Zero-trust security data processing method and system, electronic equipment and storage medium

Abstract

The invention provides a zero-trust security data processing method and system, electronic equipment and a storage medium, and relates to the technical field of network security, the method comprises the following steps: determining a to-be-queried data tree node set according to target keyword information in a data retrieval task; determining a target query range tree node set according to a target retrieval range in the data retrieval task; performing first encryption processing on the to-be-queried data tree node set to obtain security index information corresponding to the data retrieval task; performing second encryption processing on the vector representation of each element in the target query range tree node set to obtain a trap door corresponding to each element in the target query range tree node set; and according to the security index information and the trap door, determining a query permission of the data retrieval task on the target block chain. According to the method, the security and privacy of data retrieval on the block chain are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a zero-trust security data processing method, system, electronic device and storage medium. Background Art

[0002] Zero-trust smart networks have the characteristics of open communication environment, fast node movement, and random access to a large number of sensor devices. The "authentication at any time, never trust" feature is becoming more and more prominent. For example, in the field of smart driving, as cars become increasingly intelligent, networked, and shared, the vehicle itself has changed from a closed system to an open system, and security issues have become increasingly prominent.

[0003] In an environment with multi-source heterogeneous data elements, the means of attack on data are varied, resulting in defects such as excessive collection, leakage, theft and tampering of environmental data. In particular, it is limited by the bottleneck of balancing risk and trust in the zero-trust architecture. How to effectively integrate the massive data stored in the multi-source heterogeneous zero-trust intelligent network cloud, enhance the reliability, complementarity and adaptability of data or information conversion, and ensure the secure transmission and accurate migration of data information is an issue that currently needs further in-depth research.

[0004] Therefore, there is an urgent need for a zero-trust secure data processing method, system, electronic device and storage medium to solve the above problems. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides a zero-trust secure data processing method, system, electronic device and storage medium.

[0006] The present invention provides a zero-trust security data processing method, comprising: According to the target keyword information in the data retrieval task, determine the set of tree nodes of the data to be queried, wherein the set of tree nodes of the data to be queried is the set of all tree nodes in the tree data structure that contain the target keyword information; the tree data structure is constructed by the keyword information and the index data; the index data is the index corresponding to the on-chain data in the target blockchain; Determine a target query range tree node set according to a target search range in the data search task, wherein the target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target search range; the target search range represents a search range corresponding to the data search task in the tree data structure; Performing a first encryption process on the data tree node set to be queried to obtain security index information corresponding to the data retrieval task; performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trapdoor corresponding to each element in the target query range tree node set; According to the security index information and the trapdoor, the query authority of the data retrieval task on the target blockchain is determined.

[0007] According to a zero-trust security data processing method provided by the present invention, the tree data structure is constructed by the following steps: Constructing corresponding key-value pairs according to the keyword information and the index data; The key-value pairs are used as tree nodes, and according to the parent node relationship between each tree node, the tree data structure corresponding to the B+ tree structure or the R tree structure is constructed.

[0008] According to a zero-trust security data processing method provided by the present invention, the first encryption processing is performed on the set of nodes in the data tree to be queried to obtain security index information corresponding to the data retrieval task, including: Generate corresponding keys based on preset security parameters; Constructing a data polynomial to be queried according to the difference between each element in the set of nodes in the data tree to be queried and the target data vector, wherein the target data vector is an encrypted representation of the data to be retrieved in the target blockchain by the data retrieval task; Generate a corresponding coefficient vector set according to each polynomial coefficient in the data polynomial to be queried; Based on the private key in the key, the coefficient vector set is encrypted to obtain the security index information corresponding to the data retrieval task; The performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trapdoor corresponding to each element in the target query range tree node set includes: A trapdoor calculation is performed according to the vector representation of each element in the target query range tree node set and the key to obtain the trapdoor corresponding to each element in the target query range tree node set.

[0009] According to a zero-trust security data processing method provided by the present invention, determining the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor includes: Obtaining an inner product result between the security index information and the trapdoor; If the inner product result belongs to an element in the target query range tree node set, it is determined that the data retrieval task has query permission on the target blockchain; If the inner product result does not belong to the elements in the target query range tree node set, it is determined that the data retrieval task does not have query authority on the target blockchain.

[0010] According to a zero-trust secure data processing method provided by the present invention, after determining the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor, the method further includes: After determining that the data retrieval task has query authority on the target blockchain, based on an oblivious transfer process, the to-be-queried data corresponding to the data retrieval task on the target blockchain is sent to a target end, wherein the target end is a user terminal that generates the data retrieval task.

[0011] According to a zero-trust secure data processing method provided by the present invention, the target blockchain is a blockchain with a single main chain and multiple side chain structure constructed based on a hash graph, and the consensus algorithm in the target blockchain is a Byzantine fault-tolerant consensus algorithm, wherein the main chain and side chain of the target blockchain are used for tasks of storing different types of data.

[0012] According to a zero-trust security data processing method provided by the present invention, the method further includes: The data to be uploaded is encrypted by a lattice-based encryption algorithm to obtain the encrypted data to be uploaded and a digital signature corresponding to the encrypted data to be uploaded; After determining that the encrypted data to be uploaded to the chain and the digital signature have passed consensus verification, the encrypted data to be uploaded to the chain and the digital signature are added to the target blockchain, and according to the preset field information in the encrypted data to be uploaded to the chain, a tree node corresponding to the encrypted data to be uploaded to the chain in the tree data structure is constructed.

[0013] The present invention also provides a zero-trust security data processing system, comprising: A first retrieval module is used to determine a set of tree nodes of data to be queried according to target keyword information in a data retrieval task, wherein the set of tree nodes of data to be queried is a set of all tree nodes in a tree data structure that contain the target keyword information; the tree data structure is constructed by keyword information and index data; the index data is an index corresponding to the on-chain data in the target blockchain; A second retrieval module is used to determine a target query range tree node set according to a target search range in the data retrieval task, wherein the target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target search range; the target search range represents the search range corresponding to the data retrieval task in the tree data structure; An encryption module is used to perform a first encryption process on the set of tree nodes of the data to be queried to obtain security index information corresponding to the data retrieval task; perform a second encryption process on the vector representation of each element in the set of tree nodes of the target query range to obtain a trap door corresponding to each element in the set of tree nodes of the target query range; An access control module is used to determine the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the zero-trust security data processing method as described above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the zero-trust security data processing methods described above.

