Data security sharing method based on alliance chain

Abstract

The invention relates to a data security sharing method based on an alliance chain, and belongs to the field of data security. According to the method, a decentralized alliance chain network is constructed, so that the vulnerability of a centralized architecture is eliminated. Meanwhile, a linear secret sharing LSSS and a ciphertext policy attribute encryption CP-ABE algorithm are adopted, a safe and flexible access control mechanism is provided, and complex data access policy definition and efficient permission verification are allowed. Besides, due to the introduction of interoperability of the alliance chain nodes, safe and seamless exchange of data and assets among different block chain networks is allowed, data islands are broken, and information sharing and business collaboration are promoted. Besides, an innovative consensus mechanism and a treatment strategy are designed, so that the operation efficiency of the system is improved, and the cooperation of network participants and the tamper-resistant capability of the system are enhanced. According to the invention, the communication delay is obviously reduced, and the data processing speed is improved.

Description

Technical Field

[0001] The present invention belongs to the field of data security, and specifically relates to a data security sharing method based on an alliance chain. Background Art

[0002] In the wave of digital transformation, data sharing has become a key factor in promoting the development of the industry. However, most existing data sharing platforms are built on a centralized architecture, which not only makes them the primary target of cyber attacks, but also seriously affects the stability and reliability of the entire data sharing network once the central node is damaged. In addition, despite the use of privacy protection technologies such as anonymization and pseudonymization, the privacy and integrity of user data are still difficult to be fully guaranteed in a complex data ecosystem. Existing access control models also often lack the necessary flexibility and are difficult to adapt to changing business needs and complex user permission settings, which limits the efficiency and security of data sharing. With the surge in data volume, existing systems often encounter performance bottlenecks when processing large-scale data and real-time information, especially in situations that require rapid response, such as intelligent transportation systems and financial services. Although smart contracts provide the possibility of automated transactions, their security and execution efficiency are still issues that need to be addressed.

[0003] The existing technology has disadvantages:

[0004] (1) Vulnerability of centralized architecture: Most data sharing systems rely on centralized databases, which are not only easy targets for attacks, but can also cause the entire system to fail when attacked. In addition, centralized systems often face high costs and complex operations when maintaining and upgrading.

[0005] (2) Insufficient privacy protection: Existing technologies have shortcomings in protecting user privacy. Data often needs to be desensitized during sharing, but these processing methods may not be able to resist complex attack methods, resulting in the leakage of sensitive information.

[0006] (3) Rigidity of data access control: Traditional access control models are usually difficult to adapt to changing business needs and lack flexibility, which limits the efficiency and security of data sharing. At the same time, these models are often inefficient in implementing fine-grained access control.

[0007] (4) Communication efficiency bottleneck: With the surge in data volume, existing systems often encounter performance bottlenecks when processing large-scale data and real-time information. This is particularly prominent in application scenarios that require rapid response, such as intelligent transportation systems and financial services.

[0008] (5) Scalability and compatibility issues: Existing data sharing platforms are often difficult to seamlessly integrate with emerging technologies, such as IoT devices and edge computing systems, which limits their scalability and compatibility.

[0009] (6) Lack of fine-grained auditing and tracking capabilities: Existing systems make it difficult to track data access and modification history, making it difficult to meet compliance requirements.

[0010] (7) Data governance and compliance challenges: Existing systems are unable to meet the data protection regulations of different regions and industries, and data governance and compliance face challenges. Summary of the invention

