Ecological big data sharing method and device, medium and product

Abstract

The invention discloses an ecological big data sharing method and device, a medium and a product, and relates to the field of data security, and the method comprises the steps: dividing ecological big data according to the attributes of data consumers, carrying out the encryption of the data at different degrees through a hierarchical CP-ABE algorithm after the sensitivity is divided, and obtaining the encrypted data; it is ensured that only the data consumer whose attribute information conforms to the access control tree can access the data, and access control is performed on the data consumer through an intelligent contract, so that the data consumer is prevented from frequently accessing the data without time limit and frequency limit; according to the invention, the security and privacy of the ecological big data can be improved.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to an ecological big data sharing method, equipment, medium and product. Background Art

[0002] With the rapid development of the Internet and big data technology, ecological big data has been widely used in ecological environmental protection and governance in various countries and regions around the world, and has become the core support for solving current ecological environmental problems. However, ecological big data is usually stored in centralized servers, forming a "data island". If the main server is attacked by malicious personnel, it will cause a single point of failure. Secondly, there is a risk that data can be easily tampered with during data sharing, and it cannot be reliably tracked. How to achieve secure storage and sharing of data, ensure the authenticity and validity of data, and curb data falsification has become a hot topic in current ecosystem science research.

[0003] The development of blockchain provides a new approach to solving the above problems. Its decentralized, tamper-proof and traceable features provide an effective solution to the data storage and secure sharing issues in ecological big data. However, general blockchain networks currently do not have the ability to efficiently process large-scale data. In terms of ecological big data storage, a major challenge facing blockchain technology is that ecological big data has a huge amount of data. Blockchains containing images and videos will have big data storage problems and data throughput limitations. IPFS, as a decentralized storage system, aims to solve the problem of too many files. It assigns a unique hash value to each stored file. Users can find the corresponding file based on the hash address to achieve more efficient and secure data storage and sharing.

[0004] In addition, ecological big data is currently facing the challenge of privacy protection, which is mainly reflected in the following two points: First, ecological big data has different sensitivities. Second, although the current smart contracts can grant users access to data, there is still a problem of coarse-grained access control: although the existing blockchain-based ecological big data sharing scheme is committed to protecting the security of private data, it seems to be powerless in terms of access control in the time dimension and fails to fully solve the security problems caused by this, which brings potential risks for the leakage of ecological big data. This problem leads to the fact that once the access users are authorized, they can access ecological big data frequently without time limit and without number limit. In this process, if the access users engage in improper behavior and maliciously steal data, it will cause irreparable privacy violations to the ecosystem.

[0005] Therefore, in order to improve the security and privacy of ecological big data, a new ecological big data sharing and privacy protection solution is urgently needed. Summary of the invention

[0006] The purpose of this application is to provide an ecological big data sharing method, equipment, medium and product that can improve the security and privacy of ecological big data.

[0007] To achieve the above objectives, this application provides the following solutions:

[0008] In the first aspect, the present application provides an ecological big data sharing method, based on a trusted authorization center, a data producer, a data consumer, an IPFS and a blockchain entity, the ecological big data sharing method includes:

[0009] The trusted authorization center generates the system master key MK and the system public key PK; and distributes the system public key PK to data producers and data consumers;

[0010] The trusted authorization center determines the private key SK of the data consumer according to the attributes of the data consumer and sends the private key SK to the data consumer; the attributes of the data consumer include: region, unit name and department name;

[0011] Data producers divide ecological big data into different levels of sensitivity and formulate access strategies based on the sensitivity. The divided ecological big data includes: highly sensitive data M1 and less sensitive data M2.

