Multi-mechanism attribute-based encryption algorithm based on creditworthiness consensus and zero-knowledge proof

Abstract

The invention discloses a multi-mechanism attribute-based encryption algorithm based on creditworthiness consensus and zero-knowledge proof, and relates to the field of blockchains. On the basis of traditional attribute-based encryption, creditworthiness evaluation is introduced, a decentralized trust model is established for evaluating and selecting trusted nodes, and the reliability of the algorithm is improved. According to the method and the system, the data can be shared and accessed in a credible environment, zero-knowledge proof is used for verifying the correctness and integrity of the data, specific data values or other sensitive information are not leaked, and the reliability of the data is improved by combining credibility consensus and the zero-knowledge proof technology. And an innovative and efficient solution is provided for data security sharing in a multi-mechanism environment.

Description

Technical Field

[0001] The present invention mainly relates to the technical field of blockchain, specifically a multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof. Background Art

[0002] In the modern information society, data security and privacy protection have become key issues that need to be addressed. With the widespread application of cloud computing, the Internet of Things, and big data technologies, data sharing and circulation between different institutions have become more frequent. However, how to achieve efficient and secure data sharing while ensuring data privacy is one of the important challenges currently faced. Ciphertext Policy Attribute-Based Encryption (CP-ABE) technology, as a flexible encryption method, provides an effective solution to this problem. In CP-ABE, data owners are allowed to define access control policies based on the attributes of data users, thereby achieving fine-grained access control over data.

[0003] However, traditional attribute-based encryption technology has the following problems in a multi-institutional environment: (1) Trust issues: In a multi-institutional environment, the trust between institutions is difficult to guarantee. Traditional attribute-based encryption relies on a single trusted center. This single-point trust model is difficult to apply in a multi-institutional environment; (2) Security issues: How to ensure data privacy while ensuring data integrity and authenticity is a challenge faced by multi-institutional data sharing. (3) In a trustless environment, the election of appropriate ordinary blockchain nodes to undertake key generation and distribution requires multi-party consensus verification of on-chain nodes. However, the existing consensus algorithm is not fully applicable to this scenario. Proof of work not only consumes a large amount of node computing power, but also is not conducive to the participation of lightweight edge nodes. In proof of stake, offline nodes can also accumulate coin age, which may lead to free-riding behavior of participating nodes.

[0004] In order to meet the above challenges, a multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof is proposed. On the basis of traditional attribute-based encryption, the algorithm introduces the reputation consensus mechanism and zero-knowledge proof technology, thereby achieving efficient and secure data sharing in a multi-institution environment.

[0005] The reputation consensus mechanism establishes a decentralized trust model by introducing reputation evaluation. In a multi-institutional data sharing environment, the reputation consensus mechanism can be used to evaluate and select trusted nodes to ensure that data is shared and accessed in a trusted environment. Each node obtains a corresponding reputation score based on its historical behavior and contribution value. Nodes with high reputation have higher credibility in the data encryption and decryption process, thereby effectively preventing single-point trust problems. Zero-knowledge proof technology allows the prover to prove to the verifier that he has certain knowledge without leaking any additional information. In the multi-institutional attribute-based encryption algorithm, zero-knowledge proof can be used to verify the integrity and correctness of data without leaking specific data values ​​or other sensitive information, thereby ensuring data privacy and security.

[0006] In summary, by combining reputation consensus and zero-knowledge proof technology, a more secure and efficient multi-institution attribute-based encryption algorithm can be designed, providing an innovative and efficient solution for secure data sharing in a multi-institution environment. Summary of the invention

[0007] Based on this, the purpose of the present invention is to provide a multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof to solve the technical problems raised in the above background technology.

[0008] To achieve the above object, the present invention provides the following technical solutions:

[0009] The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof includes the following steps:

[0010] S1. Build a system model that includes the following participants: blockchain, data owner, data user, key generation and distribution node, and consensus verification node;

[0011] S2. Node election. Any ordinary blockchain node has the opportunity to be elected as a key generation and distribution node. The node first needs to pledge a certain amount of tokens $TokenStake as a deposit through the pledge pool smart contract, and lock it and set the lock time Time lock , we set the trust value range of the node to [0, 1]. In the initial stage, the system is based on the node online time T online And the number of pledged tokens $TokenStake is used to issue the initial trust value Trust to the node initial The first round of elections is carried out, and after each round of tasks, the system updates the factor Q by calculating the activity p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i)Quantify the node activity, computing power and calculation accuracy;

[0012] S3: After completing the quantification of the activity, computing power and calculation accuracy of node i, the system calculates the trust value Trust of the node in the previous round. i , activity update factor Q p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i) Use the following formula to calculate the updated trust value Trus * t , we normalize the trust value by the inverse tangent function, and the value range of the arctan function is The trust value of this node is always positive, so Trus * t The final value range of is [0, 1];

[0013] S4. After the consensus process begins, the N nodes with the highest trust value on the chain are voted as key generation and distribution nodes. After the node completes the generation of the attribute private key and its correctness zero-knowledge proof off-chain, it generates a transaction Tχ={ID,From,To,Act,Ope,Fee,Timestamp,Sig,Data} and packages the transaction into a block. After that, the key generation and distribution node will block Broadcast to other participating nodes on the chain for consensus verification, including block header, timestamp, and digital signature;

[0014] S5. The platform provides data access control services to obtain economic benefits, thereby issuing rewards to key generation and distribution nodes and other related nodes. Under the conditions of satisfying individual rationality and incentive compatibility, the reward obtained by each key generation and distribution node depends on the trust contribution of the node. The greater the trust contribution, the higher the platform economic reward obtained by the node. The reward will be issued in the form of $Token issued by the platform;

[0015] S6. User registration and initialization. All users in the system must register their identities on the chain and be issued a unique identity identifier by the system. The system first issues user identities UID to data owners and data users, and authorization identifiers KID to key generation and distribution nodes. Then, data users and key generation and distribution nodes obtain global public parameters GP from the chain and perform initialization operations.

