating unit is configured to generate the ciphertext header request according to the attribute key version number and the first attribute key through the first device.

[0057] Optionally, the ciphertext header share processing submodule includes:

[0058] an attribute key version number extraction unit, configured to receive a ciphertext header request from the first device through the blockchain network, and extract the attribute key version number from the ciphertext header request;

[0059] a key version number comparison unit, configured to determine a public key version number corresponding to the system public key, and compare the public key version number with the attribute key version number;

[0060] The ciphertext header share generating unit is configured to generate the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request if the public key version number is consistent with the attribute key version number.

[0061] An electronic device includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the data processing method described above when executed by the processor.

[0062] A computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the data processing method as described above

[0063] The embodiments of the present invention have the following advantages: by generating an initial ciphertext header according to multiple authorization sets corresponding to the target data, and saving the initial ciphertext header to the blockchain network, the initial ciphertext header is used for multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header, and generating a first attribute key corresponding to the first device according to the second attribute set, the system public key, and the master key, so that the first device needs to obtain multiple ciphertext header shares from the blockchain network through the first attribute key to decrypt the encrypted data. When the first device does not have access rights to the target data, even if the cloud server backs up the encrypted data in advance, the first device cannot decrypt the encrypted data to obtain the target data, thereby reducing the dependence on the credibility of the cloud server and effectively improving the security of data sharing between devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the description of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 This is a schematic diagram of a related art attack involving a public cloud server and a device with revoked attributes.

[0066] Figure 2 This is a flowchart of a data processing method provided by one embodiment of the present invention;

[0067] Figure 3 This is a schematic diagram of a data processing system architecture provided by an embodiment of the present invention;

[0068] Figure 4 This is a structural block diagram of a data processing device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0069] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are also within the scope of protection of the present invention.

[0070] CP-ABE is a public-key encryption technology based on device attributes, supporting a one-to-many encryption and decryption model and fine-grained access control. The system manages the attributes of all registered industrial devices and assigns different access rights to encrypted data based on different attributes or attribute combinations. However, industrial devices often have rudimentary security measures, making them easy targets for attackers. Furthermore, a large number of industrial devices frequently enter and exit the system due to malfunctions or environmental factors, resulting in changes in their attributes. Therefore, attribute revocation is required for exiting industrial devices to prevent unauthorized access.

[0071] However, if the attribute is simply deleted from the system, not only will the purpose of revoking permissions be failed, but two abnormal situations will also occur. First, the revoked device still has the attribute key before revocation and can decrypt the ciphertext; second, the device newly added to the system cannot obtain the key corresponding to the attribute and thus cannot decrypt the ciphertext published before revocation.

[0072] Therefore, in order to achieve effective permission revocation, the ciphertext stored on the public cloud server and the attribute keys of the unrevoked device must be updated. Since the revoked device cannot obtain the updated attribute key, it is difficult to decrypt the updated ciphertext. Therefore, it can be seen that the update of the ciphertext is very necessary in permission revocation. Assuming that in a revocation CP-ABE scheme, the cloud server is the only provider of ciphertext, and the device must download the ciphertext from the cloud server every time it accesses data, then the scheme contains the following two types of ciphertext:

[0073] Type A: Ciphertext uploaded to the public cloud server before the revocation event occurs;

[0074] Type B: Ciphertext uploaded to the public cloud server after a revocation event occurs.

[0075] Type A ciphertext is encrypted using the system public key before the revocation event and must be updated after the revocation event. Type B ciphertext is encrypted using the updated system public key and can be correctly decrypted if the attribute sets of newly added industrial devices and industrial devices with updated attribute keys meet the access policy. For revoked devices, even if the original attribute set before revocation meets the access policy, the device cannot correctly decrypt these two types of ciphertext because the attribute key cannot be updated.

[0076] In related technologies, the update of ciphertext is performed by public cloud servers, so public cloud servers have greater power in revoking permissions. If a corrupted public cloud server backs up the ciphertext to be updated before performing the ciphertext update, it is easy to collude with the revoked device to achieve illegal access. Figure 1 As shown in the figure, after an attribute revocation event occurs, although the revoked device no longer possesses the revoked attribute, it still possesses the key corresponding to that attribute and can correctly decrypt the old ciphertext before the update. This means that there exists an "old ciphertext - old key" correspondence. In the CP-ABE scheme, public cloud servers are generally assumed to be "honest and curious," meaning they can honestly perform ciphertext updates but are curious about the plaintext information contained within them. For an "honest and curious" public cloud server, updating ciphertext and backing up the old ciphertext before the update do not conflict, thus satisfying the "honest and curious" security assumption. While it can update "honestly," it can collude with the revoked device to obtain its "curious" plaintext information, thereby compromising data security.

