Medical data hierarchical sharing method based on block chain

Abstract

The invention discloses a medical data hierarchical sharing method based on a block chain, and the method comprises the steps: encrypting a file with a monotonic access structure according to different sensitivities, and transmitting a secret value of a secret message with low sensitiveness to a ciphertext with high sensitiveness through a method for transmitting and sharing the secret value upwards; in the data decryption stage, the highest-sensitivity file which can be met by a user is found through quick comparison and pre-decryption is carried out once, the sensitivity file in the file set can be decrypted more easily, access control is better carried out, the number of times of decryption in the medical data sharing process is effectively reduced, and the user experience is improved. And data sharing of multi-level attributes under the condition of ensuring privacy security is realized in a real sense.

Description

Technical Field

[0001] The present invention belongs to the technical field of data sharing, and more specifically, the present invention relates to a medical data hierarchical sharing method based on blockchain. Background Art

[0002] Medical data can help individuals better understand their physical condition, and also help medical staff to more effectively evaluate and diagnose patients' health conditions, so as to provide better medical decisions and treatment plans. Since medical data collection uses a large number of applications and a large amount of data is created every day, services for sharing and storing data are essential. At the same time, the sharing of medical data can also provide better collaboration and coordination. Medical staff can share and access patients' medical data to improve communication and coordination between medical teams.

[0003] The advent of cloud computing has made it easy to store and process a large amount of medical data. Cloud service providers (CSPs) provide infrastructure for processing and data storage at a certain cost. Such services reduce the cost of establishing and maintaining systems. Therefore, third-party storage and computing services are used. However, if medical data are generated and outsourced to cloud servers, patients do not own them, and they are accessed according to treatment needs in medical treatment, which makes integrity protection a challenging issue, especially in the case of medical accidents, medical institutions may cooperate with cloud servers to destroy outsourced medical data to cover up misdiagnosis. Beginning to link data access control with blockchain technology, and combining blockchain with data encryption, secure data sharing, transaction traceability, irreversible changes, non-repudiation and large-scale collaborative computing, as well as identity and data privacy protection can be achieved; due to its attractive characteristics, blockchain technology is seen as a powerful solution to solve the above difficulties in cloud-assisted medical systems.

[0004] In the existing medical data access process, most of the time only a single file with access rights is decrypted. When multiple files need to be accessed, they need to be accessed and decrypted one by one. Since permission verification is required for each access, the permission verification process is relatively complicated. Therefore, access permission verification often requires a lot of computing resources, and repeated ciphertext decryption calculations will bring huge storage and computing overhead to the device. Summary of the invention

[0005] The present invention provides a medical data hierarchical sharing method based on blockchain, aiming to improve the above problems.

[0006] The present invention is implemented as follows: a medical data hierarchical sharing method based on blockchain, the method is specifically as follows:

[0007] Data all users DOSet the Boolean attributes and weighted attributes of each file in the batch medical data F, sort the file permissions based on the Boolean attributes and weighted attributes of the files, build an access structure for each file in order from low to high file permissions, encrypt the corresponding files based on the access structure, and after all files in the batch medical data F are encrypted, generate an index of the batch medical data F, upload the index and encrypted batch medical data F to the cloud server for storage, and the cloud server returns the storage address to all data users U DO ;

[0008] Access to medical data: Data access user U DU Initiate a query request to the cloud server, the query request includes the requesting user U DU The cloud server pre-decrypts the requested batch medical data within the authority based on the received pre-decryption key TK and the batch medical data requested, obtains the pre-decrypted ciphertext of the medical data within the authority, and returns it to the data access user U DU ;Data access user U DU The pre-decrypted ciphertext of the authorized medical data is decrypted based on the private key to obtain the plaintext of the authorized medical data.

[0009] Furthermore, the process of obtaining the pre-decryption key TK is as follows:

[0010] The registered user sends a registration request to the blockchain, which carries the registered user's own weighted attribute S * and the Boolean attribute w * ;

[0011] The blockchain generates a pre-decryption key TK for each registered user = {L θ ,K 1 ,K 2}, and broadcast, where K 1 =g γ , K 2 =h β ;

[0012] Among them, Att θ,q Represents a blockchain node BN θ The qth Boolean attribute managed, u and h are random numbers in the system public parameter PP, β is the private key of the registered user, h is a random number, r θ,q For the Boolean attribute set A θ The qth Boolean attribute in q is selected as a random number and based on the random number r θ,q Calculation parameters ATT θ Att is the Boolean attribute of user U θ,q The summation result, Rθ r is the Boolean attribute of user U θ,q The summation result, parameter v γ The acquisition process is as follows:

[0013] Each node BN θ Pick a random number γ θ , calculate and broadcast the parameters and parameters Parameters parameter As a secret share, after a node receives the secret shares broadcast by more than k other nodes, each node obtains the parameter g using the Pedersen secret sharing protocol. γ and parameter v γ .