[0012] The data producer uses the Fernet algorithm and the hierarchical CP-ABE algorithm to encrypt the highly sensitive data M1 and the low-sensitivity data M2 respectively, generating the ecological big data ciphertext CT and the symmetric key ciphertext KCT;

[0013] The data producer uploads the hash value and ecological big data ciphertext CT to IPFS;

[0014] IPFS generates a file identifier CID based on the content of the ecological big data ciphertext CT and hash value, and returns the file identifier CID to the data producer;

[0015] The data producer deploys the smart contract and submits the file identifier CID and the symmetric key ciphertext KCT to the blockchain;

[0016] The data consumer invokes the smart contract to send an access request to the data producer;

[0017] The data producer deploys a smart contract to allow the data consumer to access the data and updates the access processing time, accessible time period, minimum accessible time interval, access threshold, and data index allowed to be accessed;

[0018] Data consumers access data on the blockchain;

[0019] Data consumers query ciphertext data on IPFS based on the file identifier CID;

[0020] IPFS returns the ecological big data ciphertext CT and data hash value to the data consumer;

[0021] The data consumer uses the private key SK to decrypt the symmetric key ciphertext KCT to obtain the symmetric key K, and uses the symmetric key K to decrypt the ecological big data ciphertext to obtain the data plaintext M.

[0022] Optionally, the data producer uses the Fernet algorithm and the hierarchical CP-ABE algorithm to encrypt the highly sensitive data M1 and the low-sensitivity data M2 respectively, and generates the ecological big data ciphertext CT and the symmetric key ciphertext KCT, specifically including:

[0023] Initialize system public key MK and system public key PK;

[0024] Determine the private key SK according to the system public key MK, the system public key PK and the attribute set S;

[0025] The Fernet algorithm is used to encrypt the highly sensitive data M1 and the low-sensitivity data M2 to generate the ecological big data ciphertext CT;

[0026] Using the CP-ABE algorithm, the system public key PK, the symmetric key K and the established access policy are input to encrypt the symmetric key and generate the symmetric key ciphertext KCT.

[0027] Optionally, the data consumer uses the private key SK to decrypt the symmetric key ciphertext KCT to obtain the symmetric key K;

[0028] The symmetric key K is used to decrypt the ecological big data ciphertext CT to obtain the plaintext ecological big data.

[0029] Optionally, the smart contract includes: a registration contract, a storage contract, an access contract and a behavior inspection contract;

[0030] The registration contract is responsible for adding data producer and data consumer nodes to the consortium blockchain;

[0031] The storage contract is used to store the file identifier, hash value, and key encrypted in the blockchain;

[0032] The access contract is used to query data in the blockchain and output the data;

[0033] The behavior check contract is used to check the visitor for improper behavior during the visit.

[0034] In a second aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the ecological big data sharing method.

[0035] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, characterized in that the computer program implements the ecological big data sharing method when executed by a processor.

[0036] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements the ecological big data sharing method when executed by a processor.

[0037] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0038] The present application provides an ecological big data sharing method, device, medium and product, which divides ecological big data according to the attributes of data consumers. After the sensitivity is divided, the hierarchical CP-ABE algorithm is used to encrypt the data to different degrees, ensuring that only data consumers whose attribute information conforms to the access control tree can access the data, and access control is performed on data consumers through smart contracts to prevent data consumers from accessing data frequently without time limit or number of times. The present application is supported by blockchain technology and takes the CP-ABE algorithm as the core to construct a set of blockchain-driven hierarchical CP-ABE ecological big data sharing and privacy protection solutions, designs hierarchical encryption algorithms with different encryption degrees according to different sensitivities, and designs smart contracts based on the time dimension to achieve fine-grained access control, which has important research significance for better protecting high-privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flowchart of an ecological big data sharing method provided in one embodiment of the present application;

[0041] Figure 2 Schematic diagram of the merged access control tree

[0042] Figure 3 It is the flow chart of hierarchical CP-ABE encryption algorithm;

[0043] Figure 4This is the functional logic diagram of the smart contract. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0046] In an exemplary embodiment, Figure 1 As shown, a method for sharing ecological big data based on trusted authorization centers, data producers, data consumers, IPFS and blockchain entities is provided, and the method includes the following steps. Among them:

[0047] (1) The trusted authorization center generates the system master key MK and the system public key PK;

[0048] (2) The trusted authorization center determines the data consumer's private key SK according to the data consumer's attributes and sends the system public key PK and the private key SK to the data consumer; the data consumer's attributes include: region, unit name, and department name;

[0049] (3) Distribute the system public key PK to the data producer;

[0050] (4) Data producers classify ecological big data according to their sensitivity and formulate access strategies based on the sensitivity. The classified ecological big data includes: high-sensitivity data M1 and low-sensitivity data M2.

