Blockchain data trusted interaction method based on multi-permission attribute-based encryption

Abstract

The application provides a blockchain data trusted interaction method based on multi-permission attribute-based encryption, which comprises the following steps: step 1: system initialization. The whole system generates initial parameters, including the generation and on-chain of public parameters, and the generation of public keys and private keys. Step 2: data encryption. The data owner in the system needs to sort and encrypt data, and upload the ciphertext information to the blockchain. Step 3: key generation. When the data user wants to access the data of other data owners, he will send an access request to the blockchain. After monitoring the access request of the data user, the blockchain notifies the attribute permission to provide the access key. Step 4: data decryption. The data user who needs to access the encrypted data obtains the access key and then downloads the corresponding ciphertext. The data user decrypts the ciphertext according to the system parameters and attribute token to obtain the data.

Description

Technical Field

[0001] This invention relates to the fields of encryption methods and blockchain, and particularly to a blockchain data trusted interaction method based on multi-permission attribute base encryption. Background Technology

[0002] This section provides only background information relevant to this disclosure and is not necessarily prior art.

[0003] Cloud computing architecture has become the core model of modern computing, providing powerful data processing, analysis, and storage capabilities, and is widely used in fields such as the Internet of Things, intelligent transportation, and smart industry. Through cloud architecture, data can be efficiently processed and stored in a centralized cloud environment, thereby reducing the computing burden on terminal devices and improving system scalability and responsiveness. This architecture can not only handle the concurrent demands of large-scale data but also provide reliable computing support for various complex applications. With technological advancements, the application scope of cloud architecture is constantly expanding, and its role is becoming increasingly indispensable.

[0004] However, with the proliferation of IoT devices and the continuous growth of data traffic, cloud architectures face the severe challenge of processing massive amounts of data. Ensuring that this data can be quickly and securely uploaded to the blockchain and processed with low latency is a pressing technical problem. The dynamic changes in networks, the complexity of multi-source heterogeneous devices, and the large-scale concurrency of terminal nodes all increase the management difficulty of cloud systems. Especially in data sharing and communication, ensuring full auditability of communication events becomes crucial to maintaining system transparency and trust. This is not only a technical requirement but also a matter of user confidence in the system; any data leakage or delayed processing can have serious consequences.

[0005] Blockchain technology, as a decentralized distributed ledger, offers a powerful tool for solving these problems due to its tamper-proof and traceable characteristics. Cloud architecture combined with blockchain technology ensures the transparency and security of the data on-chain process, while a distributed trust mechanism guarantees that all communication and operations within the system can be audited and traced. The immutability and distributed trust that blockchain brings to the cloud environment further enhance the overall security and reliability of the cloud system. It is worth noting that blockchain has already demonstrated its unique advantages in many fields, especially in data security, where its application prospects are immeasurable.

[0006] Furthermore, the massive amounts of data generated in fields such as the Internet of Things (IoT), smart industry, and intelligent transportation not only require rapid processing speeds but also necessitate ensuring confidentiality and access control during data transmission. Multi-Authority Attribute-Based Encryption (MA-ABE) technology provides a fine-grained encryption solution for data access in cloud architectures, allowing control over data access permissions based on specific user attributes. This encryption method effectively prevents unauthorized access, ensuring data security in complex, distributed environments. This encryption method is gradually becoming an industry standard for data security and is gaining increasing attention and application from enterprises and institutions. Summary of the Invention

[0007] Purpose of the invention: To address the shortcomings of existing technologies, this invention provides a blockchain data trusted interaction method based on multi-permission attribute-based encryption, in order to improve the problems of trusted data interaction under the existing cloud architecture, enhance the security and trustworthiness of the cloud system, and reduce unreliable factors in data interaction.

[0008] This invention specifically provides a blockchain data trusted interaction method based on multi-permission attribute-based encryption, comprising the following steps:

[0009] Step 1: Initialize the system and generate initial parameters. The cloud server generates a global public parameter GP based on the security parameter λ, and the system generates a public key and a private key based on the GP.

[0010] Step 2: Based on the initialization parameters obtained in Step 1, encrypt the data, and the data owner uploads the ciphertext and ciphertext hash value to the cloud server.