[0016] The zero-trust security data processing method, system, electronic device and storage medium provided by the present invention organize keyword information and index data by constructing a tree data structure, and determine the tree node sets to be queried and the target query range according to the data retrieval task, and then generate security index information and trapdoors by encrypting these tree node sets, thereby realizing fine-grained access control of data retrieval tasks, improving the security and privacy of data retrieval on the blockchain, and ensuring that only users with corresponding query permissions can access specific data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A flowchart of the zero-trust secure data processing method provided by the present invention; Figure 2A schematic diagram of the structure of the zero-trust secure data processing system provided by the present invention; Figure 3 This is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Network security technology refers to the use of various technical means and methods to protect the hardware, software and data in the system from damage, change or leakage due to accidental or malicious reasons, so as to ensure the continuous, reliable and normal operation of the system and prevent service interruption.

[0021] Trusted data refers to data that is trustworthy, reliable and accurate. This data can meet specific quality standards and security requirements during its generation, collection, storage, transmission, processing and use. Its core elements include data credibility, identity, environment credibility, application credibility and flow credibility. Data credibility refers to the ability of data to maintain accuracy, integrity, consistency and reliability throughout its life cycle.

[0022] As a distributed shared data model, blockchain has information technology advantages such as point-to-point transmission, multi-party consensus, structured coding, intelligent scripts and cryptographic support. Its features such as automation, anti-tampering, anti-counterfeiting, fine-grained, traceable and weak center allow various decentralized entities to jointly create and operate a highly reliable data system with consistency and sharing, while also having the advantages of security and high efficiency. With the Internet as the underlying infrastructure, blockchain builds a more credible management and control platform for the efficient circulation of information, which can fully solve the security issues in data collection, transmission, storage and execution.

[0023] As an emerging network security architecture and concept, zero-trust smart network can effectively protect network resources and data in smart driving systems through mandatory authentication and authorization, as well as fine-grained access control. For example, in smart driving cars, zero-trust smart network can assign reasonable permissions to each component and perform access control on each data interaction between components, thereby effectively protecting the car's internal applications from connections from unauthorized users.

[0024] In the field of intelligent driving, facing the complex environment of multi-source heterogeneous data elements, data attack methods are endless, resulting in environmental data facing risks such as excessive collection, leakage, theft and tampering. Especially under the zero-trust architecture, the balance between risk and trust has become a major bottleneck. Therefore, how to effectively integrate heterogeneous data from different sources, enhance the reliability, complementarity and adaptability of data conversion in the massive data stored in the zero-trust intelligent network cloud, and ensure the security and accuracy of data information during transmission is an urgent problem to be solved in the field of intelligent driving.

[0025] In view of the problems existing in the above-mentioned prior art, the present invention provides a zero-trust security information transmission method based on blockchain encryption. The method relies on blockchain technology, integrates information technologies such as point-to-point transmission, multi-party consensus, structured coding, smart contracts and cryptography, and exhibits significant characteristics such as automated operation, anti-tampering, anti-counterfeiting ability, fine-grained control, traceability and weak centralization. These characteristics enable the dispersed parties to jointly build and operate a reliable data system with high consistency and sharing, while ensuring the security and operation efficiency of the system. The present invention uses the Internet as the infrastructure, and blockchain technology provides a more reliable management and control platform for the efficient circulation of information, effectively solving the security problems of data in the collection, transmission, storage and execution links, and can effectively overcome the problems of information transmission lag, imperfect open trust environment and inconsistent coordination of control instructions in the traditional management system. Through reliable data flow management, efficient cooperation mechanism and scientific decision-making analysis capabilities, it provides strong support for multi-level, multi-regional and multi-center standardized control and system management.

[0026] Figure 1 A flowchart of the zero-trust security data processing method provided by the present invention is as follows: Figure 1 As shown, the present invention provides a zero-trust security data processing method, comprising: Step 101, according to the target keyword information in the data retrieval task, determine the set of tree nodes of the data to be queried, wherein the set of tree nodes of the data to be queried is the set of all tree nodes in the tree data structure that contain the target keyword information; the tree data structure is constructed by the keyword information and the index data; the index data is the index corresponding to the on-chain data in the target blockchain.

[0027] In the present invention, the data retrieval task includes one or more target keyword information, and the keyword information is used to find matching data in the data set.

[0028] In the present invention, the set of tree nodes of data to be queried refers to the set of all tree nodes containing target keyword information in the tree data structure. This set is a direct reflection of the search results and contains all data nodes that meet the query conditions. The tree data structure is a hierarchical data organization method, in which each node can have zero or more child nodes, forming a tree-like hierarchical structure. In the present invention, the tree data structure is constructed by "keyword information" and "index data", which means that each tree node contains some keyword information for identifying or describing the data content of the node. At the same time, these nodes are also associated with other nodes through index data.

[0029] In the present invention, index data is the index corresponding to the on-chain data in the target blockchain. In blockchain technology, once the data is on-chain, it is difficult to modify or delete. Therefore, in order to efficiently retrieve this data, it is necessary to establish an index to speed up the query process. Index data can be regarded as the "address" or "pointer" of the data, which points to the specific data location on the blockchain, so that the node containing the target keyword information can be quickly located in the tree data structure.

