Data security sharing method, device and system based on block encryption

Abstract

The invention provides a data security sharing method, device and system based on block encryption. The method comprises the following steps: a data center blocks data information, encrypts each data block to obtain a data block ciphertext, uploads the data block ciphertext to a cloud server for storage, and locally stores block information and directory information; after data demand information published by a data user is received, determining to-be-shared data meeting the demand according to locally stored block information and directory information; verifying the identity of the data user, and judging whether the private key of the data user is legal and whether the request data is compliant; and after verification and judgment are passed, a data sharing request is sent to the supervision center, so that the supervision center generates a data sharing token and a signature by using a private key of the supervision center, and sends the data sharing token and the signature to a data user. By using the scheme of the invention, the data can be shared safely and reliably.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data security sharing method, device and system based on block encryption. Background Art

[0002] In today's information-based, networked, and intelligent era, data has become a key factor in promoting social progress and economic development. With the rapid development of technologies such as the Internet, the Internet of Things, and 5G, data collection, storage, processing, and analysis have become more convenient, which provides a broad space and unlimited possibilities for data sharing. However, the security issue of data sharing has also arisen, becoming an important issue restricting the development of data sharing.

[0003] Data sharing security refers to the ability to ensure that data is not unauthorizedly accessed, leaked, tampered with or destroyed during the data sharing process. It involves the security protection of data in all links such as transmission, storage, processing and use. The core goal of data sharing security is to ensure the confidentiality, integrity and availability of data, namely the CIA (Confidentiality, Integrity, Availability) model. At present, data sharing security still faces many challenges. First, the data sharing environment is becoming more and more complex, involving multiple different organizations, systems and platforms, which brings difficulties to the management and control of data sharing security. Secondly, the technology of data sharing is constantly developing, and new security threats and vulnerabilities are constantly emerging, which requires that the technology and methods of data sharing security also need to be continuously updated and improved. Finally, data sharing involves the interests and rights of multiple parties, and it is necessary to balance the requirements of security, efficiency, privacy, compliance and other aspects, which undoubtedly increases the complexity and difficulty of data sharing security. Summary of the invention

[0004] The present invention provides a data security sharing method, device and system based on block encryption to ensure the security of data sharing.

[0005] To this end, the present invention provides the following technical solutions: The present invention provides a data security sharing method based on block encryption, the method comprising: The data center divides the data information into blocks, encrypts each data block to obtain a data block ciphertext, uploads the data block ciphertext to the cloud server for storage, and saves the block information and directory information locally; After receiving the data demand information published by the data user, determine the data to be shared that meets the demand based on the locally stored block information and directory information; Authentication of the data user and determination of whether the data user's private key is legitimate and whether the requested data is compliant; After verification and judgment, a data sharing request is sent to the supervision center, so that the supervision center uses its own private key to generate a data sharing token and signature, and sends it to the data user.

[0006] Optionally, encrypting each data block to obtain a data block ciphertext includes: Generate a public key and a private key pair using an attribute-based encryption algorithm and set an access structure for determining a combination of attributes that can decrypt data; Each data block is encrypted using the public key and the access structure to obtain a data block ciphertext.

[0007] Optionally, the data demand information includes: identity information of the data user, access structure verification certificate, and requested data information; the access structure verification certificate is generated by the data user according to a private key, public parameters issued by the data center, and a zero-knowledge proof model; the zero-knowledge proof model is generated according to a set access structure; The determining whether the private key of the data user is legal includes: Determining whether the access structure verification certificate satisfies the access structure; If so, it is determined that the private key of the data user is legal.

[0008] Optionally, the method further comprises: The data user receives the data sharing token and signature sent by the supervision center; the data sharing token includes the authority and instructions for obtaining and using data; Send the data sharing token and signature to the cloud server, so that the cloud server will send the corresponding data block ciphertext to the data user according to the data sharing token and signature; The data user decrypts the ciphertext of each data block and combines the decrypted data into complete data information.

