Blockchain fine-grained controllable rewriting method and editable blockchain system

Abstract

The application discloses a kind of blockchain fine-grained controllable rewriting method and editable blockchain system, the method includes: by the attribute of modifier modification key pair original message cipher text is decrypted to obtain the decrypted original message, according to the decrypted original message and modification message to obtain rewrite check value;According to rewrite check value and the identity key of modifier generation modification signature;When modification signature is valid, replace original message with modification message and save modification signature.The method provided by the application embeds the identity of the modifier who performs rewriting and the attribute of the modifier who provides the key into the modification signature, so that when tracking the user of malicious rewriting, the identity of the user of rewriting and the identity of the user who provides the rewriting key can be tracked through the modification signature, thereby avoiding the case that the malicious user who leaks the key through a black box method cannot be tracked, and improving the security performance of the blockchain.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain technology, and specifically relates to a blockchain fine-grained controllable rewriting method and an editable blockchain system. Background Art

[0002] Blockchain, a decentralized distributed ledger known for its immutability and transparency, is widely used in fields such as cryptocurrency, supply chain management, and smart contracts. However, the immutability of traditional blockchains presents limitations in certain application scenarios, such as data privacy, regulatory compliance, and error correction. To address these issues, editable and accountable blockchains have emerged. While retaining the core advantages of blockchain, they add the ability to modify data under specific conditions and introduce transparent auditing and tracking mechanisms to ensure that every modification is recorded and tracked, thereby enhancing system transparency and accountability. This blockchain technology, through encryption and permission control, ensures data security and privacy, making it suitable for fields requiring flexibility and accountability, such as healthcare, finance, and law.

[0003] Panwar et al. proposed a solution for tracking malicious modifiers during blockchain rewrites. However, their solution only tracks malicious users who perform malicious rewrites themselves; it does not account for the leakage of secret keys. This solution provides only weak accountability: modifiers who perform malicious rewrites themselves can be identified, but modifiers who leak secret keys in a black-box manner cannot be properly tracked. In other words, malicious modifiers could collude to obtain decryption boxes with similar keys and use them to subvert rewrite permissions in a readable blockchain without being identified.

[0004] Therefore, current blockchain rewriting methods are not very secure. Summary of the Invention

[0005] The embodiments of the present invention provide a fine-grained controllable blockchain rewriting method and an editable blockchain system, which can solve the problem of low security of current blockchain rewriting methods.

[0006] In a first aspect, an embodiment of the present invention provides a blockchain fine-grained controllable rewriting method, the method comprising:

[0007] Decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, wherein the attribute modification key is generated according to the modifier's attribute;

[0008] Generate a rewrite check value based on the modified message and the decrypted original message;

[0009] Generate a modified signature based on the rewritten checksum and the modifier's identity key, wherein the identity key is generated based on the modifier's identity vector. The modified signature can be used to determine the identity and attributes of the modifier.

[0010] Verify whether the modified signature is valid by rewriting the check value;

[0011] If the modified signature is valid, the original message is replaced with the modified message and the modified signature is saved.

[0012] In a second aspect, an embodiment of the present invention provides an editable blockchain system, the system including multiple blockchain nodes, each of which includes an encryption tracking module, a hash generation module, and a signature module;

[0013] The encryption tracking module is used to decrypt the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, wherein the attribute modification key is generated according to the modifier's attributes;

[0014] The hash generation module is used to generate a rewrite check value based on the modified message and the decrypted original message;

[0015] The signature module is used to generate a modified signature based on the rewritten check value and the identity key of the modifier, wherein the identity key is generated based on the identity vector of the modifier. The identity and attributes of the modifier can be determined through the modified signature;

[0016] The signature module is also used to verify whether the modified signature is valid by rewriting the check value;

[0017] If the modified signature is valid, the blockchain node is used to replace the original message with the modified message and save the modified signature.

[0018] Compared with the prior art, the embodiments of the present invention have the following advantages: the method provided by the present invention embeds the identity and attributes of the modifier who performs the rewriting into the modification signature and the rewrite check value. In this way, when tracking the user who maliciously rewrites, the identity of the rewriting user and the identity of the user who provides the rewriting key can be tracked through the modification signature, thereby avoiding the situation where a malicious user who leaks the key through a black box method cannot be tracked, thereby improving the security performance of the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of a scenario of editable blockchain rewriting provided by an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of the structure of an editable blockchain system provided by an embodiment of the present invention;

[0021] Figure 3A schematic diagram of an implementation flow of a method for operating an editable blockchain provided by an embodiment of the present invention;

[0022] Figure 4 A flowchart of an implementation method for fine-grained controllable blockchain rewriting provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0024] Figure 1 The figure shows a scenario diagram of an editable blockchain rewrite provided by an embodiment of the present invention.

