Attribute-based searchable encrypted power grid data sharing method and system

Abstract

The invention discloses an attribute-based searchable encrypted power grid data sharing method and system, and the method comprises the steps: a data provider requests a private key and inputs metadata information, a key generation center receives the request of the data provider, determines the return condition of the private key to the data provider according to an access control strategy, and stores the return condition of the private key to the data provider; the encrypted data is uploaded to a block chain system; the data consumer requests the block chain system to retrieve target data, and the key generation center judges the access authority of the data consumer according to the access control strategy; if access is authorized, the data consumer decrypts and checks the target data by using the private key; and when the unauthorized party retrieves the data, the key generation center forbids the access of the unauthorized party according to the access control strategy, and if the retrieval fails, the unauthorized party cannot check the encrypted data. According to the method, developers and users are allowed to apply, so that ciphertext retrieval and fine-grained access control of power grid data are realized, and meanwhile, a user attribute revocation mechanism and multi-keyword searchable encryption are supported.

Description

Technical Field

[0001] The present invention relates to the technical field of computer applications, and in particular to a method and system for sharing attribute-based searchable and encrypted power grid data. Background Art

[0002] Power grid data has become a valuable resource with huge commercial and social value due to its huge volume, complex interactivity, real-time update characteristics, wide coverage and high penetration rate. It is not only related to the economy and people's livelihood, but also closely related to many fields such as energy. By sharing power grid data, we can avoid the waste of resources and promote the digital transformation of the power grid. However, the personal information and business information contained in power grid data involve personal privacy protection and commercial secrets protection. Therefore, the security of this information must be ensured during the sharing process to prevent leakage and infringement. In order to protect data privacy, a common method is to encrypt the data and store it on the blockchain. Although this ensures the confidentiality of the data, it also limits the availability of the data. The encrypted data loses its original semantic characteristics, making it difficult for users to retrieve data and difficult to meet the needs of fine-grained access control.

[0003] Searchable encryption is a special encryption technology that allows users to perform search operations on encrypted data without decrypting the data. It solves the problem of ciphertext data retrieval in the above-mentioned power grid data sharing process, ensures the privacy and security of power grid data, and provides efficient indexing services for different data users. According to the different construction primitives, searchable encryption can be divided into symmetric and asymmetric schemes, among which symmetric schemes are favored due to their fast operation speed and high computational efficiency. Searchable encryption technology also supports different types of search functions, such as single keyword, multi-keyword and fuzzy keyword search, as well as different user modes, including one-to-one, many-to-one, one-to-many and many-to-many. In the scenario of power grid data sharing, considering the large volume of data, the large number of users and the different search permissions, it is necessary to study a symmetric searchable encryption scheme that is both secure and efficient. Attribute encryption is an advanced encryption technology that allows access control to data based on the user's attributes or attribute sets. Compared with traditional encryption technology, attribute encryption provides more fine-grained access control, so that the access rights of encrypted data can be customized according to the user's identity, role or other attributes. Attribute encryption technology is divided into two types: Key Policy Attribute Based Encryption (KP-ABE) and Ciphertext Policy Attribute Based Encryption (CP-ABE). CP-ABE embeds the access structure into the ciphertext and the attribute set into the key to ensure that only users who meet specific attribute conditions can decrypt the data, thereby providing flexible data access control. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed.

[0006] Therefore, the present invention provides an attribute-based searchable and encrypted power grid data sharing method and system to solve the problems mentioned in the background technology.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides an attribute-based searchable encrypted power grid data sharing method, comprising: a data provider requests a private key and inputs metadata information, a key generation center receives the request of the data provider, and determines the return of the private key to the data provider according to an access control policy; if the return is allowed, the data provider performs searchable encryption on the data according to the private key, and uploads the encrypted data to a blockchain system;

[0009] The data consumer requests the blockchain system to retrieve the target data, and the key generation center determines the access rights of the data consumer according to the access control policy; if the access is authorized, the data consumer uses the private key to decrypt and view the target data;

[0010] When an unauthorized party attempts to retrieve data, the key generation center prohibits the unauthorized party from accessing the data according to the access control policy, and the retrieval fails, and the unauthorized party cannot view the encrypted data.

[0011] As a preferred solution of the attribute-based searchable and encrypted power grid data sharing method described in the present invention, it also includes: when the data consumer requests to retrieve the target data from the blockchain system, the data access is controlled by the target data ID, the data consumer ID and the access time.