[0011] The purpose of the present invention is to overcome the limitations of existing data sharing technologies in many aspects, especially the fragility of centralized architecture, the lack of privacy protection, the rigidity of data access control, the bottleneck of communication efficiency, and the scalability and compatibility issues, and provide a data security sharing method based on the alliance chain. By building a decentralized alliance chain architecture, the security of data sharing is enhanced, the risk of single point failure is reduced, and the overall stability and anti-attack capability of the system are improved; at the same time, advanced encryption technology and ciphertext policy attribute encryption (CP-ABE) algorithm are used to improve the level of privacy protection in the data sharing process, and the security of sensitive information can be ensured even in a complex data ecosystem; in addition, the present invention adapts to changing business needs and improves access control efficiency by designing a fine-grained access control mechanism; in response to the challenge of communication efficiency, the communication delay is reduced by optimizing the data processing process, and the system's ability to process large-scale and real-time data is enhanced. The present invention also focuses on improving the scalability and compatibility of the entire system to ensure seamless integration with emerging technologies such as IoT devices and edge computing systems.

[0012] To achieve the above purpose, the technical solution of the present invention is: a data security sharing method based on the alliance chain, comprising:

[0013] Build a decentralized alliance chain network;

[0014] An access control mechanism based on the ciphertext policy attribute encryption CP-ABE algorithm with linear secret sharing (LSSS) is proposed to realize data access policy definition and permission verification in the alliance chain network.

[0015] In one embodiment of the present invention, the method comprises the following steps:

[0016] System construction and initialization: The data management agency or trusted third-party technical department is responsible for building and initializing the entire alliance chain system, generating global public system parameters and global keys, building an alliance chain network, and dividing the data nodes into different management groups according to their responsibilities and geographical distribution. The participants in the alliance chain network include the certification authority CA composed of the data management agency or trusted third-party technical department, data nodes, and data producers;

[0017] The scheme for dividing the alliance chain network into different management groups based on the responsibilities and geographical distribution of data nodes is as follows:

[0018] Feature 1: The geographical distribution principle of data nodes, where data nodes are divided into different groups according to their geographical locations to reduce data transmission delays and improve access speeds;

[0019] Feature 2: The principle of division of management responsibilities, in which data nodes are assigned to corresponding groups based on their management responsibilities, such as data type, access rights, and maintenance tasks;

[0020] Feature 3: Dynamic adjustment mechanism, in which the division of groups can be dynamically adjusted according to changes in the geographical distribution of data nodes or updates to management responsibilities to maintain the efficiency and security of data sharing.

[0021] Establishment of data nodes: Each data node is configured as an authoritative management node in the consortium chain group, responsible for authenticating the identity of the data producer;

[0022] Data encryption stage: The data producer will perform AES symmetric encryption on the data to be uploaded to the chain, and use the ciphertext policy attribute encryption algorithm CP-ABE based on linear secret sharing LSSS for encryption. The encrypted ciphertext data includes attribute policy, system parameters and system public key, and is sent to the data node through a secure channel;

[0023] Data decryption phase: Data producers obtain authorization by registering and verifying their identity with data nodes. Authorized entities use their attributes, public system parameters, and master keys to successfully decrypt ciphertext data that meets the attribute policy and obtain plaintext data for access and use.

[0024] In one embodiment of the present invention, during the establishment of a data node, the authentication process of the data node for authenticating the identity of the data producer adopts a non-interactive zero-knowledge proof NIZK algorithm, and the specific steps are as follows:

[0025] Initialization: Generate the system public parameters PP based on the discrete logarithm problem of zero-knowledge proof and a trusted parameter generator;

[0026] Prover initialization: Data producer P generates its private key sk p and the corresponding public key pkp ;

[0027] Proof generation: Data producer P uses its private key sk p and the system public parameter PP to generate a zero-knowledge proof π, proving that it knows the same thing as pk p The associated private key without revealing any information about sk p information;

[0028] Authentication: Data producer P submits the zero-knowledge proof π to the data node, and the data node uses the system public parameter PP to verify the validity of the proof π;

[0029] Transaction records on the blockchain: When P's identity is verified through zero-knowledge proof, the data node stores P's identity information and registered transaction records as transaction T on the blockchain. The structure of transaction T is T = (ID P , pk P ,π,T s ), where ID P is the identity of P, T s Is the timestamp.

