Method and system for sharing stream data based on bidirectional hash chain symmetric encryption and signcryption

Abstract

The application relates to a flow data sharing method and system based on bidirectional hash chain symmetric encryption and signcryption in the technical field of data sharing, and comprises the following steps: calculating an original beginning left key corresponding to a first encryption time unit and an original ending right key corresponding to a last encryption time unit in a maximum time interval; based on the original beginning left key and the original ending right key, calculating original encryption sub-keys corresponding to the rest of the encryption time units to generate an encryption key; symmetrically encrypting flow data by using the encryption key, and based on the application request, obtaining response data in a request time period, performing signcryption processing on the response data to obtain signcrypted data; and sending the signcrypted data to a data application user, so that the data application user performs signcryption on the signcrypted data to obtain the response data, and performs decryption processing on the response data to obtain target data, thereby solving the problems that resource consumption is large and privacy is low when existing flow data is subjected to point-to-point data transmission.

Description

Technical Field

[0001] This invention relates to the field of data sharing technology, specifically to a streaming data sharing system based on bidirectional hash chain symmetric encryption and signature encryption. Background Technology

[0002] With the rapid development of IoT technology, the interconnection of devices and the use of networks for information and data exchange are becoming increasingly common. Among data transmission types, streaming data (continuously generated and transmitted time-series data, such as video streams, audio streams, and sensor data streams) organized around time is playing an increasingly dominant role. This data, often collected by various IoT sensors, needs to be encrypted and uploaded to the cloud before being accessed in time-segmented units. The continuity of streaming data is crucial for application scenarios; however, existing IoT communication technologies face numerous challenges in sharing streaming data.

[0003] First, traditional algorithms incur significant time and computational overhead. While public-key encryption algorithms offer high security in encrypted sharing of streaming data, the encryption and decryption processes are relatively slow, making them unsuitable for large-scale streaming data transmission. Furthermore, it's often impossible to know in advance who will receive the data, thus hindering public-key encryption. If traditional symmetric encryption algorithms are used, a dedicated symmetric key needs to be generated for each data segment to ensure security. When users request a large amount of data, key transmission incurs substantial communication overhead.

[0004] Second, centralized storage architectures have limitations. Most existing IoT systems rely on centralized servers to store data; however, this is prone to single points of failure, affecting data transmission across the entire system. For streaming data, failures can disrupt data sharing processes, impacting system reliability. Furthermore, centralized servers require users to fully trust the server operators to ensure their transaction data is not leaked or tampered with, which is difficult to guarantee in reality. Summary of the Invention

[0005] This paper presents a streaming data sharing system based on bidirectional hash chain symmetric encryption and signcryption, which has the following advantages compared with existing technologies:

[0006] Using a bidirectional hash chain to generate symmetric encryption keys significantly improves encryption efficiency and reduces the complexity of key management. Combining the advantages of symmetric and public-key encryption, it uses a bidirectional hash chain to calculate the symmetric key. During transmission, only the first and last two encryption subkeys are sent, reducing communication overhead and providing an efficient key generation and management mechanism. Furthermore, by sending only the first and last two encryption subkeys, encryption keys exceeding the timeframe of these two subkeys cannot be calculated, ensuring that data requesting users' access does not exceed limits and guaranteeing the efficiency and security of data sharing.

[0007] A decentralized management mode using the InterPlanetary File System (IPFS) is used. IPFS is a decentralized file storage and sharing protocol that realizes an efficient and secure file transmission network through distributed hash tables, content addressing and peer-to-peer communication technology. Using IPFS can improve the robustness of the system, avoid single point failure and trust problems, and ensure the real-time and continuity of the streaming data transmission;

[0008] The Chinese remainder theorem is used to reduce communication overhead. The present application uses the Chinese remainder theorem to compress the CID set of the requested data, thereby reducing the amount of data transmission.

[0009] The present application solves the problem of large resource consumption and low security of existing streaming data in peer-to-peer data transmission.