[0016] S7, MA-CPABE global initialization, input system security parameter λ, run MA-CPABE global initialization algorithm GlobalSetup(λ), use group generator Construct a cyclic group satisfying e:G o ×G o →G T e, generate tuple BP = (p, g, h, e, G o , G T ), where the large prime number p is a cyclic group G o and G T The order of, g and h are the group G o The generator of

[0017] Define the system attribute domain as U = {1, 2, .., n} ≤ Z p , Z p is a finite field modulo p, and two collision-resistant hash functions H are randomly selected: {0, 1} * →G o and F:{0,1} * →G o , H and F respectively map the key generation and distribution node identifier KID and the user identity identifier UID to group G o ;

[0018] The system elects N key generation and distribution nodes {KGDNodeA, ..., KGDNodeN} through staking to undertake key generation and distribution work. Each node manages a set of attributes. Among them, Attribute i，j ∈Z p , i=1,...,N, j=1,...,q;

[0019] Generate the global public parameters GP = (p, g, h, e, G o , G T , H, F);

[0020] S8. Encrypt to form ciphertext. The data owner DO formulates an access control policy (A, ρ), where A is an access control matrix with dimension n×l, ρ is a mapping function that maps attribute i to the matrix, and converts the plaintext m, access control policy (A, ρ), global parameter GP and related attribute public key {MPK K1D，UKIn} as input, run Encrypt(m,(A,ρ),GP,{MPK K1D，UKIn})→CT obtains the encrypted ciphertext CT;

[0021] S9, user attribute private key generation. The data user applies to the key generation and distribution node for the user attribute private key based on his / her own attributes;

[0022] S10, generate zero-knowledge proof π of the correctness of the attribute private key, SKEnc&CreateProof(SK s，KID，UID , UPK UID , MSK KID.UKIn )→πKey generation distribution node input data user public key UPK UID , attribute private key SK s，KID，UID And the key generation and distribution node private key MSK KID.UKIn First, use the data user public key UPK off-chain UID Attribute private key SK s，KID，UID Encryption encapsulation is performed, and then an attribute private key correctness proof π is generated based on the Sigma non-interactive zero-knowledge proof protocol of the Fiat-Shamir transformation to ensure that the correctness of the attribute private key generated by the key generation distribution node is verified without leaking the key generation distribution node private key and the attribute private key. The generated correctness zero-knowledge proof π is then broadcast to the consensus verification nodes of the entire network to verify the correctness of the user's attribute private key;

[0023] S11. Zero-knowledge proof verification of the correctness of the attribute private key, VerifyNIZK(UPK UID , USK UID ,F(UID) χ ,π)→TureorFalse Before the data user uses the attribute private key generated by the key generation and distribution node to decrypt, the consensus verification node of the entire network first needs to verify the correctness of the attribute private key generated by the key generation and distribution node. The consensus verification node inputs the zero-knowledge proof of the correctness of the attribute private key π and the public key UPK of the data user. UID 、Private key USK UID , verify the correctness zero-knowledge proof π. If the following equations are all verified to be true, it proves that the key generation and distribution node correctly generated the attribute private key SK s，KID，UID ,

[0024] S12. The data user calculates and decrypts.

[0025] Preferably, in S1, the blockchain serves as a management chain, and a group of nodes are elected to undertake key generation and distribution work, so that each key generation and distribution node independently manages a set of attributes and is responsible for the traceability and auditability of transaction delivery;

[0026] When the data owner wants to share data m, he first creates an access policy (A, ρ) based on the LSSS matrix to grant access rights to the data user, and then encrypts the shared data by executing the encryption algorithm Encrypt to generate the ciphertext CT;

[0027] Under the condition of satisfying the set access policy, when the data user wants to access the shared data m, he first needs to apply to the relevant key generation and distribution node to obtain the attribute private key SK s，KID，UID Secondly, when the consensus verification node verifies the correctness of the attribute private key broadcast by the key generation and distribution node, the data user can use his own private key USK UID Decrypt E3 in the zero-knowledge proof π to obtain the attribute private key SK s，KID，UID , and finally, the decryption algorithm FinalDecrypt is executed to decrypt the ciphertext CT and obtain the plaintext data m;

[0028] Each key generation and distribution node independently manages a set of attributes and undertakes key generation and distribution work. Each node generates an attribute private key SK for data users who meet the access policy by executing the KeyGen algorithm off-chain. s，KID，UID , so that only data users who meet the access policy can obtain the attribute private key;

[0029] The consensus verification node is responsible for verifying the zero-knowledge proof of the correctness of the attribute private key, checking the legitimacy of the transaction, confirming whether the transaction initiator has sufficient funds to pay the relevant fees, and is responsible for the generation of blocks.

[0030] Preferably, in S2, the specific quantitative calculation process is as follows:

[0031] Calculate the activity contribution update factor. The performance of the blockchain is affected by the activity of the node. Before voting, the system calculates the activity update factor Q based on the cumulative voting behavior of node i. p (i) ;

[0032] Calculate the timeliness contribution update factor. The computing power of the node is also an important indicator to measure the performance of the chain. Nodes with strong computing power can save a lot of computing time when performing tasks. After each round of task execution, the system will calculate the timeliness update factor Q based on the node execution time. t (i) , and use this to measure the computing power of the node;

[0033] The correctness of calculation contribution update factor. The correctness of the node's execution of calculation tasks is a key indicator of blockchain reliability. Nodes with higher calculation accuracy can usually perform their tasks effectively. After each round of task execution, the system will calculate the correctness update factor Q based on the collected verification feedback. c (i) .

[0034] Preferably, in S5, it is assumed that the key generation and distribution node KGD KID The trust contribution in the access control process is TC(KGD KID ), the token reward obtained by the node is $TokenReward(KGD KID ), where the node trust contribution TC(KGD KID ) is mainly composed of activity contribution TC P (KGD KID ), Timeliness Contribution TC t (KGD KID ) and the correctness contribution TC c (KGD KID ) consists of three parts, so KGD KID The trust contribution in an access control cycle can be defined as:

[0035] TC(KGD KID )=TC p (KGD KID )+TC t (KGD KID )+TC c (KGD KID );

[0036] The honesty of the key generation and distribution node is used to predict the honest performance of the node in the current access control cycle by the probability of honest behavior, malicious behavior, and correction of malicious behavior in the historical tasks in which the node participated. If the honest performance of the key generation and distribution node is Pr c (KGD KID ), the probability that the node has malicious behavior and is corrected is Pr v (KGD KID ), the node dishonesty is expressed as probability, Pr vc (KGD KID )=Pr v (KGD KID )·(1-Pr c (KGD KID )), if the node is found to be dishonest, the platform will deduct part of the user's deposit $TokenReward(KGD KID) as a penalty Y·$TokenStake(KGD KID ), therefore, the key generation and distribution node KGD KID The platform economic benefits obtained under honest performance, and when P rc (KGD KID )=1, the key generation and distribution node KGD KID The maximum economic benefit is: $TokenReward(1) = $TokenReward(KGD KID )-TC(KGD KID ), when P rc (KGD KID )<0.5, the economic benefit obtained by the node is negative;

[0037] When the trust value of a node is lower than the set threshold, it means that the node has problems such as high attribute private key error rate, low generation efficiency, low activity, malicious voting, etc. The system will delete the public key identity of the node from the list and punish it, and will no longer accept its registration request for a period of time, making it unable to participate in system tasks for a period of time.

