Data processing method and device and electronic equipment

Abstract

The invention provides a data processing method and device and electronic equipment, relates to the technical field of information security, and is used for improving the security of data transmission. The data processing method is applied to a server, and comprises the following steps: receiving an access request from a client, and obtaining target data according to the access request; encrypting the target data according to a pre-stored first key to obtain a first ciphertext; determining a second ciphertext according to a pre-stored public parameter, an access strategy and the first key in combination with an attribute encryption algorithm; wherein the second ciphertext comprises a first component, a second component, a third component and a fourth component, the second component, the third component and the fourth component are used for assisting the client in determining a first parameter, the first component is used for assisting the client in determining a second key based on the first parameter and the first component, and the second key is used for decrypting the first ciphertext; and forming a response ciphertext by the first ciphertext and the second ciphertext, and sending the response ciphertext to the client.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data processing method, device and electronic device. Background Art

[0002] With the rapid development of Internet technology, some users illegally obtain important data from websites through web crawlers or automated programs in order to gain improper benefits. Important data such as identity information, corporate confidential information, etc. The leakage of these important data will directly threaten personal economic security and privacy information, and even cause serious property losses to corporate organizations. Therefore, how to improve the security of data transmission between the client and the server has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] The present application provides a data processing method, device and electronic device for improving the security of data transmission between a client and a server.

[0004] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to a server, and the method includes: receiving an access request from a client, the access request being used to request access to target data; obtaining the target data according to the access request; encrypting the target data according to a pre-stored first key to obtain a first ciphertext; determining a second ciphertext according to pre-stored public parameters, an access policy and the first key in combination with an attribute encryption algorithm, the access policy being used to indicate data access rights corresponding to the attributes of each client; wherein the second ciphertext includes a first component, a second component, a third component and a fourth component, the second component, the third component and the fourth component being used to assist the client in determining a first parameter, the first component being used to assist the client in determining a second key based on the first parameter and the first component, and the second key being used to decrypt the first ciphertext; combining the first ciphertext and the second ciphertext into a response ciphertext, and sending the response ciphertext to the client.

[0005] In an embodiment of the present application, the access policy is combined with the first key through the public parameters, the access policy and the first key, in combination with the attribute encryption algorithm, to obtain the second ciphertext. Then, when decrypting the response ciphertext, only when the attributes of the client comply with the access policy can the correct second key be calculated, thereby decrypting the target data. In this way, even if other users intercept the response ciphertext between the client and the server, the client devices used by other users do not comply with the access policy and cannot decrypt the target data, thereby improving the security of the transmitted data between the client and the server.

[0006] In a possible implementation, according to the pre-stored public parameters, access policy and the first key, combined with the attribute encryption algorithm, determining the second ciphertext includes: determining the first component according to the first key and the public parameters; determining the second component according to the public parameters; determining the third component according to the public parameters, access policy, random vector and first random parameters; determining the fourth component according to the public parameters and the first random parameters; combining the first component, the second component, the third component and the fourth component into the second ciphertext; wherein the second ciphertext is C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}, where C represents the second ciphertext, C s represents the first component, C0 represents the second component, {C 1i} i∈[1,l] represents the third component, {C 2i} i∈[1,l]} represents the fourth component, and l represents the number of attributes included in the attribute set pre-stored by the server.

[0007] In one possible implementation, the third component is determined based on the common parameters, the access strategy, the random vector and the first random parameter, including: determining the random vector from the p-order additive prime number group; determining the product of the access strategy and the random vector as the second parameter; determining a predefined generator based on the common parameters; and determining the product result of the generator whose exponent is the second parameter and the generator whose exponent is the first random parameter as the third component.

[0008] In a possible implementation, the target data is encrypted according to a pre-stored first key to obtain a first ciphertext, including: determining the business requirements of the client according to the access request; determining sensitive data in the target data according to the business requirements; and encrypting the sensitive data in the target data according to the first key to obtain the first ciphertext.

[0009] In this implementation, the business needs of the client are determined through access requests, and sensitive data related to the business needs can be determined, and then the sensitive data in the target data is encrypted. Compared with the method of directly encrypting all the target data, this method can effectively improve the encryption and decryption efficiency.

[0010] In a possible implementation, the public parameter is generated by the blockchain system, and the public parameter is {G,G T ,H,e,g,g α ,{H(x)}x∈A}, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0011] In a second aspect, an embodiment of the present application provides a data processing method, which is applied to a client, and the method includes: sending an access request to a server, the access request being used to request access to target data; receiving a response ciphertext from the server, the response ciphertext including a first ciphertext and a second ciphertext, the first ciphertext being obtained by the server encrypting the target data according to a pre-stored first key, the second ciphertext being determined by the server according to pre-stored public parameters, access policies and the first key, in combination with an attribute encryption algorithm, the second ciphertext including a first component, a second component, a third component and a fourth component; determining a first parameter according to a pre-stored third key, the second component, the third component and the fourth component, the third key being generated by the blockchain system according to attribute information of the client, a pre-stored fourth key and the public parameters and sent to the client; determining a second key according to the first parameter and the first component; decrypting the first ciphertext according to the second key to obtain the target data.

[0012] In a possible implementation, the second ciphertext is C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}, where C represents the second ciphertext, C s represents a first component in the second ciphertext, the first component being determined based on the first key and the public parameter, C0 represents a second component in the second ciphertext, the second component being determined based on the public parameter, {C 1i} i∈[1,l] represents a third component in the second ciphertext, the third component being determined based on the public parameter, the access policy, the random vector and the first random parameter, {C 2i} i∈[1,l]} represents the fourth component in the second ciphertext, and the fourth component is determined based on the public parameter and the first random parameter; wherein, l represents the number of attributes included in the attribute set pre-stored by the server.