[0077] Based on this, the present invention proposes a data processing method and device, an electronic device, and a storage medium to overcome or partially overcome the above-mentioned deficiencies in the related art.

[0078] Reference Figure 2 , which shows a flowchart of a data processing method provided by an embodiment of the present invention, which may specifically include the following steps:

[0079] Step 201: In response to a request from a first device to obtain target data from a second device, obtain a system public key, a master key, a first attribute set corresponding to the target data, and multiple authorization sets; wherein the first attribute set is a set of first attributes corresponding to all devices allowed to access the target data, and the authorization set is a set of multiple first attributes;

[0080] In step 201, the second device is the data owner, the target data is the data held by the data owner, that is, the plaintext to be encrypted, and the first device is the data user. To ensure secure data sharing, especially in the context of data transmission between devices in the Industrial Internet, the plaintext must be encrypted to obtain ciphertext during the target data transmission process. After receiving the ciphertext, the data user decrypts it back to the plaintext, achieving end-to-end secure data transmission.

[0081] The system public key is public and can be freely distributed to any entity that needs to communicate securely with the system or organization. It is used to authenticate entities involved in encryption and decryption. The master key is a private key used to generate or derive other keys from ciphertext. In practical applications, the system public key and master key can be generated in advance and stored on the corresponding server or blockchain network.

[0082] The first attribute set is a collection of first attributes corresponding to all devices that are allowed to access the target data. The first attribute can be information such as the device model, device ID, device type, etc. Only when the device has the corresponding attributes can it access the ciphertext and decrypt the plaintext. The authorization set is a set of multiple first attributes. That is, in addition to having the corresponding attributes, the device must also meet the combination of first attributes defined by the authorization set to access and decrypt the ciphertext. For example, a device has two attributes a and b. The access policy "a∧(b∨c)" for ciphertext data contains two authorization sets: A1 = {a, b}, A2 = {a, c}. Then the attributes possessed by the device meet the authorization set A1, and the device has access rights to the ciphertext data.

[0083] In practical applications, the first attribute set and authorization set for target data can be defined by an access structure. For example, in the access structure (M, ρ), M represents the set of first attributes corresponding to all devices allowed to access the target data, i.e., the first attribute set, which can be specifically represented by a matrix. ρ is a function that maps subsets of M to Boolean values. This function can be used to define different authorization sets.

[0084] In some embodiments of the present invention, before obtaining the system public key, the master key, and the first attribute set and the plurality of authorization sets corresponding to the target data in response to the request from the first device to obtain the target data from the second device, the method further includes:

[0085] Obtaining the number of the multiple target nodes;

[0086] Obtaining a third attribute set corresponding to all devices, and determining a first attribute version number corresponding to each attribute in the third attribute set; wherein the third attribute set includes the first attribute set;

[0087] The system public key and the master key are generated according to the third attribute set, the number of the multiple target nodes, and the first attribute version number.

[0088] In this embodiment, the target node is the target node in the blockchain network used to store the initial ciphertext header in subsequent steps. The third attribute set is the attributes corresponding to all devices registered with the system, which are managed by the system. The third attribute set includes the first attribute set corresponding to devices allowed to access the target data, that is, the first attribute set is a subset of the third attribute set.

[0089] In specific implementation, the system public key and master key can be generated during system initialization in the following ways:

[0090] First, choose a group of order p p>N, where The generator is g, and N is the number of target nodes.

[0091] Then, select a prime number q such that (q-1) mod p = 0; select And it is a p-order element, is a finite field of order q; for each attribute i in the third attribute set, randomly select h i :h1, And the version number v corresponding to each attribute i i :v1,v2,v3...v U ∈ Where U is the total number of attributes i, is a finite field of order p.

[0092] Furthermore, we randomly select α,a, The final public key PK is:

[0093]

[0094] Where e is represented as a bilinear mapping function.

[0095] Furthermore, the master key MSK generated by the above-determined parameters is: MSK={g α ,a,β}.

[0096] In some embodiments of the present invention, the multiple target nodes include a leader node and multiple candidate nodes corresponding to the leader node; wherein the leader node is used to manage nodes other than the leader node in the blockchain network.