[0038] Preferably, the initialization process of S6 is as follows:

[0039] KGDNSetup(GP,U KID )(MPK KID.UKIn , M.S. KKID.UKIn ) The key generation and distribution node inputs the global public parameter GP and the attribute set U managed by it KID , for the managed attribute i∈U KID , choose a random number, α i，KID， Y i，KID ∈Z N , generate the following public key set and private key set:

[0040] MPK KID , U KIn ={e(g, g) αi，KID , g Yi，KID}, MPK KID , U KIn ={α i，KID， Y i，KID};

[0041] UserSetup(GP,UID)→(UPK UID , USK UID ) The data user inputs the global public parameter GP and the identity identifier UID, and selects a random index χ∈Z N， Generate the following user public key and user private key:

[0042] UPKUID =g χ , USK UID =χ.

[0043] Preferably, in S8, Encrypt(m, (A, ρ), GP, {MPK K1D，UKIn})→CT data owner inputs data plaintext m, system global public parameter GP, key generation and distribution node public key {MPK K1D，UKIn} and access control policy (A, ρ), where A is a l×n matrix, the mapping function ρ maps attribute i to matrix A, and selects a random number s∈Z N and a random vector with s as its first component make A χ represents the xth row of matrix A, and then selects a random vector with 0 as the first component make For each row of the matrix A χ , randomly select r χ ∈Z N , output data ciphertext CT = {C0, {C 1χ , C 2χ , C 3χ C 4χ} χ∈{1，2...l}}.

[0044] Preferably, in S9, KeyGen(UID, GP, S, U KID ,{MSK KID，UIn})→SK s.KID.UID When the consensus verification node passes the identity authentication of the data user, the key generation and distribution node inputs the global public parameter GP, the user attribute set S, the user identity UID, and the attribute set U managed by the key generation and distribution node. KID and its private key {MSK KID，UIn}, for each attribute i∈s in the user attribute set S, the key generation and distribution node selects a random number t∈Z N , generate the attribute private key component through the following calculation, and output the attribute private key SK S，KID，UID ={K 2，KID，UID , K 3，KID，UID , {K 1，i，KID，UID} i∈s}.

[0045] Preferably, the generation process in S10 is as follows:

[0046] S1001. Select random numbers w, k, v, r∈Z N ;

[0047] S1002. Calculate and generate the parameter E1=UPK for zero-knowledge proof UID W =g wχ , E2=UPK UID k =g kχ , E3=SK S，KID，UID ·g k ;

[0048] S1003, calculate and generate the hash value E4=H1(E1, E2, E3) of the zero-knowledge proof;

[0049] S1004, calculate and generate the parameter E5=w+E4·k for zero-knowledge proof;

[0050] S1005. Calculate and generate the parameter V1=g for zero-knowledge proof θ , V2=g αi，KID ;

[0051] S1006. Calculate and generate a hash value V3=H1(V1, V2, g) of the zero-knowledge proof;

[0052] S1007. Calculate and generate the parameter V4=θ+V3·α for zero-knowledge proof i，KID ;

[0053] S1008. Calculate and generate the parameter U1=g for zero-knowledge proof r , U2=g yi，KID ;

[0054] S1009, calculate and generate the hash value U3=H1(U1, U2, g) of the zero-knowledge proof;

[0055] S1010, calculate and generate the parameter U4=r+U3·y of zero-knowledge proof i，KID ;

[0056] S1011. Output the generated zero-knowledge proof π = (E1, E2, E3, E4, E5, V1, V2, V3, V4, U1, U2, U3, U4).

[0057] Preferably, the verification process of S11 is as follows:

[0058] S1101, verify whether the equation is established;

[0059] S1102. If the equality verification is established, it means that the zero-knowledge proof π of the correctness of the attribute private key has been verified successfully.

[0060] Preferably, the decryption process of S12 is as follows:

[0061] S1201:SKDecrypt(UPKUID , USK UID ,π)→SK s，KID，UID If the consensus verification node passes the zero-knowledge proof π of the correctness of the attribute private key, it proves that the key generation and distribution node has correctly generated the attribute private key, and the data user can use his own private key UPK UID Decrypt to obtain the attribute private key SK s，KID，UID , the data user inputs the zero-knowledge proof of the correctness of the attribute private key π, the data user's public key USK UID And the private key UPK UID , decrypt and obtain the attribute private key SK by performing the following calculation process s，KID，UID ;

[0062] S1202: FinalDecrypt(GP,CT,SK s，KID.UID )→mor△Data user obtains attribute private key SK s，KID.UID Then, input the global public parameter GP and the ciphertext CT, let I = {χ|p(χ)∈S}≤{1,2,...,l}, which represents the attribute authorization set that satisfies the decryption permission of the data owner. For the attribute χ∈l that satisfies the decryption condition, it is within the row span of the matrix A.

[0063] Decrypted data plaintext m = Co / e(g, g) s , if the attribute set s owned by the data user does not satisfy the access policy (A, ρ), then output △.

[0064] In summary, the present invention mainly has the following beneficial effects:

[0065] 1. Propose a new consensus algorithm - proof of trust contribution, which calculates the node trust value by quantifying the node activity, calculation accuracy and computing power. After that, each node will compete for the right to record accounts based on its own trust value to achieve efficient and secure data sharing in a multi-institutional trustless environment.

[0066] 2. Compared with proof of work and proof of stake, proof of trust contribution can not only mobilize a large amount of node computing power, but also effectively reduce the risk of node free riding and improve node activity and fairness.

[0067] 3. In order to verify the correctness of the attribute private key without leaking the key, a zero-knowledge proof of the correctness of the attribute private key is constructed based on the non-interactive zero-knowledge proof protocol, and verifiable key calculation on the chain is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a system model diagram of the present invention;

[0069] Figure 2It is the test result diagram of the present invention;

[0070] Figure 3 A is the formula diagram of the present invention;

[0071] Figure 4 It is the B formula diagram of the present invention;

[0072] Figure 5 It is the C formula diagram of the present invention;

[0073] Figure 6 It is the D formula diagram of the present invention;

[0074] Figure 7 It is the E formula diagram of the present invention;

[0075] Figure 8 It is the F formula diagram of the present invention;

[0076] Fig. 9 It is the G formula diagram of the present invention;

[0077] Fig.10 It is the H formula diagram of the present invention;

[0078] Fig.11 It is the Y formula diagram of the present invention;

[0079] Fig.12 It is the J formula diagram of the present invention;

[0080] Fig.13 It is the K formula diagram of the present invention;

[0081] Fig.14 L formula diagram of the present invention.

[0082] Figure Description: (a) Update factor Q according to activity p (i) and the correctness update factor Q c (i) Evaluate node performance; (b) Update factor Q based on activity p (i) and the timeliness update factor Q t (i) Evaluate node performance; (c) Update factor Q based on correctness c (i) and the timeliness update factor Q t (i) Evaluate node performance; (d) Update factor Q based on different ρ t (i) (e) The results of 40 rounds of voting. DETAILED DESCRIPTION

[0083] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0084] The following describes an embodiment of the present invention based on its overall structure.

