Privacy-enhanced block chain supervision method based on KP-ABE cryptographic algorithm

Abstract

The invention belongs to the field of block chain privacy enhancement, relates to an attribute encryption technology, is used for solving the problem that privacy protection and supervision requirements cannot be balanced in the prior art, and particularly relates to a privacy enhancement block chain supervision method based on a KP-ABE cryptographic algorithm. The public key and the attribute set are used to encrypt process data into a ciphertext, and the system uploads the encrypted ciphertext to a block chain server for evidence storage; the platform administrator generates an access strategy according to the supervision requirement, and generates a supervision private key for the supervision by using the master key and the access strategy; the supervisor uses the supervision private key to decrypt the process data conforming to the access strategy, complete plaintext data is obtained, and checking is executed; according to the method, the access strategy is embedded into the secret key, and the attribute of the supervision data is embedded into the ciphertext, so that fine-grained access control is realized, the data privacy is ensured, and an effective solution is provided for blockchain privacy supervision.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain privacy enhancement and relates to attribute encryption technology, specifically a privacy enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm. Background Art

[0002] With the increasing application of blockchain technology in finance, healthcare, supply chain management and other fields, data privacy protection has become a focus of supervision. Regulators require blockchain platforms to take effective measures to ensure the privacy of user data and prevent data leakage and abuse. However, regulators and regulatory processes can also cause privacy leaks. How to balance privacy protection and regulatory needs has become an urgent problem to be solved.

[0003] In KP-ABE, the decryption policy of the ciphertext is embedded in the user's private key when the key is generated, and the relevant attributes are embedded in the ciphertext when it is encrypted, that is, the access policy is associated with the key; however, when there are a large number of users, frequent updates of the access policy will significantly increase the resource consumption of the server, including CPU, memory, disk IO and network bandwidth, and may also cause security incidents such as server attacks or unstable operation;

[0004] Therefore, how to allocate information through encryption and decryption so that the system can balance data privacy and operating efficiency is a technical problem that urgently needs to be solved in this field. In response to the above technical problem, this application proposes a solution. Summary of the invention

[0005] The purpose of the present invention is to provide a privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm to solve the problem that the existing technology cannot balance privacy protection and supervision requirements;

[0006] The technical problem to be solved by the present invention is: how to provide a privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm that can balance privacy protection and supervision requirements.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm includes the following steps:

[0009] Step S1: Perform performance monitoring and analysis on the server: generate a monitoring cycle, mark the server that uses the KP-ABE cryptographic algorithm to manage encryption and decryption data as a monitoring object, and obtain the performance coefficient XN of the monitoring object within the monitoring cycle;

[0010] Step S2: Performing an operational performance evaluation and analysis on the server and marking the monitored object as an object with normal performance or an object with abnormal performance;

[0011] Step S3: Perform critical analysis on the number of users of performance abnormal objects and obtain the user critical value;

[0012] Step S4: Performing allocation analysis on the encryption and decryption methods of the server: generating a supervision cycle, obtaining the number of users of the server at the beginning of the supervision cycle and marking it as the supervision value of the server, and allocating the data encryption and decryption methods of the server within the supervision cycle according to the supervision value;

[0013] Step S5: Using KP-ABE cryptographic algorithm to perform data encryption and decryption;

[0014] Step S6: Use the SM4 encryption algorithm to perform data encryption and decryption.

[0015] Further, in step S1, the process of obtaining the performance coefficient XN of the monitored object during the monitoring period includes: obtaining the occupancy data ZY, the power consumption data GH and the response data XY of the monitored object during the monitoring period and performing numerical calculations to obtain the performance coefficient XN, the occupancy data ZY is the maximum value of the CPU occupancy rate of the monitored object during the monitoring period, the power consumption data GH is the maximum value of the operating power of the monitored object during the monitoring period, and the response data XY is the maximum value of the response speed of the server during the monitoring period.

[0016] Furthermore, in step S2, the specific process of marking the monitored object as an object with normal performance or an object with abnormal performance includes: comparing the performance coefficient XN of the monitored object during the monitoring period with a preset performance threshold XNmax: if the performance coefficient XN is less than the performance threshold XNmax, it is determined that the operating performance of the monitored object during the monitoring period meets the requirements, and the corresponding monitored object is marked as an object with normal performance; if the performance coefficient XN is greater than or equal to the performance threshold XNmax, it is determined that the operating performance of the monitored object during the monitoring period does not meet the requirements, and the corresponding monitored object is marked as an object with abnormal performance.