[0030] In one embodiment of the present invention, during the encryption phase, the data producer encrypts the data to be uploaded to the chain in the following specific implementation manner:

[0031] 1) Use the AES symmetric encryption algorithm to encrypt the plaintext data M and generate a symmetric key K AES and the corresponding initial ciphertext C AES ;

[0032] C AES =AES Encrypt (M,K AES )

[0033] Among them, AES Encrypt The encryption algorithm is the AES symmetric encryption algorithm;

[0034] 2) Using the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS, C AES Perform secondary encryption to ensure that only users who meet the predetermined attribute policy can decrypt; the details are as follows:

[0035] The encryption algorithm of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS is used to encrypt C AES Encrypt to generate the final ciphertext CT, and use the symmetric key K AES Encapsulated in ciphertext; this encryption process depends on a set of attribute sets A and attribute strategies Π and the system public key PK;

[0036] CT=CPABEEncrypt ((C AES ,K AES ),A,Π,PK)

[0037] Among them, CPABE Encrypt It is an encryption algorithm of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS. The attribute policy ∏ is defined based on the access control requirements of the data.

[0038] In one embodiment of the present invention, the specific implementation method of decrypting the ciphertext data that meets the attribute policy and obtaining the plaintext data is as follows:

[0039] 1) The data accessor needs to verify whether its attribute set A' satisfies the attribute strategy Π; if so, use the private key SK to decrypt CT and obtain K AES and C AES ;

[0040] (K AES ,C AES )=CPABE Decrypt (CT,SK,PK)

[0041] Among them, CPABE Decrypt is the decryption algorithm of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS, SK is the private key corresponding to the attribute set A';

[0042] 2) Use K AES C AES Use the AES symmetric encryption algorithm to decrypt and get the original plaintext M:

[0043] The mathematical expression is as follows:

[0044] M=AES Decrypt (C AES ,K AES )

[0045] Among them, AES Decrypt Decryption algorithm for the AES symmetric encryption algorithm.

[0046] In one embodiment of the present invention, in the alliance chain network, the on-chain and off-chain storage of data is purposefully selected based on the importance and sensitivity of the data. The selection principles are as follows:

[0047] Assess the importance of data and rank it based on its impact and value to business operations;

[0048] Assess the sensitivity of the data and categorize it according to the level of damage that a data breach could cause.

[0049] In one embodiment of the present invention, the data decryption stage also includes a mechanism for monitoring and responding to abnormal behaviors in the data sharing process. The monitoring criteria for abnormal behaviors include preset security rules and behavioral pattern recognition based on machine learning. The mechanism for responding to abnormal behaviors in the data sharing process specifically adopts different response strategies according to the abnormal level, including:

[0050] Low-level anomalies: record behavior logs and conduct regular reviews;

[0051] Medium-level exception: triggers a warning notification and requires further user verification;

[0052] High-level anomalies: Immediately block related operations, isolate the entity involved, and initiate the security review process.

[0053] In one embodiment of the present invention, a consensus mechanism is also designed to enhance the cooperation of network participants and the anti-tampering ability of the system, that is, a verifiable random function VRF mechanism is introduced to carry out the election process of the master node, as follows:

[0054] (1) Each participating data node generates a temporary public-private key pair and submits the public key to the system;

[0055] (2) The system collects all submitted public keys and uses the VRF mechanism to generate a random number for each public key. The generated random number will serve as the basis for the election;

[0056] (3) The system sorts all participating data nodes according to the generated random number and selects the data node with the smallest random number as the master node;

[0057] (4) The master node uses its private key to sign the election results and publishes the signature results to all participating data nodes to prove the legitimacy of its identity.

[0058] In one embodiment of the present invention, alliance chain node interoperability is also introduced to realize data and asset exchange between different blockchain networks in the alliance chain network.