[0051] (5) The data producer uses the Fernet algorithm and the hierarchical CP-ABE algorithm to encrypt the highly sensitive data M1 and the low-sensitivity data M2 respectively; the generated ecological big data ciphertext CT and the symmetric key ciphertext KCT;

[0052] (6) The data producer uploads the hash value and ecological big data ciphertext CT to IPFS;

[0053] (7) IPFS generates a file identifier CID based on the ecological big data ciphertext CT and hash value, and returns the file identifier CID to the data producer;

[0054] (8) The data producer deploys the smart contract and submits the file identifier CID and the symmetric key ciphertext KCT to the blockchain;

[0055] (9) The data consumer invokes the smart contract to send an access request to the data producer;

[0056] (10) The data producer deploys a smart contract to allow the data consumer to access the data and updates the access processing time, accessible time period, minimum accessible time interval, access threshold, and data index allowed to be accessed;

[0057] (11) Data consumers access data on the blockchain;

[0058] (12) Data consumers query ciphertext data on IPFS based on the file identifier CID;

[0059] (13) IPFS returns the ecological big data ciphertext CT and data hash value to the data consumer;

[0060] (14) The data consumer uses the private key SK to decrypt the symmetric key ciphertext KCT to obtain the symmetric key K, and uses the symmetric key K to decrypt the ecological big data ciphertext to obtain the data plaintext M.

[0061] Among them, steps (1)-(3) of the above steps are the key distribution stage, (4)-(8) are the data storage stage, and (9)-(14) are the data sharing stage;

[0062] In an exemplary embodiment, step (4) is specifically:

[0063] When the access policy of M2 is set to A1 = "Inner Mongolia Autonomous Region OR Forestry Bureau", it means that the Inner Mongolia Autonomous Region or the Forestry Bureau has access rights; and the access policy of M1 is further refined to A2 = "(Inner Mongolia Autonomous Region OR Forestry Bureau) AND Forest Resources Management Department", which indicates that only data consumers who are both the Inner Mongolia Autonomous Region or the Forestry Bureau and the Forest Resources Management Department can access it. Since the access policies of M1 and M2 are often interdependent, considering this dependency, the present application designs the structure of the access control tree to simplify the access policy construction process by merging the access control trees of M1 and M2. The specific merging strategy is: regard the entire access control tree of M2 as the left subtree, and set it directly as the left branch of the root node of the access control tree. For M1, the additional conditions in its access policy are constructed as the right subtree of the root node. When integrating these two subtrees, the root node adopts the (2, 2) connection method. For example Figure 2 shown.

[0064] The structure of ecological big data is complex and diverse, and different data sources and sensitivity levels require different access control strategies. In the process of solving the access control problem of ecological big data, it is first necessary to classify the sensitivity of ecological big data. To this end, this study proposes a sensitivity classification standard for ecological big data. This standard divides ecological big data into two levels: high-sensitivity data and low-sensitivity data according to the sensitivity of ecological big data generated in different regions. By classifying ecological big data according to the sensitivity of the region, we can better control the access rights to ecological big data and protect the confidentiality and integrity of sensitive data.

[0065] The regional characteristics of ecological big data are reflected in the following aspects:

[0066] 1. Globally: Ecological big data covers various ecosystems at different scales around the world, including forests, grasslands, wetlands, oceans, etc., which can achieve a comprehensive analysis and understanding of these ecosystems.

[0067] 2. Regional: Ecological big data includes not only global data, but also various regional ecological big data, such as ecological big data of a country or region, or ecological big data of a specific area, such as forests, lakes, rivers, etc.

[0068] The data generated by these bordering areas are classified as highly sensitive data, while the ecological big data generated by other areas that do not involve important strategic resources can be classified as low-sensitivity data.

[0069] In an exemplary embodiment, Figure 3 As shown, step (5) specifically includes:

[0070] Initialize system public key MK and system public key PK;

[0071] Determine the private key SK according to the system public key MK, the system public key PK and the attribute set S;

[0072] Use the Fernet algorithm to encrypt the highly sensitive data M1 and the low-sensitivity data M2 to generate the symmetric key K and the ecological big data ciphertext CT;

[0073] Generate the symmetric key ciphertext KCT based on the system public key PK, the symmetric key K and the established access policy.

