Block chain shared data access control method and system

Abstract

The invention relates to the technical field of data management, in particular to a block chain shared data access control method and system. The invention provides a block chain system model based on the on-chain and off-chain storage data, in the model, the user stores the data in the corresponding cloud storage server, the index corresponding to the data is encrypted and stored in the block chain system, the external node can obtain the data stored in the cloud storage server through the index information, and the data stored in the cloud storage server can be stored in the block chain system. The data overload problem of the block chain is relieved, and the storage efficiency of the block chain is improved. According to the invention, the proxy re-encryption algorithm is used, so that the visitor can obtain the corresponding data through the secret key of the visitor under the condition that the private key of the visitor is not leaked by the user, the transaction data privacy is guaranteed, and the data controlled sharing of the block chain is realized. A user in the model can dynamically manage an authority list, the authority list is maintained through an administrator, visitors are newly added and deleted, and dynamic updating of authority control is achieved.

Description

Technical Field

[0001] The present disclosure relates to the field of data management technology, and in particular to a blockchain shared data access control method and system. Background Art

[0002] In recent years, with the rapid development of information technology, global data has shown explosive growth. Users' local storage can no longer meet the requirements of big data. In order to conveniently store and efficiently calculate massive data, cloud storage technology has emerged. As an emerging storage technology, cloud storage has the characteristics of large storage capacity, flexible storage methods, and convenient access. It is gradually replacing local storage technology and is favored by more and more customers. However, it is not completely reliable for users to store data on cloud storage servers. For example, cloud storage service providers may maliciously tamper with user data and cause losses to users. Most users will introduce third-party auditors to complete the interaction, but third-party auditors are not completely trustworthy. They may steal user data by repeatedly sending requests or colluding with cloud storage service providers. In summary, for the cloud storage environment under big data, realizing a stable, reliable and efficient remote data integrity detection model is an important research direction at present.

[0003] Blockchain has the characteristics of decentralization, immutability, and traceability. It can verify data integrity and accuracy when both parties are untrustworthy, ensure data security, and gradually enter the public eye. Blockchain stores transaction information in the blockchain network through consensus nodes selected by consensus algorithms, allowing users to view the operations of external nodes on their own stored data at any time, greatly ensuring the security of user data.

[0004] In existing technologies, the non-deletability of blockchain has also caused great trouble for the storage of massive data. At the same time, how to share the data stored by users on the blockchain without leaking the key is also a question worth pondering. Summary of the invention

[0005] In response to the above problems, the present invention provides a blockchain shared data access control method and system to solve the problem of data sharing.

[0006] In a first aspect, a blockchain shared data access encryption method is provided, the method comprising:

[0007] The data owner encrypts the index information of the data to be accessed with the data owner's user public key to obtain an encrypted index for accessing the data, and stores the encrypted index on the blockchain through the consensus node, while the data to be accessed is stored in the cloud storage server;

[0008] The data owner obtains a permission list for managing data access permissions by adding data access permissions, and then hands the permission list over to the user administrator for permission management;

[0009] The data owner calculates the re-encryption key used for re-encrypting the encrypted index based on the user public key of the data accessor, the system encryption parameter α, and the user private key of the data owner, and hands the re-encryption key to the consensus node for management;

[0010] Among them, the consensus nodes are selected through the consensus algorithm of each node in the blockchain.

[0011] Furthermore, it also includes:

[0012] The user public key of the data owner, the user private key of the data owner, the user public key of the data accessor, the user private key of the data accessor, the system encryption parameter α and the system decryption parameter β are generated and distributed by the key distribution agency;

[0013] The key distribution agency generates a key pair for the data owner. For each user among the data owners, the corresponding key pair is: {(pk1,sk1),(pk2,sk2),...,(pk n ,sk n )}, n is the number of users among the data owners; pk n is the user public key of the data owner, sk n The user private key of the data owner;

[0014] The key distribution agency generates a key pair for the data accessor. For each user among the data accessors, the corresponding key pair is: {(pk A ,sk A ),(pk B ,sk B ),...,(pk N ,sk N )}, N is the number of users among the data visitors; pk N is the user public key in the data accessor, sk N The user's private key in the data accessor;

[0015] The key distribution agency generates a system key pair (α, β), where α represents the system encryption parameter, which is managed by the data owner, and β represents the system decryption parameter, which is managed by the user administrator.

