A data sharing method, apparatus, computing device, and storage medium

Abstract

The application provides a data sharing method and device, a computing device and a storage medium, comprising: a data owner determining primary encrypted ciphertext, a first re-encryption key and a second re-encryption key; the data owner selecting a computing agent and at least two auxiliary agents, and sending the primary encrypted ciphertext and the second re-encryption key to the computing agent, and distributing the first re-encryption key to the at least two auxiliary agents after being cut into pieces; the computing agent and the at least two auxiliary agents both complete the computing process of a verifiable delay function, and the computing results are both verified; the computing agent is used for re-encrypting the primary encrypted ciphertext according to the second re-encryption key, and sending the re-encrypted re-encryption ciphertext to a data user; the auxiliary agent is used for sending the first re-encryption key cut into pieces to the data user; the data user obtains to-be-shared data; the scheme reduces the computing cost of the identity authentication link of the data owner, and enhances the expansibility of the agent node.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data sharing method and device, computing equipment and storage medium. BACKGROUND

[0002] In the field of data sharing, data owners expect to share encrypted data with data users through a cloud platform, and this process cannot be known by the cloud platform. The traditional method is that the data owner encrypts the data to be shared using the public key of the data user, and uploads the encrypted ciphertext to the cloud platform; the data user obtains the encrypted ciphertext through the cloud platform, and decrypts the ciphertext using the private key of the user to obtain the data to be shared. In this process, when a large number of data users request to share data, since the encryption process is completed by the data owner, a large number of ciphertext copies will occupy the storage space locally on the data owner; moreover, a large number of encryption operations increase the computing and communication overheads of the data owner.

[0003] The prior art overcomes the problems of the data owner in the traditional method by setting a proxy, that is, the encryption process is completed by the proxy node, and the specific process is as follows: the data owner sends the data to be shared to the proxy node after initial encryption; when there is a data user requesting to share data, the data owner receives the public key of the data user and sets a re-encryption key according to the public key of the data user, and sends the re-encryption key to the proxy node; the proxy node re-encrypts the initial encrypted ciphertext after receiving the re-encryption key, and the data receiver decrypts the re-encrypted ciphertext to obtain the data to be shared. In this process, the encryption process is completed by the proxy node, a large number of ciphertext copies exist in the proxy node, and the computing and communication overheads of the encryption operation are borne by the proxy node, thereby reducing the storage space and computing overheads of the data owner.

[0004] However, in the cloud service scenario, the proxy node may frequently exit and join due to cost control considerations. In order to prevent attackers from pretending to be proxy nodes, the data owner needs to perform strong identity authentication on the joining and exiting of each proxy node, which to some extent increases the computing overheads of the data owner in the identity authentication link and limits the expandability of the proxy node.

[0005] Therefore, how to reduce the computing overheads of the data owner in the identity authentication link and enhance the expandability of the proxy node while ensuring the security of data sharing remains to be solved. SUMMARY

[0006] The present application provides a data sharing method and device, computing equipment and storage medium, which can reduce the computing overheads of the data owner in the identity authentication link and enhance the expandability of the proxy node while ensuring the security of data sharing.

[0007] In a first aspect, an embodiment of the present application provides a data sharing method, which can be executed by a data sharing device. The data sharing device can be a terminal device or a module for the terminal device, or a server or a module for the server. The present application does not limit the execution subject of the method. The method comprises the following steps: a data owner determines a primary encrypted ciphertext, a first re-encryption key and a second re-encryption key; the primary encrypted ciphertext is a ciphertext obtained by the data owner after encrypting to-be-shared data; the first re-encryption key is determined by the data owner according to a public key of a data user; the second re-encryption key is determined by the data owner according to a private key of the data owner; the data owner selects a computing agent and at least two auxiliary agents, and sends the primary encrypted ciphertext and the second re-encryption key to the computing agent, and distributes the first re-encryption key to the at least two auxiliary agents after being sliced; the computing agent and the at least two auxiliary agents both complete a verifiable delay function (VDF) calculation process, and the calculation results of the computing agent and the at least two auxiliary agents both pass the verification; the computing agent is configured to re-encrypt the primary encrypted ciphertext according to the received second re-encryption key, and send the re-encrypted re-encryption ciphertext to the data user; the auxiliary agent is configured to send the received first re-encryption key slice to the data user; and the data user is configured to obtain the to-be-shared data according to the received re-encryption ciphertext and the first re-encryption key.

[0008] In the above scheme, on the one hand, the data owner sends the primary encrypted ciphertext, the first re-encryption key and the second re-encryption key to different agent nodes respectively, and an attacker must simultaneously pretend to be a data receiver, master enough agent nodes, and complete sufficient VDF calculation capacity and delay to obtain the to-be-shared data, thereby increasing the security of data sharing; on the other hand, each agent node does not need to perform complex identity authentication with the data owner, and only needs to provide VDF calculation capacity and re-encryption calculation capacity, thereby reducing the authentication overhead of the data owner on the agent node; on the other hand, the agent node does not need to frequently perform complex identity authentication with the data owner, and only needs to have VDF calculation capacity, thereby enhancing the expansibility of the agent node.

[0009] In a possible implementation, the data owner determines a number of times of computation of the verifiable delay function corresponding to the data to be shared, and writes the number of times of computation into a data tag contract; the data tag contract is used to obtain the number of times of computation by a plurality of agents; wherein a computation process of the verifiable delay function is performed by each agent in a corresponding blockchain according to the number of times of computation and a blockchain identifier corresponding to each agent; a computation duration of the verifiable delay function performed by each agent according to the number of times of computation is greater than a block generation frequency of the blockchain; the data owner obtains computation results of the verifiable delay function performed by the plurality of agents, and determines a preselected agent according to the computation results of the plurality of agents; the preselected agent refers to an agent node whose computation result of the verifiable delay function passes verification and whose block height at which the computation process of the verifiable delay function is performed is located in an executable interval; the executable interval refers to a block height used to perform the computation process of the verifiable delay function submitted by the plurality of agents to the data owner before the computation process of the verifiable delay function is performed; the number of the preselected agents is a positive integer greater than 3; and the data owner selects a computation agent and at least two auxiliary agents from the preselected agents.

[0010] The foregoing scheme can accurately and effectively determine the computation agent and the at least two auxiliary agents.

[0011] In a possible implementation, for any agent of the preselected agents, if a difference between a hash value of a blockchain identifier corresponding to the agent and an aggregated hash value is the smallest, the agent is determined to be the computation agent; the aggregated hash value is a hash value obtained by aggregating a random token corresponding to the preselected agent and a current block height of the blockchain; and at least two agents are selected as the auxiliary agents from the preselected agents except the computation agent.

[0012] The foregoing scheme can accurately and effectively determine the computation agent.

[0013] In a possible implementation, the data owner splits the first re-encryption key into N slices; wherein N is a positive integer, and N is less than half of the number of auxiliary agents; the data owner sends the N slices to the at least two auxiliary agents respectively, and determines a slice number corresponding to each auxiliary agent; and the data owner sends the slice number corresponding to each auxiliary agent to the data user.

[0014] The foregoing scheme redundantly sends the first re-encryption key to the auxiliary agents, thereby reducing a risk of data transmission failure in a case where the auxiliary agents fail.

[0015] In a possible implementation, a data owner calls a sharing request contract to record a data sharing request, the data sharing request including a storage link of data to be shared and an identifier of a data user; the sharing request contract is used to record each data sharing request; the data owner returns the initial encryption ciphertext of the storage link of the data to be shared according to record information returned by the sharing request contract; the data owner determines the first re-encryption key according to the record information and a public key of the data user; the data owner determines the second re-encryption key according to the record information and a private key of the data owner; and the public key of the data user is determined according to the identifier of the data user.

[0016] The above scheme can accurately and effectively determine the initial encryption ciphertext, the first re-encryption key and the second re-encryption key; the first re-encryption key includes the public key of the data user and the record information returned by the sharing request contract, the second re-encryption key includes the private key of the data owner and the record information returned by the sharing request contract, and an attacker must obtain two pairs of keys of the owner and the receiver of single data sharing and record information of single data sharing to obtain the data to be shared, thereby increasing the security of data sharing.

[0017] In a possible implementation, the data owner obtains record information returned by the sharing request contract; the record information includes a transaction identifier and a record block height; the transaction identifier is used to indicate a transaction hash value of the sharing request contract successfully chaining the data sharing request; the record block height refers to a height of a block recording the data sharing request on a blockchain; the data owner determines a public key and a private key of the data owner according to the transaction identifier, the record block height and a blockchain identifier corresponding to the data owner; and the data owner performs initial encryption on the storage link of the data to be shared according to the public key corresponding to the data owner, to obtain the initial encryption ciphertext.

[0018] The above scheme can accurately and effectively determine the initial encryption ciphertext, and the public key and the private key of the data owner are different in each data sharing request, thereby improving the security of the initial encryption ciphertext.

[0019] In a possible implementation, the data owner inputs the transaction identifier and the record block height into a first hash function to obtain a first hash value; the output of the first hash function is an element in an additive cyclic group; the sum of any two elements in the additive cyclic group is also in the additive cyclic group; the first hash value is in the additive cyclic group; the data owner inputs a blockchain identifier corresponding to the data owner into the first hash function to obtain a second hash value; the second hash value is in the additive cyclic group; and the data owner determines a public key and a private key of the data owner according to the first hash value, the second hash value, and a first element; the first element is an element selected by the data owner from the additive cyclic group.

[0020] The above scheme can accurately and effectively determine the public key and the private key of the data owner, and the public key and the private key of the data owner are different each time a data sharing request is made, thereby improving the security of the initial encryption ciphertext.

[0021] In a possible implementation, the data owner obtains a public key of the data user; the public key of the data user is determined by the data user according to the first hash value and a blockchain identifier corresponding to the data user; the data owner selects a second element from a multiplicative cyclic group; the product of any two elements in the multiplicative cyclic group is in the multiplicative cyclic group; the product of any two elements in the multiplicative cyclic group is also in the multiplicative cyclic group; and the data owner determines the first re-encryption key according to the public key corresponding to the data user, the first element, and the second element.

[0022] The above scheme can accurately and effectively determine the first re-encryption key, and the first re-encryption key is different for different data to be shared, thereby improving the security of the first re-encryption key.

[0023] In a possible implementation, the data owner inputs the second element into a second hash function to obtain a third hash value; the second hash function is used to map an element in the multiplicative cyclic group to the additive cyclic group; and the data owner determines the second re-encryption key according to the private key corresponding to the data owner, the first element, and the third hash value.

[0024] The above scheme can accurately and effectively determine the second re-encryption key, and the second re-encryption key is different for different data to be shared, thereby improving the security of the second re-encryption key.

[0025] In a second aspect, the embodiments of the present application provide a data sharing method, which can be executed by a data sharing device, the data sharing device can be a terminal device or a module for the terminal device, or a server or a module for the server. The present application does not limit the execution subject of the method. The method comprises: an agent node obtains a calculation number of a verifiable delay function corresponding to to-be-shared data through a data marking contract; the agent node executes a calculation process of the verifiable delay function according to the calculation number and a blockchain identifier corresponding to the agent node; wherein the calculation duration of the agent node in executing the verifiable delay function according to the calculation number is greater than the block generation frequency of the blockchain; the agent node sends a calculation result of the verifiable delay function and a block height of the calculation process of the verifiable delay function; the calculation result and the block height of the calculation process are used by a data owner to determine the agent type of the agent node; the agent node determines the agent type of itself and processes the corresponding information of the to-be-shared data according to the agent type of itself.

[0026] In the above scheme, on the one hand, the agent node needs to complete the calculation process of the verifiable delay function, and the calculation process of the verifiable delay function is usually long, thus reducing the possibility of an attacker disguising as an agent node, and thus reducing the possibility of the attacker obtaining the to-be-shared data; on the other hand, the agent node does not need to frequently perform complex identity authentication with the data owner, and only needs to have the VDF calculation capability, thus enhancing the expansibility of the agent node.

[0027] In a possible implementation method, the agent node obtains a transaction identifier corresponding to the to-be-shared data; the transaction identifier is a transaction hash value obtained after the data owner successfully chains a data sharing request by calling a sharing request contract; the sharing request contract is used to record each data sharing request; and the agent node executes the calculation process of the verifiable delay function according to the transaction identifier, the calculation number, and the blockchain identifier corresponding to the agent node.