[0059] In one embodiment of the present invention, the data node selects the on-chain and off-chain storage of the data that the data producer needs to upload to the chain based on the importance and sensitivity of the data. The selection principle is as follows: evaluate the importance of the data and classify it based on the impact and value of the data on business operations; evaluate the sensitivity of the data and classify it according to the degree of damage that may be caused by data leakage. In this way, storage efficiency and data security are balanced. Specifically, the data node determines the data that the data producer needs to upload to the chain and decides whether to upload it to the chain:

[0060]

[0061] Among them, DataSaensitibity represents the sensitivity score of the data, and Threshold is the preset threshold used to decide whether to store the data on the chain. Data with a sensitivity score greater than the Threshold is stored on the chain, otherwise it is stored off the chain.

[0062] Compared with the prior art, the present invention has the following beneficial effects: the method of the present invention enhances the security of data sharing, reduces the risk of single point failure, and improves the overall stability and anti-attack capability of the system by building a decentralized alliance chain architecture; at the same time, by using advanced encryption technology and ciphertext policy attribute encryption (CP-ABE) algorithm, it is committed to improving the level of privacy protection in the data sharing process, and ensuring the security of sensitive information even in a complex data ecosystem; in addition, the present invention adapts to changing business needs and improves access control efficiency by designing a fine-grained access control mechanism; in response to the challenge of communication efficiency, by optimizing the data processing process, reducing communication delays, and enhancing the system's ability to process large-scale and real-time data. The present invention also focuses on improving the overall scalability and compatibility of the system to ensure seamless integration with emerging technologies such as IoT devices and edge computing systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is the system architecture of the method of the present invention.

[0064] Figure 2 The probability of consensus nodes being attacked under different threshold settings.

[0065] Figure 3 The decryption time of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing (LSSS) of the present invention is compared with that of the traditional CP-ABE algorithm when processing different numbers of node attributes.

[0066] Figure 4 The encryption time and decryption time of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing (LSSS) of the present invention are compared with the total encryption time and decryption time of the traditional CP-ABE algorithm when processing different numbers of node attributes.

[0067] Figure 5 The encryption time of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing (LSSS) of the present invention is compared with that of the traditional CP-ABE algorithm when processing different numbers of node attributes. DETAILED DESCRIPTION

[0068] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0069] The present invention provides a data security sharing method based on a consortium chain, comprising:

[0070] Build a decentralized alliance chain network chain architecture to enhance the security of data sharing, reduce the risk of single point failure, and improve the overall stability and anti-attack capabilities of the system;

[0071] Propose an access control mechanism based on the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS to realize data access policy definition and permission verification in the alliance chain network; strive to improve the level of privacy protection in the data sharing process, and ensure the security of sensitive information even in a complex data ecosystem;

[0072] It also introduces interoperability of alliance chain nodes to realize data and asset exchange between different blockchain networks in the alliance chain network; it breaks the data silos and promotes information sharing and business collaboration;

[0073] A consensus mechanism is also designed to enhance the cooperation of network participants and the system's anti-tampering ability, which not only improves the system's operating efficiency, but also enhances the cooperation of network participants and the system's anti-tampering ability.

[0074] The following is the specific implementation process of the present invention.

[0075] 1. System construction and initialization: In the present invention, the data management agency or a certified third-party technical agency is first responsible for building and initializing the entire alliance chain data security sharing system. The core function of the system is to generate global public system parameters and global keys, which are key elements to ensure system security and credibility. In addition, the system will build an alliance chain, whose main participants include certification authorities (CA), data nodes, and data producers. The alliance chain adopts the consensus mechanism and governance mechanism proposed in this technical solution, and is divided into different management groups according to the geographical distribution and management responsibilities of data nodes to optimize data management and sharing processes.