[0011] Step 3: The data user initiates a data access request, and the system generates a key based on the data user's attributes.

[0012] Step 4: The data user decrypts the ciphertext CT using the key and system parameters obtained in Step 3.

[0013] Furthermore, in step 1, the initial parameters include the system's global public parameter GP, attribute permissions, and public / private key pairs for different roles.

[0014] Furthermore, in step 1, the global common parameter GP is initialized. The cloud server uses the security parameter λ as input and the global common parameter GP as output. In the global settings, a bilinear group G of order N = p1p2p3 is selected, where p1, p2, and p3 are prime numbers. The global common parameter GP includes N and G. p1 The generator g1 is defined. Additionally, a one-way hash function H: {0, 1} is defined to map the global identity GID to elements of G.* →G.

[0015] Attribute permission initialization: The system allocates a set of different attributes according to smart contract 1. Smart contract 1 checks whether the attribute permission sender is a cloud server. If so, the attribute permission is assigned to the attribute's permission list, and a threshold t is set. If not, the contract will not continue execution, and the system will send an error message to the contract caller.

[0016] The generation of public-private key pairs is based on attribute permissions (AA). i The global public parameters GP output a pair of keys (sk i , pk i For each attribute 'a' managed by this permission, the permission randomly selects two indices. And released As the public key. (Secondary key) Will be by AA i Storage. Public key PK i It will be stored in the blockchain.

[0017] Step 1 includes two key pair initialization algorithms. The first algorithm is the role initialization algorithm, which takes the global public parameter GP as input. Role initialization generates a role key pair (rsk, rpk) based on the global public parameter GP, where rsk is... and rpk=g rsk A random value in the public key rpk, which is stored in the blockchain.

[0018] The second algorithm is the cloud server database initialization algorithm, similar to the role initialization algorithm. For cloud server database initialization, the algorithm accepts the globally common parameter GP as input and generates a key pair (vsk, vpk) for the database system.

[0019] The two key pairs are primarily used to encrypt the ciphertext CT to obtain the data hash value. The role key (rsk, rpk) is used to sign and verify the ciphertext, while the database system key (vsk, vpk) is used for signature verification when the ciphertext is uploaded to the blockchain on the cloud server.

[0020] Furthermore, in step 1, the blockchain calculates the attribute key PK based on smart contract 2. a The smart contract 2 collects enough public keys (pk) from different permissions (AA) for the blockchain. i Then, the attribute key PK is calculated using the Shamir secret sharing scheme. a Public key PK needs to be collected i The quantity is determined by a threshold t. Data users access data via their held attribute key PK. aTo decrypt encrypted messages corresponding to specific attributes.

[0021] Furthermore, in step 2, the role uploading the data executes the Encrypt algorithm. The encryption algorithm uses data M and an n×l access matrix A, with the function ρ mapping its rows to attributes. It selects a random... and a random vector p is its first term. Let λ be... x A represents x ·v, where A x It is the x-th row of a, which also selects a random vector. The first term is 0. Let ω x A represents x ·w. For each row of A, A x Randomly select one s is The random value in α ρ(x) This represents the value corresponding to the attribute ρ(x). The ciphertext is calculated as follows:

[0022] C0 = Me(g1, g1) s

[0023]

[0024] Furthermore, after calculating the ciphertext, the data owner uses their own key rsk. i Sign the ciphertext. The signed ciphertext CT is transferred via smart contract 3. sign Uploaded to the blockchain. Smart contract 3 will detect whether the sender of the encrypted message is the data owner, whether the recipient is a cloud server database, and save the encrypted hash value.

[0025] Furthermore, in step 3, when a data user wants to access data belonging to another data owner, they will send an access request to the blockchain. After monitoring the data user's access request, the blockchain notifies the attribute authority to provide an access key. Based on the role's attributes, the attribute authority sends the access key to the data user using its secret key sk. For role with attribute 'a', a key is generated, and the permission is calculated as follows:

[0026]

[0027] Where GID stands for global identity, α a and y a for The random value in.