[0025] For example, see Figure 1 , editable blockchain allows data owners (i.e. users) to calculate access policy A and message signature The associated Chameleon hash ( h , r ). A holder of privileges that satisfies the access policy in a given hash (i.e., a modifier) ​​can find an arbitrary collision to modify the hash object in the blockchain (i.e., the original message m ) without changing its hash value. The decorator also needs to generate a valid decoration signature , linking the chameleon hash to its producer. If a malicious modifier doesn't perform the malicious rewrite themselves, but instead leaks their secret key (e.g., in a device like a decryption box), the central authority can trace the malicious user who contributed the secret key to the decryption box. Thus, editable blockchains support modifiability and accountability at a fine-grained level.

[0026] Figure 2 The figure shows a schematic diagram of the structure of an editable blockchain system provided by an embodiment of the present invention.

[0027] As an example, see Figure 2 , the editable blockchain system can be used for transaction-level blockchain rewriting. Even if an editable transaction (i.e., message) is rewritten based on the rewriting method provided by the present invention, the blockchain remains unchanged. Figure 2 , similar to traditional immutable blockchains, the i-th node in the blockchain system can be edited The block header includes the hash minutes of the previous node and the timestamp of the additional block time. , in the i Merkle root of four transactions accumulated in nodes and Proof of Consensus .in It can be a random number of some blockchain difficulty or the signature of a qualified shareholder in the blockchain.

[0028] For example, the editable blockchain can include two types of transactions: mutable transactions and immutable transactions. Each node can perform both mutable and immutable transactions. Figure 2 , the Merkle root of the i-th node accumulates four transactions, transaction 、 、 It is an immutable transaction that uses the traditional collision-resistant hash function h. Is a variable transaction, with access strategy A When Need to be rewritten as When the modifier has the property S Satisfy access policy A When the node Calculate arbitrary collisions in the hash digest . Then broadcast the modified message and rewrite the check value , all participants verify the correctness of the rewritten checksums, and if they are valid, use the new message and rewritten checksums to Update the local copy of the blockchain.

[0029] Specifically, see Figure 2 The execution entities in the editable blockchain system can be various blockchain nodes, which can be categorized as users 201, central authorities 202, and modifiers 203. Each node can be equipped with components such as an encryption tracking module 210, a hash generation module 220, and a signature module 230 (only shown here for modifiers 203 and central authorities 202). By calling these modules, each node can perform operations such as data upload, data modification, and identity authentication on the editable blockchain system.

[0030] For example, the modifier 203 can call the encryption tracking module 210 to decrypt the original message ciphertext according to its own attribute modification key to obtain the decrypted original message, call the hash generation module 220 to generate a rewrite check value according to the modified message and the decrypted original message, and call the signature module 230 to generate a modified signature according to its own identity key and the decrypted original message; thereby performing data modification.

[0031] Exemplarily, the encryption tracing module 210 can operate based on the Adaptively Secure Attribute-Based Rncryption for Traitor Tracing (ABTT), the hash generation module 220 can operate based on the Chameleon-Hashes with Ephemeral Trapdoors (CHET), and the signature module 230 can operate based on the Identity-Based Signature (IBS).

[0032] In an editable blockchain system, two nodes—users 201 who upload data and central authorities 202—are fully trusted, while modifiers 203 and outsiders (i.e., blockchain users who cannot modify blockchain objects) are untrustworthy. Attacks performed by outsiders can be overridden by attacks performed by malicious modifiers. In practice, modifiers 203 might waste their rewrite privileges to launch the following attacks:

[0033] Resistance to collision attacks: A malicious modifier whose attributes do not match the access policy may attempt to modify the user associated with the access policy.

[0034] Accountability Attack: A malicious modifier may attempt to overwrite user-provided information by impersonating other modifiers; and / or encapsulate their keys in a black-box manner to obtain a similar decryption box so that other users can use the decryption box to anonymously modify information on the chain, thereby undermining the accountability of the editable blockchain.

