Data processing method and device, electronic equipment and medium

Abstract

The embodiment of the invention provides a data processing method and device, electronic equipment and a medium, and the method comprises the steps: receiving a data access request of a data user, determining a key attribute set corresponding to the data access request on a data link, and verifying a user certificate of the data user by adopting the key attribute set, and after the user certificate is successfully verified, returning a key information ciphertext stored on a data link to the data user, so that the data user decrypts the key information ciphertext by using a user attribute private key, obtains an original data ciphertext from a cloud storage system through a data storage address obtained after decryption, and sends the original data ciphertext to the data user. And the original data ciphertext is decrypted to obtain the original data shared by the data owner, so that the user is verified in an attribute verification mode before the data in the cloud storage system is obtained, and the security of the data in the cloud storage system is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, electronic equipment and medium for data processing. Background Art

[0002] With the rapid development of the Internet, cloud storage systems have been widely used due to their massive storage space, fast data processing capabilities and convenient access experience.

[0003] However, cloud storage systems also raise some issues, such as trust in centralized services, reliance on third parties for data protection, and potential security risks in data transmission, which affect the security of data in cloud storage systems. Summary of the invention

[0004] In view of the above problems, a method, device, electronic device and medium for data processing are proposed to overcome the above problems or at least partially solve the above problems, including:

[0005] A method for data processing, the method comprising:

[0006] Receive data access requests from data users;

[0007] Determining a key attribute set corresponding to the data access request on a data chain, and using the key attribute set to verify a user certificate of the data user;

[0008] After the user certificate is successfully verified, the key information ciphertext stored in the data chain is returned to the data user, so that the data user can use the user attribute private key to decrypt the key information ciphertext, and obtain the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypt the original data ciphertext, and obtain the original data shared by the data owner.

[0009] Optionally, before receiving the data access request from the data user, the method further includes:

[0010] Obtaining a user attribute set of a user; wherein the user includes a data user;

[0011] A user attribute private key of the user is generated according to the user attribute set, and the user attribute private key is integrated into a user certificate and sent to the user.

[0012] Optionally, the user certificate is generated according to the public key of the user, and the public key is a public key in an asymmetric key pair generated locally by the user.

[0013] Optionally, before receiving the data access request submitted by the data user, the method further includes:

[0014] Receive the data storage address and key attribute set uploaded by the data owner; wherein the data storage address is the data storage address of the original data ciphertext in the cloud storage system, and the original data ciphertext is the ciphertext obtained by encrypting the original data to be shared;

[0015] According to the key attribute set, the key information at least including the data storage address is encrypted to obtain the key information ciphertext, and the key information ciphertext is stored on the data chain.

[0016] Optionally, the data access request is a data access request initiated through an on-chain data address, and the on-chain data address is an on-chain data address obtained by querying in the cloud storage according to an input data keyword;

[0017] After storing the key information ciphertext on the data link, the method further includes:

[0018] In the cloud storage service, an index relationship between the keywords of the original data and the on-chain data address where the key information ciphertext is stored in the data chain is established.

[0019] Optionally, determining a key attribute set corresponding to the data access request on a data chain includes:

[0020] Determine the key information ciphertext on the data chain through the on-chain data address;

[0021] Determine a key attribute set corresponding to the key information ciphertext.

[0022] Optionally, the adopting the key attribute set to verify the user certificate of the data user includes:

[0023] Obtain the user attribute private key set integrated in the user certificate of the data user

[0024] Determining whether the key attribute set and the user attribute private key set match;

[0025] In the case where the key attribute set and the user attribute private key set match, determining that the user certificate of the data user is successfully authenticated;

[0026] In the case where the key attribute set and the user attribute private key set do not match, it is determined that the user certificate verification of the data user has failed.

[0027] A data processing device, comprising:

[0028] A data access request receiving module, used to receive a data access request from a data user;

[0029] A user certificate verification module, used to determine a key attribute set corresponding to the data access request on the data chain, and use the key attribute set to verify the user certificate of the data user;

[0030] The key information ciphertext return module is used to return the key information ciphertext stored in the data chain to the data user after the user certificate is successfully verified, so that the data user can use the user attribute private key to decrypt the key information ciphertext, and obtain the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypt the original data ciphertext, and obtain the original data shared by the data owner.

[0031] An electronic device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method described above when executed by the processor.

