Block chain-based distributed data sharing method, system and device and server

Abstract

The invention relates to the technical field of block chains, in particular to a block chain-based distributed data sharing method, system and device and a server, the method is applied to a block chain platform, and the method comprises the following steps: obtaining a data encryption application submitted by a data encryption user, receiving and storing an encryption strategy sent by the data encryption user based on the data encryption application, receiving a data decryption application submitted by the data reading user, and verifying whether the attribute of the data reading user meets a corresponding encryption strategy based on the data decryption application; if the attribute of the data reading user meets the encryption strategy, a decryption application event is triggered and broadcasted, an authority is indicated to generate an attribute key corresponding to the data decryption application, the attribute key is sent to the data reading user, and the data reading user decrypts the encrypted data according to the attribute key. By adopting the method, the behavior traceability is met, the decentralization degree of the system is improved, and distributed data sharing can be safely and efficiently realized among users.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a distributed data sharing method, system, device and server based on blockchain. Background Art

[0002] In the field of blockchain, the importance of data sharing is reflected in its promotion of transparency, trust and efficiency. The decentralized nature allows all parties to access and verify data equally, reducing information asymmetry and improving transaction efficiency. For example, in financial services and supply chain management, real-time sharing of data can accelerate decision-making and reduce costs.

[0003] However, distributed data sharing on blockchain also faces many risks. Among them, data privacy and security are key issues. Sensitive information may be at risk of leakage during sharing, and smart contracts and network attacks may cause data to be tampered with or lost.

[0004] In view of this, in a decentralized scenario with the participation of multiple parties, how to ensure the security of data and ensure that users can share distributed data safely and efficiently is an issue that needs to be urgently addressed. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a distributed data sharing method, system, device and server based on blockchain, which can ensure the security of data in a decentralized scenario with the participation of multiple parties and realize distributed data sharing among users safely and efficiently.

[0006] A first aspect of an embodiment of the present application provides a distributed data sharing method based on blockchain, which is applied to a blockchain platform. The method includes:

[0007] Obtaining a data encryption application submitted by a data encryption user calling a smart contract, receiving and storing an encryption policy sent by the data encryption user based on the data encryption application, wherein the encryption policy is constructed by the data encryption user based on the attributes in the attribute set on the blockchain platform, and the encryption policy is used by the data encryption user to encrypt the original data;

[0008] Receive a data decryption application submitted by a data reader calling a smart contract, and verify whether the attributes of the data reader satisfy the encryption policy based on the data decryption application;

[0009] If the attributes of the data reading user meet the encryption policy, a decryption application event is triggered and broadcast. The decryption application event is used to instruct the authority to generate an attribute key corresponding to the data decryption application and send the attribute key to the data reading user so that the data reading user can decrypt the encrypted data according to the attribute key.

[0010] In a possible implementation manner of the first aspect, before receiving and storing the encryption policy sent by the data encryption user based on the data encryption application, the method further includes:

[0011] Based on the data encryption application, verify the legitimacy of the data encryption user identity;

[0012] If the identity of the data encryption user is legal, the data encryption user is allowed to read the attribute set on the blockchain platform.

[0013] In a possible implementation manner of the first aspect, before obtaining the data encryption application submitted by the data encryption user calling the smart contract, the method further includes:

[0014] Obtaining a registration application and an institution public key submitted by an authority, wherein the registration application is used to register attributes supported by the authority;

[0015] The registration application is reviewed, and if the review is passed, the attributes supported by the authoritative organization and their corresponding organization public keys are stored.

[0016] In a possible implementation manner of the first aspect, before obtaining the data encryption application submitted by the data encryption user calling the smart contract, the method further includes:

[0017] Obtaining the attribute application submitted by the user by calling the smart contract, wherein the attribute application is used to apply to the authority for the attributes required by the user;

[0018] Trigger and broadcast a user attribute application event, wherein the user attribute application event is used to instruct an authority to review and approve the attribute application and to provide feedback on the review and approval result;

[0019] Receiving the attribute application approval result fed back by the authority based on the user attribute application event;

[0020] The attribute status of the user on the blockchain platform is updated according to the approval result.

[0021] In a possible implementation manner of the first aspect, the user attribute application event includes an organization identifier of an authority, a user address of the user, and an applied attribute list; and the authority approves the attribute application, including:

[0022] Verify whether the user address matches the user public key of the user;

[0023] If the user address matches the user public key of the user, the attribute application is approved;

[0024] Alternatively, if the user address matches the user public key of the user, verify whether the user is a user supported by the service;

[0025] If the user is a user supported by the service, the attribute application is approved.

[0026] In a possible implementation of the first aspect, the decryption application event is also used to instruct the authority to obtain the user public key of the data reader from the blockchain platform before sending the attribute key to the data reader, encrypt the attribute key according to the user public key, and send the encrypted attribute key to the data reader.

[0027] In the embodiment of the present application, in a decentralized scenario involving multiple parties, attributes and encryption strategies are uploaded to the chain, and the blockchain platform verifies the decryption authority of the data reader on the chain. This not only ensures the transparency and non-tamperability of the data and guarantees the security of the data, but also the user submits a data encryption application or a data decryption application to the blockchain platform by calling a smart contract. The distribution of attribute keys by the authority depends on the blockchain platform broadcasting the decryption application event, which can not only meet the traceability of behavior, and any participant can verify the fairness of data access control, but also greatly limits the rights of the authority and improves the degree of decentralization of the system, thereby ensuring that distributed data sharing can be achieved safely and efficiently among users.