[0074] Correspondingly, the method by which the data consumer uses the private key SK to decrypt the symmetric key ciphertext KCT is the Fernet algorithm.

[0075] In order to strengthen the protection of ecological big data, this study selected the Fernet algorithm, combined with sensitivity division and CP-ABE encryption algorithm to ensure that privacy data will not be leaked, thus better protecting ecological big data.

[0076] The Fernet algorithm is a public key cryptographic algorithm based on elliptic curve cryptography, proposed by researchers at the University of Helsinki in Finland in 2000. Fernet is based on a combination of the AES algorithm and the Hash-based Message Authentication Code (HMAC) algorithm, and is designed to provide easy-to-use encryption and integrity protection. The features of the Fernet algorithm are as follows:

[0077] Easy to use: One of the design goals of the Fernet algorithm is to provide an easy-to-use encryption method so that application developers can quickly integrate encryption functions without having to worry too much about complex encryption details.

[0078] Data integrity protection: The Fernet algorithm uses HMAC to protect data integrity. HMAC is a keyed hash function that can detect whether data has been tampered with during transmission, thereby ensuring data integrity.

[0079] AES encryption: The Fernet algorithm uses AES to encrypt data. AES is an advanced encryption standard that is widely recognized and used in various encryption scenarios.

[0080] Automatic key management: The Fernet algorithm automatically handles key generation and rotation, simplifying the complexity of key management. It generates a pair of encryption keys and authentication keys and automatically updates the keys when they are rotated, thereby increasing the security of the system.

[0081] Timestamp and expiration time: The Fernet algorithm also includes a timestamp and expiration time to ensure that the encrypted data is valid within a certain time range and prevent data from being replayed.

[0082] In summary, the Fernet algorithm not only inherits the strong security of AES, but also protects the integrity of ecological big data, making data more secure and reliable during transmission.

[0083] The Fernet algorithm can also set an expiration time in the ciphertext. If the expiration time set in the ciphertext is exceeded, the ciphertext cannot be decrypted even with a symmetric key, thus protecting the privacy of ecological big data in the time dimension. The Fernet algorithm first generates a key K, which is randomly generated to ensure the uniqueness of each encryption process; then the input data is filled with a randomly generated initialization vector (IV), which is randomly generated and used with K to ensure the confidentiality of the data. After completing the above process, the data is encrypted using the key K, and a message authentication code (MAC) is calculated using the HMAC-SHA256 algorithm. If the data is tampered with during transmission, the calculated MAC will be different from the original MAC, so that it can be determined whether the data is complete.

[0084] When using this algorithm for encryption, the expiration time ET set by the data producer and the data plaintext M are input, and the data ciphertext CT and the symmetric key K are output; when using this algorithm for decryption, the symmetric key K and the ciphertext CT are input, and the data plaintext M is output. The Fernet algorithm is an important part of the hierarchical CP-ABE encryption algorithm.

[0085] The traditional hierarchical data attribute encryption strategy requires the construction of two different access policies A1 and A2 for highly sensitive data M1 and less sensitive data M2, which increases the difficulty for data producers to build access control policies. However, in actual applications, the access policies for highly sensitive data and less sensitive data often have a dependent relationship, that is, the access policy for highly sensitive data includes the access policy requirements for less sensitive data.

[0086] Taking into account the dependency between the access policies for highly sensitive data and less sensitive data, this application merges the access control trees for highly sensitive data and less sensitive data. The merging strategy is to use the entire access control tree for less sensitive data as the left subtree of the root node of the access control tree, and use the additional conditions for the access control policy for highly sensitive data as the right subtree of the root node of the access control tree. The root nodes are connected using (2,2).