[0085] Example

[0086] The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof includes the following steps:

[0087] S1. Build a system model that includes the following participants: blockchain, data owner, data user, key generation and distribution node, and consensus verification node;

[0088] Blockchain: As a management chain, blockchain elects a group of nodes to undertake key generation and distribution work, so that each key generation and distribution node can independently manage a set of attributes and is responsible for the traceability and auditability of transaction delivery;

[0089] Data owner: When the data owner wants to share data m, he first creates an access policy (A, ρ) based on the LSSS matrix to grant access rights to the data user, and then encrypts the shared data by executing the encryption algorithm Encrypt to generate the ciphertext CT;

[0090] Data user: When a data user wants to access shared data m, he / she must first apply to the relevant key generation and distribution node to obtain the attribute private key SK under the condition that the set access policy is met. s，KID，UID Secondly, when the consensus verification node verifies the correctness of the attribute private key broadcast by the key generation and distribution node, the data user can use his own private key USK UID Decrypt E3 in the zero-knowledge proof π to obtain the attribute private key SK s，KID，UID , and finally, the decryption algorithm FinalDecrypt is executed to decrypt the ciphertext CT and obtain the plaintext data m;

[0091] Key generation and distribution node: Each key generation and distribution node independently manages a set of attributes and undertakes key generation and distribution work. Each node generates attribute private keys SK for data users who meet the access policy by executing the KeyGen algorithm off-chain. s，KID，UID , so that only data users who meet the access policy can obtain the attribute private key;

[0092] Consensus verification node: mainly responsible for verifying the zero-knowledge proof of the correctness of the attribute private key, checking the legality of the transaction, confirming whether the transaction initiator has sufficient funds to pay the relevant fees, and responsible for the generation of blocks.

[0093] S2. Node election. Any ordinary blockchain node has the opportunity to be elected as a key generation and distribution node. The node first needs to pledge a certain amount of tokens $TokenStake as a deposit through the pledge pool smart contract, and lock it and set the lock time Time lock , we set the trust value range of the node to [0, 1]. In the initial stage, the system is based on the node online time T online And the number of pledged tokens $TokenStake is used to issue the initial trust value Trust to the node initial The first round of elections is carried out, and after each round of tasks, the system updates the factor Q by calculating the activity p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i) The node activity, computing power and calculation accuracy are quantified. The specific quantitative calculation process is as follows:

[0094] Calculate the activity contribution update factor. The performance of the blockchain is affected by the activity of the node. Before voting, the system calculates the activity update factor Qp(i) based on the cumulative voting behavior of node i, such as Figure 3 As shown in the figure, α represents the number of votes that the node has participated in, and θ x Indicates whether the node participates in the xth round of voting normally. If it participates normally, θ x =1, otherwise θ x =0,τ x Indicates whether the node has malicious voting behavior in the xth round of voting. If yes, then τ x =1, otherwise τ x =0, γ represents the penalty weight of the user for malicious voting behavior, and γ is proportional to the penalty intensity of the node;

[0095] Calculate the timeliness contribution update factor. The computing power of the node is also an important indicator for measuring the performance of the chain. Nodes with strong computing power can save a lot of computing time when performing tasks. After each round of task execution, the system will calculate the timeliness update factor Qt(i) based on the node's task execution time, and use this to measure the node's computing power. Figure 4 As shown, t represents the time consumed by the node to execute the task, and ρ is used to control the decay rate of the timeliness update factor, which is proportional to the degree of incentive for the node;

[0096] Calculation correctness contribution update factor, the correctness of the node executing the calculation task is a key indicator to measure the reliability of the blockchain. Nodes with higher calculation accuracy can usually perform their tasks effectively. After each round of task execution, the system will calculate the correctness update factor Qc(i) based on the collected verification feedback, where N represents the total number of verification feedbacks received, Nb represents the number of correct verification feedbacks, Nf represents the number of incorrect verification feedbacks, Nu represents the number of uncertain feedbacks, Nthres represents the feedback number threshold, b, f, u represent the posterior probabilities of the three verification feedback results, and the expected correctness τ c like Figure 5 As shown, the relationship between the expected correctness τc and the correctness update factor Qc(i) is defined as follows. We set the correctness reference point to τc=0.8, and ξ and φ control the rate of change of the upper and lower parts of Qc(i), respectively.

[0097] like Figure 6 As shown in S3, after completing the quantification of the activity, computing power and calculation accuracy of node i, the system updates the activity factor Q according to the node's previous trust value Trusti and activity update factor Q p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i) Use the following formula to calculate the updated trust value Trus * t , we normalize the trust value by the inverse tangent function, and the value range of the arctan function is The trust value of this node is always positive, so Trus * t The final value range of is [0, 1].

[0098] S4. After the consensus process begins, the N nodes with the highest trust value on the chain are voted as key generation and distribution nodes. After the node completes the generation of the attribute private key and its correctness zero-knowledge proof off-chain, it generates a transaction Tχ={ID,From,To,Act,Ope,Fee,Timestamp,Sig,Data} and packages the transaction into a block. Among them, ID represents the transaction identifier, From represents the sender of the transaction, To represents the receiver of the transaction, Act represents the transaction type, Ope represents the transaction operation type, Fee represents the fee to be paid to the platform for executing the transaction, Timestamp represents the publishing timestamp, Sig represents the digital signature of the publisher, Data represents the data domain of the transaction, the content in <> is the block header, H k-1 Indicates the hash value of the previous block, H mRepresents the root hash value of the block Merkle tree, Tχ ID Indicates transaction content, Proof TC Indicates the trust contribution proof of the node. Here, the From field is the key generation and distribution node, the To field is the broadcast address, the Act field is S to indicate that the calculation is completed and the result is returned, and the Ope field is B B Indicates broadcast, the Data field is data, Proof TC Trust value * i , then the key generation and distribution node will block Broadcast to other participating nodes on the chain for consensus verification, including block header, timestamp, digital signature, etc.

[0099] S5. The platform provides data access control services to obtain economic benefits, thereby issuing rewards to key generation and distribution nodes and other related nodes. Under the conditions of satisfying individual rationality and incentive compatibility, the reward obtained by each key generation and distribution node depends on the trust contribution of the node. The greater the trust contribution, the higher the platform economic reward obtained by the node. The reward will be issued in the form of $Token issued by the platform;

[0100] Assume that the key generation and distribution node KGD KID The trust contribution in the access control process is TC(KGD KID ), the token reward obtained by the node is $TokenReward(KGD KID ), where the node trust contribution TC(KGD KID ) is mainly composed of activity contribution TC P (KGD KID ), Timeliness Contribution TC t (KGD KID ) and the correctness contribution TC c (KGD KID ) consists of three parts, so KGD KID The trust contribution in an access control cycle can be defined as:

[0101] TC(KGD KID )=TC p (KGD KID )+TC t (KGD KID )+TC c (KGD KID );

