User carbon emission data access control method and system based on time-space attribute encryption

Abstract

The invention discloses a user carbon emission data access control method and system based on space-time attribute encryption, and the method comprises the steps that a data owner encrypts user carbon emission data through a constructed access strategy based on space-time attributes and public parameters generated by an attribute authorization mechanism, the obtained ciphertext data and the packaging secret key are sent to a block chain network to be encrypted and stored, the block chain network returns encrypted user carbon emission ciphertext data when receiving a data access request, and a data user decrypts the encrypted user carbon emission ciphertext data according to an attribute secret key; the attribute key is generated by the attribute authorization mechanism according to the attribute set of the data user and the initialized generated master key and public parameters. According to the method, the access strategy based on the space-time attribute is adopted to encrypt the data, and the user carbon emission data can be decrypted only when the attribute set of the user is matched with the access strategy in the ciphertext, so that the fine-grained control of the data access by the data owner is realized, and the data security is improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method and system for controlling user carbon emission data access based on spatiotemporal attribute encryption. Background Art

[0002] With the global concern about climate change and the increasing demand for carbon emission control, the management and access control of carbon emission data have become particularly important. Traditional access control uses Mandatory Access Control (MAC) technology. The system determines access rights based on pre-defined security policies and the security level of the data, and users are usually unable to change these rights independently. In addition, MAC has the disadvantages of complex configuration, limited performance, and non-scalability, and is not suitable for distributed blockchain systems that require fine-grained access control. In addition, due to the complexity of carbon emission data processing business and the large scale of carbon emission data, traditional access control methods have the disadvantages of complex configuration, limited performance, and non-scalability, which makes it difficult to meet the access control requirements of data users with different attributes such as time and space in the carbon emission data processing business. Summary of the invention

[0003] The present application provides a user carbon emission data access control method and system based on spatiotemporal attribute encryption, which is used to improve the technical problem that the existing data access control method is difficult to meet the access control requirements of data users with different attributes such as time and space in the carbon emission data processing business.

[0004] In view of this, the first aspect of the present application provides a user carbon emission data access control method based on spatiotemporal attribute encryption, which is applied to the data owner, and the method includes:

[0005] Register with the attribute authority and obtain the public parameters generated by the attribute authority;

[0006] Constructing an access strategy based on spatiotemporal attributes for the user's carbon emission data, encrypting the user's carbon emission data through the public parameters and the access strategy to obtain the user's carbon emission ciphertext data and encapsulation key;

[0007] The user carbon emission ciphertext data and the encapsulation key are uploaded to the blockchain network, and the blockchain network uses the encapsulation key to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data, and when the blockchain network receives a data access request from a data user, the encrypted user carbon emission ciphertext data is returned, and the data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key;

[0008] The attribute key is generated by the attribute authorization agency according to the attribute set provided by the data user and the master key and public parameters generated by initialization.

[0009] Optionally, encrypting the user carbon emission data by using the public parameters and the access policy to obtain the user carbon emission ciphertext data and the encapsulation key includes:

[0010] Converting the access policy into a linear secret sharing scheme matrix;

[0011] generating an intermediate ciphertext according to the public parameter and an upper limit of the number of rows obtained from the linear secret sharing scheme matrix;

[0012] The user carbon emission data is encrypted according to the public parameters, the intermediate ciphertext and the access policy to obtain the user carbon emission ciphertext data and the encapsulation key.

[0013] Optionally, the process of generating the attribute key includes:

[0014] Generate an intermediate key based on the public parameters initialized by the attribute authority and the number of attributes of the data user;

[0015] An attribute key is generated according to the master key, the attribute set and the intermediate key initially generated by the attribute authority.

[0016] Optionally, the data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key, including:

[0017] The data user generates a blinding key and a recovery key according to the attribute key;

[0018] Send the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption, and the blockchain network uses the blinding key and the encapsulation key to perform preliminary decryption on the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result; the intermediate decryption result is the converted user carbon emission ciphertext data or decryption failure;

[0019] The intermediate decryption result returned by the blockchain is received. When the intermediate decryption result is the converted user carbon emission ciphertext data, the converted user carbon emission ciphertext data is decrypted by using the recovery key to obtain the user carbon emission data.