[0016] Furthermore, it also includes:

[0017] The user public key of the data accessor is transmitted from the data accessor to the data owner through the user administrator.

[0018] In a second aspect, a blockchain shared data access control method is provided, the method comprising: using the above-mentioned blockchain shared data access encryption method to encrypt data;

[0019] When a data accessor wants to access the data owner's data, he / she sends a data request to the user administrator, who verifies the accessor's authority.

[0020] When the data accessor's permission verification is passed, the user administrator sends the permission verification result to the consensus node. The consensus node uses the re-encryption key to re-encrypt the encrypted index and sends the newly generated re-encrypted index to the data accessor. At the same time, the user administrator sends the system decryption parameters to the data accessor. The data accessor decrypts the re-encrypted index using the system decryption parameters and its own private key to obtain the plaintext of the encrypted index. The corresponding data is obtained from the cloud storage server through the plaintext of the encrypted index to achieve data sharing.

[0021] Furthermore, it also includes:

[0022] When the data accessor's permission verification fails, the user administrator will directly deny access and send the illegal data accessor information to the consensus node; when the transaction reaches the quantity threshold, the consensus node will upload the transaction information to the blockchain ledger for broadcast.

[0023] Furthermore, when the data accessor passes the permission verification, the user administrator sends the permission verification result to the consensus node, and the consensus node re-encrypts the encrypted index using the re-encryption key and sends the newly generated re-encrypted index to the data accessor; at the same time, the user administrator sends the system decryption parameter to the data accessor, and the data accessor decrypts the re-encrypted index using the system decryption parameter and its own private key to obtain the plaintext of the encrypted index, including:

[0024] When data access user B wants to access data F stored by user 1 on the cloud storage server, and user B passes the permission verification, the consensus node obtains user B's information through the user administrator;

[0025] After obtaining the information of user B, the consensus node generates an encrypted index corresponding to the data F that user B wants to access. The re-encryption key rk uploaded by user 1 1-B Perform re-encryption calculation to generate a new re-encryption index Re-encrypt index The public key pk of user B B Encrypted with system encryption parameter α;

[0026] The consensus node will re-encrypt the index Send to user B, and the user administrator sends the system decryption parameter β to user B;

[0027] User B uses his own private key sk B and system decryption parameter β for re-encryption index Perform decryption calculation to obtain the encrypted index plaintext index1.

[0028] Furthermore, it also includes:

[0029] The data owner performs the authorized operation of the data accessor and sends the final update result to the user administrator.

[0030] Furthermore, the update operation includes a adding operation and a deleting operation.

[0031] Furthermore, new operations are added, including:

[0032] When data owner user 1 wants to add data accessor user C to his permission list, user C sends his public key pk to the user administrator. C ;

[0033] After receiving the pk C After that, pk C Send to user 1;

[0034] User 1 uses his private key sk1 and user C's public key pk C And the system encryption parameter α constructs the re-encryption key rk for user C 1-C ={α,(sk1,pk C )}; User 1 sends the re-encryption key to the consensus node and notifies the user administrator to update the permission list.

[0035] Further, the deletion operation includes:

[0036] When user 1 wants to delete user C from his permission list, user 1 notifies the consensus node to delete the corresponding re-encryption key rk 1-C , then let the user administrator notify user C of the permission deletion, and let the user administrator delete user C's permissions in the permission list and update the permission list.