[0035] Inheriting from the current blockchain rewriting method, the editable blockchain provided by this invention also needs to meet the following security requirements:

[0036] Complete indistinguishability: For adversarially chosen messages and public keys, the outputs of hashing and collision checking are indistinguishable. In the black-box accountability of current blockchain rewrite methods, this security requirement focuses solely on the hash value. In the black-box accountability provided by this invention, the hash value and signature pair must be indistinguishable from the hash and collision checking.

[0037] Uniqueness: Uniqueness requires that it is difficult to find different checksums that produce the same hash value for an adversarially chosen message and public key.

[0038] Figure 3 The figure shows a flowchart of an implementation method for operating an editable blockchain according to an embodiment of the present invention. Method 300 can be applied to the above-mentioned editable blockchain system. Method 300 may include steps S301-S306, each of which is described below.

[0039] S301: The central authority initializes the system and generates initial parameters.

[0040] In one example, each module in the central authority can simultaneously run the group generator to generate initial parameters. That is, the central authority executes the parameter generation algorithm: .

[0041] For example, the central authority can run the group generator to input security parameters k , , N one is a natural number. Then run the group generator Generate and return initial parameters: ,in, p is a public parameter, is the elliptic curve group, Depends on the parameters T The elliptic curve group of T It also represents identity space. is the initial hash function, is a prime number in a bilinear pairing, is the elliptic curve group The generator of is the initial hash value, pp It is an implicit input to all algorithms.

[0042] S302: The central authority generates a master public key and a master secret key.

[0043] In some embodiments, a central authority executes a setup algorithm: , generate the master public key mpk and master key msk .

[0044] For example, the master public key may satisfy: ,in, To track the master public key, is the hashed public key, Identifies the master public key.

[0045] For example, the master key may satisfy: ,in, To track the master key, is the hashed private key, Identifies the master key.

[0046] In one possible implementation, the encryption tracking module can execute its internal setup algorithm: Generate tracking master public key and tracking master keys ;in,n is the number of users, t The hash generation module can execute its internal key generation algorithm: , generate hash public key and hash private key; where, It is an implicit input to the key generation algorithm in the hash generation module. It can be used by the signature module to perform its internal setup algorithm: , generate the identity master public key and logo ;in Sets the implicit input to the algorithm for the signature module.

[0047] In one example, the cryptographic tracking module can run a generation algorithm in a collision-resistant fingerprint algorithm: , according to the safety parameters k , number of users n , Collusion Boundary t ,get , the trapdoor key tk , identity space ;in, , which includes in n words; and , is the dimension of the identity space. Generate the tracking master public key and generate the tracking master key based on the trapdoor key and the identity space.

[0048] For example, tracking the master public key satisfies:

[0049]

[0050] is the first hash function, is the second hash function, is the third hash function, and the three satisfy different mapping relationships.

[0051] in:

[0052]

[0053] is less than p The set of non-negative integers, For message space Dimensions;

[0054] in:

[0055]

[0056] 、 、 、 is a set of non-zero integers less than or equal to p A random number selected from ; 、 、 From the collection A random number selected from .

[0057] For example, tracking the master key satisfies:

[0058]

[0059] in, 、 From the collection A random number selected from .

[0060] In one example, the hash generation module may generate a hash public key and a hash private key based on an asymmetric key encryption algorithm.

[0061] For example, the hashed public key satisfies:

[0062]

[0063] For symmetric key encryption schemes, including key generation ,encryption , decryption etc. algorithms. and the following 、 Based on asymmetric encryption algorithm: generated. is a prime number in a bilinear pairing, Also based on asymmetric encryption algorithm: generated, r is a random number. 、 They are the fourth Hash function and the sixth Hash function respectively.

[0064] in:

[0065]

[0066] is less than or equal to The set of non-zero integers, represents the square of a non-negative integer less than p.

[0067] For example, the hashed private key satisfies:

[0068]

[0069] in, is the hashed private key.

[0070] In one example, the signature module can be obtained from the collection Pick a random number from x As the identification master key. The identification master public key can meet the following requirements: .

[0071] S303: The central authority generates the user's identity key based on the master key and the user's identity vector.

[0072] In one possible implementation, a central authority could run a user key generation algorithm: , generate each user's identity key; where, is the user's identity vector, The user's identity key.