[0012] As a preferred solution of the attribute-based searchable and encrypted power grid data sharing method of the present invention, the access control strategy of the data provider includes:

[0013] The power grid user randomly selects any symmetric key to encrypt the actual power grid data to obtain ciphertext; the power grid user also selects a multi-keyword set from the power grid data, randomly selects a value for each keyword in the multi-keyword set, and calculates and generates a multi-keyword index ciphertext;

[0014] The power grid user uses a preset access control strategy to encrypt the symmetric key and the file address; the access control strategy includes a matrix, in which the matrix rows are associated with the attribute names, and the elements in the matrix rows represent the attribute values. The encrypted ciphertext is generated by calculating the randomly selected values ​​and using the values ​​to share the symmetric key; the power grid user uploads the encrypted data and related ciphertext to the blockchain for storage;

[0015] The blockchain end randomly selects a value for each attribute group, generates a re-encrypted ciphertext based on the attribute group, and uses the symmetric key in the KEK to encrypt the attribute group key to form the ciphertext header information; after the blockchain stores the data, the smart contract generates the corresponding data information and uploads it to the blockchain. When the nodes in the blockchain reach a consensus, the storage address is returned to confirm that the storage operation is completed.

[0016] As a preferred solution of the attribute-based searchable and encrypted power grid data sharing method described in the present invention, the data information at least includes a hash value, a timestamp and a transaction initiator.

[0017] As a preferred solution of the attribute-based searchable encrypted power grid data sharing method of the present invention, the access control strategy of the data consumer includes:

[0018] The data consumer uses its attribute key and the target search keyword set to generate a search trapdoor, uploads the generated search trapdoor to the blockchain, and calls the search smart contract deployed in the blockchain;

[0019] If the smart contract on the blockchain successfully matches the search trap with the stored multi-keyword index ciphertext, it returns the relevant data to the data consumer and updates the search status to success; if the match fails, it returns an error flag and updates the search status to failure;

[0020] When the data consumer receives the returned relevant data, it obtains the attribute group key corresponding to the attribute name it holds, and uses the attribute group key to update its attribute key; the data consumer selects any value to calculate and generate a conversion key, and sends the conversion key to the blockchain;

[0021] After the blockchain receives the conversion key, if the attributes of the data consumer meet the access policy, a partial decryption algorithm is executed to calculate the partial decrypted ciphertext and return it to the data consumer; after the data consumer receives the partial decrypted ciphertext, it decrypts it to recover the symmetric key and the ciphertext file address, retrieves the required encrypted data in the blockchain according to the ciphertext file address, uses the symmetric key to decrypt the encrypted data, and obtains the plaintext of the power grid data.

[0022] As a preferred solution of the attribute-based searchable encrypted power grid data sharing method of the present invention, the access control strategy for unauthorized parties includes:

[0023] The unauthorized party generates a search trapdoor using the attribute key and the target search keyword set, uploads the generated search trapdoor to the blockchain, and calls the search smart contract deployed in the blockchain;

[0024] The smart contract on the blockchain matches the search trap with the stored multi-keyword index ciphertext. If the keyword match is successful, the unauthorized party does not have the correct attribute key, and the unauthorized party does not meet the attribute conditions of the access control policy. When the smart contract detects that the attributes of the unauthorized party do not comply with the access policy, an error flag is returned and the search status is updated to decryption failure. The unauthorized party cannot restore the original plaintext of the power grid data.

[0025] As a preferred solution of the attribute-based searchable and encrypted power grid data sharing method described in the present invention, the metadata information includes: target data ID, data provider ID, access control policy, data ciphertext and release time.

[0026] In a second aspect, the present invention provides a system for a method for sharing power grid data with attribute-based searchable encryption, comprising:

[0027] The data upload module is used for the data provider to request the private key and input metadata information. The key generation center receives the request from the data provider and determines the return of the private key to the data provider according to the access control policy. If the return is allowed, the data provider performs searchable encryption on the data according to the private key and uploads the encrypted data to the blockchain system.

[0028] The data access module is used for the data consumer to request the blockchain system to retrieve the target data. The key generation center determines the access rights of the data consumer according to the access control policy; if the access is authorized, the data consumer uses the private key to decrypt and view the target data;

[0029] The access prohibition module is used to prohibit the unauthorized party from accessing the encrypted data according to the access control policy when the unauthorized party retrieves the data. The retrieval fails and the unauthorized party cannot view the encrypted data.

