Block chain fine granularity controllable rewriting method and editable block chain system

Abstract

The invention discloses a block chain fine granularity controllable rewriting method and an editable block chain system, and the method comprises the steps: decrypting an original message ciphertext through an attribute modification key of a modifier to obtain a decrypted original message, and obtaining a rewriting verification value according to the decrypted original message and a modification message; generating a modification signature according to the rewriting check value and the identity key of the modifier; and when the modified signature is valid, replacing the original message with the modified message and storing the modified signature. According to the method provided by the invention, the identity of the rewritten modifier and the attribute of the modifier providing the key are embedded into the modification signature, so that the identity of the rewritten user and the identity of the user providing the rewritten key can be tracked through the modification signature when the malicious rewritten user is tracked; therefore, the situation that malicious users leaking secret keys in a black box mode cannot be tracked is avoided, and the safety performance of the block chain is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain, and in particular relates to a blockchain fine-grained controllable rewriting method and an editable blockchain system. Background Art

[0002] As a decentralized distributed ledger technology, blockchain technology is known for its immutability and transparency, and is widely used in fields such as cryptocurrency, supply chain management, and smart contracts. However, the immutability of traditional blockchain has limitations in certain application scenarios, such as data privacy protection, regulatory compliance, and error correction. To address these issues, editable and accountable blockchains have emerged. While retaining the core advantages of blockchain, it adds the ability to modify data under certain conditions, and introduces a transparent audit and tracking mechanism to ensure that each modification behavior can be recorded and tracked, thereby enhancing the transparency and accountability of the system. This blockchain technology ensures data security and privacy protection through encryption and permission control, and is suitable for fields such as medical, financial, and legal fields that require flexibility and accountability.

[0003] Panwar et al. proposed a solution to track malicious modifiers in blockchain rewrites. However, their solution only tracks malicious users who perform malicious rewrites on their own; it does not take into account the leakage of secret keys. The solution only provides weak accountability, and modifiers who perform malicious rewrites on their own can be identified, but modifiers who leak secret keys in a black-box manner cannot be properly tracked. In other words, malicious modifiers may collude to obtain decryption boxes with similar keys and use them to subvert rewrite permissions in a readable blockchain without being identified.

[0004] Therefore, current blockchain rewriting methods are not very secure. Summary of the invention

[0005] The embodiments of the present invention provide a blockchain fine-grained controllable rewriting method and an editable blockchain system, which can solve the problem that the current blockchain rewriting method has low security.

[0006] In a first aspect, an embodiment of the present invention provides a blockchain fine-grained controllable rewriting method, the method comprising:

[0007] Decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, wherein the attribute modification key is generated according to the modifier's attribute;

[0008] Generate a rewrite check value based on the modified message and the decrypted original message;

[0009] Generate a modification signature according to the rewrite check value and the identity key of the modifier, wherein the identity key is generated according to the identity vector of the modifier, and the identity and attributes of the modifier can be determined through the modification signature;

[0010] Verify whether the modified signature is valid by rewriting the check value;

[0011] If the modified signature is valid, the original message is replaced with the modified message and the modified signature is saved.

[0012] In a second aspect, an embodiment of the present invention provides an editable blockchain system, the system comprising a plurality of blockchain nodes, each node comprising an encryption tracking module, a hash generation module, and a signature module;

[0013] The encryption tracking module is used to decrypt the original message ciphertext according to the attribute modification key of the modifier to obtain the decrypted original message, wherein the attribute modification key is generated according to the attribute of the modifier;

[0014] The hash generation module is used to generate a rewrite check value according to the modified message and the decrypted original message;

[0015] The signature module is used to generate a modified signature according to the rewrite check value and the identity key of the modifier, wherein the identity key is generated according to the identity vector of the modifier, and the identity and attributes of the modifier can be determined through the modified signature;

[0016] The signature module is also used to verify whether the modified signature is valid by rewriting the check value;

[0017] If the modified signature is valid, the blockchain node is used to replace the original message with the modified message and save the modified signature.

[0018] The beneficial effect of the embodiments of the present invention compared with the prior art is that: the method provided by the present invention embeds the identity and attributes of the modifier who performs the rewriting into the modification signature and the rewrite verification value, so that when tracking the user who maliciously rewrites, the identity of the rewriting user and the identity of the user who provides the rewriting key can be tracked through the modification signature, thereby avoiding the situation where malicious users who leak keys through black box methods cannot be tracked, thereby improving the security performance of the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of a scenario of an editable blockchain rewrite provided by an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of the structure of an editable blockchain system provided by an embodiment of the present invention;

[0021] Figure 3A schematic diagram of an implementation flow of an operation method of an editable blockchain provided by an embodiment of the present invention;

[0022] Figure 4 A flowchart for implementing a fine-grained controllable rewriting method of a blockchain provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0024] Figure 1 A schematic diagram of a scenario of editable blockchain rewriting provided by an embodiment of the present invention is shown.

