Auditing method, device, equipment and system based on hidden query

Abstract

The invention provides an auditing method, device, equipment and system based on hidden query. In the method, an audit log is obtained, the audit log comprises encrypted first hidden query information, and the encrypted first hidden query information is obtained by encrypting a public key in an audit key pair; acquiring public key information of the public key from the smart contract on the block chain; based on a private key in an audit key pair corresponding to the public key information, decrypting the encrypted first hidden query information to obtain decrypted first hidden query information; auditing based on the decrypted first hidden query information to obtain an auditing result; and recording the auditing result into an auditing action log, and performing uplink storage on the auditing action log through the intelligent contract. According to the method, the audit of the hidden query is realized in combination with the block chain technology, the information on the block chain can be permanently stored, the source tracing of the hidden query can be ensured, and the effective supervision of the audit behavior is realized.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to an audit method, device, equipment and system based on hidden query. Background Art

[0002] With the massive generation and processing of data, data storage and protection have become particularly important. In order to protect data privacy and security, various technologies have been developed and improved. Among them, the private information retrieval (PIR) technology has become mature. This technology enables the query party to query data from the data provider without exposing the content of the query. At present, it is also necessary to conduct corresponding audits on private queries in order to facilitate the supervision of private queries.

[0003] In the existing technology, the storage of audit logs and query records relies on centralized storage solutions. This storage method may cause the loss of important data in the face of hardware failure, system crash or other unexpected situations, thus affecting the reliability and durability of data, and making it difficult to achieve effective supervision of audit behavior. Summary of the invention

[0004] In view of this, the purpose of this application is to provide an audit method, device, equipment and system based on hidden query, combining blockchain technology to realize the audit of hidden query. The information on the blockchain can be permanently preserved, which can ensure the traceability of hidden query and realize effective supervision of audit behavior.

[0005] To achieve the above objectives, the present application discloses the following technical solutions:

[0006] In a first aspect, the present application provides an audit method based on hidden query, comprising:

[0007] Acquire an audit log, wherein the audit log includes encrypted first concealed query information, wherein the encrypted first concealed query information is encrypted based on a public key in an audit key pair;

[0008] Obtain public key information of the public key from a smart contract on the blockchain;

[0009] Decrypting the encrypted first concealed query information based on a private key in the audit key pair corresponding to the public key information to obtain the decrypted first concealed query information;

[0010] Performing an audit based on the decrypted first concealed query information to obtain an audit result;

[0011] The audit results are recorded in the audit action log, and the audit action log is stored on the chain through the smart contract.

[0012] Optionally, the method further includes:

[0013] In a trusted execution environment, an audit key pair is generated using an asymmetric encryption algorithm, wherein the audit key pair includes a public key and a private key;

[0014] Save the private key;

[0015] The public key is stored on the blockchain through a smart contract.

[0016] Optionally, the method further includes:

[0017] Splitting the private key using a threshold secret sharing algorithm to obtain at least a first private key component, a second private key component, and a third private key component;

[0018] Then the storing of the private key includes: storing the first private key component, the second private key component and the third private key component to different storage locations respectively;

[0019] The decrypting the encrypted first concealed query information based on a private key in an audit key pair corresponding to the public key information includes:

[0020] The encrypted first hidden query information is decrypted based on at least two of the first private key component, the second private key component, and the third private key component.

[0021] Optionally, the method further includes:

[0022] If the key update condition is met, the audit key pair is updated. The key update condition includes any one or more of the following:

[0023] When the preset key update time is reached, one of the first private key component, the second private key component and the third private key component is lost, and the private key is leaked.

[0024] Optionally, updating the audit key pair includes:

[0025] In a trusted execution environment, an asymmetric encryption algorithm is used to generate an update audit key pair;

[0026] Based on the updated audit key pair, encrypt the decrypted first concealed query information to obtain newly encrypted first concealed query information;

[0027] Based on the updated audit key, the public key information in the smart contract is updated.

[0028] Optionally, the performing an audit based on the decrypted first concealed query information to obtain an audit result includes:

[0029] Obtaining second hidden query information from the blockchain, where the second hidden query information is obtained by executing a hidden query task;

[0030] An audit is performed based on the second concealed query information and the decrypted first concealed query information to obtain an audit result.