[0009] Optionally, the cloud server has one or more servers, among which there is a main server, and the multiple cloud servers form a distributed storage system; different data block ciphertexts are stored on the same or different cloud servers.

[0010] Optionally, the method further comprises: The main server receives the data sharing token and signature sent by the data user; The signature is verified using the public key of the regulatory center, and after verification, the data sharing token is broadcast to other cloud servers, so that the other cloud servers send the ciphertext of the relevant data blocks stored in themselves to the data user according to the data sharing token.

[0011] Optionally, the data sharing token includes permissions and instructions for obtaining and using data.

[0012] The present invention also provides a data security sharing device based on block encryption, the device comprising: The data processing module is used to divide the data information into blocks, encrypt each data block to obtain the data block ciphertext, upload the data block ciphertext to the cloud server for storage, and save the block information and directory information locally; The data inspection module is used to determine the data to be shared that meets the requirements based on the data demand information published by the data user on the data platform; A verification module, used to authenticate the identity of the data user and determine whether the private key of the data user is legal and whether the requested data is compliant; The data sharing module is used to send a shared data request to the supervision center after the verification and judgment of the verification module are passed, so that the supervision center uses its own private key to generate a data sharing token and signature, and sends it to the data user.

[0013] The present invention also provides a data security sharing system based on block encryption, the system comprising: a cloud server, a data center, and a supervision center; the data center comprises the data sharing device based on block encryption; The data center is used to encrypt the data information in blocks and upload it to the cloud server. When there is data to be shared that meets the needs of the data user, the data user is authenticated and the private key of the data user is determined to be legal and the requested data is compliant. After the verification and judgment are passed, a request for sharing data is sent to the supervision center; The cloud server is used to store the encrypted data blocks uploaded by the data center; The supervision center is used to receive the shared data request, use its own private key to generate a data sharing token and signature, and send it to the data user, so that the data user requests the required data from the cloud server based on the data sharing token and signature.

[0014] Optionally, the system also includes: a data user, which is used to publish data demand information to the data center when data is needed; receive a data sharing token and signature sent by the regulatory center, send the data sharing token and signature to the cloud server, and obtain shared data from the cloud server.

[0015] Optionally, the cloud server has one or more servers, one of the multiple servers is a master server, and the multiple cloud servers form a distributed storage system; different data block ciphertexts are stored on the same or different cloud servers; The main server receives the data sharing token and signature sent by the data user; The signature is verified using the public key of the regulatory center, and after verification, the data sharing token is broadcast to other cloud servers, so that the other cloud servers send the ciphertext of the relevant data blocks stored in themselves to the data user according to the data sharing token.

[0016] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the data security sharing method based on block encryption are executed.

[0017] The data security sharing method, device and system based on block encryption provided by the present invention can safely encrypt data information in blocks and store it on a cloud server. At the same time, through attribute-based encryption technology, fine-grained access control of data can be achieved to ensure that only data users who hold the corresponding private key and meet the access structure can decrypt and access the shared data, thereby ensuring the security of data sharing. Moreover, through data sharing tokens and signatures, the legitimacy and traceability of data sharing can be ensured.

[0018] Furthermore, through the zero-knowledge proof protocol, the data center can verify whether the attributes of the data user meet the access structure without leaking the data user's private key, thereby protecting the privacy of the data user. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 It is a flow chart of a data security sharing method based on block encryption provided by an embodiment of the present invention; Figure 2 It is a structural schematic diagram of a data security sharing device based on block encryption provided by an embodiment of the present invention; Figure 3 It is a structural diagram of a data security sharing system based on block encryption provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present invention, and is not used to limit the present invention.