[0025] For example, see Figure 1 , the editable blockchain allows the data owner (ie user) to calculate and access the policy A and the message signature The associated chameleon hash (h, r). The owner of the privilege that satisfies the access policy in the given hash (i.e., the modifier) ​​can find an arbitrary collision to modify the hash object in the blockchain (i.e., the original message m) without changing its hash value. The modifier also needs to generate a valid modification signature Linking a Chameleon hash to its producer. If a malicious modifier does not personally perform a malicious rewrite, but instead leaks his secret key (e.g. in a device like a decryption box), the central authority can trace the malicious user who contributed the secret key to the decryption box. Thus, editable blockchains support modifiability and accountability at a fine-grained level.

[0026] Figure 2 What is shown is a schematic diagram of the structure of an editable blockchain system provided by an embodiment of the present invention.

[0027] As an example, see Figure 2 , the editable blockchain system can be used for transaction-level blockchain rewriting. Even if an editable transaction (i.e., message) is rewritten based on the rewriting method provided by the present invention, the blockchain remains unchanged. Figure 2 , similar to the traditional immutable blockchain, the i-th node B in the editable blockchain system i The block header includes the hash minutes of the previous node, the timestamp TS recording the time of the additional block i , the Merkle root MR of four transactions accumulated in the i-th node i and consensus proof π i . Where π i It can be a random number of some blockchain difficulty or the signature of a qualified shareholder in the blockchain.

[0028] For example, the editable blockchain may include two types of transactions: mutable transactions and immutable transactions. Each node can perform mutable and immutable transactions. Figure 2 , the Merkle root of the i-th node accumulates four transactions, transaction m i,2 、m i,3 、m i,4 It is an immutable transaction that applies the traditional collision-resistant hash function h. Transaction m i,1 is a mutable transaction associated with access policy A. i,1 Need to be rewritten as m′ i,1 When the attribute S of the modifier satisfies the access policy A, the modified signature can be generated by the rewriting method provided by the present invention without affecting the node B. i Calculate any collision r' in the case of hash digest. Then broadcast the modified message and rewrite the checksum (m' i,1 ,r′), all participants verify the correctness of the rewritten checksums, and if they are valid, use the new message and rewritten checksum pair (m′) i,1 , r′) updates the local copy of the blockchain.

[0029] Specifically, see Figure 2 , the execution subject in the editable blockchain system can be each blockchain node, which can be classified into users 201, central authorities 202 and modifiers 203. Each node can be provided with components such as encryption tracking module 210, hash generation module 220, signature module 230 (only shown in modifier 203 and central authorities 202). Each node can perform operations such as data upload, data modification, and identity authentication on the editable blockchain system by calling these modules.

[0030] For example, the modifier 203 can call the encryption tracking module 210 to decrypt the original message ciphertext according to its own attribute modification key to obtain the decrypted original message, call the hash generation module 220 to generate a rewrite verification value according to the modified message and the decrypted original message, and call the signature module 230 to generate a modified signature according to its own identity key and the decrypted original message; thereby modifying the data.

[0031] Exemplarily, the encryption tracing module 210 can operate based on the Adaptively Secure Attribute-Based Rncryption for Traitor Tracing (ABTT), the hash generation module 220 can operate based on the Chameleon-Hashes with Ephemeral Trapdoors (CHET), and the signature module 230 can operate based on the Identity-Based Signature (IBS).

[0032] In an editable blockchain system, the two nodes, the user 201 who uploads the data and the central authority 202, are completely trustworthy, while the modifier 203 and the outsider (i.e., the blockchain user who cannot modify the blockchain object) are not trustworthy. The attacks performed by the outsider can be covered by the types of attacks that the malicious modifier can perform. In practical applications, the modifier 203 may waste his rewrite permission to launch the following attacks:

[0033] Resistance to collision attacks: A malicious modifier whose attributes do not match the access policy may attempt to modify the user associated with the access policy.

[0034] Accountability Attacks: Malicious modifiers may attempt to overwrite user-provided information by imitating other modifiers; and / or encapsulate their keys in a black-box manner to obtain a similar decryption box so that other users can use the decryption box to anonymously modify information on the chain, thereby undermining the accountability of the editable blockchain.

[0035] Inheriting from the current blockchain rewriting method, the editable blockchain provided by the present invention also needs to meet the following security requirements:

[0036] Complete indistinguishability: For adversarially chosen messages and public keys, the outputs of hashing and collision finding are indistinguishable. In the black-box accountability of current blockchain rewrite methods, this security requirement focuses only on hash values. In the black-box accountability provided by the present invention, it is required that hash value and signature pairs cannot be distinguished from hashing and collision finding.

[0037] Uniqueness: Uniqueness requires that it is difficult to find different checksums that produce the same hash value for an adversarially chosen message and public key.

[0038] Figure 3 The figure shows a schematic diagram of the implementation flow of an operation method of an editable blockchain provided by an embodiment of the present invention. The method 300 can be applied to the above-mentioned editable blockchain system, and the method 300 can include steps S301-S306, and each step is described below.

[0039] S301, the central authority initializes the system and generates initial parameters.

[0040] In one example, each module in the central authority can simultaneously run the group generator to generate initial parameters, that is, the central authority executes the parameter generation algorithm: PCHA.ParGen(1 k )→pp.