[0010] To solve the above technical problems, the present application solves the problem by the following technical scheme:

[0011] A streaming data sharing method based on bidirectional hash chain symmetric encryption and signcryption, comprising the following steps:

[0012] Set the maximum time interval of the date and the encryption time unit, calculate the original beginning left key corresponding to the first encryption time unit in the maximum time interval, and the original end right key corresponding to the last encryption time unit;

[0013] Based on the original beginning left key and the original end right key, use the fourth hash function to calculate the original encryption sub-key corresponding to the remaining encryption time units;

[0014] Collect all original encryption sub-keys, original beginning left keys and original end right keys into a list to obtain an encryption key;

[0015] Symmetrically encrypt the streaming data using the encryption key, and obtain the response data of the request time period based on the application request of the data application user, and perform signcryption processing on the response data to obtain signcrypted data;

[0016] Send the signcrypted data to the data application user, so that the data application user decrypts the signcrypted data to obtain the response data, and performs decryption processing on the response data to obtain target data.

[0017] The data application user decrypts the response data to obtain the target data, comprising the following steps:

[0018] Obtain a large prime number set uploaded by a data upload user to a blockchain network, and decompress the compressed data in the response data based on the large prime number set to obtain index data;

[0019] download a first ciphertext corresponding to the index data in the interstellar file system based on the index data, and obtain a request segment left beginning key and a request segment end right key in the response data;

[0020] Based on the request segment left beginning key and the request segment end right key, calculate the request segment encryption sub-key corresponding to the remaining encryption time units in the request time period;

[0021] Use the request segment left beginning key, the request segment end right key, and all request segment encryption sub-keys to decrypt the first ciphertext to obtain the target data.

[0022] The calculation formula of the original beginning left key, the original end right key, and the original encryption sub-key is:

[0023]

[0024] Wherein, α and β are two long-term secret keys of the data upload user, DT represents the date, n is the maximum time interval, H4(·) is the fourth hash function, i represents the ith encryption time unit, is the original beginning left key, is the original end right key, and together constitute the original encryption sub-key, and is calculated according to the original beginning left key, is calculated according to the original end right key.

[0025] The calculation formula of the request segment encryption sub-key corresponding to the remaining encryption time units in the request time period is:

[0026]

[0027] Wherein, is all request segment encryption sub-keys, H4(·) is the fourth hash function, i represents the ith encryption time unit, is the request segment encryption sub-key calculated according to the request segment beginning left key , is the request segment encryption sub-key calculated according to the request segment end right key .

[0028] Wherein, the response data of the request time period is obtained based on the application request of the data application user, including the following steps:

[0029] Upload the first ciphertext obtained by symmetric encryption to the interstellar file system, and receive the index set returned by the interstellar file system according to the first ciphertext;

[0030] According to the request time period in the application request, the index data of the request time period in the index set is compressed, and the compressed index data, the request segment beginning left key of the request time period corresponding to the index data, and the request segment ending right key are packaged to generate response data.

[0031] The response data is signed and encrypted, including the following steps:

[0032] An encryption parameter disclosed by a key generation center is obtained, a random number is randomly selected as a user part private key, and a user part public key is generated based on the encryption parameter, and the user part public key is sent to the key generation center.

[0033] The center public key and the center private key generated by the key generation center based on the user part public key and the encryption parameter are received.

[0034] The user part public key and the center public key of the data application user are obtained, and the signed and encrypted parameters are calculated, the response data is encrypted based on the user part public key, the center public key, the application user information, the signed and encrypted parameters, and the system public key, and the second ciphertext is generated.

[0035] The second ciphertext is signed based on the uploaded user information, the user part public key, the center public key, the random number, the timestamp, the user part private key, and the center private key, and the signed and encrypted data is obtained.

[0036] The response data is encrypted based on the user part public key, the center public key, the application user information, the signed and encrypted parameters, and the system public key to generate the second ciphertext, including the following steps:

[0037] The first application user hash value is calculated based on the application user information, the user part public key, the center public key, and the system public key through the first hash function, and the calculation formula of the first application user hash value is: Wherein, RID DU is the application user information, X DU is the user part public key, A DU is the center public key, and SPK is the system public key of the key generation center.