[0031] Optionally, the first hidden query information includes one or more of the following: hidden query parameters, hidden query results, a first hash value corresponding to the hidden query parameters, a second hash value corresponding to the hidden query result, an initiator of the hidden query, a data source owner, and a timestamp.

[0032] In a second aspect, the present application provides an audit device based on hidden query, comprising:

[0033] An acquisition unit, configured to acquire an audit log, wherein the audit log includes encrypted first concealed query information, wherein the encrypted first concealed query information is encrypted based on a public key in an audit key pair;

[0034] The acquisition unit is further used to obtain the public key information of the public key from the smart contract on the blockchain;

[0035] a decryption unit, configured to decrypt the encrypted first concealed query information based on a private key in an audit key pair corresponding to the public key information, to obtain the decrypted first concealed query information;

[0036] an audit unit, configured to perform an audit based on the decrypted first concealed query information to obtain an audit result;

[0037] The on-chain unit is used to record the audit results in the audit action log, and store the audit action log on-chain through the smart contract.

[0038] In a third aspect, the present application provides an audit device based on hidden query, comprising:

[0039] Memory for storing computer programs;

[0040] A processor is used to execute the computer program stored in the memory to implement the steps of the hidden query-based audit method provided in the first aspect.

[0041] In a fourth aspect, the present application provides an audit system based on hidden query, including: a hidden query service device and an audit service device;

[0042] The hidden query service device is used to execute the hidden query task, obtain the second hidden query information and the encrypted first hidden query information, and upload the second hidden query information to the blockchain through the smart contract of the blockchain;

[0043] The audit service device is used to execute the steps of the hidden query-based audit method as described in the first aspect.

[0044] The present application provides an audit method, device, equipment and system based on hidden query. In the method, an audit log is obtained, the audit log includes encrypted first hidden query information, the encrypted first hidden query information is encrypted based on the public key in the audit key pair; the public key information of the public key from the smart contract on the blockchain; based on the private key in the audit key pair corresponding to the public key information, the encrypted first hidden query information is decrypted to obtain the decrypted first hidden query information; based on the decrypted first hidden query information, an audit is performed to obtain an audit result; the audit result is recorded in the audit action log, and the audit action log is stored on the chain through the smart contract. The above method combines blockchain technology to realize the audit of hidden queries. The information on the blockchain can be permanently preserved, which can ensure the traceability of hidden queries and realize effective supervision of audit behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0046] Figure 1 It is a flowchart of an audit method based on hidden query provided by an embodiment of the present application;

[0047] Figure 2 It is a schematic diagram of the structure of an audit system based on hidden query provided in an embodiment of the present application;

[0048] Figure 3 It is a schematic diagram of another audit system structure based on hidden query provided in an embodiment of the present application;

[0049] Figure 4 It is a flowchart of another audit method based on hidden query provided by an embodiment of the present application;

[0050] Figure 5 It is a structural diagram of an audit device based on hidden query provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] To facilitate understanding of the technical solution provided by the present application, an audit method based on hidden query provided by the present application will be described below in conjunction with the accompanying drawings.

[0053] See also Figure 1 , which is a flow chart of an audit method based on hidden query provided by an embodiment of the present application, such as Figure 1 As shown, the method includes S101-S105.

[0054] This application does not limit the specific application of this method. As an example, Figure 2 As shown, Figure 2 A schematic diagram of the structure of an audit system based on hidden query provided by this application; the audit method based on hidden query can be applied to Figure 2 In the audit system shown, the system includes an audit service device and a hidden query service device.

[0055] S101: Acquire an audit log, where the audit log includes encrypted first concealed query information, where the encrypted first concealed query information is encrypted based on a public key in an audit key pair.

[0056] In the embodiment of the present application, it is necessary to audit the audit log, and the audit log includes the first hidden query information. It can be understood that the hidden query service device in the present application can pre-execute the hidden query task, encrypt the first hidden query information obtained during the execution of the hidden query task and save it to the audit service device, that is, the audit log can include the data of the hidden execution of the hidden query task, so that the embodiment of the present application can obtain the audit log for auditing.