[0041] For example, the central authority may run a group generator and input a security parameter k, k∈N, where N is a natural number. Then run the group generator G(1 k ) generates and returns the initial parameters: Among them, p is a common parameter, is the elliptic curve group, is an elliptic curve group that depends on parameter T, T also represents the identity space, H is the initial hash function, e is a prime number in the bilinear pairing, and G is the elliptic curve group The generator of , h is the initial hash value, and pp is the implicit input of all algorithms.

[0042] S302, the central authority generates a master public key and a master secret key.

[0043] In some embodiments, the central authority executes a setup algorithm: PCHA.Setup(n,t)→(mpk,msk) to generate a master public key mpk and a master secret key msk.

[0044] For example, the master public key may satisfy: mpk←(mpk ABTT ,pk CHET ,mpk IBS ), where mpk ABTT To track the master public key, pk CHET is the hash public key, mpk IBS Identifies the master public key.

[0045] For example, the master key may satisfy: msk←(msk ABTT ,sk CHET ,msk IBS ), where msk ABTT To track the master key, sk CHET For hashed private key, msk IBS Identifies the master key.

[0046] In one possible implementation, the encryption tracking module can execute its internal setup algorithm: ABTT.Setup(n,t)→(mpk ABTT ,msk ABTT ) Generate tracking master public key mpk ABTTand tracking master key msk ABTT ; where n is the number of users and t is the collusion limit. The hash generation module can execute its internal key generation algorithm: (sk CHET ,pk CHET )←CHET.KeyGen(pp CHET ), generate a hash public key and a hash private key; where pp CHET It is an implicit input to the key generation algorithm in the hash generation module. It can be executed by the signature module to perform its internal setup algorithm: (mpk IBS ,msk IBS )←IBS.Setup(pp IBS ), generate the identity master public key mpk IBS and logo msk IBS ; Among them, pp IBS Sets the implicit input of the algorithm for the signature module.

[0047] In one example, the encrypted tracking module can run the generation algorithm in the collision-resistant fingerprint algorithm: FC.Gen(1 k ,n,t), according to the security parameter k, the number of users n, and the collusion bound t, we obtain (Γ,tk), that is, the trapdoor key tk and the identity space Γ; where Γ={0,1} l , which includes {0,1} l The n words in ; and l>0, l is the dimension of the identity space. Generate the tracking master public key and generate the tracking master key based on the trapdoor key and the identity space.

[0048] Exemplarily, tracking the master public key satisfies:

[0049] mpk ABTT =(G1,h1,...,h l ,H1,H2,T1,T2,D1,D2,D3)

[0050] D1 is the first hash function, D2 is the second hash function, and D3 is the third hash function, and the three satisfy different mapping relationships.

[0051] in:

[0052]

[0053] D2:{0,1} * →Z p

[0054]

[0055] Z p is a set of non-negative integers less than p, l m For message space Dimensions;

[0056] in:

[0057] H1=a1h

[0058] H2=a2h

[0059] T1=(d1a1+d3)e(G,h)

[0060] T2=(d2a2+d3)e(G,h)

[0061] h i =α i h

[0062] G1=αG

[0063] a1, a2, α i , α is a set of non-zero integers less than or equal to p The random number selected from the set Z, i∈{1,...,l}; d1, d2, d3 are random numbers selected from the set Z p A random number selected from .

[0064] Exemplarily, tracking the master key satisfies:

[0065] msk ABTT =(Γ,tk,α,a1,a2,b1,b2,d1G,d2G,d3G)

[0066] Among them, b1 and b2 are from the set A random number selected from .

[0067] In one example, the hash generation module may generate a hash public key and a hash private key based on an asymmetric key encryption algorithm.

[0068] For example, the hashed public key satisfies:

[0069] pk CHET =Sε,N1,e,D4,D6

[0070] Sε={KeyGen,Enc,Dec} is a symmetric key encryption scheme, including key generation KeyGen, encryption Enc, decryption Dec and other algorithms. N1 and the following p1, q1 are based on the asymmetric encryption algorithm: (N1,p1,q1,·,·)←RSAKeyGen(1 k ). e>N′ is a prime number in the bilinear pair, and N′ is also based on the asymmetric encryption algorithm: N′=max r {(N,·,·,·,·)←RSAKeyGen(1 k; r)}, r is a random number. D4 and D6 are the fourth and sixth hash functions respectively.

[0071] in:

[0072]

[0073] is a set of non-zero integers less than or equal to N1, represents the square of a non-negative integer less than p.

[0074] For example, the hashed private key satisfies:

[0075] ed1′≡1mod(p1-1)(q1-1)

[0076] Among them, mpk ABTT =d1′ is the hash private key.

[0077] In one example, the signature module can be obtained from the collection A random number x is selected as the identification master key. The identification master public key can satisfy: msk IBS =h x .

[0078] S303, the central authority generates the user's identity key based on the master key and the user's identity vector.

[0079] In one possible implementation, a central authority could run a user key generation algorithm: Generate an identity key for each user; where, is the user's identity vector, The user's identity key.

[0080] In one example, the signing module can call its internally set key generation algorithm: Generate a user's identity key.