[0013] In a possible implementation, the public parameter is generated by the blockchain system, and the public parameter is {G,G T ,H,e,g,gα ,{H(x)} x∈A}, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0014] In a possible implementation manner, the second key is K={K0, K1, {K 2ii} i∈[1,n]}, where K represents the second key, K0 represents the first key component, K1 represents the second key component, {K 2i} i∈[1,n] Represents the third key component.

[0015] In a possible implementation, determining the first parameter according to the pre-stored third key, the second component, the third component, and the fourth component includes: determining the first parameter according to a preset formula, the second component, the third component, and the fourth component; wherein the preset formula is:

[0016]

[0017] Wherein, MC represents the first parameter, e represents the bilinear mapping, ω j It is a parameter value calculated by the client based on preset conditions.

[0018] In a third aspect, an embodiment of the present application provides a data processing device, which is applied to a server, and the device includes: a transceiver module, used to receive an access request from a client, the access request is used to request access to target data; an acquisition module, used to acquire the target data according to the access request; an encryption module, used to encrypt the target data according to a pre-stored first key to obtain a first ciphertext; the encryption module is also used to determine a second ciphertext based on pre-stored public parameters, access policies and the first key, combined with an attribute encryption algorithm, the access policy is used to indicate data access rights corresponding to the attributes of each client; wherein the second ciphertext includes a first component, a second component, a third component and a fourth component, the second component, the third component and the fourth component are used to assist the client in determining a first parameter, the first component is used to assist the client in determining a second key based on the first parameter and the first component, and the second key is used to decrypt the first ciphertext; the transceiver module is also used to combine the first ciphertext and the second ciphertext into a response ciphertext, and send the response ciphertext to the client.

[0019] In a possible implementation manner, the encryption module is specifically used to: determine the first component according to the first key and the public parameter; determine the second component according to the public parameter; determine the third component according to the public parameter, the access policy, the random vector and the first random parameter; determine the fourth component according to the public parameter and the first random parameter; combine the first component, the second component, the third component and the fourth component into the second ciphertext; wherein the second ciphertext is C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}, where C represents the second ciphertext, C s represents the first component, C0 represents the second component, {C 1i} i∈[1,l] represents the third component, {C 2i} i∈[1,l]} represents the fourth component, and l represents the number of attributes included in the attribute set pre-stored by the server.

[0020] In one possible implementation, the encryption module is specifically used to: determine the random vector from the p-order additive prime number group; determine the product of the access strategy and the random vector as the second parameter; determine a predefined generator based on the common parameter; and determine the product result of the generator whose exponent is the second parameter and the generator whose exponent is the first random parameter as the third component.

[0021] In a possible implementation, the encryption module is specifically used to: determine the business requirements of the client based on the access request; determine the sensitive data in the target data based on the business requirements; and encrypt the sensitive data in the target data based on the first key to obtain the first ciphertext.

[0022] In a possible implementation, the public parameter is generated by the blockchain system, and the public parameter is {G,G T ,H,e,g,g α ,{H(x)} x∈A}, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0023] In a fourth aspect, an embodiment of the present application provides a data processing device, which is applied to a client, and the device includes: a transceiver module, which is used to send an access request to a server, and the access request is used to request access to target data; the transceiver module is also used to receive a response ciphertext from the server, and the response ciphertext includes a first ciphertext and a second ciphertext, the first ciphertext is obtained by the server encrypting the target data according to a pre-stored first key, and the second ciphertext is determined by the server according to pre-stored public parameters, access policies and the first key, combined with an attribute encryption algorithm, and the second ciphertext includes a first component, a second component, a third component and a fourth component; a decryption module is used to determine a first parameter according to a pre-stored third key, the second component, the third component and the fourth component, and the third key is generated by the blockchain system according to the attribute information of the client, the pre-stored fourth key and the public parameters and sent to the client; the decryption module is also used to determine a second key according to the first parameter and the first component; the decryption module is also used to decrypt the first ciphertext according to the second key to obtain the target data.

[0024] In a possible implementation, the second ciphertext is C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}, where C represents the second ciphertext, C s represents a first component in the second ciphertext, the first component being determined based on the first key and the public parameter, C0 represents a second component in the second ciphertext, the second component being determined based on the public parameter, {C 1i} i∈[1,l] represents a third component in the second ciphertext, the third component being determined based on the public parameter, the access strategy, the random vector and a first random parameter, wherein the first random parameter is randomly selected from a p-order additive prime number group, {C 2i} i∈[1,l]} represents the fourth component in the second ciphertext, and the fourth component is determined based on the public parameter and the first random parameter; wherein, l represents the number of attributes included in the attribute set pre-stored by the server.

[0025] In a possible implementation, the public parameter is generated by the blockchain system, and the public parameter is {G,G T ,H,e,g,g α ,{H(x)} x∈A}, where g is a predefined generator, G and G Tis a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0026] In a possible implementation manner, the second key is K={K0, K1, {K 2i} i∈[1,n]}, where K represents the second key, K0 represents the first key component, K1 represents the second key component, {K 2i} i∈[1,n] Represents the third key component.

[0027] In a possible implementation manner, the decryption module is specifically configured to determine the first parameter according to a preset formula, the second component, the third component, and the fourth component; wherein the preset formula is:

[0028]

[0029] Wherein, MC represents the first parameter, e represents the bilinear mapping, ω j It is a parameter value calculated by the client based on preset conditions.

[0030] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method described in the first aspect and any possible implementation manner or the second aspect and any possible implementation manner by executing the instructions stored in the memory.

[0031] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method described in the first aspect and any possible implementation manner or the second aspect and any possible implementation manner.

[0032] In a seventh aspect, an embodiment of the present application provides a computer program product comprising computer instructions, which, when executed on a computer, enables the method described in the first aspect and any possible implementation manner or the second aspect and any possible implementation manner to be implemented.

