Ciphertext storage method and system based on signature witness and identity encryption

Abstract

The embodiment of the present application provides a ciphertext storage method and system based on signature witness and identity encryption, the method comprising: obtaining the number of blockchain nodes α participating in the current ciphertext storage, each blockchain node selects a random number x i , calculate the public key PK of each blockchain node based on the generator parameters and random numbers in the preset prime number bilinear group i , put α public keys into a public key set and put it into the smart contract; obtain multiple ciphertexts K and signature objects T i And L, store the α1 group results in the smart contract; get the α1 group results, perform aggregation calculation based on α1 public keys and α1 signatures to get the aggregate signature σ, use the aggregate signature and public key set U to encrypt the result c t Decryption is performed to obtain the multiple ciphertexts K.

Description

Technical Field

[0001] The present application belongs to the field of computer software and security detection technology, and specifically relates to a ciphertext storage method and system based on signature witnessing and identity encryption. Background Art

[0002] In blockchains, due to their transparency, anyone can see any content stored on the blockchain, making it impossible to store secrets directly in smart contracts. For example, consider asset transfer or custody. User A wants to transfer a digital asset to User B. However, User A and User B cannot communicate directly, meaning User A doesn't know User B's address. Therefore, User A typically uses a smart contract to lock the asset under certain conditions, such as a puzzle. If User B knows the secret to solving the puzzle, they can obtain the asset. Essentially, this requires converting the secret into a non-secret form and storing it on the blockchain.

[0003] Existing technologies require multiple rounds of interaction between encryption and decryption users in order for the decryption user to obtain the necessary information to decrypt the ciphertext. However, blockchain users and various participants are usually strangers and do not trust each other. Therefore, encryption and decryption users can only exchange information through smart contracts to ensure that the other party is not deceiving. Therefore, the existing technology solution may allow non-decryption users to see the information of the smart contract, resulting in the insecurity of the ciphertext, affecting security. Summary of the Invention

[0004] This application provides a ciphertext storage method and system based on signature witness and identity encryption, which can avoid improving the security of blockchain ciphertext.

[0005] In a first aspect, the present application provides a ciphertext storage method based on signature witnessing and identity encryption, the method comprising the following steps:

[0006] Get the number of blockchain nodes α participating in this ciphertext storage, and each blockchain node selects a random number x i , where i∈

α

[0007] After the smart contract issues a signature event, the α1 blockchain nodes that receive the signature event will sign the object T i Sign to obtain α1 signatures, use the public key pubKey of the decryption object to encrypt the α1 signatures to obtain α1 encryption results, match the encryption result and public key of each blockchain node to obtain α1 group results, and store the α1 group results in the smart contract;

[0008] Get α1 group results, use the private key privKey of the decryption object to decrypt α1 encrypted results to obtain α1 signatures, perform aggregation calculation based on α1 public keys and α1 signatures to obtain aggregate signature σ, use the aggregate signature and public key set U to encrypt the result c t Decryption is performed to obtain the multiple ciphertexts K.

[0009] The aggregate signature is an aggregate signature obtained by aggregating signatures of multiple different data of the same signature object.

[0010] In a second aspect, a ciphertext storage system based on signature witnessing and identity encryption is provided, the system comprising:

[0011] The acquisition unit is used to obtain the number of blockchain nodes α participating in the ciphertext storage. Each blockchain node selects a random number x i , where i∈

α

[0012] Calculation unit, used to convert K, L, T i , α i And the public key set is input into the encryption function to calculate the encryption result c t , c t Stored in smart contracts;

[0013] The communication unit is used to send a signature event to the signature object T by the α1 blockchain nodes that received the signature event after the smart contract sends the signature event. i Sign and get α1 signatures;

[0014] The computing unit is further configured to encrypt α1 signatures using the public key pubKey of the decryption object to obtain α1 encryption results, combine the encryption result and the public key of each blockchain node to obtain α1 groups of results, and store the α1 groups of results in the smart contract;

[0015] The calculation unit is further used to obtain α1 group results, use the private key privKey of the decryption object to decrypt α1 encryption results to obtain α1 signatures, perform aggregation calculation based on α1 public keys and α1 signatures to obtain aggregate signature σ, and use the aggregate signature and public key set U to encrypt the result c t Decryption is performed to obtain the multiple ciphertexts K.