[0073] In one example, the signing module can call its internally configured key generation algorithm: , , generate the user's identity key.

[0074] Exemplarily, the user's identity key satisfies the following formula:

[0075]

[0076] in, is the user's identity key, is the first hash function, x From less than or equal to p The set of non-zero integers The one selected as the identification master key A random number, x Also the master key msk A parameter in .

[0077] S304: The central authority generates the modifier's identity key and attribute modification key based on the master key, the modifier's attributes, and the modifier's identity vector.

[0078] In some embodiments, the central authority may run a probabilistic modifier key generation algorithm: , generate the modifier's identity key and attribute modification key, where, is a modifier’s identity vector, , for identity space; is a set of properties that the modifier has, , For the attribute universe.

[0079] In a possible implementation, similarly, the signature module calls its internal key generation algorithm to generate the modifier's identity key .

[0080] In one possible implementation, the cryptographic tracking module can run an algorithm , thus generating .in, Modifies the key for the modifier's property.

[0081] For example, the attribute modifier key satisfies:

[0082]

[0083] in, is the first modified subkey, is the second modified subkey, is the third modified subkey, It is the fourth modified subkey.

[0084] In one example, the encryption tracking module may generate an attribute modification key through the following steps S3051-S3054.

[0085] S3041, select a random number , calculate the first modified subkey: .

[0086] S3042, select the modifier's y Random number corresponding to the attribute , calculate the second modified subkey:

[0087]

[0088] Where z=1,2, , S A set of properties that a modifier has.

[0089] S3043, select a random number , calculate the third modified subkey:

[0090]

[0091]

[0092] in, .

[0093] S3044, determine the set based on the identity vector of the modifier , according to the set Calculate the fourth modifier subkey:

[0094]

[0095]

[0096] in, b =0,1, the identity vector of the modifier is a row vector, All satisfied Index A collection of is the first Column element.

[0097] S305: The user generates the original message ciphertext, message hash value, upload check value and message signature based on the master public key, the user's identity key, the original message, and the access policy.

[0098] In one possible implementation, having data (i.e., messages m ) You can run a probabilistic hashing algorithm: , generate a message hash value , upload verification value And the message signature of this message upload .

[0099] For example, the message hash value satisfies: ; Upload verification value meets ; The message signature satisfies: .

[0100] In one example, the hash generation module may run its internal hash algorithm , according to the dehashed public key , original message The first set of elements that generate the interest hash value , upload verification value , key parameters The encryption tracking module can run its internal encryption algorithm. , according to the key parameters and news m Access policy A Encrypt the original message to generate the original message ciphertext The signature module can run its internal signature algorithm: Generate the message signature for this message upload based on the original message, the first element of the message hash value, the uploaded checksum, the original message ciphertext, and the user's identity key. .

[0101] Specifically, the hash generation module can generate the first set of elements of the message hash value through steps S401-S405 in the following method 400: , upload verification value , matching hashed private key The encryption tracking module can generate the original message ciphertext through steps S405-S409 in the following method 400 The signature module can generate a message signature by following step S410 of method 400. .

[0102] Optionally, the encryption tracking module can encrypt the original message based on the cryptographic accumulator to maintain constant key and ciphertext overhead, thereby reducing costs and optimizing performance.

[0103] S306, verify whether the message hash value, upload checksum and message signature are valid.

[0104] In some embodiments, if the message hash value, upload verification value, and message signature are all valid, the original message ciphertext can be saved in the editable blockchain system.

[0105] In one possible implementation, the deterministic verification algorithm can be run by either type of node: , output 1 when the message hash value and check value are valid hash bits and the message signature is a valid signature, otherwise output 0.

[0106] In one example, the signature module may perform its internal verification algorithm: , the hash generation module performs its internal verification algorithm: , perform an XOR operation on the outputs of these two algorithms: Get the final output result.

[0107] Specifically, the hash generation module can verify whether the uploaded checksum and the message hash value meet the following conditions: , , , ; Among them, upload verification value , message hash value If all conditions are met, it returns 1. The signature module can verify whether the message signature meets the following conditions: ,in ; Returns 1 if all conditions are met.

[0108] In other embodiments, if any parameter is invalid, the upload message is abandoned.

