Data sharing method and device

Abstract

The invention discloses a data sharing method and device, and the method comprises the steps: a data owning end carries out the encryption of a plaintext corresponding to shared data according to a preset first key, and obtains a ciphertext and an index corresponding to the shared data; then, uploading the ciphertext of the shared data to a distributed system to obtain a storage address of the ciphertext of the shared data; the data owning end uploads the first secret key, the index of the shared data and the storage address of the ciphertext of the shared data to the block chain according to a preset access strategy, and the access strategy comprises the access authority of the data access end and the encryption strategy of the first secret key. Therefore, the shared data is prevented from being leaked and tampered, the shared data is prevented from being lost, and the security and privacy of the shared data are guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of Internet and big data, and in particular to a method and device for data sharing. Background Art

[0002] With the continuous development of the Internet, different business scenarios will be involved in the interaction between different enterprises and different industries, thus generating a large amount of data. As the amount of data increases, data sharing becomes more important. Data sharing helps to break down information barriers between different enterprises and different industries and promote development.

[0003] In the process of data sharing, data security is particularly important. At present, data sharing is generally achieved through centralized servers and centralized storage solutions, that is, data sharing is carried out through third-party platforms. However, under centralized management, the central administrator may cause data leakage or tampering from the inside, making the data security unguaranteed. When the central server is attacked, it will cause a single point of failure, causing the central server to crash, so that the shared data will be lost. In addition, the process of data upload and access cannot be recorded, and the data access record cannot be queried, that is, it is impossible to track and trace.

[0004] Therefore, there is an urgent need for a data sharing method to record the process of data uploading and accessing, prevent the leakage and tampering of shared data, prevent the loss of shared data, and ensure the security and privacy of shared data. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for data sharing, which are used to realize data sharing through a data security sharing system based on blockchain, prevent the loss of shared data, prevent the leakage of shared data and the tampering of shared data, and ensure the security of shared data.

[0006] In a first aspect, an embodiment of the present invention provides a data sharing method, including:

[0007] The data owner encrypts the plaintext corresponding to the shared data according to the preset first key to obtain the ciphertext and index corresponding to the shared data;

[0008] The data owner uploads the ciphertext to the distributed system to obtain the storage address of the ciphertext;

[0009] The data owner uploads the first key, the index and the storage address of the ciphertext to the blockchain according to a preset access policy, where the access policy includes the access rights of the data access terminal and the encryption policy of the first key.

[0010] In the above technical solution, the data owner can be a terminal device of the user. The user logs in to the data sharing system based on the terminal device to upload the shared data. The data sharing system represents a data security sharing system established based on the blockchain system. The data owner selects the first key through the data sharing system, encrypts the shared data, and obtains the index and ciphertext of the shared data. The encryption algorithm of the first key is a searchable encryption algorithm. Then the ciphertext of the shared data is uploaded to the distributed system through the interface of the data sharing system. The access policy includes the access rights of the data access end to the first key and the encryption policy of the first key. According to the access policy, the data owner uploads the storage address of the first key, index and ciphertext to the blockchain through the interface of the data sharing system for evidence storage. Data sharing is realized through a data security sharing system based on blockchain, and the shared data is encrypted to obtain the index and ciphertext. The data access end can search the ciphertext according to the index. The blockchain server cannot obtain information related to the plaintext of the shared data, so as to prevent malicious servers from leaking the shared data. The ciphertext of the shared data is stored in the distributed system to prevent the loss of the shared data. The preset access policy prevents the leakage and tampering of the shared data, and ensures the security and privacy of the shared data.

[0011] Optionally, the data owner uploads the first key, the index, and the storage address of the ciphertext to the blockchain according to a preset access policy, including:

[0012] The data owner encrypts the first key according to the encryption policy to obtain a second key;

[0013] The data owner encapsulates the encryption policy and the second key according to the access permission to obtain the encapsulated encryption policy and the second key;

[0014] The data owner uploads the index, the storage address of the ciphertext, the encapsulated encryption strategy and the second key to the blockchain.