[0028] A second aspect of an embodiment of the present application provides a distributed data sharing device based on blockchain, which is applied to a blockchain platform, and the device includes:

[0029] An encryption application processing unit, used to obtain a data encryption application submitted by a data encryption user calling a smart contract, receive and store an encryption policy sent by the data encryption user based on the data encryption application, wherein the encryption policy is constructed by the data encryption user based on the attributes in the attribute set on the blockchain platform, and the encryption policy is used by the data encryption user to encrypt the original data;

[0030] A decryption application processing unit, used to receive a data decryption application submitted by a data reader calling a smart contract, and verify whether the attributes of the data reader meet the encryption policy based on the data decryption application;

[0031] A data sharing unit is used to trigger and broadcast a decryption application event if the attributes of the data reading user meet the encryption policy. The decryption application event is used to instruct an authority to generate an attribute key corresponding to the data decryption application and send the attribute key to the data reading user so that the data reading user can decrypt the encrypted data according to the attribute key.

[0032] A third aspect of the embodiments of the present application provides a distributed data sharing system based on blockchain, the system comprising a data encryption user, a data reading user, an authority, and a blockchain platform, wherein:

[0033] The data encryption user is used to call the smart contract to submit a data encryption application to the blockchain platform; an encryption strategy is constructed based on the attributes in the attribute set on the blockchain platform, the encryption strategy is used to encrypt the original data, and the encryption strategy is sent to the blockchain platform;

[0034] The blockchain platform is used to obtain the data encryption application, receive and store the encryption policy sent by the data encryption user based on the data encryption application;

[0035] The data reading user is used to send a decryption application to the blockchain platform;

[0036] The blockchain platform is also used to receive a data decryption application submitted by a data reading user calling a smart contract, and based on the data decryption application, verify whether the attributes of the data reading user meet the encryption policy; if the attributes of the data reading user meet the encryption policy, trigger and broadcast a decryption application event;

[0037] The authority is used to monitor the decryption application event, and after monitoring the decryption application event, generates an attribute key corresponding to the data decryption application, and sends the attribute key to the data reading user;

[0038] The data reading user is also used to decrypt the encrypted data according to the attribute key.

[0039] The fourth aspect of an embodiment of the present application provides a server, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the steps of the distributed data sharing method based on blockchain provided in the first aspect of the embodiment of the present application are implemented.

[0040] The fifth aspect of the embodiments of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the blockchain-based distributed data sharing method provided in the first aspect of the embodiments of the present application.

[0041] The sixth aspect of the embodiments of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device executes the steps of the blockchain-based distributed data sharing method described in the first aspect of the embodiments of the present application.

[0042] It can be understood that the beneficial effects of the second to sixth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0044] Figure 1.1 This is a system architecture diagram of a distributed data sharing system based on blockchain provided in an embodiment of the present application;

[0045] Figure 1.2 This is another system architecture diagram of a distributed data sharing system based on blockchain provided in an embodiment of the present application;

[0046] Figure 2 This is a flowchart of an implementation of a distributed data sharing method based on blockchain provided in an embodiment of the present application;

[0047] Figure 3 It is a specific implementation flow chart of a blockchain platform processing an authoritative institution registration application in a distributed data sharing method based on blockchain provided in an embodiment of the present application;

[0048] Figure 4 It is a specific implementation flow chart of a blockchain platform processing a user attribute application in a distributed data sharing method based on blockchain provided in an embodiment of the present application;

[0049] Figure 5 This is a schematic diagram of an application scenario of a distributed data sharing method based on blockchain provided in an embodiment of the present application;

[0050] Figure 6 This is a structural block diagram of a distributed data sharing device based on blockchain provided in an embodiment of the present application;

[0051] Figure 7 A schematic diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0053] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0054] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0055] It should be understood that each method embodiment of the present application provides a distributed data sharing method based on blockchain, which is applicable to various types of terminal devices or servers that need to perform distributed data sharing, including mobile phones, tablet computers, wearable devices, laptops, ultra-mobile personal computers (UMPC), desktop computers and other terminal devices. The embodiments of the present application do not impose any restrictions on the specific types of terminal devices and servers.

[0056] In order to illustrate the technical solution described in this application, a specific embodiment is provided below for illustration.

[0057] Figure 1.1 and Figure 1.2 A system architecture diagram of a distributed data sharing system based on blockchain provided in an embodiment of the present application is shown, which is described in detail as follows: For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0058] Reference Figure 1.1 The distributed data sharing system based on blockchain includes a data encryption user 1, a blockchain platform 2, a data reading user 3 and an authority 4, wherein:

[0059] Data encryption user 1 is used to call the smart contract to submit a data encryption application to the blockchain platform 2; an encryption strategy is constructed based on the attributes in the attribute set on the blockchain platform 2, and the encryption strategy is used to encrypt the original data, and the encryption strategy is sent to the blockchain platform 2.

[0060] The blockchain platform 2 is used to obtain the data encryption application, receive and store the encryption policy sent by the data encryption user 1 based on the data encryption application.