[0032] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0033] The embodiments of the present invention have the following advantages:

[0034] In an embodiment of the present invention, by receiving a data access request from a data user, a key attribute set corresponding to the data access request is determined on a data chain, and the key attribute set is used to verify the user certificate of the data user. After the user certificate verification is successful, the key information ciphertext stored on the data chain is returned to the data user, so that the data user uses the user attribute private key to decrypt the key information ciphertext, and obtains the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypts the original data ciphertext, and obtains the original data shared by the data owner, thereby realizing user verification by attribute verification before obtaining data in the cloud storage system, thereby improving the security of data in the cloud storage system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0036] Figure 1a is a schematic diagram of an overall model provided by an embodiment of the present invention;

[0037] Figure 1bIt is a schematic diagram of a system architecture provided by an embodiment of the present invention.

[0038] Figure 1c is a schematic diagram of a data sharing process provided by an embodiment of the present invention;

[0039] Figure 2 is a flowchart of the steps of a data processing method provided by some embodiments of the present invention;

[0040] Figure 3 is a flowchart of another data processing method provided by some embodiments of the present invention;

[0041] Figure 4 It is a structural block diagram of a data processing device provided by some embodiments of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] In cloud storage systems, in order to ensure efficient access control, Attribute-Based Encryption (ABE) technology is used to integrate access rights directly into ciphertext or key, thereby achieving flexible and efficient data management.

[0044] In addition, a revocable attribute encryption and searchable encryption scheme based on bilinear mapping is proposed, which not only improves the performance of attribute encryption, but also enhances the accuracy of data retrieval in cloud storage.

[0045] Among them, attribute encryption technology has two main modes: key policy attribute encryption (KP-ABE) and ciphertext policy attribute encryption (CP-ABE). KP-ABE encrypts data by marking attributes and embeds access rules into the user's private key, which is particularly suitable for application scenarios with frequent queries; while CP-ABE identifies the user's identity by attributes and embeds access control into the ciphertext, providing more flexible access management.

[0046] However, attribute encryption technology usually relies on centralized infrastructure and has the risk of single point failure. By introducing the Xledger system (the Xledger system is a high-performance, modular multi-channel alliance chain system that aims to provide efficient and secure solutions for enterprise applications. Xledger combines the "sort-execution" architecture in the blockchain and the "execution-sort-verification" architecture of Fabric, with modularity, high performance, compatibility, permission control and privacy as design goals), this challenge can be effectively solved, further improving the security and reliability of the system.

[0047] In an embodiment of the present invention, a data sharing solution combining Xledger and ciphertext policy attribute encryption (CP-ABE) is proposed, and the core components of the solution include a cloud server and an Xledger system. The cloud server is responsible for data retrieval and storage, including a cloud storage index module and a cloud storage server module. The member service provider on the Xledger system is responsible for data access, and the user system includes two key entities: the data owner (DO) and the data user (DU). Both can initiate operations to ensure efficient management and secure sharing of data throughout its life cycle.

[0048] like Figure 1a and Figure 1b , the XledgerCA authentication platform is transformed to integrate the attribute encryption function with the CA certificate mechanism. In the initialization phase of XledgerCA, the attribute encryption is initialized; in the data access control phase, the CA certificate is used to perform preliminary verification of the attribute password, which ensures security while improving operational efficiency, and realizes decentralized attribute encryption and system authentication.

[0049] Based on the remodeled XledgerCA authentication platform, combined with the Xledger system and cloud storage environment, we designed and implemented smart contracts to achieve attribute encryption authentication of on-chain data and encryption and decryption of off-chain data. At the same time, we established a data index system in the cloud storage system, and finally built a decentralized data security sharing solution that supports fine-grained access control.

[0050] In an embodiment of the present invention, through the proposed sharing scheme based on Xledger and ciphertext policy attribute encryption, attribute encryption technology is integrated into Xledger, a new attribute key pair generation algorithm is proposed, and a decentralized access control mechanism is efficiently constructed. This scheme can achieve secure data sharing in a weak-trust cloud environment while ensuring efficiency, security and system availability.

[0051] Combination Figure 1a and Figure 1b , mainly including the following steps:

[0052] When the Xledger CA platform is initialized, the initial configuration of attribute encryption is performed; in the data access control stage, the CA certificate is used to perform preliminary authentication of the attribute password, taking into account system efficiency and security, and finally realizing "decentralized" attribute encryption and authentication; based on the transformed CA authentication platform, combined with Xledger and cloud storage system, smart contracts are designed to realize on-chain attribute encryption authentication and off-chain data encryption and decryption. At the same time, a data indexing system is established in the cloud storage system, forming a decentralized, efficient data sharing solution with fine-grained access control.