[0087] The specific design of the hierarchical CP-ABE encryption algorithm is as follows:

[0088] 1) Setup()→PK, MK: The algorithm takes the implicit security parameter λ as input, selects a bilinear group G0 with a prime order p and a generator g. Generates a bilinear map e: G0×G0→G1. Then randomly selects two encryption exponents α, β∈Z P The output system public key is:

[0089] PK=(G0,g,h=g β ,e(g,g) α ) (1)

[0090] The system's master key is:

[0091] MK=(β,g α ) (2)

[0092] 2) KeuGen(PK, MK, S) → SK: This algorithm takes the system public key PK, the system master key MK and the data consumer attribute set S as input, and selects a random number r∈Z P ,calculate Then for each attribute j∈S, randomly select a random number r j ∈Z P ,calculate The private key of the data consumer is calculated using the relevant parameters in PK and MK and the attribute set S of the data consumer:

[0093]

[0094] 3) Fernet_Encrypt (ET, M) → K, CT; the algorithm inputs the expiration time ET set by the data producer and the plaintext M high , M low ET represents the expiration time of the encrypted data. The encryption process is as follows:

[0095] The algorithm chooses a random number σ∈Z p Generate symmetric encryption key K high , K low , and obtain the timestamp T of the current encryption moment.

[0096] Construct metadata MD high , MD low :

[0097]

[0098] Where length() indicates the length of the message. Use the key K to encrypt the metadata MD and the expiration time ET to generate the metadata ciphertext MDCT:

[0099]

[0100] Use the key K to hash the plaintext M using HMAC technology to generate a data digest and then encrypt it to obtain the digest ciphertext ACT:

[0101]

[0102] Use the key K to encrypt the plaintext M and obtain the ciphertext body MCT:

[0103]

[0104] Finally, the metadata ciphertext is used as the message header, the ciphertext body is used as the message body, and the summary ciphertext is used as the message tail. After concatenation, the complete ciphertext CT is obtained:

[0105]

[0106] 4) Encrypt(PK, K, τ) → KCT: The algorithm inputs the system public key PK and sets the symmetric key K high , K low Encrypted under the access structure (access policy) τ. The encryption process is as follows:

[0107] Generate access control tree: the same as CP-ABE algorithm.

[0108] Recursively calculate the access control tree: First, for each node x in the access control tree in the access structure τ, select a polynomial q x , these polynomials q x From the root node R high For each node x in the tree, let the polynomial q x Order d x is the threshold k of node x x -1, that is:

[0109] d x =k x -1 (9)

[0110] From the root node R high Start by selecting random numbers s high ∈Z p , generating polynomial q for the root node high , and set q high (0) = s high , is the node x of the left subtree of the root node low Generator polynomial q low ,set up

[0111] q low (0) = s low =q high (index(x low )) (10)

[0112] For other nodes x, select polynomial q x ,make

[0113] q x (0) = q parent (x)(index(x)) (11)

[0114] And randomly choose polynomial q x Other xnodes to define the polynomial. parent(x) is the parent node of node x.

[0115] Calculate the symmetric key ciphertext KCT: Let the set of all leaf nodes in the access structure τ be Y, then the symmetric key K high , K low The ciphertext under the access structure τ is:

[0116]

[0117] 5) Decrypt(PK, KCT, SK) → K The algorithm inputs the system public key PK, the data consumer key SK and the ciphertext KCT. The decryption process is as follows:

[0118] Recursively calculate the access control tree DecryptNode(KCT, SK, x). The algorithm takes the ciphertext as input The data consumer's private key SK and a node x in the access control tree in the access structure τ.

[0119] If x is a leaf node, let i = att(x), if i∈S, define:

[0120]

[0121] if Then the algorithm outputs ⊥, which means that the attribute in the control structure is not in the attribute set corresponding to the personal private key. The access control structure cannot satisfy the attribute set in the private key, and decryption is impossible;

[0122] If x is a non-leaf node, for all child nodes z of node x, call the function DecryptNode(KCT, SK, z) and store the result as F z Let S X For an arbitrary size K z The set of child nodes z of , and satisfy F z ≠⊥. If there is no such set, the function outputs ⊥. Otherwise, calculate:

[0123]

[0124] Where i = index(x), S' x ={index(z):z∈S x}.

[0125] To sum up, recursively calculate the left child node of the root node to get Recursively calculate to the root node to get

[0126] Calculate the ciphertext of the symmetric key: Let Calculate the highly sensitive key:

[0127]

[0128] Similarly, get the low-sensitivity key:

[0129]

[0130] 6) Fernet_Decrypt(K, CT) → M: The algorithm inputs the corresponding symmetric key K and ciphertext CT, and the decryption process is as follows:

[0131] Decrypt the metadata ciphertext MDCT:

[0132]

[0133] Get the timestamp T' of the current decryption time and calculate: T'-T. If T'-T < ET, it means that the key can decrypt the ciphertext; otherwise, it means that the current time exceeds the expiration time and the key will not be able to decrypt the ciphertext.