[0016] The aggregate signature is an aggregate signature obtained by aggregating signatures of multiple different data of the same signature object.

[0017] In a third aspect, the present application provides a computer storage medium storing a computer program for electronic data exchange, wherein the computer program enables a computer to execute some or all of the steps described in the first aspect of the present application.

[0018] The embodiments of the present application have the following beneficial effects:

[0019] The encryption process of the encryptor of the technical solution of the present application does not require obtaining signatures, and only the public keys of all signers need to be used to encrypt the secret. Only when the decryptor requests a certain number of blockchain nodes to sign separately and obtains the signatures of these nodes and aggregates them can the secret be decrypted. Moreover, in the process of obtaining the decrypted shard keys (i.e., the signatures of each blockchain node), no one can know the keys, because these shard keys are asymmetrically encrypted and multi-level secret protection is achieved, thereby storing the secrets for an arbitrary length of time (until the decryption user wants to decrypt the secret). In this way, the secrets are encrypted and stored in transparent and public places such as smart contracts until the decryptor applies for the blockchain node to sign, and then the decryptor uses these signature shards to decrypt the ciphertext, so that the entire encryption and decryption process will not leak the ciphertext, and even if other people intercept the signature shards, they cannot steal the ciphertext. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 This is a schematic diagram of the structure of a computer provided in an embodiment of the present application;

[0022] Figure 2 This is a flowchart of a ciphertext storage method based on signature witnessing and identity encryption provided by an embodiment of the present application;

[0023] Figure 3This is a schematic diagram of the encryption result calculation steps provided by this application;

[0024] Figure 4 This is a structural diagram of a ciphertext storage system based on signature witnessing and identity encryption provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish between different objects, not to describe a particular order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, system, product, or apparatus.

[0027] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0028] The following is an introduction to the relevant terms involved in this application.

[0029] Blockchain: A new distributed infrastructure and computing method that uses a block chain data structure to verify and store data, a distributed node consensus algorithm to generate and update data, cryptography to ensure the security of data transmission and access, and smart contracts composed of automated script code to program and operate data.

[0030] Public key system: Keys are generated in pairs, each consisting of a public key and a private key. In practical applications, the private key is kept by the owner, while the public key needs to be made public.

[0031] Elliptic Curve Cryptography (ECC) is a public key cryptography algorithm based on elliptic curve mathematics. It provides a secure way to perform cryptographic operations such as key exchange, digital signatures, and encryption.

[0032] Hash: It can also be called hash or hash. It is a method of transforming input of any length into output of fixed length through a hash algorithm, and ensuring that different inputs will not produce the same output with a high probability.

[0033] Key negotiation: A key negotiation algorithm widely used in computer network communications. It can securely create a shared key over an insecure channel, allowing communicating parties to negotiate a secure communication key without any pre-shared key.

[0034] Bilinear mapping function, for a prime number bilinear group, it can be described by a quintuple (p, G1, G2, GT, e), where p is a large prime number related to a given safety constant, G1, G2, and GT are all multiplicative cyclic groups of order p (the generators of G1 and G2 are g1 and g2, and the generator of GT is gT), and e is a bilinear mapping function that can map two points P and Q on one or two different curves to a number: e(P, Q)→n, that is, mapping the elements in the G1 and G2 groups to the GT group.

[0035] BLS Aggregate Signatures: BLS signatures are a special type of digital signature introduced by Dan Boneh, Ben Lynn, and Hovav Shachham in 2001. BLS uses elliptic curve pairing technology based on bilinear mapping to implement signature verification and aggregation. BLS signatures require two new structures: hashing to the curve and curve pairing.

[0036] The following describes the system architecture of a computer involved in the embodiments of the present application.

[0037] The present application also provides a computer 10, such as Figure 1 As shown, it includes at least one processor 11 and memory 12, and may also include a communications interface 14 and a bus 13. The processor 11, memory 12, and communications interface 14 can communicate with each other via the bus 13. The communications interface 14 can transmit information. The processor 11 can call logic instructions in the memory 12 to execute the method in the above embodiment.