[0015] In the above technical solution, the encryption strategy of the first key can be any encryption strategy of the key, which is set by the data owner. The data owner encrypts the first key based on the encryption strategy to obtain the second key. The second key can be the ciphertext obtained after the first key is encrypted. Then the data owner encapsulates the encryption strategy and the second key according to the access rights in the access policy. When the data access end meets the access rights, the encryption strategy and the second key can be unsealed. The data owner then uploads the index, storage address and the encapsulated encryption strategy and the second key to the blockchain through the interface of the data sharing system for evidence storage. The uploaded information can also include the identity information of the data owner, which is used to track and trace the data upload process. And by formulating the access rights of the data access end, fine-grained access control is achieved to prevent the leakage of shared data and enhance the security of shared data.

[0016] Optionally, the first key is a symmetric key, and the distributed system is an IPFS system.

[0017] In the above technical solution, the first key uses a symmetric key to prevent shared data leakage and improve the security of shared data. The ciphertext of the shared file is uploaded to the IPFS system to prevent the loss of shared data due to a single point of failure and avoid the redundancy problem of storing a large amount of data in the blockchain.

[0018] In a second aspect, an embodiment of the present invention provides a data sharing method, including:

[0019] The data access end obtains the first key and index uploaded by the data owner end according to a preset access policy on the blockchain, wherein the access policy includes the access rights of the data access end and the encryption policy of the first key;

[0020] The data access end queries the storage address in the blockchain according to the index, where the storage address is the address of the ciphertext corresponding to the shared data stored in the distributed system;

[0021] The data access end determines the ciphertext corresponding to the shared data according to the storage address;

[0022] The data access end decrypts the ciphertext according to the first key to obtain the plaintext corresponding to the shared data.

[0023] In the above technical solution, the data access end can be a user's terminal device. The user logs in to the data sharing system based on the terminal device to obtain the shared data uploaded by the data owner. The data sharing system represents a data security sharing system based on blockchain. The data access end obtains the index and the first key of the shared data through the data sharing system. The data access end generates a trapdoor for the obtained index, sends it to the blockchain smart contract for query through the data sharing system, obtains the ciphertext of the shared data according to the query result, and then decrypts the ciphertext of the shared data according to the first key to obtain the shared data, thereby realizing data sharing through the data security sharing system based on blockchain. The data access end searches for the ciphertext through the trapdoor, and the blockchain server cannot obtain the plaintext information about the shared data, thereby realizing the confidential storage of the shared data, preventing the shared data from being leaked and tampered with, and ensuring the security and privacy of the shared data.

[0024] Optionally, the data access end obtains the first key and index uploaded by the data owner end according to a preset access policy on the blockchain, including:

[0025] The data access end obtains the index on the blockchain and the encryption policy and the second key encapsulated by the data owner according to the access permission;

[0026] When the data access end determines that the access right is satisfied according to its own identity information, the data access end obtains the encryption policy and the second key;

[0027] The data access end decrypts the second key according to the encryption policy to obtain the first key.

[0028] In the above technical solution, the data access end logs in to the data sharing system and obtains the index of the shared file and the encapsulated encryption policy and the second key. When the identity information of the data access end meets the access rights in the access policy, the encapsulated encryption policy and the second key can be unsealed. The data access end then decrypts the second key according to the encryption policy of the first key to obtain the first key, thereby achieving fine-grained access control and preventing shared data leakage.

[0029] Optionally, the first key is a symmetric key, and the distributed system is an IPFS system.

[0030] In the above technical solution, symmetric keys are used to implement fine-grained access control, prevent shared data from being leaked, and improve the security of shared data. The ciphertext of the shared file is obtained from the IPSF system to prevent the loss of shared data due to a single point of failure.

[0031] In a third aspect, an embodiment of the present invention provides a data sharing device, including:

[0032] A processing module, used to encrypt the plaintext corresponding to the shared data according to a preset first key to obtain the ciphertext and index corresponding to the shared data;

[0033] An uploading module, used to upload the ciphertext to a distributed system and obtain a storage address of the ciphertext;

[0034] The first key, the index and the storage address of the ciphertext are uploaded to the blockchain according to a preset access policy, wherein the access policy includes the access rights of the data access terminal and the encryption policy of the first key.

[0035] Optionally, the upload module is specifically used for:

[0036] Encrypting the first key according to the encryption strategy to obtain a second key;

[0037] Encapsulate the encryption policy and the second key according to the access permission to obtain the encapsulated encryption policy and the second key;

[0038] The index, the storage address of the ciphertext, the encapsulated encryption strategy and the second key are uploaded to the blockchain.

[0039] Optionally, the first key is a symmetric key, and the distributed system is an IPFS system.