[0028] Furthermore, in step 4, before the decryption algorithm begins, the data user first uses the data owner's public key rpk. i Verify the authenticity of the encrypted CT scan.

[0029] Furthermore, in step 4, the ciphertext CT and the decryption token K are used. a，GID The data is input along with the global public parameter GP, and outputs data M. It is assumed that the ciphertext is encrypted under the access matrix (A, ρ). To decrypt the data, the data user DU will obtain H(GID) from the random Oracle model. If DU is related to A... x A subset of the key K ρ(x)，GID If (1, 0, ..., 0) spans these rows, then the decryption process of data user DU is as follows.

[0030] For each such x, the decryptor calculates according to the following formula:

[0031]

[0032] Then, the decryptor selects a constant. Make ∑ x c x A x = (1, 0, ..., 0), and calculate:

[0033]

[0034] Then the data M can be calculated as:

[0035]

[0036] In step 4, the data user finally obtains the data they wish to access through the blockchain and cloud server database.

[0037] Compared with the prior art, the beneficial effects of the present invention are:

[0038] The access control of this invention offers high granularity. Through multi-permission attribute-based encryption, the method can flexibly set access permissions based on the attributes of different users. This means that data encryption and decryption permissions can be managed by multiple independent authorization authorities, and only users meeting specific conditions or attributes can access the relevant data. This fine-grained control significantly enhances the system's security and flexibility, ensuring that only users with appropriate permissions can decrypt data and preventing unauthorized access.

[0039] This invention provides data security and privacy protection. In a blockchain environment, data security and privacy are core issues. The introduction of MA-ABE provides a robust encryption scheme that effectively protects data confidentiality. Although data transactions and interactions are public in a blockchain, attribute-based encryption ensures the privacy of the actual data; only users with specific access permissions can access the plaintext data. This method effectively reduces the risk of data leakage and ensures data security, maintaining a high level of privacy even in a distributed environment.

[0040] By combining cloud architecture with blockchain technology, fields such as the Internet of Things (IoT), smart industry, and smart healthcare can better address the challenges of massive data processing and security. The high-efficiency computing power of cloud architecture and the transparency and trust mechanisms of blockchain technology work together to enable large-scale distributed systems to maintain higher security, reliability, and traceability when processing complex data, thereby promoting further development in various fields. Attached Figure Description

[0041] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0042] Figure 1 This is a flowchart of the steps of the present invention.

[0043] Figure 2 This is a basic framework diagram of the recommendation system model of this invention. Detailed Implementation

[0044] This invention specifically provides a blockchain data trusted interaction method based on multi-permission attribute-based encryption, comprising the following steps:

[0045] Step 1 involves initializing the system and generating initial parameters to ensure the proper functioning of the entire system's infrastructure. This is the primary step, as the system's security and efficiency largely depend on the correct generation of initialization parameters. System initialization is not merely a simple setup process; it involves complex cryptographic operations that provide the foundation for subsequent encryption and decryption operations.

[0046] Step 2: After generating the necessary initial parameters, the data is encrypted based on these parameters, and then the ciphertext and related information are uploaded. This process not only considers the security of data encryption but also ensures that the uploaded data can be reliably transmitted and stored through the blockchain network. Encryption effectively protects data privacy, especially when handling sensitive information, ensuring data security during transmission.

[0047] Step 3: When a data user wants to access the data, they first need to initiate an access request. In this step, the data user not only simply requests the data but also obtains the necessary key. The generation and transmission of this key are based on system parameters and user permissions. Key transmission not only needs to be conducted through a secure channel but also involves strict access control to ensure that only authorized users can decrypt the data.

[0048] Step 4: After the data user successfully obtains the ciphertext and possesses the corresponding key, the user will decrypt the data based on the key and system parameters. The entire decryption process requires multiple complex computational steps, each ensuring the integrity and correctness of the data. Particularly in this step, the system uses multiple cryptographic tools to ensure the security of data decryption and ultimately outputs the required data content.

[0049] In step 1, the initial parameters include the system's global public parameter GP, attribute permissions, and public / private key pairs for different roles.