[0109] Optionally, if the message uploaded by the user needs to be modified, for example, when the user uploads illegal information, the blockchain fine-grained controllable rewriting method provided by the present invention can be executed, that is, steps S307 and S308.

[0110] S307, the modifier generates a rewrite check value and a modified signature based on the master public key, the modifier's identity vector, the modifier's identity key, the attribute modification key, the original message, the modified message, the message hash value, the upload check value and the message signature.

[0111] In one possible implementation, the decorator could run a probabilistic adaptation algorithm: , the modifier uses the master public key , the identity vector of the modifier , the modifier's identity key , attribute modifier key , original message , modify the message , message hash value , upload verification value and message signature Generate rewrite checksum and modified signatures .

[0112] Optionally, before running the probabilistic adaptation algorithm, the decorator can also run a validation algorithm: , verify whether the message signature, message hash value and uploaded checksum are valid. If valid, run the probability adaptation algorithm.

[0113] In one example, the encryption tracking module can run its internal decryption algorithm: Modify the key according to the modifier's properties Encrypt the original message Decryption to obtain the decrypted original message The hash generation module runs its internally configured adaptation algorithm: , according to the uploaded checksum value , the first element of the message hash value , modify the message , original message , the original message after decryption and hashed private key Generate rewrite checksum The signature module runs its internal signature algorithm: , according to the modified message , rewrite the checksum, , the first element of the message hash value , the original message ciphertext generates a modified signature.

[0114] Specifically, the encryption tracking module may execute its internal decryption algorithm through steps S501-S502 of the following method 500. The hash generation module may execute its internal adaptation algorithm through step S503 of the method 500. The signature module may execute its internal signature algorithm through step S504 of the method 500.

[0115] S308: Verify whether the rewritten checksum and modified signature are valid.

[0116] In one possible implementation, the verification algorithm can be run by either type of node: The modified signature is verified by rewriting the checksum. If the algorithm outputs 1, verification is successful, and 0 indicates failure. If verification is successful and the modified signature is valid, the modified message can be used to replace the original message and the modified signature can be saved.

[0117] In one example, similarly, the hash generation module and the signature module may verify the modified signature by rewriting the check value through step S505 in the following method 500 .

[0118] In another possible implementation, if the verification fails, the modification of the message may be stopped.

[0119] If malicious modification of information is found, step S309 can be performed to track the malicious modifier who directly modified the information and / or leaked the key through a black box method.

[0120] S309, the central authority determines the identity and attributes of the malicious modifier based on the decryption box and the master key.

[0121] In one possible implementation, a central authority could run a deterministic tracking algorithm. , according to a decryption box similar to a key D The identity and attributes of the malicious modifier are determined by the master key, and the union of the identity vector of the modifier who made the malicious modification and the attributes of the node that maliciously provided the key is output. .

[0122] The method provided by the present invention embeds the identity of the modifier performing the rewrite and the attributes of the modifier providing the key into the modified signature. This allows the identity of the rewriting user and the identity of the user providing the rewriting key to be tracked through the modified signature when tracing a malicious rewriting user, thereby preventing the situation where malicious users who leak keys through black box methods cannot be tracked, thereby improving the security of the blockchain. Furthermore, a cryptographic accumulator is used in both the generation of attribute-modified keys and the encryption of original messages by the encryption tracking module, ensuring constant key and ciphertext overhead. Compared with traditional methods, the encryption tracking module only requires two additional group elements when generating keys and only six additional group elements when generating ciphertext, thus reducing computational costs.

[0123] Method 400 is a method for generating a message signature, an upload verification value, and a message hash value provided by an embodiment of the present invention. Method 400 can be applied to user nodes in an editable blockchain system. Method 400 may include steps S401-S410, each of which is described below.

[0124] S401, hash generation module based on asymmetric encryption algorithm: , generate key parameters 、 、 . And according to the key parameters Generate the fifth hash function: .in, is the fifth hash function, is less than or equal to The set of non-zero integers.

[0125] S402, the hash generation module is less than or equal to The set of non-zero integers Select a random number , ; From the collection Select a random number , According to the random number Calculating the hash value and hash value . The upload check value .

[0126] S403, the hash generation module generates a hash value according to the key parameters 、 Calculate the matching hash private key , matching the hashed private key satisfy: .