[0020] The second aspect of the present application provides a user carbon emission data access control method based on spatiotemporal attribute encryption, which is applied to data users, and the method includes:

[0021] Register with an attribute authority, send an attribute set to the attribute authority, and obtain an attribute key generated by the attribute authority according to the attribute set and the master key and public parameters generated by the attribute authority;

[0022] Obtaining encrypted user carbon emission ciphertext data by accessing the blockchain network, and decrypting the encrypted user carbon emission ciphertext data according to the attribute key;

[0023] The encrypted user carbon emission ciphertext data is obtained by double encrypting the user carbon emission data using the public parameters, an access strategy based on spatiotemporal attributes constructed by the data owner, and a wrapping key generated based on the public parameters and the access strategy.

[0024] Optionally, decrypting the encrypted user carbon emission ciphertext data according to the attribute key includes:

[0025] Generate a blinding key and a recovery key according to the attribute key;

[0026] Send the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption, and the blockchain network uses the blinding key and the encapsulation key to perform preliminary decryption on the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result; the intermediate decryption result is the converted user carbon emission ciphertext data or decryption failure;

[0027] The intermediate decryption result returned by the blockchain network is received. When the intermediate decryption result is the converted user carbon emission ciphertext data, the converted user carbon emission ciphertext data is decrypted by using the recovery key to obtain the user carbon emission data.

[0028] The third aspect of the present application provides a user carbon emission data access control method based on spatiotemporal attribute encryption, which is applied to a blockchain network, and the method includes:

[0029] Receiving user carbon emission ciphertext data and encapsulation key sent by the data owner; the user carbon emission ciphertext data and the encapsulation key are obtained by encrypting the user carbon emission data using the public parameters generated by the data owner through initialization of the attribute authorization mechanism and the access strategy based on spatiotemporal attributes constructed by the data owner;

[0030] The encapsulation key is used to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data;

[0031] Receiving a data access request sent by a data user, and returning the encrypted user carbon emission ciphertext data, so that the data user can decrypt the encrypted user carbon emission ciphertext data according to an attribute key;

[0032] The attribute key is generated by the attribute authorization agency according to the attribute set provided by the data user and the master key and public parameters generated by initialization.

[0033] Optionally, the data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key, including:

[0034] The data user generates a blinding key and a recovery key according to the attribute key, and sends the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption;

[0035] The blockchain network uses the blinding key and the encapsulation key to preliminarily decrypt the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result, and sends the intermediate decryption result to the data user; the intermediate decryption result is the converted user carbon emission ciphertext data or decryption failure;

[0036] When the intermediate decryption result is the converted user carbon emission ciphertext data, the data user decrypts the converted user carbon emission ciphertext data by using the recovery key to obtain the user carbon emission data.

[0037] Optionally, the method further includes:

[0038] When it is detected that the data user has caused damage to the blockchain network, the blinded key corresponding to the data user in the proxy key list is deleted according to the identity of the data user.

[0039] The fourth aspect of the present application provides a user carbon emission data access control system based on spatiotemporal attribute encryption, including:

[0040] An attribute authorization agency, used to generate public parameters and a master key by initialization, generate an attribute key according to the spatiotemporal attributes, the master key and the public parameters provided by the data user, and send the attribute key to the data user;

[0041] The data owner is used to construct an access policy based on spatiotemporal attributes for the user's carbon emission data, obtain the public parameters from the attribute authorization agency, encrypt the user's carbon emission data through the public parameters and the access policy, obtain the user's carbon emission ciphertext data and the encapsulation key, and upload the user's carbon emission ciphertext data and the encapsulation key to the blockchain network;

[0042] The blockchain network is used to encrypt the user carbon emission ciphertext data using the encapsulation key to obtain the encrypted user carbon emission ciphertext data;

[0043] A data user is used to obtain the encrypted user carbon emission ciphertext data by accessing the blockchain network, and decrypt the encrypted user carbon emission ciphertext data according to the attribute key.