[0040] In a fourth aspect, an embodiment of the present invention provides a data sharing device, including:

[0041] An acquisition unit, configured to acquire, on the blockchain, a first key and an index uploaded by a data owner according to a preset access policy, wherein the access policy includes access rights of the data access terminal and an encryption policy of the first key;

[0042] A processing unit, configured to query a storage address in the blockchain according to the index, wherein the storage address is an address of a ciphertext corresponding to the shared data stored in the distributed system;

[0043] Determine the ciphertext corresponding to the shared data according to the storage address;

[0044] The ciphertext is decrypted according to the first key to obtain the plaintext corresponding to the shared data.

[0045] Optionally, the acquiring unit is specifically used for:

[0046] Obtaining the index and the encryption policy and the second key encapsulated by the data owner according to the access permission on the blockchain;

[0047] When determining that the access right is satisfied according to the identity information of the user, obtaining the encryption policy and the second key;

[0048] The second key is decrypted according to the encryption policy to obtain the first key.

[0049] Optionally, the first key is a symmetric key, and the distributed system is an IPFS system.

[0050] In a fifth aspect, an embodiment of the present invention further provides a computer device, including:

[0051] A memory for storing program instructions;

[0052] The processor is used to call the program instructions stored in the memory and execute the above-mentioned data sharing method according to the obtained program.

[0053] In a sixth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned data sharing method. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 A schematic diagram of a system architecture provided by an embodiment of the present invention;

[0056] Figure 2 A flow chart of a data sharing method provided by an embodiment of the present invention;

[0057] Figure 3 A flow chart of a data sharing method provided by an embodiment of the present invention;

[0058] Figure 4 A hierarchical architecture diagram of a data sharing system provided by an embodiment of the present invention;

[0059] Figure 5 A flow chart of a data sharing method provided by an embodiment of the present invention;

[0060] Figure 6 A schematic diagram of the structure of a data sharing device provided by an embodiment of the present invention;

[0061] Figure 7 A schematic diagram of the structure of a data sharing device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Figure 1 A system architecture applicable to an embodiment of the present invention is exemplarily shown, which includes a data owner 100, a data sharing system 110, a data access terminal 120, a blockchain system 130 and an IPFS system 140.

[0064] Among them, the data owner 100 can be a terminal device with an interface of the data sharing system 110. The data owner 100 selects the first key through the data sharing system 110, encrypts the shared data to obtain the ciphertext and index, and then uploads the ciphertext of the shared data to the IPFS system 140 through the data sharing system 110 to obtain the storage address. It is also used to formulate an access policy, encrypt the first key based on the encryption policy in the access policy to obtain the second key, and then encapsulate the second key and the encryption policy based on the access rights in the access policy. Finally, the index, storage address, and the encapsulated second key and encryption policy are uploaded to the blockchain system 130 through the data sharing system 110.

[0065] The data sharing system 110 is a data security sharing system established based on the blockchain system 130, which is used to provide the first key to the data owner 100, encrypt the shared data, and obtain the index and ciphertext. Then the data owner 100 uploads the ciphertext of the shared data to the IPFS system 140 through the data sharing system 110. It is also used for the data owner 100 to upload the index, storage address, and the encapsulated second key and encryption strategy to the blockchain system 130 through the data sharing system 110. It is used for the data access terminal 120 to obtain the index of the shared data stored in the blockchain system 130 and the encapsulated encryption strategy and second key through the data sharing system 110, and then when the identity information of the data access terminal 120 meets the access rights, the second key is encrypted according to the encryption strategy. It is also used for the data access terminal 120 to query the blockchain system 130 through the blockchain-based data sharing system 110 according to the index to obtain the storage address.

[0066] The data access terminal 120 is used to obtain the index of the shared data stored in the blockchain system 130 and the encapsulated encryption policy and the second key through the data sharing system 110, and then decrypt the second key according to the encryption policy to obtain the first key when the identity information of the data access terminal 120 meets the access rights. It is also used for the data access terminal 120 to query the blockchain system 130 through the data sharing system 110 according to the index to obtain the storage address, and then access the IPFS system 140 according to the storage address to obtain the ciphertext of the shared data. Then, through the data sharing system 110, the ciphertext of the shared data is decrypted according to the first key to obtain the plaintext of the shared data.