[0097] In practice, all nodes in a blockchain network can be divided into: a leader node, responsible for controlling and managing other nodes in the blockchain network; multiple candidate nodes, serving as backups for the leader node. When a majority of candidate nodes deem the leader node untrustworthy, or when the leader node experiences downtime or disconnection, a backup node can be re-elected to become the leader node; and follower nodes, which are other nodes responsible for maintaining the blockchain network. The committee node, consisting of a leader node and its corresponding candidate nodes, is the target node.

[0098] Step 202: encrypt the target data according to the system public key and the first attribute set to obtain encrypted data, and save the encrypted data to a cloud server;

[0099] In step 202 , in order to associate the attributes corresponding to the device that can access the encrypted data with the target data, the target data may be encrypted by combining the system public key and the first attribute set to obtain encrypted data.

[0100] In specific implementation, the target data can be encrypted in the following ways:

[0101] First, let the target data be The first attribute set and the authorization set are defined by an access structure (M, ρ), where the first attribute set M is represented by a linear secret-sharing scheme (LSSS) matrix, and ρ is a function defining the authorization set.

[0102] Further, select as a secret shared for the first set of attributes, and then construct a random vector Then randomly select And let s=s1+s2.

[0103] Furthermore, the obtained system public key PK is:

[0104]

[0105] Furthermore, let λ i =M i v T , where i∈[1,l], l is the number of rows in the matrix M, M i is the i-th row vector of matrix M, v T Represents a row vector v The transpose of ρ(i) is used, and then a random number r is selected for each function ρ(i). i , combined with the system public key PK to target data The encrypted data CT obtained after encryption is:

[0106]

[0107] Among them, C, E, B i 、C i 、D i They are all components of the encrypted data CT, that is, components.

[0108] After the target data is encrypted through the above steps to obtain encrypted data, the encrypted data is sent to a cloud server and stored. In actual applications, the cloud server can be a public cloud server.

[0109] Step 203: Generate an initial ciphertext header based on the multiple authorization sets, and save the initial ciphertext header to the blockchain network; the initial ciphertext header is used by multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header;

[0110] In step 203, the initial ciphertext header is stored in the blockchain network and serves as a participant in encrypting the target data. When decrypting the data, the device requesting access to the target data can be authenticated based on the multiple ciphertext header shares generated by the multiple target nodes in the blockchain for the initial ciphertext header. This can avoid excessive reliance on cloud servers, especially public cloud servers, thereby improving the security of encrypted data.

[0111] In a specific implementation, the initial ciphertext header can be generated in the following ways:

[0112] Assume that P authorization sets A are defined in the access structure i , where i∈[1,P], then the initial ciphertext header for:

[0113]

[0114] Step 204: Acquire a second attribute set corresponding to the first device, and generate a first attribute key corresponding to the first device based on the second attribute set, the system public key, and the master key;

[0115] In step 204, the first attribute key is used to associate with the second attribute set. When the first device requests to access and decrypt target data using the attribute key, the first attribute key can be used to determine whether the first device has the corresponding attribute and whether the attribute is valid.

[0116] In the specific implementation, let the second attribute set be S, and randomly select The first attribute key SK is calculated and generated by the following formula:

[0117]

[0118] Among them, K, L, K xBoth represent components of the first attribute key SK, that is, components.

[0119] Step 205: Send the system public key and the first attribute key to the first device, so that the first device obtains the multiple ciphertext header shares from the blockchain network according to the first attribute key, and obtains the encrypted data from the cloud server, and decrypts the encrypted data according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data.

[0120] In step 205, the first device uses the first attribute key as a credential to request the blockchain network to obtain multiple ciphertext header shares corresponding to the initial ciphertext headers generated by multiple target nodes, and obtains encrypted data from the cloud server. Finally, the encrypted data is decrypted according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data.

[0121] In the specific implementation, the encrypted data can be decrypted to obtain the target data in the following way:

[0122] First, assume that the obtained system public key PK is:

[0123]

[0124] The first attribute key SK is:

[0125]

[0126] The multiple ciphertext header shares obtained from k+1 target nodes in the blockchain network are: in is the secret share of each target node in the blockchain network for the initial ciphertext header, and N is the number of target nodes.

[0127] Then, the ciphertext header Hdr is reconstructed by Lagrange polynomial interpolation method, specifically:

[0128] make but

[0129] When the first device has access rights to the target data, that is, the second attribute set satisfies at least one authorization set, then the first device can certainly find a set of constants Make Established, of which For the authorization set.