[0017] Furthermore, in step S3, the specific process of performing critical analysis on the user volume of the performance abnormality object includes: marking the user volume of the performance abnormality object at the end of the monitoring period as the service value of the performance abnormality object, forming a service analysis set from the service values ​​of all performance abnormality objects, and cleaning the service analysis set to obtain the user critical value.

[0018] Furthermore, the specific process of cleaning the service analysis set includes: performing variance calculation on all elements in the service analysis set to obtain a service concentration value, and comparing the service concentration value with a service concentration threshold: if the service concentration value is less than the service concentration threshold, then marking the minimum element in the service analysis set as the user critical value; if the service concentration value is greater than or equal to the service concentration threshold, then eliminating the maximum element and the minimum element in the service analysis set, and then recalculating the service concentration value, and so on, until the service concentration value is less than the service concentration threshold.

[0019] Furthermore, the specific process of allocating data encryption and decryption methods for the server within the supervision period includes: comparing the supervision value with the user critical value: if the supervision value is less than the user critical value, the KP-ABE cryptographic algorithm is allocated to the server for data encryption and decryption processing, and step S5 is executed; if the supervision value is greater than or equal to the user critical value, the SM4 encryption algorithm is allocated to the server for data encryption and decryption processing, and step S6 is executed.

[0020] Furthermore, in step S5, the specific process of using the KP-ABE cryptographic algorithm to perform data encryption and decryption processing includes:

[0021] Step S51: The platform administrator completes the initialization of the KP-ABE algorithm and generates a public key (PK) and a master key (MK) pair;

[0022] Step S52: the system records process data for supervision during operation, and encrypts the process data into ciphertext using a public key (PK) and an attribute set;

[0023] Step S53: The system uploads the encrypted ciphertext to the blockchain server for evidence storage;

[0024] Step S54: The system continues to execute steps S52 to S53 during operation, generates process data for supervision, encrypts it and stores it on the chain;

[0025] Step S55: The supervisory party proposes supervisory requirements;

[0026] Step S56: The platform administrator generates an access policy according to the supervision requirements, and uses the master key (MK) and the access policy to generate a supervision private key (SK) for this supervision;

[0027] Step S57: The supervisor uses the supervisory private key (SK) to decrypt the process data that complies with the access policy, obtains the complete plaintext data, and performs verification.

[0028] The present invention has the following beneficial effects:

[0029] 1. By performing performance monitoring and analysis on the server, the performance coefficient of the server during the monitoring period is obtained, the operating status of the server is evaluated according to the performance coefficient, and the server is marked differently. The number of users of performance abnormalities is counted to provide data support for critical analysis and encryption and decryption allocation analysis;

[0030] 2. By performing critical analysis on the number of users of performance abnormal objects, the user critical value is obtained. According to the user critical value, the basis and standard of user service volume are set for the encryption and decryption allocation analysis process. Then, at the beginning of the supervision cycle, the appropriate encryption and decryption processing method is allocated to it according to the supervision value of the server to ensure the stability of server operation.

[0031] 3. The KP-ABE cryptographic algorithm achieves fine-grained access control by embedding access policies into keys and the attributes of regulatory data into ciphertext. This design allows platform administrators to set access policies, and only regulators who meet the policies can decrypt regulatory data, thereby ensuring data privacy and providing an effective solution for blockchain supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 is a flow chart of the overall method of the present invention;

[0034] Figure 2 This is a flow chart of the present invention using the KP-ABE cryptographic algorithm to perform data encryption and decryption processing. DETAILED DESCRIPTION

[0035] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] With the increasing application of blockchain technology in finance, medical care, supply chain management and other fields, data privacy protection has become a focus of supervision. Regulators require blockchain platforms to take effective measures to ensure the privacy of user data and prevent data leakage and abuse. However, regulators and regulatory processes can also cause privacy leakage. How to balance privacy protection and regulatory needs has become an urgent problem to be solved. The traditional way is to create a dedicated regulatory account for the regulator and authorize such an account to access information such as operation process logs and operation results.