[0057] The present application does not limit the specific content of the first hidden query information. As an example, the first hidden query information includes one or more of the following: hidden query parameters, hidden query results, a first hash value corresponding to the hidden query parameters, a second hash value corresponding to the hidden query result, the initiator of the hidden query, the data source owner, and the hidden query timestamp.

[0058] It is understandable that the hidden query parameter refers to the parameter input by the initiator of the hidden query for executing the hidden query, which may include a query keyword. The initiator of the hidden query enters the hidden query parameter to query the data source owner for data. The hidden query result may include relevant results queried based on the query keyword. The hidden query timestamp includes the time information of each node in the process of executing the hidden query task. The first hash value refers to the value obtained by encrypting the hidden query parameter through the hash algorithm, and the second hash value refers to the value obtained by encrypting the hidden query result through the hash algorithm.

[0059] In the embodiment of the present application, the audit content covers user query parameters and query results to provide comprehensive audit information, ensure the completeness and accuracy of the audit results, and avoid misunderstandings due to insufficient information.

[0060] S102: Obtain public key information of a public key from a smart contract on the blockchain.

[0061] In an embodiment of the present application, an audit key pair can be generated in advance, and the public key in the audit key pair can be uploaded to the chain through a smart contract on the blockchain, so that the public key information of the public key can be obtained from the smart contract on the blockchain. The present application does not limit the specific method of generating an audit key pair. As an example, the present application can generate an audit key pair using an asymmetric encryption algorithm in a trusted execution environment. The audit key pair includes a public key and a private key, and the private key is saved. The public key is uploaded to the chain through a smart contract on the blockchain, so that the public key information can be obtained from the blockchain. As an example, the present application can save the private key to the audit service device.

[0062] The present application does not limit the specific content of the asymmetric encryption algorithm. As an example, the asymmetric encryption algorithm may be an RSA algorithm or an SM2 algorithm. By generating an audit key pair in a trusted execution environment, the security of the first hidden query information is further guaranteed.

[0063] S103: Decrypt the encrypted first concealed query information based on the private key in the audit key pair corresponding to the public key information to obtain the decrypted first concealed query information.

[0064] It can be understood that after the present application pre-generates the audit key pair, the private key will be saved and the public key will be put on the chain, so that after obtaining the public key information from the blockchain, the corresponding private key can be determined based on the public key information, and the encrypted first hidden query information can be decrypted by the private key to obtain the decrypted first hidden query information.

[0065] S104: Perform an audit based on the decrypted first hidden query information to obtain an audit result.

[0066] This application does not limit the specific method of performing an audit based on the decrypted first hidden query information to obtain the audit result. As an example, performing an audit based on the decrypted first hidden query information to obtain the audit result includes the following steps A1-A2:

[0067] A1: Obtain the second hidden query information from the blockchain. The second hidden query information is obtained by executing the hidden query task.

[0068] It is understandable that the second hidden query information is also obtained in the process of performing the hidden query task. While encrypting the first hidden query information obtained in the process of performing the hidden query task and saving it to the audit service device, the present application will also upload the second hidden query information that does not expose the specific data of the hidden query to the chain. It is understandable that the specific data of the hidden query refers to the hidden query parameters in plain text and the hidden query results in plain text. The present application does not limit the specific content of the second hidden query information. As an example, the second hidden query information may include any one or more of the following: the first hash value corresponding to the hidden query parameter, the second hash value corresponding to the hidden query result, and the hidden query timestamp.

[0069] A2: Perform an audit based on the second hidden query information and the decrypted first hidden query information to obtain an audit result.

[0070] This application compares the second hidden query information with the decrypted first hidden query information. If the two data are consistent, it means that the first hidden query information has not been lost or tampered with, indicating that the first hidden query information is safe and reliable. If the two data are inconsistent, it means that the first hidden query information has been lost or tampered with, indicating that the first hidden query information is unsafe and unreliable, and it is recorded in the audit results. That is, the audit results can include information on whether the first hidden query information has been lost or tampered with.