[0028] In the above scheme, the agent node can accurately and effectively execute the calculation process of the verifiable delay function; and the calculation process is related to the blockchain identifier corresponding to each agent node, thus preventing the agent nodes from colluding to plagiarize the calculation result.

[0029] In a possible implementation method, if the agent node determines that the agent type of itself is a calculation agent, the agent node receives a primary encryption ciphertext and a second re-encryption key sent by the data owner; the primary encryption ciphertext is a ciphertext obtained after the data owner performs primary encryption on the to-be-shared data; the second re-encryption key is determined by the data owner according to a private key of the data owner; and the agent node re-encrypts the primary encryption ciphertext according to the second re-encryption key and sends the re-encrypted re-encryption ciphertext to a data user.

[0030] The scheme can accurately and effectively re-encrypt the primary encrypted ciphertext according to the second re-encryption key.

[0031] In a possible implementation, the proxy node receives the first primary encrypted ciphertext shard, the second primary encrypted ciphertext shard and the second re-encryption key sent by the data owner; the first primary encrypted ciphertext shard and the second primary encrypted ciphertext shard are obtained after the primary encrypted ciphertext shard; the proxy node re-encrypts the primary encrypted ciphertext according to the second re-encryption key, and sends the re-encrypted re-encrypted ciphertext to the data user, including: the proxy node re-encrypts the second primary encrypted ciphertext shard according to the second re-encryption key to obtain a re-encrypted ciphertext shard; the proxy node sends the first primary encrypted ciphertext shard and the re-encrypted ciphertext shard to the data user.

[0032] The scheme shards the primary encrypted ciphertext, and the attacker must obtain the first primary encrypted ciphertext shard and the re-encrypted ciphertext shard at the same time to obtain the data to be shared, further increasing the security of the data to be shared.

[0033] In a possible implementation, if the proxy node determines that the proxy type of the proxy node is an auxiliary proxy, the proxy node receives the first re-encryption key slice sent by the data owner; the first re-encryption key is determined by the data owner according to the public key of the data user; and the proxy node sends the first re-encryption key slice to the data user.

[0034] The scheme can accurately and effectively send the first re-encryption key slice to the data user.

[0035] In a possible implementation, the proxy node determines a random token and an executable interval, and submits the random token and the executable interval to the data owner; the executable interval refers to the block height submitted by the proxy node to the data owner for executing the calculation process of the verifiable delay function before the proxy node executes the calculation process of the verifiable delay function; and the random token is used by the data owner to determine the proxy type of the proxy node.

[0036] The scheme can enable the data owner to accurately and effectively determine the validity and type of the proxy node by submitting the random token and the executable interval to the data owner by the proxy node.

[0037] In a possible implementation, the random token and / or the executable interval are updated periodically.

[0038] The scheme can increase the trustworthiness of the proxy node.

[0039] In a third aspect, an embodiment of the present application provides a data sharing method, which can be executed by a data sharing device, which can be a terminal device or a module for a terminal device, or a server or a module for a server. The present application does not limit the execution subject of the method. The method comprises the following steps: a data receiver receives a first re-encryption key slice sent by a plurality of auxiliary agents; the first re-encryption key is determined by a data owner according to a public key of a data user; the data receiver receives a re-encryption ciphertext sent by a computing agent; the re-encryption ciphertext is obtained by the computing agent by re-encrypting a primary encryption ciphertext according to a second re-encryption key; the primary encryption ciphertext is obtained by the data owner by performing primary encryption on to-be-shared data; the second re-encryption key is determined by the data owner according to a private key of the data owner; the data receiver receives a slice number corresponding to each auxiliary agent sent by the data owner; the data receiver reorganizes a plurality of first re-encryption key slices according to the slice number corresponding to each auxiliary agent, to obtain the first re-encryption key; and the data receiver decrypts the re-encryption ciphertext according to the first re-encryption key, to obtain the to-be-shared data.

[0040] In the above scheme, on the one hand, the data user respectively acquires the first re-encryption key slice and the re-encryption ciphertext, and an attacker must simultaneously pretend to be the data receiver, master sufficient agent nodes, and complete sufficient VDF computing capacity and delay, to possibly acquire the to-be-shared data, thereby increasing the security of data sharing; on the other hand, the data user can accurately and effectively acquire the first re-encryption key according to the slice number corresponding to each auxiliary agent, and then decrypt the re-encryption ciphertext according to the first re-encryption key, to accurately and effectively obtain the to-be-shared data.

[0041] In a possible implementation method, the data receiver receives a first primary encryption ciphertext slice and a re-encryption ciphertext slice sent by the computing node; the first primary encryption ciphertext slice and a second primary encryption ciphertext slice are obtained by the computing node by performing encryption on the primary encryption ciphertext slice; and the re-encryption ciphertext slice is obtained by the agent node by re-encrypting the second primary encryption ciphertext slice according to the second re-encryption key.

[0042] In the above scheme, the primary encryption ciphertext is divided into slices, and an attacker must simultaneously acquire the first primary encryption ciphertext slice and the re-encryption ciphertext slice to possibly acquire the to-be-shared data, thereby further increasing the security of the to-be-shared data.

[0043] In a possible implementation, the data receiver determines a second element according to the first primary encrypted ciphertext slice, a private key corresponding to the data receiver, and the first re-encryption key; the second element is an optional element in a multiplicative cyclic group; the data receiver obtains the data to be shared according to the second element, a second hash function, the first primary encrypted ciphertext slice, and the re-encrypted ciphertext slice; the second hash function is used to map an element in the multiplicative cyclic group to an additive cyclic group; a result of addition of any two elements in the additive cyclic group is still in the additive cyclic group; and a result of multiplication of any two elements in the additive cyclic group is in the multiplicative cyclic group.

[0044] The above scheme can accurately and effectively decrypt the data to be shared.

[0045] In a fourth aspect, an embodiment of the present application provides a data sharing apparatus, which comprises a determination unit and a selection unit. The determination unit is configured to determine a primary encrypted ciphertext, a first re-encryption key, and a second re-encryption key; the primary encrypted ciphertext is ciphertext obtained by encrypting data to be shared by a data owner; the first re-encryption key is determined by the data owner according to a public key of a data user; and the second re-encryption key is determined by the data owner according to a private key of the data owner. The selection unit is configured to select a computing agent and at least two auxiliary agents, and send the primary encrypted ciphertext and the second re-encryption key to the computing agent, and distribute the first re-encryption key to the at least two auxiliary agents after slicing; the computing agent and the at least two auxiliary agents both complete a computation process of a verifiable delay function, and the computation results of the computing agent and the at least two auxiliary agents both pass verification; the computing agent is configured to re-encrypt the primary encrypted ciphertext according to the received second re-encryption key, and send the re-encrypted re-encrypted ciphertext to the data user; the auxiliary agent is configured to send the received first re-encryption key slice to the data user; and the data user is configured to obtain the data to be shared according to the received re-encrypted ciphertext and the first re-encryption key.

[0046] In a possible implementation, the determining unit is configured to determine a number of times of calculation of the verifiable delay function corresponding to the data to be shared, and write the number of times of calculation into a data tag contract; the data tag contract is configured to enable a plurality of agents to obtain the number of times of calculation; wherein a calculation process of the verifiable delay function is performed by each agent in a corresponding blockchain according to the number of times of calculation and a blockchain identifier corresponding to each agent; a calculation duration of the verifiable delay function performed by each agent according to the number of times of calculation is greater than a block generation frequency of the blockchain; the data owner obtains a calculation result of the verifiable delay function performed by the plurality of agents, and determines a preselected agent according to the calculation result of the plurality of agents; the preselected agent refers to an agent node that passes a verification of the calculation result of the verifiable delay function and whose block height in the calculation process of the verifiable delay function is located in an executable interval; the executable interval refers to a block height submitted by the plurality of agents to the data owner before performing the calculation process of the verifiable delay function; the number of preselected agents is a positive integer greater than 3; and the selecting unit is configured to select a calculation agent and at least two auxiliary agents from the preselected agents.

[0047] In a possible implementation, the determining unit is configured to determine, for any agent of the preselected agents, that the agent is a calculation agent if a difference between a hash value of a blockchain identifier corresponding to the agent and an aggregated hash value is the smallest; the aggregated hash value is a hash value obtained by aggregating a random token corresponding to the preselected agents and a current block height of a blockchain; and the selecting unit is configured to select at least two agents from the preselected agents other than the calculation agent as auxiliary agents.

[0048] In a possible implementation, the apparatus further includes a splitting unit and a transceiving unit. The splitting unit is configured to split the first re-encryption key into N slices; N is a positive integer, and N is less than half of the number of auxiliary agents; the transceiving unit is configured to send the N slices to the at least two auxiliary agents respectively, and determine a slice number corresponding to each auxiliary agent; and the transceiving unit is configured to send the slice number corresponding to each auxiliary agent to the data user.

[0049] In a possible implementation, the determining unit is configured to invoke a sharing request contract to record a data sharing request, the data sharing request comprising a storage link of to-be-shared data and an identifier of a data user; the sharing request contract is configured to record each data sharing request; the data owner performs initial encryption on the storage link of the to-be-shared data according to record information returned by the sharing request contract to obtain the initial encryption ciphertext; the data owner determines the first re-encryption key according to the record information and a public key of the data user; the data owner determines the second re-encryption key according to the record information and a private key of the data owner; and the public key of the data user is determined according to the identifier of the data user.

[0050] In a possible implementation, the transceiving unit is configured to obtain record information returned by the sharing request contract; the record information comprises a transaction identifier and a record block height; the transaction identifier is used to indicate a transaction hash value of a transaction in which the sharing request contract successfully chains the data sharing request; and the record block height refers to a height of a block in which the data sharing request is recorded on a blockchain. The determining unit is configured to determine a public key and a private key of the data owner according to the transaction identifier, the record block height, and a blockchain identifier corresponding to the data owner; and the data owner performs initial encryption on the storage link of the to-be-shared data according to the public key corresponding to the data owner to obtain the initial encryption ciphertext.

[0051] In a possible implementation, the determining unit is configured to input the transaction identifier and the record block height into a first hash function to obtain a first hash value; an output of the first hash function is an element in an additive cyclic group; a result of addition of any two elements in the additive cyclic group is still located in the additive cyclic group; the first hash value is located in the additive cyclic group; the data owner inputs a blockchain identifier corresponding to the data owner into the first hash function to obtain a second hash value; the second hash value is located in the additive cyclic group; the data owner determines the public key and the private key of the data owner according to the first hash value, the second hash value, and a first element; and the first element is an element selected at will by the data owner from the additive cyclic group.

[0052] In a possible implementation, the transceiver is configured to obtain the public key of the data user; the public key of the data user is determined by the data user according to the first hash value and the blockchain identifier corresponding to the data user; the determination unit is configured to select an optional element in the multiplicative cyclic group as a second element; the product of any two elements in the multiplicative cyclic group is in the multiplicative cyclic group; the product of any two elements in the multiplicative cyclic group is still in the multiplicative cyclic group; and the data owner determines the first re-encryption key according to the public key corresponding to the data user, the first element, and the second element.

[0053] In a possible implementation, the determination unit is configured to input the second element into a second hash function to obtain a third hash value; the second hash function is configured to map an element in the multiplicative cyclic group to the additive cyclic group; and the data owner determines the second re-encryption key according to the private key corresponding to the data owner, the first element, and the third hash value.

[0054] In a fifth aspect, an embodiment of the present application provides a data sharing apparatus, including a transceiver and a processing unit. The processing unit is configured to obtain a calculation number of a verifiable delay function corresponding to to-be-shared data through a data marking contract; perform a calculation process of the verifiable delay function according to the calculation number and a blockchain identifier corresponding to the proxy node; wherein the calculation duration of the verifiable delay function performed by the proxy node according to the calculation number is greater than the block generation frequency of the blockchain; determine the proxy type of the proxy node, and process the corresponding information of the to-be-shared data according to the proxy type of the proxy node; the transceiver is configured to send a calculation result of the verifiable delay function and a block height of the calculation process of the verifiable delay function; and the calculation result and the block height of the calculation process are used by a data owner to determine the proxy type of the proxy node.

