Secure sharing method and device for private data of networked automobiles and storage medium

Abstract

The invention discloses a secure sharing method for private data of a networked automobile, which is implemented based on a data sharing system architecture consisting of an I PFS distributed database, an auxiliary database and a third-party access server. The method comprises the following steps: S1, a data uploader encrypts private data and sets a data access strategy, storing the encrypted ciphertext data in an I PFS distributed database, and storing other encrypted data information in an auxiliary database; and S2, the data acquisition party uses the third-party access server to perform data retrieval in the auxiliary database in combination with the access demand of the data acquisition party, and queries and decrypts the private data stored in the I PFS database based on the retrieval result. According to the method, data security is protected through multi-layer AES encryption and a hash function, and fine-grained access control and keyword encryption search are realized by utilizing a CP-ABKS algorithm combining CP-ABE and SE algorithms, so that secure sharing of privacy data in a distributed environment is realized.

Description

Technical Field

[0001] The present invention relates to the field of automobile information security technology, and in particular to a method, device and storage medium for securely sharing private data of a networked automobile. Background Art

[0002] With the continuous development and gradual maturity of emerging technologies such as 5G and cloud computing, intelligent connected vehicles have become an important carrier of cutting-edge technologies such as artificial intelligence, big data, and 5G. Compared with traditional vehicles, intelligent connected vehicles need to integrate multiple data types for real-time processing and analysis, and the amount of data involved is extremely large. These data cover multiple dimensions such as vehicle status, location, driving behavior, and user habits, and have significant characteristics such as diversity, scale, unstructured, dynamic, and confidentiality. Intelligent connected vehicles not only need to process diverse data from on-board systems, but also need to efficiently connect with the external environment, including other vehicles (V2V), infrastructure (V2I), pedestrians (V2P), and cloud platforms (V2C). This collaborative architecture based on vehicle-road-cloud integration enables vehicles to perceive road conditions in real time, make accurate decisions, and dynamically adapt to complex traffic environments, thereby achieving a more efficient and safer intelligent driving experience. However, while this system architecture improves traffic efficiency, it also exposes severe challenges in data security and privacy protection.

[0003] The application of vehicle-road-cloud integration and V2X communication technology has enabled intelligent connected vehicles to transform from a closed in-vehicle data processing mode to an open cross-device, cross-platform data collaboration mode; vehicles need to continuously collect, transmit and process multi-source, multi-modal data including vehicle status, driving behavior, road information, traffic flow, etc.; these data not only have high-frequency, low-latency flow characteristics, but also involve sensitive information such as vehicle location and user identity; if there is a lack of effective security management mechanisms, network attackers may pose potential threats to vehicle operation safety, traffic order and even user privacy through means such as data theft, tampering or forgery.

[0004] Therefore, in order to achieve efficient data sharing while protecting user privacy and data security, existing technologies have adopted different data security sharing operations. For example, through V2X communication technology, high-frequency interactions between vehicles and roadside units (RSUs) and cloud platforms can obtain road conditions and traffic guidance in real time. However, this also provides more potential attack portals for malicious attackers. Once the data is tampered with during transmission, it may cause the vehicle to misjudge environmental information and cause traffic accidents. In particular, autonomous driving vehicles rely on multi-sensor data fusion and decision-making algorithms. If they are subjected to precise attacks, serious consequences may occur.

[0005] In summary, the existing data security management and privacy protection mechanisms are difficult to meet the data security needs in the vehicle-road-cloud integration and V2X communication environment: on the one hand, traditional encryption technology fails to fully consider the real-time and diversified needs of data in intelligent connected vehicles; on the other hand, the privacy protection mechanism needs to find a balance between data sharing and privacy protection to ensure that data can be effectively utilized during the sharing process without leaking sensitive information.