[0071] As a possible implementation method, the present application does not directly use the first hash value and the second hash value in the decrypted first hidden query information for verification. The present application can perform the same hash calculation on the hidden query parameters and the hidden query results in the decrypted first hidden query information to obtain the third hash value corresponding to the hidden query parameters after the hash calculation, and the fourth hash value corresponding to the hidden query result. If the first hash value in the second hidden query information matches the third hash value, and / or the second hash value in the second hidden query information matches the fourth hash value, it is confirmed that the plaintext query parameters and the plaintext query results in the first hidden query information are correct and complete.

[0072] S105: Record the audit results in the audit action log, and store the audit log on the chain through the smart contract.

[0073] In the embodiment of the present application, after the audit is completed, the audit results can be recorded in the audit action log, and the audit action log can be uploaded and stored through the smart contract of the blockchain. It can be understood that the audit action log is used to record the audit behavior of the auditor. This application does not limit the specific content of the audit action log. As an example, the audit action log can also include information such as the auditor, the initiator of the hidden query, the data source owner, and the audit timestamp.

[0074] It can be seen that the above method combines blockchain technology to realize the audit of hidden queries. The information on the blockchain can be permanently stored, which can ensure the traceability of hidden queries. The relevant data of any hidden query task can be obtained through the blockchain, so that if a problem is found during the audit, the responsible party can be quickly located. In addition, this application can ensure the transparency and traceability of audit activities by also putting the audit results on the chain, prevent malicious audit behavior, and reduce security risks in the audit process.

[0075] In addition, when auditing the audit logs, the auditor verifies the integrity and accuracy of the audit logs in the off-chain database by obtaining the second hidden query information stored on the chain, and can quickly identify whether the audit logs in the off-chain database have been tampered with or lost.

[0076] As a possible implementation method, the present application provides an audit method based on hidden query, which also includes: splitting the private key through a threshold secret sharing algorithm to obtain at least a first private key component, a second private key component and a third private key component.

[0077] The present application does not limit the specific content of the threshold secret sharing algorithm. As an example, the threshold secret sharing algorithm includes the Shamir algorithm. The present application can divide the private key into n parts, and set t private key components to recover the private key, where n is greater than or equal to 3, and t is greater than or equal to 2. By dividing the private key, at least a first private key component, a second private key component, and a third private key component can be obtained.

[0078] The private key is then saved, including: saving the first private key component, the second private key component and the third private key component to different storage locations respectively.

[0079] In the embodiment of the present application, the split first private key component, the second private key component and the third private key component are saved to different storage locations respectively. The present application does not limit the specific location of the storage. As an example, the present application can save two key components to the audit service device, that is, the auditor, save the first private key component to the auditor's local database for storage, store the second private key component in the auditor's backup database, and send the third private key component to the super administrator of the audit system based on hidden query for storage. By saving separately, the simultaneous loss of private key components can be effectively avoided, thereby improving data security.

[0080] The encrypted first concealed query information is decrypted based on the private key in the audit key pair corresponding to the public key information, including: decrypting the encrypted first concealed query information based on at least two of the first private key component, the second private key component and the third private key component.

[0081] It is understandable that the present application requires at least two of the three private key components to be combined in order to recover the private key, thereby decrypting with the private key. As an example, the present application may preferentially use the first private key component saved in the local database of the auditor and the second private key component saved in the backup database for combination. If the first private key component or the second private key component is lost, the super administrator is requested to obtain the third key component.

[0082] By splitting the private key through the threshold secret sharing algorithm, a comprehensive security management and backup strategy is provided for the auditor's key to ensure the security of the key, prevent the loss or leakage of the key, and ensure the effectiveness of the audit and the security of the system.

[0083] As a possible implementation method, the present application provides an audit method based on , which also includes: if the key update condition is met, the audit key pair is updated, and the key update condition includes any one or more of the following: reaching the preset key update time, one of the first private key component, the second private key component and the third private key component is lost, and the private key is leaked.

[0084] In an embodiment of the present application, a preset key update time can be set in advance, and the audit key pair will be updated when the preset key update time is reached. The present application does not limit the specific duration of the preset key update time. As an example, the preset key update time can be one week or one month. For example, it can be set to update the original audit key pair every Monday or the 1st of each month.