[0038] The encryption mask is calculated based on the random number, the user part public key, the center public key, the first application user hash value, the system public key, and the signed and encrypted parameters through the second hash function, and the encryption mask calculation formula is: B = H2(RID DU , U, W), u represents a random number, which is a value in a positive integer group of a key generation center; a signature and encryption parameter U=u*P, P is a generator of an additive group of the key generation center; W is an intermediate calculation parameter;

[0039] The response data is encrypted by the encryption mask to obtain second ciphertext, wherein a calculation formula of the second ciphertext is: Wherein, M represents the response data.

[0040] The response data is encrypted by the encryption mask to obtain second ciphertext, wherein a calculation formula of the second ciphertext is:

[0041] Based on the application user information, the user partial public key two, the center public key two and the system public key, a first application user hash value is calculated by a first hash function, wherein a calculation formula of the first application user hash value is: Wherein, RID DU is the application user information, X DU is the user partial public key two, A DU is the center public key two, and SPK is the system public key of the key generation center.

[0042] Based on the random number, the user partial public key two, the center public key two, the first application user hash value, the system public key and the signature and encryption parameter, an encryption mask is calculated by a second hash function, wherein a calculation formula of the encryption mask is: B=H2(RID DU , U, W), u represents a random number, which is a value in a positive integer group of a key generation center; a signature and encryption parameter U=u*P, P is a generator of an additive group of the key generation center; W is an intermediate calculation parameter;

[0043] The response data is encrypted by the encryption mask to obtain second ciphertext, wherein a calculation formula of the second ciphertext is: Wherein, M represents the response data.

[0044] The signature and encryption data is decrypted by the data application user, including the following steps:

[0045] The signature and encryption data sent by the data upload user is received, and the signature and encryption data is verified for timeliness, and the user partial private key two and the center private key two are obtained after the verification is passed.

[0046] Based on the user partial private key two, the center private key two, the application user information in the signature and encryption data and the signature and encryption parameter in the signature and encryption data, the second ciphertext in the signature and encryption data is decrypted to obtain the response data.

[0047] A stream data sharing system based on bidirectional hash chain symmetric encryption and signcryption, the stream data sharing system performs the stream data sharing method based on bidirectional hash chain symmetric encryption and signcryption described above, including a data uploading user, a data applying user, a key generation center and a file system in stars;

[0048] The data uploading user is used to perform the following steps:

[0049] Set the maximum time interval of the date and the encryption time unit, calculate the original beginning left key corresponding to the first encryption time unit and the original end right key corresponding to the last encryption time unit in the maximum time interval, calculate the original encryption sub-key corresponding to the rest of the encryption time units based on the original beginning left key and the original end right key using the fourth hash function, and collect all the original encryption sub-keys, the original beginning left key and the original end right key to a list to obtain the encryption key; symmetrically encrypt the stream data using the encryption key, obtain the response data of the request time period based on the application request of the data applying user, and perform signcryption processing on the response data to obtain the signcrypted data;

[0050] The data applying user is used to perform the following steps:

[0051] Decrypt the signcrypted data to obtain the response data, obtain the large prime number set uploaded by the data uploading user to the blockchain network, decompress the compressed data in the response data based on the large prime number set to obtain the index data, download the first ciphertext corresponding to the index data in the file system in stars based on the index data, and obtain the request segment left beginning key and the request segment end right key in the response data; based on the request segment left beginning key and the request segment end right key, calculate the request segment encryption sub-key corresponding to the rest of the encryption time units in the request time period; use the request segment left beginning key, the request segment end right key and all the request segment encryption sub-keys to decrypt the first ciphertext to obtain the target data;

[0052] The key generation center is used to receive the user partial public key one and the user partial public key two, and generate the center public key one and the center private key one based on the user partial public key one respectively, and generate the center public key two and the center private key two based on the user partial public key two respectively;

[0053] The file system in stars is used to receive the first ciphertext of the data uploading user, and return the index set corresponding to the first ciphertext. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to make the technical solutions in the embodiments of the present application or the prior art clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only need to be some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort.

[0055] Figure 1 A flow data sharing system architecture based on bidirectional hash chain symmetric encryption and signcryption is provided for the second embodiment. DETAILED DESCRIPTION

[0056] The present application will be further described in detail below in combination with embodiments. The following embodiments are only an explanation of the present application and the present application is not limited to the following embodiments.

