Information differentiation sharing method and system based on block chain
By pre-encrypting and uploading the core data in shared data to the blockchain, and combining smart contract management data access rights, the problem of insufficient data security in the existing technology is solved, and efficient protection and security guarantee of core data is achieved.
Patent Information
- Application Number
- CN202411864438.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-18
- Publication Date
- 2025-04-11
AI Technical Summary
The existing technology has shortcomings in improving data security, especially in the face of unexpected data leakage and misuse of permissions, it is impossible to effectively protect the confidentiality and security of core data.
By pre-encrypting the core data in shared data and uploading it to the blockchain for storage. At the same time, use smart contracts to define data access rights and distribute user private keys and core data keys to each user to ensure that only users with core data access rights can decrypt core data.
It effectively protects the confidentiality of core data. Even in unexpected situations such as data leakage, unauthorized users cannot decrypt the core data, significantly improving the security of the data and providing a deeper layer of security guarantee.
Smart Images
Figure CN119814399A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of blockchain data encryption technology, and more specifically, to a blockchain-based information differentiated sharing method and system. Background Art
[0002] Existing data sharing solutions have played an important role in improving the efficiency of information circulation and optimizing resource allocation, but they also have some significant shortcomings. Due to different users, there are usually a variety of access rights designs, and different data access rights are opened to different users. For some core data, in order to ensure its security, asymmetric encryption solutions are usually adopted. For data security issues such as low-authority accidentally obtaining information that does not belong to their access rights, and information being accidentally hijacked, it is necessary to further strengthen the security of core data. In addition, various data security issues are emerging in an endless stream, such as various data leakage incidents. For core data with higher confidentiality requirements, it is even more necessary to take further security management to avoid the leakage of core data when encountering such unexpected situations.
[0003] Blockchain technology has been widely used due to its decentralization, non-tamperability, strong security and traceability. In terms of data sharing, blockchain is usually directly introduced on the basis of traditional asymmetric encryption, and the security of core data has not been further strengthened.
[0004] Therefore, how to further improve the security of data and provide a deeper level of security when facing such unexpected situations is a problem that needs to be solved in this field. Summary of the invention
[0005] The purpose of the embodiments of the present application is to provide a blockchain-based information differentiated sharing method and system to improve data security.
[0006] In order to achieve the above purpose, the embodiments of the present application are implemented in the following manner:
[0007] In a first aspect, an embodiment of the present application provides a differentiated information sharing method based on blockchain, including: S1: pre-encrypting the core data in the shared data, and uploading the shared data to the blockchain for storage, wherein the shared data includes the pre-encrypted core data; S2: defining data access rights through smart contracts, and distributing user private keys to each user, and distributing core data keys to core users, wherein each user is assigned corresponding data access rights and user private keys, and users with core data access rights in the data access rights are core users, and the core data keys are used to decrypt the core data; S3: when a user uses a user terminal to access shared data, the smart contract verifies the user's data access rights; S4: if the verification is successful, the target data accessed by the user is determined from the shared data, and the target data is re-encrypted by the system public key, and transmitted to the user terminal, so that the user terminal decrypts the re-encrypted data by its user private key, wherein if the target data also includes core data, the user terminal decrypts the pre-encrypted core data by its core data key; S5: if the verification fails, the user's data access request is rejected.
[0008] In combination with the first aspect, in a first possible implementation method of the first aspect, in S1, the core data in the shared data is pre-encrypted, including: determining regular data and core data from the data to be shared; pre-encrypting the core data; and combining the regular data and the pre-encrypted core data into shared data.
[0009] In combination with the first possible implementation method of the first aspect, in a second possible implementation method of the first aspect, the core data is image data, including several images, and the core data is pre-encrypted, including: for each image: preprocessing the current image, the preprocessing includes unifying the format, image segmentation and image rearrangement; determining the rearrangement matrix according to the rearranged image after the image rearrangement; performing channel separation on the rearranged matrix to obtain the channel matrix corresponding to each color channel; filling and secondary segmenting the channel matrix corresponding to each color channel to obtain several square matrix blocks with a side length of N; performing Arnold mapping based on the square matrix blocks corresponding to each channel matrix to obtain the mapping matrix corresponding to each square matrix block; generating an encrypted image after pre-encryption based on the mapping matrix corresponding to each square matrix block; generating a core data key based on relevant parameters in the pre-encryption process, wherein each encrypted image corresponds to a core data key.
[0010] In combination with the second possible implementation method of the first aspect, in a third possible implementation method of the first aspect, the current image is preprocessed, and the preprocessing includes unified format, image segmentation and image rearrangement, including: converting the current image into JPEG format; performing image segmentation on the current image in JPEG format into M image blocks; rearranging the M image blocks to obtain a rearranged image, and encrypting the original arrangement position permutation information matrix corresponding to the rearranged image using a pseudo-random algorithm to obtain an image recovery sequence corresponding to the rearranged image.
[0011] In combination with the second possible implementation method of the first aspect, in a fourth possible implementation method of the first aspect, the channel matrix corresponding to each color channel is filled and split twice to obtain a number of square matrix blocks with a side length of N, including: for the channel matrix corresponding to each color channel: obtaining the number of dimensions of the channel matrix; according to the side length parameter N, padding the channel matrix with zeros so that the number of dimensions of the channel matrix after zero padding is kN×kN; dividing the channel matrix after zero padding into k×k N×N square matrix blocks.