[0006] To this end, this application specifically proposes a method for securely sharing privacy data of connected vehicles to solve the above technical problems. Summary of the invention

[0007] The main purpose of the present invention is to provide a method for securely sharing the privacy data of connected vehicles, protect data security through multi-layer AES encryption and hash functions, and use the CP-ABKS algorithm that combines CP-ABE (attribute-based encryption) and SE algorithm to achieve fine-grained access control and keyword encryption search, thereby achieving secure sharing of privacy data in a distributed environment to solve the technical problems raised in the background technology.

[0008] The present invention adopts the following technical solutions to solve the above technical problems:

[0009] A secure sharing method for private data of connected vehicles, based on a data sharing system architecture consisting of an IPFS distributed database, an auxiliary database, and a third-party access server, performs the following steps:

[0010] Step S100. The data uploader encrypts the private data and sets a data access policy, stores the encrypted ciphertext data in the IPFS distributed database, and stores other encrypted data information in the auxiliary database;

[0011] Step S200. The data acquirer uses a third-party access server to perform data retrieval in the auxiliary database in combination with its own access needs, and queries and decrypts the private data stored in the IPFS database based on the retrieval results.

[0012] Preferably, the CP-ABKS algorithm in step S100 is based on the combination of the CP-ABE algorithm and the SE algorithm, and is composed of five polynomial time algorithms: system initialization, key generation, encryption, trapdoor generation and search, wherein:

[0013] System initialization, which is used to define system public parameters and generate a master key, and use the master key and other system parameters to generate a public key;

[0014] Key generation, used to generate corresponding private keys for users or user groups based on user attribute sets using the master key;

[0015] Encryption, which is used to select the data to be encrypted and symmetrically encrypt the data and the selected keywords using the public key, and specify a set of access policies after encryption to define the holders of the target attribute combination who can decrypt the data;

[0016] Trapdoor generation, for constructing a set of trapdoors using the user's private key, wherein the trapdoors are used to allow the cloud server to check whether a file contains specified keywords without decrypting the actual content;

[0017] Search, used to find all matching records in the auxiliary database based on the trapdoors submitted by the user.

[0018] Preferably, the IPFS content hash value, the ciphertext of the encryption key, and the keyword ciphertext generated in step S100 are uploaded to the auxiliary database by the data uploader to complete data storage.

[0019] Preferably, the specific operation process of step S200 includes:

[0020] Step S210. The data acquirer sends its own attribute set to the third-party access server, requesting to obtain the public key and personal private key required for data decryption;

[0021] Step S220. After receiving the private key, the data acquirer generates a keyword search trapdoor based on its own access needs, combining the acquired personal private key with the search keyword, and submits it to the auxiliary database for data search to locate the target data;

[0022] Step S230. The auxiliary database verifies the legitimacy of the search trapdoor in combination with the stored access strategy. If the verification is successful, the auxiliary database returns the content hash value, data hash value and encryption key ciphertext that match the keyword;

[0023] Step S240. The data acquirer calls the query algorithm according to the content hash value returned from the auxiliary database to obtain the encrypted data ciphertext corresponding to the target data in the IPFS distributed database;

[0024] Step S250. After completing the ciphertext acquisition, the data acquirer uses the CP-ABE algorithm to decrypt the encryption key ciphertext returned by the auxiliary database, thereby recovering the AES encryption key, and uses the AES key to decrypt the ciphertext data to obtain the original private data.

[0025] Preferably, in step S210, the third-party access server uses the master key, the access policy set by the uploader, and the attribute set of the data acquirer to perform a key generation operation through the CP-ABKS algorithm to generate two sets of personal private keys that match the user permissions, and distribute them to the data acquirer.

[0026] Preferably, it also includes:

[0027] Step L1. The data uploader uses the SHA256 hash algorithm to perform a hash operation on the original private data to generate a data hash value, which is stored in the auxiliary database as integrity verification information;

[0028] Step L2. The data acquirer can verify the consistency and integrity of the decrypted data by comparing the hash value of the decrypted data with the hash value of the data returned by the auxiliary database. After the verification is passed, the data acquirer successfully obtains the private data.