[0014] Furthermore, data access user U DU The specific process of determining the batch medical data within the authority is as follows:

[0015] Sort the files in the batch medical data F from small to large according to the corresponding values ​​of the weighted attributes. When the corresponding values ​​of the weighted attributes are the same, arrange the Boolean attributes contained in the HVE vectors of the files from small to large.

[0016] Based on the arrangement order of each file in the batch medical data F, a reverse traversal is performed to find the weighted attributes lower than the data access user U DU The maximum permission file of the weighted attribute of the user U is found, starting from the maximum permission file found. DU The Boolean attribute of the corresponding file is verified. If the verification is successful, the corresponding file and the files arranged in front of it have lower permissions than the file for user U. DU Batch medical data within the scope of authority.

[0017] Furthermore, the registered user sends a registration request to the blockchain, and the blockchain uses the registered user’s own weighted attribute S * Constructing weighted encoding of users It is the 0 code of the registered user U. 1 code for registered user U;

[0018] Data all users DO Construct weighted encoding of corresponding files based on weighted attributes of each file in uploaded batch medical data F The i-th file F i 0 encoding and 1 encoding;

[0019] User U DU 1 code 0 encoding with the file Make an intersection If the intersection does not contain the same elements, verify the weighted attribute Φ of the next file k-1 , if the intersection contains the same elements, it means that user U DU The weighted attribute permission of is greater than the weighted attribute of the corresponding file.

[0020] Furthermore, the registered user sends a registration request to the blockchain, and the blockchain constructs the user's Boolean attribute vector Ψ based on the registered user's own Boolean attributes U ={D 1 ,D 2 ,D′},D 1 = {Y j ,L j}, D 2 ={E j ,E' j}, D′={μ j =t j / r j ,μ′ j =h j / m j},

[0021]

[0022] Data all users DO Construct the Boolean attribute vector of the corresponding file based on the Boolean attribute of each file in the uploaded batch medical data F

[0023]

[0024] Calculate the verification value Δ=e(Γ ij ,E j )e(Γ' ij ,E' j ), if Δ is equal to 1, it means that there is x ij＝1 And y j =1, will replace The ciphertext CT i Middle C Λ , C' Λ With i Perform the calculation: Then verify C' Λ Does it contain H(m′ i ), if included, the verification passes.

[0025] Furthermore, the encryption process of the corresponding file based on the access structure is as follows:

[0026] Confirm file F iThe Boolean attribute set w' is obtained, the HVE vector corresponding to the Boolean attribute set w' is obtained, and the file F is constructed according to the LSSS encryption scheme. i The access structure P i , P i =(M,ρ), where M is a matrix with l rows and n columns, each row of the matrix M corresponds to an attribute in the attribute set, and ρ is the mapping function corresponding to the matrix. When j∈{1,2,...,l}, ρ(M j )∈w' j , where M j is the jth row in matrix M, w' j For file F i The j-th element in the HVE vector corresponding to the Boolean set of ;

[0027] UserU DO Generate a random vector ν = (s i ,y 2 ,...,y n ) T , where s is randomly selected i ,y 2 ,...,y n , Randomly taken from the field of integers of order p, s i is a randomly selected secret value for LSSS encryption, and for each row M of the access matrix j Calculate the shared share λ j =M j ·ν;

[0028] UserU DO Use the key and public parameters to query each file in the order of permissions from small to large i Encrypt the plaintext to generate the ciphertext CT i ={C,C 1 ,C 2 ,C 3,θ ,C x ,C' x ,C Θ ,C Λ ,C' Λ};

[0029] in, α*s represents the result of the bilinear mapping e between g and g i Power, C 1 =g c , C 2 =v c , Among them, ATT θ For file F i Contained Boolean attributes Att θ',q'The summation result, θ′ is the file F i The management node of each Boolean attribute of , q′ is the Boolean attribute set A of the corresponding Boolean attribute in the management node θ′ θ′ The sorting in C' x =g d , c and d are random numbers,

[0030] For each file F i , pick a random value Calculate C Λ =m i Z -b , C' Λ =H 1 (m i ), select the i-1th file F in the index array Index i-1 The secret value s i-1 ,calculate α*(s i +s i-1 ) power.

[0031] Furthermore, the index generation process of the batch medical data F is as follows:

[0032] The ciphertexts of all files form a ciphertext set CT, user U DO Generate the index of the ciphertext set CT kw is the keyword of the ciphertext.