[0061] Data reading user 3 is used to send a decryption request to the blockchain platform 2.

[0062] The blockchain platform 2 is also used to receive a data decryption application submitted by a data reading user calling a smart contract, and based on the data decryption application, verify whether the attributes of the data reading user 3 meet the encryption policy; if the attributes of the data reading user 3 meet the encryption policy, the decryption application event is triggered and broadcast.

[0063] The authority 4 is used to monitor the decryption application event. When the decryption application event is monitored, it generates an attribute key corresponding to the data decryption application and sends the attribute key to the data reading user 3;

[0064] The data reading user 3 is also used to decrypt the encrypted data according to the attribute key.

[0065] Data encryption user 1 and data reading user 3 refer to any entity that can interact with the blockchain, including individual users, organizations, servers, and mobile devices. Data encryption user 1 can select any set of attributes published by an authority 4 on the blockchain platform 2 and encrypt data using any Boolean formula. The above mobile devices include but are not limited to mobile phones, notebooks, tablet computers and other terminal devices with communication capabilities.

[0066] Blockchain Platform 2 is a virtual network consisting of distributed nodes, which can be physical servers, personal computers or other devices.

[0067] Authority 4 refers to an organization or entity responsible for verifying, certifying or supervising certain operations, such as a regulatory body, certification body or an organization with specific authority.

[0068] like Figure 1.2 As shown, there may be more than one authority 4. The embodiment of the present application does not impose any restrictions on the number of data encryption users 1, data reading users 3 and authority 4.

[0069] In the embodiment of the present application, attribute-based access control is implemented based on the decentralized ciphertext policy attribute-based encryption CP-ABE (Ciphertext-Policy Attribute-Based Encryption, CP-ABE) system. In the system initialization phase, global parameters (GP) are generated. These parameters include public parameters for encryption and decryption, and the blockchain smart contract is initialized using the parameters. All participants (including multiple institutions and users) can access the global parameters (GP) by accessing the smart contract. The smart contract is deployed with an attribute encryption contract. The global parameters (GP) are used as public global parameters of the attribute encryption system for all subsequent encryption and decryption processes. By utilizing the transparency of the blockchain and the distributed decentralized attribute encryption technology (Decentralized Attribute-Based Encryption, DABE), fine-grained control of data under cross-institutional and multi-authority management is achieved to ensure secure data sharing.

[0070] As a possible implementation method of the present application, the authority 4 generates its own key pair during the system initialization phase: an institution public key and a secret key. The institution public key is used for identity authentication when the authority registers with the blockchain platform, and the secret key is used by the authority 4 to generate the attribute key of the data reading user 3. The authority 4 submits a registration application and the institution public key to the blockchain platform 2 to register the supported attributes, wherein the registration application carries a list of supported attributes. The institution public key is used by the blockchain platform 2 to verify the identity of the authority 4, to ensure that the institution is indeed what it claims to be, and can reliably manage and issue the corresponding attributes and certificates, which helps to establish a trust mechanism and prevent forgery and fraud. When the blockchain platform 2 passes the review of the authority 4, the attributes supported by the authority 4 and their corresponding institution public keys are stored.

[0071] The data decryption application submitted by the data reader 3 to the blockchain platform 2 includes the GID (Global Identifier) ​​of the data reader 3, the attributes requested for access, and possible other verification information. When the authority 4 listens to the decryption application event broadcast by the blockchain platform 2, the authority 4 will generate an attribute key corresponding to the GID and the attribute based on the GID of the data reader 3, the attributes requested for access, and the authority's own secret key. The attribute key is used by the data reader 3 to decrypt the encrypted data, and the attribute key is bound to the GID of the data reader 3. When the encryption policy involves multiple attribute keys, the data reader 3 needs to obtain multiple attribute keys that meet the encryption policy before it can decrypt the encrypted data.

[0072] In this embodiment, the authority 4 can be added dynamically, and the attributes it supports and the public key of the organization need to be stored on the chain. Any party may become an authority 4. If any party wants to become an authority 4, it needs to submit a registration application and the public key of the organization to the blockchain platform 2. After passing the review of the blockchain platform 2, the registration can be completed and the role of the authority 4 can be assumed.

[0073] In a possible implementation, the data encryption user 1 is also used to read the attribute set on the blockchain platform 2, which includes the supported attributes registered by the authority 4 on the blockchain platform 2. The data encryption user 1 builds an encryption strategy based on the attributes in the attribute set, and uses the encryption strategy to encrypt the original data to obtain encrypted data. The data encryption user 1 is also used to send the encryption strategy to the blockchain platform 2, and the blockchain platform 2 verifies the decryption authority of the data reading user 3 based on the encryption strategy.

[0074] In some embodiments, the data encryption user 1 is also used to upload the encrypted data to the blockchain platform 2, so that the data reading user 3 whose decryption authority has been verified can directly obtain the encrypted data from the blockchain platform 2.

[0075] In other embodiments, the data encryption user 1 is also used to upload the hash value of the encrypted data to the blockchain platform 2, and store the encrypted data in other file systems, for example, based on the InterPlanetary FileSystem (IPFS) to store the encrypted data. The data reading user 3 whose decryption authority has been verified reads the hash value of the encrypted data from the blockchain platform 2, and based on the hash value, obtains the corresponding encrypted data from other file systems.