[0029] Preferably, the data sharing system architecture consists of an IPFS distributed database, an auxiliary database, and a third-party access server, wherein:

[0030] IPFS distributed database, used to store encrypted data uploaded by the data uploader and feedback the content hash value corresponding to the data;

[0031] Auxiliary database, used for fast permission verification and data retrieval. Content hash values ​​and keyword ciphertext are stored internally;

[0032] A third-party access server is used to generate and distribute the public key, master key, and user private key of the CP-ABKS algorithm to perform key management.

[0033] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0034] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0035] It can be seen from the above technical solution that the present invention provides a method for securely sharing private data of connected cars. Compared with the prior art, the present invention has the following advantages:

[0036] 1. The present invention can protect the security of private data during the sharing process through the organic combination of multi-layer AES encryption and hash functions, and use the ciphertext policy attribute-based encryption algorithm to achieve fine-grained access control and authority management of data. It can also build a private data security sharing model suitable for distributed environments.

[0037] 2. The present invention constructs a comprehensive data protection system by combining multi-layer AES encryption and hash functions, wherein the multi-layer AES encryption not only protects the data itself, but also further encrypts keywords and key information in combination with access strategies, thereby providing multiple security guarantees during storage and sharing.

[0038] 3. The present invention uses a hash function to generate a data summary for data integrity verification, which can effectively detect and prevent data tampering and forgery during transmission or storage, thereby protecting data privacy while improving the credibility of data transmission and storage.

[0039] 4. The present invention is based on the intelligent connected vehicle data security sharing model and uses an attribute-based encryption algorithm. The system can dynamically generate access keys according to the user's attribute set, and combine with the set access policy to achieve precise permission management. Compared with the traditional access control method based on role or static permissions, it can dynamically adjust access rights according to the user's real-time needs and attributes, effectively reducing the risk of unauthorized access to privacy data.

[0040] 5. The present invention further supports keyword encryption search function by combining the CP-ABKS algorithm, which enables data users to efficiently locate and obtain target data while ensuring privacy and security.

[0041] 6. The present invention constructs a decentralized storage architecture by introducing the IPFS distributed database. Compared with the traditional centralized system, the distributed database avoids the single point failure problem in the traditional centralized storage through data distribution and redundant storage between nodes. At the same time, the decentralized architecture can disperse the attack surface of data storage, significantly enhancing the system's defense capabilities against malicious attacks and data loss.

[0042] 7. The present invention combines encryption algorithms, hash functions and access control technologies to build a sharing framework that is secure, real-time and efficient, targeting the multi-source data characteristics in V2X communication, thereby achieving all-round protection of data during the sharing process and providing security for the large-scale application of intelligent connected vehicles in complex traffic scenarios.

[0043] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become easy to understand through the following description. Of course, it is not necessary to achieve all of the advantages described above simultaneously for any product implementing the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0045] Figure 1 It is a schematic diagram of the overall timing flow of the present invention;

[0046] Figure 2It is a schematic diagram of the framework of the security sharing model system of the present invention;

[0047] Figure 3 This is a schematic diagram of the privacy data secure upload process of the present invention;

[0048] Figure 4 This is a schematic diagram of the privacy data security acquisition process of the present invention. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. In the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0050] In the embodiment, see Figures 1 to 4 .

[0051] As attached Figure 1 The embodiment of the present invention proposes a secure sharing method for private data of connected vehicles, which is oriented to the private data of intelligent connected vehicles, protects data security through multi-layer AES encryption and hash functions, and uses the CP-ABKS algorithm combining CP-ABE (attribute-based encryption) and SE algorithm to implement fine-grained access control and keyword encryption search, thereby realizing secure sharing of private data in a distributed environment.

[0052] The AES encryption here is a conventional symmetric encryption algorithm, and its specific encryption operation process is not described in detail here.