[0050] In step 1, the cloud server uses the security parameter λ as input and the global common parameter GP as output. In the global settings, a bilinear group G of order N = p1p2p3 is selected. The global common parameter GP includes N and... The generator g1 is defined. Additionally, a one-way hash function H: {0, 1} is defined to map the global identity GID to elements of G. * →G.

[0051] In step 1, after the attribute permissions are added to the system, a different set of attributes will be assigned according to smart contract 1. Smart contract 1 first checks whether the sender is a cloud server. If so, it assigns the attribute permission to the permission list of attribute a and sets the threshold t.

[0052] if Sender = CS then

[0053] attribute[a].authoritylist←AA(s);

[0054] attribute[a].threshold←t;

[0055] Based on attribute permissions AA i The global public parameters GP output a pair of keys (sk i , pk i For each attribute 'a' managed by this permission, the permission randomly selects two indices. And released As the public key. (Secondary key) Will be by AA i Storage. Public key PKi It will be stored in the blockchain.

[0056] Step 1 includes two key pair initialization algorithms. The first algorithm is the role initialization algorithm, which takes the globally common parameter GP as input and outputs a key pair (rsk, rpk) of the role, where rsk is... and rpk=g rsk A random value. The public key rpk is also stored in the blockchain.

[0057] The second algorithm is the cloud server database initialization algorithm, similar to the role initialization algorithm. The algorithm accepts the globally common parameter GP as input and then generates a key pair (vsk, vpk) for PVD. These keys are primarily used to encrypt the ciphertext CT to obtain the data hash value.

[0058] In step 1, the blockchain collects enough public keys (pk) from different permissions (AA). i At that time, the Shamir secret sharing scheme is used to share the computed attribute key PK. a The algorithm is defined by smart contract 2:

[0059]

[0060] Where count is the counter for attribute a, and threshold is the threshold for generating the key.

[0061] In step 2, the role uploading the data performs encryption using the Encrypt algorithm. The encryption algorithm uses the data M and an n×l access matrix A, with the function ρ mapping its rows to attributes. It selects a random... and a random vector p is its first term. Let λ be... x A represents x ·v, where A x It is the x-th row of a, which also selects a random vector. The first term is 0. Let ω x A represents x ·w. For each row of A, A x Randomly select one The ciphertext is calculated as follows:

[0062] C0 = Me(g1, g1) s

[0063]

[0064] After calculating the ciphertext, the data owner uses their own key rsk. i Sign the ciphertext. Then, use smart contract 3 to transfer the signed ciphertext CT. signUploaded to the blockchain. Smart contract 3 will detect whether the sender of the encrypted message is the data owner:

[0065] if Sender = DO then

[0066] dataHash ← getData(CT sign rsk i );

[0067] Whether the recipient is a cloud server database, and whether the encrypted hash value is saved:

[0068] if Receiver = CSD then

[0069] save dataHash;

[0070] In step 3, when a data user wants to access data belonging to another data owner, they send an access request to the blockchain. After monitoring the data user's access request, the blockchain notifies the attribute authority to provide an access key. Based on the role's attributes, the attribute authority sends the access key to the data user using its private key. For role with attribute 'a', a key is generated, and the permission calculation is as follows:

[0071]

[0072] In step 4, before the decryption algorithm begins, according to smart contract 4, the data user first uses the data owner's public key rpk. i Verify the authenticity of the encrypted CT scan:

[0073] If Recevier = DU, then

[0074] (CT sign rpk i )←getCT(dataHash);

[0075] K a，GID ←getKey(SK);

[0076] In step 4, the ciphertext CT and the decryption token K are used. a，GID The data is input along with the global public parameter GP, and outputs data M. It is assumed that the ciphertext is encrypted under the access matrix (A, ρ). To decrypt the data, the data user DU will obtain H(GID) from the random Oracle model. If the data user DU has A for A... x A subset of the key K ρ(x)，GID If (1, 0, ..., 0) spans these rows, then the decryption process of data user DU is as follows.