[0055] In a possible implementation, the transceiver is configured to obtain a transaction identifier corresponding to the to-be-shared data; the transaction identifier is a transaction hash value obtained after a data sharing request of the data owner is successfully chained by calling a sharing request contract; and the sharing request contract is configured to record each data sharing request. The processing unit is configured to perform a calculation process of the verifiable delay function according to the transaction identifier, the calculation number, and the blockchain identifier corresponding to the proxy node.

[0056] In a possible implementation, if the proxy node determines that the proxy type of the proxy node is a computing proxy, the transceiver is configured to receive the first encrypted ciphertext and the second re-encryption key sent by the data owner; the first encrypted ciphertext is a ciphertext obtained by performing first encryption on the data to be shared by the data owner; the second re-encryption key is determined by the data owner according to a private key of the data owner; and the processing unit is configured to perform re-encryption on the first encrypted ciphertext according to the second re-encryption key, and send the re-encrypted re-encryption ciphertext to the data user.

[0057] In a possible implementation, the transceiver is configured to receive the first encrypted ciphertext fragment, the second encrypted ciphertext fragment, and the second re-encryption key sent by the data owner; the first encrypted ciphertext fragment and the second encrypted ciphertext fragment are obtained by performing first encryption on the first encrypted ciphertext; the processing unit is configured to perform re-encryption on the second encrypted ciphertext fragment according to the second re-encryption key, to obtain a re-encrypted ciphertext fragment; and the transceiver is configured to send the first encrypted ciphertext fragment and the re-encrypted ciphertext fragment to the data user.

[0058] In a possible implementation, if the proxy node determines that the proxy type of the proxy node is an auxiliary proxy, the transceiver is configured to receive the first re-encryption key sent by the data owner; the first re-encryption key is determined by the data owner according to a public key of the data user; and the transceiver is configured to send the first re-encryption key to the data user.

[0059] In a possible implementation, the processing unit is configured to determine a random token and an executable interval, and submit the random token and the executable interval to the data owner; the executable interval refers to a block height submitted by the proxy node to the data owner for performing a calculation process of a verifiable delay function before the proxy node performs the calculation process of the verifiable delay function; and the random token is used by the data owner to determine the proxy type of the proxy node.

[0060] In a possible implementation, the processing unit is configured to periodically update the random token and / or the executable interval.

[0061] In a sixth aspect, an embodiment of the present application provides a data sharing device, comprising: a transceiving unit and a decryption unit. The transceiving unit is configured to receive a plurality of first re-encryption key slices sent by a plurality of auxiliary agents; the first re-encryption key is determined by a data owner according to a public key of a data user; receive re-encryption ciphertext sent by a computing agent; the re-encryption ciphertext is obtained by the computing agent by re-encrypting primary encryption ciphertext according to a second re-encryption key; the primary encryption ciphertext is obtained by the data owner by performing primary encryption on to-be-shared data; the second re-encryption key is determined by the data owner according to a private key of the data owner; and receive a slice number corresponding to each auxiliary agent sent by the data owner. The decryption unit is configured to recombine the plurality of first re-encryption key slices according to the slice number corresponding to each auxiliary agent to obtain the first re-encryption key; and decrypt the re-encryption ciphertext according to the first re-encryption key to obtain the to-be-shared data.

[0062] In a possible implementation method, the transceiving unit is configured to receive a first primary encryption ciphertext slice and a re-encryption ciphertext slice sent by the computing node; the first primary encryption ciphertext slice and a second primary encryption ciphertext slice are obtained by the computing node by performing encryption on the primary encryption ciphertext slice; and the re-encryption ciphertext slice is obtained by the agent node by re-encrypting the second primary encryption ciphertext slice according to the second re-encryption key.

[0063] In a possible implementation method, the decryption unit is configured to determine a second element according to the first primary encryption ciphertext slice, a private key corresponding to the data receiver, and the first re-encryption key; the second element is an optional element in a multiplicative cyclic group; the data receiver obtains the to-be-shared data according to the second element, a second hash function, the first primary encryption ciphertext slice, and the re-encryption ciphertext slice; the second hash function is used to map an element in the multiplicative cyclic group to an additive cyclic group; a result of addition of any two elements in the additive cyclic group is still in the additive cyclic group; and a result of multiplication of any two elements in the additive cyclic group is in the multiplicative cyclic group.

[0064] In a seventh aspect, an embodiment of the present application further provides a computing device, comprising:

[0065] a memory configured to store program instructions;

[0066] a processor configured to invoke the program instructions stored in the memory, and execute any method of the first aspect, or any method of the second aspect, or any method of the third aspect according to the obtained program instructions.

[0067] In an eighth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores computer readable instructions. When a computer reads and executes the computer readable instructions, any method of the first aspect, or any method of the second aspect, or any method of the third aspect is implemented.

[0068] In a ninth aspect, the embodiments of the present application provide a computer program product, which comprises a computer program executable by a computer device. When the program is executed on the computer device, the computer device executes any method of the first aspect, or any method of the second aspect, or any method of the third aspect. BRIEF DESCRIPTION OF DRAWINGS

[0069] Figure 1 A flowchart of a verifiable delay function provided by the embodiments of the present application;

[0070] Figure 2 A system architecture diagram of a data sharing method provided by the embodiments of the present application;

[0071] Figure 3 A flowchart of a data sharing method provided by the embodiments of the present application;

[0072] Figure 4 A flowchart of a proxy selection method provided by the embodiments of the present application;

[0073] Figure 5 A flowchart of a proxy selection method provided by the embodiments of the present application;

[0074] Figure 6 A flowchart of a data sharing method provided by the embodiments of the present application;

[0075] Figure 7 A flowchart of a method for determining a first-time encryption ciphertext provided by the embodiments of the present application;

[0076] Figure 8 A flowchart of a method for determining a data owner public and private key provided by the embodiments of the present application;

[0077] Figure 9 A flowchart of a method for determining a first re-encryption key provided by the embodiments of the present application;

[0078] Figure 10 A flowchart of a method for determining a second re-encryption key provided by the embodiments of the present application;

[0079] Figure 11 A flowchart of a data sharing method provided by the embodiments of the present application;

[0080] Figure 12 A flowchart of a data sharing method provided for an embodiment of the present application is shown in FIG. 1.

[0081] Figure 13 A structural diagram of a data sharing device provided for an embodiment of the present application is shown in FIG. 2.

[0082] Figure 14 A structural diagram of a data sharing device provided for an embodiment of the present application is shown in FIG. 3.

[0083] Figure 15 A structural diagram of a data sharing device provided for an embodiment of the present application is shown in FIG. 4.

[0084] Figure 16 A structural diagram of a data sharing device provided for an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0085] Some verifiable delay functions and proxy re-encryption are briefly introduced below.

[0086] A verifiable delay function (VDF) is a kind of mathematical function emerging in recent years, which requires at least a known time T for calculation, and cannot be significantly reduced even when CPU parallel computing, but once calculated, it can be quickly verified, i.e., the verification time is significantly less than the calculation time. VDF is a tool for increasing stable delay in distributed computing, and provides a trusted proof of time passing. VDF function needs to meet the following conditions:

[0087] Time-consuming: the calculation needs to be time-consuming, and it is difficult to be significantly reduced by parallel computing.

[0088] Fast verification: the proof verification time of the calculation result needs to be significantly, at least logarithmically, less than the calculation time.

[0089] Uniqueness, the same input corresponds to a unique output result (but the proof of the result does not need to be unique).

[0090] Serial, the probability that an attacker wants to calculate the result of VDF in less than T time is negligible.

[0091] The general operation process of VDF is as follows Figure 1 As shown in FIG. 6. VDF generally includes three processes: initialization Setup, calculation Eval and verification Verify.

[0092] The initialization stage accepts security parameters λ and time parameters (actual time-consuming) τ, and can determine the parameters ek used for calculation and verification parameters vk.

[0093] The computation phase accepts computation parameters ek and input x, and generates output y and proof of π (i.e. (y,π)=Eval(ek,x)) after a sufficiently long computation time.

[0094] The verification phase accepts vk, x, y, and π, and can quickly verify and output pass or fail (i.e., accept / reject = Verify(vk,x,y,π)).

[0095] The most common VDF formula in the industry (i.e. Figure 1 The calculation phase Eval is generally performed in the following repeated squaring manner, as shown in formula (1), where N is the modulus parameter λ in the public parameters and T is the time parameter τ. The following formula means: the input x is squared, the result of the square is squared again, and this is repeated T times (the total time taken is τ). Finally, the result is taken as remainder when divided by N. The repeated squaring cannot be parallelized, and the result is only known in the last calculation. Therefore, it meets the time consumption and uniqueness requirements of the VDF algorithm.

[0096] Generally speaking, the larger the value of T, the more difficult the VDF problem is, and the longer the average computation time will be.

[0097]

[0098] To make the calculation easier to verify in order to meet the requirements of VDF, a proof of π needs to be provided. There are various forms of proofs of π that meet the conditions, commonly including those based on the multiplicative group of integers N using Euler's totient function, Boneh interactive verification, and the Wislowski verification protocol. The proof of π, along with y, x, and vk, is sent to the verifier for verification. Generally, the time spent verifying the result should be much less than the time spent calculating Eval, and can be ignored in comparison. Table 1 shows a set of comparison data for the verification of proofs based on the repeated square Eval + multiplicative group of integers N:

[0099] Table 1

[0100] T value 100 1000 100000 10000000 Eval calculation duration (seconds) 2.365 5.489 670.615 67749.56 Verify verification duration (seconds) 0.0008 0.006 1.145 6.871

[0101] A common scenario for data sharing is that a data owner wants to share encrypted data with a data user through a cloud platform, and this process should not be known to the cloud platform. The traditional approach is for the data owner to encrypt the data to be shared using the data user's public key and upload the encrypted ciphertext to the cloud platform; the data user then obtains the encrypted ciphertext through the cloud platform and decrypts it using their own private key to obtain the data to be shared. This method is unsuitable for sharing scenarios with a large number of data users: firstly, it results in numerous ciphertext copies occupying storage space; secondly, the encryption operation incurs significant computational and communication overhead for the data owner.

[0102] Proxy Re-Encryption (PRE) is a public key encryption scheme, which is often used in data security sharing in cloud environment: the data owner allows a semi-honest third party (proxy) to modify the ciphertext encrypted by the data owner's public key (re-encryption) so that other data users can decrypt the re-encrypted ciphertext. The PRE scheme can make full use of the computing power and bandwidth resources of cloud services. The data owner's computing overhead is limited to encrypting the plaintext once and generating a small additional key for each data user, without the need to encrypt a large amount of plaintext for each new user. This reduces the data owner's computing power requirements and makes full use of cloud computing power.

[0103] Generally, a complete PRE scheme requires the following five-tuple functions.

[0104] KeyGen: Local key generation function;

[0105] Encrypt: Data encryption function;

[0106] ReKeyGen: Re-encryption key generation function;

[0107] ReEncrypt: Data re-encryption function:

[0108] Decrypt: Data decryption function.

[0109] The data flow steps under the standard PRE scheme are as follows:

[0110] -Data owner Alice and data user Bob use the KeyGen function to generate local public and private keys, respectively;

[0111] -Alice uses the Encrypt function to encrypt the plaintext information M for the first time, and uploads the ciphertext data C to the proxy;

[0112] -Data users provide encryption public keys and send them to Alice;

[0113] -Alice uses the ReKeyGen function to generate a re-encryption key for Bob and sends it to the proxy;

[0114] -The proxy uses ReEncrypt and generates new ciphertext data based on the ciphertext data C and the re-encryption key;

[0115] -Bob obtains the re-encrypted ciphertext data and decrypts it using the local private key.

[0116] Figure 2The schematic diagram of a data sharing system provided in this application embodiment includes: a data owner, a data user, an agent, a blockchain, and cloud storage; wherein, the agent node can be further divided into a computing agent and multiple auxiliary agents.

[0117] A blockchain can be a public or consortium blockchain, but its block production frequency must be fixed. All participants in the system need at least read access to the blockchain.

[0118] Data owner. The actual owner of the data needs to participate in the process of initializing the shared public key pair, communicating with the proxy, setting up VDF questions, and verifying the data.

[0119] Data users. Data users need to participate in the calculation of the initial shared public key and the decryption of the data.

[0120] Agents. Agents can freely join or leave the data sharing process, simply by periodically registering random tokens on the chain. Data owners will categorize agents into computation agents and auxiliary agents.