[0033] Among them, the beneficial effects of the second to seventh aspects can be referred to the contents described in the first aspect above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1A schematic diagram of an application scenario of a data processing method provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of a data processing method provided in an embodiment of the present application Figure 1 ;

[0036] Figure 3 A schematic diagram of a data processing method provided in an embodiment of the present application Figure 2 ;

[0037] Figure 4 A schematic diagram of a data processing method provided in an embodiment of the present application Figure 3 ;

[0038] Figure 5 A schematic diagram of a data processing device provided in an embodiment of the present application Figure 1 ;

[0039] Figure 6 A schematic diagram of a data processing device provided in an embodiment of the present application Figure 2 ;

[0040] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0042] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0043] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0044] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0045] Please refer to Figure 1 , is a schematic diagram of an application scenario of a data processing method provided in an embodiment of the present application. Figure 1 As shown, the scenario diagram includes a client 110 and a server 120 , and the client 110 and the server 120 can perform wired or wireless communication.

[0046] The client 110 may refer to a user device with a data access request requirement, and a browser, an application, etc. may be running in the client 110, and the browser or application may send an access request to the server 120 through the client 110. User devices include but are not limited to mobile phones, personal computers (PCs), tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), etc. The server 120 refers to a server with data query capabilities.

[0047] Exemplarily, the client 110 may send an access request to the server 120, requesting access to the target data. Based on the access request, the server 120 obtains the target data, encrypts the target data based on the first key to obtain the first ciphertext, and calculates the second ciphertext based on the first key, the access policy, the public parameters, and the attribute encryption algorithm, and combines the first ciphertext and the second ciphertext into a response ciphertext and sends it to the client 110. The client 110 can decrypt the response ciphertext to obtain the target data. The specific implementation of the server 120 encrypting the response ciphertext and the client decrypting the response ciphertext will be described in detail below.

[0048] In a possible implementation, the scenario diagram may further include a blockchain system 130, and the blockchain system 130 may respectively communicate with the client 110 and the server 120 via wired or wireless communication. The blockchain system 130 is established by an authoritative authorization agency.

[0049] In this implementation, the blockchain system 130 may pre-store the attribute information of at least one client that establishes a connection with the server 120, and pre-configure the access policy of the at least one client to access the server 120. The blockchain system 130 may generate public parameters and a fourth key based on the access policy and predefined parameters. Further, the blockchain system 130 may generate a third key for each client based on the fourth key and the attribute information of each client. The specific implementation of the blockchain system 130 generating the public parameters and the third key will be described in detail below.

[0050] Please refer to Figure 2 , which is a flow chart of a data processing method provided in an embodiment of the present application Figure 1 The following is executed by the server Figure 2 The steps shown are described below. For example, the server is Figure 1 The server 120 shown, Figure 2 The client involved is, for example, Figure 1 The client 110 shown, Figure 2 The distributed blockchain involved is, for example, Figure 1 A distributed blockchain 130 is shown.

[0051] S201, receiving an access request from a client, where the access request is used to request access to target data.

[0052] The access request may be input by a user on a display interface of the client, or may be received from other user devices, which is not limited in the embodiments of the present application.

[0053] For example, a user enters a query content on the browser search page of the client, and the browser generates an access request based on the query content. The client accesses the Internet Protocol (IP) address of the server and establishes a transmission control protocol (TCP) connection with it. Based on the connection, the browser in the client sends an access request to the server. The access request is, for example, a hypertext transfer protocol (HTTP) request, a GET request, and a POST request. The specific request method type sent can be determined according to the query content entered by the user, for example, a GET request is used to obtain a page, and a POST request is used to submit a form.

[0054] In one possible implementation, the server may upload the access request from the client to the blockchain system for subsequent auditing and analysis.

[0055] S202, acquiring target data according to the access request.

[0056] After receiving the access request, the server can obtain the target data that meets the access request according to the access request. Specifically, the server can obtain the target data from a database, or obtain the target data after executing the corresponding logic code, or obtain the target data from other data sources, which is not limited in the embodiments of the present application.

[0057] S203: Encrypt the target data according to a pre-stored first key to obtain a first ciphertext.

[0058] The first key is a symmetric key pre-configured in the server.

[0059] Specifically, the server may encrypt the target data according to the first key and the symmetric encryption algorithm to obtain the first ciphertext. The symmetric encryption algorithm is, for example, an advanced encryption standard (AES), SM4 or other symmetric encryption algorithms. Exemplarily, an expression for encrypting the first ciphertext is as follows:

[0060] C D =ENC sk (D)

[0061] Among them, C D represents the first ciphertext, D represents the target data, sk represents the first key, and EN refers to the encryption operation.

[0062] In a possible implementation, the server may selectively encrypt part of the target data, and the part of the target data may be sensitive data in the target data, such as identity information, confidential business information, government affairs information, etc. Specifically, the server may determine the business requirements of the client according to the access request, determine the sensitive data in the target data according to the business requirements, and then encrypt the sensitive data in the target data according to the first key to obtain the first ciphertext.

[0063] For example, an access request indicates obtaining web page information of government website A. Based on the access request, the server can determine that the client's business need is government information. Therefore, the server can encrypt the government information in the target data as sensitive data.

[0064] In a possible implementation, in some application scenarios, the sensitive data involved between the server and the client is fixed, for example, for data transmission within an enterprise, the sensitive data involved includes identity information of internal personnel of the enterprise, internal confidential information of the enterprise, etc. Therefore, the server can encrypt these sensitive data in advance. Then, after the server receives the access request, if it is determined that the target data includes the aforementioned fixed sensitive data, the encrypted sensitive data is directly obtained as the first ciphertext. This method can effectively reduce the repeated encryption operations of the server, and is also conducive to improving the data transmission efficiency between the server and the client.

[0065] S204, according to the pre-stored public parameters, access policy and first key, combined with the attribute encryption algorithm, determine the second ciphertext, the second ciphertext includes a first component, a second component, a third component and a fourth component, the second component, the third component and the fourth component are used to assist the client in determining the first parameter, the first component is used to assist the client in determining the second key based on the first parameter and the first component, and the second key is used to decrypt the first ciphertext.