[0067] The blockchain system 130 is used to interact with the data owner 100 and the data access end 120 through the data sharing system 110, and is also used to save the index, storage address, and encapsulated second key and encryption strategy uploaded by the data owner 100 to the blockchain system 130 through the data sharing system 110.

[0068] The IPFS system 140 is used for the data owner 100 to upload the ciphertext of the shared data to the IPFS system 140 for storage through the data sharing system 110. The data access terminal 120 accesses the IPFS system 140 according to the storage address to obtain the ciphertext of the shared data and then decrypts it.

[0069] Based on the above description, Figure 2 The flowchart of a data sharing method provided by an embodiment of the present invention is exemplarily shown. The method is applied to a data owner, such as Figure 2 As shown in the figure, the process specifically includes:

[0070] Step 210: The data owner encrypts the plaintext corresponding to the shared data according to a preset first key to obtain the ciphertext and index corresponding to the shared data.

[0071] In the embodiment of the present invention, the data-owning end refers to the end with shared data, which can be a terminal device used by the user, such as a mobile phone, a computer, etc. The terminal device has an interface of the data sharing system, and the user logs in to the data sharing system through the interface based on the terminal device to upload the shared data. The data sharing system is a data security sharing system established based on the blockchain system. The interface of the data sharing system can be a website or application installed on the terminal device. Exemplarily, the user opens the webpage of the data sharing system on the computer and enters the account number and password to log in.

[0072] The data owner selects the first key through the data sharing system, encrypts the shared data, and obtains the index and ciphertext of the shared data. Among them. The first key is a parameter, which is input into the encryption algorithm or decryption algorithm to realize data encryption or decryption. Specifically, the data owner selects the symmetric key in the data sharing system, encrypts the plaintext of the shared data, and obtains the corresponding ciphertext and index. The symmetric key indicates that both parties sending and receiving data must use the same key to encrypt and decrypt the data. The index is the keyword of the shared data obtained after the shared data is encrypted. Exemplarily, the data owner selects the second parameter in the data sharing system, that is, the second symmetric key. The shared data is an experimental record of a certain material. The data owner inputs the second parameter into the encryption algorithm, encrypts the plaintext of the experimental record, and obtains the ciphertext of the experimental record and the identifier of the experimental record, that is, the index.

[0073] In step 220, the data owner uploads the ciphertext to a distributed system to obtain a storage address of the ciphertext.

[0074] In an embodiment of the present invention, after obtaining the ciphertext and index of the shared data, the data owner uploads the ciphertext of the shared data to the distributed system through the data sharing system to obtain the storage address. Specifically, the data owner uploads the ciphertext of the shared data to the IPFS system through the data sharing system to obtain the storage address of the ciphertext of the shared data in the IPFS system. Exemplarily, after obtaining the ciphertext of the experimental record and the identifier of the experimental record, the data owner uploads the ciphertext of the experimental record to the IPFS system through the data sharing system to obtain the storage address of the ciphertext of the experimental record.

[0075] In step 230, the data owner uploads the first key, the index, and the storage address of the ciphertext to the blockchain according to a preset access policy.

[0076] In an embodiment of the present invention, the data owner formulates an access strategy, and then uploads the first key, the index of the shared data, and the storage address of the ciphertext of the shared data to the blockchain according to the access strategy. Among them, the access strategy includes the access rights of the data access terminal and the encryption strategy of the first key. The access rights of the data access terminal indicate that the identity information of the data access terminal can perform access operations after meeting the preset conditions. For example, the access rights are that when the identity information of the data access terminal is a supervisor, access is allowed. The encryption strategy of the first key indicates the operation rules for encrypting the first key, which is used to decrypt the encrypted first key.

[0077] Specifically, the data owner formulates an access policy including access rights and encryption policies, and encrypts the first key according to the encryption policy to obtain the second key. The second key can be the ciphertext obtained by encrypting the first key. Then, the data owner encapsulates the encryption policy and the second key according to the access rights. Finally, the data owner uploads the index, storage address, and the encapsulated encryption policy and the second key to the blockchain for evidence storage through the data sharing system. Exemplarily, after the data owner formulates the access policy, the selected second symmetric key is encrypted using the operation rules according to the encryption policy to obtain the ciphertext of the above symmetric key. Then, according to the access rights, the encryption policy and the ciphertext of the above symmetric key are encapsulated, and can only be unsealed when the identity information of the data access end is the supervisor. Then, the data owner uploads the identifier of the experimental record, the storage address of the ciphertext of the experimental record, the encapsulated encryption policy, and the ciphertext of the above symmetric key to the blockchain system through the data sharing system. In one implementation, the data owner also uploads its own identity information, the hash value of the shared data, and the number of the shared data to the blockchain, where the hash value of the shared data is used to verify whether the ciphertext of the shared data is complete and ensure the security of the shared data; the data owner's identity information and the shared data number are used for subsequent queries on the data upload process to achieve tracking and tracing of data records.