[0081] Exemplarily, the user's identity key satisfies the following formula:

[0082]

[0083] in, is the user's identity key, D1 is the first hash function, and x is a non-zero integer set less than or equal to p. The one selected as the identification master key msk IBS A random number, x is also a parameter in the master key msk.

[0084] S304, the central authority generates the modifier's identity key and attribute modification key according to the master key, the modifier's attributes, and the modifier's identity vector.

[0085] In some embodiments, the central authority may run a probabilistic modifier key generation algorithm: Generate the modifier's identity key and attribute modification key, where is a modifier's identity vector, Γ is the identity space; S is a set of attributes possessed by the modifier, S∈Ω, Ω={0,1}* is the attribute universe.

[0086] In a possible implementation, similarly, the signature module calls its internally set key generation algorithm to generate the modifier's identity key

[0087] In one possible implementation, the cryptographic tracking module can run an algorithm Thus generating in, Modifies the key for the modifier's property.

[0088] Exemplarily, the attribute modifier key satisfies:

[0089]

[0090] Among them, sk0 is the first modified subkey, sk y is the second modified subkey, sk′ is the third modified subkey, It is the fourth modified subkey.

[0091] In one example, the encryption tracking module may generate an attribute modification key through the following steps S3051-S3054.

[0092] S3041, select random numbers r1, r2∈Z p , calculate the first modified subkey: sk0 = (sk 0,1 ,sk 0,2 ,sk 0,3 )=(b1r1h,b2r2h,(r1+r2)h).

[0093] S3042, select the random number σ corresponding to the yth attribute of the modifier y ∈Z p , calculate the second modified subkey:

[0094] sk y =(sk y,1 ,sk y,2 ,-σ y G)

[0095]

[0096] Among them, z=1,2, y∈S, S is a set of attributes of the modifier.

[0097] S3043, select a random number σ′∈Z p , calculate the third modified subkey:

[0098] sk′=(sk1′,sk2′,d3G·-σ′G)

[0099]

[0100] Among them, σ z =σ y =1,2.

[0101] S3044, determine the set W according to the identity vector of the modifier b , according to the set W b Calculate the fourth modified subkey:

[0102]

[0103] Where b = 0, 1, the identity vector of the modifier is a row vector, W b ∈{1,...,l) are all i = the set of indices i of b, w i is the i-th column element in the modifier's identity vector.

[0104] S305, the user generates the original message ciphertext, message hash value, upload verification value and message signature according to the master public key, the user's identity key, the original message, and the access policy.

[0105] In one possible implementation, the user who owns the data (i.e., message m) You can run a probabilistic hashing algorithm: Generate message hash value h m , upload verification value r and the message signature of this message upload

[0106] Exemplarily, the message hash value satisfies: m ←(h CHET ,c ABTT ); upload verification value satisfies r←r CHET ; The message signature satisfies:

[0107] In one example, the hash generation module can run its internal hash algorithm (h CHET ,r CHET ,etdCHET )←CHET.Hash(pk CHET ,m), according to the hash public key pk CHET 、The first group of elements h of the hash value generated by the original message m CHET , upload verification value r = r CHET 、Key parameter etd CHET The encryption tracking module can run its internal encryption algorithm c ABTT ←ABTT.Enc(etd CHET ,A), according to the key parameter etd CHET The access policy A of message m encrypts the original message to generate the original message ciphertext c ABTT The signature module can run its internal signature algorithm: Generate the message signature for this message upload based on the original message, the first group of elements of the message hash value, the upload check value, the original message ciphertext and the user's identity key

[0108] Specifically, the hash generation module can generate the first group element h of the message hash value through steps S401-S405 in the following method 400: CHET , upload verification value r = r CHET , match the hashed private key etd CHET The encryption tracking module can generate the original message ciphertext c through steps S405-S409 in the following method 400 ABTT The signature module can generate a message signature by following step S410 of method 400:

[0109] Optionally, the encryption tracking module can encrypt the original message based on the cryptographic accumulator to maintain a constant key and ciphertext overhead, thereby reducing costs and optimizing performance.

[0110] S306, verify whether the message hash value, upload checksum and message signature are valid.

[0111] In some embodiments, if the message hash value, upload verification value, and message signature are all valid, the original message ciphertext can be saved in the editable blockchain system.

[0112] In one possible implementation, the deterministic verification algorithm can be run by either type of node: Output 1 if the message hash value and check value are bits of a valid hash and the message signature is a valid signature, otherwise output 0.

[0113] In one example, the signature module may perform its internal verification algorithm: The hash generation module executes its internal verification algorithm: CHET.Verify(pk CHET ,m,h CHET ,r CHET ), perform an XOR operation on the outputs of these two algorithms: Get the final output result.

[0114] Specifically, the hash generation module can verify whether the uploaded checksum and the message hash value meet the following conditions: h1=D4(m,N1,N2)r1″ e mod N1, h2=D5(m,N1,N2)r2″ e mod N2; where the upload check value r = (r1″, r2″), the message hash value h m =(h1,h2,N2,D6,c ABTT ,c Sε ). If all conditions are met, it returns 1. The signature module can verify whether the message signature meets the following conditions: v = D2 (m, h1, h2, r1", r2", c ABTT ,c Sε ,R′), where Returns 1 if all conditions are met.