[0053] The data user (DU) looks up the dataset index dkey in the interstellar file transfer system and selects the required data. DU submits a data access request to Xledger, indicating that it wants to obtain the relevant data. DU finds the corresponding data location through dhash. User certificate verification: Xledger verifies DU's user certificate Ucert based on the key attribute set Akey stored on the chain. If Ucert verification is successful, DU obtains the ciphertext CT and hash value Mhash on the chain. DU uses its attribute private key SK to decrypt CT and obtain the random number R and the URL of the data storage. DU accesses the cloud storage system through the URL, obtains the encrypted data ciphertext M', and verifies whether SM3(M') is equal to Mhash stored on the chain. After verification, DU uses the random number R to decrypt the data ciphertext M' and finally obtains the original data.

[0054] like Figure 1c , a data sharing solution based on Xledger and ciphertext policy attribute encryption, including:

[0055] S1: Transform the attribute key generation scheme and XledgerCA authentication model;

[0056] In step S1, the XledgerCA authentication model is transformed to generate and distribute attribute keys to each entity, including:

[0057] S11: Generation of attribute public key and master key Setup (1 λ )->(PK,MSK): Input a random number λ, select two multiplicative cyclic groups G0 and G1 of order p, g is the generator of G0, and a bilinear map is e: Arbitrarily select a, b, q∈G0, α, β∈Zp, then the attribute public key PK={G0,p,g α ,g β ,a,b,e(g,g) α}, master key MSK = {α};

[0058] S12: User registration: The user enters the username username, password pwd, user type type and attribute set S' according to the system requirements. XledgerCA verifies the user information and converts the user attribute set S' into the attribute key attribute set S = {stt1, stt2, ..., sttn}. The system returns the user registration result.

[0059] S13: The user generates his own asymmetric key: the user inputs a random private key SKu, and calculates the corresponding public key PKu through the elliptic curve algorithm PKu=SKuG (G is the elliptic curve base point).

[0060] S14: The attribute private key is generated by XledgerCA based on the user attribute set S = {att1, att2, ..., attn}, randomly selecting α, t∈ZP*, and calculating K = g α g αt , L = g t For atti∈S, calculate K att =g dit , then the user private key SK = {K, L, Katt}.

[0061] S15: Certificate application and issuance process, that is: the user generates an asymmetric key pair locally, and submits the generated public key PKu to XledgerCA to apply for a personal transaction certificate. XledgerCA generates a user attribute private key SK based on user information and access control attributes, and integrates the attribute private key into the user certificate Certu. XledgerCA signs the generated user attribute private key with the asymmetric key public key PKu provided by the user. Subsequently, XledgerCA distributes the user certificate Certu and the signed user attribute private key to the user. After the user receives the certificate and user attribute private key provided by XledgerCA, he uses the private key SKc of his asymmetric key to verify the signature, thereby obtaining his own user attribute private key SK.

[0062] S2: Encrypt and share data index keywords;

[0063] In step S2, the detailed process of data sharing is as follows:

[0064] S21: Extract data keywords. The data owner (DO) extracts keyword information from the original data and generates a data keyword dkey for subsequent data indexing and access.

[0065] S22: DO selects a symmetric encryption key and uses the key to perform a symmetric encryption operation on the original data d to generate a ciphertext M of the original data, thereby ensuring the security of the data during storage and transmission.

[0066] S23: After the original data is encrypted, DO uses the SM3 national secret summary algorithm to perform summary processing on the original data ciphertext M and generate a hash value Mhash of M, so that the integrity and correctness of the data can be verified in subsequent operations.

[0067] S24: DO uploads the generated original data ciphertext M to the cloud storage system, and obtains the data storage address URL returned by the cloud storage system for subsequent data access and sharing.