[0127] S404, the hash generation module selects a random number , , based on the key generation algorithm in the symmetric key encryption algorithm: Get key parameters , based on the encryption algorithm in the symmetric key encryption algorithm: Generate key parameters ; The first element of the message hash value

[0128] S405, hash generation module runs the function: Get key parameters K ,in Is a general Map to The injective function of , M is the message space; .

[0129] S406, the encryption tracking module parses the access policy to obtain ,in Yes Line and The access structure of the columns is a matrix, π is a vector.

[0130] S407: The encryption tracking module selects an initial access value from the access structure matrix. , ; Perform XOR operation on the original message and the initial access value to obtain the encrypted access value , .

[0131] S408, the encryption tracking module selects a random number , and calculate , , ,get .in, , Represents the access structure matrix No. Rank j Column elements, .

[0132] S409, the encryption tracking module selects a random number , ,calculate: , , and then get the original message ciphertext , thus obtaining the message hash value: .

[0133] The original message ciphertext satisfies: ,in: , .

[0134] S410, the signature module selects another generator from the elliptic curve group and random numbers ,calculate: , , ; Thus, the message signature is obtained .

[0135] Figure 4 The following is a flowchart illustrating a method for implementing fine-grained, controllable blockchain rewriting according to an embodiment of the present invention. By way of example and not limitation, method 500 can be applied to the aforementioned editable blockchain system. Method 500 may include steps S501-S505. Each step is described below.

[0136] S501, decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message.

[0137] In one example, the attributes of a modifier, that is, the collection of attributes in the modified attribute modifier key generated by the modifier S Satisfy the access policy of the original message ciphertext , then there exists a constant set ,satisfy ,in To access the structure matrix i row vectors, .

[0138] The encrypted tracking module can be calculated in sequence:

[0139]

[0140]

[0141]

[0142] in, Indicates a continuous multiplication operation, the result of which is a number in the range [0, S ] in the numbers. hour, .

[0143] Then calculate:

[0144]

[0145] in, , The formula is: middle The coefficient of . ,and ,but Also meets: .

[0146] The last pair 、 Performing XOR operation, we can get the decrypted original message .

[0147] S502: regenerate the encrypted original message according to the decrypted original message, and verify whether the encrypted original message is identical to the ciphertext of the original message.

[0148] In one possible implementation, you can run the function get and pass a random number And the sixth hash function is performed: Get the encrypted original message.

[0149] In one example, if the encrypted original message is the same as the original message ciphertext, the subsequent steps can be performed.

[0150] In another example, if the two are different, modification of the original message may be stopped.

[0151] S503: Generate a rewrite check value according to the modified message and the decrypted original message.

[0152] In one example, the hash generation module can be based on a decryption algorithm in a symmetric encryption algorithm: Get key parameters ;like does not exist, that is , you can also stop modifying the original message and return .

[0153] In an example, the hash generation module may calculate the first original check parameter and the second original check parameter according to the original message, calculate the first modified check parameter and the second modified check parameter according to the modified message; and then calculate the rewrite check value according to these four parameters.

[0154] For example, the rewrite check value may satisfy the following formula:

[0155]

[0156]

[0157]

[0158] in, To rewrite the checksum, , , is the first original calibration parameter, is the second original verification parameter; is the first modified check parameter, is the second modified check parameter, is the hashed private key.

[0159] in:

[0160] .

[0161] S504: Generate a modified signature based on the rewritten check value and the identity key of the modifier.

[0162] For example, the modified signature may satisfy the following formula:

[0163]

[0164]

[0165]

[0166] in, Signature for modification.

[0167] S505: Verify whether the modified signature is valid by rewriting the check value.

[0168] In one example, the validity of the modified signature can be verified by determining whether the rewritten check value satisfies the modification verification model. If valid, the original message can be replaced with the modified message and the modified signature of the message rewrite can be saved.

[0169] Exemplarily, the modified verification model may satisfy the following formula:

[0170] .

[0171] In another example, if the verification fails, the message rewriting can be stopped and returned. .

[0172] Optionally, when malicious rewriting of a message is discovered, the following step S506 may be performed to track the identity and attributes of the malicious modifier.

[0173] S506: Track the identity of the modifier who performs the malicious modification and the attributes of the key provider who provides the attribute modification key according to the modification signature corresponding to the malicious rewriting information.

[0174] Specifically, the central authority can track down the malicious modifier through the following steps S5061-S5065.