[0121] Cloud storage. Encrypted data used for storage. This application does not limit the specific implementation of cloud storage. For example, blockchain-based IPFS storage or traditional public cloud service storage can be used, but both the data user (read permission) and the data owner (read and write permission) need to be able to access it, and neither needs additional permissions.

[0122] Optionally, a proxy can be used for cloud storage.

[0123] Figure 3 This is a flowchart illustrating a data sharing method provided in an embodiment of this application. The method can be executed by a data sharing device, which can be a terminal device or a module for a terminal device, or a server or a module for a server. This application does not limit the entity executing this method.

[0124] The method includes the following steps:

[0125] Step 301: The data owner determines the initial encrypted ciphertext, the first encryption key, and the second encryption key.

[0126] The initial encrypted ciphertext is the ciphertext obtained by the data owner after encrypting the data to be shared; the first encryption key is determined by the data owner based on the public key of the data user; and the second encryption key is determined by the data owner based on the private key of the data owner.

[0127] Step 302: The data owner selects a computing agent and at least two auxiliary agents, and sends the initial encrypted ciphertext and the second encryption key to the computing agent, and distributes the first encryption key in slices to the at least two auxiliary agents.

[0128] In this process, the computation agent and the at least two auxiliary agents all complete the calculation of the verifiable delay function, and the calculation results are all verified. The computation agent is used to re-encrypt the initially encrypted ciphertext according to the received second encryption key, and send the re-encrypted ciphertext to the data user. The auxiliary agents are used to send the received first encryption key slice to the data user. The data user is used to obtain the data to be shared according to the received re-encrypted ciphertext and the first encryption key.

[0129] The above scheme has several advantages. First, the data owner sends the initial encrypted ciphertext, the first encryption key, and the second encryption key to different proxy nodes. An attacker must simultaneously impersonate the data recipient, control a sufficient number of proxy nodes, and achieve adequate VDF computation capabilities and latency to potentially obtain the shared data, thus increasing data sharing security. Second, each proxy node does not require complex authentication with the data owner; it only needs to provide VDF computation capabilities and re-encryption computation capabilities, reducing the authentication overhead for the data owner. Third, proxy nodes do not need frequent complex authentication with the data owner; they only need VDF computation capabilities, enhancing the scalability of the proxy nodes.

[0130] In one possible implementation, the specific process of selecting the data owner's computing agent and at least two auxiliary agents in step 302 above is as follows: Figure 4 As shown, it includes the following steps:

[0131] Step 401: The data owner determines the number of calculations of the verifiable delay function corresponding to the data to be shared, and writes the number of calculations into the data tag contract.

[0132] The data tagging contract is used by multiple agents to obtain the number of calculations; the calculation process of the verifiable delay function is executed by each agent in the corresponding blockchain according to the number of calculations and the blockchain identifier corresponding to each agent; the calculation time of the verifiable delay function executed by each agent according to the number of calculations is greater than the block production frequency of the blockchain.

[0133] One possible implementation involves setting the number of calculations for a verifiable delay function corresponding to different data to be shared.

[0134] Optionally, the number of calculations for the verifiable delay function can be set according to the amount of data to be shared. For example, the larger the amount of data to be shared, the more calculations are required.

[0135] Optionally, the number of calculations for the verifiable delay function can be set according to the data type of the data to be shared. For example, if the data type of the data to be shared involves user privacy, the number of calculations will be higher. This application does not limit the method for determining the number of calculations for the verifiable delay function corresponding to the data type of the data to be shared.

[0136] In one possible implementation, before step 301, the data owner can also select the VDF formula, proof algorithm, and calculation parameters to be used; for example, the perfect square is selected as the calculation process of the VDF algorithm, i.e., the above formula (1); the Boneh proof is selected as the verification process of the VDF algorithm; and the genesis block hash is used to set the modulus parameter N.

[0137] One possible implementation involves obtaining the blockchain's block production frequency t and setting a sufficiently large minimum computation count Tmin for a verifiable delay function. This ensures that the time required for most proxies to solve a VDF (Verifiable Delay Function) Eval is greater than the block production frequency t. For example, assuming an average block production time of 10 seconds, for most current general-purpose hardware machines, the average computation time t is approximately 11 seconds when Tmin = 10,000 computations. Therefore, Tmin is set to 10,000.

[0138] Optionally, the data type of the data to be shared is set such that the number of calculations of the corresponding verifiable delay function is greater than or equal to the minimum number of calculations Tmin.

[0139] In one possible implementation, the data owner uploads the VDF formula, proof algorithm, calculation parameters, and minimum number of calculations to the blockchain after reaching a consensus among nodes, and writes the Verify algorithm corresponding to the VDF Eval into the proxy control contract to ensure that this algorithm can be executed by the blockchain.

[0140] In one possible implementation, a proxy control contract is used to collect the random tokens and VDF calculation results uploaded by each proxy, and is responsible for verifying both. All proxies have write permissions to this proxy control contract.

[0141] In one possible implementation, a data tagging contract is used to record the storage link for each set of data to be shared, as well as the VDF computation problem for the data owner regarding the data to be shared. This contract only grants write permissions to the data owner.

[0142] Step 402: The data owner obtains the calculation results of the verifiable delay function executed by multiple agents, and determines the pre-selected agent based on the calculation results of the multiple agents.

[0143] Wherein, the pre-selected agent refers to the agent node whose calculation result of the verifiable delay function has been verified and whose block height for executing the calculation process of the verifiable delay function is located within the executable interval; the executable interval refers to the block height submitted by the multiple agents to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected agents is a positive integer greater than 3.

[0144] In one possible implementation, multiple proxies send the calculation results of the verifiable delay function to the data owner, or multiple proxies write the calculation results of the verifiable delay function into a proxy control contract, which then verifies whether the calculation results are correct.

[0145] Optionally, after completing the VDF calculation, each agent sends the calculated result y and proof π to the agent control contract in a single transaction to submit the calculation result. The agent control contract uses the VDF Verify algorithm to verify the following: the VDF calculation results of each agent are correct; and the block height entered by each agent before submitting the result transaction is within its promised block height range.

[0146] In one possible implementation, the proxy control contract collects a set {i} of all verified proxies i, and a set {i} of all unverified proxies i. ～ The proxy control contract prohibits each proxy i in the latter from requesting to update the block height range within the current block height range, and also prevents it from performing VDF computations within the current block height range.

[0147] Step 403: The data owner selects a computing agent and at least two auxiliary agents from the pre-selected agents.

[0148] In one possible implementation, for any of the pre-selected proxies, if the difference between the hash value of the blockchain identifier corresponding to the proxies and the aggregate hash value is the smallest, then the proxies are determined to be computation proxies; the aggregate hash value is the hash value of the random token corresponding to the pre-selected proxies and the current block height of the blockchain after aggregation; at least two proxies are selected as auxiliary proxies from the pre-selected proxies other than the computation proxies.

[0149] Optionally, the proxy control contract uses a certain method to aggregate two sets of data: the current block height of the blockchain and the earliest valid block height commitment range for each of the pre-selected proxies at the time of submitting the result (to prevent proxies from temporarily and urgently submitting new block height commitments based on this aggregation method), and then selects the computational proxy. The aggregation method should ensure randomness and unpredictability as much as possible.

[0150] Optionally, the method for determining the computation agent is as follows: Figure 5 As shown, this step includes the following:

[0151] Step 501: Aggregate the random tokens of each agent in the pre-selected agents to obtain the first aggregation result.

[0152] In one possible implementation, the random tokens of each agent in the pre-selected agents are aggregated using the following formula (2).

[0153] H a =Hash(ε1||ε2||..ε i )……(2)

[0154] Among them, H a The first aggregation result is given by Hash, where ε is the hash function. i The random token corresponding to the i-th agent.

[0155] Step 502: Determine the aggregate hash value based on the first aggregation result and the current block height of the blockchain.

[0156] One possible implementation method is to determine the aggregate hash value using the following formula (3).

[0157] H b =Hash(H a ||BH)……(3)

[0158] Among them, H b For aggregate hash value, H a This is the first aggregation result, where BH is the current block height of the blockchain and Hash is the hash function.

[0159] Step 503: Determine the hash value of the blockchain identifier corresponding to each agent in the pre-selected agents.

[0160] In one possible implementation, the on-chain public key address addr(i) of each agent i is calculated using the same hash algorithm to obtain Haddr(i).

[0161] Step 504: If the difference between the hash value of the blockchain identifier corresponding to the agent and the aggregate hash value is the smallest, then the agent is determined to be a computing agent.

[0162] One possible implementation involves comparing each Haddr(i) and H_b sequentially, converting them to binary, subtracting their absolute values, and finding the agent i with the smallest result, which is then used as the computation agent. Alternatively, the agent i with the largest result can also be selected as the computation agent. This application does not limit the method for determining the computation agent, as long as it uniquely identifies one agent as the computation agent.

[0163] Step 505: Select at least two agents as auxiliary agents from the pre-selected agents other than the computation agent.

[0164] In one possible implementation, after step 505, the agent control contract informs the data owner of the computation agent, auxiliary agent, and data aggregation method together.

[0165] In one possible implementation, the data owner needs to use the same data aggregation method to confirm whether the choice of computing agent is correct.

[0166] In one possible implementation, if the VDF verification algorithm is executed by the proxy control contract, the data owner does not need to verify the VDF calculation results of the computation proxy and the auxiliary proxy. If the VDF verification algorithm is executed by the data owner, the data owner needs to verify the VDF calculation results of the pre-selected proxy before selecting the computation proxy and the auxiliary proxy.

[0167] In one possible implementation, after step 302 above, the step of slicing the first encryption key and distributing it to the at least two auxiliary agents includes: the data owner slicing the first encryption key into N slices; where N is a positive integer and N is less than half the number of auxiliary agents; the data owner sending the N slices to the at least two auxiliary agents respectively, and determining the slice number corresponding to each auxiliary agent; and the data owner sending the slice number corresponding to each auxiliary agent to the data user.

[0168] Optionally, to ensure transmission redundancy, it is necessary to strive to ensure that each slice is transmitted to the user by at least two or more auxiliary proxies, that is, the value of N is no more than half the number of auxiliary proxies: Choosing a larger N value within this range for the data owner means finer granularity of segmentation, lower probability of collusion between agents, but greater impact of errors in transmission by a single agent, and vice versa.

[0169] Optionally, the data owner randomly sorts the blockchain addresses addr(i) of all auxiliary agents i, then modulo N, and the remainder is the result to allocate the corresponding first-level encryption key Rekey1 slice to each auxiliary agent i. For example, using (addr(i)+rand(addr(i)))mod N, a remainder res from 0 to (N-1) can be obtained for each auxiliary agent i, and then the res-th slice of Rekey1 is assigned to the auxiliary agent i.

[0170] Optionally, the data owner sends the Rekey1 slice number corresponding to each auxiliary agent i to the data user, and the data user restores the complete Rekey1 locally based on the received Rekey1 slice value.

[0171] In one possible implementation, step 301 above, the process of the data owner determining the initial encrypted ciphertext, the first encryption key, and the second encryption key, is as follows: Figure 6 As shown, it includes the following steps:

[0172] Step 601: The data owner invokes the shared request contract to record the data sharing request.

[0173] The data sharing request includes the storage link of the data to be shared and the identifier of the data user; the sharing request contract is used to record each data sharing request.

[0174] In one possible implementation, a share request contract is deployed on the blockchain to record each data sharing request. This contract only grants write permissions to the data owner.

[0175] In one possible implementation, the data owner stores the data to be shared in cloud storage; the cloud storage returns an accessible storage link URL for the data to be shared. For simplicity, we directly use the binary representation of this URL as the original text M that needs to be re-encrypted by a proxy. Without loss of generality, the data owner can choose to negotiate a second encryption for the data stored in cloud storage with the data user; this application does not limit this. For example, the storage link URL for the data to be shared using Baidu Cloud Storage is pan.baidu.com / s / 1kbabc, which, when converted to a binary string, becomes the original text M.

[0176] Optionally, the generation of M is perpetual and uninterrupted.

[0177] In one possible implementation, the data owner generates a hash value Hash(M) for the original text M, and simultaneously assigns a VDF calculation count TM for each original text M, and sets (Hash(M), T) as the hash value. M The data is written to the blockchain and marked as a contract.

[0178] In one possible implementation, the data user and the data owner confirm the data sharing request through some offline method. Subsequently, the data owner adds a data sharing request to the on-chain sharing request contract, including the Hash(M) to be shared and the data user ID.