[0076] As a possible implementation method of the present application, the user submits an attribute application to the blockchain platform 2 by calling a smart contract. The attribute application includes a list of attributes applied for. The blockchain platform 2 triggers and broadcasts a user attribute application event. The user attribute application event includes the attribute application. When the authority 4 monitors the user attribute application event, it approves the attribute application and feeds back the approval result to the blockchain platform 2. The blockchain platform 2 updates the attribute status of the user on the blockchain platform 2 according to the approval result. The attribute status is recorded in the smart contract to identify the attributes that the user has obtained approval for. The user also queries the owned attributes on the smart contract. If the approval result is approval, the blockchain platform 2 is also used to update the attribute status of the user on the blockchain platform 2 to the attributes that the user has obtained approval for. If the approval result is approval failure, the blockchain platform 2 is also used to update the attribute status of the user on the blockchain platform 2 to null. The user can be a data encryption user 1 or a data reading user 3. This embodiment does not limit the type of user who submits the attribute application. For the data reading user 3, only if the attribute application is approved can it obtain the attribute key corresponding to the attribute to decrypt the corresponding encrypted data.

[0077] In the embodiment of the present application, the user applies for attributes from the authority 4 through the blockchain platform 2, and the authority 4 enables the blockchain platform 2 to implement attribute-based access control by registering the public key and related attributes on the blockchain platform 2. Different users can access different levels of data according to the attributes and permissions they hold.

[0078] As a possible implementation mode of the present application, the user attribute application event includes the organization identification of the authority 4, the user address of the user and the applied attribute list, and the authority 4 is also used to verify whether the user address matches the user public key of the user; if the user address matches the user public key of the user, the attribute application is approved; if the user address does not match the user public key of the user, the attribute application is not approved.

[0079] As a possible implementation mode of the present application, the authority 4 is also used to verify whether the user address matches the user public key of the user; if the user address matches the user public key of the user, verify whether the user is a user supported by the business; if the user is a user supported by the business, the attribute application is approved.

[0080] In this embodiment, after the user submits an attribute application to the blockchain platform 2, even if the authority 4 approves it, the authority 4 does not send the attribute key to the user. Instead, when the user (data reading user 3) submits a data decryption application to the blockchain platform 2, when the blockchain platform 2 verifies that the user's attributes meet the corresponding encryption policy and the user does have the decryption authority, the authority 4 issues the attribute key to the user through a secure channel. After verifying the user's decryption authority on the chain, the authority 4 issues the corresponding attribute key to the user, which not only makes the behavior traceable, but also helps to ensure the security of data sharing, ensuring that distributed data sharing can be achieved safely and efficiently among users.

[0081] In a possible implementation, when there is more than one authority 4, the user carries an institution ID in the attribute application submitted to the blockchain platform 2 by calling a smart contract, which is used to indicate the authority 4 for approval, and the blockchain platform 2 triggers and broadcasts the user attribute application event. The authority 4 is also used to approve the user's attribute application when it monitors that the institution ID in the user attribute application event is its own ID, and feedback the approval result. In this embodiment, the user can select the authority 4 according to the needs, and the attribute application submitted by the user indicates the attributes to be applied for and the institution ID, so that the corresponding authority 4 can quickly approve the user's attribute application when it monitors the user attribute application event.

[0082] In another possible implementation, when there is more than one authority 4, each authority 4 supports different attributes. The user submits an attribute application to the blockchain platform 2 by calling a smart contract, and the blockchain platform 2 triggers and broadcasts a user attribute application event. The authority 4 is also used to monitor the user attribute application event and determine whether it supports the attributes in the user attribute list according to the attribute type in the user attribute application event. If supported, the attribute application of the user is approved and the approval result is fed back. In this embodiment, the user does not need to specify the ID of the authority 4, and the authority 4 itself determines whether it supports the attributes applied by the user in the user attribute application event.

[0083] As a possible implementation method of the present application, when there is more than one authority 4, the data encryption user 1 can simultaneously construct a joint encryption strategy based on the attributes supported by different authority 4, for example, a joint encryption strategy can be constructed based on the first attribute supported by the first authority and the second attribute supported by the second authority, and then the joint encryption strategy is used to encrypt the original data. In this case, if the data reading user 3 wants to decrypt the encrypted data encrypted by the joint encryption strategy, it is necessary to apply to the first authority for the first attribute key corresponding to the first attribute and to the second authority for the second attribute key corresponding to the second attribute through the blockchain platform 2. The data reading user 3 can only effectively decrypt the above encrypted data after obtaining the first attribute key and the second attribute key.

[0084] In some implementations, after completing the attribute application, the data reader 3 actively establishes a connection with the authority 4, and the authority 4 sends the attribute key to the data reader 3 based on the connection.

[0085] In a possible implementation, the authority 4 is also used to obtain the user public key of the data reading user 3 from the blockchain platform 2, encrypt the attribute key according to the user public key, and send the encrypted attribute key to the data reading user 3.