[0030] The present invention combines the tree data structure with the blockchain technology to realize an efficient and secure data retrieval mechanism. The blockchain provides the data immutability, while the tree data structure provides the hierarchical organization and rapid retrieval capability of the data. Under this combination, the data retrieval task can be completed more efficiently and accurately, especially in scenarios where a large amount of data needs to be processed and data security is required to be high. For example, in the field of intelligent driving, a large amount of road condition information, vehicle status information, pedestrian behavior information, etc. need to be retrieved and analyzed in real time. By constructing a data retrieval system based on the tree data structure and the blockchain technology, rapid and accurate retrieval of these information can be achieved. Specifically, the road condition information, vehicle status information, etc. can be used as keyword information to construct a tree data structure; at the same time, the blockchain technology is used to record the chain process of this information and generate corresponding index data. In this way, when the autonomous driving car needs to make a decision, the required information can be quickly retrieved through the tree data structure, thereby improving the accuracy and efficiency of the decision. In addition, the immutability of the blockchain also ensures the authenticity and reliability of the data, providing strong technical support for intelligent driving.

[0031] Step 102, determining a target query range tree node set according to a target search range in the data retrieval task, wherein the target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target search range; the target search range represents the search range corresponding to the data retrieval task in the tree data structure.

[0032] In the present invention, the target search scope refers to a specific scope that needs to be searched in the tree data structure, which is specified by the user or the system in the data search task. This scope can be a certain part, a certain level, or certain specific branches in the tree data structure. The determination of the target search scope is usually based on the specific requirements and background of the search task. For example, the user may only be interested in certain specific types or categories of data in the tree data structure.

[0033] The target query range tree node set refers to the set of all tree nodes containing target keyword information within the target search range. This set is a direct reflection of the search results of the search task within the specified range, and includes all tree nodes that match the query keywords within the target search range.

[0034] When performing data retrieval tasks, the tree data structure enables the system to locate and access data according to levels and branches, thereby improving the efficiency of retrieval.

[0035] Specifically, in the present invention, first, according to the needs of the data retrieval task, the target retrieval range is determined; then, in the tree data structure, all tree nodes within the target retrieval range are traversed, and for each tree node, it is checked whether it contains the target keyword information; if it does, the tree node is added to the target query range tree node set. For example, in the field of intelligent driving, it is necessary to retrieve and analyze the road condition information, traffic signals, pedestrians and other vehicle dynamics around the vehicle in real time. In order to efficiently process these massive and real-time changing data, different target retrieval ranges can be set according to the needs of the automatic driving system, such as only focusing on the road condition information within a certain distance in front of the vehicle, or only focusing on a specific type of traffic signal.

[0036] Step 103, performing a first encryption process on the data tree node set to be queried to obtain security index information corresponding to the data retrieval task; performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trapdoor corresponding to each element in the target query range tree node set.

[0037] In the present invention, the private key is used to perform a first encryption process on the set of nodes in the data tree to be queried, thereby converting the set of nodes in the data tree to be queried into an encrypted form, namely, security index information. This encryption form protects the content of the original data, making it impossible for unauthorized users to directly access or understand the data, and can be used to verify or retrieve the encrypted data when needed.

[0038] For each element (i.e., tree node) in the target query range tree node set, it can be represented as a vector form, and this vector representation may contain the keyword information, location information or other relevant features of the node. In the present invention, a key is used to perform a second encryption process on these vector representations. Through the second encryption process, the vector representation of each element in the target query range tree node set is converted into an encrypted form, i.e., a trapdoor. A trapdoor is a special encryption output that allows users with corresponding decryption keys to verify or retrieve specific encrypted data without decrypting the entire data set. For example, in the map data in the field of intelligent driving, sensitive route information, landmark locations, or user behavior data may be included. In order to protect these data, the above encryption processing method can be used. Specifically, in the first encryption process, key nodes (such as intersections, important landmarks, etc.) in the map data can be encrypted to generate security index information. In this way, even if the map data is illegally obtained, the attacker cannot directly understand the specific information of these key nodes. During the second encryption process, the environmental data collected in real time by the autonomous driving system can be encrypted, such as the location of other vehicles around the vehicle, pedestrian dynamics, etc. By generating a trapdoor, the system can verify or retrieve specific environmental information without exposing the original data, thereby ensuring the safety and privacy of the driving process.

[0039] Step 104: Determine the query authority of the data retrieval task on the target blockchain based on the security index information and the trapdoor.

[0040] In the present invention, when a data retrieval task needs to be executed on the target blockchain, it will first be checked whether the task has the corresponding query authority. The query authority is determined based on the matching degree of the security index information and the trapdoor. Specifically, the present invention calculates the predicate relationship between the security index information and the trapdoor based on the inner product. If the inner product result corresponding to the keyword is in the interval corresponding to the target query range tree node set, it can be determined that the data retrieval task has the authority to query on the target blockchain.

[0041] The zero-trust secure data processing method provided by the present invention organizes keyword information and index data by constructing a tree data structure, and determines the tree node sets to be queried and the target query range according to the data retrieval task, and then generates security index information and trapdoors by encrypting these tree node sets, thereby realizing fine-grained access control of data retrieval tasks, improving the security and privacy of data retrieval on the blockchain, and ensuring that only users with corresponding query permissions can access specific data.

[0042] Based on the above embodiment, the tree data structure is constructed by the following steps: Constructing corresponding key-value pairs according to the keyword information and the index data; The key-value pairs are used as tree nodes, and according to the parent node relationship between each tree node, the tree data structure corresponding to the B+ tree structure or the R tree structure is constructed.

[0043] In order to improve the security of retrieval and access of encrypted data, the present invention establishes a complete encryption index between the consensus node and the service node to ensure the comprehensive traceability and security of the data. At the same time, a local data index is constructed between the mobile terminal nodes to improve the efficiency and flexibility of data retrieval. At the same time, in order to achieve efficient linear interval retrieval, the present invention combines predicate encryption and tree data structure technology. This combination not only ensures the accuracy of retrieval, but also greatly improves the retrieval speed, allowing users to quickly find the required data.

[0044] In the present invention, keyword information is used to identify or search for information of a specific data item, and is usually an identifier provided by a user when querying or used for data classification and retrieval within the system.

[0045] Index data is data associated with keyword information, which provides information about the location, attributes or other related information of a data item for fast positioning or access to data.