[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] The core goal of data sharing security is to ensure the confidentiality, integrity and availability of data. Among them, confidentiality refers to the ability of data not to be obtained and accessed by unauthorized third parties. In the process of data sharing, data may need to traverse multiple different network environments and contact multiple different systems and users. Therefore, ensuring the confidentiality of data is the top priority of data sharing security. Integrity refers to the ability of data to maintain its authenticity, accuracy and consistency during storage, transmission and processing. Data may be subject to various malicious attacks or accidental damage during sharing, so ensuring the integrity of data is crucial to maintaining the value and credibility of data. Availability refers to the ability of data to be accessed and used normally by authorized users when needed. The purpose of data sharing is to enable people who need data to obtain and use the data, so ensuring the availability of data is also an important part of data sharing security.

[0024] In order to achieve the security of data sharing, a series of security technologies and measures need to be adopted. For example, data encryption technology can protect the confidentiality of data. Even if the data is intercepted during transmission, it cannot be interpreted by unauthorized third parties. Technologies such as digital signatures and hash functions can verify the integrity of data to ensure that the data has not been tampered with during transmission and storage. Technologies such as backup, redundancy, and load balancing can improve data availability and ensure that data can still be used normally in the face of hardware failures, network attacks, etc.

[0025] In addition to technical measures, data sharing security also needs to take into account management factors. For example, it is necessary to formulate a reasonable data sharing strategy to clarify which data can be shared and which data cannot be shared, as well as the conditions and scope of data sharing. It is necessary to strengthen the monitoring and auditing of the data sharing process to promptly discover and respond to various security threats. At the same time, it is also necessary to improve users' security awareness and skills to prevent data leakage or damage due to misoperation or malicious behavior.

[0026] To this end, in view of the security and privacy protection issues in data sharing, the present invention provides a data security sharing method, device and system based on block encryption, which uses attribute-based encryption (ABE) technology to achieve fine-grained access control of ciphertext, ensuring that only users who meet specific attributes can decrypt data. By defining a flexible access structure, the access policy of the data can be described to achieve effective control of the data sharing process. At the same time, by using the zero-knowledge proof protocol, it is possible to verify whether the user meets the access structure without leaking the user's private key information, thereby protecting the user's privacy.

[0027] like Figure 1 FIG. 1 is a flow chart of a data security sharing method based on block encryption provided by an embodiment of the present invention, comprising the following steps: Step 101, the data center divides the data information into blocks, encrypts each data block to obtain data block ciphertext, uploads the data block ciphertext to the cloud server for storage, and saves the block information and directory information locally.

[0028] For example, for data information , which is divided into Data blocks , for this Each data block is encrypted independently to obtain For the division of data blocks, data information The number of divided data blocks is determined based on the size of the data blocks, etc. The sizes of the divided data blocks can be the same or different, which is not limited in this embodiment of the present invention.

[0029] In order to ensure the security of data sharing, the data center can define an access structure A, which is used to determine which attribute combinations can decrypt the data to be shared. Using this access structure, restrictions can be placed on data users to ensure that only data users with appropriate attributes can decrypt and access sensitive data, thereby achieving fine-grained access control.

[0030] In addition, the data center can use an attribute-based encryption algorithm to generate a public key PublicKey and a private key pair, where the public key is used to encrypt the data block and the private key is used to associate a specific attribute and is used in subsequent decryption.

[0031] The data center uses the public key and access structure A to access each data block. Encrypt to form data block ciphertext The formula is =Encrypt( ,PublicKey,A), where Encrypt() represents the encryption function.

[0032] In some embodiments, the cloud server may have one, namely the above The ciphertexts of the data blocks are stored on the same cloud server with different storage addresses.

[0033] In other embodiments, the cloud server may be in cluster mode, that is, it may be composed of two or more servers, one of which is a master server. The encrypted data block is uploaded to the main server, and then the main server The encrypted data blocks are stored in different cloud servers. For example, The encrypted data blocks are stored in On each cloud server, you can select the corresponding cloud server based on its comprehensive performance, such as load capacity and resource usage.

[0034] In other embodiments, the data center may also select the cloud server that needs to store the ciphertext of each data block, which is not limited in the embodiments of the present invention.