[0179] Optionally, multiple data entries can be shared, but the data owner needs to concatenate the corresponding multiple data entries M.

[0180] Step 602: The data owner performs initial encryption on the storage link of the data to be shared based on the record information returned by the sharing request contract to obtain the initial encrypted ciphertext.

[0181] In one possible implementation, after the data sharing request addition operation is successfully uploaded to the blockchain, the sharing request contract returns record information.

[0182] Optionally, the recording information is the transaction hash value of the record of the data sharing request.

[0183] Step 603: The data owner determines the first encryption key based on the record information and the public key of the data user.

[0184] Step 604: The data owner determines the second encryption key based on the record information and the data owner's private key.

[0185] The public key of the data user is determined based on the identifier of the data user.

[0186] In one possible implementation, step 602 above, where the data owner performs initial encryption on the storage link of the data to be shared based on the record information returned by the sharing request contract, yields the initial encrypted ciphertext, as follows: Figure 7 As shown, it includes the following steps:

[0187] Step 701: The data owner obtains the record information returned by the sharing request contract.

[0188] The recorded information includes a transaction identifier and a record block height; the transaction identifier is used to indicate the transaction hash value in which the sharing request contract successfully uploads the data sharing request to the blockchain; the record block height refers to the height of the block on the blockchain that records the data sharing request.

[0189] Step 702: The data owner determines the public key and private key of the data owner based on the transaction identifier, the record block height, and the blockchain identifier corresponding to the data owner.

[0190] Step 703: The data owner performs initial encryption on the storage link of the data to be shared using the public key corresponding to the data owner, to obtain the initial encrypted ciphertext.

[0191] In one possible implementation, step 702 above, where the data owner determines the public and private keys corresponding to the data owner based on the transaction identifier, the record block height, and the blockchain identifier corresponding to the data owner, involves the following specific implementation process: Figure 8 As shown, it includes the following steps:

[0192] Step 801: The data owner inputs the transaction identifier and the record block height into the first hash function to obtain the first hash value.

[0193] Wherein, the output of the first hash function is an element in the addition cycle group; the result of adding any two elements in the addition cycle group is still located in the addition cycle group; the first hash value is located in the addition cycle group.

[0194] In one possible implementation, the method for determining the first hash value is shown in the following formula (4).

[0195] t = H1(shareHash||BH) share )……(4)

[0196] Wherein, shareHash is the transaction identifier, BH share H1 is the record block height; H1 is the first hash function; t is the first hash value.

[0197] In one possible implementation, before step 601, the data owner needs to agree with the data user on a security parameter λ, which is an additive cyclic group G1 and a multiplicative cyclic group G1, both of fixed order p. T The set of elements of G1 is defined as Z; the bilinear mapping e is G1×G1→G T Furthermore, the generator of G1 is g; the generator means that any element of G1 can be generated by the generator g.

[0198] Optionally, two irreversible hash functions H1:{0,1} are agreed upon. * →G1 (meaning: a binary string of any length can always be mapped unidirectionally to G1), and H2:G T →G1 (meaning: any element of the multiplicative cyclic group GT can be unidirectionally mapped to G1).

[0199] In one possible implementation, the data owner selects a random number s from the set Z as the first parameter, which is used as the master key for public key generation.

[0200] In one possible implementation, the data owner includes the security parameter λ, the addition cyclic group G1, and the multiplication cyclic group G. T The first parameter and other parameters are synchronized to the data user and do not need to be uploaded to the blockchain.

[0201] In one possible implementation, the concatenated original text M can still be represented by elements in set Z.

[0202] Step 802: The data owner inputs the blockchain identifier corresponding to the data owner into the first hash function to obtain the second hash value.

[0203] The second hash value is located in the addition cyclic group.

[0204] In one possible implementation, the blockchain identifier corresponding to the data owner is the binary representation of the blockchain address actually held by the data owner.

[0205] Step 803: The data owner determines the public key and private key of the data owner based on the first hash value, the second hash value, and the first element.

[0206] The first element is any element selected from the data master-slave addition loop group.

[0207] In one possible implementation, the calculation method for the public and private keys of the data owner is shown in the following formulas (5) and (6).

[0208] pk_os=t*H1(ID_os)*g……(5)

[0209] sk_os=s*pk_S……(6)

[0210] Where pk_os is the public key of the data owner, sk_os is the private key of the data owner; ID_os is the blockchain identifier corresponding to the data owner; H1 is the first hash function; t is the first hash value; g is the generator of G1, * means continuous addition, such as s*g (that is, adding the generator g s times); s is the first element.

[0211] In one possible implementation, the calculation method for the public and private keys of the data user is shown in the following formulas (7) and (8).

[0212] pk_us=t*H1(ID_us)*g……(7)

[0213] sk_us=s*pk_S……(8)

[0214] Where pk_us is the public key of the data user, sk_us is the private key of the data user; ID_us is the blockchain identifier corresponding to the data user; H1 is the first hash function; t is the first hash value; g is the generator of G1, and * is continuous addition.

[0215] In one possible implementation, in step 703 above, the data owner performs initial encryption on the storage link of the data to be shared based on the public key corresponding to the data owner to obtain the initial encrypted ciphertext, including: the data owner selecting any parameter from the addition cyclic group as the third element r; the data owner determining a first initial encrypted ciphertext fragment based on the third parameter and the generator g in the addition cyclic group; and the data owner determining a second initial encrypted ciphertext fragment based on the third parameter, the storage link of the data to be shared, and the public key corresponding to the data owner.

[0216] In one possible implementation, the calculation method for the first initial encrypted ciphertext fragment is shown in the following formula (9).

[0217] C1=r*g……(9)

[0218] Where C1 is the first initial encrypted ciphertext fragment; r is the third element; g is the generator of G1; and * represents continuous addition.

[0219] In one possible implementation, the calculation method for the second initial encrypted ciphertext fragment is shown in the following formula (10).

[0220] C2=M*r*e(s*g,pk OS )……(10)

[0221] Wherein, C2 is the second initial encrypted ciphertext fragment; M is the storage link of the data to be shared; r is the third element; g is the generator of G1; s is the first element; pk OS is the public key of the data owner; e is a bilinear mapping.

[0222] In one possible implementation method, the calculation method for the initial encrypted ciphertext is shown in the following formula (11).

[0223] C = C1||C2……(11)

[0224] Where C represents the initial encrypted ciphertext, C1 represents the first initial encrypted ciphertext fragment, C2 represents the second initial encrypted ciphertext fragment, and || represents the character concatenation operation.

[0225] In one possible implementation, step 603 above, where the data owner determines the specific implementation of the first encryption key based on the record information and the public key of the data user, is as follows: Figure 9 As shown, it includes the following steps:

[0226] Step 901: The data owner obtains the public key of the data user.

[0227] The public key of the data user is determined by the data user based on the first hash value and the blockchain identifier corresponding to the data user.

[0228] Step 902: Select one element from the master-slave multiplication cyclic group of the data as the second element.

[0229] Wherein, the result of multiplying any two elements in the addition loop group is located in the multiplication loop group; the result of multiplying any two elements in the multiplication loop group is still located in the multiplication loop group.

[0230] In one possible implementation, the data owner is a slave G. TRandomly select an element X from the given elements as the second element.

[0231] Step 903: The data owner determines the first encryption key based on the public key corresponding to the data user, the first element, and the second element.

[0232] In one possible implementation, the calculation method for the first encryption key is shown in the following formula (12).

[0233] Rekey1=X*r*e(s*g,pk US *t*g)…(12)

[0234] Where Rekey1 is the first encryption key, X is the second element; r is the third element; g is the generator of G1; s is the first element; pk US is the public key of the data user; e is the bilinear mapping; t is the first hash value.

[0235] In one possible implementation, step 604 above, where the data owner determines the second encryption key based on the record information and the data owner's private key, is implemented as follows: Figure 10 As shown, it includes the following steps:

[0236] Step 1001: The data owner inputs the second element into the second hash function to obtain the third hash value.

[0237] The second hash function is used to map elements in the multiplication cyclic group to the addition cyclic group.

[0238] Step 1002: The data owner determines the second encryption key based on the private key corresponding to the data owner, the first element, and the third hash value.

[0239] In one possible implementation, the calculation method for the second encryption key is shown in the following formula (13).

[0240]

[0241] Where Rekey2 is the second encryption key, X is the second element; r is the third element; g is the generator of G1; sk OS is the private key of the data owner; e is the bilinear mapping; H2 is the second hash function; the superscript of -1 refers to the subtraction of the generator operation.

[0242] In one possible implementation, Rekey2 and ciphertext C are sent to the computation agent in the next step for re-encryption computation, while Rekey1 is sent to the auxiliary agent selected in the next step for transmission.

[0243] Figure 11 This is a flowchart illustrating a data sharing method provided in an embodiment of this application. The method can be executed by a data sharing device, which can be a terminal device or a module for a terminal device, or a server or a module for a server. This application does not limit the entity executing this method.

[0244] The method includes the following steps:

[0245] Step 1101: The proxy node obtains the number of calculations of the verifiable delay function corresponding to the data to be shared through the data tagging contract.

[0246] In one possible implementation, each agent i needs to register and authenticate with the data owner; after authentication, the agents agree to write a record to the on-chain agent control contract every period. The record must contain the on-chain public key address addr(i) of each agent i and a random token ε. i And a committed block height range, such as: (0x71C7656EC7ab88b098defB751B7401B5f6d8976F,0.736, [140,180]), which means that this agent will commit to completing the VDF and re-encryption-based data sharing computation within this given block height range.

[0247] In one possible implementation, each agent i needs to periodically update the block height interval and upload new random tokens, and each agent can only maintain one record; the update frequency is optional, and the period can be arbitrarily increased or decreased; generally, the ideal approach is to update when the current block height is close to the right side of the interval (e.g., update when the current block height = 170 < 180), otherwise omissions may occur. If an agent performs any re-encryption calculation or VDF calculation error within the current block height interval, it can no longer update this block height interval. The agent assumes all risks associated with this interval replacement operation or failure to update in a timely manner.

[0248] Step 1102: The proxy node performs a calculation process of a verifiable delay function based on the number of calculations and the blockchain identifier corresponding to the proxy node.

[0249] Wherein, the computation time of the verifiable delay function performed by the proxy node based on the number of computations is greater than the block production frequency of the blockchain.

[0250] In one possible implementation, the proxy node obtains the transaction identifier corresponding to the data to be shared; the transaction identifier is the transaction hash value obtained after the data owner successfully uploads the data sharing request to the blockchain by calling the sharing request contract; the sharing request contract is used to record each data sharing request; the proxy node performs a calculation process of a verifiable delay function based on the transaction identifier, the number of calculations, and the blockchain identifier corresponding to the proxy node.

[0251] In one possible implementation, the proxy node performs the calculation of the input parameter x of the verifiable delay function calculation process, as shown in formula (14).

[0252] x=shareHash||addr(i)……(14)

[0253] Where x is the input x accepted during the computation phase, shareHash is the transaction identifier, and addr(i) is the blockchain identifier corresponding to agent node i.

[0254] Optionally, addr(i) is the blockchain address corresponding to the proxy node i. The purpose of adding the proxy address is to prevent collusion between proxies to copy the calculation results.

[0255] Step 1103: The proxy node sends the calculation result of the verifiable delay function, as well as the block height of the process of executing the calculation of the verifiable delay function.

[0256] The calculation results and the block height of the calculation process are used by the data owner to determine the proxy type of the proxy node.

[0257] In one possible implementation, the proxy node sends the calculation result of the verifiable delay function to the data owner, or sends the calculation result of the verifiable delay function to the proxy control contract.

[0258] Optionally, the calculation result includes the result y obtained by the proxy node and the proof π.

[0259] Step 1104: The proxy node determines its own proxy type and processes the corresponding information of the data to be shared according to its own proxy type.

[0260] The above scheme has two advantages. First, the proxy node needs to complete the calculation process of the verifiable delay function, which is usually quite long. This reduces the possibility of the attacker impersonating the proxy node, thereby reducing the possibility of the attacker obtaining the data to be shared. Second, the proxy node does not need to frequently perform complex identity authentication with the data owner. It only needs to have VDF calculation capabilities, which enhances the scalability of the proxy node.