[0037] In a third aspect, a blockchain shared data access control system includes: a key distribution agency, the key distribution agency is respectively connected to a data owner and a data accessor, the data owner and the data accessor are jointly connected to a consensus node, the key distribution agency, the data owner, the data accessor and the consensus node are jointly connected to a user administrator, the consensus node is connected to a blockchain, the data owner is connected to a cloud storage server, and the blockchain is connected to the cloud storage server;

[0038] Data owner, used to represent several data owner users. Data owner users store data on cloud storage servers, encrypt the index corresponding to the shared data using the public key and system encryption parameters, specify the access rights of data accessors, receive the public key of the data accessor through the user administrator, construct a re-encryption key, broadcast the encrypted index and re-encryption key to the blockchain network, and the re-encryption key is managed by the consensus node selected by the consensus algorithm. The encrypted index is stored in the blockchain;

[0039] Data accessors are used to represent several data owner users. They obtain the index information by decrypting the re-encrypted ciphertext obtained from the consensus node, the system decryption parameters obtained from the user administrator, and their own private keys, and then find the corresponding data on the cloud storage server through the index information.

[0040] Key distribution agency, used to represent the key distribution platform, used to generate trusted key pairs and distribute them to data owners and data accessors, and to produce system encryption parameters and system decryption parameters;

[0041] User administrators are used to manage the access rights list of data owners, verify the access rights of visitors, and return the final verification results to the consensus node. They are also used to interact with data owners to dynamically update data access rights. They are also used to send system decryption parameters to legitimate data visitors to obtain index plaintext.

[0042] Consensus nodes are used to represent nodes in the blockchain system that are selected by the consensus algorithm. For legitimate users, the original index ciphertext stored on the blockchain is re-encrypted using the re-encryption key uploaded by the data owner, and the re-encrypted index ciphertext is sent to the visitor.

[0043] Blockchain, for recording encrypted indexes and public verification;

[0044] The cloud storage server is used to store the plaintext of the data owner's user data, which corresponds one-to-one with the data index stored in the blockchain.

[0045] In a fourth aspect, an electronic device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0046] a memory storing a computer program;

[0047] The processor is used to implement the above-mentioned blockchain shared data access encryption method when executing the computer program stored in the memory.

[0048] In a fifth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned blockchain shared data access encryption method.

[0049] The present disclosure has at least the following beneficial effects:

[0050] The present disclosure proposes a blockchain system model based on on-chain and off-chain data storage. In the model, users store data in corresponding cloud storage servers, and the indexes corresponding to the data are encrypted and stored in the blockchain system. External nodes can obtain data stored on the cloud storage server through index information, thereby alleviating the data overload problem of the blockchain and improving the storage efficiency of the blockchain.

[0051] This disclosure uses a proxy re-encryption algorithm, which enables visitors to obtain corresponding data through their own keys without revealing their own private keys, thereby ensuring the privacy of transaction data and realizing controlled sharing of blockchain data. In the model, users can dynamically manage the permission list, and the administrator can maintain the permission list, add and delete visitors, thus realizing dynamic update of permission control.

[0052] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or be understood by implementing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures indicated in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 This is a schematic diagram of the encryption method flow in the embodiment of the present disclosure;

[0055] Figure 2 This is a schematic diagram of the access control system architecture according to an embodiment of the present disclosure;

[0056] Figure 3 This is a schematic diagram of data interaction in an embodiment of the present disclosure;

[0057] Figure 4 It is a structural diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0059] like Figure 1 As shown, a blockchain shared data access encryption method, the method comprising:

[0060] S101, the data owner encrypts the index information of the data to be accessed by using the user public key of the data owner to obtain an encrypted index for accessing the data, and stores the encrypted index on the blockchain through the consensus node, and the data to be accessed is stored in the cloud storage server;

[0061] S102, the data owner obtains a permission list for managing data access permissions by adding data access permissions, and submits the permission list to the user administrator for permission management;

[0062] S103, the data owner calculates a re-encryption key for re-encrypting the encrypted index according to the user public key of the data accessor, the system encryption parameter α and the user private key of the data owner, and hands the re-encryption key to the consensus node for management;

[0063] Among them, the consensus nodes are selected through the consensus algorithm of each node in the blockchain.