[0033] Furthermore, data access user U DU The specific process of obtaining query request data is as follows:

[0034] Visit User U DU Generate search trap based on ciphertext keyword kw and private key SK

[0035] UserU DU Select the timestamp Time′ of the time when the search trap was generated and generate a search transaction in, sign′=Sign SK (ζ), User will search for transaction TX search Pack and upload to the blockchain for consensus, Sign SK (ζ) represents the adoption of user U DU The private key SK encrypts the parameter ζ;

[0036] The smart contract uses the ciphertext keyword kw to search and calculates the parameter ζ=VerifyPK (sign), parameter ζ′=H(H(T 0 )||Time′), if ζ=ζ′, then calculate the parameter if Then verify that e(Index,PK)=e(MSK,T 0 ), if the verification is successful, the storage address addr is returned to the user U DU ;

[0037] Among them, Verify PK (sign) indicates that the search transaction encrypted by the encryption function Sign is decrypted using the public key PK using the corresponding decryption function Verify. e(Index,PK) indicates that the mapping function in the bilinear mapping is used to map Index and PK. e(MSK,T 0 ) indicates the MSK, T 0 The mapping function in the bilinear mapping is used for mapping.

[0038] Furthermore, the pre-decryption process of the ciphertext is as follows:

[0039] For the ciphertext CT found i , the cloud server finds a set of constants Make λ j is the shared share of the access matrix row, and then calculates the ciphertext CT i The pre-decrypted ciphertext CT i ′:

[0040]

[0041] Furthermore, the pre-decrypted ciphertext CT i The decryption process of ′ is as follows:

[0042] UserU DU Use the private key SK to pre-decrypt the ciphertext CT i ′ is decrypted to get B i :

[0043]

[0044] Find the ciphertext CT of the previous ciphertext set i-1 , get B i-1 :

[0045]

[0046] Repeat the above steps, user U DU Get the data set {B 1 ,...,B i-1 ,Bi};

[0047] Plaintext data Get batch plaintext data F = {F 1 ,F 2 ,...,F i}.

[0048] The blockchain-based medical data hierarchical sharing method provided by the present invention has the following beneficial effects:

[0049] (1) Design a hierarchical access control method to integrate the ciphertext part of low-sensitivity files into high-sensitivity files, implement hierarchical access control of files, and reduce the decryption and verification computation costs;

[0050] (2) Based on 0-1 coding and HVE coding, a flexible access policy representation method is proposed. This method supports the expression and comparison of hidden attributes. Compared with the traditional attribute encryption method that needs to find a fixed constant to determine whether the access policy is met, this method can compare permissions without disclosing file and user attributes.

[0051] (3) Use blockchain nodes as attribute authorization agencies to realize key generation and attribute management and solve the single point failure problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of the partitioning of the access structure of the department to which the doctor belongs corresponding to the Boolean attribute provided in the embodiment of the present invention;

[0053] Figure 2 A flowchart of a blockchain-based medical data hierarchical sharing method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The specific implementation modes of the present invention are further explained in detail below by describing the embodiments with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0055] In order to facilitate the comparison of hidden attributes, the present invention divides the attributes of users in the medical data sharing system into weighted attributes and Boolean attributes. The weighted attribute is the position of the doctor in the department. The dean, department director, chief physician, deputy chief physician, attending physician, and nurse are represented by permissions 1-6 respectively. The Boolean attribute refers to the doctor's department, department information, etc. The specific access structure is divided as follows: Figure 1 shown.

[0056] (1) 0-1 encoding

[0057] Let s = s n sn-1 ...s 1 is a binary string of length n for a certain attribute dimension value. The encoding of 0 in s is defined as a set The 1 encoding of s is a set

[0058] For example, let x be 5 and y be 6. As shown in Table 1, the 1 code of x is taken from the binary string of x. Every time a '1' is taken, the string is added to the 1 code set of x. For example, if the binary of x is 011, the first 1 is "01", and the second 1 is "011". So far, all 1 codes have been taken, so the 1 code set of x is {01,011}. The 0 code of x is taken from the binary string. Every time the last "0" is taken, the "0" is flipped to "1", and then the string is added to the 0 code set. For example, in x, the first 0 is "0", and then the "0" is flipped to "1", so the 0 code is "1". Because there is only one 0 in 011, the 0 code set is {1}.

[0059] In the system, the user's weighted attributes are represented by 0-1 coding. When judging x < y, it is only necessary to judge whether at least one element in the set of x's 0 coding and y's 1 coding is the same, that is: As shown in Table 1, both contain the element "011", so it is concluded that x<y.