[0068] S25: Define data access attribute information and encrypt key information, that is, DO provides {R, URL} of the uploaded data, and the system performs ciphertext policy attribute encryption according to the data access strategy (A, ρ) to obtain the ciphertext CT. The specific calculation formula is X = Me (g, g) αt, Y = gt, Z = qksi, D = (hattigβ)si, CT = {X, Y, Z, D, atti, si},

[0069] S26: After the encryption of the ciphertext policy attributes is completed, the user-defined access control expression is uploaded to the system, and the system extracts the key attribute set;

[0070] S3: extract and decrypt available data;

[0071] In step S3, the detailed process of extracting and decrypting the available data is as follows:

[0072] S31: DU checks the data index record information on the cloud storage based on the data keyword dkey and obtains the on-chain data address dhash.

[0073] S32: DU uses the on-chain data address dhash to access on-chain information. The system verifies by comparing the attribute information in the user certificate (the certificate contains the relevant attributes of data access control) with the key attribute set Akey stored on the chain. If the verification is successful, the system will return the ciphertext key information of the data (including CT and Mhash); if the verification fails, the access request will be rejected.

[0074] S33: When DU obtains data on the chain, the attribute set information in the certificate is matched and authenticated with the Akey in the ciphertext stored on the chain to ensure that the user has the authority to decrypt the data. After verification, DU can continue the decryption operation.

[0075] The present invention is further described below:

[0076] Reference Figure 2 , shows a flowchart of a data processing method provided by some embodiments of the present invention, which may specifically include the following steps:

[0077] Step 201: Receive a data access request from a data user.

[0078] In some embodiments of the present invention, before receiving the data access request from the data user, it also includes: obtaining the user attribute set of the user; generating the user attribute private key of the user based on the user attribute set, integrating the user attribute private key into the user certificate and sending it to the user.

[0079] Among them, users include data users and, of course, data owners.

[0080] In some embodiments of the present invention, the user certificate is generated based on the public key of the user, and the public key is a public key in an asymmetric key pair generated locally by the user.

[0081] For all users, on the one hand, user certificates can be generated based on the public key in the asymmetric key pair, and on the other hand, the user's user attribute set can be obtained (such as user attributes can include the user's position, level, work department, etc.). The user attribute private key is integrated in the user certificate, and attribute-based encryption technology is adopted to integrate access rights directly into ciphertext or keys, thereby achieving flexible and efficient data management and ensuring efficient access control.

[0082] In some examples, such as Figure 1c , specifically including:

[0083] S11: Generation of attribute public key and master key Setup (1 λ )->(PK,MSK): Input a random number λ, select two multiplicative cyclic groups G0 and G1 of order p, g is the generator of G0, and a bilinear map is e: Arbitrarily select a, b, q∈G0, α, β∈Zp, then the attribute public key PK={G0,p,g α ,g β ,a,b,e(g,g) α}, master key MSK = {α};

[0084] S12: User registration: The user enters the username username, password pwd, user type type and attribute set S' according to the system requirements. XledgerCA verifies the user information and converts the user attribute set S' (i.e. the user's user attribute set) into the attribute key attribute set S = {stt1, stt2, ..., sttn}. The system returns the user registration result.

[0085] S13: The user generates his own asymmetric key: the user inputs a random private key SKu, and calculates the corresponding public key PKu through the elliptic curve algorithm PKu=SKuG (G is the elliptic curve base point).

[0086] S14: The attribute private key is generated by XledgerCA based on the user attribute set S = {att1, att2, ..., attn}, randomly selecting α, t∈ZP*, and calculating K = g α g αt , L = g t For atti∈S, calculate K att =g dit , then the user private key SK = {K, L, Katt}.

[0087] S15: Certificate application and issuance process, that is: the user generates an asymmetric key pair locally, and submits the generated public key PKu to XledgerCA to apply for a personal transaction certificate. XledgerCA generates a user attribute private key SK based on user information and access control attributes (that is, based on the user attribute set, generates the user attribute private key of the user), and integrates the attribute private key into the user certificate Certu (that is, the user attribute private key is integrated into the user certificate and sent to the user). XledgerCA signs the generated user attribute private key using the asymmetric key public key PKu provided by the user. Subsequently, XledgerCA distributes the user certificate Certu and the signed user attribute private key to the user. After the user receives the certificate and user attribute private key provided by XledgerCA, he uses the private key SKc of his asymmetric key to verify the signature, thereby obtaining his own user attribute private key SK.

[0088] In some embodiments of the present invention, before receiving the data access request from the data user, it also includes: receiving the data storage address and key attribute set uploaded by the data owner; encrypting the key information including at least the data storage address according to the key attribute set to obtain the key information ciphertext, and storing the key information ciphertext on the data chain.