[0046] Furthermore, according to the keyword information and index data, they are paired to form a key-value pair, where the key is the keyword information used to uniquely identify the data item; the value is the index data, which provides information associated with the key. In a tree data structure, a node is the basic unit that constitutes the tree, and each node contains some data (i.e., a key-value pair) and pointers or links that may point to other nodes.

[0047] Use key-value pairs as tree nodes: We use the key-value pairs built previously as nodes in a tree data structure. This means that each node stores a keyword and its corresponding index data, providing a basis for subsequent data retrieval and access.

[0048] When constructing a B+ tree or an R tree, the present invention first determines the parent node of each node based on the order or spatial position relationship of the keyword information. By recursively or iteratively adding nodes and adjusting the structure of the tree according to the parent node relationship, a complete B+ tree or R tree is finally constructed. It should be noted that in the present invention, storing the B+ tree in an encrypted form can protect the key value and retrieval interval information, but its structure itself determines that the sorting characteristics of the data are difficult to hide. In order to further improve data security, the tree data structure in the present invention adopts the representation form of an R tree, so as to further protect the key value order in the tree and construct a multi-dimensional interval retrieval function.

[0049] On the basis of the above embodiment, after determining the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor, the method further includes: After determining that the data retrieval task has query authority on the target blockchain, based on an oblivious transfer process, the to-be-queried data corresponding to the data retrieval task on the target blockchain is sent to a target end, wherein the target end is a user terminal that generates the data retrieval task.

[0050] In the present invention, in order to protect the user's query intention and data security, under the premise of ensuring query authorization, the retrieved data is inadvertently transferred (Oblivious Transfer, abbreviated as OT), so that during the data transmission process, even if the data is intercepted, the original query content cannot be restored, thereby ensuring the confidentiality and integrity of the data and the security of the access mode.

[0051] Moreover, in terms of access control, the present invention adopts the BLP (Bell-LaPadula) mandatory access control framework, which quantifies risks through information entropy and can more accurately evaluate the security of access requests. At the same time, the present invention also uses collaborative filtering technology to dynamically adjust access quotas, strictly controls the relationship between access boundaries and system risks according to the user's access behavior and system risk status, and ensures data security and access compliance.

[0052] Based on the above embodiment, the first encryption processing is performed on the set of nodes in the data tree to be queried to obtain the security index information corresponding to the data retrieval task, including: Generate corresponding keys based on preset security parameters; Constructing a data polynomial to be queried according to the difference between each element in the set of nodes in the data tree to be queried and the target data vector, wherein the target data vector is an encrypted representation of the data to be retrieved in the target blockchain by the data retrieval task; Generate a corresponding coefficient vector set according to each polynomial coefficient in the data polynomial to be queried; Based on the private key in the key, the coefficient vector set is encrypted to obtain the security index information corresponding to the data retrieval task; The performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trapdoor corresponding to each element in the target query range tree node set includes: A trapdoor calculation is performed according to the vector representation of each element in the target query range tree node set and the key to obtain the trapdoor corresponding to each element in the target query range tree node set.

[0053] In the present invention, the process of combining predicate encryption and B+ tree structure is explained to realize ciphertext interval retrieval, wherein predicate encryption is mainly based on inner product calculation, that is, given a data vector to be retrieved (i.e., target data vector) and search vector , only when When . Considering that only using predicate encryption for ciphertext retrieval requires constructing an index for each record, the amount of node calculation increases linearly with the number of records and the length of the above-mentioned vector, and its efficiency cannot meet the real-time requirements of the network. Therefore, the present invention utilizes the B+ tree structure to store the key-value pairs in an encrypted form in order on each node of the tree, and also uses predicate encryption to determine whether the interval query condition is met through the inner product, so that the data holder can independently retrieve the encrypted B+ tree structure, which not only reduces the number of comparisons to a logarithmic level, but also effectively avoids additional interaction overhead.

[0054] Specifically, assume that the search condition (i.e., the target search scope) is , determine the two extreme values With the keyword in the B+ tree node The size of Is it in the interval or ,in, is the maximum value in the interval.

[0055] Furthermore, define To contain keywords All B+ tree nodes, that is, the set of data tree nodes to be queried, It is a B+ tree node in the data tree node set to be queried; To cover and only cover the search conditions The minimum node set of the target query range tree node set. The node in the target query scope tree node collection.

[0056] if ,express and The intersection of is not empty and has an intersection node, and then Mapped to a polynomial, that is, the polynomial of the data to be queried: ; in, are the polynomial coefficients; is a variable. , then there must exist satisfy Based on this, the present invention can transform the interval judgment of keywords into the zero value judgment problem of multiple vector inner products, thereby constructing the following related function of the ciphertext interval retrieval process: function :Generate a key according to preset security parameters, where the preset security parameters can be security parameters such as key length and key update period.

[0057] function :Based on the data tree node set to be queried The difference between each element in and the target data vector is used to construct the data polynomial to be queried. , so that according to the polynomial of the data to be queried Each polynomial coefficient in constructs the corresponding coefficient vector set , and further use the private key to pair the coefficient vector set Encryption to obtain security index information .

[0058] function : Query the target range tree node collection The elements in are represented by vectors, that is, , then according to the key and Perform trapdoor calculation to obtain the predicate encrypted trapdoor ,in, , , which can be calculated by the trapdoor function.

[0059] On the basis of the above embodiment, determining the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor includes: Obtaining an inner product result between the security index information and the trapdoor; If the inner product result belongs to an element in the target query range tree node set, it is determined that the data retrieval task has query permission on the target blockchain; If the inner product result does not belong to the elements in the target query range tree node set, it is determined that the data retrieval task does not have query authority on the target blockchain.

[0060] In the present invention, the security index information and the trapdoor are regarded as vectors, and their inner product result is a scalar value. By calculating the inner product between the security index information and the trapdoor, a specific numerical result, namely the inner product result, can be obtained. By judging whether the inner product result belongs to an element in the target query range tree node set, it can be determined whether the data retrieval task meets the query condition. If the inner product result belongs to an element in the target query range tree node set, it is determined that the data retrieval task has query permission on the target blockchain, indicating that the user terminal or system can access and retrieve specific data items stored on the blockchain.