[0038] In addition, the logic instructions in the above-mentioned memory 12 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. The above-mentioned logic instructions can also become an operating system, application or computer program, etc.

[0039] The memory 12 is a computer-readable storage medium that can be configured to store software programs or computer-executable programs, such as program instructions or modules corresponding to the methods in the embodiments of the present disclosure. The processor 11 executes the software programs, instructions, or modules stored in the memory 12 to execute functional applications and data processing, thereby implementing the methods in the above embodiments.

[0040] The memory 12 may include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data generated based on the use of the computer 10. Furthermore, the memory 12 may include high-speed random access memory and non-volatile memory. For example, various media that can store program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, may also be transient storage media.

[0041] It is understood that the computer in this embodiment can be understood as a server. For example, the server includes a cloud server or an edge server. This is not limited to a unique server. Of course, in an optional technical scenario, the above-mentioned computer can also be a personal computer (PC), tablet computer, laptop computer, and other smart devices. This application does not limit the specific form of the above-mentioned computer, as long as the above-mentioned computer has an operating system and shortcuts.

[0042] The specific methods are introduced in detail below.

[0043] See also Figure 2 , this application also provides a ciphertext storage method based on signature witness and identity encryption, the above method includes the following steps:

[0044] Step S201: Get the number of blockchain nodes α participating in the ciphertext storage. Each blockchain node selects a random number x. i , where i∈

α

[0045] Step S202: After the smart contract issues a signature event, the α1 blockchain nodes that receive the signature event will sign the object T i Sign to obtain α1 signatures, use the public key pubKey of the decryption object to encrypt the α1 signatures to obtain α1 encryption results, match the encryption result and public key of each blockchain node to obtain α1 group results, and store the α1 group results in the smart contract;

[0046] Step S203: Get the α1 group results, use the private key privKey of the decryption object to decrypt the α1 encryption results to obtain α1 signatures, perform aggregation calculation based on the α1 public keys and α1 signatures to obtain the aggregate signature σ, use the aggregate signature and the public key set U to encrypt the encryption result c t Decryption is performed to obtain the multiple ciphertexts K.

[0047] The aggregate signature may be an aggregate signature obtained by aggregating signatures of multiple different data of the same signature object.

[0048] The above-mentioned aggregation execution method can specifically adopt the m-of-n BLS aggregation signature algorithm. Of course, other aggregation algorithms can also be adopted, such as the BLS aggregation signature algorithm, etc.

[0049] The technical solution provided by this application can obtain the number of blockchain nodes α participating in the ciphertext storage. Each blockchain node selects a random number x. i , where i∈

α

[0050] For example, the above K, L, T i , α i And the public key set is input into the encryption function to calculate the encryption result c t Specifically, they may include:

[0051] Select α random numbers from the random number cluster, select a public key pk1 from the α public keys, calculate the hash value ε1 of the public key pk1, select the generator g2 of G2 from the prime number bilinear group, calculate c based on g2 and another random number r, calculate the signature object T1 value based on the random number α1, the hash value ε1 and c, select an element h from the group G2, calculate c0 based on h, g2 and another random number r; calculate cj based on the public key pk1, g2 and the defined function value sj; based on T i , K, g2 and Gt are calculated to get ci', h, c, c0, cj, ci', αi, T i Input the encryption function to get the encryption result ct.

[0052] For example, the encryption function may be: SWE.Enc((pk j ) j∈[n] ,(T i ) i∈[l] , (K i ) i∈[l]);

[0053] Among them, pk j Represents the public key of each blockchain node. For example, the public key of node 1 can be pk1, and the public key of node 2 can be pk2. i Represents the signature object, for example, T1 represents the first signature object, and T2 represents the second signature object. It should be noted that the signature objects here do not necessarily represent different individuals. For example, T1 can be the signature of user A, and T2 can be the data of user A (such as asset list, asset generation time, etc.). i Represents the encryption object, for example, K1 represents the first encryption object, K2 represents the second encryption object, and L represents the number of T and K, for example, 4 or 5.