[0035] In order to ensure that each data block ciphertext is stored correctly, in some embodiments, the cloud server may also return a storage credential to the data center after storing the corresponding data block ciphertext, and the storage credential may include the storage address of the data block ciphertext. Accordingly, after receiving the storage credential, the data center determines that the data block ciphertext has been stored correctly.

[0036] In an embodiment of the present invention, the storage credential may be used as a verification mechanism to prove that the data has been correctly stored and can be correctly retrieved and decrypted when needed.

[0037] By encrypting and distributing data information in blocks, data security can be better guaranteed. The encrypted data blocks stored on the cloud server can only be accessed with authorization.

[0038] Step 102, after receiving the data demand information issued by the data user, determine the data to be shared that meets the demand based on the locally stored block information and directory information.

[0039] When a data user needs to use data, he or she can publish data demand information to the data center. The data demand information may include the identity information of the data user, access structure verification certificate, and requested data information. Among them: The identity information may be, for example, but not limited to, any one or more of the following information: ID, name, ID number, etc.

[0040] The request data information may include, for example, but is not limited to, one or more information such as summary, keywords, and file number.

[0041] The access structure verification proof is generated by the data user inputting public parameters, private keys and other information into the zero-knowledge proof model. The public parameters and zero-knowledge proof model can be issued by the data center, and the zero-knowledge proof model can be generated based on the access structure. Using the access structure verification proof, the data center can verify whether the user attribute private key meets the access structure without leaking the user's private key.

[0042] Accordingly, after receiving the data demand information published by the data user, the data center can first determine whether there is data to be shared that meets the demand based on the requested data information. Specifically, the locally stored block information and directory information can be searched based on the requested data information to determine whether there is data to be shared that meets the demand. If there is, then continue to execute the subsequent step 103; if not, then the corresponding prompt information can be returned to the data user.

[0043] Step 103, authenticate the data user's identity and determine whether the data user's private key is legal and whether the requested data is compliant.

[0044] The data center authenticates the data user to determine whether the data user is a legitimate user. Specifically, the data center can submit the corresponding identity information to the real-name authentication server, which calls the official database to verify the user's identity information and returns the authentication result to the data center. By authenticating the data user, it can be ensured that only legitimate users can access the shared data provided by the data center.

[0045] If the identity authentication fails, the data center may return a corresponding information prompt to the data user to prompt the data user that the identity authentication fails.

[0046] If the identity authentication is successful, the data center needs to further determine whether the private key of the data user is legal and whether the requested data is compliant.

[0047] The legitimacy of the data user's private key can be determined by using a zero-knowledge proof protocol to determine whether the user's attribute private key satisfies the access structure. Specifically, the data center can use the data user's public key, public parameters, zero-knowledge proof model and related algorithms to verify the legitimacy of the access structure verification proof.

[0048] The judgment on whether the data requested by the data user is compliant may be made in accordance with corresponding regulations or specifications, etc., which is not limited in this embodiment of the present invention.

[0049] It should be noted that the algorithm for generating the zero-knowledge proof model can be set arbitrarily, and the embodiment of the present invention does not limit this.

[0050] Step 104, after verification and judgment are passed, a data sharing request is sent to the supervision center, so that the supervision center uses its own private key to generate a data sharing token and signature, and sends it to the data user.

[0051] The data sharing request may include: data user ID, data center ID, data information to be shared: data address, and may further include: data directory information, data format, data quality (including data availability, integrity, standardization, consistency and timeliness, etc.).

[0052] Correspondingly, after receiving the data sharing request, the supervision center generates a data sharing token and signature using its own private key, and sends the data sharing token and signature to the data user.

[0053] The data sharing token may include but is not limited to the following information: Permissions: Defines the actions that a user holding a token can perform, such as read, write, or execute.

[0054] Validity information: includes the validity period of the token, that is, when the token becomes effective and when it expires.

[0055] Data address: Specifies the specific resource or collection of resources to which the token grants access.