[0130] Furthermore, define Then decrypt the encrypted data to get the target data using the following formula

[0131]

[0132] In some embodiments of the present invention, enabling the first device to obtain the multiple ciphertext header shares from the blockchain network according to the first attribute key includes:

[0133] generating a secret share for the master key for each of the plurality of target nodes, and sending the secret share to the blockchain network;

[0134] In a specific implementation, a secret share for the master key may be generated for each of the multiple target nodes in the following manner:

[0135] Each target node is Extract the master key MSK = {g α ,a,β} and randomly select As the coefficients of the polynomial f(x), where the threshold is k+1, let f(0)=a, then the polynomial f(x) is:

[0136] f(x)=a+a1x+a2x 2 +…+a k x k modp

[0137] Then calculate the target node The secret share of the master key

[0138] Generate a ciphertext header request according to the first attribute key by the first device, and send the ciphertext header request to the blockchain network;

[0139] In a specific implementation, the blockchain network needs to verify whether the attributes of the first device are valid and distribute a ciphertext header share to the first device. Therefore, the first device needs to generate a ciphertext header request based on its first attribute key and then send the ciphertext header request to the blockchain network.

[0140] The ciphertext header request is received through the blockchain network, the multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request, and the multiple ciphertext header shares are sent to the first device.

[0141] In a specific implementation, the target node's ciphertext header share for the initial ciphertext header can be generated in the following way:

[0142] First, the initial ciphertext header is: The ciphertext header request is: in is the version number corresponding to the first attribute key, L is the first attribute key Component L in γ corresponds to the authorization set A satisfied by the second attribute set γ .

[0143] Then, each target node Combined with the secret share for the initial ciphertext header Generate ciphertext header share

[0144] In some embodiments of the present invention, generating, by the first device, a ciphertext header request according to the first attribute key further includes:

[0145] Determine an attribute key version number corresponding to the first attribute key according to the second attribute set and the system public key;

[0146] In specific implementations, the attribute key version number can be generated in the following ways:

[0147] The system public key PK is:

[0148]

[0149] The first attribute key SK is:

[0150]

[0151] Let the authorization set satisfied by the second attribute set be A γ , let the set The attribute key version number

[0152] The ciphertext header request is generated by the first device according to the attribute key version number and the first attribute key.

[0153] In specific implementation, the ciphertext header request can be generated in the following ways:

[0154] The first attribute key SK is Combined with the above attribute key version number Authorization Set A γ , construct the ciphertext header request as:

[0155] In some embodiments of the present invention, receiving the ciphertext header request through the blockchain network and generating the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request includes:

[0156] receiving, through the blockchain network, a ciphertext header request from the first device, and extracting the attribute key version number from the ciphertext header request;

[0157] In the specific implementation, let the ciphertext header request be Then extract the attribute key version number from it

[0158] Determine the public key version number corresponding to the system public key, and compare the public key version number with the attribute key version number;

[0159] In specific implementations, the public key version number corresponding to the system public key can be determined in the following ways:

[0160] The system public key is:

[0161]

[0162] The public key version number corresponding to the system public key in

[0163] If the public key version number is consistent with the attribute key version number, the multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request.

[0164] In the specific implementation, the attribute key version number can be verified by the following formula and public key version number V s Is it consistent?

[0165]

[0166] When the above formula is established, the public key version number and the attribute key version number are considered to be consistent, and in response to the ciphertext header request of the first device, multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request.

[0167] In some embodiments of the present invention, the method further comprises:

[0168] In response to a revocation event of a target attribute in the second attribute set, determining a second attribute version number corresponding to the target attribute in the first attribute version number and updating the second attribute version number to obtain a target attribute version number;

[0169] In this embodiment, when the first device exits the secure sharing of encrypted data due to factors such as failure or environmental changes, it is necessary to perform attribute revocation on it, that is, to revoke the mapping relationship between the first device and the target attribute. When a revocation event occurs to the target attribute in the second attribute set of the first device, for other third devices that also have the target attribute and whose target attribute has not been revoked, it is necessary to update the system public key, initial ciphertext header, second attribute key corresponding to the third device, and encrypted data involved in decrypting the encrypted data to ensure normal access to the target data by the third device. Therefore, the target attribute can be first determined in the third attribute set corresponding to all devices managed by the system, and then the second attribute version number corresponding to the target attribute can be determined. The second attribute version number is updated to obtain the target attribute version number, and then the system public key, initial ciphertext header, second attribute key, and encrypted data are updated based on the target attribute version number.

[0170] In the specific implementation, the second attribute version number can be updated in the following way:

[0171] Let the target attribute be χ and the second attribute version number be v χ , then randomly select As the target attribute version number.