[0012] In combination with the fourth possible implementation manner of the first aspect, in a fifth possible implementation manner of the first aspect, Arnold mapping is performed based on the square matrix block corresponding to each channel matrix to obtain a mapping matrix corresponding to each square matrix block, including: for each square matrix block corresponding to the channel matrix, Arnold mapping is performed using the following formula:
[0013] x n+1 =(ax n +by n )mod N,
[0014] y n+1 =(cx n +dy n )mod N,
[0015] Among them, (x n ,y n ) is the coordinate of the element in the square matrix block before mapping, (x n+1 ,y n+1 ) is the coordinate of the elements in the square matrix block after mapping, N is the side length parameter of the square matrix block, mod N represents the modular operation on the side length parameter N, a, b, c and d are the matrix mapping parameters of Arnold mapping, and satisfy c = 1, d = a × b + 1; accordingly, the mapping matrix corresponding to each square matrix block is obtained.
[0016] In combination with the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, based on the mapping matrix corresponding to each square matrix block, generating a pre-encrypted encrypted image, including: for the mapping matrix corresponding to each square matrix block: according to the sequential numbering of the square matrix blocks, performing pixel processing on the mapping matrix corresponding to the square matrix block to obtain a scrambled pixel encrypted image corresponding to the square matrix block, and the processing method adopts the following formula:
[0017] P' (x,y) =(P (x,y) +i)mod 256,
[0018] Among them, P' (x,y) is the pixel value after pixel processing at the coordinate (x, y) in the mapping matrix, P (x,y) is the pixel value before pixel processing at the coordinate (x, t) in the mapping matrix, and i is the sequential number of the square matrix block; based on the scrambled pixel encrypted image corresponding to each square matrix block, the square matrix blocks are spliced according to the sequential number to obtain the channel encrypted image of the corresponding color channel; based on the channel encrypted image of each color channel, they are fused into the encrypted image after pre-encryption.
[0019] In combination with the sixth possible implementation method of the first aspect, in the seventh possible implementation method of the first aspect, a core data key is generated based on relevant parameters in the pre-encryption process, including: obtaining the number of dimensions of the channel matrix under each color channel, the sequential number corresponding to each square matrix block, the side length N of the square matrix block, the number k of square matrix blocks, and Arnold's matrix mapping parameters a and b; obtaining the image recovery sequence and image segmentation parameter M corresponding to the rearranged image; based on the number of dimensions of the channel matrix under each color channel, the sequential number corresponding to each square matrix block, the side length N of the square matrix block, the number k of square matrix blocks, Arnold's matrix mapping parameters a and b, the image recovery sequence and image segmentation parameter M corresponding to the rearranged image, a core data key is generated.
[0020] In combination with the seventh possible implementation manner of the first aspect, in an eighth possible implementation manner of the first aspect, the core data is image data, and for each encrypted image, the user terminal decrypts the pre-encrypted core data through its core data key in the following manner: D1: Retrieve the core data key corresponding to the encrypted image; D2: Perform channel separation on the encrypted image to obtain an encrypted image channel matrix corresponding to each color channel; D3: For each encrypted image channel matrix, divide the encrypted image channel matrix into k×k N×N encrypted image matrix blocks according to a parameter N; D4: For each encrypted image matrix block, perform restoration processing using the following formula:
[0021]
[0022] Among them, P (x,y) is the pixel value with coordinates (x, y) in the encrypted image matrix block after restoration, P' (x,y) is the pixel value with coordinates (x, y) in the encrypted image matrix block before restoration, i is the sequence number of the encrypted image matrix block, i∈[1,k 2 ],k 2 is the total number of encrypted image matrix blocks in each encrypted image channel matrix;
[0023] D5: For the encrypted image matrix block after restoration, the following formula is used for inverse mapping:
[0024] x n =d(x n+1 -ay n +1) mod N,
[0025] y n =-(bx n +1-y n +1) mod N,
[0026] Among them, (x n ,y n ) is the coordinate of the element in the encrypted image matrix block after inverse mapping, (x n+1 ,y n+1 ) is the coordinate of the element in the encrypted image matrix block after inverse mapping, N is the side length parameter of the encrypted image matrix block, mod N represents the modulo operation on the side length parameter N, a and b are the matrix mapping parameters of the Arnold mapping, and satisfy c=1, d=a×b+1; D6: splicing the encrypted image matrix blocks after inverse mapping according to the sequence number i to obtain the channel image to be restored, and based on the dimension number of the channel matrix under the color channel, removing the edge zero pixels of the channel image to be restored to obtain the restored channel image; D7: fusing the restored channel images of each channel to obtain a restored rearranged image, and using a pseudo-random algorithm to decrypt the image recovery sequence to obtain the original arrangement position permutation information matrix; D8: segmenting the restored rearranged image according to the image segmentation parameter M to obtain M image blocks to be restored, and arranging and restoring the M image blocks to be restored based on the original arrangement position permutation information matrix to obtain the decrypted image.
[0027] In a second aspect, an embodiment of the present application provides a blockchain-based differentiated information sharing system, comprising: a data terminal, used to run step S1 in the blockchain-based differentiated information sharing method described in any one of the first aspect or the possible implementations of the first aspect; a blockchain system, used to run steps S2-S5 in the blockchain-based differentiated information sharing method described in any one of the first aspect or the possible implementations of the first aspect; a user terminal, used to run the data decryption process in the blockchain-based differentiated information sharing method described in any one of the first aspect or the possible implementations of the first aspect, wherein the data decryption process comprises: decrypting the secondary encrypted data by using the user's private key and decrypting the pre-encrypted core data by using its core data key.