[0054] For example, the specific calculation method of the above encryption result ct is as follows Figure 3 As shown, Figure 3 The schematic diagram of the encryption result calculation steps provided for this application may include:

[0055] Step A1: Select a random number r and m random numbers r j ; where j∈(0,1…m-1); r j ∈Zp; where Zp is a set of random numbers, and the above random numbers can be prime numbers.

[0056] Step A2, based on each PK j Calculate ε j Specific calculation methods may include:

[0057] ε j =H2(PK j );s j =f(s j );in,

[0058] f(x)=∑ m-1 j＝0 r j· x j ;x is the independent variable.

[0059] Step A3: Select L random numbers α from Zp i , i∈(0,1…L-1),

[0060] Step A4: Based on α i 、T i Calculate t i ; Calculate c based on g2 and r;

[0061] t i =H(T i ) αi ;

[0062] c=g2 r , where g2 is the generator of group G2.

[0063] Step A5: Select a random element h from group G2 and calculate C0;

[0064] C0=h r g2 r0 ;

[0065] Step A6: For each PKj and Sj, calculate c j ;

[0066] where c j =pk j r g2 Sj

[0067] Step A7: For each t i and K i , calculate c i '.

[0068] Among them, c i '=e(t i g2 r 0)·g T Ki ,

[0069] Step A8: Calculate the output result ct; ct = (h, c, c0, (c j ) j∈[n] ,(c i ′,a i , t i ) i∈[l] ).

[0070] For example, decrypting the encrypted result using the aggregate signature to obtain the ciphertext K specifically includes:

[0071] Obtain a preset public key set U, calculate the hash value εj for each public key in U, calculate Lj for each hash value εj, calculate C* based on Lj and cj, calculate Zi based on the aggregate signature σ and C*, and substitute Zi into the decryption function to obtain the encrypted data. If there are multiple encrypted data, combine the multiple encrypted data to obtain the encrypted ciphertext.

[0072] The above decryption function can be specifically: SWE.Dec(ct, (σ i ) i∈[l] , U, V),

[0073] Where V=(pk1,pk2…pk n ) is the public key set of all blockchain nodes, U=(pk1'’ ,pk2'…pk k ') is the public key of the k blockchain nodes participating in the signature. It should be noted that the subscripts in the V set and the subscripts in the U set are not one-to-one corresponding, but are just the order of the public keys in their respective sets; σ i Is the signature of each node on Ti (S Tij ) i∈

L

k

[0074] The specific method for obtaining K may include the following steps:

[0075] Step B1: For each public key in the set U, calculate ε j ; j here represents the subscript of the public key, and I represents the number of public keys in the set U;

[0076] The above ε j The calculation formula of can be found in the description of step A2 above, which will not be repeated here.

[0077] Step B2: For each ε j , calculate Lj respectively;

[0078] in,

[0079]

[0080] i and j can be adjacent values ​​or interval values, for example, j = 1, i = 2 (adjacent selection), and j = 3, i = 1 (interval selection)

[0081] Step B3, calculate C*;

[0082]

[0083] Step B4: For each c i ′,a i , t i , σ i , calculate z i =c i ′·e(σ i , a i ) / e(t i , c*);

[0084] Step B5: For each Zi, calculate The obtained K i ′, i∈[l] are combined to form the decrypted secret K;

[0085] dlog gt The calculation of (Zi) means finding the multiplier of Zi corresponding to gT.

[0086] Example 1

[0087] The first embodiment of the present application provides a ciphertext storage method based on signature witness and identity encryption. The above method is for encrypting the ciphertext between Alice and Bob. The number of blockchain nodes in this embodiment is n = 5. Only when Bob obtains the correct signatures of more than or equal to 3 nodes can he obtain the key to decrypt the secret, so m = 3. The technical scenario implemented in this embodiment may include: selecting a prime bilinear group (p, G1, G2, GT, e) and a hash function H: {0, 1} → G1 that conforms to the hash to elliptic curve and a hash function H2: {0, 1} → Z that hashes to positive integers within the prime number p P .