[0261] In one possible implementation, if the proxy node determines that its proxy type is a computation proxy, the proxy node receives an initial encrypted ciphertext and a second encryption key sent by the data owner; the initial encrypted ciphertext is the ciphertext obtained by the data owner after initially encrypting the data to be shared; the second encryption key is determined by the data owner based on the data owner's private key; the proxy node re-encrypts the initial encrypted ciphertext based on the second encryption key and sends the re-encrypted ciphertext to the data user.

[0262] Optionally, the proxy node receives a first initial encrypted ciphertext fragment, a second initial encrypted ciphertext fragment, and a second encryption key sent by the data owner; the first initial encrypted ciphertext fragment and the second initial encrypted ciphertext fragment are obtained by re-encrypting the initial encrypted ciphertext fragment; the proxy node re-encrypts the initial encrypted ciphertext according to the second encryption key and sends the re-encrypted ciphertext to the data user, including: the proxy node re-encrypts the second initial encrypted ciphertext fragment according to the second encryption key to obtain a re-encrypted ciphertext fragment; the proxy node sends the first initial encrypted ciphertext fragment and the re-encrypted ciphertext fragment to the data user.

[0263] In one possible implementation, the calculation method for re-encrypting the second initially encrypted ciphertext fragment based on the second encryption key is shown in the following formula (15).

[0264] C2 ′ =C2*Rekey2……(15)

[0265] Among them, C2 ′ C2 is the second initial encryption ciphertext fragment, and Rekey2 is the second encryption key.

[0266] In one possible implementation, after the computation agent completes its computation, it can send the first initially encrypted ciphertext fragment and the re-encrypted ciphertext fragment to the data receiver. However, the data receiver only uses C1. ′ and C2 ′ Decryption is impossible because the necessary information (the shared public-private key pair derived from the master key s) is missing, and this information resides in Rekey1. The data owner needs to redundantly split Rekey1 and have it transmitted to the data user via other auxiliary agents. Specifically, C1... ′ =C1.

[0267] In one possible implementation, if the proxy node determines that its proxy type is an auxiliary proxy, the proxy node receives a first encryption key slice sent by the data owner; the first encryption key is determined by the data owner based on the public key of the data user; the proxy node sends the first encryption key slice to the data user.

[0268] In one possible implementation, before step 1101, the proxy node determines a random token and an executable range, and submits the random token and the executable range to the data owner; the executable range refers to the block height submitted by the proxy node to the data owner before executing the calculation process of the verifiable delay function; the random token is used by the data owner to determine the proxy type of the proxy node.

[0269] Optionally, after determining the random token and the executable range, the proxy node writes the random token and the executable range into the proxy control contract.

[0270] Optionally, the proxy node periodically updates the random token and / or the executable range.

[0271] Figure 12 This is a flowchart illustrating a data sharing method provided in an embodiment of this application. The method can be executed by a data sharing device, which can be a terminal device or a module for a terminal device, or a server or a module for a server. This application does not limit the entity executing this method.

[0272] The method includes the following steps:

[0273] Step 1201: The data receiver receives a slice of the first encryption key sent by multiple auxiliary agents.

[0274] The first encryption key is determined by the data owner based on the public key of the data user.

[0275] Step 1202: The data receiver receives the re-encrypted ciphertext sent by the computing agent.

[0276] Wherein, the re-encrypted ciphertext is obtained by the computing agent re-encrypting the initial encrypted ciphertext according to the second encryption key; the initial encrypted ciphertext is the ciphertext obtained by the data owner after initially encrypting the data to be shared; the second encryption key is determined by the data owner according to the data owner's private key.

[0277] In one possible implementation, the data receiver receives a first initially encrypted ciphertext fragment and a re-encrypted ciphertext fragment sent by the computing node; the first initially encrypted ciphertext fragment and the second initially encrypted ciphertext fragment are obtained by the computing node after encrypting the initially encrypted ciphertext fragment; the re-encrypted ciphertext fragment is obtained by the proxy node after re-encrypting the second initially encrypted ciphertext fragment according to the second re-encryption key.

[0278] Step 1203: The data receiver receives the slice number corresponding to each auxiliary agent sent by the data owner.

[0279] Step 1204: The data receiver reassembles multiple first-level encryption key slices according to the slice number corresponding to each auxiliary agent to obtain the first-level encryption key.

[0280] Step 1205: The data receiver decrypts the re-encrypted ciphertext using the first encryption key to obtain the data to be shared.

[0281] The above scheme has two advantages. First, the data user obtains the first-level encryption key slice and the re-encrypted ciphertext separately. The attacker must simultaneously impersonate the data receiver, control a sufficient number of proxy nodes, and achieve sufficient VDF computing power and latency in order to obtain the data to be shared, thus increasing the security of data sharing. Second, the data user can accurately and effectively obtain the first-level encryption key based on the slice number corresponding to each auxiliary proxy, and then decrypt the re-encrypted ciphertext based on the first-level encryption key, thereby accurately and effectively obtaining the data to be shared.

[0282] In one possible implementation, the data receiver determines a second element based on the first initial encrypted ciphertext fragment, the private key corresponding to the data receiver, and the first encryption key; the second element is any element randomly selected from the data owner-slave multiplication cyclic group; the data receiver obtains the data to be shared based on the second element, the second hash function, the first initial encrypted ciphertext fragment, and the re-encrypted ciphertext fragment; wherein, the second hash function is used to map the elements in the multiplication cyclic group to the addition cyclic group; the result of adding any two elements in the addition cyclic group is still located in the addition cyclic group; the result of multiplying any two elements in the addition cyclic group is located in the multiplication cyclic group.

[0283] In one possible implementation, the second element is determined as shown in formula (16).

[0284] X = Rekey1 / e(C1) ′ ,sk US )……(16)

[0285] Where X is the second element, Rekey1 is the first encryption key, and C1 ′ For the first initial encrypted ciphertext fragment, sk US Let be the private key corresponding to the data user, and e be a bilinear mapping.

[0286] In one possible implementation method, the original text M of the data to be shared is determined by the following formula (17).

[0287] M = C2 ′ / e(C1 ′ ,H2(X))……(17)

[0288] Where M represents the data to be shared, and C2 ′ For re-encrypting ciphertext fragments, e is a bilinear mapping, C1 ′ H1 is the first ciphertext fragment encrypted initially, H2 is the second hash function, and X is the second element.

[0289] Optionally, M is the storage link for the data to be shared.

[0290] Based on the same technological concept Figure 13 An exemplary embodiment of a data sharing device 1300 provided in this application is shown. For example... Figure 13 As shown, it includes: a determining unit 1301 and a selecting unit 1302. The determining unit 1301 is used to determine the initial encrypted ciphertext, the first encryption key, and the second encryption key; the initial encrypted ciphertext is the ciphertext obtained by the data owner after encrypting the data to be shared; the first encryption key is determined by the data owner based on the public key of the data user; the second encryption key is determined by the data owner based on the private key of the data owner; the selecting unit 1302 is used to select a computing agent and at least two auxiliary agents, and send the initial encrypted ciphertext and the second encryption key to the computing agent, and distribute the first encryption key in slices to the at least two auxiliary agents; both the computing agent and the at least two auxiliary agents complete the calculation process of the verifiable delay function, and the calculation results are all verified; the computing agent is used to re-encrypt the initial encrypted ciphertext according to the received second encryption key, and send the re-encrypted ciphertext to the data user; the auxiliary agents are used to send the received slices of the first encryption key to the data user; the data user is used to obtain the data to be shared according to the received re-encrypted ciphertext and the first encryption key.

[0291] In one possible implementation, the determining unit 1301 is used to determine the number of calculations of the verifiable delay function corresponding to the data to be shared, and write the number of calculations into a data tag contract; the data tag contract is used by multiple agents to obtain the number of calculations; wherein, the calculation process of the verifiable delay function is executed by each agent in the corresponding blockchain according to the number of calculations and the blockchain identifier corresponding to each agent; the calculation time of each agent executing the verifiable delay function according to the number of calculations is greater than the block production frequency of the blockchain; the data owner obtains the calculation results of the multiple agents executing the verifiable delay function, and determines pre-selected agents according to the calculation results of the multiple agents; the pre-selected agents refer to agent nodes whose calculation results of the verifiable delay function are verified and whose block height for executing the calculation process of the verifiable delay function is within the executable interval; the executable interval refers to the block height submitted by the multiple agents to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected agents is a positive integer greater than 3; the selecting unit 1302 is used to select a calculation agent and at least two auxiliary agents from the pre-selected agents.

[0292] In one possible implementation, the determining unit 1301 is configured to determine the agent as a computation agent if the difference between the hash value of the blockchain identifier corresponding to the agent and the aggregate hash value is the smallest for any agent among the pre-selected agents; the aggregate hash value is the hash value of the random token corresponding to the pre-selected agent and the current block height of the blockchain after aggregation; and select at least two agents as auxiliary agents from the pre-selected agents other than the computation agent.

[0293] In one possible implementation, the above-mentioned device further includes a segmentation unit 1303 and a transceiver unit 1304. The segmentation unit 1303 is used to segment the first encryption key into N slices; wherein N is a positive integer and N is less than half the number of auxiliary agents; the transceiver unit 1304 is used to send the N slices to the at least two auxiliary agents respectively, and determine the slice number corresponding to each auxiliary agent; and send the slice number corresponding to each auxiliary agent to the data user.

[0294] In one possible implementation, the determining unit 1301 is used to invoke a sharing request contract to record a data sharing request. The data sharing request includes a storage link of the data to be shared and an identifier of the data user. The sharing request contract is used to record each data sharing request. The data owner performs initial encryption on the storage link of the data to be shared based on the record information returned by the sharing request contract to obtain the initial encrypted ciphertext. The data owner determines the first encryption key based on the record information and the public key of the data user. The data owner determines the second encryption key based on the record information and the private key of the data owner. The public key of the data user is determined based on the identifier of the data user.

[0295] In one possible implementation, the transceiver unit 1304 is used to obtain record information returned by the sharing request contract; the record information includes a transaction identifier and a record block height; the transaction identifier is used to indicate the transaction hash value of the sharing request contract successfully uploading the data sharing request to the blockchain; the record block height refers to the height of the block on the blockchain that records the data sharing request; the determining unit 1301 is used to determine the public key and private key of the data owner based on the transaction identifier, the record block height, and the blockchain identifier corresponding to the data owner; the data owner performs initial encryption on the storage link of the data to be shared based on the public key corresponding to the data owner to obtain the initial encrypted ciphertext.

[0296] In one possible implementation, the determining unit 1301 is configured to input the transaction identifier and the record block height into a first hash function to obtain a first hash value; the output of the first hash function is an element in an addition cyclic group; the result of adding any two elements in the addition cyclic group is still located in the addition cyclic group; the first hash value is located in the addition cyclic group; the data owner inputs the blockchain identifier corresponding to the data owner into the first hash function to obtain a second hash value; the second hash value is located in the addition cyclic group; the data owner determines the public key and private key of the data owner based on the first hash value, the second hash value, and the first element; the first element is an element randomly selected by the data owner from the addition cyclic group.

[0297] In one possible implementation, the transceiver unit 1304 is used to obtain the public key of the data user; the public key of the data user is determined by the data user based on the first hash value and the blockchain identifier corresponding to the data user; the determining unit 1301 is used to select any one element in the multiplication loop group as the second element; the result of multiplying any two elements in the addition loop group is located in the multiplication loop group; the result of multiplying any two elements in the multiplication loop group is still located in the multiplication loop group; the data owner determines the first encryption key based on the public key corresponding to the data user, the first element, and the second element.

[0298] In one possible implementation, the determining unit 1301 is used to input the second element into a second hash function to obtain a third hash value; the second hash function is used to map the elements in the multiplication cyclic group to the addition cyclic group; the data owner determines the second encryption key based on the private key corresponding to the data owner, the first element, and the third hash value.

[0299] Based on the same technological concept Figure 14 An exemplary embodiment of a data sharing device 1400 provided in this application is shown. For example... Figure 14 As shown, it includes a transceiver unit 1401 and a processing unit 1402. The processing unit 1402 is used to obtain the number of calculations of the verifiable delay function corresponding to the data to be shared through a data tagging contract; execute the calculation process of the verifiable delay function according to the number of calculations and the blockchain identifier corresponding to the proxy node; wherein, the calculation time of the proxy node executing the verifiable delay function according to the number of calculations is greater than the block production frequency of the blockchain; determine the proxy type of the proxy node, and process the corresponding information of the data to be shared according to the proxy type of the proxy node; the transceiver unit 1401 is used to send the calculation result of the verifiable delay function and the block height of the calculation process of the verifiable delay function; the calculation result and the block height of the calculation process are used by the data owner to determine the proxy type of the proxy node.