[0086] In the embodiment of the present application, in a decentralized scenario with the participation of multiple parties, the attributes and encryption strategies are uploaded to the chain, and the blockchain platform 2 verifies the decryption authority of the data reading user 3 on the chain. This not only ensures the transparency and non-tamperability of the data and guarantees the security of the data, but also the user submits a data encryption application or a data decryption application to the blockchain platform 2 by calling a smart contract. The distribution of attribute keys by the authority 4 depends on the blockchain platform 2 broadcasting the decryption application event, which can satisfy the traceability of behavior and any participant can verify the fairness of data access control. It also greatly limits the rights of the authority 4 and improves the degree of decentralization of the system, thereby ensuring that distributed data sharing can be achieved safely and efficiently among users.

[0087] Figure 2 The implementation process of the distributed data sharing method based on blockchain provided by the embodiment of the present application is shown. The execution end of the embodiment of the present application is a blockchain platform. The method flow may include the following steps S201 to S203. The specific implementation principle of each step is as follows:

[0088] Step S201: Obtain a data encryption application submitted by a data encryption user calling a smart contract, and receive and store an encryption policy sent by the data encryption user based on the data encryption application.

[0089] The encryption strategy is constructed by the data encryption user based on the attributes in the attribute set on the blockchain platform, and the encryption strategy is used by the data encryption user to encrypt the original data.

[0090] In the embodiment of the present application, the data encryption user calls the smart contract to submit a data encryption application to the blockchain platform, reads the attribute set from the blockchain platform, builds an encryption strategy based on the attributes in the attribute set, and encrypts the original data according to the encryption strategy to obtain encrypted data. As the owner of the original data, the data encryption user encrypts the original data to limit the range of users who can share the original data. The data encryption user also submits the encryption strategy to the blockchain platform, and the blockchain platform also receives and stores the encryption strategy sent by the data encryption user based on the data encryption application, so as to facilitate the blockchain platform to conduct permission review on data reading users who want to share the encrypted data.

[0091] In some possible implementations, before receiving and storing the encryption policy sent by the data encryption user based on the data encryption application, the blockchain platform verifies the legitimacy of the data encryption user's identity based on the data encryption application; if the data encryption user's identity is legitimate, the data encryption user is allowed to read the attribute set on the blockchain platform. In this embodiment, before the data encryption user operates on the chain, it is necessary to provide identity information to the blockchain platform for verification, and the data encryption user is authenticated by the blockchain platform to ensure the legitimacy of its encryption authority. The blockchain platform can verify the legitimacy of the data encryption user's identity based on the relevant identity authentication mechanism on the chain. When the identity legitimacy verification is passed, the blockchain platform marks the identity status of the data encryption user as legitimate, and allows the data encryption user to read the attribute set on the chain. Through identity legitimacy verification, it can be ensured that only legitimate users can perform data encryption operations, thereby reducing the risk of data leakage or abuse and ensuring data security.

[0092] As a possible implementation of this application, Figure 3 The following is a specific implementation process of the blockchain platform processing the registration application of the authoritative institution in the distributed data sharing method based on blockchain provided in the embodiment of the present application, which is described in detail as follows:

[0093] A1: Obtain a registration application and an institution public key submitted by an authority, wherein the registration application is used to register the attributes supported by the authority. The institution public key is a public key in a key pair generated locally by the authority.

[0094] Any party on the blockchain platform can apply to become an authority. The authority needs to generate attribute keys corresponding to the attributes locally. The attribute keys include the institution's public key and the attribute key. Submit a registration application and the institution's public key to the blockchain platform. The registration application carries a list of supported attributes. The supported attributes are registered on the blockchain platform. The blockchain platform verifies the identity of the authority based on the institution's public key. There can be multiple authorities on the blockchain platform, and different authorities support different attributes.

[0095] A2: Review the registration application. If the application passes the review, store the attributes supported by the authority and their corresponding public keys.

[0096] The blockchain platform reviews the registration application of the authority based on the institution’s public key to ensure that the institution is indeed what it claims to be and can reliably manage and issue the corresponding attributes and certificates.

[0097] Institutional public keys can be used by smart contracts to verify and process operations related to specific attributes, thereby enhancing the flexibility and functionality of the contract.

[0098] In this embodiment, the registration application of the authoritative agency is reviewed through the blockchain platform, and the registration application with attributes that can be supported by the valid authoritative agency is completed, effectively building a trusted data sharing and access control mechanism.

[0099] As a possible implementation of this application, Figure 4 A specific implementation process of the blockchain platform processing user attribute application in the distributed data sharing method based on blockchain provided in the embodiment of the present application is shown, and the details are as follows:

[0100] B1: Obtain the attribute application submitted by the user by calling the smart contract, and the attribute application is used to apply to the authority for the attributes required by the user. The user is a data encryption user or a data reading user.

[0101] B2: triggering and broadcasting a user attribute application event, wherein the user attribute application event is used to instruct an authority to review and approve the attribute application and to feed back the review and approval result.

[0102] The user attribute application event includes the organization identification of the authority, the user address of the user, and the attribute list applied for. The authority approves the attribute application, including: verifying whether the user address matches the user public key of the user; if the user address matches the user public key of the user, the attribute application is approved; or, if the user address matches the user public key of the user, verifying whether the user is a user supported by the service; if the user is a user supported by the service, the attribute application is approved.

[0103] B3: receiving the attribute application approval result fed back by the authority based on the user attribute application event.

[0104] B4: Update the attribute status of the user on the blockchain platform according to the approval result.