[0076] 2. Mathematical description of encryption and decryption process:

[0077] In the data encryption stage of the alliance chain, the data producer needs to perform the following steps on the plaintext data M to generate the ciphertext CT:

[0078] 2.1. Use the AES symmetric encryption algorithm to encrypt M and generate a symmetric key K AES and the corresponding ciphertext C AES .

[0079] C AES =AES Encrypt (M,K AES )

[0080] Among them, K AES To generate the ciphertext C AES The symmetric key to use.

[0081] 2.2. Using the ciphertext policy attribute encryption (CP-ABE) algorithm based on linear secret sharing (LSSS), C AES Perform secondary encryption to ensure that only users who meet specific attribute policies can decrypt. The specific steps are as follows:

[0082] Using CP-ABE to analyze C AES Encrypt to generate the final ciphertext CT, and use the symmetric key K AES Encapsulated in the ciphertext. This encryption process depends on a set of attributes A and encryption policy ∏ and the system public key PK.

[0083] The mathematical expression is as follows:

[0084] CT=CPABE Encrypt ((C AES ,K AES ),A,Π,PK)

[0085] Among them, PK is the system public key.

[0086] 2.3. In the data decryption phase, the data accessor needs to perform the following steps on CT to restore the original plaintext M:

[0087] The data accessor needs to verify whether its attribute set A' satisfies the encryption strategy Π.

[0088] If the attributes are satisfied, use the private key SK to decrypt CT and get K AES and C AES .

[0089] Use K AES C AES Perform AES decryption to obtain the original plaintext M.

[0090] The mathematical expression is as follows:

[0091] (K AES ,C AES )=CPABE Decrypt (CT,SK,PK)

[0092] M=AES Decrypt (C AES ,K AES )

[0093] Where SK is the private key corresponding to the attribute set A'.

[0094] 3. Roles and responsibilities of the certification authority (CA):

[0095] The certification authority (CA) is a key organization that interfaces with government departments and is responsible for maintaining the authority and credibility of the system. The responsibilities of the CA include the distribution of attributes and system parameters, as well as the identity registration of data nodes and data producers. During the system initialization phase, the CA distributes system public parameters, global keys, and attribute information to the groups managed by each data node through a secure communication channel, and ensures that this information is ultimately securely delivered by the data node to the data producers within the group. The CA is responsible for generating and distributing system public parameters P and global keys MK, as well as defining the attribute set A. These parameters are the basis for constructing bilinear mapping and attribute-based encryption strategies. In terms of identity registration and management, the CA provides identity authentication and registration services for data nodes and data producers to ensure the uniqueness and legitimacy of the identity of each entity.

[0096] The specific encryption process of CA attribute-based encryption (ABE) algorithm is as follows:

[0097] CT=CPABE Encrypt (M,P,A,Π)

[0098] Among them, M is the plaintext data, A is the attribute set, and Π is the logical expression that defines the access rights.

[0099] Decryption process:

[0100] M=CPABE Decrypt (CT,P,SK i )

[0101] If the attribute set of entity i satisfies Π, the decryption is successful and the plaintext M is output.

[0102] 4. Configuration and functions of data nodes:

[0103] As a key node in the data sharing alliance chain system, the data node plays an important role in data encryption and authentication strategy generation. The data node conducts strict identity authentication on the data producers who have newly joined the group to ensure their legitimacy and authenticity. After successful authentication, the data node permanently puts the vehicle's identity information and registration transaction records on the chain, using the tamper-proof nature of the blockchain to ensure the transparency and integrity of the data.

[0104] Data nodes selectively store data in distributed storage systems on or off the chain based on the attributes and sharing requirements of the data. For data that requires high transparency and security, on-chain storage is preferred; for data that is large in size or has low access frequency, off-chain storage is selected to optimize storage efficiency and cost. The data storage decision logic is as follows:

[0105]

[0106] Among them, DataSaensitibity represents the sensitivity score of the data, and Threshold is the preset threshold used to decide whether to store the data on the chain. Data with a sensitivity score greater than the Threshold is stored on the chain, otherwise it is stored off the chain.