[0064] The specific implementation is as follows:

[0065] The system model involved in the present disclosure is that the data owner uses the on-chain and off-chain storage methods to store data, the blockchain stores the encrypted index information corresponding to the data, and the cloud server stores the data information of the data owner. The index information corresponds one-to-one with the data information stored by the data owner on the cloud server, and the visitor can find the corresponding data information by obtaining the index information.

[0066] The key distribution agency distributes key pairs to all users among data owners and data accessors. Data accessors send their own public keys to user administrators, and user administrators send public keys to data owners. Data owners encrypt index information with their own public keys and add data accessor permissions according to their own needs. At the same time, they calculate the re-encryption key based on the public key of the legitimate data accessor, the system encryption parameter α and their own private key, and then store the encrypted index on the blockchain. The re-encryption key is managed by the consensus node, and the corresponding data is stored in the cloud server under the chain. The permission list is managed by the user administrator. Among them, the consensus node is selected by each node in the blockchain through a consensus algorithm. The consensus algorithm adopts the consensus algorithm commonly used in the prior art. This disclosure does not involve the selection of the consensus algorithm, and no further explanation is given here.

[0067] When a data accessor wants to access the data owner's data, he sends a data access request to the user administrator, who verifies the accessor's authority. If the accessor is a legitimate user, the user administrator sends the verification result to the consensus node, which re-encrypts the encrypted index using the corresponding re-encryption key and sends the newly generated re-encrypted index to the data accessor. At the same time, the user administrator sends the system decryption parameters to the data accessor, who decrypts the re-encrypted index using the system decryption parameters and his own private key to obtain the plaintext of the index, and then obtains the corresponding data from the cloud server through the index to achieve data sharing. If the accessor is an illegal user, the user administrator will directly deny access and send the illegal accessor information to the consensus node. When the number of transactions reaches a certain level, the consensus node will upload the transaction information to the blockchain ledger for broadcast.

[0068] If the data owner wants to update the data accessor's permissions, he needs to send a request to the user administrator to add or delete. After receiving the request from the data owner, if the user administrator performs a new operation, the new accessor's public key will be sent to the data owner for calculating the re-encryption key. After that, the user administrator will update the permission list to achieve dynamic update of permission control. If a deletion operation is performed, the data owner will notify the consensus node to delete the corresponding re-encryption key, and notify the user administrator to delete the accessor's permissions in the permission list.

[0069] like Figure 2 As shown, a blockchain shared data access control system includes: a key distribution agency, the key distribution agency is connected to a data owner and a data accessor respectively, the data owner and the data accessor are jointly connected to a consensus node, the key distribution agency, the data owner, the data accessor and the consensus node are jointly connected to a user administrator, the consensus node is connected to a blockchain, the data owner is connected to a cloud storage server, and the blockchain is connected to the cloud storage server;

[0070] Data owner, used to represent several data owner users. Data owner users store data on cloud storage servers, encrypt the index corresponding to the shared data using the public key and system encryption parameters, specify the access rights of data accessors, receive the public key of the data accessor through the user administrator, construct a re-encryption key, broadcast the encrypted index and re-encryption key to the blockchain network, and the re-encryption key is managed by the consensus node selected by the consensus algorithm. The encrypted index is stored in the blockchain;

[0071] Data accessors are used to represent several data owner users. They obtain the index information by decrypting the re-encrypted ciphertext obtained from the consensus node, the system decryption parameters obtained from the user administrator, and their own private keys, and then find the corresponding data on the cloud storage server through the index information.

[0072] Key distribution agency, used to represent the key distribution platform, used to generate trusted key pairs and distribute them to data owners and data accessors, and to produce system encryption parameters and system decryption parameters;

[0073] User administrators are used to manage the access rights list of data owners, verify the access rights of visitors, and return the final verification results to the consensus node. They are also used to interact with data owners to dynamically update data access rights. They are also used to send system decryption parameters to legitimate data visitors to obtain index plaintext.