[0056] Authentication information: May contain the user's authentication data to ensure that only the legitimate holder can use the token.

[0057] Accordingly, the data user sends the received data sharing token to the cloud server. If it is a clustered cloud server, the received data sharing token can be sent to the master server in the cluster.

[0058] Correspondingly, the main server verifies the validity of the token signature through the public key of the supervision center. If it is valid, the data sharing token is broadcast to other cloud servers, instructing them to send the data block ciphertext corresponding to the data address to the data user. For example, each cloud server provides the data user with the download address of the data block ciphertext and opens the download permission, so that the data user can download the corresponding data block ciphertext from different cloud servers.

[0059] After the data user downloads the ciphertext of each data block, he uses the private key PrivateKey related to the attribute to decrypt the ciphertext of each data block to obtain the corresponding data block, that is: =Decrypt( ,PrivateKey,A), Among them, Decrypt() represents the decryption function.

[0060] Then, the data user combines the decrypted data blocks into complete data information, ensuring the integrity and consistency of the data.

[0061] In the above embodiment, the storage address of the data required by the data user (i.e., the data address mentioned above) is carried in the data sharing token sent by the supervision center and sent to the data user. After the data user uploads the data sharing token and signature to the cloud server, the cloud server can determine the data block ciphertext that can be provided to the data user based on the storage address.

[0062] In some embodiments, the storage address of the data required by the data user can also be sent directly to the data user by the data center without sending it to the supervision center. Accordingly, the data sharing token generated by the supervision center no longer carries the corresponding data address. After receiving the data sharing token and signature, the data user uploads the data sharing token and signature, as well as the storage address, to the cloud server. The cloud server can determine the data block ciphertext that can be provided to the data user based on the storage address.

[0063] It should be noted that in order to ensure the correspondence between the data sharing token sent by the supervision center and the data storage address when the data user requests multiple types of data, when the data center sends a request for shared data to the supervision center, the request can carry identification information corresponding to the data to be shared, such as the request serial number, etc., which can uniquely identify the corresponding data storage address. Accordingly, when the data center sends the data address information to the data user, it carries the identification information; the data sharing token sent by the monitoring center to the data user also carries the identification information. Accordingly, after receiving the data address information and the data sharing token sent by the data user, the cloud server verifies that the identification information in the two is consistent before sending the corresponding data block ciphertext to the data user. If the identification information in the two is inconsistent, the data block ciphertext is refused to be sent to the data user.

[0064] In some embodiments, the data user can also use the hash function to verify the original data block during the decryption of the data block ciphertext to ensure that the data has not been tampered with during transmission and storage. Of course, before the data center divides the corresponding data information into blocks, it first calculates it using the hash function, and then encrypts the data information after the hash calculation in blocks.

[0065] It should be noted that in specific implementations, the data center and the regulatory center can regularly update the key pairs to further enhance data security.

[0066] The data security sharing method based on block encryption provided by the present invention can safely encrypt data information in blocks and store it on the cloud server. At the same time, through attribute-based encryption technology, fine-grained access control of data can be achieved to ensure that only data users who hold the corresponding private key and meet the access structure can decrypt and access the shared data, thereby ensuring the security of data sharing. Moreover, through data sharing tokens and signatures, the legitimacy and traceability of data sharing can be ensured.

[0067] Accordingly, the embodiment of the present invention also provides a data security sharing device based on block encryption, such as Figure 2 Shown is a structural schematic diagram of the device.

[0068] Reference Figure 2 An embodiment of the data sharing device 30 based on block encryption may include the following modules: The data processing module 201 is used to divide the data information into blocks, encrypt each data block to obtain a data block ciphertext, upload the data block ciphertext to the cloud server for storage, and save the block information and directory information locally; The data checking module 202 is used to determine the data to be shared that meets the demand based on the data demand information published by the data user on the data platform; Verification module 203, used to authenticate the identity of the data user and determine whether the private key of the data user is legal and whether the requested data is compliant; The data sharing module 204 is used to send a data sharing request to the supervision center after the verification and judgment of the verification module 203 are passed, so that the supervision center uses its own private key to generate a data sharing token and signature, and sends it to the data user.