[0028] Beneficial effects:
[0029] 1. This solution pre-encrypts the core data in the shared data and uploads the shared data to the blockchain for storage; defines data access rights through smart contracts, distributes user private keys to each user, and distributes core data keys to core users, where each user is assigned corresponding data access rights and user private keys. Users with core data access rights in the data access rights are core users, and the core data keys are used to decrypt the core data. Since the core data has been pre-encrypted, even if the data is uploaded to the blockchain, unauthorized users cannot directly access and decrypt these sensitive information, thereby effectively protecting the confidentiality of the data. Even in the face of unexpected situations such as data leakage, the pre-encrypted core data is difficult to crack without a decryption method, thereby effectively ensuring the security of the data and providing a deeper level of security. When a user uses a user terminal to access shared data, the smart contract verifies the user's data access rights; if the verification is successful, the target data accessed by the user is determined from the shared data, and the target data is re-encrypted through the system public key and transmitted to the user terminal, so that the user terminal decrypts the re-encrypted data through its user private key. If the target data also contains core data, the user terminal decrypts the pre-encrypted core data through its core data key; if the verification fails, the user's data access request is rejected. This can effectively achieve differentiated access rights control for data. Even in the face of a very small probability of low-authority accidentally obtaining high-authority access data, there is no decryption method, and the pre-encrypted core data will not be cracked, thereby effectively ensuring data security.
[0030] 2. When the core data is image data, for each image: preprocess the current image, including unified format, image segmentation and image rearrangement; determine the rearrangement matrix based on the rearranged image after the image rearrangement; perform channel separation on the rearranged matrix to obtain the channel matrix corresponding to each color channel; fill and split the channel matrix corresponding to each color channel twice to obtain a number of square matrix blocks with a side length of N; perform Arnold mapping based on the square matrix block corresponding to each channel matrix to obtain the mapping matrix corresponding to each square matrix block; generate the encrypted image after pre-encryption based on the mapping matrix corresponding to each square matrix block; generate the core data key based on the relevant parameters in the pre-encryption process. This scheme adopts preprocessing (including scrambling and rearrangement of pseudo-random algorithm), channel separation, square matrix block processing (filling and blocking), Arnold mapping, and then pixel-level processing. Each step is encrypted to form a multi-level encryption system. This multi-level encryption mechanism greatly increases the difficulty of cracking and improves the security of data.
[0031] 3. The classic Arnold mapping scheme is used during Arnold mapping, and this factor is taken into account when processing the square matrix block, so that the reverse restoration and decryption can be realized through the relevant key parameters. After Arnold mapping, the pixel-level processing based on the numbering is added (scrambled pixel encryption), and the mapping matrix corresponding to each square matrix block is processed according to the sequential numbering of the square matrix block: P' (x,y) =(P (x,y) +i)mod 256, get the scrambled pixel encrypted image corresponding to this square matrix block, splice the scrambled pixel encrypted image corresponding to each square matrix block according to the sequential number of the square matrix block, and get the channel encrypted image of the corresponding color channel; the channel encrypted image based on each color channel is fused into the encrypted image after pre-encryption. This can further increase the difficulty of cracking and improve data security.
[0032] 4. When the user terminal restores the data through the core data key, the restoration design is carried out for each process, and the restoration design is carried out for the pixel-level processing (scrambled pixel encryption), and the reverse restoration scheme is designed: And reverse restore for Arnold mapping: n =d(x n+1 -ay n +1)mod N,y n =-(bx n +1-y n+1)mod N, so that the core data (image data) can be restored on the user terminal through the core data key, so that the solution can run stably. Even in the face of data leakage and unauthorized data acquisition (without access to the core data, but accidentally obtaining the core data and the core data key), the security of the data can be guaranteed, because there is no corresponding data decryption method, it is difficult to crack, so that the core data (image data) can be kept safe.
[0033] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0035] Figure 1 An interactive diagram of the blockchain-based differentiated information sharing system provided in an embodiment of the present application.
[0036] Figure 2 A flowchart of a blockchain-based differentiated information sharing method provided in an embodiment of the present application.
[0037] Figure 3 Flowchart for decrypting core data for user terminals. DETAILED DESCRIPTION
[0038] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.
[0039] See also Figure 1 , Figure 1 Interaction diagram of the information differentiated sharing system based on blockchain provided in the embodiment of the present application. In this embodiment, the information differentiated sharing system based on blockchain mainly includes three types of entities: data terminal, i.e., the terminal of the data owner, with a built-in running program of the pre-add method; blockchain, i.e., the data platform, which can complete data storage, verification of user access rights, data distribution, key distribution and other matters; user terminal, i.e., the user's terminal, the user is divided into core users with core data access rights and ordinary users without core data access rights, and the user terminal of the core user has a built-in data decryption method for core data decryption.
[0040] The data terminal is mainly used to pre-encrypt core data and upload shared data to the blockchain for storage.