[0074] Consensus nodes are used to represent nodes in the blockchain system that are selected by the consensus algorithm. For legitimate users, the original index ciphertext stored on the blockchain is re-encrypted using the re-encryption key uploaded by the data owner, and the re-encrypted index ciphertext is sent to the visitor.

[0075] Blockchain, for recording encrypted indexes and public verification;

[0076] The cloud storage server is used to store the plaintext of the data owner's user data, which corresponds one-to-one with the data index stored in the blockchain.

[0077] The specific implementation is as follows:

[0078] System model such as Figure 2 As shown, it includes: data owner, data accessor, key distribution agency, user administrator, consensus node, blockchain, and cloud storage server.

[0079] Data owner: It is composed of user groups. The group users store data on the cloud server, encrypt the index corresponding to the shared data through the public key and system encryption parameters, specify the access rights of data visitors, and can decide to add and delete visitors. The public key of the data visitor is received through the user administrator, and the re-encryption key is constructed. The encrypted index and re-encryption key are broadcast to the blockchain network. The re-encryption key is managed by the consensus node selected by the consensus algorithm, and the encrypted index is stored in the blockchain.

[0080] Data accessor: Users who want to access the data owner's data need to obtain the plaintext of the encrypted index on the blockchain to find the corresponding data to be accessed. They obtain the index information by decrypting the re-encrypted ciphertext obtained from the consensus node, the system decryption parameters obtained from the user administrator and their own private key. Then, they find the corresponding data on the cloud storage server through the index information.

[0081] Key distribution agency: A trusted key distribution platform that distributes the generated trusted key pairs to data owners and data accessors, so that every user in the user group has their own public and private key pairs.

[0082] User administrator: A trusted administrator jointly elected by blockchain nodes, data owners, and data accessors. He manages the access rights list of data owners, verifies the access rights of accessors, returns the final verification results to the consensus node, interacts with data owners, and dynamically updates data access rights. Send system decryption parameters to legitimate data accessors to obtain index plaintext. For illegal users, reject user requests and send user information to the consensus node.

[0083] Consensus node: A node in the blockchain system selected by the consensus algorithm. For legitimate users, it uses the re-encryption key uploaded by the data owner to re-encrypt the original index ciphertext stored on the blockchain and sends the re-encrypted index ciphertext to the visitor. After a certain period of time, the transaction record is written into the blockchain ledger.

[0084] Blockchain: A data sharing platform with decentralized, traceable, and tamper-proof characteristics, enabling the entire system to implement secure integrity audits, public verification and other mechanisms.

[0085] Cloud storage server: provides users with a large amount of storage resources and more efficient computing power, stores the plain text of user data, and corresponds one-to-one with the data index stored in the blockchain.

[0086] Compared with the prior art, the disclosed technology optimizes the problem of blockchain storage data overload through on-chain and off-chain storage. Through proxy re-encryption, users can obtain corresponding data through their own keys without revealing their private keys, thereby ensuring the privacy of transaction data and realizing controlled sharing of blockchain data. It also allows data owners to dynamically manage visitor permissions and realize dynamic updates of permission control. There is an essential difference between the two, and the above-mentioned technical disclosure does not involve the technical content of this case.

[0087] A blockchain shared data access control method, the method comprising: using the above-mentioned blockchain shared data access encryption method to encrypt data;

[0088] When a data accessor wants to access the data owner's data, he / she sends a data request to the user administrator, who verifies the accessor's authority.

[0089] When the data accessor's permission verification is passed, the user administrator sends the permission verification result to the consensus node. The consensus node uses the re-encryption key to re-encrypt the encrypted index and sends the newly generated re-encrypted index to the data accessor. At the same time, the user administrator sends the system decryption parameters to the data accessor. The data accessor decrypts the re-encrypted index using the system decryption parameters and its own private key to obtain the plaintext of the encrypted index. The corresponding data is obtained from the cloud storage server through the plaintext of the encrypted index to achieve data sharing.