[0066] Among them, the access policy is used to indicate the data access rights corresponding to the attributes of each client. Among them, the attributes of the client are related to the specific application scenario. For example, taking the enterprise scenario as an example, each client is an office device within the enterprise, then the attributes of each client can be divided by department, such as R&D department, product department, marketing department, finance department, etc. Alternatively, it can also be divided by job level, etc., which can be set according to actual needs, and the embodiment of this application does not limit this. The attributes of each client can be assigned by the blockchain system when the client is registered, and each client can be assigned one or more attributes.

[0067] The access policy can be generated by the blockchain system based on the pre-configured data access rights of each client's attributes and sent to the server. The access policy can be an access structure based on a linear secret sharing scheme (LSSS), which can be specifically expressed as (M, ρ), where M is a l×n matrix, l represents the number of attributes included in the attribute set, and ρ is a mapping function that can map each row of the matrix M to the corresponding attribute value, that is, ρ:{1,...,l}→U.

[0068] The public parameters are generated by the blockchain system and sent to the server. The specific method of generating the public parameters is described below. The blockchain system can generate multiplication cyclic groups G and G with a prime order of p according to the predefined generator g. TThe blockchain system randomly selects a second random parameter from the p-order additive prime number group, and determines a third parameter based on the second random parameter, a predefined bilinear map e, and a generator g, wherein the bilinear map e: G×G=G T .

[0069] Exemplarily, the third parameter can be expressed as e(g,g) α , where α is the second random parameter, α∈Z p , Z p is a p-order additive prime group. The blockchain system determines the hash function of each attribute in the attribute set, and the attribute set includes the attributes of each client. The hash function is a predefined hash function, which can be specifically expressed as H: {0,1} * →Z p , where H represents the hash function, Z p Represents the p-order additive prime group. Based on this, if we define each attribute x∈A, where A is a set of attributes, then the hash function of each attribute can be expressed as H(x).

[0070] Based on the above parameters, the blockchain system can generate public parameters. Specifically, the public parameters can be expressed as:

[0071] para={G,G T ,H,e,g,g α ,{H(x)} x∈A}

[0072] Among them, g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0073] Then, the server can calculate the second ciphertext according to the pre-stored public parameters, access policy and first key in combination with the attribute encryption algorithm. Among them, the attribute encryption algorithm described in the embodiment of the present application can specifically refer to the attribute encryption algorithm based on the key policy.

[0074] The second ciphertext may include a first component, a second component, a third component and a fourth component. The specific manner in which the server determines the four components in the second ciphertext is described below.

[0075] 1. The first component

[0076] The server may determine the first component according to the first key, the public parameter and the third random parameter. Exemplarily, a calculation formula for determining the first component is as follows:

[0077] C s =sk·e(g,g)αs

[0078] Among them, C s represents the first component, sk represents the first key, e represents the bilinear map, α is the second random parameter, g is the predefined generator, s is the third random parameter, and s is randomly selected by the server from the p-order additive prime number group.

[0079] 2. Second Component

[0080] The server may determine the second component according to the public parameter and the third random parameter. Exemplarily, a calculation formula for determining the second component is as follows:

[0081] C0=g s

[0082] Wherein, C0 represents the second component, g is a predefined generator, and s is a third random parameter.

[0083] 3. The third component

[0084] The server can determine the third component based on the public parameters, the access strategy, the random vector and the first random parameter, wherein the first random parameter is randomly selected from a p-order additive prime number group, and the random vector is composed of a group of random parameters randomly selected by the server from the p-order additive prime number group, wherein the group of random numbers includes the third random parameter.

[0085] The server selects a set of random parameters from the p-order additive prime number group to form a random vector. The random vector can be expressed as u=(s,x2,...,x n ), where s is the third random parameter, x2,...,x n are multiple random parameters randomly selected by the server from the p-order additive prime number group, namely s, x2, ..., x n ∈Z p , n is the number of columns of matrix M.

[0086] Furthermore, the server may determine the product of the access policy and the random vector as the second parameter. The access policy may be expressed as (M, ρ), where M is an l×n matrix, l represents the number of attributes included in the attribute set, and ρ is a mapping function that can map each row of the matrix M to a corresponding attribute value, i.e., ρ:{1,...,l}→U. Exemplarily, a calculation formula for determining the second parameter is as follows:

[0087] λ i =M i ·u

[0088] Among them, λ i Represents the second parameter, M iRepresents the attribute value corresponding to the i-th row in the matrix M, M i It can be understood as the attribute of the client that the server allows to access the target data in the access policy, and u represents a random vector.

[0089] Based on the second parameter obtained above, the server determines a predefined generator from the public parameters and randomly selects a first random parameter from the p-order additive prime number group. The server then determines the product of the generator whose index is the second parameter and the generator whose index is the first random parameter as the third component.

[0090] Exemplarily, a calculation formula for determining the third component is as follows:

[0091]

[0092] Among them, C 1i represents the third component, g is a predefined generator, λ i is the second parameter, t i is the first random parameter.

[0093] 4. The fourth component

[0094] The server may determine the fourth component according to the public parameter and the first random parameter. Exemplarily, a calculation formula for determining the fourth component is as follows:

[0095]

[0096] Among them, C 2i is the fourth component, g is a predefined generator, H(a i ) is the hash function of the i-th attribute in the attribute set, t i is the first random parameter.

[0097] Based on the above calculation method, the server can calculate the second ciphertext, which can be expressed as:

[0098] C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}

[0099] Among them, C represents the second ciphertext, C s represents the first component in the second ciphertext, C0 represents the second component in the second ciphertext, {C 1i} i∈[1,l] represents the third component in the second ciphertext, {C 2i} i∈[1,l]} represents the fourth component in the second ciphertext, l represents the number of attributes included in the attribute set pre-stored by the server, 1≤i≤l.