[0078] Based on the above description, Figure 3 The flowchart of a data sharing method provided by an embodiment of the present invention is exemplarily shown. The method is applied to a data access terminal, such as Figure 3 As shown in the figure, the process specifically includes:

[0079] Step 310: The data access end obtains the first key and index uploaded by the data owner according to the preset access policy on the blockchain.

[0080] In the embodiment of the present invention, the data access end refers to an end for obtaining shared data, which can be a user's terminal device such as a mobile phone, a computer, etc. The terminal device has an interface of the data sharing system, and the user logs in to the data sharing system through the interface based on the terminal device to obtain shared data. The data sharing system is a data security sharing system based on blockchain. The interface of the data sharing system can be a website or application installed on the terminal device. Exemplarily, the user opens the webpage of the data sharing system on the computer and enters the account password to log in.

[0081] The data access end obtains the first key and index uploaded by the data owner end according to the access policy through the interface of the data sharing system. The access policy includes the access rights of the data access end and the encryption policy of the first key. The access rights of the data access end indicate that the access operation can be performed when the identity information of the data access end meets the preset conditions. The encryption policy of the first key indicates the operation rule selected by the data owner end to encrypt the first key.

[0082] Specifically, the data access terminal obtains the index of the shared data and the encryption policy and the second key encapsulated according to the access rights from the blockchain through the data sharing system. For example, the data access terminal logs in to the data sharing system and obtains the identifier of the experimental record and the encryption policy encapsulated according to the access rights and the ciphertext of the selected second symmetric key. When the data access terminal determines that the access rights are met based on its own identity information, it unseals the encapsulated encryption policy and the second key to obtain the encryption policy and the second key. If the identity information of the data access terminal is the supervisor, it meets the access rights set by the data owner, and then the data access terminal unseals the encapsulated encryption policy and the ciphertext of the above-mentioned symmetric key to obtain the encryption policy of the above-mentioned symmetric key and the ciphertext of the above-mentioned symmetric key. When the identity information of the data access terminal does not meet the access rights, the encapsulated encryption policy and the second key cannot be unsealed, and the first key cannot be obtained, and then the plaintext of the shared data cannot be obtained, so as to prevent the leakage of the shared data and ensure the security of the shared data.

[0083] The data access end decrypts the second key according to the encryption policy to obtain the first key. Specifically, the data access end decrypts the ciphertext of the symmetric key using the operation rules in the encryption policy to obtain the symmetric key.

[0084] Step 320: The data access end queries the storage address in the blockchain according to the index.

[0085] In an embodiment of the present invention, the data access terminal queries the blockchain through the data sharing system according to the index to obtain the storage address of the shared data in the IPFS system. Specifically, the data access terminal generates a trapdoor according to the index of the acquired shared data, sends it to the blockchain smart contract through the data sharing system for query, and returns the query result to the data access terminal. The query result is the storage address of the shared data in the IPFS system. Because the shared data is uploaded to the IPFS system after encryption, the blockchain server cannot obtain any plaintext information about the shared data during the query process of the blockchain smart contract. The confidential storage of files is realized, which can prevent malicious servers from leaking the privacy of the data owner and protect the security of shared data. Exemplarily, the name of a certain material obtained by the data access terminal generates a trapdoor. Through the data sharing system, the trapdoor is sent to the blockchain smart contract for query, and then the blockchain smart contract returns the storage address of the ciphertext of the experimental record of the queried material to the data access terminal.

[0086] In one possible implementation, when the data access end obtains the index and the second key of the shared data, it also obtains the storage address of the shared data in IPFS, that is, the storage address of the shared data can be obtained without generating a trapdoor based on keywords for query.

[0087] Step 330: The data access end determines the ciphertext corresponding to the shared data according to the storage address.