[0030] In a third aspect, the present invention provides a computing device, comprising:

[0031] Memory and processor;

[0032] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the attribute-based searchable encrypted power grid data sharing method are implemented.

[0033] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the attribute-based searchable encrypted power grid data sharing method.

[0034] Compared with the prior art, the present invention has the following beneficial effects: the present invention subdivides user attributes into attribute names and attribute values, and adopts a linear secret sharing mechanism to partially hide access policies, thereby enhancing security. In addition, by further constructing a binary tree structure to distribute attribute group keys, not only key management is optimized, but also the dynamic revocation function of user attributes is realized. The present invention also integrates a multi-keyword search function, which significantly improves the efficiency of effective retrieval of encrypted data, making data access more flexible and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0036] Figure 1 A method flow chart of an attribute-based searchable and encrypted power grid data sharing method and system according to an embodiment of the present invention;

[0037] Figure 2 A data sharing schematic diagram of an attribute-based searchable and encrypted power grid data sharing method and system according to an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of a KEK binary tree of an attribute-based searchable encrypted power grid data sharing method and system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0040] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0041] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0042] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0043] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0044] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0045] Example 1

[0046] Reference Figure 1 , is an embodiment of the present invention, which provides an attribute-based searchable encrypted power grid data sharing method, such as Figure 1 As shown, including:

[0047] S100: The data provider requests a private key and inputs metadata information. The key generation center receives the request from the data provider and determines the return of the private key to the data provider according to the access control policy. If the return is allowed, the data provider performs searchable encryption on the data according to the private key and uploads the encrypted data to the blockchain system.

[0048] S2100: The data consumer requests the blockchain system to retrieve the target data. The key generation center determines the data consumer's access rights based on the access control policy. If the access is authorized, the data consumer uses the private key to decrypt and view the target data.

[0049] S300: When an unauthorized party attempts to retrieve data, the key generation center prohibits access to the unauthorized party according to the access control policy, the retrieval fails, and the unauthorized party cannot view the encrypted data.

[0050] It should be noted that the attribute-based searchable encrypted power grid data sharing method provided by this application can realize ciphertext retrieval and fine-grained access control of power grid data from different user perspectives. Specifically, the scheme subdivides user attributes into attribute names and attribute values, and adopts a linear secret sharing mechanism to partially hide the access policy, thereby enhancing security. In addition, by constructing a binary tree structure to distribute attribute group keys, it not only optimizes key management, but also realizes the dynamic revocation function of user attributes. Furthermore, the integration of multi-keyword search functions significantly improves the efficiency of effective retrieval of encrypted data, making data access more flexible and efficient.

[0051] In an embodiment of the present application, it also includes: when the data consumer requests to retrieve target data from the blockchain system, data access is controlled through the target data ID, the data consumer ID and the access time.

[0052] In the embodiment of the present application, the access control strategy of the data provider includes:

[0053] The power grid user randomly selects any symmetric key to encrypt the actual power grid data to obtain ciphertext; the power grid user also selects a multi-keyword set from the power grid data, randomly selects a value for each keyword in the multi-keyword set, and calculates and generates a multi-keyword index ciphertext;

[0054] The power grid user uses a preset access control strategy to encrypt the symmetric key and file address; the access control strategy includes a matrix, in which the matrix rows are associated with the attribute names, and the elements in the matrix rows represent the attribute values. The encrypted ciphertext is generated by calculating the randomly selected values ​​and using the value-sharing symmetric key; the power grid user uploads the encrypted data and related ciphertext to the blockchain for storage;

[0055] On the blockchain side, a value is randomly selected for each attribute group, and a re-encrypted ciphertext is generated based on the attribute group. The attribute group key is encrypted using the symmetric key in the KEK to form the ciphertext header information. After the blockchain stores the data, the smart contract generates the corresponding data information and uploads it to the blockchain. When the nodes in the blockchain reach a consensus, the storage address is returned to confirm that the storage operation is complete.

[0056] Specifically, the data information includes at least a hash value, a timestamp, and a transaction initiator.

[0057] It should be noted that the searchable encryption method in the embodiment of the present application supports the power grid company's search encryption mode for multiple data users, allows control over the searchable scope of different types of users, and supports single keyword and multi-keyword searches.