[0100] S205: Combine the first ciphertext and the second ciphertext into a response ciphertext, and send the response ciphertext to the client.

[0101] The server combines the first ciphertext and the second ciphertext into a response ciphertext and sends it to the client. Correspondingly, the client receives the response ciphertext from the server, and then the client can decrypt the response ciphertext to obtain the target data.

[0102] Combine the following Figure 3 A schematic diagram of a data processing method shown in FIG. Figure 2 , the specific implementation method of the client to obtain the target data based on the response ciphertext decryption is described. Figure 3 The steps shown are explained below. For example, the client Figure 1 The client 110 shown, Figure 3 The server involved is, for example, Figure 1 The server 120 shown, Figure 3 The distributed blockchain involved is, for example, Figure 1 A distributed blockchain 130 is shown.

[0103] S301, sending an access request to a server, where the access request is used to request access to target data.

[0104] The client sends an access request to the server and the specific content of the access request can correspond to the content described above, which will not be repeated here.

[0105] S302, receiving a response ciphertext from the server, the response ciphertext including a first ciphertext and a second ciphertext, the first ciphertext is obtained by the server encrypting the target data according to a pre-stored first key, the second ciphertext is determined by the server according to pre-stored public parameters, access policy and the first key in combination with an attribute encryption algorithm, and the second ciphertext includes a first component, a second component, a third component and a fourth component.

[0106] Among them, the specific contents of the first key, public parameters, access policy and attribute encryption algorithm can refer to the contents described above and will not be repeated here.

[0107] The specific implementation method of the server determining the second ciphertext based on the public parameters, access policy and the first key in combination with the attribute encryption algorithm can correspond to the content described above and will not be repeated here.

[0108] S303: Determine a first parameter according to the pre-stored third key, the second component, the third component and the fourth component.

[0109] Among them, the third key is generated by the blockchain system according to the attribute information of the client, the pre-stored fourth key and the public parameters and sent to the client. The fourth key is generated by the blockchain system, and the fourth key can be the second random parameter mentioned above, that is, α, or the fourth key can also be expressed as MSK={α}, where MSK represents the fourth key.

[0110] The third key may include a first key component, a second key component, and a third key component. The specific method for generating the first key component, the second key component, and the third key component by the blockchain system is described below.

[0111] 1. First key component

[0112] The blockchain system can determine the first key component based on the public parameter, the fourth key and the fourth random parameter, wherein the fourth random parameter is randomly selected by the blockchain system from a p-order additive prime number group. Exemplarily, a calculation formula for determining the first key component is as follows:

[0113] K0=g α g r

[0114] Wherein, K0 represents the first key component, g is a predefined generator, α is the fourth key, and r is the fourth random parameter.

[0115] 2. Second key component

[0116] The blockchain system may determine the second key component according to the fourth random parameter and the public parameter. Exemplarily, a calculation formula for determining the second key component is as follows:

[0117] K1=g r

[0118] Wherein, K1 represents the second key component, g is a predefined generator, and r is a fourth random parameter.

[0119] 3. Third key component

[0120] The blockchain system can determine the third key component based on the public parameter and the fourth random parameter. Exemplarily, a calculation formula for determining the third key component is as follows.

[0121]

[0122] Among them, K 2i represents the third key component, g is a predefined generator, r is the fourth random parameter, H(a i ) is the hash function of the i-th attribute in the attribute set.

[0123] Based on the above calculation method, the blockchain system can calculate the third key, which can be expressed as:

[0124] K={K0,K1,{K 2i} i∈[1,n]}

[0125] Where K represents the third key, K0 represents the first key component, K1 represents the second key component, {K 2i} i∈[1,n] represents the third key component, i represents the i-th attribute in the attribute set, which can also be understood as the i-th row in the matrix M, and n represents the number of columns in the matrix M.

[0126] After the blockchain system determines the third key, it sends the third key to the client. Then the client can determine the first parameter based on the third key, the second component, the third component and the fourth component. Specifically, the client can determine the first parameter based on the preset formula, the second component, the third component and the fourth component. The preset formula is as follows:

[0127]

[0128] Among them, MC represents the first parameter, C0 represents the second component, and C 1j represents the third component, C2 represents the fourth component, K0 represents the first key component in the third key, K1 represents the second key component in the third key, K 2j represents the third key component in the third key, e represents a bilinear mapping, ω j is the parameter value calculated by the client based on the preset condition, where the preset condition can be expressed as ∑ω j ·M j =(1,0,...,0), M j Denotes the jth row in the matrix M, which represents the attributes of the client. The preset condition is determined based on the access matrix and pre-configured in the client.

[0129] S304: Determine a second key according to the first parameter and the first component.

[0130] The specific contents of the first parameter and the first component may refer to the contents described above.

[0131] The client can calculate the second key based on the calculated first parameter and the first component. Exemplarily, a calculation formula for determining the second key is as follows:

[0132]

[0133] Among them, sk represents the second key, C s represents the first component, and MC represents the first parameter.

[0134] It should be understood that the first key is a symmetric key, and the first key is the same as the second key.

[0135] S305, decrypt the first ciphertext according to the second key to obtain target data.

[0136] The client performs a decryption operation on the first ciphertext based on the second key to obtain the target data. For example, the expression for decrypting the first ciphertext by the client is as follows:

[0137] D=DEC sk (C D )

[0138] Where D represents the target data, C D represents the first ciphertext, sk represents the second key, and DE refers to the decryption operation.

[0139] In a possible implementation, in order to improve the decryption efficiency of the client, a third-party device may be set between the client and the server, and the server sends a response ciphertext to the client through the third-party device. In this implementation, when the third-party device receives the response ciphertext from the server, it can determine the first parameter based on the second component, the third component, the fourth component and the third key in the second ciphertext, and forward the response ciphertext and the first parameter to the client. Then the client can directly determine the second key based on the first component and the first parameter in the second ciphertext, and decrypt the first ciphertext based on the second key. Among them, the specific method for the third-party device to determine the first parameter can correspond to the specific method for the client to determine the first parameter, which will not be repeated here.