[0088] In an embodiment of the present invention, the data access terminal determines the ciphertext of the shared data according to the acquired storage address. Specifically, the data access terminal accesses the storage address of the shared data in the IPFS system to obtain the ciphertext of the shared data. Exemplarily, the data access terminal accesses the storage address of the ciphertext of the experimental record to obtain the ciphertext of the experimental record.

[0089] Step 340: The data access end decrypts the ciphertext according to the first key to obtain the plaintext corresponding to the shared data.

[0090] In an embodiment of the present invention, the data access end decrypts the ciphertext according to the first key to obtain the plaintext corresponding to the shared data. Specifically, the data access end decrypts the ciphertext of the shared data according to the symmetric key through the data sharing system to obtain the plaintext of the shared data. Exemplarily, the data access end decrypts the ciphertext of the experimental record through the data sharing system according to the second symmetric key selected by the data owner obtained by decryption to obtain the experimental record of a certain material.

[0091] In order to better explain the above technical solution, Figure 4 The following is an exemplary diagram of a layered architecture of a data sharing system provided by an embodiment of the present invention. Figure 4As shown, the data sharing system is established based on the blockchain system, and the layered architecture consists of a user layer, an interface layer, an algorithm layer, a node layer, and a storage layer.

[0092] The user layer is mainly composed of various business systems such as user registration, data on-chain, block data query, and data access application. It is a variety of operating systems used to serve users.

[0093] The interface layer includes interfaces such as channel creation, contract deployment, data chain upload, data encryption and decryption, and block data query. It is a bridge between the blockchain and users.

[0094] The algorithm layer includes key management, identity management, identity authentication, node management, consensus services and other core algorithms. It is the core part of the entire model, implementing the main business logic and encryption algorithms, and fully protecting data security and user privacy. Most of the algorithms are executed by smart contracts in the blockchain system, avoiding the participation of untrusted third parties and ensuring the reliability of algorithm execution.

[0095] The node layer consists of a sorting service and different organizations. The sorting service includes several sorting service nodes, and the organization includes a master node and several peer nodes.

[0096] The storage layer uses IPFS as the underlying storage. IPFS is a decentralized storage network based on blockchain technology that can achieve permanent storage of data.

[0097] Through the joint action and interaction between each layer, a blockchain-based data sharing system is formed to realize data sharing, prevent the loss of shared data, prevent the leakage of shared data and the tampering of shared data, and ensure the security of shared data.

[0098] In this application, the data owner and the data access end can register through the user creation interface of the interface layer based on the user registration system of the user layer. Based on the channel service algorithm of the algorithm layer, the channel creation interface and the connectivity test interface of the interface layer are used to establish the connection between the data owner and the data access end and the data sharing system. And based on the identity management algorithm of the algorithm layer, the identity information of the data owner and the data access end is managed.

[0099] The data owner selects the symmetric key for encrypting the shared data from the key management algorithm of the algorithm layer through the key acquisition interface of the interface layer, and then encrypts the shared data according to the symmetric key based on the data encryption and decryption interface of the interface layer. When uploading the ciphertext of the shared data to IPFS for storage, the data uplink function in the interface layer, user layer and algorithm layer interacts with each other to save the ciphertext of the shared data in the IPFS system of the storage layer, and obtains the storage address of the ciphertext of the shared data. When the data owner uploads the index, storage address and the encryption strategy and ciphertext of the symmetric key encapsulated according to the access rights to the blockchain system, the data owner interacts with each other according to the data uplink function in the interface layer, user layer and algorithm layer, and then sorts the relevant information according to the sorting service algorithm of the algorithm layer and the sorting service node of the node layer, and packages it into blocks and distributes it to the Peer node in the node layer, so as to upload the relevant information to the blockchain system.

[0100] The data access end obtains the index uploaded by the data owner and the ciphertext of the encryption policy and symmetric key encapsulated according to the access rights based on the data access application business system at the user layer. The identity information of the data access end is verified by the identity authentication algorithm at the algorithm layer. When the identity information meets the access rights, the ciphertext of the encapsulated encryption policy and symmetric key is unsealed to obtain the symmetric key. The data access end sends the trapdoor generated based on the index to the block data query business system at the user layer and the data query algorithm at the algorithm layer through the block query interface at the interface layer to query and obtain the storage address of the ciphertext of the shared data. After the data access end obtains the ciphertext of the shared data, it decrypts the ciphertext of the shared data according to the symmetric key based on the data encryption and decryption interface at the interface layer to obtain the shared data.