[0044] It can be seen from the above technical solutions that this application has the following advantages:

[0045] The user carbon emission data access control method based on spatiotemporal attribute encryption provided in the present application adopts an access strategy based on time and space attributes to encrypt the user carbon emission data, and associates the data user's key with the attribute set. During decryption, only when the user's attribute set matches the access policy in the user's carbon emission ciphertext data can the user decrypt the user's carbon emission data. This enables the data owner to perform fine-grained control over data access, improves data security, and achieves the purpose of safe circulation and sharing of carbon emission data. It is suitable for scenarios where fine-grained control of carbon emission data access is required. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A flowchart of a method for controlling user carbon emission data access based on spatiotemporal attribute encryption applied to a data owner provided in an embodiment of the present application;

[0048] Figure 2 A flowchart of a method for controlling user carbon emission data access based on spatiotemporal attribute encryption applied to data users provided in an embodiment of the present application;

[0049] Figure 3 A flowchart of a user carbon emission data access control method based on spatiotemporal attribute encryption applied to a blockchain network provided in an embodiment of the present application;

[0050] Figure 4 A structural schematic diagram of a user carbon emission data access control system based on spatiotemporal attribute encryption provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] For easier understanding, please refer to Figure 1 In a first aspect, the present application provides a method for controlling user carbon emission data access based on spatiotemporal attribute encryption, which is applied to data owners and includes:

[0053] Step 110: Register with the attribute authority and obtain the public parameters generated by the attribute authority.

[0054] The data owner registers with the attribute authority, and the attribute authority returns the public parameter PK to the data owner. The attribute authority executes the initialization algorithm Setup( ,U) Generate the public parameters PK and master key MSK for encryption and decryption, where, , U are safety parameters.

[0055] Step 120: construct an access policy based on spatiotemporal attributes for the user's carbon emission data, encrypt the user's carbon emission data through public parameters and the access policy, and obtain the user's carbon emission ciphertext data and encapsulation key.

[0056] After the data owner obtains the public parameter PK from the attribute authorization agency, he formulates an access policy based on the shared data requirements. The access policy consists of the attributes and logical words of the data user. For example, the policy can be {(time period AND location coordinates) OR (attribute 2 AND attribute 3)}. Under this access policy, only data users with satisfying time periods and location coordinates can access the user's carbon emission data, while data users with only attribute 2 or attribute 3 cannot match. Such an access policy can be converted into a linear secret sharing scheme (Linear Secret-Sharing and Access Policy, LSSS) matrix through existing technologies and used in encryption algorithms. Then, the data owner uses the public parameter PK and the access policy to execute the encryption algorithm, encrypt the user's carbon emission data, and generate the user's carbon emission ciphertext data and encapsulation key.

[0057] The specific process of encrypting carbon emission data through public parameters and access policies to obtain the user's carbon emission ciphertext data can be as follows:

[0058] S11, converting the access policy into a linear secret sharing scheme matrix;

[0059] S12, generating an intermediate ciphertext according to the public parameters and an upper limit of the number of rows obtained from the linear secret sharing scheme matrix;

[0060] Input the public parameter PK and the upper limit of the number of rows N obtained from the linear secret sharing scheme matrix into the function Encrypt1.out(PK,N), and output the intermediate ciphertext IT1;

[0061] The public parameter PK and the upper limit N of the number of rows obtained from the linear secret sharing scheme matrix are input into the function Encrypt2.out(PK,N) to output the intermediate ciphertext IT2.

[0062] It should be noted that in order to reduce the computing pressure of the data owner, the public parameters and the matrix from the linear secret sharing scheme can be sent to the blockchain network, and the blockchain network executes step S12, and the data owner obtains the two intermediate ciphertexts encrypted by the blockchain network.

[0063] S13. Encrypt the user's carbon emission data according to the public parameters, the intermediate ciphertext and the access policy to obtain the user's carbon emission ciphertext data and the encapsulation key.