[0089] The data storage address is the data storage address of the original data ciphertext in the cloud storage system, and the original data ciphertext is the ciphertext obtained by encrypting the original data to be shared.

[0090] In some embodiments of the present invention, the data access request is a data access request initiated through an on-chain data address, and the on-chain data address is an on-chain data address obtained by querying in cloud storage according to an input data keyword.

[0091] In some embodiments of the present invention, after storing the key information ciphertext on the data chain, it also includes: establishing an index relationship between the keywords of the original data and the on-chain data address where the key information ciphertext is stored in the data chain in the cloud storage service.

[0092] For the data owner, the private key in the locally generated asymmetric key pair can be used to encrypt the original data to be shared to obtain the ciphertext, that is, the original data ciphertext.

[0093] After obtaining the original data ciphertext, the original data ciphertext can be stored in the cloud storage system, and then the data storage address in the cloud storage system can be obtained.

[0094] After obtaining the data storage address, the data storage address and the key attribute set can be uploaded to the data chain; the on-chain service in the data chain can then encrypt the key information including at least the data storage address according to the uploaded key attribute set, obtain the key information ciphertext, and store the key information ciphertext on the data chain. If the data user wants to obtain the data storage address of the original data to be shared in the cloud storage system, he must first obtain the key information ciphertext and decrypt the ciphertext.

[0095] After storing the key information ciphertext on the data chain, the on-chain data address of the key information ciphertext can be generated, and then the keywords of the original data to be shared can be set. In the data chain, an index relationship between the keywords of the original data and the on-chain data address can be established.

[0096] In some examples, such as Figure 1c ,The detailed process of data sharing is as follows:

[0097] S21: Extracting data keywords: The data owner (DO) extracts keyword information from the original data and generates data keywords dkey (i.e., keywords of the original data) for subsequent data indexing and access.

[0098] S22: DO selects a symmetric encryption key and uses the key to perform a symmetric encryption operation on the original data d to generate a ciphertext M (i.e., the original data ciphertext) of the original data (i.e., the original data to be shared) to ensure the security of the data during storage and transmission.

[0099] S23: After the original data is encrypted, DO uses the SM3 national secret summary algorithm to perform summary processing on the original data ciphertext M and generate a hash value Mhash of M, so that the integrity and correctness of the data can be verified in subsequent operations.

[0100] S24: DO uploads the generated original data ciphertext M to the cloud storage system, and obtains the data storage address URL (ie, data storage address) returned by the cloud storage system for subsequent data access and sharing.

[0101] S25: Define data access attribute information and encrypt key information, that is, DO provides {R, URL} of the uploaded data (that is, at least the key information of the data storage address), and the system performs ciphertext policy attribute encryption according to the data access strategy (A, ρ) to obtain the ciphertext CT (that is, the key information ciphertext). The specific calculation formula is X = Me (g, g) αt, Y = gt, Z = qksi, D = (hattigβ)si, CT = {X, Y, Z, D, atti, si},

[0102] S26: After the encryption of the ciphertext policy attributes is completed, the user-defined access control expression is uploaded to the system, and the system extracts the key attribute set;

[0103] Step 202: determine a key attribute set corresponding to the data access request on the data chain, and use the key attribute set to verify the user certificate of the data user.

[0104] In some embodiments of the present invention, determining the key attribute set corresponding to the data access request on the data chain includes: determining the key information ciphertext on the data chain through the on-chain data address; determining the key attribute set corresponding to the key information ciphertext.

[0105] In some embodiments of the present invention, the use of the key attribute set to verify the user certificate of the data user includes: obtaining the user attribute private key set integrated in the user certificate of the data user to determine whether the key attribute set and the user attribute private key set match; if the key attribute set and the user attribute private key set match, determining that the user certificate verification of the data user is successful; if the key attribute set and the user attribute private key set do not match, determining that the user certificate verification of the data user has failed.

[0106] Step 203, after the user certificate is successfully verified, the key information ciphertext stored in the data chain is returned to the data user, so that the data user uses the user attribute private key to decrypt the key information ciphertext, and obtains the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypts the original data ciphertext, and obtains the original data shared by the data owner.