[0140] The third-party device can be a device trusted by both the client and the server, can be other servers or terminal devices, or can be a blockchain system, which is not limited in the present application embodiment. In practical applications, a device with strong computing power can be selected as the third-party device to further improve the decryption efficiency.

[0141] It should be noted that in the attribute encryption algorithm provided in the embodiment of the present application, the ω calculated based on the preset conditions j , when the client's attributes meet the access policy, s = ∑λ j ·ω j However, in the actual decryption process of the client, when the attributes of the client do not comply with the access policy, the second key calculated by the client cannot decrypt the first ciphertext.

[0142] In a possible implementation, after the client obtains the target data through decryption, the target data can be rendered in the page and displayed to the user. Exemplarily, after the browser in the client receives the HTTP response from the server, it starts to parse the content of the response. The browser renders the page based on the HTML, cascading style sheets (CSS), and JavaScript in the response, which includes parsing the HTML structure, applying the style, executing JavaScript code, etc.

[0143] In order to more clearly understand the method flow of a data processing method provided in an embodiment of the present application, Figure 4 A schematic diagram of a data processing method shown in FIG. Figure 3 , a data processing method provided in an embodiment of the present application is described. Among them, Figure 4 The client involved is, for example, Figure 1 The client 110 shown, Figure 4 The server involved is, for example, Figure 1 The server 120 shown, Figure 4 The blockchain systems involved are, for example, Figure 1 Blockchain system 130 is shown.

[0144] S401, the blockchain system generates public parameters, a fourth key and an access policy.

[0145] Among them, the specific method of the blockchain system to generate public parameters, the fourth key and access strategy can refer to the content described above.

[0146] S402, the blockchain system sends public parameters and access policies to the server. Correspondingly, the server receives the public parameters and access policies from the blockchain system.

[0147] S403, the blockchain system generates a third key based on the public parameters, the fourth key and the attribute information of the client.

[0148] Among them, the specific method for the blockchain system to generate the third key can refer to the content described above.

[0149] S404, the blockchain system sends the third key to the client. Correspondingly, the client receives the third key from the blockchain system.

[0150] S405, the client sends an access request to the server, where the access request is used to request access to target data. Correspondingly, the server receives the access request from the client.

[0151] S406: The server obtains target data according to the access request.

[0152] The specific method in which the server obtains the target data according to the access request may correspond to the content described above.

[0153] S407, the server encrypts the target data according to the first key to obtain a first ciphertext, and determines a second ciphertext according to the public parameters, the access policy and the first key in combination with an attribute encryption algorithm.

[0154] The server encrypts the first ciphertext and determines the specific content of the second ciphertext, which can correspond to the content described above.

[0155] S408, the server sends a response ciphertext including the first ciphertext and the second ciphertext to the client. Correspondingly, the client receives the response ciphertext from the server.

[0156] S409: The client decrypts the first ciphertext according to the third key and the second ciphertext in the response ciphertext to obtain the target data.

[0157] Among them, the client decrypts the first ciphertext according to the third key and the second ciphertext in the response ciphertext. The specific method of obtaining the target data can be referred to the content described above, which will not be repeated here.

[0158] Based on the same inventive concept, an embodiment of the present application provides a data processing device, which is used to implement any of the above data processing methods, for example Figure 2 The data processing method shown, and the device can also realize the functions of the server mentioned above.

[0159] Please refer to Figure 5 , is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. Figure 5 As shown, the data processing device 500 includes a transceiver module 501, an acquisition module 502 and an encryption module 503. The data processing device 500 can be applied in a server.

[0160] Exemplarily, the transceiver module 501 is used to receive an access request from a client, and the access request is used to request access to target data; the acquisition module 502 is used to acquire the target data according to the access request; the encryption module 503 is used to encrypt the target data according to a pre-stored first key to obtain a first ciphertext; the encryption module 503 is also used to determine the second ciphertext according to the pre-stored public parameters, access policy and first key in combination with the attribute encryption algorithm, and the access policy is used to indicate the data access rights corresponding to the attributes of each client; wherein the second ciphertext includes a first component, a second component, a third component and a fourth component, and the second component, the third component and the fourth component are used to assist the client in determining the first parameter, the first component is used to assist the client in determining the second key based on the first parameter and the first component, and the second key is used to decrypt the first ciphertext; the transceiver module 501 is also used to combine the first ciphertext and the second ciphertext into a response ciphertext, and send the response ciphertext to the client.

[0161] In a possible implementation, the encryption module 503 is specifically used to: determine the first component according to the first key and the public parameter; determine the second component according to the public parameter; determine the third component according to the public parameter, the access policy, the random vector and the first random parameter; determine the fourth component according to the public parameter and the first random parameter; combine the first component, the second component, the third component and the fourth component into a second ciphertext; wherein the second ciphertext is C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}, where C represents the second ciphertext, C s represents the first component, C0 represents the second component, {C 1i} i∈[1,l] represents the third component, {C 2i} i∈[1,l]} represents the fourth component, and l represents the number of attributes included in the attribute set pre-stored by the server.

[0162] In one possible implementation, the encryption module 503 is further used to: determine a random vector from a p-order additive prime number group; determine the product of the access strategy and the random vector as a second parameter; determine a predefined generator based on the public parameters; and determine the product result of the generator whose exponent is the second parameter and the generator whose exponent is the first random parameter as a third component.

[0163] In a possible implementation, the encryption module 503 is specifically used to: determine the business requirements of the client according to the access request; determine the sensitive data in the target data according to the business requirements; and encrypt the sensitive data in the target data according to the first key to obtain a first ciphertext.