[0115] In other embodiments, if any parameter is invalid, the upload message is abandoned.

[0116] Optionally, if the message uploaded by the user needs to be modified, for example, when the user uploads illegal information, the blockchain fine-grained controllable rewriting method provided by the present invention can be executed, that is, steps S307 and S308.

[0117] S307, the modifier generates a rewrite check value and a modified signature according to the master public key, the modifier's identity vector, the modifier's identity key, the attribute modification key, the original message, the modified message, the message hash value, the upload check value and the message signature.

[0118] In one possible implementation, the decorator can run a probabilistic adaptation algorithm: The modifier uses the master public key mpk and the identity vector of the modifier Modifier's identity key Attribute Modifier Key Original message m, modified message m′, message hash value h m , upload the verification value r and message signature Generate rewrite check value r′ and modify signature

[0119] Optionally, before running the probabilistic adaptation algorithm, the decorator can also run a validation algorithm: Verify whether the message signature, message hash value and uploaded checksum are valid. If valid, run the probability adaptation algorithm.

[0120] In one example, the encryption tracking module can run its internal decryption algorithm: Modify the key according to the modifier's properties The original message ciphertext c ABTT Decryption obtains the decrypted original message etd′ CHET The hash generation module runs its internally configured adaptation algorithm: r′ CHET ←CHET.Adapt(sk CHET ,etd CHET ,m,m′,h CHET ,r CHET ), according to the uploaded verification value r = r CHET , the first element h of the message hash value CHET , modified message m′, original message m, decrypted original message etd′ CHET and hashed private key sk CHET Generate rewrite check value r′ CHET The signature module runs its internally configured signature algorithm: According to the modified message m', rewrite the check value, r' CHET , the first element h of the message hash value CHET , the original message ciphertext generates a modified signature.

[0121] Specifically, the encryption tracking module may execute its internal decryption algorithm through steps S501-S502 in the following method 500. The hash generation module may execute its internal adaptation algorithm through step S503 in the method 500. The signature module may execute its internal signature algorithm through step S504 in the method 500.

[0122] S308, verify whether the rewritten check value and the modified signature are valid.

[0123] In one possible implementation, the verification algorithm can be run by either type of node: The modified signature is verified by rewriting the checksum. If the algorithm outputs 1, it means the verification is passed, and if it outputs 0, it means the verification is not passed. If the verification is passed and the modified signature is valid, the modified message can be used to replace the original message and the modified signature can be saved.

[0124] In one example, similarly, the hash generation module and the signature module may verify the modified signature by rewriting the check value through step S505 in the method 500 described below.

[0125] In another possible implementation, if the verification fails, the modification of the message may be stopped.

[0126] If malicious modification of information is found, step S309 can be performed to track the malicious modifier who directly modifies the information and / or leaks the key through a black box method.

[0127] S309, the central authority determines the identity and attributes of the malicious modifier based on the decryption box and the master key.

[0128] In one possible implementation, the central authority can run a deterministic tracing algorithm, PCHA.Trace(msk,D)→S FC , determine the identity and attributes of the malicious modifier based on the key-like decryption box D and the master key, and output the union S of the identity vector of the modifier who made the malicious modification and the attributes of the node that maliciously provided the key FC .

[0129] The method provided by the present invention embeds the identity of the modifier who performs the rewriting and the attributes of the modifier who provides the key into the modified signature, so that when tracking the malicious rewriting user, the identity of the rewriting user and the identity of the user who provides the rewriting key can be tracked through the modified signature, thereby avoiding the situation where the malicious user who leaks the key through the black box method cannot be tracked, and the security performance of the blockchain is improved. Furthermore, the cryptographic accumulator is used when the encryption tracking module generates the attribute modification key and encrypts the original message, so that the encryption tracking module enjoys a constant key and ciphertext overhead; compared with the traditional method, the encryption tracking module only needs 2 additional group elements when generating the key and only needs 6 additional group elements when generating the ciphertext, which can reduce the computational cost.

[0130] Method 400 is a method for generating a message signature, an upload verification value, and a message hash value provided by an embodiment of the present invention. Method 400 can be applied to a user node in an editable blockchain system. Method 400 may include steps S401-S410, and each step is described below.

[0131] S401, the hash generation module is based on the asymmetric encryption algorithm: (N2, p2, q2, ·, ·) ← RSAGen (1 k ), generate key parameters N2, p2, q2. And generate the fifth hash function according to the key parameter N2: Wherein, D5 is the fifth hash function, is a set of non-zero integers less than or equal to N2.

[0132] S402, the hash generation module generates a non-zero integer set less than or equal to N1 Select a random number r1″ from From the collection Select a random number r2″ from Calculate the hash value h1=D4(m,N1,N2)r1″ based on the random number r1″ e mod N1 and hash value h2 = D5(m,N1,N2)r2" e mod N2. The upload checksum value r = r CHET =(r1″, r2″).

[0133] S403, the hash generation module calculates the matching hash private key d2′ according to the key parameters p2 and q2, and the matching hash private key d2′ satisfies: etd2′≡1mod(p2-1)(q2-1).