[0069] The specific implementation of each of the above modules can refer to the description in the previous embodiment of the method of the present invention, which will not be repeated here.

[0070] The data security sharing device 200 based on block encryption provided in the embodiment of the present invention can provide shared data to data users as a data provider or data center. Other related descriptions of the data security sharing device 200 based on block encryption can refer to the related descriptions in the above embodiments, which will not be repeated here.

[0071] Accordingly, the embodiment of the present invention also provides a data security sharing system based on block encryption, such as Figure 3 The figure shows a structural diagram of the data security sharing system based on block encryption and the system.

[0072] The data security sharing system based on block encryption includes: a cloud server 30, a data center 31, a supervision center 32, and further includes a data user 40. The data center 31 includes Figure 2 The data security sharing device 200 shown in FIG. The data center 31 is used to encrypt the data information in blocks and upload it to the cloud server. When there is data to be shared that meets the needs of the data user, the data user is authenticated and the private key of the data user is judged to be legal and the requested data is compliant. After the verification and judgment are passed, a request for sharing data is sent to the supervision center; The cloud server 30 is used to store the encrypted data blocks uploaded by the data center; The supervision center 32 is used to receive the shared data request, generate a data sharing token and signature using its own private key, and send it to the data user, so that the data user requests the required data from the cloud server based on the data sharing token and signature.

[0073] The data user 40 is used to publish data demand information to the data center 31 when data is needed; receive the data sharing token and signature sent by the supervision center 32, send the data sharing token and signature to the cloud server 30, and obtain shared data from the cloud server 30.

[0074] In a specific implementation, the cloud server 30 may have one or more servers, among which there is a main server, and the multiple cloud servers 30 form a distributed storage system; different data block ciphertexts are stored on the same or different cloud servers.

[0075] When there are multiple cloud servers 30, the main server receives the data sharing token and signature sent by the data user 40; verifies the signature using the public key of the regulatory center, and broadcasts the data sharing token to other cloud servers after the verification, so that the other cloud servers send the ciphertext of the relevant data blocks stored in themselves to the data user 40 according to the data sharing token.

[0076] The specific working mode and data sharing process of each part in the above-mentioned data security sharing system based on block encryption can be referred to the description in the previous embodiment of the method of the present invention, and will not be repeated here.

[0077] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0078] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0079] In several embodiments provided by the present invention, it should be understood that the disclosed device can be implemented in other ways.

[0080] The present invention also provides a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and the computer program can be executed when it is run. Figure 1 The storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc. The storage medium may also include a non-volatile memory (non-volatile) or a non-transitory memory, etc.

[0081] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server or a data provider to another website site, a computer, a server or a data provider by wired or wireless means.

[0082] The embodiments of the present invention are described in detail above. The present invention is described in detail using specific implementation methods herein. The description of the above embodiments is only used to help understand the method and system of the present invention. It is only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should belong to the scope of protection of the present invention, and the content of this specification should not be understood as limiting the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data security sharing method based on block encryption, characterized in that: The method comprises: The data center divides the data information into blocks, encrypts each data block to obtain a data block ciphertext, uploads the data block ciphertext to the cloud server for storage, and saves the block information and directory information locally; After receiving the data demand information published by the data user, determine the data to be shared that meets the demand based on the locally stored block information and directory information; Authentication of the data user and determination of whether the data user's private key is legitimate and whether the requested data is compliant; After verification and judgment, a data sharing request is sent to the supervision center, so that the supervision center uses its own private key to generate a data sharing token and signature, and sends it to the data user; The step of encrypting each data block to obtain the data block ciphertext comprises: Generate a public key and a private key pair using an attribute-based encryption algorithm and set an access structure for determining a combination of attributes that can decrypt data; Encrypting each data block using the public key and the access structure to obtain a data block ciphertext; The data demand information includes: the identity information of the data user, the access structure verification certificate, and the requested data information; the access structure verification certificate is generated by the data user according to the private key, the public parameters issued by the data center, and the zero-knowledge proof model; the zero-knowledge proof model is generated according to the set access structure; The determining whether the private key of the data user is legal includes: Determining whether the access structure verification certificate satisfies the access structure; If so, it is determined that the private key of the data user is legal.