[0061] If the inner product result does not belong to the elements in the target query range tree node set, it is determined that the data retrieval task does not have query authority on the target blockchain, indicating that the user terminal or system cannot access and retrieve specific data items stored on the blockchain. Furthermore, the present invention constructs the following related functions for the ciphertext interval authority judgment process: function : Determine the security index information based on the inner product result and trapdoor The predicate relationship between the keywords The corresponding inner product result falls into the tree node If the interval of the target query range tree node set is equal to 1, it returns 1, indicating that the data retrieval task has query permission on the target blockchain.

[0062] function : Calling a function Make a judgment, if there is make , then it means the keyword The scope is the target query scope tree node set The corresponding index outputs 1 accordingly.

[0063] According to the above function, the present invention can be used on the B+ tree structure Encrypt the upper and lower bounds of the key-value pairs corresponding to each tree node respectively, and maintain the logical order relationship between tree nodes through the tree structure. The interval and interval Encrypt separately and generate intervals Corresponding trapdoor and interval Corresponding , so that data holders can The function compares ciphertext on the B+ tree structure, finds the next tree node to be searched, iterates sequentially, and can eventually locate the subtree or leaf node that meets the search criteria and obtain the data to be read in batches.

[0064] Based on the above embodiment, the target blockchain is a blockchain with a single main chain and multiple side chains structure constructed based on a hash graph, and the consensus algorithm in the target blockchain is a Byzantine fault-tolerant consensus algorithm, wherein the main chain and side chain of the target blockchain are used for tasks of storing different types of data.

[0065] In the present invention, the target blockchain adopts a single main chain and multiple side chains structure, which is built based on HashGraph technology. Based on the feature of HashGraph that supports the parallel creation of multiple chains, the throughput of the system can be significantly improved, and the interaction of cross-chain smart contracts can be supported. In the present invention, the main chain is responsible for task assignment and trust backtracking, while the side chain is used to process specific business logic and data storage. This structure not only ensures the overall stability and security of the system, but also improves the flexibility and scalability of the business.

[0066] Furthermore, in the present invention, the consensus algorithm adopted by the target blockchain is the Practical Byzantine Fault Tolerance (PBFT) consensus algorithm, which includes two core processes: mutual voting and virtual voting.

[0067] Mutual voting: With events as the basic block unit, each event contains a collection of information, timestamp, signature, and reference hash to the parent event. The transaction node randomly selects multiple reachable nodes to send the event to be confirmed. The receiving node signs the event and packages it into a new event, which is then sent randomly. Through this rumor propagation mechanism, events can be quickly known to most nodes, ensuring the breadth of consensus.

[0068] Virtual voting: Nodes conduct multiple rounds of voting through recorded events, and elect holders whose event set is consistent with that of most nodes as well-known witnesses. Well-known witnesses are responsible for determining the order of events and generating multi-chain blocks. This mechanism not only ensures the correctness of consensus, but also improves the efficiency of the system.

[0069] Based on the above single main chain and multiple side chain structure, combined with the practical Byzantine fault-tolerant consensus algorithm, the communication complexity can be reduced to O(n), and multi-chain block fusion and local consensus can be supported. Even in extreme environments of network isolation or congestion, some nodes can still establish local HashGraph with 1 / 3 fault tolerance, and reach consensus with the main chain after the network is restored to ensure data consistency.

[0070] In the present invention, the main chain and side chain in the target blockchain undertake the storage task of different types of data. The multi-centralized nodes on the main chain are responsible for task assignment and trust backtracking, and store the core data and metadata of the system, such as user identity authentication information, transaction history, smart contract code and execution results, etc. These data are crucial to the security and stability of the system, so the main chain adopts a highly secure design to ensure that the data cannot be tampered with and is traceable.

[0071] The side chain is used to process specific business logic and data storage. According to business needs, multiple side chains can be created to store different types of data, such as user personal information, specific details of transactions, state variables of smart contracts, etc. The design of the side chain is more flexible and scalable, and can meet the needs of different business scenarios. On this basis, write smart contracts between the main chain and the side chain, and design an efficient Byzantine fault-tolerant consensus algorithm that supports multi-chain integration to achieve the integration of the main chain and the side chain, and finally form a standardized graph-structured blockchain.

[0072] Taking the intelligent driving scenario as an example, vehicles need to exchange a large amount of data in real time, such as location, speed, direction, etc. These data are crucial to driving safety, so the authenticity and reliability of the data need to be ensured. Through the main chain and side chain structure of the target blockchain, core data such as vehicle authentication information and driving data can be stored on the main chain to ensure the security and non-tamperability of the data. At the same time, sensitive data such as vehicle personalized settings and driving habits can be stored on the side chain to protect user privacy. In the intelligent driving scenario, vehicles need to exchange information and make decisions in real time, such as following the vehicle in front, changing lanes and overtaking, etc. Through the mechanism of mutual voting and virtual voting, vehicles can quickly reach a consensus and take corresponding actions to improve driving safety and efficiency.

[0073] In the present invention, in order to support the efficient execution of smart contracts, the reputation, instructions and physical objects in management affairs are mapped to corresponding structured digital abstractions. Based on entity relationship theory and Word2Vec (Word to Vector) technology, the storage structure and logical relationship are defined to ensure the efficiency, verifiability and scalability of data transmission and processing. By equipping the main chain with Turing-complete intelligent scripts and using incomplete stack machine scripts on the side chain, the underlying nodes are prevented from unauthorized execution of tasks, while meeting the performance requirements of low-end mobile devices. The weak central node verifies the data source and endorses the execution results to ensure that the business process is consistent with the rules.