[0102] The honesty of the key generation and distribution node is used to predict the honest performance of the node in the current access control cycle by the probability of honest behavior, malicious behavior, and correction of malicious behavior in the historical tasks in which the node participated. If the honest performance of the key generation and distribution node is Pr c (KGD KID ), the probability that the node has malicious behavior and is corrected is Pr v (KGD KID ), the node dishonesty is expressed as probability, Pr vc (KGD KID )=Pr v (KGD KID )·(1-Pr c (KGD KID )), if the node is found to be dishonest, the platform will deduct part of the user's deposit $TokenReward(KGD KID ) as a penalty Y·$TokenStake(KGD KID ), therefore, the key generation and distribution node KGD KID The platform economic benefits obtained under honest performance, and when P rc (KGD KID )=1, the key generation and distribution node KGD KID The maximum economic benefit is: $TokenReward(1) = $TokenReward(KGD KID )-TC(KGD KID ), when P rc (KGD KID )<0.5, the economic benefit obtained by the node is negative, please refer to Figure 7 As shown;

[0103] When the trust value of a node is lower than the set threshold, it means that the node has problems such as high attribute private key error rate, low generation efficiency, low activity, malicious voting, etc. The system will delete the public key identity of the node from the list and punish it, and will no longer accept its registration request for a period of time, making it unable to participate in system tasks for a period of time.

[0104] S6. User registration and initialization. All users in the system must register their identities on the chain and be issued a unique identity identifier by the system. The system first issues user identities UID to data owners and data users, and authorization identifiers KID to key generation and distribution nodes. Then, data users and key generation and distribution nodes obtain global public parameters GP from the chain and perform initialization operations. The specific initialization process is as follows:

[0105] 1. KGDNSetup (GP, U KID)(MPK KID.UKIn , M.S. KKID.UKIn ), the key generation and distribution node inputs the global public parameter GP and the attribute set U managed KID , for the managed attribute i∈U KID , choose a random number, α i，KID， Y i，KID ∈Z N , generate the following public key set and private key set: MPK KID , U KIn ={e(g, g) αi，KID , g Yi，KID}, MPK KID , U KIn ={α i，KID， Y i，KID};

[0106] 2. UserSetup(GP,UID)→(UPK UID , USK UID ) The data user inputs the global public parameter GP and the identity identifier UID, and selects a random index χ∈Z N， Generate the following user public key and user private key: UPK UID =g χ , USK UID =χ.

[0107] S7, MA-CPABE global initialization;

[0108] 1. Input the system security parameter λ, run the MA-CPABE global initialization algorithm GlobalSetup(λ), and use the group generator Construct a cyclic group satisfying e:G o ×G o →G T e, generate tuple BP = (p, g, h, e, G o , G T ), where the large prime number p is a cyclic group G o and G T The order of, g and h are the group G o The generator of

[0109] 2. Define the system attribute domain as U = {1, 2, .., n} ≤ Z p , Z p is a finite field modulo p, and two collision-resistant hash functions H are randomly selected: {0, 1} * →G o and F:{0,1} * →G o, H and F respectively map the key generation and distribution node identifier KID and the user identity identifier UID to group G o ;

[0110] 3. The system selects N key generation and distribution nodes {KGDNodeA, ..., KGDNodeN} through staking to undertake key generation and distribution work. Each node manages a set of attributes. Among them, Attribute i，j ∈Z p , i=1,...,N, j=1,...,q;

[0111] 4. Generate the global public parameters GP=(p, g, h, e, G o , G T , H, F).

[0112] S8. Encrypt to form ciphertext. The data owner DO formulates an access control policy (A, ρ), where A is an access control matrix with dimension n×l, ρ is a mapping function that maps attribute i to the matrix, and converts the plaintext m, access control policy (A, ρ), global parameter GP and related attribute public key {MPK K1D，UKIn} as input, run Encrypt(m,(A,ρ),GP,{MPK K1D，UKIn})→CT obtains the encrypted ciphertext CT, specifically:

[0113] Encrypt(m,(A,ρ),GP,{MPK K1D，UKIn})→CT, the data owner inputs the data plaintext m, the system global public parameter GP, and the key generation and distribution node public key {MPK K1D，UKIn} and access control policy (A, ρ), where A is a l×n matrix, the mapping function ρ maps attribute i to matrix A, and selects a random number s∈Z N and a random vector with s as its first component make A χ represents the xth row of matrix A, and then selects a random vector with 0 as the first component make For each row of the matrix A χ , randomly select r χ ∈Z N , output data ciphertext CT = {C0, {C 1χ , C 2χ , C 3χ C 4χ} χ∈{1，2...l}}, see Figure 8 shown.

[0114] S9. User attribute private key generation. Data users apply to the key generation and distribution node for user attribute private keys based on their own attributes, specifically including:

[0115] KeyGen(UID,GP,S,U KID ,{MSK KID.UKIn})→SK sK1D.UID , when the consensus verification node passes the identity authentication of the data user, the key generation and distribution node inputs the global public parameter GP, the user attribute set S, the user identity identifier UID, the attribute set UKID managed by the key generation and distribution node and its private key {MSK KID.UKIn}, for the user attribute set S S For each attribute i∈s in the key generation distribution node, a random number t∈Z is selected N , generate the attribute private key component through the following calculation, and output the attribute private key SK sK1D.UID ={K 2,KID,UID ,K 3,KID,UID ,{K 1，i，KID,UID} i∈s}, see Fig. 9 shown.

[0116] S10, generate zero-knowledge proof π of the correctness of the attribute private key, SKEnc&CreateProof(SK s，KID，UID , UPK UID , MSK KID.UKIn )→πKey generation distribution node input data user public key UPK UID , attribute private key SK s，KID，UID And the key generation and distribution node private key MSK KID.UKIn First, use the data user public key UPK off-chain UID Attribute private key SK s，KID，UID Encryption encapsulation is performed, and then an attribute private key correctness proof π is generated based on the Sigma non-interactive zero-knowledge proof protocol of the Fiat-Shamir transformation to ensure that the correctness of the attribute private key generated by the key generation distribution node is verified without leaking the key generation distribution node private key and the attribute private key. Then the generated correctness zero-knowledge proof π is broadcast to the consensus verification node of the whole network to verify the correctness of the user's attribute private key. The specific generation process is as follows:

[0117] S1001. Select random numbers w, k, v, r∈Z N ;

[0118] S1002. Calculate and generate the parameter E1=UPK for zero-knowledge proof UID W =gwχ , E2=UPK UID k =g kχ , E3=SK S，KID，UID ·g k ;

[0119] S1003, calculate and generate the hash value E4=H1(E1, E2, E3) of the zero-knowledge proof;

[0120] S1004, calculate and generate the parameter E5=w+E4·k for zero-knowledge proof;

[0121] S1005. Calculate and generate the parameter V1=g for zero-knowledge proof θ , V2=g αi，KID ;

[0122] S1006. Calculate and generate a hash value V3=H1(V1, V2, g) of the zero-knowledge proof;

[0123] S1007. Calculate and generate the parameter V4=θ+V3·α for zero-knowledge proof i，KID ;

[0124] S1008. Calculate and generate the parameter U1=g for zero-knowledge proof r , U2=g yi，KID ;

[0125] S1009, calculate and generate the hash value U3=H1(U1, U2, g) of the zero-knowledge proof;

[0126] S1010, calculate and generate the parameter U4=r+U3·y of zero-knowledge proof i，KID ;

[0127] S1011. Output the generated zero-knowledge proof π = (E1, E2, E3, E4, E5, V1, V2, V3, V4, U1, U2, U3, U4).