[0134] S404, the hash generation module selects a random number u″, u″∈{0,1} k , based on the key generation algorithm in the symmetric key encryption algorithm: Sε.KeyGen(1 k ) Get the key parameter k Sε , based on the encryption algorithm in the symmetric key encryption algorithm: Sε.Enc(k Sε ,d2′) Generate key parameter c Sε ; The first element h of the message hash value CHET =(h1,h2,N2,D6,,c Sε )

[0135] S405, the hash generation module runs the function: encode(k Sε ,u″) to obtain the key parameter K, where encode is a Sε ,u″) is mapped to the injective function of M, where M is the message space; K = etd CHET =mpk,n.

[0136] S406, the encryption tracking module parses the access policy to obtain A = (M, π), where M is an access structure matrix with n1 rows and n2 columns, and π is a vector.

[0137] S407, the encryption tracking module selects an initial access value m0 from the access structure matrix, m0∈M; performs an XOR operation on the original message and the initial access value to obtain an encrypted access value m1,

[0138] S408, the encryption tracking module selects a random number And calculate , and get c i′ =(c i′,1 ,c i′,2 ,c i′,3 ). Where i′=1,...,n1,Mi′,j Represents the element in the i′th row and jth column of the access structure matrix M, where u′=1, 2, 3.

[0139] S409, the encryption tracking module selects a random number ψ1∈{1,...,n}, calculate: Then get the original message ciphertext c ABTT , thus obtaining the message hash value: h m =(h1,h2,N2,D6,c ABTT ,c Sε ).

[0140] The original message ciphertext satisfies: in:

[0141] S410, the signature module selects another generator from the elliptic curve group and random numbers Calculation: R = e(G′, h m )k′, So as to obtain the message signature

[0142] Figure 4 The flowchart shown is a method for implementing a fine-grained controllable rewriting method of a blockchain provided by an embodiment of the present invention. As an example but not a limitation, method 500 can be applied to the above-mentioned editable blockchain system, and method 500 may include steps S501-S505. Each step is described below.

[0143] S501, decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message.

[0144] In one example, the attributes of the modifier, that is, the attribute set S in the modified attribute modification key generated by the modifier, satisfies the access policy A=(M,π) of the original message ciphertext, then there exists a constant set {γ i} i∈{1,...,l} ,satisfy Among them, M i To access the i-th row vector in the structure matrix, I = {1,…, l}.

[0145] The encrypted tracking module can be calculated in sequence:

[0146]

[0147] Here, π(·) represents a continuous multiplication operation, and its result is a number in the range [0, S]. When i=i′, c i,u′ =c i′,u′ .

[0148] Then calculate:

[0149]

[0150] Where b = w ψ , f i The formula is: Medium i The coefficient of. Since l≥|W b |, and ψ1∈{1,...,l}∩W b , then f(x) also satisfies:

[0151] Finally, perform an XOR operation on m1 and m0 to obtain the decrypted original message K′=etd′ CHET =m.

[0152] S502, regenerate the encrypted original message according to the decrypted original message, and verify whether the encrypted original message is the same as the ciphertext of the original message.

[0153] In one possible implementation, you can run the function encode -1 (K′) obtains (k′ Sε ,u″′), and through the random numbers s1′,s2′ and the sixth hash function: (s1′,s2′)←D6(u″′,A) to get the encrypted original message.

[0154] In one example, if the encrypted original message is the same as the original message ciphertext, the subsequent steps can be performed.

[0155] In another example, if the two are different, the modification of the original message may be stopped.

[0156] S503, generating a rewrite check value according to the modified message and the decrypted original message.

[0157] In one example, the hash generation module can be based on a decryption algorithm in a symmetric encryption algorithm: Sε.Dec(k′ Sε ,c Sε ) obtains the key parameter d2″; if d2″ does not exist, that is, d2″=⊥, the modification of the original message can also be stopped and ⊥ can be returned.

[0158] In an example, the hash generation module may calculate the first original check parameter and the second original check parameter according to the original message, calculate the first modified check parameter and the second modified check parameter according to the modified message; and then calculate the rewrite check value according to the four parameters.

[0159] Exemplarily, the rewrite check value may satisfy the following formula:

[0160] r′=(r1′,r2′)

[0161]

[0162]

[0163] Where r′=r′ CHET To rewrite the checksum value, y1=x1r1″ e , x1 is the first original verification parameter, x2 is the second original verification parameter; x1′ is the first modified verification parameter, x2′ is the second modified verification parameter, and d1′ is the hash private key.

[0164] in:

[0165]

[0166] S504, generating a modified signature according to the rewrite check value and the identity key of the modifier.

[0167] Exemplarily, the modified signature may satisfy the following formula:

[0168]

[0169] v2=D2(m′,h1,h2,r1′,r2′,c ABTT ,c Sε ,R)

[0170]

[0171] in, Signature for modification.

[0172] S505, verifying whether the modified signature is valid by rewriting the check value.

[0173] In one example, the validity of the modified signature can be verified by determining whether the rewritten check value satisfies the modification verification model. If valid, the original message can be replaced with the modified message and the modified signature of the message rewrite can be saved.

[0174] Exemplarily, the modified verification model may satisfy the following formula:

[0175]

[0176] In another example, if the verification fails, the message rewriting can be stopped and ⊥ is returned.