[0041] The blockchain is mainly used to store data, define data access rights, distribute private keys to each user (essentially, this is achieved with the help of an external key certification agency or other key generation and issuance agency, and this embodiment will not be introduced separately and can be directly regarded as blockchain issuance), distribute core data keys to core users, verify users' data access rights, and re-encrypt target data through the system public key (paired with the user's private key, and it is a one-to-one relationship, each user private key corresponds to a system public key), transmit it to the user terminal, and enable the user terminal to decrypt the re-encrypted data through its user private key.
[0042] The user terminal is used to run the data decryption process in the blockchain-based information differential sharing method. The data decryption process includes: decrypting the secondary encrypted data through the user's private key and decrypting the pre-encrypted core data through its core data key.
[0043] The following will introduce this solution in detail through the information differentiation sharing method based on blockchain. Figure 2 , Figure 2 Flow chart of the information differential sharing method based on blockchain provided in the embodiment of the present application. The information differential sharing method based on blockchain may include step S1, step S2, step S3, step S4 and step S5.
[0044] First, the data terminal requires the data terminal to run step S1.
[0045] S1: Pre-encrypt the core data in the shared data and upload the shared data to the blockchain for storage, wherein the shared data includes the pre-encrypted core data.
[0046] In this embodiment, the data terminal can pre-encrypt the core data in the shared data, specifically: determine the regular data and core data from the data to be shared, pre-encrypt the core data, and then combine the regular data and the pre-encrypted core data into shared data. In this way, the shared data can be uploaded to the blockchain for storage.
[0047] If the core data is image data, this embodiment designs a special encryption algorithm for the image data to improve the security of the image data.
[0048] The core data contains several images, so the pre-encryption of the core data can be performed for each image.
[0049] For each image:
[0050] The data terminal can preprocess the current image, including format unification, image segmentation and image rearrangement.
[0051] Specifically, the data terminal can convert the current image into JPEG format, and then segment the current image in JPEG format into M image blocks, for example, according to the pixel ratio of the image, it is divided into M image blocks (for example, 8*8=64 image blocks, 10*10=100 image blocks, etc., it is necessary to consider the size of commonly used images in the core data or the size of the image in the specified core data). The M image blocks are rearranged to obtain a rearranged image, and the original arrangement position replacement information matrix corresponding to the rearranged image is encrypted using a pseudo-random algorithm to obtain an image recovery sequence corresponding to the rearranged image. In this way, the preprocessing of the image (including image scrambling and pseudo-random encryption) can be completed as the first layer of encryption mechanism.
[0052] After completing the preprocessing of the image, the data terminal can determine the rearrangement matrix based on the rearranged image after the image is rearranged. The rearrangement matrix here is a two-dimensional matrix composed of the pixel values of each pixel. Then the rearrangement matrix can be channel separated to obtain the channel matrix corresponding to each color channel: R channel matrix, G channel matrix, and B channel matrix.
[0053] Afterwards, the data terminal may fill and split the channel matrix corresponding to each color channel twice to obtain a number of square matrix blocks with a side length of N.
[0054] Then, for the channel matrix corresponding to each color channel, the data terminal can obtain the dimension of the channel matrix, and then fill the channel matrix with zeros according to the side length parameter N (for example, fill the width direction with zeros from the right side, and fill the height direction with zeros from the bottom side), so that the dimension of the zero-filled channel matrix is kN×kN, thereby dividing the zero-filled channel matrix into k×k N×N square matrix blocks (here, it can also be filled into jN×kN, thereby dividing the zero-filled channel matrix into j×k N×N square matrix blocks, and this embodiment takes the filling into kN×kN as an example). Since the dimension of each color channel of the same rearranged image is the same, the zero-filling and division methods are also the same.
[0055] Of course, in order to further increase the difficulty of cracking, we can consider choosing different zero-padding schemes according to different channels: for example, for the R channel matrix, adopt the scheme of padding zeros in the width direction from the right side and padding zeros in the height direction from the bottom side; for the G channel matrix, adopt the scheme of padding zeros in the width direction from the left side and padding zeros in the height direction from the top side; for the B channel matrix, adopt the scheme of padding zeros in the width direction from the left and right sides (when the number of columns to be zero-padding is odd, specify one more column on the left side, or one more column on the right side) and padding zeros in the height direction from the top and bottom sides (when the number of rows to be zero-padding is odd, specify one more row on the top side, or one more row on the bottom side).
[0056] After obtaining the k×k N×N square matrix blocks divided by the channel matrix (the channel matrix corresponding to each color channel can be divided into k×k N×N square matrix blocks), the data terminal can perform Arnold mapping based on the square matrix blocks corresponding to each channel matrix to obtain the mapping matrix corresponding to each square matrix block.
[0057] Exemplarily, for each square matrix block corresponding to the channel matrix, the data terminal may use the following formula to perform Arnold mapping:
[0058] x n+1 =(ax n +by n )mod N, (1)
[0059] y n+1 =(cx n +dy n )mod N, (2)
[0060] Among them, (x n ,y n ) is the coordinate of the element in the square matrix block before mapping, (x n+1 ,y n+1 ) is the coordinate of the element in the square matrix block after mapping, N is the side length parameter of the square matrix block, mod N represents the modulo operation on the side length parameter N, a, b, c and d are the matrix mapping parameters of Arnold mapping, and satisfy c = 1, d = a × b + 1. Here, the matrix mapping parameters a and b can be derived from the values generated by the pseudo-random algorithm, n is the current iteration number, and the design of the iteration number of Arnold mapping can be designed as needed.