[0134] Decrypt the summary ciphertext ACT:

[0135]

[0136] Decrypt the ciphertext MCT to obtain the highly sensitive data plaintext M high and low-sensitivity data plaintext M low :

[0137]

[0138] Verify data integrity: Use HMAC technology to hash the plaintext body M and generate a new data summary HMAC'. Compare the new data summary with HMAC to confirm the integrity of the data. If HMAC' = HMAC, it means that the data has not been tampered with during transmission; otherwise, the decryption will fail and the plaintext data M will not be returned.

[0139] In order to realize the sharing and privacy protection of ecological big data, the smart contract includes: registration contract, storage contract, access contract and behavior inspection contract. The functional logic diagram of the smart contract is as follows: Figure 4 shown.

[0140] The registration contract is responsible for adding data producer and data consumer nodes to the consortium blockchain;

[0141] The storage contract is used to store the file identifier, hash value, and key encrypted in the blockchain;

[0142] The access contract is used to query data in the blockchain and output the data;

[0143] The behavior check contract is used to check the visitor for improper behavior during the visit.

[0144] In the smart contract, the following are first defined:

[0145] (1) The current caller of the smart contract is recorded as msg.sender, and the timestamp of the current moment is recorded as block.timestamp.

[0146] (2) Two structures for storing ecological big data related information are defined: ER and AccessList. The ER structure is used to store relevant ecological big data, including: the data index rid of the ecological big data, the data consumer account address consumerAddress, the data producer account address producerAddress, the original data hash value hash, the timestamp admissionTime of the hash upload time, the content identifier CID and the symmetric key ciphertext KCT.

[0147] The AccessList structure is used to store information such as the behavior of data consumers accessing ER-related data, including: the visitor account address consumerAccount, the account address being accessed producerAccount, the access record index ridcode, the access status corresponding, the access processing time requestTime, the accessible time period countDown, the minimum accessible time interval minGap, the access threshold thresholdValue, the accessed data index rids[] and each data access time consumerAccessTimes[], where rids[] and consumerAccessTimes[] are array types. Among them, corresponding = 2 is the request status, which has not been responded to yet; corresponding = 1 is the consent status, and the data producer has allowed access to the corresponding ER data; corresponding = 0 is the rejection status, and the data producer rejects this access request.

[0148] (3) For the two structures ER and AccessList, two internal array variables ERs and accesslist are defined. At the same time, two mapping variables are defined: mapping(uint256=>address)publicRidToAccount and mapping(uint256=>uint256)public RidToNumber, which are used to query the corresponding account in ERs and its position in the array according to rid.

[0149] (4) Smart contract call priority: registration contract < storage contract < access contract < behavior check contract. A smart contract with a higher priority can call a smart contract with a lower priority. For example, a behavior check contract can call global variables and functions in any contract, while a registration contract cannot call global variables and functions in other contracts.

[0150] The following are the main functions of the smart contract:

[0151] The ConsumerRequestAccess function belongs to the functions in the access contract, as shown in Function 1 in Table 1.

[0152] Table 1

[0153]

[0154] The ProducerAgree function belongs to the functions in the access contract, as shown in Function 2 in Table 2.

[0155] Table 2

[0156]

[0157]

[0158] The retrieveUserER function belongs to the function in the behavior check contract, as shown in Function 3 in Table 3.

[0159] Table 3

[0160]

[0161] The CheckMisconduct function belongs to the function in the behavior check contract, as shown in Function 4 in Table 4:

[0162] Table 4

[0163]

[0164] This application uses a combination of blockchain technology and IPFS system to effectively realize the secure storage and sharing of ecological big data and prevent data tampering. The use of blockchain-based ecological big data security storage and sharing solutions can also break down the data barriers of meteorological, forestry, wetland and other departments, build a safe and reliable data sharing solution, and make data flow more valuable. And using encryption technology, the stored data is placed on a distributed storage platform for encryption processing. If the ecological big data changes, the platform can record its different versions for subsequent tracing and verification. In response to the problem that privacy data is easily leaked, this study designed an access control strategy based on smart contracts and hierarchical CP-ABE. This strategy divides the attributes of ecological big data according to different sensitivities, and combines the ciphertext strategy attribute-based encryption technology with the symmetric encryption algorithm Fernet and smart contracts to achieve fine-grained access control, prevent data leakage, and strengthen the protection of ecological big data.