[0064] The data owner inputs the public parameter PK, the intermediate ciphertext (IT1, IT2) and the access structure (M, ) to the function Encrypt1.user(PK,IT1,IT2,(M, )), output the user carbon emission ciphertext data CT and the encapsulation key key, that is, Encrypt1.user(PK,IT1,IT2,(M, ))→(CT,key). Where M is the user’s carbon emission data, A set of attributes set for the data owner, which includes at least time attributes and spatial attributes (such as location coordinates).

[0065] Step 130: Upload the user carbon emission ciphertext data and the encapsulation key to the blockchain network. The blockchain network uses the encapsulation key to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data. When the blockchain network receives a data access request from a data user, it returns the encrypted user carbon emission ciphertext data. The data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key.

[0066] After the data owner encrypts the user's carbon emission ciphertext data, the user's carbon emission ciphertext data and the encapsulation key are uploaded to the blockchain network for encrypted storage. That is, the blockchain network uses the encapsulation key key to encrypt the user's carbon emission ciphertext data CT, obtains the encrypted user's carbon emission ciphertext data TCT and stores the encrypted user's carbon emission ciphertext data TCT, that is, Encrypt2.user(CT,key) →TCT. The data user sends a data access request to the blockchain network to download the encrypted user's carbon emission ciphertext data of interest according to its time-space attribute set (attribute set), and then decrypts the encrypted user's carbon emission ciphertext data according to the attribute key, where the attribute key is generated by the attribute authorization agency based on the attribute set provided by the data user and the master key and public parameters generated by the initialization. The data user registers with the attribute authorization agency, sends the attribute set to the attribute authorization agency, and obtains the attribute key generated by the attribute authorization agency based on the attribute set and the master key and public parameters generated by the initialization. Among them, the attribute key generation process includes:

[0067] S21, generating an intermediate key according to the public parameters initialized and generated by the attribute authorization agency and the number of attributes of the data user;

[0068] Input the public parameter PK and the integer N' representing the number of attributes to the function KeyGen1.out (PK, N'), and output the intermediate key ISK1, that is, KeyGen1.out (PK, N') → ISK1;

[0069] Input the public parameter PK and the integer N' representing the number of attributes to the function KeyGen2.out (PK, N'), and output the intermediate key ISK2, that is, KeyGen2.out (PK, N') → ISK2.

[0070] S22. Generate an attribute key based on the master key, attribute set and intermediate key initialized and generated by the attribute authorization agency.

[0071] Input the master key MSK initialized by the attribute authority, the attribute set S provided by the data user, and two intermediate keys (ISK1, ISK2) to the function KeyGen.pkg (MSK, S, ISK1, ISK2), and output the attribute key SK, that is, KeyGen.pkg (MSK, S, ISK1, ISK2) → SK.

[0072] It should be noted that in order to reduce the computing pressure of the attribute authorization agency, the attribute authorization agency can send the public parameter PK, the master key MSK and the integer N' representing the number of attributes to the blockchain network, and the blockchain network will calculate the attribute key.

[0073] After the data user obtains the encrypted user carbon emission ciphertext data, he can first verify the encrypted user carbon emission ciphertext data. If the verification result is legal, it means that the data has not been tampered with. The data user further decrypts the encrypted user carbon emission ciphertext data according to the attribute key.

[0074] Furthermore, in order to reduce the computing pressure of data users, data users can send encrypted user carbon emission ciphertext data and attribute keys that meet the encrypted data access policy to let the blockchain network execute the decryption algorithm to obtain the data plaintext. Only when the attribute set provided by the data user meets the access policy can the attribute key that meets the access policy be obtained, and the encrypted user carbon emission ciphertext data can be successfully decrypted. The decryption process includes:

[0075] S31. The data user generates a blinding key and a recovery key based on the attribute key;

[0076] The data user inputs the attribute key SK to the function KeyGen.ran(SK), which outputs the blinded key TK and the recovery key RtK, i.e., KeyGen.ran(SK)→(TK,RtK).

[0077] It should be noted that in order to reduce the computing pressure of data users, step S31 can be executed by the blockchain network.