[0058] It should also be noted that the embodiment of the present application is designed based on ciphertext policy attribute encryption, which implements mandatory access control and solves the problem of timely revocation of user permissions, thereby ensuring the security and flexibility of data sharing.

[0059] In the embodiment of the present application, the access control strategy of the data consumer includes:

[0060] The data consumer uses its attribute key and the target search keyword set to generate a search trapdoor, uploads the generated search trapdoor to the blockchain, and calls the search smart contract deployed in the blockchain;

[0061] If the smart contract on the blockchain successfully matches the search trap with the stored multi-keyword index ciphertext, it returns the relevant data to the data consumer and updates the search status to success; if the match fails, it returns an error flag and updates the search status to failure;

[0062] When the data consumer receives the returned relevant data, it obtains the attribute group key corresponding to the attribute name it holds, and uses the attribute group key to update its attribute key; the data consumer selects any value to calculate and generate a conversion key, and sends the conversion key to the blockchain;

[0063] After the blockchain receives the conversion key, if the attributes of the data consumer meet the access policy, it executes the partial decryption algorithm, calculates the partial decrypted ciphertext, and returns it to the data consumer; after the data consumer receives the partial decrypted ciphertext, it decrypts it to recover the symmetric key and ciphertext file address, retrieves the required encrypted data in the blockchain according to the ciphertext file address, uses the symmetric key to decrypt the encrypted data, and obtains the plaintext of the power grid data.

[0064] In the embodiment of the present application, the access control policy for unauthorized parties includes:

[0065] The unauthorized party generates a search trap using the attribute key and the target search keyword set, uploads the generated search trap to the blockchain, and calls the search smart contract deployed in the blockchain;

[0066] The smart contract on the blockchain matches the search trap with the stored multi-keyword index ciphertext. If the keyword match is successful, the unauthorized party does not have the correct attribute key, and the unauthorized party does not meet the attribute conditions of the access control policy. When the smart contract detects that the attributes of the unauthorized party do not comply with the access policy, an error flag is returned and the search status is updated to decryption failure. The unauthorized party cannot restore the original plaintext of the power grid data.

[0067] It should be noted that since unauthorized data consumers cannot obtain the correct partial decryption ciphertext, they cannot generate a valid conversion key and therefore cannot continue the decryption process. Even if an unauthorized data consumer attempts to generate and send the so-called conversion key, the blockchain will detect that the attributes of the data consumer do not meet the access policy and refuse to execute the partial decryption algorithm, returning an error flag.

[0068] In an embodiment of the present application, the metadata information includes: target data ID, data provider ID, access control policy, data ciphertext and release time.

[0069] Example 2

[0070] Reference Figure 1 to Figure 3 This embodiment further provides an attribute-based searchable and encrypted power grid data sharing system in this embodiment, including:

[0071] The data upload module is used for the data provider to request the private key and input metadata information. The key generation center receives the request from the data provider and determines the return of the private key to the data provider according to the access control policy. If the return is allowed, the data provider will searchably encrypt the data according to the private key and upload the encrypted data to the blockchain system.

[0072] The data access module is used for data consumers to request the blockchain system to retrieve target data. The key generation center determines the data consumer's access rights based on the access control policy. If the access is authorized, the data consumer uses the private key to decrypt and view the target data.

[0073] The access prohibition module is used when an unauthorized party attempts to retrieve data. The key generation center prohibits access to the unauthorized party according to the access control policy, and the retrieval fails, and the unauthorized party cannot view the encrypted data.

[0074] In an optional embodiment, the attribute-based encrypted power grid data sharing system may be searched by performing the following steps:

[0075] The power grid user randomly selects any symmetric key to encrypt the actual power grid data to obtain ciphertext; the power grid user also selects a multi-keyword set from the power grid data, randomly selects a value for each keyword in the multi-keyword set, and calculates and generates a multi-keyword index ciphertext;

[0076] The power grid user uses a preset access control strategy to encrypt the symmetric key and file address; the access control strategy includes a matrix, in which the matrix rows are associated with the attribute names, and the elements in the matrix rows represent the attribute values. The encrypted ciphertext is generated by calculating the randomly selected values ​​and using the value-sharing symmetric key; the power grid user uploads the encrypted data and related ciphertext to the blockchain for storage;

[0077] On the blockchain side, a value is randomly selected for each attribute group, and a re-encrypted ciphertext is generated based on the attribute group. The attribute group key is encrypted using the symmetric key in the KEK to form the ciphertext header information. After the blockchain stores the data, the smart contract generates the corresponding data information and uploads it to the blockchain. When the nodes in the blockchain reach a consensus, the storage address is returned to confirm that the storage operation is complete.