[0085] In the embodiment of the present application, when a private key component is lost or a private key is leaked, the audit key pair will also be updated to protect the first hidden query information and improve the security of the data.

[0086] The present application does not limit the specific method of updating the audit key pair. As an example, updating the audit key pair includes the following steps:

[0087] B1: In a trusted execution environment, use an asymmetric encryption algorithm to generate an update audit key pair.

[0088] The present application does not limit the specific content of the asymmetric encryption algorithm. As an example, the asymmetric encryption algorithm may be RSA or SM2. The audit key pair is also generated and updated in the trusted execution environment to ensure data security.

[0089] B2: Based on the updated audit key pair, an encryption operation is performed on the decrypted first concealed query information to obtain newly encrypted first concealed query information.

[0090] B3: Based on the updated audit key pair, the public key information in the smart contract is updated.

[0091] In the embodiment of the present application, the public key in the updated audit key pair can be used to re-encrypt the decrypted first hidden query information to obtain the newly encrypted first hidden query information. The public key in the updated audit key pair is uploaded to the blockchain through the smart contract of the blockchain, thereby replacing the original public key based on the public key in the updated audit key pair, thereby updating the public key information. As an example, in the embodiment of the present application, the audit public key update event is also saved on the blockchain.

[0092] By updating the audit key pair in the above manner, the first hidden query information can be better protected and data security can be improved.

[0093] See also Figure 3 , Figure 3 Another schematic diagram of the structure of an audit system based on hidden query provided in the embodiment of the present application is shown below in combination with Figure 3 The solution of this application is further described.

[0094] It is understandable that the hidden query service device described above may include Figure 3 The audit service device described above may include: Figure 3The audit service component in the system. The hidden query client component and the hidden query server component can process encrypted queries in the trusted execution environment (TEE) to ensure that the query intention of the user is not disclosed when querying sensitive data, while ensuring the privacy and security of the data. The blockchain component provides data integrity and operation transparency for the system by recording data query and audit operations on an unalterable distributed ledger, ensuring the reliability of data storage and access history. The key management component is responsible for securely generating, storing, distributing and revoking encryption keys, using secret sharing technology to prevent key leakage, and ensuring the security of the data encryption and decryption process. The audit service component is used to monitor and record data access and operations, ensure the compliance of data use by implementing a comprehensive audit strategy, and provide integrity and tamper-proof verification of the audit log. The key management component is responsible for securely generating, storing, distributing and revoking encryption keys, using secret sharing technology to prevent key leakage, and ensuring the security of the data encryption and decryption process.

[0095] In an embodiment of the present application, the audit service component can pre-generate an audit key pair, and upload the public key in the audit key pair to the chain through a smart contract on the blockchain. The method of generating an audit key pair is the same as above and will not be repeated here. After the audit key pair is generated, the private key will be divided through a threshold secret sharing algorithm. Here, the private key is divided according to t=2, n=3. n represents the division into 3 private key components, and t represents that at least 2 key components must be combined to restore the original private key. The two private key components are distributed to the audit service component, one of which is sent to the trusted execution environment of the audit service component for storage, and the other is stored by the auditor as a backup. One copy is sent to the system super administrator for storage. The public key in the audit key pair is uploaded to the chain through a smart contract on the blockchain.

[0096] The process of creating a hidden query task is as follows:

[0097] C1: The data user selects the specified data source in the system, sets the query parameters, and initiates the hidden query task.

[0098] C2: The user's query parameters are transmitted to the hidden query service client of the local trusted execution environment through the front end, and the hidden query service client encrypts the query parameters.

[0099] C21: Get the latest public key from the smart contract on the blockchain, use the public key to encrypt the query parameters of the data user, and store the encrypted data in the audit data storage outside the trusted execution environment. At the same time, use the hash algorithm to hash the original data of the query parameters to obtain the hash value, and store the hash value of the original data of the query parameters on the chain through the smart contract on the blockchain.

[0100] C22: Encrypt the query parameters using a homomorphic encryption algorithm, and then send them to the hidden query service server in the trusted execution environment of the data source owner for hidden query. It can be understood that step C21 and step C22 can be executed in parallel.