[0172] Update the system public key according to the target attribute version number to obtain the target system public key;

[0173] Generate a ciphertext update key and an attribute update key according to the second attribute version number, the target attribute version number, and the target system public key, and update the initial ciphertext header;

[0174] In the specific implementation, the target attribute version number v′ can be calculated based on the following method χ Update the system public key PK:

[0175] The system public key PK before the update is:

[0176]

[0177] Then the updated system public key PK' is:

[0178]

[0179] Furthermore, random selection According to the second attribute version number v χ , target attribute version number v′ χ , the ciphertext update key UK generated by the system public key PK' ct for:

[0180]

[0181] Property Update Key UK sk for:

[0182]

[0183] Furthermore, for the initial ciphertext header Update, the updated initial ciphertext header for:

[0184]

[0185] Furthermore, the updated initial ciphertext header can be sent to the blockchain network for storage.

[0186] Sending the ciphertext update key to the cloud server so that the cloud server updates the encrypted data according to the ciphertext update key;

[0187] In specific implementations, encrypted data can be updated in the following ways:

[0188] Assume that the encrypted data before the update is CT, and the encrypted data CT' after the ciphertext update key is:

[0189]

[0190]

[0191] The attribute update key is sent to a third device that has not revoked the target attribute, so that the third device updates a second attribute key corresponding to the third device according to the attribute update key.

[0192] In a specific implementation, assuming that the second attribute key corresponding to the third device whose target attribute has not been revoked is SK, the updated second attribute key SK' is:

[0193]

[0194] Through the above steps, a third device whose target attribute has not been revoked can obtain multiple updated ciphertext header shares generated by the target node for the updated initial ciphertext header from the blockchain network based on the updated second attribute key, obtain the updated encrypted data from the cloud server, and decrypt the encrypted data based on the updated second attribute key, the target system public key, and the updated ciphertext header share to obtain the target data. However, for the first device whose target attribute has been revoked, since the first attribute key it holds is generated based on the pre-update system public key and pre-update master key, which are in turn generated based on the second attribute version number corresponding to the target attribute (i.e., the pre-update attribute version number), when the second attribute version number is updated to the target attribute version number, the first attribute key becomes invalid, resulting in the first device being unable to normally obtain multiple ciphertext header shares from the blockchain network based on the first attribute key and then decrypt the encrypted data. Therefore, even if the first device and the cloud server collude to obtain the pre-update encrypted data, it is difficult to achieve unauthorized access to the encrypted data due to the lack of ciphertext header shares, thereby improving the security of target data sharing after the device attribute is revoked.

[0195] The embodiments of the present invention have the following advantages: by generating an initial ciphertext header according to multiple authorization sets corresponding to the target data, and saving the initial ciphertext header to the blockchain network, the initial ciphertext header is used for multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header, and generating a first attribute key corresponding to the first device according to the second attribute set, the system public key, and the master key, so that the first device needs to obtain multiple ciphertext header shares from the blockchain network through the first attribute key to decrypt the encrypted data. When the first device does not have access rights to the target data, even if the cloud server backs up the encrypted data in advance, the first device cannot decrypt the encrypted data to obtain the target data, thereby reducing the dependence on the credibility of the cloud server and effectively improving the security of data sharing between devices.

[0196] It should be noted that for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0197] Reference Figure 3 , shows a system architecture diagram of data processing provided by an embodiment of the present invention. The system may include the following entities:

[0198] Public cloud server: Used to receive and store ciphertext (i.e., encrypted data) sent by the data owner, and to update the ciphertext using the CT update key (i.e., ciphertext update key) generated by the attribute authority. When a data user initiates an access request for the ciphertext, the public cloud server sends the ciphertext to the data user. In the data security architecture of this system, the public cloud server is considered "honest and curious," meaning it can honestly update the ciphertext, but may back up the ciphertext before the update and collude with the first device whose target attribute has been revoked to obtain the plaintext in the ciphertext (i.e., the target data).

[0199] Data owner: This is the second device that holds the plaintext. This can be an industrial device or other device that holds the target data. After generating the corresponding initial ciphertext header for the ciphertext, the second device sends the initial ciphertext header to the blockchain network for storage.

[0200] Data user: that is, the first device and / or third device requesting access to plaintext, which can be industrial equipment or other devices requesting access to plaintext. When the target attribute is not revoked, the first device and / or third device can request multiple ciphertext header shares from the blockchain network through their respective corresponding first attribute key and second attribute key (i.e. SK), and restore the multiple ciphertext header shares to the ciphertext header, and then decrypt the obtained ciphertext to restore it to plaintext. When the target attribute of the first device is revoked, the third device whose target attribute has not been revoked receives the attribute update key (i.e. SK update key) distributed by the attribute authorization agency and updates the second attribute key it holds. The third device can decrypt the ciphertext normally to obtain the plaintext, while the first device holding the unupdated first attribute key cannot decrypt the ciphertext.