[0074] Based on the above embodiment, the method further includes: The data to be uploaded is encrypted by a lattice-based encryption algorithm to obtain the encrypted data to be uploaded and a digital signature corresponding to the encrypted data to be uploaded; After determining that the encrypted data to be uploaded to the chain and the digital signature have passed consensus verification, the encrypted data to be uploaded to the chain and the digital signature are added to the target blockchain, and according to the preset field information in the encrypted data to be uploaded to the chain, a tree node corresponding to the encrypted data to be uploaded to the chain in the tree data structure is constructed.

[0075] In the present invention, in order to resist quantum attacks and balance data confidentiality and processability, the lattice-based NTRU (Number Theory Research Unit) encryption algorithm is used to implement semantically secure encryption and signature protocols. At the same time, the present invention optimizes the plaintext encoding method, algebraic structure and execution efficiency of the NTRU algorithm, combines the autonomous sampling method (Bootstrap) and relinearization technology to suppress noise, and constructs a fully homomorphic encryption scheme that supports arithmetic and logical calculations. Further, the use of evaluation keys is eliminated through smoothing technology and modular reduction, the computing, communication and storage overheads are reduced, the indistinguishability of fresh ciphertext and calculated ciphertext is ensured, and the full-state security processing of ciphertext is achieved in a multi-key environment. Finally, security mechanisms such as hash algorithms, homomorphic computing and digital signatures are integrated to build a unified chain security system, realize an efficient, secure and reliable information management platform, and meet the diverse needs in complex scenarios.

[0076] In the present invention, based on NTRU quantum-resistant encryption working on the convolution polynomial ring Above, its encryption and decryption operations only need to perform simple polynomial multiplication, so its performance is significantly better than other public key cryptographic systems. At the same time, the NTRU algorithm can be strictly reduced to the interval shortest vector (GapSVP) problem on the lattice, has strong anti-quantum attack capabilities, and is very suitable for information-sensitive blockchain applications. Its basic encryption and decryption structure is as follows: : According to the safety parameters Generate modulus and polynomial order , and select two small variance Gaussian distributions and as a public variable. Then, from Medium Sampling Random polynomial of order and ,calculate As a private key, and output is the public key.

[0077] : Encryption, that is, encoding plaintext data into a polynomial ,from Randomly select a noise vector from the distribution and , output ciphertext .

[0078] : Decryption, i.e. calculation , the output It is the plaintext before encryption.

[0079] Based on the above encryption and decryption process, we can see that the NTRU algorithm is very simple. Since its security is mainly based on the ring LWE (Learning With Errors), a shorter polynomial and a smaller modulus can prevent it from being attacked by various attacks such as Shor's algorithm and Schmidt orthogonalization. It can be implemented in most devices at a low storage and computing cost.

[0080] In the blockchain, since there is more than one user of information with different rights and responsibilities, different data may be encrypted under the control of different keys. To this end, the present invention considers implementing basic multi-key homomorphism based on the following decryption structure, where homomorphism is added: ; Homomorphic multiplication: .

[0081] Furthermore, the present invention adopts smoothing technology to represent the ciphertext in a form that is easier to represent and process, and makes the decryption process no longer dependent on the number of times the key is used. Specifically, the NTRU algorithm is also used to encrypt the data in the form of a vector: .

[0082] Then, define Function for ciphertext vector Expand the polynomial coefficients into a matrix , and the smoothing function is specified as: .

[0083] Through the above process, we can know that The first element of implement Operation, you can restore the plaintext ,in, The function represents the nearest integer. and conduct and Operations can also be used to obtain the ciphertext matrix corresponding to the XOR and AND operations. To further improve the performance, the present invention will also The basis of the function, according to The ratio is expanded to make the ciphertext size smaller than The scale of decreases.

[0084] For the blockchain technology under the existing zero-trust architecture, complete decentralization has not been achieved, but a strategy of centralized decision-making and decentralized execution has been adopted. In order to overcome the limitations of existing consensus mechanisms such as PoW (proof of work) and DPoS (delegated proof of stake) in terms of throughput, scalability and energy consumption, and to better fit the model of hierarchical authorization and multilateral collaboration in large-scale system management, the present invention provides a blockchain construction and consensus method based on a graph structure. The method takes HashGraph as the core framework, revolves around the main chain, and connects to the corresponding side chain for different functional modules such as data storage and scheduling, so as to achieve a reliable consensus mechanism and ensure efficient block generation speed and task confirmation timeliness. At the same time, the present invention maps various smart contracts to side chains at different levels and links of system behavior, which not only ensures that the upper-level complex tasks can be executed through Turing-complete scripts, but also that the lower-level tasks are difficult to exceed due to the incomplete characteristics of the scripts, and also adapts to the performance requirements of large-scale low-end mobile devices (such as Internet of Things devices) with limited resources.

[0085] Furthermore, based on chained block data, the present invention constructs complete indexes on service nodes and consensus nodes, as well as partial indexes on verification nodes under the premise of data encryption protection. These indexes are stored in ciphertext form and meet the indistinguishability requirements, ensuring that even without a key, an attacker cannot obtain any valuable information through the index. On this basis, combined with predicate encryption technology and tree data structure (such as B+ tree structure), the present invention constructs a linear multi-dimensional ciphertext interval retrieval method, which not only has efficient retrieval performance and a small number of interaction rounds, but also can effectively hide the sorting characteristics of data. In terms of access control, the BLP model is used as the underlying framework to allocate appropriate credit quotas to authorized entities, and the determination of access rights is realized through a dynamic collaborative filtering mechanism. This mechanism can dynamically adjust the risk benchmark according to changes in the overall user behavior of the system, thereby better balancing the relationship between system risk and availability.

[0086] In addition, in order to cope with the key requirements of information protection, digital signature and integrity verification in blockchain technology, the present invention adopts a lattice-based cryptographic algorithm to resist the threats of data leakage, information forgery and block tampering that may be caused by quantum computing. The NTRU algorithm shows strong resistance to lattice basis reduction or Shor cycle calculation because it can be reduced to the GapSVP (interval shortest vector) problem on the lattice through quantum proof, while maintaining a high computational efficiency. In view of this, the present invention constructs an encryption, decryption and digital signature scheme that combines the NTRU algorithm with polynomial coding on the Galois field, aiming to meet the strict requirements of blockchain for data authenticity, confidentiality and real-time performance.