[0037] However, the traditional method has the following defects: the supervisory account can access all process and result data, which has too much authority and is prone to privacy leakage during the supervision process;

[0038] like Figure 1 As shown, the privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm includes the following steps:

[0039] Step S1: Perform performance monitoring and analysis on the server: Generate a monitoring cycle, mark the server that uses the KP-ABE cryptographic algorithm for encryption and decryption data management as a monitoring object, obtain the occupancy data ZY, power consumption data GH and response data XY of the monitoring object during the monitoring cycle, the occupancy data ZY is the maximum value of the CPU occupancy rate of the monitoring object during the monitoring cycle, the power consumption data GH is the maximum value of the operating power of the monitoring object during the monitoring cycle, and the response data XY is the maximum value of the response speed of the server during the monitoring cycle; the performance coefficient XN of the monitoring object during the monitoring cycle is obtained by the formula XN=c1×ZY+c2×GH+c3×XY, where c1, c2 and c3 are all proportional coefficients, and c1>c2>c3>1; perform performance monitoring and analysis on the server to obtain the performance coefficient of the server during the monitoring cycle, evaluate the operating status of the server according to the performance coefficient, and mark the server differently, and count the number of users of performance abnormal objects to provide data support for critical analysis and encryption and decryption allocation analysis processes;

[0040] Step S2: Performing an operation performance evaluation and analysis on the server: comparing the performance coefficient XN of the monitored object during the monitoring period with the preset performance threshold value XNmax: if the performance coefficient XN is less than the performance threshold value XNmax, it is determined that the operation performance of the monitored object during the monitoring period meets the requirements, and the corresponding monitored object is marked as a normal performance object; if the performance coefficient XN is greater than or equal to the performance threshold value XNmax, it is determined that the operation performance of the monitored object during the monitoring period does not meet the requirements, and the corresponding monitored object is marked as an abnormal performance object;

[0041] Step S3: Perform critical analysis on the number of users of the performance abnormality object: mark the number of users of the performance abnormality object at the end of the monitoring period as the service value of the performance abnormality object, form a service analysis set by the service values ​​of all performance abnormality objects, and clean the service analysis set: perform variance calculation on all elements in the service analysis set to obtain a service concentration value, and compare the service concentration value with the service concentration threshold: if the service concentration value is less than the service concentration threshold, mark the minimum element in the service analysis set as the user critical value; if the service concentration value is greater than or equal to the service concentration threshold, remove the maximum element and the minimum element in the service analysis set, and then recalculate the service concentration value, and so on, until the service concentration value is less than the service concentration threshold;

[0042] Step S4: Perform allocation analysis on the encryption and decryption methods of the server: Generate a supervision cycle, obtain the number of users of the server at the beginning of the supervision cycle and mark it as the supervision value of the server, and compare the supervision value with the user critical value: if the supervision value is less than the user critical value, the KP-ABE cryptographic algorithm is allocated to the server for data encryption and decryption processing, and step S5 is executed; if the supervision value is greater than or equal to the user critical value, the SM4 encryption algorithm is allocated to the server for data encryption and decryption processing, and step S6 is executed; according to the user critical value, the basis and standard of the user service volume are set for the encryption and decryption allocation analysis process, and then at the beginning of the supervision cycle, the server's supervision value is used to allocate a suitable encryption and decryption processing method to it to ensure the stability of server operation;

[0043] like Figure 2 As shown, step S5: use the KP-ABE cryptographic algorithm to perform data encryption and decryption processing:

[0044] Step S51: The platform administrator completes the initialization of the KP-ABE algorithm and generates a public key (PK) and a master key (MK) pair;

[0045] Step S52: the system records process data for supervision during operation, and encrypts the process data into ciphertext using a public key (PK) and an attribute set;

[0046] Step S53: The system uploads the encrypted ciphertext to the blockchain server for evidence storage;

[0047] Step S54: The system continues to execute steps S52 to S53 during operation, generates process data for supervision, encrypts it and stores it on the chain;

[0048] Step S55: The supervisory party proposes supervisory requirements;

[0049] Step S56: The platform administrator generates an access policy according to the supervision requirements, and uses the master key (MK) and the access policy to generate a supervision private key (SK) for this supervision;

[0050] Step S57: The supervisor uses the supervisory private key (SK) to decrypt the process data that complies with the access policy, obtains the complete plaintext data, and performs verification; the attributes of the supervisory data are embedded in the ciphertext to achieve fine-grained access control; this design allows the platform administrator to set access policies, and only supervisors who meet the policies can decrypt the supervisory data, thereby ensuring data privacy and providing an effective solution for blockchain supervision.