[0077] For each such x, the decryptor calculates according to the following formula:

[0078]

[0079] Decryptor selection constant Make ∑ x c x A x = (1, 0, ..., 0), and calculate:

[0080]

[0081] Then the data M can be calculated as:

[0082]

[0083] This invention provides a blockchain data trusted interaction method based on multi-permission attribute-based encryption. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A blockchain data trusted interaction method based on multi-permission attribute-based encryption, characterized in that, Includes the following steps: Step 1: System initialization, generating initial parameters. The cloud server generates a global public parameter GP based on the security parameter λ, and the system generates a public key and a private key based on the GP; Step 2: Encrypt the data according to the initialization parameters obtained in Step 1, and the data owner uploads the ciphertext and the ciphertext hash value to the cloud server; Step 3: The data user initiates a data access request, and the system generates a key based on the data user's attributes; Step 4: The data user decrypts the ciphertext CT using the key and system parameters obtained in Step 3. Step 1, system initialization, includes: Role initialization involves generating a pair of role keys based on the globally shared parameter GP using an algorithm. ),in yes and A random value in the public key Stored in the blockchain; The cloud server database is initialized by generating a key pair for the database system based on the globally common parameter GP using an algorithm. ); The initial parameters include the system's global public parameters (GP), attribute permissions, and public / private key pairs for different roles; Global common parameter GP is initialized; the cloud server selects the order based on the security parameter λ. = The bilinear group G, where , as well as Define a one-way hash function for prime numbers. Map the global identity GID to elements of G, and output the global common parameter GP, which contains N and generator ; Attribute permission initialization: The system allocates a set of different attributes according to smart contract 1. Smart contract 1 checks whether the attribute permission sender is a cloud server. If it is, the attribute permission is allocated to the attribute's permission list and a threshold t is set. If not, the contract will not continue to execute, and the system will send an error message to the contract caller. The system generates public-private key pairs based on attribute permissions. The global public parameters (GP) output a pair of keys ( For each attribute managed by this permission, the permission randomly selects two indices. and publish As a public key, the private key By attribute permissions Keep the public key safe. Stored in the blockchain; The blockchain computes attribute keys based on smart contracts. The smart contract 2 collects sufficient public keys from different permissions (AA) for the blockchain. Then, the attribute key is computed using the Shamir secret sharing scheme. Public keys that need to be collected The quantity is determined by the threshold t; In step 2, after the data is encrypted, the data owner uses their role key. Sign the ciphertext and send the signed ciphertext through smart contract 3. The encrypted data is uploaded to the blockchain. The smart contract 3 detects whether the sender of the encrypted data is the data owner and whether the receiver is the cloud server database, and saves the hash value of the encrypted data. In step 4, before the decryption algorithm begins, the data user uses the data owner's role public key. Verify the authenticity of the encrypted CT scan.

2. The blockchain data trusted interaction method based on multi-permission attribute base encryption according to claim 1, characterized in that, In step 2, the uploaded data is encrypted using the Encrypt algorithm, which employs data M and... Access matrix A, function Mapping each row of the matrix to an attribute set, the ciphertext is calculated as follows: in, express ,in It is to access the x-th row of matrix A. Let be a random vector, where And the first term is a random number p, where ; express , Let be a random vector, where And the first term is 0, for each row of A Select random number , , Representation and Attributes The value corresponding to (x).

3. The blockchain data trusted interaction method based on multi-permission attribute base encryption according to claim 2, characterized in that, In step 3, when a data user accesses data belonging to another data owner, they send an access request to the blockchain. After monitoring the data user's access request, the blockchain notifies the attribute authority to provide an access key. Based on the role's attributes, the attribute authority uses its key sk to send an access key to the data user. The role with attribute 'a' generates a key, and the permission calculation is as follows: GID stands for Global Identity. and for The random value in.

4. The blockchain data trusted interaction method based on multi-permission attribute base encryption according to claim 3, characterized in that, In step 4, the encrypted CT and decryption token are used. The data is input using the global public parameter GP, and the output data is M. The ciphertext is in the access policy. The data is encrypted, and the data user DU will obtain H(GID) from the random Oracle model; if DU is related to A... A subset of the key This allows the data user DU to decrypt data across the span of rows (1,0,...,0) as follows: For each x that meets the condition, the decryptor calculates using the following formula: Decryptor selection constant , making And calculate: Then the data M can be calculated as:

Images