[0300] In one possible implementation, the transceiver unit 1401 is used to obtain the transaction identifier corresponding to the data to be shared; the transaction identifier is the transaction hash value obtained after the data owner successfully uploads the data sharing request to the blockchain by calling the sharing request contract; the sharing request contract is used to record each data sharing request; the processing unit 1402 is used to perform a calculation process of a verifiable delay function based on the transaction identifier, the number of calculations, and the blockchain identifier corresponding to the proxy node.

[0301] In one possible implementation, if the proxy node determines that its proxy type is a computation proxy, the transceiver unit 1401 is used to receive the initial encrypted ciphertext and the second encryption key sent by the data owner; the initial encrypted ciphertext is the ciphertext obtained by the data owner after initially encrypting the data to be shared; the second encryption key is determined by the data owner based on the data owner's private key; the processing unit 1402 is used to re-encrypt the initial encrypted ciphertext according to the second encryption key, and send the re-encrypted ciphertext to the data user.

[0302] In one possible implementation, the transceiver unit 1401 is configured to receive a first initial encrypted ciphertext fragment, a second initial encrypted ciphertext fragment, and a second encryption key sent by the data owner; the first initial encrypted ciphertext fragment and the second initial encrypted ciphertext fragment are obtained by re-encrypting the initial encrypted ciphertext fragment; the processing unit 1402 is configured to re-encrypt the second initial encrypted ciphertext fragment according to the second encryption key to obtain a re-encrypted ciphertext fragment; the transceiver unit 1401 is configured to send the first initial encrypted ciphertext fragment and the re-encrypted ciphertext fragment to the data user.

[0303] In one possible implementation, if the proxy node determines that its proxy type is an auxiliary proxy, the transceiver unit 1401 is used to receive a first encryption key slice sent by the data owner; the first encryption key is determined by the data owner based on the public key of the data user; and the first encryption key slice is sent to the data user.

[0304] In one possible implementation, the processing unit 1402 is used to determine a random token and an executable interval, and submit the random token and the executable interval to the data owner; the executable interval refers to the block height submitted by the proxy node to the data owner before executing the calculation process of the verifiable delay function; the random token is used by the data owner to determine the proxy type of the proxy node.

[0305] In one possible implementation, the processing unit 1402 is used to periodically update the random token and / or the executable range.

[0306] Based on the same technological concept Figure 15 An exemplary embodiment of a data sharing device 1500 provided in this application is shown. For example... Figure 15As shown, the system includes a transceiver unit 1501 and a decryption unit 1502. The transceiver unit 1501 is used to receive first-level encryption key slices sent by multiple auxiliary agents; the first-level encryption key is determined by the data owner based on the public key of the data user; receive re-encrypted ciphertext sent by a computing agent; the re-encrypted ciphertext is obtained by the computing agent re-encrypting the initial encrypted ciphertext based on a second-level encryption key; the initial encrypted ciphertext is the ciphertext obtained by the data owner after initial encryption of the data to be shared; the second-level encryption key is determined by the data owner based on the data owner's private key; and receive slice numbers corresponding to each auxiliary agent sent by the data owner. The decryption unit 1502 is used to reassemble the multiple first-level encryption key slices according to the slice numbers corresponding to each auxiliary agent to obtain the first-level encryption key; and decrypt the re-encrypted ciphertext according to the first-level encryption key to obtain the data to be shared.

[0307] In one possible implementation, the transceiver unit 1501 is used to receive a first initially encrypted ciphertext fragment and a re-encrypted ciphertext fragment sent by the computing node; the first initially encrypted ciphertext fragment and the second initially encrypted ciphertext fragment are obtained by the computing node after encrypting the initially encrypted ciphertext fragment; the re-encrypted ciphertext fragment is obtained by the proxy node after re-encrypting the second initially encrypted ciphertext fragment according to the second re-encryption key.

[0308] In one possible implementation, the decryption unit 1502 is used to determine a second element based on the first initial encrypted ciphertext fragment, the private key corresponding to the data receiver, and the first re-encryption key; the second element is any element randomly selected from the data owner-slave multiplication cyclic group; the data receiver obtains the data to be shared based on the second element, the second hash function, the first initial encrypted ciphertext fragment, and the re-encrypted ciphertext fragment; wherein, the second hash function is used to map the elements in the multiplication cyclic group to the addition cyclic group; the result of adding any two elements in the addition cyclic group is still located in the addition cyclic group; the result of multiplying any two elements in the addition cyclic group is located in the multiplication cyclic group.

[0309] Based on the same technical concept, embodiments of this application provide a data sharing device 1600, which may be, for example, a computing device. Figure 16 As shown, a data sharing device 1600 includes at least one processor 1601 and a memory 1602 connected to the at least one processor. In this embodiment, the specific connection medium between the processor 1601 and the memory 1602 is not limited. Figure 16Taking the connection between the processor 1601 and the memory 1602 via a bus as an example, the bus can be divided into address bus, data bus, control bus, etc.

[0310] In this embodiment of the application, the memory 1602 stores instructions that can be executed by at least one processor 1601. By executing the instructions stored in the memory 1602, at least one processor 1601 can execute the above-described data sharing method.

[0311] The processor 1601 serves as the control center of a data sharing device 1600. It can connect to various parts of a computer device via various interfaces and lines, and performs resource settings by running or executing instructions stored in the memory 1602 and accessing data stored in the memory 1602. Optionally, the processor 1601 may include one or more determining units. The processor 1601 may integrate an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1601. In some embodiments, the processor 1601 and the memory 1602 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0312] Processor 1601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0313] Memory 1602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 1602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 1602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 1602 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0314] This application also provides a computer-readable storage medium storing a computer-executable program, which is used to cause a computer to perform a data sharing method listed in any of the above embodiments.

[0315] This application provides a computer program product, including a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform a data sharing method listed in any of the above-described methods.

[0316] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0317] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0318] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0319] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0320] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A data sharing method, characterized in that, include: The data owner determines the initial encrypted ciphertext, the first encryption key, and the second encryption key. The initial encrypted ciphertext is the ciphertext obtained by the data owner after encrypting the data to be shared; the first encryption key is determined by the data owner based on the public key of the data user; the second encryption key is determined by the data owner based on the private key of the data owner. The data owner selects a computation agent and at least two auxiliary agents, and sends the initial encrypted ciphertext and the second encryption key to the computation agent. The first encryption key is then sliced ​​and distributed to the at least two auxiliary agents. Both the computation agent and the at least two auxiliary agents complete the calculation of a verifiable delay function, and the calculation results are all verified. The computation agent re-encrypts the initial encrypted ciphertext using the received second encryption key and sends the re-encrypted ciphertext to the data user. The auxiliary agents send slices of the received first encryption key to the data user. The data user is used to obtain the data to be shared based on the received re-encrypted ciphertext and the first encryption key; The data owner selects a computational agent and at least two auxiliary agents, including: The data owner determines the number of calculations of the verifiable delay function corresponding to the data to be shared, and writes the number of calculations into the data tagging contract; the data tagging contract is used by multiple agents to obtain the number of calculations; wherein, the calculation process of the verifiable delay function is executed by each agent in the corresponding blockchain according to the number of calculations and the blockchain identifier corresponding to each agent; the calculation time of each agent executing the verifiable delay function according to the number of calculations is greater than the block production frequency of the blockchain; The data owner obtains the calculation results of the verifiable delay function executed by multiple agents, and determines pre-selected agents based on the calculation results of the multiple agents; the pre-selected agents refer to agent nodes whose calculation results of the verifiable delay function are verified and whose block height for executing the calculation process of the verifiable delay function is within the executable interval; the executable interval refers to the block height submitted by the multiple agents to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected agents is a positive integer greater than 3; The data owner selects a computing agent and at least two auxiliary agents from the pre-selected agents; The data owner selects a computing agent and at least two auxiliary agents from the pre-selected agents, including: For any of the pre-selected proxies, if the difference between the hash value of the blockchain identifier corresponding to the proxies and the aggregate hash value is the smallest, then the proxies are determined to be computation proxies; the aggregate hash value is the hash value of the random token corresponding to the pre-selected proxies and the current block height of the blockchain after aggregation. Select at least two agents as auxiliary agents from the pre-selected agents other than the computation agent.

2. The method as described in claim 1, characterized in that, The step of slicing the first encryption key and distributing it to the at least two auxiliary agents includes: The data owner divides the first encryption key into N slices; where N is a positive integer and N is less than half the number of auxiliary proxies; The data owner sends the N slices to the at least two auxiliary agents respectively, and determines the slice number corresponding to each auxiliary agent; The data owner sends the slice number corresponding to each auxiliary agent to the data user.

3. The method as described in claim 1, characterized in that, The data owner determines the initial encrypted ciphertext, the first encryption key, and the second encryption key, including: The data owner invokes a sharing request contract to record data sharing requests. The data sharing request includes the storage link of the data to be shared and the identifier of the data user. The sharing request contract is used to record each data sharing request. The data owner performs initial encryption on the storage link of the data to be shared based on the record information returned by the sharing request contract, resulting in the initial encrypted ciphertext. The data owner determines the first encryption key based on the record information and the public key of the data user; The data owner determines the second encryption key based on the record information and the data owner's private key; wherein, the public key of the data user is determined based on the identifier of the data user.

4. The method as described in claim 3, characterized in that, The initial encrypted ciphertext obtained by the data owner through initial encryption of the storage link of the data to be shared based on the record information returned by the sharing request contract includes: The data owner obtains the record information returned by the sharing request contract; the record information includes a transaction identifier and a record block height; the transaction identifier is used to indicate the transaction hash value of the sharing request contract successfully uploading the data sharing request to the blockchain; the record block height refers to the height of the block on the blockchain that records the data sharing request; The data owner determines the public and private keys of the data owner based on the transaction identifier, the record block height, and the blockchain identifier corresponding to the data owner; The data owner performs initial encryption on the storage link of the data to be shared using the public key corresponding to the data owner, thereby obtaining the initial encrypted ciphertext.

5. The method as described in claim 4, characterized in that, The data owner determines its public and private keys based on the transaction identifier, the record block height, and the blockchain identifier corresponding to the data owner, including: The data owner inputs the transaction identifier and the record block height into a first hash function to obtain a first hash value; the output of the first hash function is an element in an addition cyclic group; the result of adding any two elements in the addition cyclic group is still located in the addition cyclic group; the first hash value is located in the addition cyclic group; The data owner inputs the blockchain identifier corresponding to the data owner into the first hash function to obtain a second hash value; the second hash value is located in the addition loop group; The data owner determines its public and private keys based on the first hash value, the second hash value, and the first element; the first element is an element randomly selected by the data owner from the addition cyclic group.

6. The method as described in claim 5, characterized in that, The data owner determines the first encryption key based on the record information and the public key of the data user, including: The data owner obtains the public key of the data user; the public key of the data user is determined by the data user based on the first hash value and the blockchain identifier corresponding to the data user; The data belongs to the master-slave multiplication loop group, from which one element is selected as the second element; the result of multiplying any two elements in the addition loop group is located in the multiplication loop group; the result of multiplying any two elements in the multiplication loop group is still located in the multiplication loop group. The data owner determines the first encryption key based on the public key corresponding to the data user, the first element, and the second element.

7. The method as described in claim 6, characterized in that, The data owner determines the second encryption key based on the record information and the data owner's private key, including: The data owner inputs the second element into the second hash function to obtain the third hash value; the second hash function is used to map the elements in the multiplication cyclic group to the addition cyclic group; The data owner determines the second encryption key based on the private key corresponding to the data owner, the first element, and the third hash value.