[0201] Attribute Authority: This authority distributes secret shares to committee nodes in the blockchain network. When the target attribute of the first device is revoked, it sends the updated initial ciphertext header to the blockchain ledger for storage. It also distributes the CT update key to the public cloud server and the SK update key to data users whose target attributes have not been revoked. Within this system's data security architecture, the attribute authority is considered fully trustworthy.

[0202] Blockchain network: It consists of a leader node, a committee node consisting of candidate nodes, and follower nodes. The leader node is selected from the candidate nodes and maintains the blockchain ledger together with the other candidate nodes. The follower nodes are used to replace down or broken candidate nodes and jointly maintain the blockchain ledger.

[0203] Reference Figure 4 , which shows a schematic structural diagram of a data processing device provided by an embodiment of the present invention, which may specifically include the following modules:

[0204] The request response module 401 is configured to, in response to a request from a first device to obtain target data from a second device, obtain a system public key, a master key, a first attribute set corresponding to the target data, and multiple authorization sets; wherein the first attribute set is a set of first attributes corresponding to all devices allowed to access the target data, and the authorization set is a set consisting of multiple first attributes;

[0205] An encryption module 402 is configured to encrypt the target data according to the system public key and the first attribute set to obtain encrypted data, and save the encrypted data to a cloud server;

[0206] A ciphertext header share generation module 403 is configured to generate an initial ciphertext header based on the multiple authorization sets and store the initial ciphertext header in the blockchain network; the initial ciphertext header is used by multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header;

[0207] A first attribute key generation module 404 is configured to obtain a second attribute set corresponding to the first device, and generate a first attribute key corresponding to the first device based on the second attribute set, the system public key, and the master key;

[0208] The first attribute key sending module 405 is used to send the system public key and the first attribute key to the first device, so that the first device obtains the multiple ciphertext header shares from the blockchain network according to the first attribute key, and obtains the encrypted data from the cloud server, and decrypts the encrypted data according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data.

[0209] In some embodiments of the present invention, the apparatus further comprises:

[0210] A target node quantity acquisition module, configured to acquire the quantity of the plurality of target nodes;

[0211] a first attribute version number determination module, configured to obtain a third attribute set corresponding to all devices and determine a first attribute version number corresponding to each attribute in the third attribute set; wherein the third attribute set includes the first attribute set;

[0212] A system public key and master key generation module is configured to generate the system public key and the master key according to the third attribute set, the number of the plurality of target nodes, and the first attribute version number.

[0213] In some embodiments of the present invention, the apparatus further comprises:

[0214] a target attribute version number determining module, configured to, in response to a revocation event of a target attribute in the second attribute set, determine a second attribute version number corresponding to the target attribute from the first attribute version number and update the second attribute version number to obtain a target attribute version number;

[0215] A target system public key determination module, configured to update the system public key according to the target attribute version number to obtain a target system public key;

[0216] an update key module, configured to generate a ciphertext update key and an attribute update key according to the second attribute version number, the target attribute version number, and the target system public key, and to update the initial ciphertext header;

[0217] a ciphertext update key sending module, configured to send the ciphertext update key to the cloud server, so that the cloud server updates the encrypted data according to the ciphertext update key;

[0218] The attribute update key sending module is configured to send the attribute update key to a third device whose target attribute has not been revoked, so that the third device updates a second attribute key corresponding to the third device according to the attribute update key.

[0219] In some embodiments of the present invention, the first attribute key sending module 405 further includes:

[0220] a secret share generation submodule, configured to generate a secret share for the master key for each of the plurality of target nodes, and send the secret share to the blockchain network;

[0221] a ciphertext header request processing submodule, configured to generate a ciphertext header request according to the first attribute key through the first device, and send the ciphertext header request to the blockchain network;

[0222] The ciphertext header share processing submodule is used to receive the ciphertext header request through the blockchain network, generate the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request, and send the multiple ciphertext header shares to the first device.

[0223] In some embodiments of the present invention, the ciphertext header request processing submodule includes:

[0224] an attribute key version number determining unit, configured to determine an attribute key version number corresponding to the first attribute key according to the second attribute set and the system public key;

[0225] The ciphertext header request generating unit is configured to generate the ciphertext header request according to the attribute key version number and the first attribute key through the first device.