[0105] After monitoring the user attribute application event related to itself, the authority will review and approve the user's attribute application and verify the user's identity. Once approved, the user's identity can be associated with the applied attributes, and the approval result can be notified to the blockchain platform. The blockchain platform updates the user's attribute status on the blockchain platform based on the approval result and records the user's attributes in the smart contract.

[0106] In the embodiment of the present application, the authority submits a registration application to the blockchain platform, and the user submits an attribute application to the blockchain platform. All parties only need to interact with the blockchain platform, which can make the behavior traceable and help improve the security of data sharing.

[0107] Step S202: receiving a data decryption application submitted by a data reader calling a smart contract, and based on the data decryption application, verifying whether the attributes of the data reader meet the encryption policy.

[0108] In the embodiment of the present application, the blockchain platform stores the encryption policy uploaded by the data encryption user, verifies whether the attributes of the data reading user meet the encryption policy, that is, determines whether the attributes of the data reading user are the same as the attributes corresponding to the encryption policy. If they are not the same, the attributes of the data reading user do not meet the encryption policy, and the data reading user does not have the data decryption authority.

[0109] Step S203: If the attributes of the data reading user meet the encryption policy, a decryption application event is triggered and broadcast. The decryption application event is used to instruct the authority to generate an attribute key corresponding to the data decryption application and send the attribute key to the data reading user so that the data reading user can decrypt the encrypted data according to the attribute key.

[0110] The encrypted data is obtained by the data encryption user after encrypting the original data according to the encryption policy.

[0111] In this embodiment, the blockchain platform does not store attribute keys. When the blockchain platform verifies that the attributes of the data reading user meet the encryption policy on the blockchain platform, a decryption application event is triggered and broadcast. When the authority monitors a decryption application event related to itself, the corresponding attribute key is sent to the data reading user through a secure channel, so that the data reading user decrypts the encrypted data according to the attribute key. Among them, related to itself means that the attributes associated in the decryption application event are attributes supported by the authority itself.

[0112] As a possible implementation of the present application, the decryption application event is also used to instruct the authority to obtain the user public key of the data reader from the blockchain platform before sending the attribute key to the data reader, encrypt the attribute key according to the user public key, and send the encrypted attribute key to the data reader.

[0113] In a possible implementation, the data reader can establish a connection with the authority after submitting the attribute application and it is approved. When the authority monitors the decryption application event of the data reader, the generated attribute key is sent to the data reader based on the above connection. That is, the data reader establishes a connection with the authority in advance after successfully completing the attribute application.

[0114] In one possible implementation, after verifying that the attributes of the data reader satisfy the encryption policy, the blockchain platform feeds back the verification result to the data reader. The data reader establishes a connection with the corresponding authority based on the institution ID carried in the verification result, and the authority sends the attribute key to the data reader based on the connection.

[0115] In the embodiment of the present application, the data reading user does not submit a decryption application directly to the authority, but submits a decryption application to the blockchain platform. The blockchain platform verifies the identity and then broadcasts the decryption application event, which is conducive to ensuring the security of distributed data sharing. The distribution of attribute keys by the authority depends on the blockchain platform broadcasting the decryption application event, which can not only meet the traceability of behavior, any participant can verify the fairness of data access control, but also greatly limit the rights of the authority and improve the degree of decentralization of the system.

[0116] For example, take an application scenario as an example. Figure 5As shown in the figure, authority A and authority B submit registration applications to the blockchain platform, register supported attributes, and upload the locally generated institution public key and supported attributes to the chain, which are managed by the blockchain platform through smart contracts. Data encryption users read the attributes on the blockchain platform, select attributes to build encryption policies, and upload the encryption policies to the blockchain platform for storage. Data encryption users can select specified attributes according to their needs to limit the users who can participate in data sharing. For example, data encryption users hope to share medical data only with users with "doctor" attributes issued by medical organizations and "researcher" attributes issued by clinical trial managers. Before submitting a decryption application, data decryption users need to submit a user attribute application to the blockchain platform. Based on the user attribute application, the blockchain platform triggers and broadcasts an attribute application event. The attribute application submitted by the data reading user includes the institution ID of the designated authority A. After authority A monitors the attribute application event, it approves the user attribute application of the data user and feeds back the user attribute application approval result to the blockchain platform. If the identity legitimacy of the data reading user is verified, the blockchain platform updates the attribute status of the data reading user, and the attribute status includes the attributes obtained by the data reading user. The data reader establishes a connection with authority A and submits a decryption request to the blockchain platform. After verifying that the attributes of the data reader meet the encryption policy, the blockchain platform triggers and broadcasts the decryption request event. After authority A listens to the decryption request event, it issues an attribute key to the data reader based on the connection established by the data reader. After the data reader obtains the attribute key corresponding to the encryption policy, it uses the attribute key to decrypt the encrypted data, thereby realizing distributed data sharing.

[0117] It can be seen that in the embodiments of the present application, in a decentralized scenario involving multiple parties, attributes and encryption strategies are put on the chain, and the blockchain platform verifies the decryption authority of the data reader on the chain, which not only ensures the transparency and non-tamperability of the data and guarantees the security of the data, but also the user submits a data encryption application or a data decryption application to the blockchain platform by calling a smart contract. The distribution of attribute keys by the authority depends on the blockchain platform broadcasting the decryption application event, which can not only meet the traceability of behavior, and any participant can verify the fairness of data access control, but also greatly limit the rights of the authority and improve the degree of decentralization of the system, thereby ensuring that distributed data sharing can be achieved safely and efficiently among users.