[0078] S32, sending the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption, and the blockchain network uses the blinding key and the encapsulation key to perform preliminary decryption on the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result;

[0079] The blockchain network inputs the blinding key TK, the encrypted user carbon emission ciphertext data TCT and the encapsulation key key to the function Decrypt.out (TK, TCT, key), and outputs the converted user carbon emission ciphertext data CT' or interrupts the operation (i.e., decryption fails). When the attribute key is an attribute key whose attribute set satisfies the access policy, the blockchain network can obtain the converted user carbon emission ciphertext data CT'; when the attribute key is an attribute key whose attribute set does not satisfy the access policy, the blockchain network cannot obtain the converted user carbon emission ciphertext data CT' through the blinding key TK decryption, and the output decryption fails. The blockchain network returns the intermediate decryption result to the data user.

[0080] S33. Receive the intermediate decryption result returned by the blockchain. When the intermediate decryption result is the converted user carbon emission ciphertext data, decrypt the converted user carbon emission ciphertext data by recovering the key to obtain the user carbon emission data.

[0081] The data user receives the intermediate decryption result returned by the blockchain. When the intermediate decryption result is the converted user carbon emission ciphertext data, the data user inputs the recovery key RtK and the converted user carbon emission ciphertext data CT' into the function Decrypt.user (RtK, CT'), and outputs the decrypted user carbon emission data, that is, Decrypt.user (RtK, CT') → M. When the decryption result is a decryption failure, it means that the attribute set provided by the user does not comply with the access policy, and the user carbon emission data cannot be decrypted.

[0082] After detecting a data leak, the blockchain network can perform a wrapping key update operation and use the updated wrapping key to update the encrypted user carbon emission ciphertext data. When a malicious data user appears, the user's permissions can be immediately revoked and decryption can be refused. When the blockchain network detects that data user u has caused damage to the blockchain network (such as data user u maliciously initiating a large number of requests, causing the blockchain network service to slow down or even unable to respond normally to requests from other legitimate users), the blockchain network will revoke its destructive operation and call the Revoke (u, L) algorithm to immediately revoke it from the authorization list and refuse to use TK for outsourced decryption for data user u. The blockchain network takes the identity of the data user u and the proxy key list L as input. The Revoke (u, L) function deletes the blinded key corresponding to the data user u in the proxy key list L, and revokes the decryption ability of the data user u by updating and outputting the proxy key list L; when the destructive behavior of the data user u is revoked, its permissions are immediately modified through the authorization list, and the data user will be immediately revoked if he makes a request again.

[0083] The user carbon emission data access control method based on spatiotemporal attribute encryption provided in the present application adopts an access strategy based on time and space attributes to encrypt the user carbon emission data, and associates the data user's key with the attribute set. During decryption, only when the user's attribute set matches the access policy in the user's carbon emission ciphertext data can the user decrypt the user's carbon emission data. This enables the data owner to perform fine-grained control over data access, improves data security, and achieves the purpose of safe circulation and sharing of carbon emission data. It is suitable for scenarios where fine-grained control of carbon emission data access is required.

[0084] Please refer to Figure 2 The second aspect of the present application provides a user carbon emission data access control method based on spatiotemporal attribute encryption, which is applied to data users and includes:

[0085] Step 210: Register with the attribute authority, send the attribute set to the attribute authority, and obtain the attribute key generated by the attribute authority according to the attribute set and the master key and public parameters generated by the attribute authority.

[0086] The data user registers with the attribute authorization agency and sends the attribute set to the attribute authorization agency. The attribute authorization agency generates the attribute key based on the attribute set, the master key generated by initialization, and the public parameters and sends it to the data user. The generation process of the attribute key is consistent with the specific process of the aforementioned steps S21-S22, and will not be repeated here.

[0087] Step 220: Obtain the encrypted user carbon emission ciphertext data by accessing the blockchain network, and decrypt the encrypted user carbon emission ciphertext data according to the attribute key.

[0088] The data user sends a data access request to the blockchain network to download the encrypted user carbon emission ciphertext data of interest according to its time-space attribute set (attribute set), and then decrypts the encrypted user carbon emission ciphertext data according to the attribute key.