[0226] In some embodiments of the present invention, the ciphertext header share processing submodule includes:

[0227] an attribute key version number extraction unit, configured to receive a ciphertext header request from the first device through the blockchain network, and extract the attribute key version number from the ciphertext header request;

[0228] a key version number comparison unit, configured to determine a public key version number corresponding to the system public key, and compare the public key version number with the attribute key version number;

[0229] The ciphertext header share generating unit is configured to generate the plurality of ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request if the public key version number is consistent with the attribute key version number.

[0230] In some embodiments of the present invention, the multiple target nodes include a leader node and multiple candidate nodes corresponding to the leader node; wherein the leader node is used to manage nodes other than the leader node in the blockchain network.

[0231] Some embodiments of the present invention further provide an electronic device, which may include a processor, a memory, and a computer program stored in the memory and capable of running on the processor, and the computer program implements the above data processing method when executed by the processor.

[0232] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above data processing method is implemented.

[0233] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above data processing method when executed by a processor.

[0234] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0235] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0236] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0237] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0238] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0239] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0240] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0241] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0242] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the above elements.

[0243] The above is a detailed introduction to a data processing method and device, electronic device, and storage medium provided. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A data processing method, characterized in that: The method comprises: In response to a request from a first device to obtain target data from a second device, obtaining a system public key, a master key, a first attribute set corresponding to the target data, and multiple authorization sets; wherein the first attribute set is a set of first attributes corresponding to all devices allowed to access the target data, and the authorization set is a set consisting of multiple first attributes; Encrypting the target data according to the system public key and the first attribute set to obtain encrypted data, and saving the encrypted data to a cloud server; Generating an initial ciphertext header according to the multiple authorization sets, and saving the initial ciphertext header to the blockchain network; the initial ciphertext header is used by multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header; Obtaining a second attribute set corresponding to the first device, and generating a first attribute key corresponding to the first device according to the second attribute set, the system public key, and the master key; Sending the system public key and the first attribute key to the first device, so that the first device obtains the multiple ciphertext header shares from the blockchain network according to the first attribute key, obtains the encrypted data from the cloud server, and decrypts the encrypted data according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data; The method for generating the multiple ciphertext header shares includes: receiving, via the blockchain network, a ciphertext header request from the first device, and extracting an attribute key version number from the ciphertext header request; wherein the attribute key version number corresponds to the first attribute key and is determined based on the second attribute set and the system public key; Determine the public key version number corresponding to the system public key, and compare the public key version number with the attribute key version number; If the public key version number is consistent with the attribute key version number, the multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request; wherein the secret share is generated for the master key based on each node in the multiple target nodes.

2. The method according to claim 1, characterized in that Before obtaining the system public key, the master key, and the first attribute set and multiple authorization sets corresponding to the target data in response to the request of the first device to obtain the target data of the second device, the method further includes: Obtaining the number of the multiple target nodes; Obtaining a third attribute set corresponding to all devices, and determining a first attribute version number corresponding to each attribute in the third attribute set; wherein the third attribute set includes the first attribute set; The system public key and the master key are generated according to the third attribute set, the number of the multiple target nodes, and the first attribute version number.

3. The method according to claim 2, characterized in that The method further comprises: In response to a revocation event of a target attribute in the second attribute set, determining a second attribute version number corresponding to the target attribute in the first attribute version number and updating the second attribute version number to obtain a target attribute version number; Update the system public key according to the target attribute version number to obtain the target system public key; Generate a ciphertext update key and an attribute update key according to the second attribute version number, the target attribute version number, and the target system public key, and update the initial ciphertext header; Sending the ciphertext update key to the cloud server so that the cloud server updates the encrypted data according to the ciphertext update key; The attribute update key is sent to a third device that has not revoked the target attribute, so that the third device updates a second attribute key corresponding to the third device according to the attribute update key.

4. The method according to claim 2 or 3, characterized in that The step of enabling the first device to obtain the multiple ciphertext header shares from the blockchain network according to the first attribute key includes: generating a secret share for the master key for each of the plurality of target nodes, and sending the secret share to the blockchain network; Generate a ciphertext header request according to the first attribute key by the first device, and send the ciphertext header request to the blockchain network; The ciphertext header request is received through the blockchain network, the multiple ciphertext header shares are generated according to the secret share, the initial ciphertext header, and the ciphertext header request, and the multiple ciphertext header shares are sent to the first device.