[0101] In order to better explain the above technical solution, Figure 5 The following is a flow chart showing a method for sharing data according to an embodiment of the present invention. Figure 5 As shown, the specific process includes:

[0102] Step 501, upload the ciphertext of shared data.

[0103] The data owner selects a symmetric key through the data sharing system, encrypts the shared data, and obtains the index and ciphertext of the shared data. The ciphertext of the shared data is then uploaded to IPFS for storage to obtain the storage address.

[0104] Step 502: Encrypt the symmetric key based on the access policy.

[0105] The data owner formulates an access policy for the symmetric key, encrypts the symmetric key based on the key encryption policy in the access policy, and obtains the ciphertext of the symmetric key.

[0106] Step 503, upload relevant information to the blockchain.

[0107] The data owner encapsulates the encryption policy and the ciphertext of the symmetric key according to the access rights in the access policy, and uploads the above index, storage address and the encapsulated encryption policy and the ciphertext of the symmetric key to the blockchain system through the data sharing system.

[0108] The above process is the process in which the data owner uploads shared data and related information to the blockchain system and IPFS system through the data sharing system. The following is the method for the data access end to obtain shared data.

[0109] Step 504, obtaining data information.

[0110] The data access end obtains the index uploaded by the data owner and the encapsulated encryption strategy and ciphertext of the symmetric key through the data sharing system.

[0111] Step 505: decrypt to obtain the symmetric key.

[0112] When the data access end meets the access rights, the encryption policy and the ciphertext of the symmetric key are decrypted. The ciphertext of the symmetric key is decrypted based on the encryption policy to obtain the symmetric key.

[0113] Step 506, query according to the index to obtain the storage address.

[0114] The data access end generates a trapdoor based on the index, sends it to the blockchain smart contract for query through the data sharing system, and returns the storage address to the data access end.

[0115] Step 507: Access the storage address to obtain the ciphertext of the shared data.

[0116] The data access end accesses the IPFS storage address and obtains the ciphertext of the shared data.

[0117] Step 508, decrypt the ciphertext of the shared data to obtain the shared data.

[0118] The data access end decrypts the ciphertext of the shared data based on the symmetric key to obtain the plaintext of the shared data.

[0119] In the embodiment of the present invention, the data owner selects a symmetric key to encrypt the plaintext of the shared data to prevent the shared data from being leaked. Then, the symmetric key is encrypted based on the encryption policy to obtain the ciphertext of the symmetric key. The encryption policy and the ciphertext of the symmetric key are then encapsulated according to the access rights and uploaded to the blockchain. Only when the identity information of the data access end meets the access rights can the encryption policy and the ciphertext of the symmetric key be obtained, so as to realize fine-grained access control, prevent the loss of shared data, prevent the leakage of shared data and the tampering of shared data, and ensure the security and privacy of shared data.

[0120] Based on the same technical concept, Figure 6 The following is a schematic diagram showing the structure of a data sharing device provided by an embodiment of the present invention. Figure 6 As shown, the device specifically includes:

[0121] The processing module 610 is used to encrypt the plaintext corresponding to the shared data according to the preset first key to obtain the ciphertext and index corresponding to the shared data;

[0122] An upload module 620, used to upload the ciphertext to a distributed system and obtain a storage address of the ciphertext;

[0123] The first key, the index and the storage address of the ciphertext are uploaded to the blockchain according to a preset access policy, wherein the access policy includes the access rights of the data access terminal and the encryption policy of the first key.

[0124] Optionally, the upload module 620 is specifically used for:

[0125] Encrypting the first key according to the encryption strategy to obtain a second key;

[0126] Encapsulate the encryption policy and the second key according to the access permission to obtain the encapsulated encryption policy and the second key;

[0127] The index, the storage address of the ciphertext, the encapsulated encryption strategy and the second key are uploaded to the blockchain.

[0128] Optionally, the first key is a symmetric key, and the distributed system is an IPFS system.