[0078] The data consumer uses its attribute key and the target search keyword set to generate a search trapdoor, uploads the generated search trapdoor to the blockchain, and calls the search smart contract deployed in the blockchain;

[0079] If the smart contract on the blockchain successfully matches the search trap with the stored multi-keyword index ciphertext, it returns the relevant data to the data consumer and updates the search status to success; if the match fails, it returns an error flag and updates the search status to failure;

[0080] When the data consumer receives the returned relevant data, it obtains the attribute group key corresponding to the attribute name it holds, and uses the attribute group key to update its attribute key; the data consumer selects any value to calculate and generate a conversion key, and sends the conversion key to the blockchain;

[0081] After the blockchain receives the conversion key, if the attributes of the data consumer meet the access policy, it executes the partial decryption algorithm, calculates the partial decrypted ciphertext, and returns it to the data consumer; after the data consumer receives the partial decrypted ciphertext, it decrypts it to recover the symmetric key and ciphertext file address, retrieves the required encrypted data in the blockchain according to the ciphertext file address, uses the symmetric key to decrypt the encrypted data, and obtains the plaintext of the power grid data.

[0082] The unauthorized party generates a search trap using the attribute key and the target search keyword set, uploads the generated search trap to the blockchain, and calls the search smart contract deployed in the blockchain;

[0083] The smart contract on the blockchain matches the search trap with the stored multi-keyword index ciphertext. If the keyword match is successful, the unauthorized party does not have the correct attribute key, and the unauthorized party does not meet the attribute conditions of the access control policy. When the smart contract detects that the attributes of the unauthorized party do not comply with the access policy, an error flag is returned and the search status is updated to decryption failure. The unauthorized party cannot restore the original plaintext of the power grid data.

[0084] In an alternative embodiment, the system model is as follows Figure 2As shown in the figure, it includes power grid users, data users, blockchain and data users. The key generation center saves the access control policies submitted by power grid users and allocates private keys to authorized users. Power grid users upload their power grid data to blockchain storage through searchable encryption. Authorized users can retrieve the data they want in the blockchain, while unauthorized users cannot retrieve it.

[0085] In an optional embodiment, attribute-based searchable encrypted power grid data sharing is divided into seven stages: system initialization stage, key generation stage, data encryption stage, re-encryption stage, data retrieval stage, data decryption stage and ciphertext update stage, specifically including ten polynomial time algorithms, namely Setup, ABEKeyGen, KEKeyGen, Encrypt, ReEncrypt, Trapdoor, Search, Transform, PartDecrypt, and Decrypt.

[0086] Specifically, Setup(λ)→(PK, masterKey) is executed by the key generation center. The Setup(λ) algorithm takes the security parameter λ as input and then outputs the system public parameter PK and the system master key masterKey.

[0087] Exemplarily, the key generation center selects a security parameter λ for initialization. Select two repeating cyclic groups G1 and G2 of prime order p, where g is the generator of G1. Given a bilinear pair e:G1×G1→G2 and two hash functions H1:{0,1} * →G1, Calculate each attribute T in the attribute set i =H1(att(i)). The key generation center randomly selects α, β, Calculate e(g,g) respectively α , g β , g μ The key generation center stores the master key masterKey = {α, β} and publishes the system public parameters PK = {G1, G2, p, e, e (g, g) α ,g β ,g μ ,H1,H2,T i =H1(att(i)).

[0088] Specifically, ABEKeyGen(PK, masterKey, S)→sk, the key generation center executes the ABEKeyGen algorithm, takes the system public parameter PK, the master key masterKey and a set of attributes S of the data user u as input, and outputs the attribute key sk of the data user u.

[0089] Exemplarily, the key generation center selects a random number Calculate K = g xβ , K1=g x , K3=g α In addition, the key generation center randomly selects calculate The key generation center sends the attribute key sk to the data user, sk = {S, K, K1, K2, K3, K4, K5, K i}, the key generation center will be each attribute name i corresponding to the attribute group G i Send to the blockchain.