[0060]

[0061] Table 1 0-1 encoding of weighted attributes

[0062] (2) Hidden vector encryption;

[0063] Let vector x = {x 1 ,x 2 ,...,x l} is used for encryption, y={y 1 ,y 2 ,...,y l} is used for decryption. Decryption is determined to be possible if and only if the two vectors match, that is, the two vectors must have the same letters for each position. In this scheme, vector x represents the attribute set of the ciphertext policy, and vector y represents the attribute set of the private key. For these two vectors, if the attribute in U is contained in the corresponding attribute set of the vector, the value of the attribute at the corresponding position in the vector is 1. For example, the system global attributes are U = {A, B, C, D, E, F}, and the attribute set of the ciphertext policy is W = {A, C, F}, then the HVE vector of the policy is x = {1, 0, 1, 0, 0, 1}.

[0064] Since the access structure is a monotonic access structure, in the file sorting and comparison stage, we only need to compare the number of 1s in each file vector to sort the files on the user side. In the decryption matching stage, a conversion step is required during the comparison. As shown in Table 2, the attributes owned by the user are S = {A, B, C, F}, then the vector is y 1 ={1,1,1,0,0,1}, the private key satisfies However, since the vector y 1 does not match the vector x, so the HVE decryption does not work. In order to achieve correct decryption, we stipulate that when “(x) i =0 and (y 1 ) i =1”, y i Set to "0" to transform the vector into y 2 , and remain unchanged for other cases.

[0065] U A B C D E F x 1 0 1 0 0 1 <![CDATA[y 1 ]]> 1 1 1 0 0 1 <![CDATA[y 2 ]]> 1 0 1 0 0 1

[0066] Table 2 Decryption matching based on hidden vectors

[0067] Figure 2 A flowchart of a medical data hierarchical sharing method based on blockchain provided in an embodiment of the present invention, the method is specifically as follows:

[0068] (1) System initialization phase: The blockchain generates system parameters, and each node calculates the value of the corresponding attribute;

[0069] Blockchain with security as a parameter λ As input, select G and p-order prime number G T , g∈G is a generator, e:G×G→G T is a bilinear map, choose the hash function and H:{0,1} * →G, and random numbers g, h, u, v∈G, is the field of prime integers of order p, and G represents a group of order q.

[0070] All nodes randomly generate and broadcast a secret share α θ , the node receives the secret shares broadcast by more than k other nodes and uses the Pedersen secret sharing protocol to obtain the same shared secret parameters

[0071] There are l Boolean attributes in the medical system, which constitute the global attributes For the j-th Boolean attribute w in the global attribute W j , randomly select random numbers: Where j∈[1,l], traverses all Boolean attributes in the global attribute W, and forms the system public parameters based on random numbers Among them, e(g,g) α Represents g and the αth power of the result of the bilinear map e of g.

[0072] Calculate the master key parameters based on the random number: Z=e(g,g) z , build the master key based on the master key parameters Among them, g α Where α is a shared secret parameter and g is a random number.

[0073] There are n blockchain nodes in the medical system, including a master node and multiple slave nodes. Each slave blockchain node (referred to as slave node) manages at least one Boolean attribute in the global attribute W. Node BN θ Managed Boolean property set A θ ={Att θ,1 ,...,Att θ,q}, Att θ,q Represents a blockchain node BN θ The qth Boolean attribute managed by each node, where the Boolean attributes in each Boolean attribute set do not overlap, and a Boolean attribute can only be managed by one node. θ Input system public parameter PP, which is a Boolean attribute set A θ For each Boolean property in the And based on the random number r θ,q Calculation parameters Each node BN θ Pick a random number Calculate and broadcast parameters and parameters Parameters parameter As a secret share, after a node receives the secret shares broadcast by more than k other nodes, each node obtains the parameter g using the Pedersen secret sharing protocol. γ and parameter v γ ;

[0074] (2) User registration stage: the registered user key generates the pre-decryption key TK and the authority retrieval key K;

[0075] Registered user U enters his own weighted attribute S * and the Boolean attribute w * , public parameters PP, system master key MSK, blockchain calculates and broadcasts the key TK for pre-decryption generated for each user requesting registration = {L θ ,K1 ,K 2},in, K 1 =g γ , K 2 =h β ,h β β is the user's private key, h is a random number, ATT θ Att is the Boolean attribute of user U θ,q The summation result, R θ r is the Boolean attribute of user U θ,q Sum the results.

[0076] The main blockchain node (referred to as the main node) is based on the weighted attribute S of the registered user U * Generate 0-1 encoding of weighted attributes in, The 0 code of the registered user U is generated as follows: starting from the left side of the binary code of the weighted attribute, each time a "0" is obtained, the "0" is flipped to "1", and the string including all the previous codes (including the current flipped 1) is added to the 0 code set until the binary code traversal is completed; The 1 code of the registered user U is generated as follows: when a '1' is obtained from the left side of the binary code of the weighted attribute, the string including all the previous codes is added to the 1 code set of x (the subsequent 0-1 code value selection rule is as described above).