[0107] 5. Data processing and docking of data producers:

[0108] As the main data producer in the data sharing alliance chain, the data producer is responsible for storing the attributes and keys distributed by the CA, and using these keys to perform LSSS-based CP-ABE attribute encryption on the data that needs to be on the chain. In addition, the data producer is also responsible for decrypting the received ciphertext data to ensure the smooth progress of data authentication and sharing operations. The encryption process is that the data producer uses its stored attributes and keys to encrypt the generated data. This process ensures the security and privacy of the data during transmission and storage. The encryption process follows the following technical steps:

[0109] CT=CPABE Encrypt (M,P,SK attr ,Π)

[0110] Among them, M is the plaintext data to be encrypted, P is the public parameter, SK attr is the private key obtained by the data producer based on its attributes, and Π is a logical expression that defines access rights.

[0111] 6. The present invention also adopts an innovative consensus mechanism, which introduces a Verifiable Random Function (VRF) mechanism to carry out the election process of the master node. Specific steps:

[0112] (1) Each participating node generates a temporary public-private key pair and submits the public key to the system;

[0113] (2) The system collects all submitted public keys and uses the VRF algorithm to generate a random number for each public key. The generated random number will serve as the basis for the election;

[0114] (3) The system sorts all participating nodes according to the generated random number and selects the node with the smallest random number as the master node;

[0115] (4) The master node uses its private key to sign the election results and publishes the signature results to all participating nodes to prove the legitimacy of its identity.

[0116] This method can significantly reduce the risk of master node identity disclosure before the consensus formation stage. Through the VRF mechanism, master nodes can be fairly and randomly selected without revealing their identities, thereby enhancing the security and anti-tampering capabilities of the entire system. The experiment set up multiple blockchain networks with different architectures and protocols, and the present invention successfully achieved interoperability between them. Figure 2 As shown in the figure, the present invention demonstrates the probability of consensus nodes being attacked under different threshold settings through simulation experiments. Specific parameter environment settings of the experiment:

[0117] 1) Number of participating nodes: 100 nodes;

[0118] 2) Proportion of nodes controlled by attackers: 50%;

[0119] 3) Threshold setting: determined according to the size of the random number generated by the VRF algorithm;

[0120] 4) Attack model: Assume that the attacker is able to control a certain proportion of nodes and attempts to disrupt the consensus process through malicious behavior.

[0121] The experimental results show that even in the extreme case, that is, assuming that 50% of the nodes are successfully hacked by the attacker, the probability of the attacker successfully destroying the consensus in the present invention is less than 0.1. This result fully proves that the present invention can provide a highly reliable guarantee for efficient data security sharing in terms of the security of the consensus mechanism.

[0122] 7. The present invention simulates and tests the efficiency of the encryption and decryption algorithm, especially the performance when processing different numbers of node attributes. The present invention optimizes the algorithm to improve its efficiency in various data sharing scenarios. Specifically, the present invention uses parallel computing technology to process multiple attribute shares, which significantly improves the decryption speed. In the decryption stage, the present invention uses the following mathematical model to process attribute shares in parallel:

[0123] Suppose there are n attribute shares s1,s2,......,s n In the decryption phase, the system can perform decryption on each attribute share in the ciphertext CT in parallel to obtain the intermediate decryption result d i :

[0124] d i =CPABE Decrypt (CT,SK i ,PK)for i=1,......,n

[0125] Among them, SK i is the attribute share s i The associated private key.