[0128] S11. Zero-knowledge proof verification of the correctness of the attribute private key, VerifyNIZK(UPK UID , USK UID ,F(UID) χ ,π)→TureorFalse Before the data user uses the attribute private key generated by the key generation and distribution node to decrypt, the consensus verification node of the entire network first needs to verify the correctness of the attribute private key generated by the key generation and distribution node. The consensus verification node inputs the zero-knowledge proof of the correctness of the attribute private key π and the public key UPK of the data user. UID 、Private key USK UID, verify the correctness zero-knowledge proof π. If the following equations are all verified to be true, it proves that the key generation and distribution node correctly generated the attribute private key SK s，KID，UID , the specific verification process is as follows:

[0129] S1101, Verification Fig.10 Is the formula valid?

[0130] S1102, if Fig.10 If the formula verification is established, it means that the zero-knowledge proof π of the correctness of the attribute private key has been verified.

[0131] S12. The data user performs calculations to decrypt. The specific decryption process is as follows:

[0132] S1201:SKDecrypt(UPK UID , USK UID ,π)→SK s，KID，UID If the consensus verification node passes the zero-knowledge proof π of the correctness of the attribute private key, it proves that the key generation and distribution node has correctly generated the attribute private key, and the data user can use his own private key UPK UID Decrypt to obtain the attribute private key SK s，KID，UID , the data user inputs the zero-knowledge proof of the correctness of the attribute private key π, the data user's public key USK UID And the private key UPK UID , decrypt and obtain the attribute private key SK by performing the following calculation process s，KID，UID , see Fig.11 As shown;

[0133] S1202: FinalDecrypt(GP,CT,SK s，KID.UID )→mor△Data user obtains attribute private key SK s，KID.UID Then, input the global public parameter GP and the ciphertext CT, let I = {χ|p(χ)∈S}≤{1,2,...,l}, which represents the attribute authorization set that satisfies the decryption permission of the data owner. For the attribute χ∈l that satisfies the decryption condition, within the row span of the matrix A, for each χ, we can calculate Fig.12 As shown;

[0134] Randomly select a constant set {C χ ∈Z N} χ∈l , so that∑ x c x A x =(1,0,..0), then Therefore, Fig.13 As shown;

[0135] And use Fig.14 The formula recovers the data plaintext;

[0136] Decrypted data plaintext m = Co / e(g, g) s , if the attribute set s owned by the data user does not satisfy the access policy (A, ρ), then output △.

[0137] Based on traditional attribute-based encryption, the algorithm introduces reputation evaluation to establish a decentralized trust model for evaluating and selecting trusted nodes to ensure that data is shared and accessed in a trusted environment; zero-knowledge proof is used to verify the correctness and integrity of the data without leaking specific data values ​​or other sensitive information; by combining reputation consensus and zero-knowledge proof technology, it provides an innovative and efficient solution for secure data sharing in a multi-institutional environment.

[0138] Experimental simulation analysis of the effect of the present invention:

[0139] Experimental environment: The experiment uses a host (Intel Core i7-8750H CPU@2.20GHz, 8.0GB RAM, Ubuntu18.64 operating system), and adopts the pairing proposed in JPBC based on the elliptic curve y2=x3+x. For the blockchain part, we use Remix, an online smart contract compilation platform provided by Ethereum, to compile and deploy smart contract codes, and open multiple ports to simulate multiple nodes participating in the competition for accounting rights based on the Proof of Trust Contribution (PoTC) consensus mechanism. The verification difficulty is dynamically adjusted according to the contribution of the participating nodes. Nodes with high contribution have low verification difficulty. Ultimately, the longest chain is used as the benchmark to resolve accounting conflicts. For each experiment, 20 independent experiments were repeated, and the average value was taken as the experimental result. The comparison of simulation time at each stage of different schemes is shown in the figure. Figure 2 shown.

[0140] like Figure 2 As shown in (a)-(c), the experiment also updates the factor Q according to the activity p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i) To evaluate the performance of nodes in terms of activity, computational time and computational accuracy. Obviously, node performance will vary with Q p (i) , Q t (i) , Q c (i) The increase of gives a better performance, and the weights of the above three parameters are respectively determined by the parameters ξ, ζ control. When we have higher requirements on the timeliness and correctness of node execution tasks, we can set ξ, ζ higher, and vice versa. Figure 2 (d) shows the update factor Q based on different timeliness t (i) The change curve of Q t (i) The faster it decreases, the higher the value can be assigned to the parameter ρ when the system is sensitive to the timeliness of the node's task execution, otherwise a lower value can be selected.

[0141] We set the initial trust values ​​of excellent nodes, ordinary nodes, and malicious nodes to 0.5, 0.4, and 0.3 respectively and conduct a voting simulation. Figure 2 As shown in (e), after multiple rounds of voting, the number of votes obtained by excellent nodes gradually increases and they maintain the lead in the subsequent voting process. Since other nodes have no bad records, they are more inclined to vote for nodes with high trust values. Ordinary nodes are relatively stable, while the trust value of malicious nodes gradually decreases with the increase of election rounds. When the trust value of a node is lower than the set threshold, the system will delete the public key identity of the node from the list and will no longer accept its registration request for a period of time, making it unable to participate in system tasks for a period of time.

[0142] Although an embodiment of the present invention has been shown and described, this specific embodiment is merely an explanation of the present invention and is not a limitation of the invention. The specific features, structures, materials or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. After reading this specification, those skilled in the art may make modifications, substitutions and variations to the embodiments without creative contributions as needed without departing from the principles and purpose of the present invention. However, as long as they are within the scope of the claims of the present invention, they are protected by patent law.