[0164] In a possible implementation, the public parameters are generated by the blockchain system, and the public parameters are {G,G T ,H,e,g,g α ,{H(x)} x∈A}, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated by the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0165] Based on the same inventive concept, an embodiment of the present application provides a data processing device, which is used to implement any of the above data processing methods, for example Figure 3 The data processing method shown, and the device can also realize the functions of the client mentioned above.

[0166] Please refer to Figure 6 , which is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application Figure 2 .like Figure 6 As shown, the data processing device 600 includes a transceiver module 601 and a decryption module 602. The data processing device 600 can be applied to a client.

[0167] Exemplarily, the transceiver module 601 is used to send an access request to the server, and the access request is used to request access to the target data; the transceiver module 601 is also used to receive a response ciphertext from the server, and the response ciphertext includes a first ciphertext and a second ciphertext. The first ciphertext is obtained by the server encrypting the target data according to a pre-stored first key, and the second ciphertext is determined by the server according to the pre-stored public parameters, the access policy and the first key, combined with the attribute encryption algorithm, and the second ciphertext includes a first component, a second component, a third component and a fourth component; the decryption module 602 is used to determine the first parameter according to the pre-stored third key, the second component, the third component and the fourth component, and the third key is generated by the blockchain system according to the attribute information of the client, the pre-stored fourth key and the public parameters and sent to the client; the decryption module 602 is also used to determine the second key according to the first parameter and the first component; the decryption module 602 is also used to decrypt the first ciphertext according to the second key to obtain the target data.

[0168] In a possible implementation, the second ciphertext is C={C s ,C0,{C 1i} i∈[1,l] ,{C 2i} i∈[1,l]}, where C represents the second ciphertext, C srepresents the first component in the second ciphertext, the first component is determined based on the first key and the public parameter, C0 represents the second component in the second ciphertext, the second component is determined based on the public parameter, {C 1i} i∈[1,l] represents the third component in the second ciphertext, the third component is determined based on the public parameter, the access strategy, the random vector and the first random parameter, the first random parameter is randomly selected from the p-order additive prime number group, {C 2i} i∈[1,l]} represents the fourth component in the second ciphertext, and the fourth component is determined based on the public parameter and the first random parameter; wherein, l represents the number of attributes included in the attribute set pre-stored by the server.

[0169] In a possible implementation, the public parameters are generated by the blockchain system, and the public parameters are {G,G T ,H,e,g,g α ,{H(x)} x∈A}, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated by the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

[0170] In a possible implementation manner, the second key is K={K0, K1, {K 2i} i∈[1,n]}, where K represents the second key, K0 represents the first key component, K1 represents the second key component, {K 2i} i∈[1,n] Represents the third key component.

[0171] In a possible implementation manner, the decryption module 602 is specifically configured to determine the first parameter according to a preset formula, the second component, the third component, and the fourth component; wherein the preset formula is:

[0172]

[0173] Among them, MC represents the first parameter, e represents the bilinear mapping, ω j It is the parameter value calculated by the client based on preset conditions.

[0174] Please refer to Figure 7 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 700 includes at least one processor 701 and a memory 702 communicatively connected to the at least one processor 701 .

[0175] The processor 701 may be a general-purpose processor or a dedicated processor. The processor 701 may include, for example, a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data. The central processing unit may be used to control the electronic device 700, execute software programs and / or process data. Different processors may be independent devices or may be arranged in one or more processing circuits, for example, integrated in one or more dedicated integrated circuits.

[0176] In one embodiment, the memory 702 stores instructions that can be executed by at least one processor 701. The at least one processor 701 implements the functions of the previous server by executing the instructions stored in the memory 702, and accordingly, can also implement the steps executed by the previous server.

[0177] In this embodiment, the electronic device 700 can implement the functions of the previous text data processing device 500. In addition, the at least one processor 701 in the electronic device 700 can also implement the functions of the previous text transceiver module 501, the acquisition module 502 and the encryption module 503.

[0178] In another embodiment, the memory 702 stores instructions executable by at least one processor 701, and the at least one processor 701 implements the functions of the client as described above by executing the instructions stored in the memory 702, and accordingly, can also implement the steps performed by the client as described above.

[0179] In this embodiment, the electronic device 700 can implement the functions of the previous text data processing device 600. In addition, the at least one processor 701 in the electronic device 700 can also implement the functions of the previous text transceiver module 601 and the decryption module 602.

[0180] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes any data processing method, such as Figure 2 , Figure 3 or Figure 4 The data processing method shown.

[0181] Based on the same inventive concept, the embodiment of the present application provides a computer program product including instructions, which, when executed on a computer, enables the above-mentioned data processing method as described above, for example, to implement Figure 2 , Figure 3 or Figure 4 The data processing method shown.

[0182] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0183] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0184] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0186] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data processing method, characterized in that: The data processing method is applied to the server; the method comprises: receiving an access request from a client, wherein the access request is used to request access to target data; Acquire the target data according to the access request; Encrypting the target data according to a pre-stored first key to obtain a first ciphertext; Determine a second ciphertext according to the pre-stored public parameters, access policy and the first key in combination with an attribute encryption algorithm, wherein the access policy is used to indicate the data access rights corresponding to the attributes of each client; wherein the second ciphertext includes a first component, a second component, a third component and a fourth component, wherein the second component, the third component and the fourth component are used to assist the client in determining the first parameter, the first component is used to assist the client in determining the second key based on the first parameter and the first component, and the second key is used to decrypt the first ciphertext; The first ciphertext and the second ciphertext are combined into a response ciphertext, and the response ciphertext is sent to the client.