2. The data security sharing method based on block encryption according to claim 1 is characterized in that: The method further comprises: The data user receives the data sharing token and signature sent by the supervision center; the data sharing token includes the authority and instructions for obtaining and using data; Send the data sharing token and signature to the cloud server, so that the cloud server will send the corresponding data block ciphertext to the data user according to the data sharing token and signature; The data user decrypts the ciphertext of each data block and combines the decrypted data into complete data information.

3. The data security sharing method based on block encryption according to claim 2 is characterized in that: The cloud server has one or more servers, among which there is a main server, and the multiple cloud servers form a distributed storage system; The ciphertexts of different data blocks are stored on the same or different cloud servers.

4. The data security sharing method based on block encryption according to claim 3 is characterized in that: The method further comprises: The main server receives the data sharing token and signature sent by the data user; The signature is verified using the public key of the regulatory center, and after verification, the data sharing token is broadcast to other cloud servers, so that the other cloud servers send the ciphertext of the relevant data blocks stored in themselves to the data user according to the data sharing token.

5. The data security sharing method based on block encryption according to claim 4 is characterized in that: The data sharing token includes permissions and instructions for obtaining and using data.

6. A data security sharing device based on block encryption, characterized in that: The device comprises: The data processing module is used to divide the data information into blocks, encrypt each data block to obtain a data block ciphertext, upload the data block ciphertext to the cloud server for storage, and save the block information and directory information locally; The data inspection module is used to determine the data to be shared that meets the requirements based on the data demand information published by the data user on the data platform; A verification module, used to authenticate the identity of the data user and determine whether the private key of the data user is legal and whether the requested data is compliant; The data sharing module is used to send a shared data request to the supervision center after the verification and judgment of the verification module are passed, so that the supervision center uses its own private key to generate a data sharing token and signature, and sends it to the data user.

7. A data security sharing system based on block encryption, characterized in that: The system comprises: a cloud server, a data center, and a supervision center; the data center comprises the data security sharing device based on block encryption as claimed in claim 6; The data center is used to encrypt the data information in blocks and upload it to the cloud server. When there is data to be shared that meets the needs of the data user, the data user is authenticated and the private key of the data user is determined to be legal and the requested data is compliant. After the verification and judgment are passed, a request for sharing data is sent to the supervision center; The cloud server is used to store the encrypted data blocks uploaded by the data center; The supervision center is used to receive the shared data request, use its own private key to generate a data sharing token and signature, and send it to the data user, so that the data user requests the required data from the cloud server based on the data sharing token and signature.

8. The data security sharing system based on block encryption according to claim 7 is characterized in that: The system further comprises: The data user is used to publish data demand information to the data center when data is needed; receive the data sharing token and signature sent by the supervision center, send the data sharing token and signature to the cloud server, and obtain shared data from the cloud server.

9. The data security sharing system based on block encryption according to claim 8 is characterized in that: The cloud server has one or more servers, among which there is a main server, and the multiple cloud servers form a distributed storage system; The ciphertexts of different data blocks are stored on the same or different cloud servers; The main server receives the data sharing token and signature sent by the data user; The signature is verified using the public key of the regulatory center, and after verification, the data sharing token is broadcast to other cloud servers, so that the other cloud servers send the ciphertext of the relevant data blocks stored in themselves to the data user according to the data sharing token.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the data security sharing method based on block encryption according to any one of claims 1 to 5 are executed.

Images