[0089] It should be noted that after the data user obtains the encrypted user carbon emission ciphertext data, he can first verify the encrypted user carbon emission ciphertext data. If the verification result is legal, it means that the data has not been tampered with. The data user further decrypts the encrypted user carbon emission ciphertext data according to the attribute key. Among them, the encrypted user carbon emission ciphertext data is obtained by doubly encrypting the user carbon emission data with public parameters, the access strategy based on spatiotemporal attributes constructed by the data owner, and the encapsulation key generated based on the public parameters and the access strategy. The specific process of the user carbon emission ciphertext data is consistent with the specific process of the aforementioned steps S11-S13, which will not be repeated here.

[0090] The user carbon emission data access control method based on spatiotemporal attribute encryption provided in the present application adopts an access strategy based on time and space attributes to encrypt the user carbon emission data, and associates the data user's key with the attribute set. During decryption, only when the user's attribute set matches the access policy in the user's carbon emission ciphertext data can the user decrypt the user's carbon emission data. This enables the data owner to perform fine-grained control over data access, improves data security, and achieves the purpose of safe circulation and sharing of carbon emission data. It is suitable for scenarios where fine-grained control of carbon emission data access is required.

[0091] Please refer to Figure 3 The third aspect of the present application provides a user carbon emission data access control method based on spatiotemporal attribute encryption, which is applied to a blockchain network. The method includes:

[0092] Step 310: Receive the user carbon emission ciphertext data and encapsulation key sent by the data owner.

[0093] Step 320: Use the encapsulation key to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data.

[0094] The blockchain network receives the user carbon emission ciphertext data and encapsulation key sent by the data owner, and uses the encapsulation key to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data. The user carbon emission ciphertext data is obtained by encrypting the user carbon emission data using the public parameters generated by the attribute authorization agency initialized by the data owner and the access strategy based on spatiotemporal attributes constructed by the data owner. The specific process of the user carbon emission ciphertext data is consistent with the specific process of the aforementioned steps S11-S13, which will not be repeated here.

[0095] Step 330: Receive a data access request sent by a data user, and return the encrypted user carbon emission ciphertext data, so that the data user can decrypt the encrypted user carbon emission ciphertext data according to the attribute key.

[0096] After receiving the data access request sent by the data user, the blockchain network returns the corresponding encrypted user carbon emission ciphertext data. After the data user obtains the encrypted user carbon emission ciphertext data, he can first verify the encrypted user carbon emission ciphertext data. If the verification result is legal, it means that the data has not been tampered with. The data user further decrypts the encrypted user carbon emission ciphertext data according to the attribute key. Among them, the attribute key is generated by the attribute authorization agency based on the attribute set provided by the data user and the master key and public parameters generated by the initialization. The generation process of the attribute key is consistent with the specific process of the aforementioned steps S21-S22, which will not be repeated here.

[0097] After detecting a data leak, the blockchain network can perform a wrapping key update operation and use the updated wrapping key to update the encrypted user carbon emission ciphertext data. When a malicious data user appears, the user's permissions can be immediately revoked and decryption can be refused. When the blockchain network detects that data user u has caused damage to the blockchain network, the blockchain network will revoke its destructive operation and call the Revoke (u, L) algorithm to immediately revoke it from the authorization list and refuse to use TK for outsourced decryption for data user u. The blockchain network takes the identity of the data user u and the proxy key list L as input. The Revoke (u, L) function deletes the blinded key corresponding to the data user u in the proxy key list L, and revokes the decryption ability of the data user u by updating and outputting the proxy key list L; when the destructive behavior of the data user u is revoked, its permissions are immediately modified through the authorization list, and the data user will be immediately revoked if he makes another request.

[0098] The user carbon emission data access control method based on spatiotemporal attribute encryption provided in the present application adopts an access strategy based on time and space attributes to encrypt the user carbon emission data, and associates the data user's key with the attribute set. During decryption, only when the user's attribute set matches the access policy in the user's carbon emission ciphertext data can the user decrypt the user's carbon emission data. This enables the data owner to perform fine-grained control over data access, improves data security, and achieves the purpose of safe circulation and sharing of carbon emission data. It is suitable for scenarios where fine-grained control of carbon emission data access is required.