Claims

1. A multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof, characterized by: The following steps are involved: S1. Build a system model that includes the following participants: blockchain, data owner, data user, key generation and distribution node, and consensus verification node; S2. Node election. Any ordinary blockchain node has the opportunity to be elected as a key generation and distribution node. The node first needs to pledge a certain amount of tokens $TokenStake as a deposit through the pledge pool smart contract, and lock it and set the lock time Time lock , we set the trust value range of the node to [0, 1]. In the initial stage, the system is based on the node online time T online And the number of pledged tokens $TokenStake is used to issue the initial trust value Trust to the node initial The first round of elections is carried out, and after each round of tasks, the system updates the factor Q by calculating the activity p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i) Quantify the node activity, computing power and calculation accuracy; S3: After completing the quantification of the activity, computing power and calculation accuracy of node i, the system calculates the trust value Trust of the node in the previous round. i , activity update factor Q p (i) , Timeliness update factor Q t (i) And the correctness update factor Q c (i) Use the following formula to calculate the updated trust value Trus * t , we normalize the trust value by the inverse tangent function, and the value range of the arctan function is The trust value of this node is always positive, so Trus * t The final value range of is [0, 1]; S4. After the consensus process begins, the N nodes with the highest trust value on the chain are voted as key generation and distribution nodes. After the node completes the generation of the attribute private key and its correctness zero-knowledge proof off-chain, it generates a transaction Tχ={ID,From,To,Act,Ope,Fee,Timestamp,Sig,Data} and packages the transaction into a block L2Block i ={ <H k-1 , H m , Timestamp i >,Tχ,Proof TC }, then the key generation and distribution node will block L2Block i Broadcast to other participating nodes on the chain for consensus verification, including block header, timestamp, and digital signature; S5. The platform provides data access control services to obtain economic benefits, thereby issuing rewards to key generation and distribution nodes and other related nodes. Under the conditions of satisfying individual rationality and incentive compatibility, the reward obtained by each key generation and distribution node depends on the trust contribution of the node. The greater the trust contribution, the higher the platform economic reward obtained by the node. The reward will be issued in the form of $Token issued by the platform; S6. User registration and initialization. All users in the system must register their identities on the chain and be issued a unique identity identifier by the system. The system first issues user identities UID to data owners and data users, and authorization identifiers KID to key generation and distribution nodes. Then, data users and key generation and distribution nodes obtain global public parameters GP from the chain and perform initialization operations. S7, MA-CPABE global initialization, input system security parameter λ, run MA-CPABE global initialization algorithm GlobalSetup(λ), use group generator Construct a cyclic group satisfying e:G o ×G o →G T e, generate tuple BP = (p, g, h, e, G o , G T ), where the large prime number p is a cyclic group G o and G T The order of, g and h are the group G o The generator of Define the system attribute domain as U = {1, 2, .., n} ≤ Z p , Z p is a finite field modulo p, and two collision-resistant hash functions H are randomly selected: {0, 1} * →G o and F:{0,1} * →G o , H and F respectively map the key generation and distribution node identifier KID and the user identity identifier UID to group G o ; The system elects N key generation and distribution nodes {KGDNodeA, ..., KGDNodeN} through staking to undertake key generation and distribution work. Each node manages a set of attributes U KID =Attribute i，j ={A i , 1, ..., A i，q }, where Attribute i，j ∈Z p , i=1,...,N, j=1,...,q; Generate the global public parameters GP = (p, g, h, e, G o , G T , H, F); S8. Encrypt to form ciphertext. The data owner DO formulates an access control policy (A, ρ), where A is an access control matrix with dimension n×l, ρ is a mapping function that maps attribute i to the matrix, and converts the plaintext m, access control policy (A, ρ), global parameter GP and related attribute public key {MPK K1D，UKIn } as input, run Encrypt(m,(A,ρ),GP,{MPK K1D，UKIn })→CT obtains the encrypted ciphertext CT; S9, user attribute private key generation. The data user applies to the key generation and distribution node for the user attribute private key based on his / her own attributes; S10, generate zero-knowledge proof of correctness of attribute private key π, SKEnc&CreateProof(SK s，KID，UID , UPK UID , MSK KID.UKIn )→πKey generation distribution node input data user public key UPK UID , attribute private key SK s，KID，UID And the key generation and distribution node private key MSK KID.UKIn First, use the data user public key UPK off-chain UID Attribute private key SK s，KID，UID Encryption encapsulation is performed, and then an attribute private key correctness proof π is generated based on the Sigma non-interactive zero-knowledge proof protocol of the Fiat-Shamir transformation to ensure that the correctness of the attribute private key generated by the key generation distribution node is verified without leaking the key generation distribution node private key and the attribute private key. The generated correctness zero-knowledge proof π is then broadcast to the consensus verification nodes of the entire network to verify the correctness of the user's attribute private key; S11. Zero-knowledge proof verification of the correctness of the attribute private key, VerifyNIZK(UPK UID , USK UID ,F(UID) χ ,π)→TureorFalse Before the data user uses the attribute private key generated by the key generation and distribution node to decrypt, the consensus verification node of the entire network first needs to verify the correctness of the attribute private key generated by the key generation and distribution node. The consensus verification node inputs the zero-knowledge proof of the correctness of the attribute private key π and the public key UPK of the data user. UID 、Private key USK UID , verify the correctness zero-knowledge proof π. If the following equations are all verified to be true, it proves that the key generation and distribution node correctly generated the attribute private key SK s，KID，UID , S12. The data user calculates and decrypts.

2. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: In S1, the blockchain acts as a management chain, and a group of nodes are elected to undertake key generation and distribution work, so that each key generation and distribution node independently manages a set of attributes and is responsible for the traceability and auditability of transaction delivery; When the data owner wants to share data m, he first creates an access policy (A, ρ) based on the LSSS matrix to grant access rights to the data user, and then encrypts the shared data by executing the encryption algorithm Encrypt to generate the ciphertext CT. Under the condition of satisfying the set access policy, when the data user wants to access the shared data m, he first needs to apply to the relevant key generation and distribution node to obtain the attribute private key SK s，KID，UID Secondly, when the consensus verification node verifies the correctness of the attribute private key broadcast by the key generation and distribution node, the data user can use his own private key USK UID Decrypt E3 in the zero-knowledge proof π to obtain the attribute private key SK s，KID，UID , and finally, the decryption algorithm FinalDecrypt is executed to decrypt the ciphertext CT and obtain the plaintext data m; Each key generation and distribution node independently manages a set of attributes and undertakes key generation and distribution work. Each node generates an attribute private key SK for data users who meet the access policy by executing the KeyGen algorithm off-chain. s，KID，UID , so that only data users who meet the access policy can obtain the attribute private key; The consensus verification node is responsible for verifying the zero-knowledge proof of the correctness of the attribute private key, checking the legitimacy of the transaction, confirming whether the transaction initiator has sufficient funds to pay the relevant fees, and is responsible for the generation of blocks.

3. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: In S2, the specific quantitative calculation process is as follows: Calculate the activity contribution update factor. The performance of the blockchain is affected by the activity of the node. Before voting, the system calculates the activity update factor Q based on the cumulative voting behavior of node i. p (i) ; Calculate the timeliness contribution update factor. The computing power of the node is also an important indicator to measure the performance of the chain. Nodes with strong computing power can save a lot of computing time when performing tasks. After each round of task execution, the system will calculate the timeliness update factor Q based on the node execution time. t (i) , and use this to measure the computing power of the node; The correctness of calculation contribution update factor. The correctness of the node's execution of calculation tasks is a key indicator of blockchain reliability. Nodes with higher calculation accuracy can usually perform their tasks effectively. After each round of task execution, the system will calculate the correctness update factor Q based on the collected verification feedback. c (i) .

4. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: In S5, it is assumed that the key generation and distribution node KGD KID The trust contribution in the access control process is TC(KGD KID ), the token reward obtained by the node is $TokenReward(KGD KID ), Among them, the node trust contribution TC (KGD KID ) is mainly composed of activity contribution TC P (KGD KID ), Timeliness Contribution TC t (KGD KID ) and the correctness contribution TC c (KGD KID ) consists of three parts, so KGD KID The trust contribution in an access control cycle can be defined as: TC(KGD KID )=TC p (KGD KID )+TC t (KGD KID )+TC c (KGD KID ); The honesty of the key generation and distribution node is used to predict the honest performance of the node in the current access control cycle by the probability of honest behavior, malicious behavior, and correction of malicious behavior in the historical tasks in which the node participated. If the honest performance of the key generation and distribution node is Pr c (KGD KID ), the probability that the node has malicious behavior and is corrected is Pr v (KGD KID ), the node dishonesty is expressed as probability, Pr vc (KGD KID )=Pr v (KGD KID )·(1-Pr c (KGD KID )), if the node is found to be dishonest, the platform will deduct part of the user's deposit $TokenReward(KGD KID ) as a penalty Y·$TokenStake(KGD KID ), therefore, the key generation and distribution node KGD KID The platform economic benefits obtained under honest performance, and when P rc (KGD KID )=1, the key generation and distribution node KGD KID The maximum economic benefit is: $TokenReward(1) = $TokenReward(KGD KID )-TC(KGD KID ), when P rc (KGD KID )<0.5, the economic benefit obtained by the node is negative; When the trust value of a node is lower than the set threshold, it means that the node has problems such as high attribute private key error rate, low generation efficiency, low activity, malicious voting, etc. The system will delete the public key identity of the node from the list and punish it, and will no longer accept its registration request for a period of time, making it unable to participate in system tasks for a period of time.

5. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: The initialization process of S6 is as follows: KGDNSetup(GP,U KID )(MPK KID.UKIn , M.S. KKID.UKIn ) The key generation and distribution node inputs the global public parameter GP and the attribute set U managed by it KID , for the managed attribute i∈U KID , choose a random number, α i，KID， Y i，KID ∈Z N , generate the following public key set and private key set: MPK KID ,U KIn ={e(g,g) αi，KID ,g Yi，KID },MPK KID ,U KIn ={α i，KID ,Y i，KID }; UserSetup(GP,UID)→(UPK UID , USK UID ) The data user inputs the global public parameter GP and the identity identifier UID, and selects a random index χ∈Z N， Generate the following user public key and user private key: UPK UID =g χ ,USK UID =χ。 6. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: In S8, Encrypt(m,(A,ρ),GP,{MPK K1D，UKIn })→CT data owner inputs data plaintext m, system global public parameter GP, key generation and distribution node public key {MPK K1D，UKIn } and access control policy (A, ρ), where A is a l×n matrix, the mapping function ρ maps attribute i to matrix A, and selects a random number s∈Z N and a random vector with s as its first component make A χ represents the xth row of matrix A, and then selects a random vector with 0 as the first component make For each row of the matrix A χ , randomly select r χ ∈Z N , output data ciphertext CT = {C0, {C 1χ , C 2χ , C 3χ C 4χ } χ∈{1，2...l} }.

7. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: In S9, KeyGen(UID, GP, S, U KID ,{MSK KID，UIn })→SK s.KID.UID When the consensus verification node passes the identity authentication of the data user, the key generation and distribution node inputs the global public parameter GP, the user attribute set S, the user identity UID, and the attribute set U managed by the key generation and distribution node. KID and its private key {MSK KID，UIn }, for each attribute i∈s in the user attribute set S, the key generation and distribution node selects a random number t∈Z N , generate the attribute private key component through the following calculation, and output the attribute private key SK S，KID，UID ={K 2，KID，UID , K 3，KID，UID , {K 1，i，KID，UID } i∈s }.

8. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: The generation process in S10 is as follows: S1001. Select random numbers w, k, v, r∈Z N ; S1002. Calculate and generate the parameter E1=UPK for zero-knowledge proof UID W =g wχ , E2=UPK UID k =g kχ , E3=SK S，KID，UID ·g k ; S1003, calculate and generate the hash value E4=H1(E1, E2, E3) of the zero-knowledge proof; S1004, calculate and generate the parameter E5=w+E4·k for zero-knowledge proof; S1005. Calculate and generate the parameter V1=g for zero-knowledge proof θ , V2=g αi，KID ; S1006. Calculate and generate a hash value V3=H1(V1, V2, g) of the zero-knowledge proof; S1007. Calculate and generate the parameter V4=θ+V3·α for zero-knowledge proof i，KID ; S1008. Calculate and generate the parameter U1=g for zero-knowledge proof r , U2=g yi，KID ; S1009, calculate and generate the hash value U3=H1(U1, U2, g) of the zero-knowledge proof; S1010, calculate and generate the parameter U4=r+U3·y of zero-knowledge proof i，KID ; S1011. Output the generated zero-knowledge proof π = (E1, E2, E3, E4, E5, V1, V2, V3, V4, U1, U2, U3, U4).

9. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: The verification process of S11 is as follows: S1101, verify whether the equation is established; S1102. If the equality verification is established, it means that the zero-knowledge proof π of the correctness of the attribute private key has been verified.

10. The multi-institution attribute-based encryption algorithm based on reputation consensus and zero-knowledge proof according to claim 1 is characterized in that: The decryption process of S12 is as follows: S1201:SKDecrypt(UPK UID , USK UID ,π)→SK s，KID，UID If the consensus verification node passes the zero-knowledge proof π of the correctness of the attribute private key, it proves that the key generation and distribution node has correctly generated the attribute private key, and the data user can use his own private key UPK UID Decrypt to obtain the attribute private key SK s，KID，UID , the data user inputs the zero-knowledge proof of the correctness of the attribute private key π, the data user's public key USK UID And the private key UPK UID , decrypt and obtain the attribute private key SK by performing the following calculation process s，KID，UID ; S1202: FinalDecrypt(GP,CT,SK s，KID.UID )→mor△Data user obtains attribute private key SK s，KID.UID Then, input the global public parameter GP and the ciphertext CT, let I = {χ|p(χ)∈S}≤{1,2,...,l}, which represents the attribute authorization set that satisfies the decryption permission of the data owner. For the attribute χ∈l that satisfies the decryption condition, it is within the row span of the matrix A. Decrypted data plaintext m = Co / e(g, g) s , if the attribute set s owned by the data user does not satisfy the access policy (A, ρ), then output △.

Images