[0118] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0119] Corresponding to the distributed data sharing method based on blockchain described in the above embodiment, Figure 6A structural block diagram of a distributed data sharing device based on blockchain provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0120] Reference Figure 6 The distributed data sharing device is applied to the blockchain platform. The distributed data sharing device includes: an encryption application processing unit 61, a decryption application processing unit 62, and a data sharing unit 63, wherein:

[0121] The encryption application processing unit 61 is used to obtain the data encryption application submitted by the data encryption user calling the smart contract, receive and store the encryption policy sent by the data encryption user based on the data encryption application, the encryption policy is constructed by the data encryption user based on the attributes in the attribute set on the blockchain platform, and the encryption policy is used by the data encryption user to encrypt the original data;

[0122] The decryption application processing unit 62 is used to receive a data decryption application submitted by a data reading user calling a smart contract, and verify whether the attributes of the data reading user meet the encryption policy based on the data decryption application;

[0123] The data sharing unit 63 is used to trigger and broadcast a decryption application event if the attributes of the data reading user meet the encryption policy. The decryption application event is used to instruct the authority to generate an attribute key corresponding to the data decryption application and send the attribute key to the data reading user so that the data reading user can decrypt the encrypted data according to the attribute key.

[0124] As a possible implementation of the present application, the encryption application processing unit 61 is further used for:

[0125] Based on the data encryption application, verify the legitimacy of the data encryption user identity;

[0126] If the identity of the data encryption user is legal, the data encryption user is allowed to read the attribute set on the blockchain platform.

[0127] As a possible implementation of the present application, the above-mentioned distributed data sharing device further includes:

[0128] The institution registration review unit is used to obtain the registration application and institution public key submitted by the authority, wherein the registration application is used to register the attributes supported by the authority; the registration application is reviewed, and if the review is passed, the attributes supported by the authority and the corresponding institution public key are stored.

[0129] As a possible implementation of the present application, the above-mentioned distributed data sharing device further includes:

[0130] The attribute application processing unit is used to obtain the attribute application submitted by the user by calling the smart contract, and the attribute application is used to apply for the attributes required by the user from the authority; trigger and broadcast the user attribute application event, and the user attribute application event is used to instruct the authority to approve the attribute application and feedback the approval result; receive the attribute application approval result fed back by the authority based on the user attribute application event; update the attribute status of the user on the blockchain platform according to the approval result.

[0131] As a possible implementation manner of the present application, the user attribute application event includes an organization identifier of an authority, a user address of the user, and an applied attribute list; the authority approves the attribute application, including:

[0132] Verify whether the user address matches the user public key of the user;

[0133] If the user address matches the user public key of the user, the attribute application is approved;

[0134] Alternatively, if the user address matches the user public key of the user, verify whether the user is a user supported by the service;

[0135] If the user is a user supported by the service, the attribute application is approved.

[0136] As a possible implementation of the present application, the decryption application event is also used to instruct the authority to obtain the user public key of the data reader from the blockchain platform before sending the attribute key to the data reader, encrypt the attribute key according to the user public key, and send the encrypted attribute key to the data reader.

[0137] As can be seen from the above, in the embodiments of the present application, in a decentralized scenario involving multiple parties, attributes and encryption strategies are put on the chain, and the blockchain platform verifies the decryption authority of the data reader on the chain, which not only ensures the transparency and non-tamperability of the data and guarantees the security of the data, but also the user submits a data encryption application or a data decryption application to the blockchain platform by calling a smart contract. The distribution of attribute keys by the authority depends on the blockchain platform broadcasting the decryption application event, which can not only meet the traceability of behavior, and any participant can verify the fairness of data access control, but also greatly limit the rights of the authority and improve the degree of decentralization of the system, thereby ensuring that distributed data sharing can be achieved safely and efficiently among users.

[0138] The present application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, Figures 2 to 5 The steps of any distributed data sharing method based on blockchain are represented.

[0139] The embodiment of the present application also provides a computer program product, when the computer program product is run on a terminal device, the terminal device executes the following Figures 2 to 5 The steps of any distributed data sharing method based on blockchain are represented.

[0140] The embodiment of the present application also provides a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, Figures 2 to 5 The steps of any method for monitoring abnormal vehicle driving environment are represented.

[0141] Figure 7 Schematic diagram of a server provided by an embodiment of the present application. Figure 7 As shown, the server 7 of this embodiment includes: a processor 70, a memory 71, and a computer program 72 stored in the memory 71 and executable on the processor 70. When the processor 70 executes the computer program 72, the steps in the above-mentioned embodiments of the distributed data sharing method based on blockchain are implemented, for example Figure 2 Alternatively, when the processor 70 executes the computer program 72, the functions of each module / unit in the above-mentioned device embodiments are realized, for example Figure 6 The functions of the units 61 to 63 are shown.

[0142] The computer program 72 may be divided into one or more modules / units, which are stored in the memory 71 and executed by the processor 70 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 72 in the server 7.