[0061] Based on this, the data terminal can obtain the mapping matrix corresponding to each square matrix block.
[0062] Afterwards, the data terminal can generate an encrypted image after pre-encryption based on the mapping matrix corresponding to each square matrix block.
[0063] Exemplarily, for the mapping matrix corresponding to each square matrix block: the data terminal can perform pixel processing on the mapping matrix corresponding to the square matrix block according to the sequential numbering of the square matrix blocks to obtain the scrambled pixel encrypted image corresponding to the square matrix block, and the processing method adopts the following formula:
[0064] P' (x,y) =(P (x,y) +i)mod 256, (3)
[0065] Among them, P' (x,y) is the pixel value after pixel processing at the coordinate (x, y) in the mapping matrix, P (x,y) is the pixel value at coordinate (x, y) in the mapping matrix before pixel processing, and i is the sequential number of the square matrix block.
[0066] Then, the data terminal can encrypt the image based on the scrambled pixels corresponding to each square matrix block, splice it according to the sequential numbering of the square matrix blocks, obtain the channel encrypted image of the corresponding color channel, and then merge the channel encrypted image of each color channel into the encrypted image after pre-encryption.
[0067] After obtaining the encrypted image after pre-encryption, the data terminal can generate a core data key based on relevant parameters in the pre-encryption process, wherein each encrypted image corresponds to a core data key.
[0068] Exemplarily, the data terminal can obtain the dimension number of the channel matrix under each color channel, the sequence number corresponding to each square matrix block, the side length N of the square matrix block, the number of square matrix blocks k, Arnold's matrix mapping parameters a and b, and obtain the image restoration sequence and image segmentation parameter M corresponding to the rearranged image.
[0069] Then, the data terminal can generate the core data key based on the number of dimensions of the channel matrix under each color channel, the sequential number corresponding to each square matrix block, the side length N of the square matrix block, the number of square matrix blocks k, Arnold's matrix mapping parameters a, b, the image recovery sequence corresponding to the rearranged image, and the image segmentation parameter M.
[0070] Thus, the pre-encryption of the image data can be realized. As for text data or other types of data, the currently mature encryption method can be used to encrypt and generate the corresponding core data key.
[0071] After completing the pre-encryption of the core data, the data terminal can upload the core data (pre-encrypted and carrying the corresponding core data key) and regular data to the blockchain as shared data.
[0072] The blockchain can then run step S2.
[0073] S2: Define data access rights through smart contracts, distribute user private keys to each user, and distribute core data keys to core users, where each user is assigned corresponding data access rights and user private keys. Users with core data access rights in the data access rights are core users, and the core data keys are used to decrypt core data.
[0074] In this embodiment, the blockchain can define data access rights through smart contracts and assign access rights to each user. Ordinary users can only access regular data but not core data, while core users can access both regular data and core data.
[0075] After that, the blockchain can distribute user private keys to each user, and core data keys to core users. Then, each user is assigned corresponding data access rights and user private keys. Users with core data access rights are core users, and core data keys are used to decrypt core data. In addition, in order to increase the difficulty of cracking, the core data decryption method is not open to ordinary users on the user side, but is open to core users on the user side.
[0076] S3: When a user uses a user terminal to access shared data, the smart contract verifies the user's data access rights.
[0077] In this embodiment, when a user uses a user terminal to access shared data, an access request is generated (including a user ID to distinguish the user), and the smart contract can verify the user's data access rights based on the user ID (verify whether the data accessed by the user is within the scope of his or her authority).
[0078] If the verification is successful, the blockchain runs step S4.
[0079] S4: If the verification is successful, the target data accessed by the user is determined from the shared data, and the target data is re-encrypted using the system public key and transmitted to the user terminal, so that the user terminal decrypts the re-encrypted data using its user private key. If the target data also contains core data, the user terminal decrypts the pre-encrypted core data using its core data key.
[0080] In this embodiment, if the verification is successful, the blockchain can determine the target data accessed by the user from the shared data, and re-encrypt the target data through the system public key (corresponding to the user's user private key), and transmit it to the user terminal, so that the user terminal can decrypt the re-encrypted data through its user private key. If the target data also contains core data, the user terminal also needs to decrypt the pre-encrypted core data through the corresponding core data key.
[0081] Since the asymmetric encryption scheme used in the secondary encryption of blockchain in this scheme is a mature technology, it will not be described here. The decryption of core data can be achieved through the following scheme.
[0082] See also Figure 3 , Figure 3 Flowchart of core data decryption for a user terminal. In this embodiment, when the user terminal decrypts the pre-encrypted core data using the core data key, steps D1-D8 may be executed.
[0083] First, the user terminal may execute step D1.
[0084] D1: Retrieve the core data key corresponding to the encrypted image.
[0085] In this embodiment, the user terminal can retrieve the core data key corresponding to the pre-encrypted core data.
[0086] The user terminal can then execute step D2.
[0087] D2: Separate the encrypted image into channels and obtain the encrypted image channel matrix corresponding to each color channel.
[0088] In this embodiment, the user terminal may separate the encrypted image into channels to obtain an encrypted image channel matrix corresponding to each color channel, that is, an encrypted image channel matrix corresponding to the R color channel, the G color channel, and the B color channel.
[0089] Then run step D3:
[0090] D3: For each encrypted image channel matrix, according to the parameter N, the encrypted image channel matrix is divided into k×k N×N encrypted image matrix blocks.