[0077] The master node is based on the user's own Boolean attribute w * Generate an l-bit HVE vector y∈{0,1} l , HVE vector generation rule: compare the user's existing Boolean attributes with the global Boolean attributes. If the user has the Boolean attribute, the element at the corresponding position in the HVE vector is set to 1, otherwise the element at the corresponding position in the HVE vector is set to 0. For the HVE vector y∈{0,1} l Each element y in j Randomly select a random number z j , choose a random number ε, And meet z is a random number, and the parameters are calculated separately: D 1 = {Y j ,L j}, D 2 ={E j ,E' j}, D′={μ j =t j / r j ,μ′ j =h j / mj}, and finally output Ψ U ={D 1 ,D 2 ,D′};

[0078]

[0079]

[0080] The blockchain will be used to pre-decrypt the key TK, the authority to retrieve the key K = {Φ U ,Ψ U}Return to registered user U.

[0081] Registered user U randomly selects a private key SK=β, And calculate the public key PK = g β , Generate a public-private key pair.

[0082] (3) Data owner U DO Sort the file permissions in the uploaded batch plaintext data;

[0083] When the data has user U DO (Patient) uploads batch plaintext data F = {F 1 ,F 2 ,F i ...,F k}, the batch plaintext data is the current medical data, and the Boolean attribute w' and the weighted attribute S' of the file access object are used to define the file attributes, so each file has a Boolean attribute and a weighted attribute.

[0084] File upload user U DO (one of the registered users U) for the i-th file F i The weighted attribute generation code in The 0 and 1 codes are for the i-th file respectively.

[0085] File upload user U DO Confirm file F i The Boolean attribute set w' is used to generate the l-bit HVE vector x for each file according to the global attribute W. i , for each element of the vector x ij , randomly selected generate

[0086]

[0087] Among them, when x ij =1, select a random number When xij =0, select a random number

[0088] UserU DO Using Φ i With x i Sort the file permissions in the file set, with files with smaller permissions at the front. Files with smaller weighted attribute values ​​and fewer Boolean attributes are considered to have smaller permissions. The sorting process is as follows: first sort based on the corresponding values ​​of the weighted attributes. When the corresponding values ​​of the weighted attributes are the same, sort based on the Boolean attributes.

[0089] Different filesΦ i of Other Files s of Perform intersection comparison, that is If there are no identical elements, then the next file's weighted attributes are verified. If there are identical elements at the same time, then the file's weighted attribute permissions are lower than other files, and the file is placed in front. Files with the same weighted attributes continue to compare Boolean attributes. When comparing Boolean attributes, the number of 1s in the HVE vector is counted. The fewer the number, the lower the permissions of the corresponding file, and it will be placed in front.

[0090] Generate an array J[k] by sorting the file IDs according to the permissions from low to high.

[0091] (4) Encrypt each file in turn based on the file permission sorting to form an index, upload the encrypted data and its index to the cloud server for storage, and the cloud server returns the data storage address addr;

[0092] Confirm file F i The Boolean attribute set w' is obtained, and then the HVE vector corresponding to the Boolean attribute set w' is obtained, and the file F is constructed according to the LSSS encryption scheme. i The access structure P i , P i =(M,ρ), where M is a matrix with l rows and n columns. Each row of the matrix M corresponds to an attribute in the attribute set, that is, there are l attributes in total. ρ is the mapping function corresponding to the matrix, which satisfies that when j∈{1,2,...,l}, ρ(M j )∈w' j , where M j is the jth row in matrix M, w' j For file F i The j-th element in the HVE vector corresponding to the Boolean attribute set of .

[0093] UserU DO Generate a random vector ν = (s i ,y2 ,...,y n ) T , where s is randomly selected i ,y 2 ,...,y n , Randomly taken from the field of integers of order p, s i is a randomly selected secret value for LSSS encryption, and for each row M of the access matrix j Calculate the shared share λ j =M j ·ν;

[0094] UserU DO Use the key and public parameters to query each file in the order of permissions from small to large i Encrypt the plaintext to generate the ciphertext CT i ={C,C 1 ,C 2 ,C 3,θ ,C x ,C' x ,C Θ ,C Λ ,C' Λ};

[0095] in, α*s represents the result of the bilinear mapping e between g and g i Power: security parameter for encrypted files, C 1 =g c , C 2 =v c , Among them, ATT θ For file F i Contained Boolean attributes Att θ',q' The summation result, θ′ is the file F i The management node of each Boolean attribute of , q′ is the Boolean attribute set A of the corresponding Boolean attribute in the management node θ′ θ′ The sorting in C' x =g d , where c and d are random numbers.