[0057] Embodiment one

[0058] Before the present application describes the flow data sharing method based on bidirectional hash chain symmetric encryption and signcryption, the following description is first made about the use of the key generation center (KGC) and the simple process of building.

[0059] The key generation center is used to generate public parameters and complete public keys and private keys for participating users. When the key generation center is built, a security parameter λ needs to be given, then two large prime numbers p and q are selected, both of which have a length of about λ bits, then set E(F p ) to be an elliptic curve defined in a finite field F p , and its equation is:

[0060] y 2 ≡x 3 +ax+b(mod p), where a∈F p , b∈F p , and the condition 4a 3 +27b 2 ≠0 mod p is met. When the key generation center performs signcryption, an additive group G is selected, which has a modulus q and is defined on the elliptic curve E(F p ), and contains an infinite point. Set P to be the generator of the additive group.

[0061] On the other hand, the key generation center also defines four hash functions as follows:

[0062] The first hash function H1:

[0063] The second hash function H2: {0, 1} id ×G×G→{0, 1} l ;

[0064] The third hash function H3:

[0065] The fourth hash function H4: {0, 1} * → {0, 1} k ,

[0066] wherein id represents the identity length, l represents the information length, k represents the encryption key length, T represents a timestamp, represents a positive integer group modulo q.

[0067] The first hash function is used to calculate the combination of the user's identity, public key and system public key, and the identity information (a binary bit string with a length of id) and the elements on the three additive groups G are combined and calculated, and an element in the positive integer group is output; the second hash function is used to generate the mask or encryption key of the message, and the identity information and the elements on the two additive groups G are combined and calculated, and a fixed length bit string is output; the third hash function is used to calculate the signature part in the signcryption process, and the identity information, the elements on the two additive groups G, a bit string (the encrypted version of the message), an element on the additive group G and a timestamp are combined and calculated, and an element in the positive integer group is output; the fourth hash function is used to generate an encryption key, and an arbitrary length bit string is input, and a fixed length bit string is output.

[0068] On the other hand, in order to normally execute the two-way hash chain based symmetric encryption and signcryption method for stream data sharing of the present application, a system composed of a data uploading user, a data applying user, a key generation center and an interstellar file system needs to be built, so as to support data transmission in the process of time series data encryption and decryption. When building, the data uploading user and the data applying user both need to register with the key generation center to establish a trust relationship with the key generation center. Therefore, after the data uploading user completes the registration, the encryption parameters disclosed by the key generation center can be directly obtained, which are used to generate the user part public key one and the user part private key one by the data uploading user. The encryption parameters include the positive integer group and the generator P of the additive group is a base point on the elliptic curve, and the encryption parameter is the data provided by the key generation center, which is provided when the key generation center is constructed. In addition, when the data uploading user registers with the key generation center, two long-term secret keys a and β of the data uploading user are also automatically generated. After the above basic preparations are completed, the flow data sharing method based on two-way hash chain symmetric encryption and sign encryption can be performed. It should be noted that in the flow data sharing process of the present application, it mainly includes two processes of symmetric encryption based on two-way hash chain and sign encryption. The symmetric encryption based on two-way hash chain is to encrypt the flow data collected by the data uploading user; the sign encryption is to encrypt the data generated by the data uploading user in response to the application of the data application user.

[0069] First, the flow data collected by the data uploading user is symmetrically encrypted, that is, the flow data collected by the data uploading user is symmetrically encrypted using the encryption key generated by the two-way hash chain to obtain the first ciphertext, and the first ciphertext is uploaded to the interplanetary file system (IPFS).

[0070] Specifically, the maximum time interval of the date and the encryption time unit are set; the original beginning left key corresponding to the first encryption time unit and the original end right key corresponding to the last encryption time unit in the maximum time interval are calculated using the fourth hash function; based on the original beginning left key and the original end right key, the original encryption sub-key corresponding to the remaining encryption time unit is calculated using the fourth hash function, and all original encryption sub-keys, original beginning left key and original end right key are collected into a list to obtain the encryption key; the flow data is symmetrically encrypted using the encryption key to obtain the first ciphertext.