[0091] In this embodiment, the user terminal may perform segmentation processing on each encrypted image channel matrix, and segment the encrypted image channel matrix into k×k N×N encrypted image matrices.
[0092] Afterwards, the user terminal may execute step D4.
[0093] D4: Perform restoration processing on each encrypted image matrix block.
[0094] Specifically, the user terminal may use the following formula for restoration:
[0095]
[0096] Among them, P (x,y) is the pixel value with coordinates (x, y) in the encrypted image matrix block after restoration, P' (x,y)is the pixel value with coordinates (x, y) in the encrypted image matrix block before restoration, i is the sequence number of the encrypted image matrix block, i∈[1,k 2 ],k 2 The total number of encrypted image matrix blocks in each encrypted image channel matrix.
[0097] After completing the restoration of each encrypted image matrix block, the user terminal may execute step D5.
[0098] D5: Perform inverse mapping on the encrypted image matrix block after restoration.
[0099] Specifically, the user terminal may use the following formula for inverse mapping:
[0100] x n =d(x n+1 -ay n +1) mod N, (5)
[0101] y n =-(bx n +1-y n +1) mod N, (6)
[0102] Among them, (x n ,y n ) is the coordinate of the element in the encrypted image matrix block after inverse mapping, (x n+1 ,y n+1 ) is the coordinate of the element in the encrypted image matrix block after inverse mapping, N is the side length parameter of the encrypted image matrix block, mod N represents the modular operation on the side length parameter N, a and b are the matrix mapping parameters of Arnold mapping, and satisfy c=1, d=a×b+1.
[0103] After completing the inverse mapping of each encrypted image matrix block, the user terminal may execute step D6.
[0104] D6: splice the encrypted image matrix blocks after inverse mapping according to the sequence number i to obtain the channel image to be restored, and remove the edge zero pixels of the channel image to be restored based on the dimension number of the channel matrix under the color channel to obtain the restored channel image.
[0105] In this embodiment, the user terminal can splice the encrypted image matrix blocks after inverse mapping according to the sequence number i to obtain the channel image to be restored. Then, based on the dimension number of the channel matrix under the color channel, the edge zero-filled pixels of the channel image to be restored are removed (it needs to correspond to the zero-filling scheme during pre-encryption, for example, if the pre-encryption is to fill the columns on the right and the rows on the bottom, then the zero-filled elements should also be removed in accordance with this rule. If it is other schemes, it also corresponds to removing the zero-filled part in the pre-encryption process), thereby obtaining the restored channel image.
[0106] After obtaining the restored channel images (the restored channel images of the three color channels), the user terminal may execute step D7.
[0107] D7: Fuse the restored channel images of each channel to obtain the restored rearranged image, and use a pseudo-random algorithm to decrypt the image recovery sequence to obtain the original arrangement position permutation information matrix.
[0108] In this embodiment, the user terminal can fuse the restored channel images of each channel (i.e., superimpose the restored channel images of the three color channels) to obtain a restored rearranged image. Then, the image restoration sequence is decrypted using the same pseudo-random algorithm as in the pre-encryption to obtain the original arrangement position permutation information matrix.
[0109] Finally, the user terminal may execute step D8.
[0110] D8: Segment the restored rearranged image according to the image segmentation parameter M to obtain M image blocks to be restored, and arrange and restore the M image blocks to be restored based on the original arrangement position permutation information matrix to obtain the decrypted image.
[0111] In this embodiment, the user terminal can divide the restored rearranged image according to the image segmentation parameter M (for example, during pre-encryption, it is divided into 10*10=100 image blocks by equal division, then the same segmentation scheme needs to be used at this time) to obtain M image blocks to be restored.
[0112] Then, the user terminal may arrange and restore the M image blocks to be restored by permuting the information matrix of the original arrangement positions, thereby obtaining a decrypted image.
[0113] If the verification fails, the blockchain can run step S5.
[0114] S5: If the verification fails, the user's data access request is rejected.
[0115] The above solution can realize differentiated information sharing based on blockchain and ensure the security of data.
[0116] In summary, the embodiment of the present application provides a differentiated information sharing method and system based on blockchain, by pre-encrypting the core data in the shared data, uploading the shared data to the blockchain for storage; defining data access rights through smart contracts, distributing user private keys to each user, and distributing core data keys to core users, wherein each user is assigned corresponding data access rights and user private keys, and users with core data access rights in the data access rights are core users, and the core data keys are used to decrypt the core data. Since the core data has been pre-encrypted, even if the data is uploaded to the blockchain, unauthorized users cannot directly access and decrypt these sensitive information, thereby effectively protecting the confidentiality of the data. Even in the face of unexpected situations such as data leakage, there is no decryption method, and the pre-encrypted core data is difficult to crack, thereby effectively ensuring the security of the data and having a deeper level of security. When a user uses a user terminal to access shared data, the smart contract verifies the user's data access rights; if the verification is successful, the target data accessed by the user is determined from the shared data, and the target data is re-encrypted through the system public key and transmitted to the user terminal, so that the user terminal decrypts the re-encrypted data through its user private key. If the target data also contains core data, the user terminal decrypts the pre-encrypted core data through its core data key; if the verification fails, the user's data access request is rejected. This can effectively achieve differentiated access rights control for data. Even in the face of a very small probability of low-authority accidentally obtaining high-authority access data, there is no decryption method, and the pre-encrypted core data will not be cracked, thereby effectively ensuring data security.