[0088] Select a public-private key asymmetric encryption and decryption algorithm PKE, such as EC-ElGamal and SM3 algorithm, which includes an encryption algorithm PKE.Enc(pubKey, S)→ct and a decryption algorithm PKE.Dec(privKey, ct)→s.

[0089] Deploy a smart contract on the blockchain as a place to store secrets (encrypted) and other public information. Select 5 participating blockchain nodes (selected arbitrarily), and each of these 5 blockchain nodes selects a random number x i , i∈[5], x i ∈Z p ' as the private key, and then calculate the respective public keys Finally, all public keys V = (pk1, pk2, ... pk5) are placed in the smart contract. The value of the signature object T is arbitrarily selected. For the sake of simplicity, since this example is encrypting a secret K, only one T needs to be selected as the common signature object for all nodes and stored in the smart contract. (The solution of this embodiment supports the encryption and decryption of multiple secrets at the same time. According to the above principle, a corresponding number of signature objects are required, but each signature object does not need to be different. In addition, encrypting and decrypting multiple secrets at the same time is equivalent to concatenating multiple secrets and finally encrypting and decrypting a secret. Therefore, the example here only uses one signature object and one secret.) The above method includes the following steps:

[0090] Step S31, Alice calls the encryption function SWE.Enc((pk j ) i∈[n] ,(T i ) i∈[l] , (K i ) i∈[l] ), input n = 5, l = 1, T, K and each public key PK i , we can get the output ct=(h,c,c0,(c j ) j∈[5],(c i ′,a i , t i ) i∈[1] ), and then store ct in the smart contract.

[0091] Step S32: Before applying for decryption, Bob first generates a pair of public and private keys (privKey, pubKey). Bob applies for decryption to the smart contract and stores the public key pubKey in the smart contract.

[0092] Step S33: The smart contract issues a signature event. Due to the characteristics of blockchain, all blockchain nodes will receive this event. Assume that three of the nodes (whose public keys are pk1′, pk2′, and pk3′) immediately sign the signature object T after receiving the event: Then use Bob’s public key pubKey stored in the smart contract to encrypt the signature: Finally, combine the encryption result with your own public key Send to smart contract.

[0093] Step S34: Bob obtains the encryption result of the previous step from the smart contract First decrypt using the private key separately: Get the signatures S1, S2, and S3 of the three blockchain nodes; then aggregate these three signatures to get the aggregate signature σ: calculate the corresponding ε for the participating signatures pk1′, pk2′, and pk3′ j =H2(pk j ), j∈3, we get (ε1, ε2, ε k ). For each ε j Recalculate Finally get the aggregate signature

[0094] Step S35. Bob finally uses the aggregate witness signature decryption function SWE.Dec(ct, σ, U, V), where U = (pk1′, pk2′, pk3′), to obtain the original ciphertext K encrypted by Alice.

[0095] The encryption process of the encryptor of the technical solution of the present application does not require obtaining signatures, and only the public keys of all signers need to be used to encrypt the secret. Only when the decryptor requests a certain number of blockchain nodes to sign separately and obtains the signatures of these nodes and aggregates them can the secret be decrypted. Moreover, in the process of obtaining the decrypted shard keys (i.e., the signatures of each blockchain node), no one can know the keys, because these shard keys are asymmetrically encrypted and multi-level secret protection is achieved, thereby storing the secrets for an arbitrary length of time (until the decryption user wants to decrypt the secret). In this way, the secrets are encrypted and stored in transparent and public places such as smart contracts until the decryptor applies for the blockchain node to sign, and then the decryptor uses these signature shards to decrypt the ciphertext, so that the entire encryption and decryption process will not leak the ciphertext, and even if other people intercept the signature shards, they cannot steal the ciphertext.