[0129] Based on the same technical concept, Figure 7 The following is a schematic diagram showing the structure of a data sharing device provided by an embodiment of the present invention. Figure 7 As shown, the device specifically includes:

[0130] An acquisition unit 710 is used to acquire, on the blockchain, a first key and an index uploaded by a data owner according to a preset access policy, wherein the access policy includes access rights of the data access terminal and an encryption policy of the first key;

[0131] A processing unit 720 is used to query a storage address in the blockchain according to the index, where the storage address is an address of a ciphertext corresponding to the shared data stored in the distributed system;

[0132] Determine the ciphertext corresponding to the shared data according to the storage address;

[0133] The ciphertext is decrypted according to the first key to obtain the plaintext corresponding to the shared data.

[0134] Optionally, the acquiring unit 710 is specifically configured to:

[0135] Obtaining the index and the encryption policy and the second key encapsulated by the data owner according to the access permission on the blockchain;

[0136] When determining that the access right is satisfied according to the identity information of the user, obtaining the encryption policy and the second key;

[0137] The second key is decrypted according to the encryption policy to obtain the first key.

[0138] Optionally, the first key is a symmetric key, and the distributed system is an IPFS system.

[0139] Based on the same technical concept, an embodiment of the present invention further provides a computer device, including:

[0140] A memory for storing program instructions;

[0141] The processor is used to call the program instructions stored in the memory and execute the above data sharing method according to the obtained program.

[0142] Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned data sharing method.

[0143] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0144] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0147] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data sharing method, characterized in that: include: The data owner encrypts the plaintext corresponding to the shared data according to the preset first key to obtain the ciphertext and index corresponding to the shared data; The data owner uploads the ciphertext to the distributed system to obtain the storage address of the ciphertext; The data owner uploads the first key, the index and the storage address of the ciphertext to the blockchain according to a preset access policy, where the access policy includes the access rights of the data access terminal and the encryption policy of the first key.

2. The method according to claim 1, characterized in that The data owner uploads the first key, the index and the storage address of the ciphertext to the blockchain according to a preset access policy, including: The data owner encrypts the first key according to the encryption policy to obtain a second key; The data owner encapsulates the encryption policy and the second key according to the access permission to obtain the encapsulated encryption policy and the second key; The data owner uploads the index, the storage address of the ciphertext, the encapsulated encryption strategy and the second key to the blockchain.

3. The method according to claim 1, characterized in that The first key is a symmetric key, and the distributed system is an IPFS system.

4. A data sharing method, characterized in that: include: The data access end obtains the first key and index uploaded by the data owner end according to a preset access policy on the blockchain, wherein the access policy includes the access rights of the data access end and the encryption policy of the first key; The data access end queries the storage address in the blockchain according to the index, where the storage address is the address of the ciphertext corresponding to the shared data stored in the distributed system; The data access end determines the ciphertext corresponding to the shared data according to the storage address; The data access end decrypts the ciphertext according to the first key to obtain the plaintext corresponding to the shared data.

5. The method according to claim 4, characterized in that The data access end obtains the first key and index uploaded by the data owner according to the preset access policy on the blockchain, including: The data access end obtains the index on the blockchain and the encryption policy and the second key encapsulated by the data owner according to the access permission; When the data access end determines that the access right is satisfied according to its own identity information, the data access end obtains the encryption policy and the second key; The data access end decrypts the second key according to the encryption policy to obtain the first key.

6. The method according to claim 4, characterized in that The first key is a symmetric key, and the distributed system is an IPFS system.

7. A data sharing device, characterized in that: include: A processing module, used to encrypt the plaintext corresponding to the shared data according to a preset first key to obtain the ciphertext and index corresponding to the shared data; An uploading module, used to upload the ciphertext to a distributed system and obtain a storage address of the ciphertext; The first key, the index and the storage address of the ciphertext are uploaded to the blockchain according to a preset access policy, wherein the access policy includes the access rights of the data access terminal and the encryption policy of the first key.

8. A data sharing device, characterized in that: include: An acquisition unit, configured to acquire, on the blockchain, a first key and an index uploaded by a data owner according to a preset access policy, wherein the access policy includes access rights of the data access terminal and an encryption policy of the first key; A processing unit, configured to query a storage address in the blockchain according to the index, wherein the storage address is an address of a ciphertext corresponding to the shared data stored in the distributed system; Determine the ciphertext corresponding to the shared data according to the storage address; The ciphertext is decrypted according to the first key to obtain the plaintext corresponding to the shared data.

9. A computer device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory and execute the method described in any one of claims 1 to 3 or claims 4 to 6 according to the obtained program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method of any one of claims 1 to 3 or claims 4 to 6.

Images