[0090] The specific implementation is as follows:

[0091] Key Distribution:

[0092] The key distribution agency generates key pairs for data owners and data accessors. For each user among the data owners, the corresponding key pair is: {(pk1,sk1),(pk2,sk2),...,(pk n ,sk n )}, for each user in the data accessor, the corresponding key pair is: {(pk A ,sk A ),(pk B ,sk B ),...,(pk N ,sk N )}, and generate a system key pair (α, β) at the same time, where α represents the system encryption parameter, which is managed by the data owner, and β is the system decryption parameter, which is managed by the user administrator.

[0093] Upload data information:

[0094] (1) Data index encryption upload,

[0095] Assume that the data stored by user 1 is F, and the corresponding index information is index1. The corresponding relationship between the index and the files stored on the cloud server is as follows: Figure 3 User 1 encrypts the index information index1 using its own public key pk1 to obtain the encrypted index User 1 uploads F to the corresponding cloud storage server and stores the encrypted index Broadcast on the blockchain.

[0096] (2) Re-encryption key generation,

[0097] The data accessor will use the public key {pk A ,pk B ,...,pk N} is sent to the user administrator. After receiving the public key, the user administrator sends the public key to the data owner (assuming user 1). User 1 controls the permissions of data accessors according to their own needs, and performs addition and deletion operations. After performing the corresponding operations, the corresponding permission list is handed over to the user administrator for management. The permission list is shown in Table 1. Assuming that user 1 allows user B among the data accessors to access the data, user 1 uses its own private key sk1 and user B's public key pk B And the system encryption parameter α constructs the re-encryption key rk for user B 1-B ={α,(sk1,pk B )}, then user 1 sends the re-encrypted key to the consensus node. The consensus node is the node selected by each node of the blockchain through the consensus algorithm. The consensus algorithm will not be discussed in detail here.

[0098] Table 1

[0099]

[0100] Data Access:

[0101] Assume that data accessor user B wants to access data F stored by user 1 on the cloud server.

[0102] First, user B sends an access request to the user administrator, who queries the permission list and sends the verification result of whether the user is legitimate to the consensus node.

[0103] If user B is a legitimate user, the user administrator will send the legitimate user information to the consensus node after receiving the access from user B. After obtaining the information of user B, the consensus node will generate the encrypted index that user B wants to access. The re-encryption key rk uploaded by user 1 1-B Perform re-encryption calculation to generate a new re-encryption index Re-encrypt the index at this time It is through user B's public key pk B and the system encryption parameter α. After the consensus node calculates, the re-encrypted index Send it to user B. At the same time, the user administrator sends the system decryption parameter β to user B. User B uses his own private key sk B and system decryption parameter β for re-encryption index After decryption calculation, the index plaintext index1 is obtained. After obtaining the index plaintext index1, user B finds the corresponding stored data file F in the cloud server according to the index information, and the data access is successful.

[0104] If user B is an illegal user, the user administrator will directly deny user B's access after receiving user B's access and send user B's information to the consensus node.

[0105] When the number of transactions reaches a certain level, the consensus node uploads the transaction information to the blockchain ledger for broadcasting.

[0106] Access User Authorization:

[0107] The data owner updates the authorization of the data accessor, and the final update result is maintained by the user administrator. The update operation mainly includes addition and deletion.

[0108] (1) Add new operations,

[0109] Suppose user 1 wants to add user C to his permission list. First, user C sends his public key pk to the user administrator. C , the user administrator receives the pk C After that, pk C Sent to user 1. User 1 uses his own private key sk1 and user C's public key pk C And the system encryption parameter α constructs the re-encryption key rk for user C 1-C ={α,(sk1,pk C )}. User 1 then sends the re-encryption key to the consensus node and notifies the user administrator to update the permission list.

[0110] (2) Delete operation,

[0111] Suppose user 1 wants to remove user C from his permission list. First, user 1 notifies the consensus node to delete the corresponding re-encryption key rk 1-C , then let the user administrator notify user C of the permission deletion, and let the user administrator delete user C's permissions in the permission list and update the permission list.