[0107] For data users, they can first query through keywords, obtain the corresponding on-chain data address based on the index relationship, and then initiate a data access request through the on-chain data address. After verifying the data access request, they can obtain the key information ciphertext corresponding to the on-chain data address on the data chain. By decrypting the key information ciphertext, they can obtain the data storage address. Through the data storage address, they can obtain the corresponding original data ciphertext in the cloud storage system. By decrypting the original data ciphertext, they can obtain the original data shared by the data owner.

[0108] In some examples, such as Figure 1c , the detailed process of extracting and decrypting available data is as follows:

[0109] S31: DU consults the data index record information on the cloud storage based on the data keyword dkey and obtains the on-chain data address dhash (i.e., the on-chain data address).

[0110] S32: DU uses the on-chain data address dhash to access on-chain information. The system verifies by comparing the attribute information in the user certificate (the certificate contains the relevant attributes of data access control) with the key attribute set Akey stored on the chain. If the verification is successful, the system will return the ciphertext key information of the data (including CT and Mhash); if the verification fails, the access request will be rejected.

[0111] S33: When DU obtains data on the chain, the attribute set information in the certificate is matched and authenticated with the Akey in the ciphertext stored on the chain to ensure that the user has the authority to decrypt the data. After verification, DU can continue the decryption operation.

[0112] In an embodiment of the present invention, by receiving a data access request from a data user, a key attribute set corresponding to the data access request is determined on a data chain, and the key attribute set is used to verify the user certificate of the data user. After the user certificate verification is successful, the key information ciphertext stored on the data chain is returned to the data user, so that the data user uses the user attribute private key to decrypt the key information ciphertext, and obtains the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypts the original data ciphertext, and obtains the original data shared by the data owner, thereby realizing user verification by attribute verification before obtaining data in the cloud storage system, thereby improving the security of data in the cloud storage system.

[0113] Reference Figure 3 , shows a flowchart of another data processing method provided by some embodiments of the present invention, which may specifically include the following steps:

[0114] Step 301, obtaining a user attribute set of a user; wherein the user includes a data user.

[0115] Step 302: Generate a user attribute private key of the user according to the user attribute set, integrate the user attribute private key into a user certificate and send it to the user.

[0116] Step 303, receiving the data storage address and key attribute set uploaded by the data owner; wherein the data storage address is the data storage address of the original data ciphertext in the cloud storage system, and the original data ciphertext is the ciphertext obtained by encrypting the original data to be shared.

[0117] Step 304: encrypt the key information at least including the data storage address according to the key attribute set to obtain key information ciphertext, and store the key information ciphertext on the data chain.

[0118] Step 305: In the cloud storage service, an index relationship between the keyword of the original data and the on-chain data address where the key information ciphertext is stored in the data chain is established.

[0119] Step 306, receiving a data access request from a data user; wherein, the data access request is a data access request initiated through an on-chain data address, and the on-chain data address is an on-chain data address obtained by querying the cloud storage according to the input data keyword.

[0120] Step 307, determine the key information ciphertext on the data chain through the on-chain data address, and determine the key attribute set corresponding to the key information ciphertext.

[0121] Step 308: Obtain the user attribute private key set integrated in the user certificate of the data user.

[0122] Step 309, determining whether the key attribute set and the user attribute private key set match, and if the key attribute set and the user attribute private key set match, determining that the user certificate verification of the data user is successful.

[0123] Step 310, after the user certificate is successfully verified, the key information ciphertext stored in the data chain is returned to the data user, so that the data user uses the user attribute private key to decrypt the key information ciphertext, and obtains the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypts the original data ciphertext, and obtains the original data shared by the data owner.

[0124] In an embodiment of the present invention, by receiving a data access request from a data user, a key attribute set corresponding to the data access request is determined on a data chain, and the key attribute set is used to verify the user certificate of the data user. After the user certificate verification is successful, the key information ciphertext stored on the data chain is returned to the data user, so that the data user uses the user attribute private key to decrypt the key information ciphertext, and obtains the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypts the original data ciphertext, and obtains the original data shared by the data owner, thereby realizing user verification by attribute verification before obtaining data in the cloud storage system, thereby improving the security of data in the cloud storage system.

[0125] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0126] Reference Figure 4 , shows a schematic diagram of the structure of a data processing device provided by some embodiments of the present invention, which may specifically include the following modules:

[0127] The data access request receiving module 401 is used to receive a data access request from a data user;

[0128] A user certificate verification module 402, used to determine a key attribute set corresponding to the data access request on the data chain, and use the key attribute set to verify the user certificate of the data user;

[0129] The key information ciphertext return module 403 is used to return the key information ciphertext stored in the data chain to the data user after the user certificate is successfully verified, so that the data user can use the user attribute private key to decrypt the key information ciphertext, and obtain the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypt the original data ciphertext, and obtain the original data shared by the data owner.