[0096] See Figure 4 , Figure 4 This application provides a ciphertext storage system based on signature witness and identity encryption, the system comprising:

[0097] The acquisition unit 401 is used to obtain the number of blockchain nodes α participating in the ciphertext storage. Each blockchain node selects a random number x i , where i∈

α

[0098] Calculation unit 402, used to calculate K, L, T i , α i And the public key set is input into the encryption function to calculate the encryption result c t , c t Stored in smart contracts;

[0099] Communication unit 403, used for receiving the signature event after the smart contract issues the signature event, and the α1 blockchain nodes that receive the signature event send the signature object T i Sign and get α1 signatures;

[0100] The computing unit 402 is further configured to encrypt the α1 signatures using the public key pubKey of the decryption object to obtain α1 encryption results, combine the encryption result and the public key of each blockchain node to obtain α1 sets of results, and store the α1 sets of results in the smart contract;

[0101] The calculation unit 402 is further used to obtain α1 group results, decrypt α1 encryption results using the private key privKey of the decryption object to obtain α1 signatures, perform aggregation calculation based on α1 public keys and α1 signatures to obtain aggregate signature σ, and use the aggregate signature and public key set U to encrypt the encryption result c t Decryption is performed to obtain the multiple ciphertexts K.

[0102] The aggregate signature is an aggregate signature obtained by aggregating signatures of multiple different data of the same signature object.

[0103] For example,

[0104] The calculation unit 402 is specifically configured to select α random numbers from the random number cluster, select a public key pk1 from the α public keys, calculate the hash value ε1 of the public key pk1, select a generator g2 of G2 from the prime number bilinear group, calculate c based on g2 and another random number r, calculate the signature object T1 value based on the random number α1, the hash value ε1 and c, select an element h from the group G2, calculate C0 based on h, g2 and another random number r; calculate cj based on the public key pk1, g2 and the defined function value sj; and calculate T i , K, g2 and Gt are calculated to get ci', h, c, C0, cj, ci', αi, T i Input the encryption function to get the encryption result ct.

[0105] For example, the calculation unit 402 is specifically configured to select a random number r and m random numbers r j , where j∈(0,1…m-1); r j ∈Zp; where Zp is a set of random numbers;

[0106] Perform hash calculation on each public key PKj to obtain the εj corresponding to each public key, and perform custom function f(x) on each public key PKj to obtain S j ; For each PKj and S j calculate Cj ;

[0107] Select L random numbers a from Zp i ,i∈(0,1…L-1), for each a i、 T i Calculate t i , calculate c based on g2 and r; calculate C0, where C0 is equal to the product of h to the power of r and g2 to the power of r0;

[0108] Calculate ci', where ci' is equal to t iMultiply the product of the bilinear function value of the product of the r0 power of g2 and the Ki power of Gt, and change h, c, C0, cj, ci', αi, T i , t i Collect them together to get the encrypted result ct.

[0109] For example, the calculation unit 402 is specifically configured to obtain a preset public key set U, calculate a hash value εj for each public key in the set U, calculate Lj for each hash value εj, calculate C* based on Lj and cj, calculate Zi based on the aggregate signature σ and C*, and substitute Zi into the decryption function to obtain encrypted data. If there are multiple encrypted data, the multiple encrypted data are combined to obtain the encrypted ciphertext.

[0110] For example, the calculation unit 402 is specifically used to select the corresponding εi for each εj, calculate the difference between εj and εi, and calculate the ratio of -εi to the difference, where Lj is the direct product value of each εj ratio, where i and j are adjacent selections or interval selections.

[0111] For example, the calculation unit 402 is specifically configured to calculate C*, where C* is the direct product of cj raised to the power of Lj.

[0112] For example, the calculation unit 402 is specifically used to calculate σ, a i The bilinear function of t1 and C* is used to obtain the first value, the bilinear function of t1 and C* is used to obtain the second value, the ratio of the first value to the second value is calculated, and Zi is the product of t1 and the ratio.

[0113] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any method described in the above method embodiments, and the above computer includes an electronic device.

[0114] The present application also provides a computer program product comprising a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to perform some or all of the steps of any of the methods described in the above method embodiments. The computer program product may be a software installation package, and the computer may comprise an electronic device.

[0115] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed methods, systems, and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for example, the division of the units is merely a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the system or unit, which may be electrical, mechanical or other forms.

[0117] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0118] In addition, the functional units in various embodiments of the present invention may be integrated into a single processing unit, each unit may be physically included separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional units.

[0119] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a volatile memory or a non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM (DR RAM), among other media that can store program code.