[0112] like Figure 4As shown, the present disclosure provides an electronic device, including a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402 and the memory 403 communicate with each other through the communication bus 404;

[0113] Memory 403, storing computer programs;

[0114] The processor 401 is used to implement the above-mentioned blockchain shared data access encryption method when executing the computer program stored in the memory 403.

[0115] The present disclosure provides a computer-readable storage medium storing a computer program, which implements the above-mentioned blockchain shared data access encryption method when executed by a processor.

[0116] The computer-readable storage medium may be included in the device / apparatus described in the above embodiment; or it may exist independently without being assembled into the device / apparatus. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0117] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0118] Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A blockchain shared data access encryption method, characterized in that: The method comprises: The data owner encrypts the index information of the data to be accessed with the data owner's user public key to obtain an encrypted index for accessing the data, and stores the encrypted index on the blockchain through the consensus node, while the data to be accessed is stored in the cloud storage server; The data owner obtains a permission list for managing data access permissions by adding data access permissions, and then hands the permission list over to the user administrator for permission management; The data owner calculates the re-encryption key used for re-encrypting the encrypted index based on the user public key of the data accessor, the system encryption parameter α, and the user private key of the data owner, and hands the re-encryption key to the consensus node for management; Among them, the consensus nodes are selected through the consensus algorithm of each node in the blockchain.

2. A blockchain shared data access encryption method according to claim 1, characterized in that: Also includes: The user public key of the data owner, the user private key of the data owner, the user public key of the data accessor, the user private key of the data accessor, the system encryption parameter α and the system decryption parameter β are generated and distributed by the key distribution agency; The key distribution agency generates a key pair for the data owner. For each user among the data owners, the corresponding key pair is: {(pk1,sk1),(pk2,sk2),...,(pk n ,sk n )}, n is the number of users among the data owners; pk n is the user public key of the data owner, sk n The user private key of the data owner; The key distribution agency generates a key pair for the data accessor. For each user among the data accessors, the corresponding key pair is: {(pk A ,sk A ),(pk B ,sk B ),...,(pk N ,sk N )}, N is the number of users among the data visitors; pk N is the user public key in the data accessor, sk N The user's private key in the data accessor; The key distribution agency generates a system key pair (α, β), where α represents the system encryption parameter, which is managed by the data owner, and β represents the system decryption parameter, which is managed by the user administrator.

3. A blockchain shared data access encryption method according to claim 1, characterized in that: Also includes: The user public key of the data accessor is transmitted from the data accessor to the data owner through the user administrator.

4. A blockchain shared data access control method, characterized in that: The method comprises: using a blockchain shared data access encryption method as described in any one of claims 1 to 3 to encrypt data; When a data accessor wants to access the data owner's data, he / she sends a data request to the user administrator, who verifies the accessor's authority. When the data accessor's permission verification is passed, the user administrator sends the permission verification result to the consensus node. The consensus node uses the re-encryption key to re-encrypt the encrypted index and sends the newly generated re-encrypted index to the data accessor. At the same time, the user administrator sends the system decryption parameters to the data accessor. The data accessor decrypts the re-encrypted index using the system decryption parameters and its own private key to obtain the plaintext of the encrypted index. The corresponding data is obtained from the cloud storage server through the plaintext of the encrypted index to achieve data sharing.

5. A blockchain shared data access control method according to claim 4, characterized in that: Also includes: When the data accessor's permission verification fails, the user administrator will directly deny access and send the illegal data accessor information to the consensus node; when the transaction reaches the quantity threshold, the consensus node will upload the transaction information to the blockchain ledger for broadcast.