[0087] In addition, given that blockchain data may involve a variety of complex calculations during the integration and processing process, and the data must remain confidential during the processing process, the present invention extends the homomorphic characteristics of NTRU to an environment with multiple parties involved, in order to implement privacy calculations and processing methods between ciphertexts encrypted with different keys, thereby ensuring the security and privacy of data during the processing process.

[0088] Compared with the prior art, the beneficial effects of the present invention are mainly reflected in the following three points: 1. In order to give full play to the advantages of weak centralization and high security of blockchain, the underlying physical architecture needs to be implemented with a distributed structure. Based on the actual management logic and functional requirements, the differences in interface definition, communication mode and physical performance of the underlying networks such as the Internet of Things, mobile Internet and backbone network are shielded to ensure that the implementation of blockchain data structure, information processing method and security protocol has unified and clear specifications.

[0089] Second, we use reliable high-performance service nodes and low-end idle computing power in the network to build a load-balanced trust dependency mechanism. On this basis, we combine the advantages of Delegated Proof of Stake (DPoS) and Practical Byzantine Fault Tolerance (PBFT) algorithms, use the Hyperledger as an information exchange carrier, and build an efficient consensus algorithm with (n-1) / 3 fault tolerance. This algorithm can effectively resist various active attacks such as block producer collusion, low voting rate abuse, and distributed denial of service within the threshold range.

[0090] 3. Adopt the lattice-based quantum-resistant NTRU algorithm to realize data encryption and digital signature functions respectively. In order to balance the contradiction between confidentiality and system functionality, the Flattering technology is used to enable the encryption mechanism to support fully homomorphic computing in a multi-key environment. Combined with zero-knowledge proof technology, it ensures that smart contracts, information fusion and verification can be executed on semantically secure ciphertext, further improving the security and functionality of the system.

[0091] The zero-trust security data processing system provided by the present invention is described below. The zero-trust security data processing system described below and the zero-trust security data processing method described above can be referenced to each other.

[0092] Figure 2 A schematic diagram of the structure of the zero-trust secure data processing system provided by the present invention is shown in FIG. Figure 2As shown, the present invention provides a zero-trust security data processing system, including a first retrieval module 201, a second retrieval module 202, an encryption module 203 and an access control module 204, wherein the first retrieval module 201 is used to determine a set of tree nodes of data to be queried according to target keyword information in a data retrieval task, wherein the set of tree nodes of data to be queried is a set of all tree nodes containing the target keyword information in a tree data structure; the tree data structure is constructed by keyword information and index data; the index data is an index corresponding to the on-chain data in a target blockchain; the second retrieval module 202 is used to determine a target query range tree node set according to a target retrieval range in the data retrieval task, wherein, The target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target retrieval range; the target retrieval range represents the retrieval range corresponding to the data retrieval task in the tree data structure; the encryption module 203 is used to perform a first encryption process on the data tree node set to be queried to obtain the security index information corresponding to the data retrieval task; a second encryption process is performed on the vector representation of each element in the target query range tree node set to obtain the trapdoor corresponding to each element in the target query range tree node set; the access control module 204 is used to determine the query authority of the data retrieval task on the target blockchain based on the security index information and the trapdoor.

[0093] The zero-trust secure data processing system provided by the present invention organizes keyword information and index data by constructing a tree data structure, and determines the tree node sets to be queried and the target query range according to the data retrieval task, and then generates security index information and trapdoors by encrypting these tree node sets, thereby realizing fine-grained access control of data retrieval tasks, improving the security and privacy of data retrieval on the blockchain, and ensuring that only users with corresponding query permissions can access specific data.

[0094] The system provided in the embodiment of the present invention is used to execute the above-mentioned method embodiments. Please refer to the above-mentioned embodiments for the specific process and detailed contents, which will not be repeated here.

[0095] Figure 3 A schematic diagram of the structure of an electronic device provided by the present invention, such as Figure 3As shown, the electronic device may include: a processor (Processor) 301, a communication interface (Communications Interface) 302, a memory (Memory) 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304. The processor 301 can call the logic instructions in the memory 303 to execute the zero-trust security data processing method, which includes: determining a set of tree nodes of data to be queried according to the target keyword information in the data retrieval task, wherein the set of tree nodes of data to be queried is a set of all tree nodes containing the target keyword information in the tree data structure; the tree data structure is constructed by keyword information and index data; the index data is an index corresponding to the on-chain data in the target blockchain; determining a target query range tree node set according to the target retrieval range in the data retrieval task, wherein the target query range tree node set is a set of tree nodes containing the target keyword information in the tree data structure within the target retrieval range; the target retrieval range represents the retrieval range corresponding to the data retrieval task in the tree data structure; performing a first encryption process on the set of tree nodes of data to be queried to obtain security index information corresponding to the data retrieval task; performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trap door corresponding to each element in the target query range tree node set; determining the query authority of the data retrieval task on the target blockchain according to the security index information and the trap door.

[0096] In addition, the logic instructions in the above-mentioned memory 303 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0097] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the zero-trust security data processing method provided by the above methods, and the method includes: determining a set of tree nodes of data to be queried according to target keyword information in a data retrieval task, wherein the set of tree nodes of data to be queried is a set of all tree nodes in a tree data structure that contain the target keyword information; the tree data structure is constructed by keyword information and index data; the index data is an index corresponding to the on-chain data in the target blockchain; according to the target keyword information in the data retrieval task A target search scope is determined, and a target query scope tree node set is determined, wherein the target query scope tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target search scope; the target search scope represents the search scope corresponding to the data retrieval task in the tree data structure; a first encryption process is performed on the data tree node set to be queried to obtain security index information corresponding to the data retrieval task; a second encryption process is performed on the vector representation of each element in the target query scope tree node set to obtain a trapdoor corresponding to each element in the target query scope tree node set; and a query authority of the data retrieval task on the target blockchain is determined according to the security index information and the trapdoor.