[0051] The KP-ABE encryption and decryption process involves the following main data:

[0052] Public key (PK): generated by the initialization algorithm and paired with the master key (MK);

[0053] Master key (MK): generated by the initialization algorithm and paired with the master public key (PK);

[0054] User attribute private key (SK): generated by the key generation algorithm;

[0055] Attribute set: a set of one or more attributes of the data to be encrypted (for example, operation time, operation type, user name, etc.);

[0056] Access structure: data access strategy, supporting comparison operations and logical operations; for example: operation time>=2024-10-01and operation time<=2024-10-02and user name=Zhang San.

[0057] Step S6: Use SM4 encryption algorithm to perform data encryption and decryption:

[0058] Step S61: input four 32-bit plaintext fields (X0, X1, X2, X3);

[0059] Step S62: Each round of iteration uses a round function F, which receives four 32-bit plaintext fields and a 32-bit round key and outputs a 32-bit result; the round function F consists of a nonlinear transformation and a linear transformation, the nonlinear transformation uses an S-box to perform byte replacement, and the linear transformation performs a circular left shift operation;

[0060] Step S63: XOR the initial key with the system parameter to generate 32 round keys (RK0, RK1, ..., RK31);

[0061] Step S64: After completing 32 rounds of iterations, the last four words (X32, X33, X34, X35) are reversed to obtain the final ciphertext (Y0, Y1, Y2, Y3);

[0062] In step S62, the construction of the round function F includes nonlinear transformation and linear transformation:

[0063] ‌Non-linear transformation‌: Use S-box to replace bytes, divide the input 32-bit data into 4 bytes, and convert each byte into hexadecimal number ‌12 through the S-box.

[0064] ‌Linear transformation‌: Perform a circular left shift operation on the result of the nonlinear transformation and XOR it with the initial data to obtain the final output‌‌‌‌.

[0065] SM4 is a symmetric encryption algorithm, which means that encryption and decryption use the same key, and its key length is 128 bits (16 bytes); the encryption and decryption speed of the SM4 algorithm is fast, and it is suitable for scenarios where large amounts of data are encrypted and decrypted. It has high performance in both hardware and software implementations. ‌‌‌‌

[0066] The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm generates a monitoring cycle when working, marks the server that uses the KP-ABE cryptographic algorithm to manage encryption and decryption data as a monitoring object, obtains the occupancy data ZY, power consumption data GH and response data XY of the monitoring object during the monitoring cycle and performs numerical calculation to obtain the performance coefficient XN, and marks the monitoring object as a normal performance object or an abnormal performance object through the performance coefficient XN; marks the user volume of the abnormal performance object at the end of the monitoring cycle as the service value of the abnormal performance object, and the service values ​​of all abnormal performance objects constitute a service analysis set, which is cleaned to obtain a user critical value, generates a supervision cycle, obtains the user volume of the server at the beginning of the supervision cycle and marks it as the supervision value of the server, compares the supervision value with the user critical value, and marks the encryption and decryption method of the server according to the comparison result.

[0067] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

[0068] The above formulas are obtained by collecting a large amount of data for software simulation and selecting a formula close to the real value. The coefficients in the formula are set by technicians in this field according to actual conditions; for example: formula XN=c1×ZY+c2×GH+c3×XY; technicians in this field collect multiple groups of sample data and set corresponding performance coefficients for each group of sample data; substitute the set performance coefficients and the collected sample data into the formula, any three formulas constitute a three-variable linear equation group, screen the calculated coefficients and take the average, and obtain the values ​​of c1, c2 and c3 as 3.62, 2.57 and 2.02 respectively;

[0069] The size of the coefficient is to quantify each parameter to obtain a specific value for subsequent comparison. The size of the coefficient depends on the amount of sample data and the preliminary setting of the corresponding performance coefficient for each group of sample data by technical personnel in this field; as long as it does not affect the proportional relationship between the parameter and the quantized value, such as the performance coefficient is proportional to the value of the occupied data.