[0126] Then, these decrypted shares d i The complete symmetric key K is quickly reconstructed through the merge function Merge AES and ciphertext C AES , and then restore the original message M:

[0127] (K AES ,C AES )=Merge(d1,d2,......,d n )

[0128] M=AES Decrypt (C AES ,K AES )

[0129] Experimental results, such as Figure 3 , Figure 4 and Figure 5 As shown. In the simulation environment set up, the time required for the encryption phase of the scheme of the present invention is slightly lower than that of the traditional CP-ABE scheme. In particular, after the introduction of alliance chain node interoperability, we observed that the time for data synchronization and transaction confirmation in a multi-chain environment was significantly reduced, and the efficiency of alliance chain node transactions was improved by about 40% compared with traditional methods. This result is particularly significant in the decryption phase, especially when processing node data with a large number of attributes, the scheme of the present invention shows a significant time consumption advantage. This is due to the rapid response capability of the adaptive access control system, which can dynamically adjust access rights according to user behavior patterns in real time, greatly improving the efficiency of permission verification.

[0130] As the number of attributes increases, the performance advantage of the solution of the present invention becomes more and more obvious, especially in terms of enhanced data privacy protection. Through CP-ABE technology, the present invention ensures that only users who meet specific access policies can decrypt and access data. Even when the amount of data increases significantly, no performance degradation is observed. In addition, the implementation of data storage optimization strategy intelligently adjusts the storage location according to the frequency and importance of data access, further reducing data retrieval time and improving storage efficiency.

[0131] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A data security sharing method based on a consortium chain, characterized in that: include: Build a decentralized alliance chain network; An access control mechanism based on the ciphertext policy attribute encryption CP-ABE algorithm with linear secret sharing (LSSS) is proposed to realize data access policy definition and permission verification in the alliance chain network.

2. According to claim 1, a data security sharing method based on a consortium chain is characterized in that: The steps include: System construction and initialization: The data management agency or trusted third-party technical department is responsible for building and initializing the entire alliance chain system, generating global public system parameters and global keys, building an alliance chain network, and dividing the data nodes into different management groups according to their responsibilities and geographical distribution. The participants in the alliance chain network include the certification authority CA composed of the data management agency or trusted third-party technical department, data nodes, and data producers; Establishment of data nodes: Each data node is configured as an authoritative management node in the consortium chain group, responsible for authenticating the identity of the data producer; Data encryption stage: The data producer will perform AES symmetric encryption on the data to be uploaded to the chain, and use the ciphertext policy attribute encryption algorithm CP-ABE based on linear secret sharing LSSS for encryption. The encrypted ciphertext data includes attribute policy, system parameters and system public key, and is sent to the data node through a secure channel; Data decryption phase: Data producers obtain authorization by registering and verifying their identity with data nodes. Authorized entities use their attributes, public system parameters, and master keys to successfully decrypt ciphertext data that meets the attribute policy and obtain plaintext data for access and use.

3. According to claim 2, a data security sharing method based on a consortium chain is characterized in that: In the establishment of data nodes, the authentication process of data nodes to authenticate the identity of data producers adopts the non-interactive zero-knowledge proof NIZK algorithm. The specific steps are as follows: Initialization: Generate the system public parameters PP based on the discrete logarithm problem of zero-knowledge proof and a trusted parameter generator; Prover initialization: Data producer P generates its private key sk p and the corresponding public key pk p ; Proof generation: Data producer P uses its private key sk p and the system public parameter PP to generate a zero-knowledge proof π, proving that it knows the same thing as pk p The associated private key without revealing any information about sk p information; Authentication: Data producer P submits the zero-knowledge proof π to the data node, and the data node uses the system public parameter PP to verify the validity of the proof π; Transaction records on the blockchain: When P's identity is verified through zero-knowledge proof, the data node stores P's identity information and registered transaction records as transaction T on the blockchain. The structure of transaction T is T = (ID P , pk P ,π,T3), where ID P is the identity of P, T s Is the timestamp.