[0117] When the core data is image data, for each image: preprocess the current image, including unified format, image segmentation and image rearrangement; determine the rearrangement matrix based on the rearranged image after the image rearrangement; perform channel separation on the rearranged matrix to obtain the channel matrix corresponding to each color channel; fill and split the channel matrix corresponding to each color channel twice to obtain a number of square matrix blocks with a side length of N; perform Arnold mapping based on the square matrix block corresponding to each channel matrix to obtain the mapping matrix corresponding to each square matrix block; generate the encrypted image after pre-encryption based on the mapping matrix corresponding to each square matrix block; generate the core data key based on the relevant parameters in the pre-encryption process. This scheme adopts preprocessing (including scrambling and rearrangement of pseudo-random algorithm), channel separation, square matrix block processing (filling and blocking), Arnold mapping, and then pixel-level processing. Each step is encrypted to form a multi-level encryption system. This multi-level encryption mechanism greatly increases the difficulty of cracking and improves the security of data.
[0118] The classic Arnold mapping scheme is used during Arnold mapping, and this factor is taken into account when processing the square matrix block, so that the reverse restoration and decryption can be realized through the relevant key parameters. After Arnold mapping, pixel-level processing based on numbering (scrambled pixel encryption) is added, and the mapping matrix corresponding to each square matrix block is processed pixel by pixel according to the sequential numbering of the square matrix block: P' (x,y) =(P (x,y) +i)mod 256, get the scrambled pixel encrypted image corresponding to this square matrix block, splice the scrambled pixel encrypted image corresponding to each square matrix block according to the sequential number of the square matrix block, and get the channel encrypted image of the corresponding color channel; the channel encrypted image based on each color channel is fused into the encrypted image after pre-encryption. This can further increase the difficulty of cracking and improve data security.
[0119] When the user terminal restores the data through the core data key, the restoration design is carried out for each process, and the restoration design is carried out for the pixel-level processing (scrambled pixel encryption), and the reverse restoration scheme is designed: And reverse restore for Arnold mapping: n =d(x n+1 -ay n +1)mod N,y n =-(bx n +1-y n +1)mod N, so that the core data (image data) can be restored on the user terminal through the core data key, so that the solution can run stably. Even in the face of data leakage and unauthorized data acquisition (without access to the core data, but accidentally obtaining the core data and the core data key), the security of the data can be guaranteed, because there is no corresponding data decryption method, it is difficult to crack, so that the core data (image data) can be kept safe.
[0120] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A differentiated information sharing method based on blockchain, characterized in that: include: S1: Pre-encrypt the core data in the shared data and upload the shared data to the blockchain for storage, wherein the shared data contains the pre-encrypted core data; S2: Define data access rights through smart contracts, distribute user private keys to each user, and distribute core data keys to core users. Each user is assigned corresponding data access rights and user private keys. Users with core data access rights are core users, and core data keys are used to decrypt core data. S3: When a user uses a user terminal to access shared data, the smart contract verifies the user’s data access rights; S4: If the verification is successful, the target data accessed by the user is determined from the shared data, and the target data is re-encrypted using the system public key and transmitted to the user terminal, so that the user terminal decrypts the re-encrypted data using its user private key. If the target data also contains core data, the user terminal decrypts the pre-encrypted core data using its core data key; S5: If the verification fails, the user's data access request is rejected.
2. The information differentiation sharing method based on blockchain according to claim 1 is characterized in that: In S1, the core data in the shared data is pre-encrypted, including: Identify routine data and core data from the data to be shared; Pre-encrypt the core data; Combine regular data and pre-encrypted core data into shared data.
3. The information differentiation sharing method based on blockchain according to claim 2 is characterized in that: The core data is image data, including several images. The core data is pre-encrypted, including: For each image: Preprocess the current image, including format unification, image segmentation and image rearrangement; Determine a rearrangement matrix according to the rearranged image after the image is rearranged; Perform channel separation on the rearranged matrix to obtain a channel matrix corresponding to each color channel; Fill and split the channel matrix corresponding to each color channel twice to obtain a number of square matrix blocks with a side length of N; Based on the square matrix block corresponding to each channel matrix, Arnold mapping is performed to obtain the mapping matrix corresponding to each square matrix block; Based on the mapping matrix corresponding to each square matrix block, an encrypted image after pre-encryption is generated; Based on the relevant parameters in the pre-encryption process, a core data key is generated, wherein each encrypted image corresponds to a core data key.
4. The information differentiation sharing method based on blockchain according to claim 3 is characterized in that: Preprocess the current image, including unified format, image segmentation and image rearrangement, including: Convert the current image to JPEG format; Perform image segmentation on the current image in JPEG format and divide it into M image blocks; The M image blocks are rearranged to obtain a rearranged image, and the original arrangement position permutation information matrix corresponding to the rearranged image is encrypted using a pseudo-random algorithm to obtain an image restoration sequence corresponding to the rearranged image.
5. The information differentiation sharing method based on blockchain according to claim 3 is characterized in that: The channel matrix corresponding to each color channel is filled and divided twice to obtain several square matrix blocks with a side length of N, including: The channel matrix corresponding to each color channel: Get the number of dimensions of the channel matrix; According to the side length parameter N, the channel matrix is padded with zeros so that the dimension of the channel matrix after zero padding is kN×kN; The zero-padded channel matrix is divided into k×k N×N square matrix blocks.