[0099] Please refer to Figure 4 In a fourth aspect, the present application provides a user carbon emission data access control system based on spatiotemporal attribute encryption, comprising:

[0100] The attribute authority is used to generate public parameters and master keys through initialization, generate attribute keys based on the spatiotemporal attributes, master keys and public parameters provided by data users, and send them to data users;

[0101] Data owners build access policies based on spatiotemporal attributes for user carbon emission data, obtain public parameters from attribute authorization agencies, encrypt user carbon emission data through public parameters and access policies, obtain user carbon emission ciphertext data and encapsulation keys, and upload user carbon emission ciphertext data and encapsulation keys to the blockchain network;

[0102] The blockchain network is used to encrypt the user carbon emission ciphertext data with a wrapping key to obtain the encrypted user carbon emission ciphertext data;

[0103] Data users are used to obtain encrypted user carbon emission ciphertext data by accessing the blockchain network, and decrypt the encrypted user carbon emission ciphertext data according to the attribute key.

[0104] The user carbon emission data access control system based on spatiotemporal attribute encryption provided in the present application adopts an access strategy based on time and space attributes to encrypt user carbon emission data, and associates the data user's key with an attribute set. During decryption, only when the user's attribute set matches the access policy in the user's carbon emission ciphertext data can the user decrypt the user's carbon emission data, thereby realizing fine-grained control of data access by data owners and improving data security. The system is suitable for scenarios where fine-grained control of carbon emission data access is required.

[0105] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0106] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0107] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0108] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0109] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0110] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0111] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions for executing all or part of the steps of the method described in each embodiment of the present application through a computer device (which can be a personal computer, server, or network device, etc.). The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (full name in English: Read-Only Memory, English abbreviation: ROM), random access memory (full name in English: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program codes.

[0112] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A user carbon emission data access control method based on spatiotemporal attribute encryption, characterized in that: Applied to the data owner, the method comprises: Register with the attribute authority and obtain the public parameters generated by the attribute authority; Constructing an access strategy based on spatiotemporal attributes for the user's carbon emission data, encrypting the user's carbon emission data through the public parameters and the access strategy to obtain the user's carbon emission ciphertext data and encapsulation key; The user carbon emission ciphertext data and the encapsulation key are uploaded to the blockchain network, and the blockchain network uses the encapsulation key to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data, and when the blockchain network receives a data access request from a data user, the encrypted user carbon emission ciphertext data is returned, and the data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key; The attribute key is generated by the attribute authorization agency according to the attribute set provided by the data user and the master key and public parameters generated by initialization.

2. The user carbon emission data access control method based on spatiotemporal attribute encryption according to claim 1 is characterized in that: The user carbon emission data is encrypted by using the public parameters and the access policy to obtain the user carbon emission ciphertext data and the encapsulation key, including: Converting the access policy into a linear secret sharing scheme matrix; generating an intermediate ciphertext according to the public parameter and an upper limit of the number of rows obtained from the linear secret sharing scheme matrix; The user carbon emission data is encrypted according to the public parameters, the intermediate ciphertext and the access policy to obtain the user carbon emission ciphertext data and the encapsulation key.

3. The user carbon emission data access control method based on spatiotemporal attribute encryption according to claim 1 is characterized in that: The process of generating the attribute key includes: Generate an intermediate key based on the public parameters initialized by the attribute authority and the number of attributes of the data user; An attribute key is generated according to the master key, the attribute set and the intermediate key initially generated by the attribute authority.

4. The user carbon emission data access control method based on spatiotemporal attribute encryption according to claim 1 is characterized in that: The data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key, including: The data user generates a blinding key and a recovery key according to the attribute key; Send the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption, and the blockchain network uses the blinding key and the encapsulation key to perform preliminary decryption on the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result; the intermediate decryption result is the converted user carbon emission ciphertext data or decryption failure; The intermediate decryption result returned by the blockchain is received. When the intermediate decryption result is the converted user carbon emission ciphertext data, the converted user carbon emission ciphertext data is decrypted by using the recovery key to obtain the user carbon emission data.