[0090] Specifically, KEKeyGen(u t )→PK t , the blockchain executes the KEKeyGen algorithm and converts the data user u t As input, output path key PK t .

[0091] For example, the blockchain defines a KEK binary tree for all users, and the binary tree assigns a unique leaf node to each user. In the binary tree, each node v j Each stores an independent and random symmetric key, using KEK j A group of KEKs on the path nodes from the leaf node to the root node is defined as the path key. The blockchain assigns each user a path key PK from the KEK tree leaf node to the root node. t The KEK binary tree is as follows: Figure 3 shown.

[0092] Specifically, The power grid user executes the Encrypt algorithm and inputs the system public parameter PK, multi-keyword set W, power grid data m and access strategy Output ciphertext CT and multi-keyword index ciphertext I w .

[0093] For example, the power grid user randomly selects a symmetric key k and encrypts the power grid data m to obtain the ciphertext C=Enc k (m). Upload the ciphertext C to the blockchain for storage and obtain the storage address R returned by the system.

[0094] The power grid user selects a multi-keyword set W from the power grid data, where W contains d keywords. Random Selection calculate Generate multi-keyword index ciphertext

[0095] Grid user access policy Encrypt the symmetric key k and the file address R, where M is a l×n matrix and ρ is a function that maps the M matrix to the attribute name. is the attribute value associated with (M,ρ). The grid user randomly selects a vector v=(s,v2,…,v n ),in Used to share secret values For each i∈[1,l], calculate λ i =M i v, where M i represents the i-th row of the matrix. In addition, for each i∈[1,l], randomly select Calculate C k =ke(g,g) αs , C R =Re(g,g) αs , C η =g s ,

[0096] Ciphertext in Incomplete access policy after deleting the attribute value set.

[0097] Grid users will (CT,I w ) is uploaded to the blockchain for storage.

[0098] Specifically, ReEncrypt(CT,G)→(CT′), the blockchain executes the ReEncrypt algorithm, inputs the ciphertext CT and the attribute group G, and outputs the re-encrypted ciphertext CT′.

[0099] For example, blockchain is used for every G i ∈G, randomly select one Where G is the attribute group corresponding to all attribute names in constructing the ciphertext access policy. Re-encrypt the ciphertext

[0100] For each G i ∈G, the blockchain will select a node in the KEK tree that can cover G i The root node of all users in the i ) represents. This set covers all G i Users in G i Users in the network cannot know the KEK (G i ) in the blockchain. The blockchain uses the collection KEK (G i) in the symmetric key encryption attribute group key θ i , get the ciphertext header information Hdr,

[0101] Blockchain preservation (CT′,I W ,Hdr). After the blockchain stores the relevant data, the deployed smart contract will generate (CT′,I W ,Hdr)’s hash value, timestamp, transaction initiator and other information are uploaded to the blockchain. After all nodes in the blockchain reach a consensus, the transaction ID is returned.

[0102] Specifically, Trapdoor(PK,sk,W′)→(T q ), the power grid user executes the Trapdoor algorithm, inputs the system public parameter PK, the attribute key sk and the access multi-keyword set W′, and outputs the search trapdoor T q .

[0103] Exemplarily, a data user inputs an attribute key sk and a multi-keyword set W′ to generate a search trap. User random selection Calculate Y1 = K q 、Y2=K1 q , Y4=g μ . Search for trapdoor T q ={Y1,Y2,Y3,Y4}.

[0104] Data users will search for trapdoor T q Upload to the blockchain and call the search smart contract deployed in the blockchain.

[0105] Specifically, Search(PK,T q ,I W )→(CT′,Hdr), the blockchain executes the Search algorithm, inputs the system public parameter PK, and searches for the trapdoor T q and multi-keyword index ciphertext I W , output the re-encrypted ciphertext CT′ and ciphertext header information Hdr or ⊥.

[0106] For example, the blockchain will search for the trapdoor T q With multi-keyword index ciphertext I W To match, verify whether the following equation holds: If the equation is verified, the blockchain returns (CT′, Hdr) to the data user, and the smart contract updates the search status to Search = 1. Otherwise, the search fails, the blockchain returns ⊥, and the smart contract updates the search status to Search = 0. The smart contract will record and upload relevant transaction information such as search status, transaction initiator, timestamp, and other information to the blockchain, and return the transaction ID after all nodes in the blockchain reach a consensus.