5. The method according to claim 4, characterized in that Generating a ciphertext header request according to the first attribute key by the first device includes: Determine an attribute key version number corresponding to the first attribute key according to the second attribute set and the system public key; The ciphertext header request is generated by the first device according to the attribute key version number and the first attribute key.

6. The method according to any one of claims 1 to 3, characterized in that The multiple target nodes include a leader node and multiple candidate nodes corresponding to the leader node; wherein the leader node is used to manage nodes other than the leader node in the blockchain network.

7. A data processing device, characterized in that: The device comprises: a request response module, configured to, in response to a request from a first device to obtain target data from a second device, obtain a system public key, a master key, a first attribute set corresponding to the target data, and multiple authorization sets; wherein the first attribute set is a set of first attributes corresponding to all devices allowed to access the target data, and the authorization set is a set consisting of multiple first attributes; an encryption module, configured to encrypt the target data according to the system public key and the first attribute set to obtain encrypted data, and save the encrypted data to a cloud server; A ciphertext header share generation module is configured to generate an initial ciphertext header based on the multiple authorization sets and store the initial ciphertext header in the blockchain network; the initial ciphertext header is used by multiple target nodes in the blockchain network to generate multiple ciphertext header shares corresponding to the initial ciphertext header; a first attribute key generation module, configured to obtain a second attribute set corresponding to the first device, and generate a first attribute key corresponding to the first device according to the second attribute set, the system public key, and the master key; a first attribute key sending module, configured to send the system public key and the first attribute key to the first device, so that the first device obtains the multiple ciphertext header shares from the blockchain network according to the first attribute key, obtains the encrypted data from the cloud server, and decrypts the encrypted data according to the first attribute key, the system public key, and the multiple ciphertext header shares to obtain the target data; The device further comprises: an attribute key version number extraction unit, configured to receive a ciphertext header request from the first device via the blockchain network, and extract the attribute key version number from the ciphertext header request; wherein the attribute key version number corresponds to the first attribute key and is determined based on the second attribute set and the system public key; a key version number comparison unit, configured to determine a public key version number corresponding to the system public key, and compare the public key version number with the attribute key version number; A ciphertext header share generation unit is used to generate the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request if the public key version number is consistent with the attribute key version number; wherein the secret share is generated for the master key based on each node in the multiple target nodes.

8. The apparatus according to claim 7, further comprising: A target node quantity acquisition module, configured to acquire the quantity of the plurality of target nodes; a first attribute version number determination module, configured to obtain a third attribute set corresponding to all devices and determine a first attribute version number corresponding to each attribute in the third attribute set; wherein the third attribute set includes the first attribute set; A system public key and master key generation module is configured to generate the system public key and the master key according to the third attribute set, the number of the plurality of target nodes, and the first attribute version number.

9. The apparatus according to claim 8, further comprising: a target attribute version number determining module, configured to, in response to a revocation event of a target attribute in the second attribute set, determine a second attribute version number corresponding to the target attribute from the first attribute version number and update the second attribute version number to obtain a target attribute version number; A target system public key determination module, configured to update the system public key according to the target attribute version number to obtain a target system public key; an update key module, configured to generate a ciphertext update key and an attribute update key according to the second attribute version number, the target attribute version number, and the target system public key, and to update the initial ciphertext header; a ciphertext update key sending module, configured to send the ciphertext update key to the cloud server, so that the cloud server updates the encrypted data according to the ciphertext update key; The attribute update key sending module is configured to send the attribute update key to a third device whose target attribute has not been revoked, so that the third device updates a second attribute key corresponding to the third device according to the attribute update key.

10. The apparatus according to claim 8 or 9, wherein the first attribute key sending module further comprises: a secret share generation submodule, configured to generate a secret share for the master key for each of the plurality of target nodes, and send the secret share to the blockchain network; a ciphertext header request processing submodule, configured to generate a ciphertext header request according to the first attribute key through the first device, and send the ciphertext header request to the blockchain network; The ciphertext header share processing submodule is used to receive the ciphertext header request through the blockchain network, generate the multiple ciphertext header shares according to the secret share, the initial ciphertext header, and the ciphertext header request, and send the multiple ciphertext header shares to the first device.

11. The apparatus according to claim 10, wherein the ciphertext header request processing submodule comprises: an attribute key version number determining unit, configured to determine an attribute key version number corresponding to the first attribute key according to the second attribute set and the system public key; The ciphertext header request generating unit is configured to generate the ciphertext header request according to the attribute key version number and the first attribute key through the first device.

12. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the method for data processing according to any one of claims 1 to 6 is implemented.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data processing method according to any one of claims 1 to 6 is implemented.

Images