4. According to claim 2, a data security sharing method based on a consortium chain is characterized in that: During the data encryption phase, the specific implementation method for data producers to encrypt the data to be uploaded to the chain is as follows: 1) Use the AES symmetric encryption algorithm to encrypt the plaintext data M and generate a symmetric key K AES and the corresponding initial ciphertext C AES ; C AES =AES Encrypt (M,K AES ) Among them, AES Encrypt The encryption algorithm is the AES symmetric encryption algorithm; 2) Using the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS, C AES Perform secondary encryption to ensure that only users who meet the predetermined attribute policy can decrypt; the details are as follows: The encryption algorithm of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS is used to encrypt C AES Encrypt to generate the final ciphertext CT, and use the symmetric key K AES Encapsulated in ciphertext; this encryption process depends on a set of attribute sets A and attribute strategies Π and the system public key PK; CT=CPABE Encrypt ((C AES ,K AES ),A,Π,PK) Among them, CPABE Encrypt It is an encryption algorithm of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS, and the attribute policy Π is defined based on the access control requirements of the data.

5. According to claim 4, a data security sharing method based on a consortium chain is characterized in that: The specific implementation method of decrypting ciphertext data that meets the attribute strategy and obtaining plaintext data is as follows: 1) The data accessor needs to verify whether its attribute set A′ satisfies the attribute strategy Π; if so, use the private key SK to decrypt CT and obtain K AES and C AES ; (K AES ,C AES )=CPABE Decrypt (CT,SK,PK) Among them, CPABE Decrypt is the decryption algorithm of the ciphertext policy attribute encryption CP-ABE algorithm based on linear secret sharing LSSS, SK is the private key corresponding to the attribute set A′; 2) Use K AES C AES Use the AES symmetric encryption algorithm to decrypt and get the original plaintext M: The mathematical expression is as follows: M=AES Decrypt (C AES ,K AES ) Among them, AES Decrypt Decryption algorithm for the AES symmetric encryption algorithm.

6. A data security sharing method based on a consortium chain according to claim 1 or 2, characterized in that: In the consortium chain network, the on-chain and off-chain storage of data is purposefully selected based on the importance and sensitivity of the data. The selection principles are as follows: Assess the importance of data and rank it based on its impact and value to business operations; Assess the sensitivity of the data and categorize it according to the level of damage that a data breach could cause.

7. According to claim 2, a data security sharing method based on a consortium chain is characterized in that: The data decryption phase also includes a mechanism to monitor and respond to abnormal behaviors during data sharing; The mechanism for responding to abnormal behaviors during data sharing is to adopt different response strategies according to the abnormal level, including: Low-level anomalies: record behavior logs and conduct regular reviews; Medium-level exception: triggers a warning notification and requires further user verification; High-level anomalies: Immediately block related operations, isolate the entity involved, and initiate the security review process.

8. According to claim 1, a data security sharing method based on a consortium chain is characterized in that: A consensus mechanism is also designed to enhance the cooperation of network participants and the system's tamper-resistance, that is, the Verifiable Random Function (VRF) mechanism is introduced to carry out the election process of the master node, as follows: (1) Each participating data node generates a temporary public-private key pair and submits the public key to the system; (2) The system collects all submitted public keys and uses the VRF mechanism to generate a random number for each public key. The generated random number will serve as the basis for the election; (3) The system sorts all participating data nodes according to the generated random number and selects the data node with the smallest random number as the master node; (4) The master node uses its private key to sign the election results and publishes the signature results to all participating data nodes to prove the legitimacy of its identity.

9. According to claim 1, a data security sharing method based on a consortium chain is characterized in that: It also introduces alliance chain node interoperability to enable data and asset exchange between different blockchain networks in the alliance chain network.

10. According to claim 1, a data security sharing method based on a consortium chain is characterized in that: The data node determines the data that the data producer needs to upload to the chain and decides whether to upload it to the chain: Among them, DataSaensitibity represents the sensitivity score of the data, and Threshold is the preset threshold used to decide whether to store the data on the chain. Data with a sensitivity score greater than the Threshold is stored on the chain, otherwise it is stored off the chain.

Images