[0177] Optionally, when a malicious rewriting of a message is discovered, the following step S506 may be performed to track the identity and attributes of the malicious modifier.

[0178] S506: Track the identity of the modifier who performs the malicious modification and the attributes of the key provider who provides the attribute modification key according to the modification signature corresponding to the malicious rewriting information.

[0179] Specifically, the central authority can track down the malicious modifier through the following steps S5061-S5065.

[0180] S5061, re-encrypt the malicious rewriting message to obtain an encrypted malicious rewriting message.

[0181] Exemplarily, the encryption tracking module can run a re-encryption algorithm to obtain an encrypted malicious rewritten message.

[0182] Specifically, the re-encryption algorithm in the encryption tracking module is similar to the encryption algorithm, except that the parameters are generated The method is different. When b = 0, keep m1 ≠ 0 unchanged; when b = 1, set m1 = 0. Calculate based on the modified value of m1 Thus, the encrypted malicious rewritten message is obtained.

[0183] S5062, decrypt the encrypted malicious rewriting message by using a decryption box to obtain a decrypted malicious rewriting message.

[0184] Specifically, D(·) is a key-like decryption box, and all attribute sets D that satisfy the access policy can be entered into the decryption box D(·) S To derive multiple attribute decryption boxes D'. The encrypted malicious rewriting message can be input into the decryption box D(·) to obtain the decrypted malicious rewriting message.

[0185] S5063, comparing the decrypted malicious rewritten message with the modified message in the message space to find the modified message provided by the malicious modifier.

[0186] Exemplarily, a user key generation algorithm similar to step S303 of the above method 300 may be run: According to the master public key mpk, maliciously rewrite the message m * , modified message m′, rewrite check value r of malicious rewrite message * , modify signature and the message hash value h m * Generate the identity key corresponding to the malicious rewritten message Then run The algorithm generates the rewrite check value r of the malicious rewrite message through the attribute decryption box D′ * , modify signature and the message hash value h m *, the master public key, maliciously rewrite the message m * , modified message m′, rewrite check value r of malicious rewrite message * , modify signature and the message hash value h m * Input into the decryption box D(·) to obtain the rewrite check value and modified signature of the modified message Then run the verification algorithm: To verify whether the modified signature of the modified message is valid. If the algorithm outputs 1, it is determined that the modified message and the malicious rewritten message match, and the modified signature is generated by a malicious modifier.

[0187] S5064, determining the identity of the malicious modifier according to the modified signature corresponding to the modified message provided by the malicious modifier.

[0188] By modifying the signature, we can get the identity vector of the malicious modifier, and get the identity of the malicious modifier who directly made the modification.

[0189] S5065, based on a fingerprint algorithm with collision resistance, the attribute of the malicious key provider is obtained according to the trapdoor key and the identity vector of the malicious modifier.

[0190] Exemplary, collision-resistant fingerprint algorithm The attributes of the malicious key provider can be obtained based on the trapdoor key and the identity vector of the malicious modifier.

[0191] The method provided by the present invention embeds the identity of the modifier who performs the rewriting and the attributes of the modifier who provides the key into the modification signature, so that when tracking the user who maliciously rewrites, the identity of the rewriting user and the identity of the user who provides the rewriting key can be tracked through the modification signature, thereby avoiding the situation where the malicious user who leaks the key through the black box method cannot be tracked, thereby improving the security performance of the blockchain.

[0192] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0193] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification.

[0194] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0195] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, any modifications made without departing from the concept of the present invention should be deemed to belong to the protection scope of the present invention.

Claims

1. A fine-grained controllable rewriting method for blockchain, characterized in that: The method is applied to an editable blockchain system, and the method includes: Decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, wherein the attribute modification key is generated according to the attribute of the modifier; Generate a rewrite check value according to the modified message and the decrypted original message; generating a modification signature according to the rewrite check value and the identity key of the modifier, wherein the identity key is generated according to the identity vector of the modifier, and the identity and attributes of the modifier can be determined through the modification signature; Verifying whether the modified signature is valid by using the rewrite check value; If the modified signature is valid, the modified message is used to replace the original message, and the modified signature is saved.

2. The method according to claim 1, characterized in that: Before decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, the method further includes: Generate master public key and master secret key; Generate a user identity key according to the master key and the user identity vector; Generate the identity key of the modifier according to the identity vector of the modifier and the master key; and generate the attribute modification key of the modifier according to the master key, the attribute of the modifier and the identity vector of the modifier; Encrypt the original message according to the master public key, the user's identity key, and the access policy of the original message to obtain the original message ciphertext, and generate a message hash value and a message signature and upload verification value for this message upload; Verify whether the message hash value, the message signature and the upload checksum value are valid; If the message hash value, the message signature and the upload verification value are all valid, the original message ciphertext is saved.