6. The information differentiation sharing method based on blockchain according to claim 5 is characterized in that: Based on the square matrix block corresponding to each channel matrix, Arnold mapping is performed to obtain the mapping matrix corresponding to each square matrix block, including: For each square matrix block corresponding to the channel matrix, the following formula is used for Arnold mapping: x n+1 =(ax n +by n )mod N, the n+1 (cx n +to n )mod N, Among them, (x n ,y n ) is the coordinate of the element in the square matrix block before mapping, (x n+1 ,y n+1 ) is the coordinate of the element in the square matrix block after mapping, N is the side length parameter of the square matrix block, mod N represents the modulo operation on the side length parameter N, a, d, c and d are the matrix mapping parameters of Arnold mapping, and satisfy c = 1, d = a × b + 1; Based on this, the mapping matrix corresponding to each square matrix block is obtained.
7. The information differentiation sharing method based on blockchain according to claim 6 is characterized in that: Based on the mapping matrix corresponding to each square matrix block, the encrypted image after pre-encryption is generated, including: The corresponding mapping matrix for each square matrix block is: According to the sequential numbering of the square matrix blocks, the mapping matrix corresponding to the square matrix block is processed to obtain the scrambled pixel encrypted image corresponding to the square matrix block. The processing method is performed using the following formula: P' (x,y) =(P (x,y) +i)mod256, Among them, P' (x,y) is the pixel value after pixel processing at the coordinate (x, y) in the mapping matrix, P (x,y) is the pixel value at coordinate (x, y) in the mapping matrix before pixel processing, and i is the sequential number of the square matrix block; Based on the scrambled pixel encrypted image corresponding to each square matrix block, the square matrix blocks are spliced according to the sequential numbers to obtain the channel encrypted image of the corresponding color channel; The channel encrypted images based on each color channel are fused into the encrypted image after the pre-encryption.
8. The information differentiation sharing method based on blockchain according to claim 7 is characterized in that: Generate the core data key based on the relevant parameters in the pre-encryption process, including: Get the dimension number of the channel matrix under each color channel, the sequence number corresponding to each square matrix block, the side length N of the square matrix block, the number of square matrix blocks k, and the matrix mapping parameters a and b of Arnold; Obtain an image restoration sequence and an image segmentation parameter M corresponding to the rearranged image; The core data key is generated based on the number of dimensions of the channel matrix under each color channel, the sequential number corresponding to each square matrix block, the side length N of the square matrix block, the number k of square matrix blocks, Arnold's matrix mapping parameters a, b, the image recovery sequence corresponding to the rearranged image, and the image segmentation parameter M.
9. The information differentiation sharing method based on blockchain according to claim 8 is characterized in that: The core data is image data. For each encrypted image, the user terminal decrypts the pre-encrypted core data using its core data key in the following manner: D1: retrieve the core data key corresponding to the encrypted image; D2: Separate the encrypted image into channels to obtain the encrypted image channel matrix corresponding to each color channel; D3: For each encrypted image channel matrix, according to the parameter N, the encrypted image channel matrix is divided into k×k N×N encrypted image matrix blocks; D4: For each encrypted image matrix block, the following formula is used for restoration: Among them, P (x,y) is the pixel value with coordinates (x, y) in the encrypted image matrix block after restoration, P' (x,y) is the pixel value with coordinates (x, y) in the encrypted image matrix block before restoration, i is the sequence number of the encrypted image matrix block, i∈[1,k 2 ],k 2 is the total number of encrypted image matrix blocks in each encrypted image channel matrix; D5: For the encrypted image matrix block after restoration, the following formula is used for inverse mapping: x n =d(x n+1 -is n +1)mod N, y n =-(bx n +1-y n +1)mod N, Among them, (x n ,y n ) is the coordinate of the element in the encrypted image matrix block after inverse mapping, (x n+1 ,y n+1 ) is the coordinate of the element in the encrypted image matrix block after inverse mapping, N is the side length parameter of the encrypted image matrix block, mod N represents the modulo operation on the side length parameter N, a and b are the matrix mapping parameters of Arnold mapping, and satisfy c=1, d=a×b+1; D6: splicing the encrypted image matrix blocks after inverse mapping according to the sequence number i to obtain the channel image to be restored, and removing the edge zero pixels of the channel image to be restored based on the dimension number of the channel matrix under the color channel to obtain the restored channel image; D7: Fuse the restored channel images of each channel to obtain the restored rearranged image, and use a pseudo-random algorithm to decrypt the image recovery sequence to obtain the original arrangement position permutation information matrix; D8: Segment the restored rearranged image according to the image segmentation parameter M to obtain M image blocks to be restored, and arrange and restore the M image blocks to be restored based on the original arrangement position permutation information matrix to obtain the decrypted image.
10. A differentiated information sharing system based on blockchain, characterized in that: include: A data terminal, used to execute step S1 in the blockchain-based information differentiation sharing method according to any one of claims 1 to 9; A blockchain system for executing steps S2-S5 in the blockchain-based information differential sharing method according to any one of claims 1 to 9; A user terminal, used to run the data decryption process in the blockchain-based differentiated information sharing method described in any one of claims 1 to 9, wherein the data decryption process includes: decrypting the secondary encrypted data by the user's private key and decrypting the pre-encrypted core data by its core data key.