8. A data sharing method, characterized in that, include: The proxy node obtains the number of computations of the verifiable delay function corresponding to the data to be shared through the data tagging contract; The proxy node performs a verifiable delay function calculation process based on the number of calculations and the blockchain identifier corresponding to the proxy node; wherein, the calculation time of the verifiable delay function performed by the proxy node based on the number of calculations is greater than the block production frequency of the blockchain; The proxy node sends the calculation result of the verifiable delay function, as well as the block height of the calculation process of the verifiable delay function; the calculation result and the block height of the calculation process are used by the data owner to determine the proxy type of the proxy node; The proxy node determines its own proxy type and processes the corresponding information of the data to be shared according to its own proxy type; If the difference between the hash value of the blockchain identifier corresponding to the proxy node and the aggregate hash value is the smallest, then the proxy type of the proxy node is determined to be a computation proxy; otherwise, the proxy type of the proxy node is determined to be an auxiliary proxy. The aggregate hash value is the hash value of the random token corresponding to the pre-selected proxy and the current block height of the blockchain. The pre-selected proxy refers to the proxy node whose calculation result of the verifiable delay function has been verified and whose block height for executing the calculation process of the verifiable delay function is within the executable interval. The executable interval refers to the block height submitted by multiple proxy nodes to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function. The number of pre-selected proxies is a positive integer greater than 3.

9. The method as described in claim 8, characterized in that, The proxy node performs a verifiable delay function calculation process based on the number of calculations and the blockchain identifier corresponding to the proxy node, including: The proxy node obtains the transaction identifier corresponding to the data to be shared; the transaction identifier is the transaction hash value obtained after the data owner successfully uploads the data sharing request to the blockchain by calling the sharing request contract; the sharing request contract is used to record each data sharing request. The proxy node performs a verifiable delay function calculation process based on the transaction identifier, the number of calculations, and the blockchain identifier corresponding to the proxy node.

10. The method as described in claim 8, characterized in that, The proxy node determines its own proxy type and processes the corresponding information of the data to be shared according to its own proxy type, including: If the proxy node determines that its proxy type is a computation proxy, the proxy node receives the initial encryption ciphertext and the second encryption key sent by the data owner; the initial encryption ciphertext is the ciphertext obtained by the data owner after initially encrypting the data to be shared; the second encryption key is determined by the data owner based on the data owner's private key; The proxy node re-encrypts the initially encrypted ciphertext using the second encryption key and sends the re-encrypted ciphertext to the data user.

11. The method as described in claim 10, characterized in that, The proxy node receives the initial encrypted ciphertext and the second encryption key sent by the data owner, including: The proxy node receives a first initial encrypted ciphertext fragment, a second initial encrypted ciphertext fragment, and a second encryption key sent by the data owner; the first initial encrypted ciphertext fragment and the second initial encrypted ciphertext fragment are obtained by retrieving the initial encrypted ciphertext fragment. The proxy node re-encrypts the initially encrypted ciphertext using the second encryption key, and sends the re-encrypted ciphertext to the data user, including: The proxy node re-encrypts the second initially encrypted ciphertext fragment according to the second encryption key to obtain a re-encrypted ciphertext fragment. The proxy node sends the first initially encrypted ciphertext fragment and the re-encrypted ciphertext fragment to the data user.

12. The method as described in claim 8, characterized in that, The proxy node determines its own proxy type and processes the corresponding information of the data to be shared according to its own proxy type, including: If the proxy node determines that its proxy type is auxiliary proxy, the proxy node receives the first encryption key slice sent by the data owner; the first encryption key is determined by the data owner based on the public key of the data user; The proxy node sends the first encryption key slice to the data user.

13. The method as described in claim 8, characterized in that, Before the proxy node obtains the number of calculations of the verifiable delay function corresponding to the data to be shared through the data tagging contract, the process also includes: The proxy node determines a random token and an executable range, and submits the random token and the executable range to the data owner; the executable range refers to the block height submitted by the proxy node to the data owner before executing the calculation process of the verifiable delay function; the random token is used by the data owner to determine the proxy type of the proxy node.

14. The method as described in claim 13, characterized in that, The method further includes: The random token and / or the executable range are updated periodically.

15. A data sharing method, characterized in that, include: The data receiver receives a slice of the first-level encryption key sent by multiple auxiliary agents; The first encryption key is determined by the data owner based on the public key of the data user; the computation agent and the multiple auxiliary agents all complete the calculation process of the verifiable delay function, and the calculation results are all verified; the difference between the hash value of the blockchain identifier corresponding to the computation agent and the aggregate hash value is the smallest; the auxiliary agent is any agent node among the pre-selected agents except the computation agent; the aggregate hash value is the hash value of the random token corresponding to the pre-selected agent and the current block height of the blockchain; the pre-selected agent refers to the agent node whose calculation result of the verifiable delay function is verified and whose block height for executing the calculation process of the verifiable delay function is within the executable interval; the executable interval refers to the block height submitted by the multiple agent nodes to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected agents is a positive integer greater than 3; the data receiver receives the re-encrypted ciphertext sent by the computation agent; the re-encrypted ciphertext is obtained by the computation agent re-encrypting the initial encrypted ciphertext based on the second encryption key; The initial encryption ciphertext is the ciphertext obtained by the data owner after initially encrypting the data to be shared; the second encryption key is determined by the data owner based on the data owner's private key; The data receiver receives the slice number corresponding to each auxiliary agent sent by the data owner. The data receiver reassembles multiple first-level encryption key slices according to the slice number corresponding to each auxiliary agent to obtain the first-level encryption key. The data receiver decrypts the re-encrypted ciphertext using the first encryption key to obtain the data to be shared.

16. The method as described in claim 15, characterized in that, The data receiver receives the re-encrypted ciphertext sent by the computing agent, including: The data receiver receives a first initially encrypted ciphertext fragment and a re-encrypted ciphertext fragment sent by the computing agent; the first initially encrypted ciphertext fragment and the second initially encrypted ciphertext fragment are obtained by the computing agent after encrypting the initially encrypted ciphertext fragment; the re-encrypted ciphertext fragment is obtained by the computing agent after re-encrypting the second initially encrypted ciphertext fragment according to the second re-encryption key.

17. The method as described in claim 16, characterized in that, The data receiver decrypts the re-encrypted ciphertext using the first encryption key to obtain the data to be shared, including: The data receiver determines the second element based on the first initial encrypted ciphertext fragment, the private key corresponding to the data receiver, and the first encryption key; the second element is any element selected from the data owner-slave multiplication cyclic group. The data receiver obtains the data to be shared based on the second element, the second hash function, the first initial encrypted ciphertext fragment, and the re-encrypted ciphertext fragment; wherein, the second hash function is used to map the elements in the multiplication loop group to the addition loop group; the result of adding any two elements in the addition loop group is still located in the addition loop group; the result of multiplying any two elements in the addition loop group is located in the multiplication loop group.

18. A data sharing device, characterized in that, Includes determining units and selecting units: The determining unit is used to determine the initial encrypted ciphertext, the first encryption key, and the second encryption key; the initial encrypted ciphertext is the ciphertext obtained by the data owner after encrypting the data to be shared; the first encryption key is determined by the data owner based on the public key of the data user; the second encryption key is determined by the data owner based on the private key of the data owner. The selection unit is used to select a computation agent and at least two auxiliary agents, and send the initial encrypted ciphertext and the second encryption key to the computation agent, and distribute the first encryption key in slices to the at least two auxiliary agents; both the computation agent and the at least two auxiliary agents complete the calculation process of the verifiable delay function, and the calculation results are all verified; the computation agent is used to re-encrypt the initial encrypted ciphertext according to the received second encryption key, and send the re-encrypted ciphertext to the data user; the auxiliary agents are used to send the received slices of the first encryption key to the data user; The data user is used to obtain the data to be shared based on the received re-encrypted ciphertext and the first encryption key; The determining unit is used to determine the number of calculations of the verifiable delay function corresponding to the data to be shared, and write the number of calculations into a data tagging contract; the data tagging contract is used by multiple agents to obtain the number of calculations; wherein, the calculation process of the verifiable delay function is executed by each agent in the corresponding blockchain according to the number of calculations and the blockchain identifier corresponding to each agent; the calculation time of each agent executing the verifiable delay function according to the number of calculations is greater than the block production frequency of the blockchain; the data owner obtains the calculation results of the multiple agents executing the verifiable delay function, and determines pre-selected agents according to the calculation results of the multiple agents; the pre-selected agents refer to agent nodes whose calculation results of the verifiable delay function are verified and whose block height for executing the calculation process of the verifiable delay function is within the executable interval; the executable interval refers to the block height submitted by the multiple agents to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected agents is a positive integer greater than 3; the selecting unit is used to select a calculation agent and at least two auxiliary agents from the pre-selected agents; The determining unit is configured to determine a computational agent for any of the pre-selected agents if the difference between the hash value of the blockchain identifier corresponding to the agent and the aggregated hash value is the smallest; the aggregated hash value is the hash value of the random token corresponding to the pre-selected agent and the current block height of the blockchain after aggregation; and select at least two agents as auxiliary agents from the pre-selected agents other than the computational agent.

19. A data sharing device, characterized in that, Includes a transceiver unit and a processing unit: The processing unit is configured to obtain the number of calculations of the verifiable delay function corresponding to the data to be shared through a data tagging contract; execute the calculation process of the verifiable delay function according to the number of calculations and the blockchain identifier corresponding to the proxy node; wherein, the calculation time of the proxy node executing the verifiable delay function according to the number of calculations is greater than the block production frequency of the blockchain; determine the proxy type of the proxy node, and process the corresponding information of the data to be shared according to the proxy type of the proxy node; if the difference between the hash value of the blockchain identifier corresponding to the proxy node and the aggregate hash value is the smallest, then the proxy type of the proxy node is determined to be a computation proxy; otherwise, the proxy type of the proxy node is determined to be an auxiliary proxy; the aggregate hash value is the hash value of the random token corresponding to the pre-selected proxy and the current block height of the blockchain; the pre-selected proxy refers to the proxy node whose calculation result of the verifiable delay function has been verified and whose block height for executing the calculation process of the verifiable delay function is within the executable range; the executable range refers to the block height submitted by multiple proxy nodes to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected proxies is a positive integer greater than 3; The transceiver unit is used to send the calculation result of the verifiable delay function and the block height of the calculation process of the verifiable delay function; the calculation result and the block height of the calculation process are used by the data owner to determine the proxy type of the proxy node.

20. A data sharing device, characterized in that, Includes a transceiver unit and a decryption unit: The transceiver unit is used to receive slices of the first encryption key sent by multiple auxiliary agents; the first encryption key is determined by the data owner based on the public key of the data user; the computation agent and the multiple auxiliary agents all complete the calculation process of the verifiable delay function, and the calculation results are all verified; the difference between the hash value of the blockchain identifier corresponding to the computation agent and the aggregate hash value is the smallest; the auxiliary agent is any agent node among the pre-selected agents except the computation agent; the aggregate hash value is the hash value of the random token corresponding to the pre-selected agent and the current block height of the blockchain; the pre-selected agent refers to the agent node whose calculation result of the verifiable delay function has been verified and whose block height for executing the calculation process of the verifiable delay function is within the executable interval; the executable interval refers to the block height submitted by the multiple agent nodes to the data owner for executing the calculation process of the verifiable delay function before executing the calculation process of the verifiable delay function; the number of pre-selected agents is a positive integer greater than 3; and to receive re-encrypted ciphertext sent by the computation agent; the re-encrypted ciphertext is obtained by the computation agent re-encrypting the initial encrypted ciphertext according to the second encryption key. The initial encryption ciphertext is the ciphertext obtained by the data owner after initially encrypting the data to be shared; the second encryption key is determined by the data owner based on the data owner's private key; and the slice number corresponding to each auxiliary agent sent by the data owner is received. The decryption unit is used to reassemble multiple first-level encryption key slices according to the slice number corresponding to each auxiliary agent to obtain the first-level encryption key; and to decrypt the re-encrypted ciphertext according to the first-level encryption key to obtain the data to be shared.

21. A computing device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory, execute the method as described in any one of claims 1 to 7 according to the obtained program instructions, or execute the method as described in any one of claims 8 to 14, or execute the method as described in any one of claims 15 to 17.

22. A computer-readable storage medium, characterized in that, Includes computer-readable instructions that, when read and executed by a computer, cause the method of any one of claims 1 to 7 to be implemented, or cause the method of any one of claims 8 to 14 to be implemented, or cause the method of any one of claims 15 to 17 to be implemented.

23. A computer program product, characterized in that, It includes a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of any of the methods of claims 1 to 7, or causes the computer device to perform the steps of any of the methods of claims 8 to 14, or causes the computer device to perform the steps of any of the methods of claims 15 to 17.

Images