3. The method according to claim 1 or 2, characterized in that: The attribute modifier key satisfies the following formula: in, is the modifier's attribute modification key, sk0 is the first modification subkey, sky is the second modification subkey, sk′ is the third modification subkey, is the fourth modifier subkey, is the identity vector of the modifier, and S is a set of attributes possessed by the modifier; The first modified subkey satisfies the following formula: sk0=(sk0,1,sk0,2,sk0,3)=(b1r1h,b2r2h,(r1+r2)h) Among them, h is the initial hash value, b1 and b2 are both non-zero integer sets less than or equal to p. The random numbers selected in, r1, r2, are all random numbers selected from the non-negative integer set Zp less than or equal to p, and p is a public parameter; The second modified subkey satisfies the following formula: sky=(sky,1,sky,2,-σyG) Wherein, z=1,2, D1, D2, D3 are the first hash function, the second hash function, and the third hash function respectively, σy is the random number corresponding to the yth attribute of the modifier selected from the non-negative integer set Zp, G is the generator of the elliptic curve group, a1, a2 are the random numbers selected from the non-zero integer set Zp, A random number selected from The third modified subkey satisfies the following formula: sk′=(sk1′,sk2′,d3G·-σ′G) Wherein, d1, d2, d3, σ′ are all random numbers selected from the non-negative integer set; The fourth modified subkey satisfies the following formula: Wherein, b=0, 1, Wb is the set of all indexes i satisfying wi=b, the identity vector is a row vector, and wi is the i-th column element in the identity vector of the modifier.

4. The method according to claim 1 or 2, characterized in that: The modifier's identity key satisfies the following formula: in, is the identity key of the modifier, is the identity vector of the modifier, D1 is the first hash function, x is the identification master key, and the master key includes the identification master key.

5. The method according to claim 2, characterized in that: The message hash value satisfies the following formula: hm=(h1,h2,N2,D6,cABTT,cSε) Wherein, hm is the message hash value, h1 and h2 are two hash values ​​calculated based on the original message, N2 is a key parameter generated based on an asymmetric encryption algorithm, D6 is a sixth hash function, cABTT is the original message ciphertext, and cSε is a key parameter generated based on a symmetric encryption algorithm; The message signature satisfies the following formula: v=D2(m,h1,h2,r1,r2,cABTT,cSε,R) R=e(G′,hm)k′ in, is the message signature, D1, D2 are the first hash function, the second hash function, x is a non-zero integer set less than or equal to p A random number selected from, p is a public parameter; r1 is a non-zero integer set less than or equal to N1 The random number selected in the asymmetric encryption The third key parameter generated by the algorithm; r2 is a non-zero integer set less than or equal to N2 A random number selected from , e is a prime number in the bilinear pairing, G′ is another generator of the elliptic curve group, and k′ is a random number selected from the set Zp of non-negative integers less than or equal to p; The upload verification value satisfies the following formula: r=(r1, r2).

6. The method according to claim 5, characterized in that The encrypting the original message according to the master public key, the user's identity key, and the access policy of the original message to obtain the original message ciphertext includes: Parsing the access strategy to obtain an access structure matrix; Selecting an initial access value from the access structure matrix; Performing an XOR operation on the original message and the initial access value to obtain an encrypted access value; The original message ciphertext is generated based on a cryptographic accumulator according to the encrypted access value, the access structure matrix, the initial access value, the master public key, and the user's identity key.

7. The method according to claim 6, characterized in that The modified signature satisfies the following formula: v2=D2(m′,h1,h2,r1′,r2′,cABTT,cSε,R) in, is the modified signature; r′=(r1′, r2′), r′ is the rewrite verification value.

8. The method according to claim 7, characterized in that The generating of the rewrite check value according to the modified message and the decrypted original message comprises: Calculate a first original verification parameter and a second original verification parameter according to the decrypted original message; Calculating a first modification check parameter and a second modification check parameter according to the modification message; Calculating the rewrite check value according to the first original check parameter, the second original check parameter, the first modified check parameter, and the second modified check parameter; The rewrite check value satisfies the following formula: Among them, y1=x1r1″e, y2=x2r2″e, x1 is the first original verification parameter, x2 is The second original check parameter; x1 is the first modified check parameter, and x2 is the second modified check parameter Parameters, d1 is the hashed private key, and d2 is the private key that matches the hashed private key.

9. The method according to claim 1, characterized in that: If malicious rewriting of information is found, the method further includes: Parsing the malicious rewriting information using a decryption box to obtain a modified signature corresponding to the malicious rewriting information; The identity of the modifier who performs the malicious modification and the attributes of the key provider who provides the attribute modification key are tracked according to the modification signature corresponding to the malicious rewriting information.

10. An editable blockchain system, characterized in that: It includes a variety of blockchain nodes, each of which includes an encryption tracking module, a hash generation module, and a signature module; The encryption tracking module is used to decrypt the original message ciphertext according to the attribute modification key of the modifier to obtain the decrypted original message, wherein the attribute modification key is generated according to the attribute of the modifier; The hash generation module is used to generate a rewrite check value according to the modified message and the decrypted original message; The signature module is used to generate a modification signature according to the rewrite check value and the identity key of the modifier, wherein the identity key is generated according to the identity vector of the modifier, and the identity and attributes of the modifier can be determined through the modification signature; The signature module is also used to verify whether the modified signature is valid through the rewrite check value; If the modified signature is valid, the blockchain node is used to replace the original message with the modified message and save the modified signature.

Images