6. A blockchain shared data access control method according to claim 4, characterized in that: When the data accessor passes the permission verification, the user administrator sends the permission verification result to the consensus node. The consensus node re-encrypts the encrypted index using the re-encryption key and sends the newly generated re-encrypted index to the data accessor. At the same time, the user administrator sends the system decryption parameter to the data accessor. The data accessor decrypts the re-encrypted index using the system decryption parameter and its own private key to obtain the plaintext of the encrypted index, including: When data access user B wants to access data F stored by user 1 on the cloud storage server, and user B passes the permission verification, the consensus node obtains user B's information through the user administrator; After obtaining the information of user B, the consensus node generates an encrypted index corresponding to the data F that user B wants to access. The re-encryption key rk uploaded by user 1 1-B Perform re-encryption calculation to generate a new re-encryption index Re-encrypt index The public key pk of user B B Encrypted with system encryption parameter α; The consensus node will re-encrypt the index Send to user B, and the user administrator sends the system decryption parameter β to user B; User B uses his own private key sk B and system decryption parameter β for re-encryption index Perform decryption calculation to obtain the encrypted index plaintext index1.

7. A blockchain shared data access control method according to claim 4, characterized in that: Also includes: The data owner performs the authorized operation of the data accessor and sends the final update result to the user administrator.

8. A blockchain shared data access control method according to claim 7, characterized in that: Update operations include add operations and delete operations.

9. A blockchain shared data access control method according to claim 8, characterized in that: New operations, including: When data owner user 1 wants to add data accessor user C to his permission list, user C sends his public key pk to the user administrator. C ; After receiving the pk C After that, pk C Send to user 1; User 1 uses his private key sk1 and user C's public key pk C And the system encryption parameter α constructs the re-encryption key rk for user C 1-C ={α,(sk1,pk C )}; User 1 sends the re-encryption key to the consensus node and notifies the user administrator to update the permission list.

10. A blockchain shared data access control method according to claim 8, characterized in that: Deletion operations include: When user 1 wants to delete user C from his permission list, user 1 notifies the consensus node to delete the corresponding re-encryption key rk 1-C , then let the user administrator notify user C of the permission deletion, and let the user administrator delete user C's permissions in the permission list and update the permission list.

11. A blockchain shared data access control system, characterized in that: include: Key distribution agency, the key distribution agency is connected to the data owner and the data accessor respectively, the data owner and the data accessor are jointly connected to the consensus node, the key distribution agency, the data owner, the data accessor and the consensus node are jointly connected to the user administrator, the consensus node is connected to the blockchain, the data owner is connected to the cloud storage server, and the blockchain is connected to the cloud storage server; Data owner, used to represent several data owner users. Data owner users store data on cloud storage servers, encrypt the index corresponding to the shared data using the public key and system encryption parameters, specify the access rights of data accessors, receive the public key of the data accessor through the user administrator, construct a re-encryption key, broadcast the encrypted index and re-encryption key to the blockchain network, and the re-encryption key is managed by the consensus node selected by the consensus algorithm. The encrypted index is stored in the blockchain; Data accessors are used to represent several data owner users. They obtain the index information by decrypting the re-encrypted ciphertext obtained from the consensus node, the system decryption parameters obtained from the user administrator, and their own private keys, and then find the corresponding data on the cloud storage server through the index information. Key distribution agency, used to represent the key distribution platform, used to generate trusted key pairs and distribute them to data owners and data accessors, and to produce system encryption parameters and system decryption parameters; User administrators are used to manage the access rights list of data owners, verify the access rights of visitors, and return the final verification results to the consensus node. They are also used to interact with data owners to dynamically update data access rights. It is also used to send system decryption parameters to legitimate data accessors to obtain index plaintext; Consensus nodes are used to represent nodes in the blockchain system that are selected by the consensus algorithm. For legitimate users, the original index ciphertext stored on the blockchain is re-encrypted using the re-encryption key uploaded by the data owner, and the re-encrypted index ciphertext is sent to the visitor. Blockchain, for recording encrypted indexes and public verification; The cloud storage server is used to store the plaintext of the data owner's user data, which corresponds one-to-one with the data index stored in the blockchain.

12. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; a memory storing a computer program; A processor, for implementing a blockchain shared data access encryption method as described in any one of claims 1 to 3 when executing a computer program stored in a memory.

13. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a blockchain shared data access encryption method according to any one of claims 1 to 3 is implemented.

Images