[0053] It should be noted that the security sharing method is implemented by building a data security sharing model for intelligent connected vehicles, where the data sharing system architecture of the security sharing model is divided into three core components, such as Figure 2 As shown, including:

[0054] (1) IPFS distributed database, as the core storage component of the system, is mainly used to store encrypted data uploaded by the data uploader and feedback the content hash value corresponding to the data to support subsequent retrieval and access;

[0055] (2) Auxiliary database, used for fast permission verification and data retrieval, with content hash values ​​and keyword ciphertext stored internally;

[0056] (3) A third-party access server used to generate and distribute the public key, master key, and user private key of the CP-ABKS algorithm to perform key management.

[0057] At this point, a smart connected car data security sharing model can be built from privacy data uploading, encryption, storage, search, decryption to acquisition. Through the attribute-based encryption algorithm, the system can dynamically generate access keys according to the user's attribute set, and combined with the set access policy, accurate permission management can be achieved.

[0058] At the same time, the actual encrypted data content is stored in a decentralized file system such as IPFS, while other relevant information such as hash values, keywords, etc. are stored in a traditional auxiliary database. This not only takes advantage of the IPFS's tamper-proof and easy-to-verify characteristics to ensure data integrity, but also facilitates subsequent data retrieval process.

[0059] Compared with traditional role-based or static permission access control methods, this mechanism can dynamically adjust access rights according to users' real-time needs and attributes, effectively reducing the risk of unauthorized access to private data.

[0060] Furthermore, the present invention constructs a decentralized storage architecture by introducing the IPFS (InterPlanetary File System) distributed database. Compared with the traditional centralized system, the distributed database avoids the single point failure problem in the traditional centralized storage through data distribution and redundant storage between nodes. At the same time, the decentralized architecture can disperse the attack surface of data storage, significantly enhancing the system's defense capabilities against malicious attacks and data loss.

[0061] In addition, IPFS uses content addressing technology to generate a unique hash value, ensuring the accuracy of data positioning and the efficiency of retrieval, which is suitable for complex scenarios where multiple users access the data at the same time. Compared with traditional data storage and sharing solutions, the distributed architecture of the present invention is more flexible and scalable, and can adapt to the complex requirements of multi-modal and multi-source data in the vehicle-road-cloud integration and V2X communication environment, providing a forward-looking solution for data security management in the intelligent connected vehicle ecosystem.

[0062] In summary, the intelligent connected vehicle data security sharing model constructed based on the data sharing system of the intelligent connected vehicle, the specific use method of the model includes the following steps:

[0063] Step S100. Data upload, encryption and storage stage:

[0064] Step S110. The data uploader uses the AES algorithm to perform symmetric encryption on the original private data to generate data ciphertext. This encryption process is centered on the symmetric key to ensure the initial security of the private data.

[0065] Step S120. Upload the encrypted data ciphertext to the IPFS distributed database for storage, and obtain the corresponding content hash value (unique content storage value) from the database for subsequent data retrieval and positioning;

[0066] Step S130. The data uploader initiates a request through a third-party access server. When responding to the request, the server uses the CP-ABKS (Attribute-Based Searchable Encryption) algorithm to encrypt the operating system initialization operation, generate a public key and a master key, and then transmit the public key to the data uploader;

[0067] This CP-ABKS technology further supports keyword encrypted search functions, allowing data users to efficiently locate and obtain target data while ensuring privacy security. Therefore, the application of such fine-grained control technology has achieved the best balance between data privacy protection and sharing efficiency;

[0068] At this point, it can be further explained that the data uploader can also use the SHA256 hash algorithm to perform a hash operation on the original private data to generate a data hash value, which is stored as integrity verification information to facilitate verification of data consistency and integrity during subsequent data decryption;

[0069] Step S140. After the data uploader obtains the public key, the encryption process of the CP-ABKS algorithm is used to encrypt the AES algorithm encryption key and data retrieval keywords according to its access structure;

[0070] In addition, the following steps can be added:

[0071] The CP-ABKS attribute-based searchable algorithm is based on the combination of the CP-ABE algorithm and the SE algorithm. It consists of five polynomial time algorithms: system initialization (Setup), key generation (KeyGen), encryption (Encrypt), trapdoor generation (Trapdoor), and search (Search). Among them:

[0072] System initialization, which is used to define system public parameters and generate a master key, and use the master key and other system parameters to generate a public key;

[0073] Key generation, used to generate corresponding private keys for users or user groups based on user attribute sets using the master key;

[0074] Encryption, which is used to select the data to be encrypted and symmetrically encrypt the data and the selected keywords using the public key, and specify a set of access policies after encryption to define the holders of the target attribute combination who can decrypt the data;

[0075] Trapdoor generation, which is used to build a set of trapdoors using the user's private key. The trapdoors are used to allow the cloud server to check whether a file contains specified keywords without decrypting the actual content;

[0076] Search is used to find all matching records in the auxiliary database based on the trapdoors submitted by the user. At this time, by combining trapdoor generation with search, keyword search can be effectively supported even without exposing sensitive information.

[0077] Specifically, the third-party access server generates a public key and a master key using the system initialization Setup algorithm of the CP-ABKS attribute-based searchable algorithm, and transmits the public key to the data uploader. The data uploader uses the encryption Encrypt algorithm of the CP-ABKS attribute-based searchable algorithm and encrypts the AES encryption key and data retrieval keywords according to its access structure.

[0078] This operation is based on the matching conditions between the data access policy and the attribute set, laying the foundation for subsequent fine-grained access control. It not only enhances the security of data access, but also supports efficient encrypted search of data.

[0079] Finally, the data uploader uploads the generated IPFS content hash value, encryption key ciphertext, search keyword ciphertext and data hash value to the auxiliary database. The unified management and storage of this information provides efficient support for subsequent retrieval and verification of the data.

[0080] At this time, attach Figure 3 For data upload, the data is encrypted from AES to hash value generation, and then the key and keyword are encrypted through the CP-ABKS algorithm, finally completing the complete process of uploading and storing encrypted information;

[0081] Step S200. Data retrieval, decryption and acquisition phase:

[0082] Step S210. The data acquirer sends its own attribute set to the third-party access server, requesting to obtain the public key and personal private key required for data decryption;

[0083] At this time, the third-party access server uses the master key, the access policy set by the uploader, and the attribute set of the data acquirer to perform a key generation operation through the CP-ABKS algorithm to generate two sets of personal private keys that match the user's permissions and distribute them to the data acquirer;

[0084] Step S220. After receiving the private key, the data acquirer generates a keyword search trapdoor based on its own access needs, combining the acquired personal private key with the search keyword. The trapdoor is submitted to the auxiliary database as query information for locating the target data.

[0085] Step S230. The auxiliary database verifies the legitimacy of the retrieval trapdoor in combination with the stored access strategy. If the verification is successful, the auxiliary database returns the IPFS content hash value, data hash value and encryption key ciphertext that match the keyword;

[0086] Step S240. The data acquirer calls the query algorithm according to the IPFS content hash value returned from the auxiliary database to obtain the encrypted data ciphertext corresponding to the target data in the IPFS distributed database;

[0087] Step S250. After the ciphertext is obtained, the data acquirer uses the CP-ABE algorithm to decrypt the encryption key ciphertext returned by the auxiliary database, thereby recovering the AES encryption key, and uses the AES key to decrypt the ciphertext data to obtain the original private data;

[0088] In addition, it can be further explained that at this time, the data acquirer also needs to verify the consistency and integrity of the decrypted data by comparing the hash value calculated by the decrypted data with the data hash value returned by the auxiliary database. After the verification is passed, the data acquirer successfully obtains the private data and completes the secure access and use of the private data;

[0089] At this time, attach Figure 4 The retrieval and decryption process for data acquirers includes retrieval trap generation, legitimacy verification, IPFS ciphertext acquisition, and final data decryption and integrity verification.

[0090] In summary, the data security sharing method proposed in the present invention, through the organic combination of multi-layer AES encryption and hash functions, can build a comprehensive data protection system, thereby protecting the security of privacy data during the sharing process.