5. A user carbon emission data access control method based on spatiotemporal attribute encryption, characterized in that: Applied to data users, the method includes: Register with an attribute authority, send an attribute set to the attribute authority, and obtain an attribute key generated by the attribute authority according to the attribute set and the master key and public parameters generated by the attribute authority; Obtaining encrypted user carbon emission ciphertext data by accessing the blockchain network, and decrypting the encrypted user carbon emission ciphertext data according to the attribute key; The encrypted user carbon emission ciphertext data is obtained by double encrypting the user carbon emission data using the public parameters, an access strategy based on spatiotemporal attributes constructed by the data owner, and a wrapping key generated based on the public parameters and the access strategy.

6. The user carbon emission data access control method based on spatiotemporal attribute encryption according to claim 5 is characterized in that: Decrypting the encrypted user carbon emission ciphertext data according to the attribute key includes: Generate a blinding key and a recovery key according to the attribute key; Send the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption, and the blockchain network uses the blinding key and the encapsulation key to perform preliminary decryption on the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result; the intermediate decryption result is the converted user carbon emission ciphertext data or decryption failure; The intermediate decryption result returned by the blockchain network is received. When the intermediate decryption result is the converted user carbon emission ciphertext data, the converted user carbon emission ciphertext data is decrypted by using the recovery key to obtain the user carbon emission data.

7. A user carbon emission data access control method based on spatiotemporal attribute encryption, characterized in that: Applied to a blockchain network, the method comprises: Receiving user carbon emission ciphertext data and encapsulation key sent by the data owner; the user carbon emission ciphertext data and the encapsulation key are obtained by encrypting the user carbon emission data using the public parameters generated by the data owner through initialization of the attribute authorization mechanism and the access strategy based on spatiotemporal attributes constructed by the data owner; The encapsulation key is used to encrypt the user carbon emission ciphertext data to obtain the encrypted user carbon emission ciphertext data; Receiving a data access request sent by a data user, and returning the encrypted user carbon emission ciphertext data, so that the data user can decrypt the encrypted user carbon emission ciphertext data according to an attribute key; The attribute key is generated by the attribute authorization agency according to the attribute set provided by the data user and the master key and public parameters generated by initialization.

8. The user carbon emission data access control method based on spatiotemporal attribute encryption according to claim 7 is characterized in that: The data user decrypts the encrypted user carbon emission ciphertext data according to the attribute key, including: The data user generates a blinding key and a recovery key according to the attribute key, and sends the blinding key and the encrypted user carbon emission ciphertext data to the blockchain network to request outsourced decryption; The blockchain network uses the blinding key and the encapsulation key to preliminarily decrypt the encrypted user carbon emission ciphertext data to obtain an intermediate decryption result, and sends the intermediate decryption result to the data user; the intermediate decryption result is the converted user carbon emission ciphertext data or decryption failure; When the intermediate decryption result is the converted user carbon emission ciphertext data, the data user decrypts the converted user carbon emission ciphertext data by using the recovery key to obtain the user carbon emission data.

9. The user carbon emission data access control method based on spatiotemporal attribute encryption according to claim 7 is characterized in that: The method further comprises: When it is detected that the data user has caused damage to the blockchain network, the blinded key corresponding to the data user in the proxy key list is deleted according to the identity of the data user.

10. A user carbon emission data access control system based on spatiotemporal attribute encryption, characterized in that: include: An attribute authorization agency, used to generate public parameters and a master key by initialization, generate an attribute key according to the spatiotemporal attributes, the master key and the public parameters provided by the data user, and send the attribute key to the data user; The data owner is used to construct an access policy based on spatiotemporal attributes for the user's carbon emission data, obtain the public parameters from the attribute authorization agency, encrypt the user's carbon emission data through the public parameters and the access policy, obtain the user's carbon emission ciphertext data and the encapsulation key, and upload the user's carbon emission ciphertext data and the encapsulation key to the blockchain network; The blockchain network is used to encrypt the user carbon emission ciphertext data using the encapsulation key to obtain the encrypted user carbon emission ciphertext data; A data user is used to obtain the encrypted user carbon emission ciphertext data by accessing the blockchain network, and decrypt the encrypted user carbon emission ciphertext data according to the attribute key.

Images