[0120] Although the present invention is disclosed above, it is not limited thereto. Any person skilled in the art may readily conceive of variations or substitutions, and may make various modifications and alterations without departing from the spirit and scope of the present invention. Combinations of the above-described functions and implementation steps, including software and hardware implementations, are all within the scope of protection of the present invention.

Claims

1. A ciphertext storage method based on signature witness and identity encryption, characterized in that: The method comprises the following steps: Get the number of blockchain nodes α participating in this ciphertext storage, and each blockchain node selects a random number x i , where i∈【α】, the public key PK of each blockchain node is calculated based on the generator parameters and random numbers in the preset prime number bilinear group i , put α public keys into a public key set and put it into the smart contract; obtain multiple ciphertexts K and signature objects T i and L, where L is T i and the quantity value of K, K, L, T i , α i And the public key set is input into the encryption function to calculate the encryption result c t , c t Stored in smart contracts; After the smart contract issues a signature event, the α1 blockchain nodes that receive the signature event will sign the object T i Sign to obtain α1 signatures, use the public key pubKey of the decryption object to encrypt the α1 signatures to obtain α1 encryption results, match the encryption result and public key of each blockchain node to obtain α1 group results, and store the α1 group results in the smart contract; Get α1 group results, use the private key privKey of the decryption object to decrypt α1 encrypted results to obtain α1 signatures, perform aggregation calculation based on α1 public keys and α1 signatures to obtain aggregate signature σ, use the aggregate signature and the preset public key set U to encrypt the result c t Decrypting to obtain the multiple ciphertexts K; The aggregate signature is an aggregate signature obtained by aggregating signatures of multiple different data of the same signature object.

2. The ciphertext storage method based on signature witness and identity encryption according to claim 1 is characterized in that: The K, L, T i , α i And the public key set is input into the encryption function to calculate the encryption result c t Specifically, they may include: Select α random numbers from the random number cluster, select a public key pk1 from the α public keys, calculate the hash value ε1 of the public key pk1, select the generator g2 of G2 from the prime number bilinear group, calculate c based on g2 and another random number r, calculate the signature object T1 value based on the random number α1, the hash value ε1 and c, select an element h from the group G2, calculate C0 based on h, g2 and another random number r; calculate cj based on the public key pk1, g2 and the defined function value sj; based on T i , K, g2 and gT are calculated to get ci', h, c, C0, cj, ci', αi, T i Input the encryption function to get the encryption result c t ; The gT is a generator of the p-order multiplicative cyclic group of the bilinear mapping function.

3. The ciphertext storage method based on signature witness and identity encryption according to claim 2 is characterized in that: h, c, C0, cj, ci', αi, T i Inputting the encryption function to obtain the encryption result ct specifically includes: Choose a random number r and m random numbers r j , where j∈(0,1…m-1); r j ∈Zp; where Zp is a set of random numbers; For each public key PK j Perform hash calculation to obtain the εj corresponding to each public key. For each public key PK j Execute the custom function f(x) to calculate S j ; For each PK j and S j Calculate cj; Select L random numbers a from Zp i ,i∈(0,1…L-1), for each a i 、T i Calculate t i , calculate c based on g2 and r; calculate C0, where C0 is equal to the product of h to the power of r and g2 to the power of r0; Calculate ci', where ci' is equal to t i Multiply the product of the bilinear function value of the product of the r0 power of g2 and the Ki power of gT, and change h, c, C0, cj, ci', αi, T i , t i Collect them together to get the encrypted result c t .

4. The ciphertext storage method based on signature witness and identity encryption according to claim 1 is characterized in that: Decrypting the encrypted result using the aggregate signature to obtain the ciphertext K specifically includes: Obtain the preset public key set U, calculate the hash value εj for each public key in the U set, calculate Lj for each hash value εj, calculate C* based on Lj and cj, calculate Zi based on the aggregate signature σ and C*, and substitute Zi into the decryption function to obtain the encrypted data; if there are multiple encrypted data, combine the multiple encrypted data to obtain the encrypted ciphertext.