[0143] The processor 70 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0144] The memory 71 may be an internal storage unit of the server 7, such as a hard disk or memory of the server 7. The memory 71 may also be an external storage device of the server 7, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server 7. Further, the memory 71 may also include both an internal storage unit of the server 7 and an external storage device. The memory 71 is used to store the computer program and other programs and data required by the server. The memory 71 may also be used to temporarily store data that has been output or is to be output.

[0145] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0146] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0147] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0148] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0149] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0152] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0153] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A distributed data sharing method based on blockchain, characterized in that: Applied to a blockchain platform, the method comprises: Obtaining a data encryption application submitted by a data encryption user calling a smart contract, receiving and storing an encryption policy sent by the data encryption user based on the data encryption application, wherein the encryption policy is constructed by the data encryption user based on the attributes in the attribute set on the blockchain platform, and the encryption policy is used by the data encryption user to encrypt the original data; Receive a data decryption application submitted by a data reader calling a smart contract, and verify whether the attributes of the data reader satisfy the encryption policy based on the data decryption application; If the attributes of the data reading user meet the encryption policy, a decryption application event is triggered and broadcast. The decryption application event is used to instruct the authority to generate an attribute key corresponding to the data decryption application and send the attribute key to the data reading user so that the data reading user can decrypt the encrypted data according to the attribute key.

2. The method according to claim 1, characterized in that Before receiving and storing the encryption policy sent by the data encryption user based on the data encryption application, the method further includes: Based on the data encryption application, verify the legitimacy of the data encryption user identity; If the identity of the data encryption user is legal, the data encryption user is allowed to read the attribute set on the blockchain platform.

3. The method according to claim 1, characterized in that Before obtaining the data encryption application submitted by the data encryption user calling the smart contract, the method further includes: Obtaining a registration application and an institution public key submitted by an authority, wherein the registration application is used to register attributes supported by the authority; The registration application is reviewed, and if the review is passed, the attributes supported by the authoritative organization and their corresponding organization public keys are stored.

4. The method according to claim 1, characterized in that Before obtaining the data encryption application submitted by the data encryption user calling the smart contract, the method further includes: Obtaining the attribute application submitted by the user by calling the smart contract, wherein the attribute application is used to apply to the authority for the attributes required by the user; Trigger and broadcast a user attribute application event, wherein the user attribute application event is used to instruct an authority to review and approve the attribute application and to provide feedback on the review and approval result; Receiving the attribute application approval result fed back by the authority based on the user attribute application event; The attribute status of the user on the blockchain platform is updated according to the approval result.

5. The method according to claim 4, characterized in that The user attribute application event includes the organization identification of the authority, the user address of the user and the applied attribute list; the authority approves the attribute application, including: Verify whether the user address matches the user public key of the user; If the user address matches the user public key of the user, the attribute application is approved; Alternatively, if the user address matches the user public key of the user, verify whether the user is a user supported by the service; If the user is a user supported by the service, the attribute application is approved.

6. The method according to any one of claims 1 to 5, characterized in that: The decryption application event is also used to instruct the authority to obtain the user public key of the data reader from the blockchain platform before sending the attribute key to the data reader, encrypt the attribute key according to the user public key, and send the encrypted attribute key to the data reader.

7. A distributed data sharing system based on blockchain, characterized in that: The system includes data encryption users, data reading users, an authority, and a blockchain platform, wherein: The data encryption user is used to call the smart contract to submit a data encryption application to the blockchain platform; an encryption strategy is constructed based on the attributes in the attribute set on the blockchain platform, the encryption strategy is used to encrypt the original data, and the encryption strategy is sent to the blockchain platform; The blockchain platform is used to obtain the data encryption application, receive and store the encryption policy sent by the data encryption user based on the data encryption application; The data reading user is used to send a decryption application to the blockchain platform; The blockchain platform is also used to receive a data decryption application submitted by a data reading user calling a smart contract, and based on the data decryption application, verify whether the attributes of the data reading user meet the encryption policy; if the attributes of the data reading user meet the encryption policy, trigger and broadcast a decryption application event; The authority is used to monitor the decryption application event, and after monitoring the decryption application event, generates an attribute key corresponding to the data decryption application, and sends the attribute key to the data reading user; The data reading user is also used to decrypt the encrypted data according to the attribute key.

8. A distributed data sharing device based on blockchain, characterized in that: Applied to the blockchain platform, the device includes: An encryption application processing unit, used to obtain a data encryption application submitted by a data encryption user calling a smart contract, receive and store an encryption policy sent by the data encryption user based on the data encryption application, wherein the encryption policy is constructed by the data encryption user based on the attributes in the attribute set on the blockchain platform, and the encryption policy is used by the data encryption user to encrypt the original data; A decryption application processing unit, used to receive a data decryption application submitted by a data reader calling a smart contract, and verify whether the attributes of the data reader meet the encryption policy based on the data decryption application; A data sharing unit is used to trigger and broadcast a decryption application event if the attributes of the data reading user meet the encryption policy. The decryption application event is used to instruct an authority to generate an attribute key corresponding to the data decryption application and send the attribute key to the data reading user so that the data reading user can decrypt the encrypted data according to the attribute key.

9. A server comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the distributed data sharing method based on blockchain as described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the distributed data sharing method based on blockchain as described in any one of claims 1 to 6 are implemented.

Images