[0175] S5061: re-encrypt the malicious rewriting message to obtain an encrypted malicious rewriting message.

[0176] Exemplarily, the encryption tracking module can run a re-encryption algorithm to obtain the encrypted malicious rewritten message.

[0177] Specifically, the re-encryption algorithm in the encryption tracking module is similar to the encryption algorithm, except that the parameters are generated The methods are different. b =0, keep unchanged; when b =1, let According to the modified Calculation of the value Thus, the encrypted malicious rewritten message is obtained.

[0178] S5062: Decrypt the encrypted malicious rewriting message using a decryption box to obtain a decrypted malicious rewriting message.

[0179] Specifically, It is a decryption box similar to a key, which can be Enter the set of all attributes that satisfy the access policy To derive multiple attribute decryption boxes The encrypted malicious rewritten message can be input into the decryption box Get the decrypted malicious rewritten message.

[0180] S5063 , comparing the decrypted malicious rewritten message with the modified message in the message space to find the modified message provided by the malicious modifier.

[0181] Exemplarily, a user key generation algorithm similar to step S303 of the above method 300 may be executed: , according to the master public key mpk , malicious rewriting of messages , modify the message , rewrite checksum of malicious rewritten message , modify the signature and message hash value Generate the identity key corresponding to the malicious rewritten message Then run Algorithm, decryption box by attributes Generate a rewrite checksum for a malicious rewritten message , modify the signature and message hash value , the master public key, malicious rewrite message , modify the message , rewrite checksum of malicious rewritten message , modify the signature and message hash value Input to decryption box Get the rewritten checksum and modified signature of the modified message . Then run the verification algorithm: To verify whether the modified signature of the modified message is valid. If the algorithm outputs 1, it is determined that the modified message and the malicious rewritten message match, and the modified signature was generated by a malicious modifier.

[0182] S5064: Determine the identity of the malicious modifier based on the modified signature corresponding to the modified message provided by the malicious modifier.

[0183] By modifying the signature, we can get the identity vector of the malicious modifier, and get the identity of the malicious modifier who directly made the modification. .

[0184] S5065, based on a fingerprint algorithm with collision resistance, obtains the attributes of the malicious key provider according to the trapdoor key and the identity vector of the malicious modifier.

[0185] Example, based on a collision-resistant fingerprint algorithm The attributes of the malicious key provider can be obtained based on the trapdoor key and the identity vector of the malicious modifier.

[0186] The method provided by the present invention embeds the identity of the modifier who performs the rewriting and the attributes of the modifier who provides the key into the modification signature. In this way, when tracking the user who maliciously rewrites, the identity of the rewriting user and the identity of the user who provides the rewriting key can be tracked through the modification signature, thereby avoiding the situation where a malicious user who leaks the key through a black box method cannot be tracked, thereby improving the security performance of the blockchain.

[0187] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0188] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0189] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0190] The above content is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention cannot be considered to be limited to these descriptions. For those skilled in the art of the present invention, any modifications made without departing from the concept of the present invention should be deemed to fall within the scope of protection of the present invention.

Claims

1. A blockchain fine-grained controllable rewriting method, characterized in that: The method is applied to an editable blockchain system, and the method includes: Generate master public key and master secret key; Generate a user identity key based on the master key and the user's identity vector; generating the identity key of the modifier according to the identity vector of the modifier and the master key; and generating the attribute modification key of the modifier according to the master key, the attribute of the modifier and the identity vector of the modifier; Decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message; generating a rewrite check value based on the modified message and the decrypted original message; generating a modification signature according to the rewrite check value and the identity key of the modifier, wherein the identity and attributes of the modifier can be determined through the modification signature; Verifying whether the modified signature is valid by using the rewritten check value; If the modified signature is valid, replacing the original message with the modified message and saving the modified signature; The attribute modifier key satisfies the following formula: in, the property modifier key for the modifier, is the first modified subkey, is the second modified subkey, is the third modified subkey, is the fourth modified subkey, is the identity vector of the modifier, is a set of attributes possessed by the modifier; The first modified subkey satisfies the following formula: in, is the initial hash value, 、 All are less than or equal to p The set of non-zero integers A random number selected from 、 All are less than or equal to p The set of non-negative integers A random number selected from p is a public parameter; The second modified subkey satisfies the following formula: in, z =1,2, 、 、 They are the first hash function, the second hash function, and the third hash function, respectively. For the set of non-negative integers The modifier selected from y The random number corresponding to each attribute, is the generator of the elliptic curve group, 、 For the set of non-zero integers A random number selected from The third modified subkey satisfies the following formula: in, 、 、 、 are all random numbers selected from the set of non-negative integers; The fourth modified subkey satisfies the following formula: in, b =0,1, All satisfied Index i The identity vector is a row vector, is the first i Column element.