[0130] In some embodiments of the present invention, before receiving the data access request from the data user, the method further includes:

[0131] Obtaining a user attribute set of a user; wherein the user includes a data user;

[0132] A user attribute private key of the user is generated according to the user attribute set, and the user attribute private key is integrated into a user certificate and sent to the user.

[0133] In some embodiments of the present invention, the user certificate is generated based on the public key of the user, and the public key is a public key in an asymmetric key pair generated locally by the user.

[0134] In some embodiments of the present invention, before receiving the data access request submitted by the data user, the method further includes:

[0135] Receive the data storage address and key attribute set uploaded by the data owner; wherein the data storage address is the data storage address of the original data ciphertext in the cloud storage system, and the original data ciphertext is the ciphertext obtained by encrypting the original data to be shared;

[0136] According to the key attribute set, the key information at least including the data storage address is encrypted to obtain the key information ciphertext, and the key information ciphertext is stored on the data chain.

[0137] In some embodiments of the present invention, the data access request is a data access request initiated through an on-chain data address, and the on-chain data address is an on-chain data address obtained by querying in the cloud storage according to an input data keyword;

[0138] After storing the key information ciphertext on the data link, the method further includes:

[0139] In the cloud storage service, an index relationship between the keywords of the original data and the on-chain data address where the key information ciphertext is stored in the data chain is established.

[0140] In some embodiments of the present invention, determining the key attribute set corresponding to the data access request on the data link includes:

[0141] Determine the key information ciphertext on the data chain through the on-chain data address;

[0142] Determine a key attribute set corresponding to the key information ciphertext.

[0143] In some embodiments of the present invention, the verification of the user certificate of the data user using the key attribute set includes:

[0144] Obtain the user attribute private key set integrated in the user certificate of the data user

[0145] Determining whether the key attribute set and the user attribute private key set match;

[0146] In the case where the key attribute set and the user attribute private key set match, determining that the user certificate of the data user is successfully authenticated;

[0147] In the case where the key attribute set and the user attribute private key set do not match, it is determined that the user certificate verification of the data user has failed.

[0148] In an embodiment of the present invention, by receiving a data access request from a data user, a key attribute set corresponding to the data access request is determined on a data chain, and the key attribute set is used to verify the user certificate of the data user. After the user certificate verification is successful, the key information ciphertext stored on the data chain is returned to the data user, so that the data user uses the user attribute private key to decrypt the key information ciphertext, and obtains the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypts the original data ciphertext, and obtains the original data shared by the data owner, thereby realizing user verification by attribute verification before obtaining data in the cloud storage system, thereby improving the security of data in the cloud storage system.

[0149] Some embodiments of the present invention further provide an electronic device, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the above method is implemented when the computer program is executed by the processor.

[0150] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0151] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above method when executed by a processor.

[0152] A method for data processing, the method comprising:

[0153] Receive data access requests from data users;

[0154] Determining a key attribute set corresponding to the data access request on a data chain, and using the key attribute set to verify a user certificate of the data user;

[0155] After the user certificate is successfully verified, the key information ciphertext stored in the data chain is returned to the data user, so that the data user can use the user attribute private key to decrypt the key information ciphertext, and obtain the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypt the original data ciphertext, and obtain the original data shared by the data owner.

[0156] Optionally, before receiving the data access request from the data user, the method further includes:

[0157] Obtaining a user attribute set of a user; wherein the user includes a data user;

[0158] A user attribute private key of the user is generated according to the user attribute set, and the user attribute private key is integrated into a user certificate and sent to the user.

[0159] Optionally, the user certificate is generated according to the public key of the user, and the public key is a public key in an asymmetric key pair generated locally by the user.

[0160] Optionally, before receiving the data access request submitted by the data user, the method further includes:

[0161] Receive the data storage address and key attribute set uploaded by the data owner; wherein the data storage address is the data storage address of the original data ciphertext in the cloud storage system, and the original data ciphertext is the ciphertext obtained by encrypting the original data to be shared;

[0162] According to the key attribute set, the key information at least including the data storage address is encrypted to obtain the key information ciphertext, and the key information ciphertext is stored on the data chain.