[0101] The process of executing the hidden query task is as follows:

[0102] D1: The hidden query service server of the data source owner receives the hidden query request, and the data source owner reviews and approves whether to allow the query. If the query is not allowed, the hidden query task is closed. If the query is allowed, proceed to the next step.

[0103] D2: The hidden query service server executes the hidden query, and the server processes the query in a trusted execution environment. If it is homomorphic encryption, the server will calculate the encrypted query vector and the database. As an example, the calculation method may include inner product calculation to obtain the encrypted query result and return it to the hidden query service client of the data user.

[0104] D3: After receiving the encrypted query result, the data user's hidden query service client decrypts it, obtains the plain text of the query result, and returns it to the data user's front end for display.

[0105] D4: The hidden query service client of the data user uses the audit public key to encrypt the plain text of the query result and save it in the audit data storage. It can be understood that the data saved in the audit data storage is referred to as the first hidden query information above. The plain text of the query result is hashed using a hash algorithm to obtain a hash value.

[0106] D5: The hash value, the initiator of the hidden query task, the data source owner, the timestamp and other information are stored on the chain through the smart contract on the blockchain. It can be understood that the information stored on the chain is referred to as the second hidden query information above.

[0107] After executing the hidden query task, the audit service component can audit the data in the audit data storage based on the data stored on the blockchain, obtain the audit results, record the audit results in the audit log, and store the audit log on the chain through the smart contract.

[0108] The above method has the following effects:

[0109] Ensure the integrity and immutability of audit logs: By adopting decentralized storage solutions and blockchain technology, the data integrity and immutability of audit logs during long-term storage and transmission are ensured, thereby enhancing the reliability of the system and the persistence of data.

[0110] Strengthen the security management of the auditor's keys: Implement secret sharing technology to provide comprehensive security management and backup strategies for the auditor's keys, ensure the security of the keys, prevent key loss or leakage, and ensure the effectiveness of the audit and the security of the system.

[0111] Achieve comprehensive audit content: Expand the audit scope to cover user query parameters and query results, provide comprehensive audit information, ensure the completeness and accuracy of audit results, and avoid misunderstandings due to insufficient information.

[0112] Enhance the supervision of auditing behavior: Use blockchain technology to put records of auditing behavior on the chain to ensure the transparency and traceability of auditing activities. At the same time, implement real-time monitoring and alarm systems to prevent malicious auditing behavior and reduce security risks in the auditing process.

[0113] As a possible implementation, see Figure 4 , Figure 4 Another audit method based on hidden query is provided in an embodiment of the present application. The present application also provides another audit method based on hidden query, and the method includes S201-S202.

[0114] S201: Obtain an audit execution log from the blockchain, where the audit execution log is obtained by executing a hidden query task.

[0115] It is understandable that the process of executing the hidden query task requires the participation of the initiator of the hidden query and the owner of the data source (the executor of the query). In the embodiment of the present application, the initiator can first encrypt the parameters and then send them to the query executor. The query executor does not decrypt the parameters to execute the hidden query task and obtain the encrypted query result. In addition, the query executor can perform hash calculations on the encrypted hidden query parameters and the encrypted hidden query results to obtain the hash value of the encrypted hidden query parameters and the hash value of the encrypted hidden query results.

[0116] The query executor will store the relevant data obtained from the hidden query task as an audit execution log on the chain. The audit execution log may include the query task ID, the initiator of the hidden query, the query executor, the hidden query timestamp, the encrypted hash value of the hidden query parameters, and the encrypted hash value of the hidden query results.

[0117] S202: Based on the audit execution log, determine whether there is third hidden query information corresponding to the audit execution log on the blockchain, and obtain the audit result.

[0118] In an embodiment of the present application, the auditor can obtain the audit execution log of the query executor from the blockchain during the audit, and based on the audit execution log, check whether there is corresponding third hidden query information on the chain. It can be understood that the third hidden query information is equivalent to the second hidden query information that needs to be uploaded to the chain as recorded above, and its specific data is the same as the second hidden query information, which will not be repeated here. If there is third hidden query information corresponding to the audit execution log, it means that the query initiator has uploaded the third hidden query information, that is, the audit result includes whether the query initiator has uploaded the third hidden query information, which can effectively avoid the problem of the query initiator deliberately not providing or uploading the third hidden query information.