2. The method according to claim 1, characterized in that Before decrypting the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, the method further includes: Encrypt the original message according to the master public key, the user's identity key, and the access policy of the original message to obtain the original message ciphertext, and generate a message hash value and a message signature and upload verification value for this message upload; Verify whether the message hash value, the message signature and the upload checksum are valid; If the message hash value, the message signature and the upload verification value are all valid, the original message ciphertext is saved.

3. The method according to claim 1 or 2, characterized in that The modifier's identity key satisfies the following formula: in, is the identity key of the modifier, is the identity vector of the modifier, is the first hash function, To identify the master key, the master key includes the identification master key.

4. The method according to claim 2, characterized in that The message hash value satisfies the following formula: in, is the message hash value, 、 are two hash values ​​calculated based on the original message, Key parameters generated based on asymmetric encryption algorithm, is the sixth hash function, is the original message ciphertext, Key parameters generated based on the symmetric encryption algorithm; The message signature satisfies the following formula: in, Sign the message, 、 are the first hash function and the second hash function respectively, x From less than or equal to p The set of non-zero integers A random number selected from p is a public parameter; From less than or equal to The set of non-zero integers A random number selected from A third key parameter generated based on the asymmetric encryption algorithm; From less than or equal to The set of non-zero integers A random number selected from is a prime number in a bilinear pairing, is another generator of the elliptic curve group, From less than or equal to p From the set of non-negative integers A random number selected from The upload verification value satisfies the following formula: .

5. The method according to claim 4, characterized in that The encrypting the original message according to the master public key, the user's identity key, and the access policy of the original message to obtain the original message ciphertext includes: Parsing the access strategy to obtain an access structure matrix; Selecting an initial access value from the access structure matrix; Performing an XOR operation on the original message and the initial access value to obtain an encrypted access value; The original message ciphertext is generated based on a cryptographic accumulator according to the encrypted access value, the access structure matrix, the initial access value, the master public key, the user's identity key.

6. The method according to claim 5, characterized in that The modified signature satisfies the following formula: in, signing said modification; , is the rewrite check value.

7. The method according to claim 6, characterized in that Generating a rewrite check value according to the modified message and the decrypted original message includes: Calculating a first original verification parameter and a second original verification parameter according to the decrypted original message; Calculating a first modification check parameter and a second modification check parameter according to the modification message; calculating the rewrite check value based on the first original check parameter, the second original check parameter, the first modified check parameter, and the second modified check parameter; The rewrite check value satisfies the following formula: in, , , is the first original verification parameter, is the second original verification parameter; is the first modified check parameter, is the second modified check parameter, is the hashed private key, is the private key that matches the hashed private key.

8. The method according to claim 1, characterized in that If malicious rewriting of information is found, the method further includes: parsing the malicious rewriting information using a decryption box to obtain a modified signature corresponding to the malicious rewriting information; The identity of the modifier who performs the malicious modification and the attributes of the key provider who provides the attribute modification key are tracked according to the modification signature corresponding to the malicious rewriting information.

9. An editable blockchain system, characterized in that: The system is used to perform fine-grained controllable rewriting of a blockchain according to the method according to any one of claims 1 to 8, the system comprising a plurality of blockchain nodes, each node comprising an encryption tracking module, a hash generation module, and a signature module; The encryption tracking module is used to decrypt the original message ciphertext according to the modifier's attribute modification key to obtain the decrypted original message, wherein the attribute modification key is generated according to the attributes of the modifier; The hash generation module is used to generate a rewrite check value according to the modified message and the decrypted original message; The signature module is used to generate a modification signature based on the rewrite check value and the identity key of the modifier, wherein the identity key is generated based on the identity vector of the modifier, and the identity and attributes of the modifier can be determined through the modification signature; The signature module is further configured to verify whether the modified signature is valid through the rewrite check value; If the modified signature is valid, the blockchain node is used to replace the original message with the modified message and save the modified signature.

Images