[0096] For each file F i , pick a random value Calculate C Λ =m i Z -b , C' Λ =H 1 (m i ), select the i-1th file F in the index array Indexi-1 The secret value s i-1 ,calculate α*(s i +s i-1 ) power.

[0097] The ciphertexts of all files form a ciphertext set CT, user U DO Generate the index of the ciphertext set CT kw is the keyword of the ciphertext, user U DO Upload the ciphertext set CT and its index Index to the cloud server for storage, and the cloud server returns the data storage address addr;

[0098] (5) The cloud server receives the access user U DU A query request is received, and a storage address of the data requested by the query request is determined;

[0099] Visit User U DU (Doctor) Generates a search trap based on the ciphertext keyword kw and the private key SK

[0100] UserU DU Select the timestamp Time′ of the time when the search trap was generated and generate a search transaction in, sign′=Sign SK (ζ), The user will then search for transaction TX search Pack and upload to the blockchain for consensus, Sign SK (ζ) represents the adoption of user U DU The parameter ζ is encrypted with the private key SK.

[0101] The smart contract uses the ciphertext keyword kw to search and calculates the parameter ζ=Verify PK (sign), parameter ζ′=H(H(T 0 )||Time′), if ζ=ζ′, then calculate the parameter if Then verify that e(Index,PK)=e(MSK,T 0 ), if the verification is successful, the storage address addr is returned to the user U DU , where Verify PK (sign) indicates that the search transaction encrypted by the encryption function Sign is decrypted using the public key PK using the corresponding decryption function Verify. e(Index,PK) indicates that the mapping function in the bilinear mapping is used to map Index and PK. e(MSK,T 0) indicates the MSK, T 0 The mapping function in the bilinear mapping is used for mapping.

[0102] (6) For visiting user U DU The requested data is pre-decrypted and the pre-decrypted ciphertext is returned to the accessing user U DU ;

[0103] UserU DU The pre-decryption key TK, the permission retrieval key RK and the storage address addr are sent to the cloud server.

[0104] The cloud server uses the permission retrieval key RK to search from the last digit in the order of the array J[k] to determine the user U DU Whether the attributes meet the criteria for accessing the access structure:

[0105] Assume that there is a ciphertext CT in the file set i , user U DU 1 code With each document holding 0 encoding Perform intersection comparison, that is If there are no identical elements, then continue to verify the weighted attributes of the next document. If there are identical elements at the same time, then it represents user U DU The weighted attribute permission of is greater than the corresponding file, and the Boolean attributes are compared.

[0106] When comparing Boolean attributes, we need to determine the file vector x i Whether the position corresponding to the user vector y needs to be converted, calculate the verification value Δ=e(Γ ij ,E j )e(Γ' ij ,E' j ), e(Γ ij ,E j ) represents the ij 、E j The mapping function in the bilinear mapping is used for mapping, e(Γ' ij ,E' j ) represents the ij , E' j Use the mapping function in the bilinear mapping for mapping. If Δ is equal to 1, it means that x exists. ij＝1 And y j =1, then it will replace The ciphertext CT i Middle C Λ , C' Λ With i Perform the calculation: e(X ij,Y j ) indicates that X ij , Y j The mapping function in the bilinear mapping is used for mapping, e(Q ij ,L j ) indicates the Q ij , L j Use the mapping function in the bilinear mapping to map, and then verify C' Λ Does it contain H(m′ i ), if it exists, the verification is successful, record the number of digits in the array as I=i, and find the ciphertext CT with an array number less than i n , n≤i, for the ciphertext CT found i , the cloud server finds a set of constants Make λ j is the shared share of the access matrix row, and then calculates the ciphertext CT i The pre-decrypted ciphertext CT i ′:

[0107]

[0108] The cloud server returns the pre-decryption result, ciphertext set, and array index to user U DU .

[0109] (7) For access user U DU Decrypt the returned pre-decrypted ciphertext in batches to obtain the corresponding plaintext data.

[0110] UserU DU Use the private key SK to pre-decrypt the ciphertext CT i ′ is decrypted to get B i :

[0111]

[0112] On this basis, if the user wants to obtain more data within the scope of authority, he can find the data CT before the ciphertext set according to the number of bits of the returned record array I=i i-1 , get the intermediate ciphertext B i-1 :

[0113]

[0114] Similarly, user U DU Finally, we can get the set {B 1 ,...,B i-1 ,B i}.