[0163] Optionally, the data access request is a data access request initiated through an on-chain data address, and the on-chain data address is an on-chain data address obtained by querying in the cloud storage according to an input data keyword;

[0164] After storing the key information ciphertext on the data link, the method further includes:

[0165] In the cloud storage service, an index relationship between the keywords of the original data and the on-chain data address where the key information ciphertext is stored in the data chain is established.

[0166] Optionally, determining a key attribute set corresponding to the data access request on a data chain includes:

[0167] Determine the key information ciphertext on the data chain through the on-chain data address;

[0168] Determine a key attribute set corresponding to the key information ciphertext.

[0169] Optionally, the adopting the key attribute set to verify the user certificate of the data user includes:

[0170] Obtain the user attribute private key set integrated in the user certificate of the data user

[0171] Determining whether the key attribute set and the user attribute private key set match;

[0172] In the case where the key attribute set and the user attribute private key set match, determining that the user certificate of the data user is successfully authenticated;

[0173] In the case where the key attribute set and the user attribute private key set do not match, it is determined that the user certificate verification of the data user has failed.

[0174] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0175] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0176] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0177] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0178] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate a device for implementing the functions specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0179] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0180] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce computer-implemented processing, so that the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0181] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0182] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the above elements.

[0183] The above provides a detailed introduction to a data processing method, device, electronic device and medium. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for data processing, characterized in that: The method comprises: Receive data access requests from data users; Determining a key attribute set corresponding to the data access request on a data chain, and using the key attribute set to verify a user certificate of the data user; After the user certificate is successfully verified, the key information ciphertext stored in the data chain is returned to the data user, so that the data user can use the user attribute private key to decrypt the key information ciphertext, and obtain the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypt the original data ciphertext, and obtain the original data shared by the data owner.

2. The method according to claim 1, characterized in that Before receiving the data access request from the data user, the method further includes: Obtaining a user attribute set of a user; wherein the user includes a data user; A user attribute private key of the user is generated according to the user attribute set, and the user attribute private key is integrated into a user certificate and sent to the user.

3. The method according to claim 2, characterized in that The user certificate is generated according to the public key of the user, and the public key is a public key in an asymmetric key pair generated locally by the user.

4. The method according to any one of claims 1 to 3, characterized in that: Before receiving the data access request from the data user, the method further includes: Receive the data storage address and key attribute set uploaded by the data owner; wherein the data storage address is the data storage address of the original data ciphertext in the cloud storage system, and the original data ciphertext is the ciphertext obtained by encrypting the original data to be shared; According to the key attribute set, the key information at least including the data storage address is encrypted to obtain the key information ciphertext, and the key information ciphertext is stored on the data chain.

5. The method according to claim 4, characterized in that The data access request is a data access request initiated through an on-chain data address, and the on-chain data address is an on-chain data address obtained by querying in the cloud storage according to the input data keyword; After storing the key information ciphertext on the data link, the method further includes: In the cloud storage service, an index relationship between the keywords of the original data and the on-chain data address where the key information ciphertext is stored in the data chain is established.

6. The method according to claim 5, characterized in that Determining the key attribute set corresponding to the data access request on the data chain includes: Determine the key information ciphertext on the data chain through the on-chain data address; Determine a key attribute set corresponding to the key information ciphertext.

7. The method according to any one of claims 1 to 3, characterized in that: The adopting the key attribute set to verify the user certificate of the data user includes: Obtain the user attribute private key set integrated in the user certificate of the data user Determining whether the key attribute set and the user attribute private key set match; In the case where the key attribute set and the user attribute private key set match, determining that the user certificate of the data user is successfully authenticated; In the case where the key attribute set and the user attribute private key set do not match, it is determined that the user certificate verification of the data user has failed.

8. A data processing device, characterized in that: The device comprises: A data access request receiving module, used to receive a data access request from a data user; A user certificate verification module, used to determine a key attribute set corresponding to the data access request on the data chain, and use the key attribute set to verify the user certificate of the data user; The key information ciphertext return module is used to return the key information ciphertext stored in the data chain to the data user after the user certificate is successfully verified, so that the data user can use the user attribute private key to decrypt the key information ciphertext, and obtain the original data ciphertext from the cloud storage system through the data storage address obtained after decryption, decrypt the original data ciphertext, and obtain the original data shared by the data owner.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images