[0107] Specifically, Transform(PK,sk′,K τ )→(K I ), the data user executes the Transform algorithm, inputting the system public parameter PK, the updated attribute key sk′ and the transformation factor K τ , output (CT′,Hdr) or ⊥.

[0108] For example, when a data user receives (CT′, Hdr), the data user obtains all attribute group keys θ corresponding to the attribute names owned by the data user from Hdr. i . The data user then uses the attribute group key θ i Update the attribute key to get sk′,

[0109] Data users randomly select calculate The data user will generate the conversion key K I Send to blockchain,

[0110] Specifically, PartDecrypt(PK,K I ,CT′)→PCT, the blockchain executes the PartDecrypt algorithm, inputs the system public parameter PK, the conversion key K I And re-encrypt the ciphertext CT′, and output the partially decrypted ciphertext PCT.

[0111] For example, when the blockchain receives the data user's conversion key K I When, according to the access policy in the ciphertext Select whether to perform partial decryption of the ciphertext. If the data user's attributes do not meet the access policy Returns ⊥; otherwise, for The blockchain needs to find a set of coefficients So that∑ i∈I f i M i =(1,0,…,0), then ∑ i∈I f i λ i=s. The blockchain returns the partially decrypted ciphertext PCT to the data user.

[0112] Specifically, Decrypt(sk′,PCT,K τ )→m, the data user executes the Decrypt algorithm, inputting the updated attribute key sk′, the partially decrypted ciphertext PCT and the conversion factor K τ , output power grid data m.

[0113] For example, after receiving the partially decrypted ciphertext PCT returned by the blockchain, the data user respectively decrypts the C R and C k Decrypt and obtain the ciphertext file address R and the symmetric key k. The specific calculation method is as follows:

[0114]

[0115] The data user retrieves the ciphertext of the required data in the blockchain according to the ciphertext file address R, and then uses the symmetric key k to decrypt the ciphertext to obtain the plaintext m of the power grid data.

[0116] When the blockchain receives a membership change notification from the key generation center, the attribute group key θ corresponding to the attribute name i affected by the membership change is i Update. Assume that the attribute group G j Membership changes occur in the blockchain, and the blockchain randomly selects and a new attribute group key θ′ j To update the ciphertext CT′, the attribute group key does not need to be updated. The changed ciphertext is as follows:

[0117]

[0118] In addition, since the membership list of attribute name j is updated, the blockchain is G j Select a new minimum cover set and use the updated KEK (G j ) forms a new header information for the ciphertext CT′,

[0119] The present invention subdivides user attributes into attribute names and attribute values, and adopts a linear secret sharing mechanism to partially hide access policies, thereby enhancing security. In addition, by constructing a binary tree structure to distribute attribute group keys, not only key management is optimized, but also the dynamic revocation function of user attributes is realized. Furthermore, the integration of multi-keyword search function significantly improves the efficiency of effective retrieval of encrypted data, making data access more flexible and efficient.

[0120] This embodiment further provides a computing device, which is applicable to the case of the attribute-based searchable encrypted power grid data sharing method, including:

[0121] A memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the attribute-based searchable encrypted power grid data sharing method proposed in the above embodiment.

[0122] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for sharing power grid data with attribute-based searchable encryption proposed in the above embodiment is implemented.

[0123] The storage medium proposed in this embodiment and the method for sharing power grid data with attribute-based searchable encryption proposed in the above embodiment belong to the same inventive concept. For technical details not described in detail in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0124] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (RandomAccess Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0125] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for sharing power grid data with attribute-based searchable encryption, characterized in that: include: The data provider requests a private key and inputs metadata information. The key generation center receives the request from the data provider and determines the return of the private key to the data provider according to the access control policy. If the return is allowed, the data provider will search and encrypt the data according to the private key and upload the encrypted data to the blockchain system; The data consumer requests the blockchain system to retrieve the target data, and the key generation center determines the access rights of the data consumer according to the access control policy; If access is authorized, the data consumer uses the private key to decrypt and view the target data; When an unauthorized party attempts to retrieve data, the key generation center prohibits the unauthorized party from accessing the data according to the access control policy, and the retrieval fails, and the unauthorized party cannot view the encrypted data.

2. The attribute-based searchable and encrypted power grid data sharing method according to claim 1, characterized in that: Also includes: When the data consumer requests to retrieve the target data from the blockchain system, the data access is controlled by the target data ID, the data consumer ID and the access time.