[0119] See also Figure 5 , Figure 5 It is a structural diagram of an audit device based on hidden query provided in an embodiment of the present application, and the device includes: an acquisition unit 501, a decryption unit 502, an audit unit 503, and a chain unit 504.

[0120] An acquisition unit 501 is used to acquire an audit log, where the audit log includes encrypted first hidden query information, where the encrypted first hidden query information is encrypted based on a public key in an audit key pair;

[0121] The acquisition unit is further used to obtain the public key information of the public key from the smart contract on the blockchain;

[0122] A decryption unit 502 is used to decrypt the encrypted first hidden query information based on a private key in the audit key pair corresponding to the public key information to obtain the decrypted first hidden query information;

[0123] An audit unit 503, configured to perform an audit based on the decrypted first hidden query information to obtain an audit result;

[0124] The on-chain unit 504 is used to record the audit results in the audit action log, and store the audit action log on-chain through the smart contract.

[0125] The above-mentioned device combines blockchain technology to realize the audit of hidden queries. The information on the blockchain can be permanently preserved, which can ensure the traceability of hidden queries and realize effective supervision of auditing behavior.

[0126] As a possible implementation manner, the device further includes:

[0127] The generating unit is used to generate an audit key pair using an asymmetric encryption algorithm in a trusted execution environment, wherein the audit key pair includes a public key and a private key.

[0128] A storage unit is used to store the private key.

[0129] The on-chain unit 504 is also used to store the public key on-chain through a smart contract on the blockchain.

[0130] As a possible implementation manner, the device further includes:

[0131] The threshold secret sharing unit is used to divide the private key through a threshold secret sharing algorithm to obtain at least a first private key component, a second private key component and a third private key component.

[0132] The storage unit is specifically configured to store the first private key component, the second private key component and the third private key component in different storage locations respectively.

[0133] The decryption unit 502 is specifically configured to decrypt the encrypted first hidden query information based on at least two of the first private key component, the second private key component and the third private key component.

[0134] As a possible implementation manner, the device further includes:

[0135] An updating unit is used to update the audit key pair if a key update condition is met, and the key update condition includes any one or more of the following: reaching a preset key update time, one of the first private key component, the second private key component and the third private key component is lost, and the private key is leaked.

[0136] As a possible implementation, the update unit is specifically used to generate an update audit key pair using an asymmetric encryption algorithm in a trusted execution environment;

[0137] Based on the updated audit key pair, encrypt the decrypted first concealed query information to obtain newly encrypted first concealed query information;

[0138] Based on the updated audit key, the public key information in the smart contract is updated.

[0139] As a possible implementation manner, the audit unit is specifically used to: obtain second hidden query information from the blockchain, where the second hidden query information is obtained by executing a hidden query task;

[0140] An audit is performed based on the second concealed query information and the decrypted first concealed query information to obtain an audit result.

[0141] As a possible implementation manner, the first hidden query information includes one or more of the following: hidden query parameters, hidden query results, a first hash value corresponding to the hidden query parameters, a second hash value corresponding to the hidden query result, an initiator of the hidden query, a data source owner, and a hidden query timestamp.

[0142] The present application also provides an audit device based on hidden query, which may include a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps provided in the above embodiment may be implemented. Of course, the terminal may also include various network interfaces, power supplies and other components.

[0143] It should be noted that the hidden query-based audit device provided in the embodiment of the present application has the technical effects of any of the above embodiments, and the embodiment of the present application will not be described in detail here.

[0144] The present application also provides an audit system based on hidden query, including a hidden query service device and an audit service device;

[0145] The hidden query service device is used to execute the hidden query task, obtain the second hidden query information and the encrypted first hidden query information, and upload the second hidden query information to the chain through the smart contract.

[0146] The audit service device can implement the steps provided in the above embodiments.