[0091] Specifically, multi-layer AES encryption not only protects the data itself, but also further encrypts keywords and key information in combination with access strategies, thereby providing multiple security protections during storage and sharing. At the same time, the data summary generated by the hash function (such as the conventional SHA256 hash algorithm function in the prior art) is used for data integrity verification, which can effectively detect and prevent data tampering and forgery during transmission or storage. This mechanism improves the credibility of data transmission and storage while protecting data privacy, which is significantly better than traditional single-layer encryption schemes.

[0092] In addition, the ciphertext policy attribute-based encryption algorithm is used to achieve fine-grained access control and permission management of data. A privacy data security sharing model suitable for distributed environments is also constructed, filling the relevant technical gap in this technical field and providing innovative solutions for data security management of intelligent connected vehicles.

[0093] Therefore, compared with the prior art (such as the existing patent publication number CN118250065A, a decentralized fine-grained police data access control method), this method innovatively combines the IPFS distributed database, multi-layer AES encryption and hash function, and CP-ABKS algorithm, avoiding the high computing overhead of blockchain technology in automobile data scenarios, and is more suitable for the complex requirements of multi-modal and multi-source data in intelligent connected vehicle scenarios. It also achieves efficient data management through lightweight distributed storage, supports fine-grained permission control and encrypted keyword search functions, and ensures a balance between privacy protection and real-time performance; in addition, for the dynamic data flow in the vehicle-road-cloud integration and V2X communication environment, it also optimizes permission management and data integrity verification, significantly enhancing the adaptability in the intelligent connected vehicle ecosystem, and providing a more efficient and secure solution for smart transportation and smart driving.

[0094] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0095] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0096] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any of the methods for securely sharing privacy data of connected vehicles in the above embodiments.

[0097] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

[0098] The embodiment of the present application also provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus.

[0099] Memory, used to store computer programs;

[0100] The processor is used to implement the above-mentioned method for securely sharing the privacy data of the connected car when executing the program stored in the memory.

[0101] The communication bus mentioned in the above electronic device may be a Peripheral Component Interconnect (PCI) bus or an Extended Industrial Standard Architecture (EISA) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc.

[0102] The communication interface is used for communication between the above electronic device and other devices.

[0103] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0104] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0105] It should also be noted that electronic devices also include terminal devices, which can also be called terminals, user equipment, mobile stations, mobile terminals, etc. Terminal devices can be mobile phones, smart TVs, wearable devices, tablet computers, computers with wireless transceiver functions, virtual reality terminal devices, augmented reality terminal devices, wireless terminals in industrial control, wireless terminals in unmanned driving, wireless terminals in remote surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc. The embodiments of this application do not limit the specific technology and specific device form used by the terminal devices.

[0106] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium (e.g., a solid-state drive SSD), etc.

[0107] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

[0108] In addition, it should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components in a certain specific posture. If the specific posture changes, the directional indication will also change accordingly.

[0109] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing in the full text includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or schemes that A and B meet at the same time. In addition, in the embodiments of the present invention, "multiple" refers to more than two. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

Claims

1. A method for securely sharing private data of connected vehicles, characterized in that: The following steps are performed based on the data sharing system architecture consisting of IPFS distributed database, auxiliary database and third-party access server: Step S100. The data uploader uses the AES algorithm and the CP-ABKS algorithm to encrypt the private data and set the data access policy. The encrypted ciphertext data is stored in the IPFS distributed database, and the encrypted other data information is stored in the auxiliary database. Step S200. The data acquirer uses a third-party access server to perform data retrieval in the auxiliary database in combination with its own access needs, and queries and decrypts the private data stored in the IPFS database based on the retrieval results.

2. The method for securely sharing private data of connected vehicles according to claim 1, characterized in that: The specific operation steps of encrypting the private data and setting the data access policy in step S100 include: Step S110. The data uploader uses the AES algorithm to perform symmetric encryption operations on the original private data to generate data ciphertext; Step S120. Upload the encrypted data ciphertext to the IPFS distributed database for storage, and obtain the corresponding content hash value from the database; Step S130. The data uploader initiates a request through a third-party access server. When responding to the request, the server uses the CP-ABKS algorithm to perform system initialization operations, generate a public key and a master key, and then transmits the public key to the data uploader; Step S140. After the data uploader obtains the public key, it uses the encryption process of the CP-ABKS algorithm to encrypt the AES algorithm encryption key and data retrieval keywords according to its access structure.