3. The attribute-based searchable and encrypted power grid data sharing method according to claim 2, characterized in that: The access control policies of data providers include: The power grid user randomly selects any symmetric key to encrypt the actual power grid data to obtain ciphertext; the power grid user also selects a multi-keyword set from the power grid data, randomly selects a value for each keyword in the multi-keyword set, and calculates and generates a multi-keyword index ciphertext; The power grid user uses a preset access control strategy to encrypt the symmetric key and the file address; the access control strategy includes a matrix, in which the matrix rows are associated with the attribute names, and the elements in the matrix rows represent the attribute values. The encrypted ciphertext is generated by calculating the randomly selected values ​​and using the values ​​to share the symmetric key; the power grid user uploads the encrypted data and related ciphertext to the blockchain for storage; The blockchain end randomly selects a value for each attribute group, generates a re-encrypted ciphertext based on the attribute group, and uses the symmetric key in the KEK to encrypt the attribute group key to form the ciphertext header information; after the blockchain stores the data, the smart contract generates the corresponding data information and uploads it to the blockchain. When the nodes in the blockchain reach a consensus, the storage address is returned to confirm that the storage operation is completed.

4. The attribute-based searchable and encrypted power grid data sharing method according to claim 3, characterized in that: The data information includes at least a hash value, a timestamp, and the transaction initiator.

5. The attribute-based searchable and encrypted power grid data sharing method according to claim 4, characterized in that: The access control policies for data consumers include: The data consumer uses its attribute key and the target search keyword set to generate a search trapdoor, uploads the generated search trapdoor to the blockchain, and calls the search smart contract deployed in the blockchain; If the smart contract on the blockchain successfully matches the search trap with the stored multi-keyword index ciphertext, it returns the relevant data to the data consumer and updates the search status to success; if the match fails, it returns an error flag and updates the search status to failure; When the data consumer receives the returned relevant data, it obtains the attribute group key corresponding to the attribute name it holds, and uses the attribute group key to update its attribute key; the data consumer selects any value to calculate and generate a conversion key, and sends the conversion key to the blockchain; After the blockchain receives the conversion key, if the attributes of the data consumer meet the access policy, a partial decryption algorithm is executed to calculate the partial decrypted ciphertext and return it to the data consumer; after the data consumer receives the partial decrypted ciphertext, it decrypts it to recover the symmetric key and the ciphertext file address, retrieves the required encrypted data in the blockchain according to the ciphertext file address, uses the symmetric key to decrypt the encrypted data, and obtains the plaintext of the power grid data.

6. The attribute-based searchable and encrypted power grid data sharing method according to claim 5, characterized in that: Access control policies for unauthorized parties include: The unauthorized party generates a search trapdoor using the attribute key and the target search keyword set, uploads the generated search trapdoor to the blockchain, and calls the search smart contract deployed in the blockchain; The smart contract on the blockchain matches the search trap with the stored multi-keyword index ciphertext. If the keyword match is successful, the unauthorized party does not have the correct attribute key, and the unauthorized party does not meet the attribute conditions of the access control policy. When the smart contract detects that the attributes of the unauthorized party do not comply with the access policy, an error flag is returned and the search status is updated to decryption failure. The unauthorized party cannot restore the original plaintext of the power grid data.

7. The attribute-based searchable and encrypted power grid data sharing method according to claim 1 or 6, characterized in that: Metadata information includes: target data ID, data provider ID, access control policy, data ciphertext and release time.

8. A system using the attribute-based searchable encrypted power grid data sharing method as claimed in claim 1, characterized in that: include: The data upload module is used for the data provider to request the private key and input metadata information. The key generation center receives the request from the data provider and determines the return of the private key to the data provider according to the access control policy; If the return is allowed, the data provider will search and encrypt the data according to the private key and upload the encrypted data to the blockchain system; A data access module, used for the data consumer to request the blockchain system to retrieve target data, and the key generation center determines the access rights of the data consumer according to the access control policy; If access is authorized, the data consumer uses the private key to decrypt and view the target data; The access prohibition module is used to prohibit the unauthorized party from accessing the encrypted data according to the access control policy when the unauthorized party retrieves the data. The retrieval fails and the unauthorized party cannot view the encrypted data.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the attribute-based searchable encrypted power grid data sharing method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the attribute-based searchable encrypted power grid data sharing method according to any one of claims 1 to 7.

Images