[0098] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the zero-trust security data processing method provided by the above embodiments, the method comprising: determining a set of tree nodes of data to be queried according to target keyword information in a data retrieval task, wherein the set of tree nodes of data to be queried is a set of all tree nodes in a tree data structure that contain the target keyword information; the tree data structure is constructed by keyword information and index data; the index data is an index corresponding to the on-chain data in the target blockchain; determining a target query range tree node according to the target search range in the data retrieval task Point set, wherein the target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target retrieval range; the target retrieval range represents the retrieval range corresponding to the data retrieval task in the tree data structure; a first encryption process is performed on the data tree node set to be queried to obtain the security index information corresponding to the data retrieval task; a second encryption process is performed on the vector representation of each element in the target query range tree node set to obtain the trapdoor corresponding to each element in the target query range tree node set; and the query authority of the data retrieval task on the target blockchain is determined according to the security index information and the trapdoor.

[0099] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0100] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A zero-trust security data processing method, characterized in that: include: According to the target keyword information in the data retrieval task, determine the set of tree nodes of the data to be queried, wherein the set of tree nodes of the data to be queried is the set of all tree nodes in the tree data structure that contain the target keyword information; the tree data structure is constructed by the keyword information and the index data; the index data is the index corresponding to the on-chain data in the target blockchain; Determine a target query range tree node set according to a target search range in the data search task, wherein the target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target search range; the target search range represents a search range corresponding to the data search task in the tree data structure; Performing a first encryption process on the data tree node set to be queried to obtain security index information corresponding to the data retrieval task; performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trapdoor corresponding to each element in the target query range tree node set; According to the security index information and the trapdoor, the query authority of the data retrieval task on the target blockchain is determined.

2. The zero-trust security data processing method according to claim 1, characterized in that: The tree data structure is constructed by the following steps: Constructing corresponding key-value pairs according to the keyword information and the index data; The key-value pairs are used as tree nodes, and according to the parent node relationship between each tree node, the tree data structure corresponding to the B+ tree structure or the R tree structure is constructed.

3. The zero-trust security data processing method according to claim 1, characterized in that: The first encryption processing is performed on the set of nodes in the data tree to be queried to obtain security index information corresponding to the data retrieval task, including: Generate corresponding keys based on preset security parameters; Constructing a data polynomial to be queried according to the difference between each element in the set of nodes in the data tree to be queried and the target data vector, wherein the target data vector is an encrypted representation of the data to be retrieved in the target blockchain by the data retrieval task; Generate a corresponding coefficient vector set according to each polynomial coefficient in the data polynomial to be queried; Encrypting the coefficient vector set based on a private key in the key to obtain the security index information corresponding to the data retrieval task; The performing a second encryption process on the vector representation of each element in the target query range tree node set to obtain a trapdoor corresponding to each element in the target query range tree node set includes: A trapdoor calculation is performed according to the vector representation of each element in the target query range tree node set and the key to obtain the trapdoor corresponding to each element in the target query range tree node set.

4. The zero-trust security data processing method according to claim 1, characterized in that: The determining, according to the security index information and the trapdoor, the query authority of the data retrieval task on the target blockchain includes: Obtaining an inner product result between the security index information and the trapdoor; If the inner product result belongs to an element in the target query range tree node set, it is determined that the data retrieval task has query permission on the target blockchain; If the inner product result does not belong to the elements in the target query range tree node set, it is determined that the data retrieval task does not have query authority on the target blockchain.

5. The zero-trust security data processing method according to claim 4, characterized in that: After determining the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor, the method further includes: After determining that the data retrieval task has query authority on the target blockchain, based on an oblivious transfer process, the to-be-queried data corresponding to the data retrieval task on the target blockchain is sent to a target end, wherein the target end is a user terminal that generates the data retrieval task.

6. The zero-trust security data processing method according to claim 1, characterized in that: The target blockchain is a blockchain with a single main chain and multiple side chains structure constructed based on a hash graph, and the consensus algorithm in the target blockchain is a Byzantine fault-tolerant consensus algorithm, wherein the main chain and side chain of the target blockchain are used for tasks of storing different types of data.

7. The zero-trust security data processing method according to claim 6, characterized in that: The method further comprises: The data to be uploaded is encrypted by a lattice-based encryption algorithm to obtain the encrypted data to be uploaded and a digital signature corresponding to the encrypted data to be uploaded; After determining that the encrypted data to be uploaded to the chain and the digital signature have passed consensus verification, the encrypted data to be uploaded to the chain and the digital signature are added to the target blockchain, and according to the preset field information in the encrypted data to be uploaded to the chain, a tree node corresponding to the encrypted data to be uploaded to the chain in the tree data structure is constructed.

8. A zero-trust secure data processing system, characterized in that: include: A first retrieval module is used to determine a set of tree nodes of data to be queried according to target keyword information in a data retrieval task, wherein the set of tree nodes of data to be queried is a set of all tree nodes in a tree data structure that contain the target keyword information; the tree data structure is constructed by keyword information and index data; the index data is an index corresponding to the on-chain data in the target blockchain; A second retrieval module is used to determine a target query range tree node set according to a target search range in the data retrieval task, wherein the target query range tree node set is a set of tree nodes in the tree data structure that contain the target keyword information within the target search range; the target search range represents the search range corresponding to the data retrieval task in the tree data structure; An encryption module is used to perform a first encryption process on the set of tree nodes of the data to be queried to obtain security index information corresponding to the data retrieval task; perform a second encryption process on the vector representation of each element in the set of tree nodes of the target query range to obtain a trap door corresponding to each element in the set of tree nodes of the target query range; An access control module is used to determine the query authority of the data retrieval task on the target blockchain according to the security index information and the trapdoor.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, it implements the zero-trust security data processing method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the zero-trust security data processing method as described in any one of claims 1 to 7.

Images