[0115] UserU DUYou can use simple calculations to get the final plaintext data

[0116] Repeat this step, the user can get the batch plaintext data F = {F 1 ,F 2 ,…,F i}.

[0117] The present invention encrypts files with monotonous access structures according to different sensitivities, and transfers the secret value of the low-sensitivity secret text to the high-sensitivity ciphertext by transferring the secret value upward for sharing; in the data decryption stage, after a quick comparison, the file with the highest sensitivity that the user can meet is found and a pre-decryption is performed, and the sensitive files in the file collection can be more easily decrypted, and access control is better performed, effectively reducing the number of decryption times in the medical data sharing process, and truly realizing data sharing with multi-level attributes under the condition of ensuring privacy and security.

[0118] The present invention has been described exemplarily. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A medical data hierarchical sharing method based on blockchain, characterized in that: The method is specifically as follows: Medical data upload: data owned by user U DO Set the Boolean attributes and weighted attributes of each file in the batch medical data F, sort the file permissions based on the Boolean attributes and weighted attributes of the files, build an access structure for each file in order from low to high file permissions, encrypt the corresponding files based on the access structure, and after all files in the batch medical data F are encrypted, generate an index of the batch medical data F, upload the index and encrypted batch medical data F to the cloud server for storage, and the cloud server returns the storage address to all data users U DO ; Access to medical data: Data access user U DU Initiate a query request to the cloud server, the query request includes the requesting user U DU The cloud server pre-decrypts the requested batch medical data within the authority based on the received pre-decryption key TK and the batch medical data requested, obtains the pre-decrypted ciphertext of the medical data within the authority, and returns it to the data access user U DU ;Data access user U DU The pre-decrypted ciphertext of the authorized medical data is decrypted based on the private key to obtain the plaintext of the authorized medical data.

2. The medical data hierarchical sharing method based on blockchain as claimed in claim 1, characterized in that: The process of obtaining the pre-decryption key TK is as follows: The registered user sends a registration request to the blockchain, which carries the registered user's own weighted attribute S * and the Boolean attribute w * ; The blockchain generates a pre-decryption key TK for each registered user = {L θ ,K1,K2}, and broadcast, where, K1=g γ , K2=h β ; Among them, ATT θ Att is the Boolean attribute of user U θ,q The summation result, R θ r is the Boolean attribute of user U θ,q The summation result, Att θ,q Represents a blockchain node BN θ The qth Boolean attribute managed, u and h are random numbers in the system public parameter PP, β is the private key of the registered user, h is a random number, r θ,q For the Boolean attribute set A θ The qth Boolean attribute in selects a random number and calculates the parameter Parameter v γ and g γ The acquisition process is as follows: Each node BN θ Pick a random number γ θ , calculate and broadcast the parameters and parameters Parameters parameter As a secret share, after a node receives the secret shares broadcast by more than k other nodes, each node obtains the parameter g using the Pedersen secret sharing protocol. γ and parameter v γ .

3. The medical data hierarchical sharing method based on blockchain as claimed in claim 1, characterized in that: Data access user U DU The specific process of determining the batch medical data within the authority is as follows: Sort the files in the batch medical data F from small to large according to the corresponding values ​​of the weighted attribute S, where S represents the weighted attribute of the current file. When the corresponding values ​​of the weighted attributes are the same, sort the Boolean attributes u' contained in the HVE vectors of the files from small to large, where u' is the Boolean attribute of the current file; Based on the arrangement order of each file in the batch medical data F, a reverse traversal is performed to find the weighted attributes lower than the data access user U DU The maximum permission file of the weighted attribute of the user U is found, starting from the maximum permission file found. DU The Boolean attribute of the corresponding file is verified. If the verification is successful, the corresponding file and the files arranged in front of it have lower permissions than the file for user U. DU Batch medical data within the scope of authority.

4. The medical data hierarchical sharing method based on blockchain as claimed in claim 3, characterized in that: The registered user sends a registration request to the blockchain, and the blockchain uses the registered user’s own weighted attribute S * Constructing weighted encoding of users It is the 0 code of the registered user U. 1 code for registered user U; Data all users DO Construct weighted encoding of corresponding files based on weighted attributes of each file in uploaded batch medical data F The i-th file F i 0 encoding and 1 encoding; User U DU 1 code 0 encoding with the file Make an intersection If the intersection does not contain the same elements, verify the weighted attribute Φ of the next file k-1 , if the intersection contains the same elements, it means that user U DU The weighted attribute permission of is greater than the weighted attribute of the corresponding file.