2. The method according to claim 1, characterized in that: Determining the second ciphertext according to the pre-stored public parameters, access policy and the first key in combination with the attribute encryption algorithm includes: determining the first component according to the first key and the public parameter; determining the second component according to the common parameter; Determine the third component according to the common parameter, the access strategy, the random vector and the first random parameter; Determine the fourth component according to the common parameter and the first random parameter; Combining the first component, the second component, the third component and the fourth component into the second ciphertext; The second ciphertext is C={C s ,C0,{C 1i } i∈[1,l] ,{C 2i } i∈[1,l] }, C represents the second ciphertext, C s represents the first component, C0 represents the second component, {C 1i } i∈[1,l] represents the third component, {C 2i } i∈[1,l] } represents the fourth component, and l represents the number of attributes included in the attribute set pre-stored by the server.

3. The method according to claim 2, characterized in that Determining the third component according to the common parameter, the access policy, the random vector and the first random parameter includes: Determining the random vector from the p-order additive prime number group; Determine the product of the access strategy and the random vector as a second parameter; Determining a predefined generator according to the common parameters; The third component is determined as a product of a generator whose exponent is the second parameter and a generator whose exponent is the first random parameter.

4. The method according to claim 1, characterized in that: The target data is encrypted according to a pre-stored first key to obtain a first ciphertext, including: Determining the service requirements of the client according to the access request; Determining sensitive data in the target data according to the business requirements; The sensitive data in the target data is encrypted according to the first key to obtain the first ciphertext.

5. The method according to any one of claims 1 to 3, characterized in that: The public parameters are generated by the blockchain system, and the public parameters are {G,G T ,H,e,g,g α ,{H(x)} x∈A }, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

6. A data processing method, characterized in that: The data processing method is applied to a client; the method comprises: Sending an access request to a server, wherein the access request is used to request access to target data; Receiving a response ciphertext from the server, the response ciphertext including a first ciphertext and a second ciphertext, the first ciphertext being obtained by the server encrypting the target data according to a pre-stored first key, the second ciphertext being determined by the server according to pre-stored public parameters, access policies, and the first key in combination with an attribute encryption algorithm, the second ciphertext including a first component, a second component, a third component, and a fourth component; Determine a first parameter according to a pre-stored third key, the second component, the third component and the fourth component, wherein the third key is generated by the blockchain system according to the attribute information of the client, the pre-stored fourth key and the public parameter and sent to the client; Determine a second key according to the first parameter and the first component; The first ciphertext is decrypted according to the second key to obtain the target data.

7. The method according to claim 6, characterized in that The second ciphertext is C={C s ,C0,{C 1i } i∈[1,l] ,{C 2i } i∈[1,l] }, where C represents the second ciphertext, C s represents the first component, the first component is determined based on the first key and the public parameter, C0 represents the second component, the second component is determined based on the public parameter, {C 1i } i∈[1,l] represents the third component, the third component is determined based on the public parameter, the access strategy, the random vector and the first random parameter, {C 2i } i∈[1,l] } represents the fourth component, and the fourth component is determined according to the public parameter and the first random parameter; wherein, l represents the number of attributes included in the attribute set pre-stored by the server.

8. The method according to claim 6 or 7, characterized in that: The public parameters are generated by the blockchain system, and the public parameters are {G,G T ,H,e,g,g α ,{H(x)} x∈A }, where g is a predefined generator, G and G T is a multiplicative cyclic group of prime order generated according to the generator g, H is a predefined hash function, e represents a bilinear map, α is a second random parameter, x represents an attribute, and A represents an attribute set.

9. The method according to claim 7, characterized in that: The second key is K={K0, K1, {K 2i } i∈[1,n] }, where K represents the second key, K0 represents the first key component, K1 represents the second key component, {K 2i } i∈[1,n] Represents the third key component.

10. The method according to claim 9, characterized in that Determining a first parameter according to a pre-stored third key, the second component, the third component, and the fourth component includes: Determine a first parameter according to a preset formula, the second component, the third component and the fourth component; Wherein, the preset formula is: Wherein, MC represents the first parameter, e represents the bilinear mapping, ω j It is a parameter value calculated by the client based on preset conditions.

11. A data processing device, characterized in that: The data processing device is applied to a server; the device comprises: A transceiver module, used for receiving an access request from a client, wherein the access request is used for requesting access to target data; An acquisition module, used for acquiring the target data according to the access request; An encryption module, used for encrypting the target data according to a pre-stored first key to obtain a first ciphertext; The encryption module is further used to determine a second ciphertext according to a pre-stored public parameter, an access policy and the first key in combination with an attribute encryption algorithm, wherein the access policy is used to indicate data access rights corresponding to the attributes of each client; wherein the second ciphertext includes a first component, a second component, a third component and a fourth component, wherein the second component, the third component and the fourth component are used to assist the client in determining a first parameter, the first component is used to assist the client in determining a second key based on the first parameter and the first component, and the second key is used to decrypt the first ciphertext; The transceiver module is further configured to combine the first ciphertext and the second ciphertext into a response ciphertext, and send the response ciphertext to the client.

12. A data processing device, characterized in that: The data processing device is applied to a client; the device comprises: A transceiver module, used for sending an access request to a server, wherein the access request is used for requesting access to target data; The transceiver module is further used to receive a response ciphertext from the server, the response ciphertext including a first ciphertext and a second ciphertext, the first ciphertext is obtained by the server encrypting the target data according to a pre-stored first key, the second ciphertext is determined by the server according to pre-stored public parameters, access policies and the first key in combination with an attribute encryption algorithm, and the second ciphertext includes a first component, a second component, a third component and a fourth component; a decryption module, configured to determine a first parameter according to a pre-stored third key, the second component, the third component, and the fourth component, wherein the third key is generated by the blockchain system according to the attribute information of the client, the pre-stored fourth key, and the public parameter and sent to the client; The decryption module is further used to determine a second key according to the first parameter and the first component; The decryption module is further used to decrypt the first ciphertext according to the second key to obtain the target data.

13. An electronic device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the method according to any one of claims 1 to 10 by executing the instructions stored in the memory.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 10.

15. A computer program product, characterized in that The invention comprises computer instructions, which, when executed on a computer, enable the method according to any one of claims 1 to 10 to be implemented.

Images