[0070] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0071] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm, characterized in that: The following steps are involved: Step S1: Perform performance monitoring and analysis on the server: generate a monitoring cycle, mark the server that uses the KP-ABE cryptographic algorithm to manage encryption and decryption data as a monitoring object, and obtain the performance coefficient XN of the monitoring object within the monitoring cycle; Step S2: Performing an operational performance evaluation and analysis on the server and marking the monitored object as an object with normal performance or an object with abnormal performance; Step S3: Perform critical analysis on the number of users of performance abnormal objects and obtain the user critical value; Step S4: Performing allocation analysis on the encryption and decryption methods of the server: generating a supervision cycle, obtaining the number of users of the server at the beginning of the supervision cycle and marking it as the supervision value of the server, and allocating the data encryption and decryption methods of the server within the supervision cycle according to the supervision value; Step S5: Using KP-ABE cryptographic algorithm to perform data encryption and decryption; Step S6: Use the SM4 encryption algorithm to perform data encryption and decryption.

2. The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm according to claim 1 is characterized in that: In step S1, the process of obtaining the performance coefficient XN of the monitored object during the monitoring period includes: obtaining the occupancy data ZY, the power consumption data GH and the response data XY of the monitored object during the monitoring period and performing numerical calculations to obtain the performance coefficient XN, the occupancy data ZY is the maximum value of the CPU occupancy rate of the monitored object during the monitoring period, the power consumption data GH is the maximum value of the operating power of the monitored object during the monitoring period, and the response data XY is the maximum value of the response speed of the server during the monitoring period.

3. The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm according to claim 2 is characterized in that: In step S2, the specific process of marking the monitored object as an object with normal performance or an object with abnormal performance includes: comparing the performance coefficient XN of the monitored object during the monitoring period with a preset performance threshold XNmax: if the performance coefficient XN is less than the performance threshold XNmax, it is determined that the operating performance of the monitored object during the monitoring period meets the requirements, and the corresponding monitored object is marked as an object with normal performance; if the performance coefficient XN is greater than or equal to the performance threshold XNmax, it is determined that the operating performance of the monitored object during the monitoring period does not meet the requirements, and the corresponding monitored object is marked as an object with abnormal performance.

4. The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm according to claim 3 is characterized in that: In step S3, the specific process of performing critical analysis on the user volume of the performance abnormality object includes: marking the user volume of the performance abnormality object at the end of the monitoring period as the service value of the performance abnormality object, forming a service analysis set from the service values ​​of all performance abnormality objects, and cleaning the service analysis set to obtain the user critical value.

5. The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm according to claim 4 is characterized in that: The specific process of cleaning the service analysis set includes: performing variance calculation on all elements in the service analysis set to obtain a service concentration value, and comparing the service concentration value with the service concentration threshold: if the service concentration value is less than the service concentration threshold, the minimum element in the service analysis set is marked as the user critical value; if the service concentration value is greater than or equal to the service concentration threshold, the maximum element and the minimum element in the service analysis set are eliminated, and then the service concentration value is recalculated, and so on, until the service concentration value is less than the service concentration threshold.

6. The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm according to claim 5 is characterized in that: In step S4, the specific process of assigning the data encryption and decryption method of the server within the supervision period includes: comparing the supervision value with the user critical value: if the supervision value is less than the user critical value, the KP-ABE cryptographic algorithm is assigned to the server for data encryption and decryption processing, and step S5 is executed; if the supervision value is greater than or equal to the user critical value, the SM4 encryption algorithm is assigned to the server for data encryption and decryption processing, and step S6 is executed.

7. The privacy-enhanced blockchain supervision method based on the KP-ABE cryptographic algorithm according to claim 6 is characterized in that: In step S5, the specific process of using the KP-ABE cryptographic algorithm to perform data encryption and decryption includes: Step S51: The platform administrator completes the initialization of the KP-ABE algorithm and generates a public key (PK) and a master key (MK) pair; Step S52: the system records process data for supervision during operation, and encrypts the process data into ciphertext using a public key (PK) and an attribute set; Step S53: The system uploads the encrypted ciphertext to the blockchain server for evidence storage; Step S54: The system continues to execute steps S52 to S53 during operation, generates process data for supervision, encrypts it and stores it on the chain; Step S55: The supervisory party proposes supervisory requirements; Step S56: The platform administrator generates an access policy according to the supervision requirements, and uses the master key (MK) and the access policy to generate a supervision private key (SK) for this supervision; Step S57: The supervisor uses the supervisory private key (SK) to decrypt the process data that complies with the access policy, obtains the complete plaintext data, and performs verification.

Images