5. The ciphertext storage method based on signature witness and identity encryption according to claim 4 is characterized in that: The calculation of Lj for each hash value εj specifically includes: For each εj, select the corresponding εi, calculate the difference between εj and εi, and calculate the ratio of -εi to the difference. The Lj is the direct product value of each εj ratio, where i and j are adjacent selections or interval selections.

6. The ciphertext storage method based on signature witness and identity encryption according to claim 4 is characterized in that: The calculation of C* based on Lj and cj specifically includes: C* is the direct product of cj to the power of Lj.

7. The ciphertext storage method based on signature witness and identity encryption according to claim 4 is characterized in that: The Zi calculated based on the aggregate signature σ and C* specifically includes: Calculate σ and a i The bilinear function of t1 and C* is used to obtain the first value, the bilinear function of t1 and C* is used to obtain the second value, and the ratio of the first value to the second value is calculated, where Zi is the product of t1 and the ratio.

8. A ciphertext storage system based on signature witness and identity encryption, characterized in that: The system comprises: The acquisition unit is used to obtain the number of blockchain nodes α participating in the ciphertext storage. Each blockchain node selects a random number x i , where i∈【α】, the public key PK of each blockchain node is calculated based on the generator parameters and random numbers in the preset prime number bilinear group i , put α public keys into a public key set and put it into the smart contract; obtain multiple ciphertexts K and signature objects T i and L, where L is T i and the quantity value of K; Calculation unit, used to convert K, L, T i , α i And the public key set is input into the encryption function to calculate the encryption result c t , c t Stored in smart contracts; The communication unit is used to send a signature event to the signature object T by the α1 blockchain nodes that received the signature event after the smart contract sends the signature event. i Sign and get α1 signatures; The computing unit is further configured to encrypt α1 signatures using the public key pubKey of the decryption object to obtain α1 encryption results, combine the encryption result and the public key of each blockchain node to obtain α1 groups of results, and store the α1 groups of results in the smart contract; The calculation unit is further used to obtain α1 group results, use the private key privKey of the decryption object to decrypt α1 encryption results to obtain α1 signatures, perform aggregation calculation based on α1 public keys and α1 signatures to obtain aggregate signature σ, and use the aggregate signature and public key set U to encrypt the result c t Decrypting to obtain the multiple ciphertexts K; The aggregate signature is an aggregate signature obtained by aggregating signatures of multiple different data of the same signature object.

9. The ciphertext storage system based on signature witness and identity encryption according to claim 8 is characterized in that: The calculation unit is specifically used to select α random numbers from the random number cluster, select a public key pk1 from the α public keys, calculate the hash value ε1 of the public key pk1, select the generator g2 of G2 from the prime number bilinear group, calculate c based on g2 and another random number r, calculate the signature object T1 value based on the random number α1, the hash value ε1 and c, select an element h from the group G2, calculate C0 based on h, g2 and another random number r; calculate cj based on the public key pk1, g2 and the defined function value sj; and calculate T i , K, g2 and gT are calculated to get ci', h, c, C0, cj, ci', αi, T i Input the encryption function to get the encryption result c t ; The gT is a generator of the p-order multiplicative cyclic group of the bilinear mapping function.

10. The ciphertext storage system based on signature witness and identity encryption according to claim 9 is characterized in that: The calculation unit is specifically used to select a random number r and m random numbers r j , where j∈(0,1…m-1); r j ∈Zp; where Zp is a set of random numbers; For each public key PK j Perform hash calculation to obtain the εj corresponding to each public key. For each public key PK j Execute the custom function f(x) to calculate S j ; For each PK j and S j Calculate cj; Select L random numbers a from Zp i ,i∈(0,1…L-1), for each a i 、T i Calculate t i , calculate c based on g2 and r; calculate C0, where C0 is equal to the product of h to the power of r and g2 to the power of r0; Calculate ci', where ci' is equal to t i Multiply the product of the bilinear function value of the product of the r0 power of g2 and the Ki power of gT, and change h, c, C0, cj, ci', αi, T i , t i Collect them together to get the encryption result c t ; The gT is a generator of the p-order multiplicative cyclic group of the bilinear mapping function.

Images