5. The medical data hierarchical sharing method based on blockchain as claimed in claim 3, characterized in that: The registered user sends a registration request to the blockchain, and the blockchain constructs the user's Boolean attribute vector Ψ based on the registered user's own Boolean attributes. U ={D1,D2,D′}, D1 = {Y j ,L j }, D2={E j ,E' j }, D′={μ j =t j / r j ,μ′ j h j / m j }, Data all users DO Construct the Boolean attribute vector of the corresponding file based on the Boolean attribute of each file in the uploaded batch medical data F Calculate the verification value Δ=e(Γ ij ,E j )e(Γ' ij ,E' j ), if Δ is equal to 1, it means that there is x ij＝1 And y j =1, will replace The ciphertext CT i Middle C Λ , C' Λ With ψ i Perform the calculation: Then verify C' Λ Does it contain H(m′ i ), if it is included, the verification passes.

6. The medical data hierarchical sharing method based on blockchain as claimed in claim 1, characterized in that: The encryption process of the corresponding file based on the access structure is as follows: Confirm file F i The Boolean attribute set w' is obtained, the HVE vector corresponding to the Boolean attribute set w' is obtained, and the file F is constructed according to the LSSS encryption scheme. i The access structure P i , P i =(M,ρ), where M is a matrix with l rows and n columns, each row of the matrix M corresponds to an attribute in the attribute set, and ρ is the mapping function corresponding to the matrix. When j∈{1,2,...,l}, ρ(M j )∈u' j , where M j is the jth row in matrix M, w' j For file F i The j-th element in the HVE vector corresponding to the Boolean set of ; UserU DO Generate a random vector ν = (s i ,y2,...,y n ) T , where s is randomly selected i ,y2,...,y n , Randomly taken from the field of integers of order p, s i is a randomly selected secret value for LSSS encryption, and for each row M of the access matrix j Calculate the shared share λ j =M j ·v; UserU DO Use the key and public parameters to query each file in the order of permissions from small to large i Encrypt the plaintext to generate the ciphertext CT i ={C,C1,C2,C 3,θ ,C x ,C' x ,C Θ ,C Λ ,C' Λ }; in, α*s represents the result of the bilinear mapping e between g and g i Power, C1 = g c , C2=v c , Among them, ATT θ For file F i Contained Boolean attributes The summation result, θ′ is the file F i The management node of each Boolean attribute of , q′ is the Boolean attribute set A of the corresponding Boolean attribute in the management node θ′ θ′ The sorting in C' x =g d , c and d are random numbers, For each file F i , pick a random value Calculate C Λ =m i Z -b , C' Λ =H1(m i ), select the i-1th file F in the index array Index i-1 The secret value s i-1 ,calculate α*(s i +s i-1 ) power.

7. The medical data hierarchical sharing method based on blockchain as claimed in claim 1, characterized in that: The index generation process of batch medical data F is as follows: The ciphertexts of all files form a ciphertext set CT, user U DO Generate the index of the ciphertext set CT kw is the keyword of the ciphertext.

8. The medical data hierarchical sharing method based on blockchain as claimed in claim 1, characterized in that: Data access user U DU The specific process of obtaining query request data is as follows: Visit User U DU Generate search trap based on ciphertext keyword kw and private key SK UserU DU Select the timestamp Time′ of the time when the search trap was generated and generate a search transaction in, User will search for transaction TX search Package and upload to the blockchain for consensus, Indicates that user U DU The private key SK pair parameters Encryption is performed; Smart contracts use the ciphertext keyword kw to search and calculate parameters parameter if Then calculate the parameters if Then verify e(Index,PK)=e(MSK,T0). If the verification passes, the storage address addr is returned to user U. DU ; Among them, Verify PK (sign) means using the public key PK to decrypt the search transaction encrypted by the encryption function Sign using the corresponding decryption function Verify. e(Index,PK) means mapping Index and PK using the mapping function in the bilinear mapping. e(MSK,T0) means mapping MSK and T0 using the mapping function in the bilinear mapping.

9. The medical data hierarchical sharing method based on blockchain as claimed in claim 1, characterized in that: The pre-decryption process of the ciphertext is as follows: For the ciphertext CT found i , the cloud server finds a set of constants Make λ j To access the shared share of the matrix row, the ciphertext CT is then calculated for the user i The pre-decrypted ciphertext CT i ′:

10. The method for hierarchical sharing of medical data based on blockchain as claimed in claim 9, characterized in that: Pre-decrypted ciphertext CT i The decryption process of ′ is as follows: UserU DU Use the private key SK to pre-decrypt the ciphertext CT i ′ is decrypted to get B i : Find the ciphertext CT of the previous ciphertext set i-1 , get B i-1 : Repeat the above steps, user U DU Get the data set {B1,...,B i-1 ,B i }; Plaintext data Get batch plaintext data F = {F1, F2, ..., F i }.

Images