[0165] In an exemplary embodiment, a computer device is provided, which may be a server or a terminal. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used for ecological big data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for sharing ecological big data is implemented.

[0166] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0167] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0168] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0169] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0170] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0171] The present application uses specific examples to illustrate the principles and implementation methods of the present application. The above examples are only used to help understand the method and core ideas of the present application. At the same time, for those skilled in the art, according to the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present application.

Claims

1. An ecological big data sharing method, characterized in that: Based on the entities of trusted authorization center, data producer, data consumer, IPFS and blockchain, the ecological big data sharing method includes: The trusted authorization center generates the system master key MK and the system public key PK; and distributes the system public key PK to data producers and data consumers; The trusted authorization center determines the private key SK of the data consumer according to the attributes of the data consumer and sends the private key SK to the data consumer; the attributes of the data consumer include: region, unit name and department name; Data producers divide ecological big data into different levels of sensitivity and formulate access strategies based on the sensitivity. The divided ecological big data includes: highly sensitive data M1 and less sensitive data M2. The data producer uses the Fernet algorithm and the hierarchical CP-ABE algorithm to encrypt the highly sensitive data M1 and the low-sensitivity data M2 respectively, generating the ecological big data ciphertext CT and the symmetric key ciphertext KCT; The data producer uploads the hash value and ecological big data ciphertext CT to IPFS; IPFS generates a file identifier CID based on the content of the ecological big data ciphertext CT and hash value, and returns the file identifier CID to the data producer; The data producer deploys the smart contract and submits the file identifier CID and the symmetric key ciphertext KCT to the blockchain; The data consumer invokes the smart contract to send an access request to the data producer; The data producer deploys a smart contract to allow the data consumer to access the data and updates the access processing time, accessible time period, minimum accessible time interval, access threshold, and data index allowed to be accessed; Data consumers access data on the blockchain; Data consumers query ciphertext data on IPFS based on the file identifier CID; IPFS returns the ecological big data ciphertext CT and data hash value to the data consumer; The data consumer uses the private key SK to decrypt the symmetric key ciphertext KCT to obtain the symmetric key K, and uses the symmetric key K to decrypt the ecological big data ciphertext to obtain the data plaintext M.

2. The ecological big data sharing method according to claim 1 is characterized in that: The data producer uses the Fernet algorithm and the hierarchical CP-ABE algorithm to encrypt the highly sensitive data M1 and the low-sensitivity data M2 respectively, and generates the ecological big data ciphertext CT and the symmetric key ciphertext KCT, which specifically include: Initialize system public key MK and system public key PK; Determine the private key SK according to the system public key MK, the system public key PK and the attribute set S; The Fernet algorithm is used to encrypt the highly sensitive data M1 and the low-sensitivity data M2 to generate the ecological big data ciphertext CT; Using the CP-ABE algorithm, the system public key PK, the symmetric key K and the established access policy are input to encrypt the symmetric key and generate the symmetric key ciphertext KCT.

3. The ecological big data sharing method according to claim 2 is characterized in that: The data consumer uses the private key SK to decrypt the symmetric key ciphertext KCT to obtain the symmetric key K; The symmetric key K is used to decrypt the ecological big data ciphertext CT to obtain the plaintext ecological big data.

4. The ecological big data sharing method according to claim 1 is characterized in that: The smart contracts include: registration contract, storage contract, access contract and behavior inspection contract; The registration contract is responsible for adding data producer and data consumer nodes to the consortium blockchain; The storage contract is used to store the file identifier, hash value, and key encrypted in the blockchain; The access contract is used to query data in the blockchain and output the data; The behavior check contract is used to check the visitor for improper behavior during the visit.

5. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the ecological big data sharing method described in any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the ecological big data sharing method described in any one of claims 1 to 4 is implemented.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the ecological big data sharing method described in any one of claims 1 to 4 is implemented.

Images