3. The method for securely sharing private data of a connected car as claimed in claim 2, characterized in that: The CP-ABKS algorithm in step S100 is based on the combination of the CP-ABE algorithm and the SE algorithm, and consists of five polynomial time algorithms: system initialization, key generation, encryption, trapdoor generation and search, where: System initialization, which is used to define system public parameters and generate a master key, and use the master key and other system parameters to generate a public key; Key generation, used to generate corresponding private keys for users or user groups based on user attribute sets using the master key; Encryption, which is used to select the data to be encrypted and symmetrically encrypt the data and the selected keywords using the public key, and specify a set of access policies after encryption to define the holders of the target attribute combination who can decrypt the data; Trapdoor generation, for constructing a set of trapdoors using the user's private key, wherein the trapdoors are used to allow the cloud server to check whether a file contains specified keywords without decrypting the actual content; Search, used to find all matching records in the auxiliary database based on the trapdoors submitted by the user.

4. The method for securely sharing private data of a connected car as claimed in claim 3, characterized in that: The IPFS content hash value, encryption key ciphertext, and keyword ciphertext generated in step S100 are uploaded to the auxiliary database by the data uploader to complete data storage.

5. The method for securely sharing private data of a connected car as claimed in claim 4, characterized in that: The specific operation process of step S200 includes: Step S210. The data acquirer sends its own attribute set to the third-party access server, requesting to obtain the public key and personal private key required for data decryption; Step S220. After receiving the private key, the data acquirer generates a keyword search trapdoor based on its own access needs, combining the acquired personal private key with the search keyword, and submits it to the auxiliary database for data search to locate the target data; Step S230. The auxiliary database verifies the legitimacy of the search trapdoor in combination with the stored access strategy. If the verification is successful, the auxiliary database returns the content hash value, data hash value and encryption key ciphertext that match the keyword; Step S240. The data acquirer calls the query algorithm according to the content hash value returned from the auxiliary database to obtain the encrypted data ciphertext corresponding to the target data in the IPFS distributed database; Step S250. After completing the ciphertext acquisition, the data acquirer uses the CP-ABE algorithm to decrypt the encryption key ciphertext returned by the auxiliary database, thereby recovering the AES encryption key, and uses the AES key to decrypt the ciphertext data to obtain the original private data.

6. The method for securely sharing private data of a connected car as claimed in claim 5, characterized in that: In step S210, the third-party access server uses the master key, the access policy set by the uploader, and the attribute set of the data acquirer to perform a key generation operation through the CP-ABKS algorithm to generate two sets of personal private keys that match the user's permissions and distribute them to the data acquirer.

7. The method for securely sharing private data of a connected car as claimed in claim 2, characterized in that: Also includes: Step L1. The data uploader uses the SHA256 hash algorithm to perform a hash operation on the original private data to generate a data hash value, which is stored in the auxiliary database as integrity verification information; Step L2. The data acquirer can verify the consistency and integrity of the decrypted data by comparing the hash value of the decrypted data with the hash value of the data returned by the auxiliary database. After the verification is passed, the data acquirer successfully obtains the private data.

8. The method for securely sharing private data of a connected car according to any one of claims 2 to 7, characterized in that: The data sharing system architecture consists of an IPFS distributed database, an auxiliary database, and a third-party access server, where: IPFS distributed database, used to store encrypted data uploaded by the data uploader and feedback the content hash value corresponding to the data; Auxiliary database, used for fast permission verification and data retrieval, with content hash values ​​and keyword ciphertext stored internally; A third-party access server is used to generate and distribute the public key, master key, and user private key of the CP-ABKS algorithm to perform key management.

9. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 8.

10. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 8.

Images