[0147] It should be noted that the hidden query-based audit system provided in the embodiment of the present application has the technical effects of any of the above embodiments, and the embodiment of the present application will not be described in detail here.

[0148] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed, the steps provided in the above embodiment can be implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0149] It should be noted that a computer-readable storage medium provided in an embodiment of the present application has the technical effects of any of the above embodiments, and the embodiments of the present application are not described in detail here.

[0150] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0151] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0152] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. An audit method based on hidden query, characterized in that: The method comprises: Acquire an audit log, wherein the audit log includes encrypted first concealed query information, wherein the encrypted first concealed query information is encrypted based on a public key in an audit key pair; Obtain public key information of the public key from a smart contract on the blockchain; Decrypting the encrypted first concealed query information based on a private key in the audit key pair corresponding to the public key information to obtain the decrypted first concealed query information; Performing an audit based on the decrypted first concealed query information to obtain an audit result; The audit results are recorded in the audit action log, and the audit action log is stored on the chain through the smart contract.

2. The method according to claim 1, characterized in that The method further comprises: In a trusted execution environment, an audit key pair is generated using an asymmetric encryption algorithm, wherein the audit key pair includes a public key and a private key; Save the private key; The public key is stored on the blockchain through a smart contract.

3. The method according to claim 2, characterized in that The method further comprises: Splitting the private key using a threshold secret sharing algorithm to obtain at least a first private key component, a second private key component, and a third private key component; Then the storing of the private key includes: storing the first private key component, the second private key component and the third private key component to different storage locations respectively; The decrypting the encrypted first concealed query information based on a private key in an audit key pair corresponding to the public key information includes: The encrypted first hidden query information is decrypted based on at least two of the first private key component, the second private key component, and the third private key component.

4. The method according to claim 3, characterized in that: The method further comprises: If the key update condition is met, the audit key pair is updated. The key update condition includes any one or more of the following: When the preset key update time is reached, one of the first private key component, the second private key component and the third private key component is lost, and the private key is leaked.

5. The method according to claim 4, characterized in that The updating of the audit key pair includes: In a trusted execution environment, an asymmetric encryption algorithm is used to generate an update audit key pair; Based on the update audit key pair, encrypting the decrypted first concealed query information to obtain newly encrypted first concealed query information; Based on the updated audit key, the public key information in the smart contract is updated.

6. The method according to claim 1, characterized in that The auditing based on the decrypted first concealed query information to obtain an audit result includes: Obtaining second hidden query information from the blockchain, where the second hidden query information is obtained by executing a hidden query task; An audit is performed based on the second concealed query information and the decrypted first concealed query information to obtain an audit result.

7. The method according to any one of claims 1 to 6, characterized in that: The first hidden query information includes one or more of the following: hidden query parameters, hidden query results, a first hash value corresponding to the hidden query parameters, a second hash value corresponding to the hidden query results, an initiator of the hidden query, a data source owner, and a hidden query timestamp.

8. An audit device based on hidden query, characterized in that: The device comprises: An acquisition unit, configured to acquire an audit log, wherein the audit log includes encrypted first concealed query information, wherein the encrypted first concealed query information is encrypted based on a public key in an audit key pair; The acquisition unit is further used to obtain the public key information of the public key from the smart contract on the blockchain; a decryption unit, configured to decrypt the encrypted first concealed query information based on a private key in an audit key pair corresponding to the public key information, to obtain the decrypted first concealed query information; an audit unit, configured to perform an audit based on the decrypted first concealed query information to obtain an audit result; The on-chain unit is used to record the audit results in the audit action log, and store the audit action log on-chain through the smart contract.

9. An audit device based on hidden query, characterized in that: The device comprises: Memory for storing computer programs; A processor, configured to execute the computer program stored in the memory to implement the steps of the hidden query-based audit method as described in any one of claims 1 to 7.

10. An audit system based on hidden query, characterized in that: The system includes a hidden query service device and an audit service device; The hidden query service device is used to execute the hidden query task, obtain the second hidden query information and the encrypted first hidden query information, and upload the second hidden query information to the blockchain through the smart contract of the blockchain; The audit service device is used to execute the hidden query-based audit method as described in any one of claims 1-7.

Images