[0071] More specifically, assuming that the maximum time interval of the date DT is n, and the data uploading user needs to calculate the encryption sub-key for each encryption time unit in the maximum time interval. The calculation formula is: The data uploading user first calculates The required related content, first calculate the encryption sub-key when i = 1 (i.e. the first calculation is the first one), also known as the original beginning left key, the calculation formula is: Then according to the calculation result of i = 1, for Recursively calculate Then calculate the encryption sub-key when i = n (i.e. the first calculation is the nth one), also known as the original end right key, the calculation formula is: Then according to the calculation of i = n, for Recursively calculate It should be noted that a and β are two long-term secret keys of the data uploading user, which are randomly selected by the data uploading user in the system initialization stage, and the secret key space is {0, 1}k, k is the key length.

[0072] Further, according to the foregoing calculation, the following can be obtained for Calculate the encryption key Then it is represented as a data set Kset DT , and

[0073] When the data uploading user starts collecting data on date DT, the data uploading user encrypts DT in Kset according to the time period as needed, and then uses the corresponding time period to encrypt the stream data , thereby generating the first ciphertext and uploading the first ciphertext to the IPFS for outsourcing data storage. Correspondingly, the data uploading user will receive the index set sent by the IPFS Then the data uploading user deletes wherein, represents the data collected by the data uploading user in the time interval t i .

[0074] After the uploading of the first ciphertext is completed and the data uploading user receives the index set returned by the IPFS, since the data uploading user will only trigger the signing and encryption process of the response data corresponding to the requested viewing data in the application request after receiving the application request of the data application user, the embodiment further illustrates the signing and encryption process performed by the data uploading user after receiving the application request of the data application user.

[0075] The signing and encryption process of the data generated by the data uploading user in response to the application of the data application user when the data application user applies for data is as follows: based on the application request of the data application user and the index set returned by the IPFS according to the first ciphertext, the response data of the request time period is generated.

[0076] Specifically, based on the request time period requested in the application request of the data application user, the index data of the request time period in the index set is compressed, and the compressed index data and the request segment start left key and the request segment end right key of the request time period corresponding to the index data are packaged to generate the response data.

[0077] The embodiment takes the request time of the data application user as the time range within date DT as [t s , t eThe data is taken as an example for illustration. After receiving the request, the data uploading user first randomly generates a large prime number set, and the length of the generated large prime number set is equal to the length of the index data. The large prime number set is uploaded to the blockchain network for public disclosure. Then, the large prime number set is used to compress the index data by using the Chinese remainder theorem technology to generate compressed data Thus, through the compression processing, the communication overhead is reduced. Then, the request segment start left key of the request time period corresponding to the index data The request segment end right key (i.e. ) and the compressed data are packaged to obtain the response data of the request time period

[0078] When obtaining the response data, the data uploading user can also perform: obtaining the encryption parameter disclosed by the key generation center; randomly selecting a random number as a user partial private key one and generating a user partial public key one based on the encryption parameter, sending the user partial public key one to the key generation center; receiving the center public key one and the center private key one generated by the key generation center based on the user partial public key one.

[0079] Specifically, when the data uploading user obtains the encryption parameter, a random integer x DO is generated as the user partial private key one, and x DO satisfies Then, the user partial public key one X DO is calculated, and the calculation formula is: X DO =x DO ·P. After obtaining the user partial private key one and the user partial public key one, the data uploading user packs the user information, the timestamp and the user partial public key one, and sends them to the key generation center through the SSL / TLS protocol, wherein the packed data form can be represented as {RID DO , X DO , T}. RID DO represents the user information uploaded by the data uploading user, and T represents the timestamp.

[0080] Then, the center public key one and the center private key one generated by the key generation center based on the user partial public key one and the encryption parameter are received.

[0081] The key generation center generates the center public key one and the center private key one, including the following steps: selecting a random number value one a DO , and the random number value one satisfies The center public key one of the key generation center is calculated according to the random number value one, and the calculation formula is: A DO =a DO• P; upload user information RID DO • X, center public key A DO • A, system public key SPK of the key generation center DO and the first upload user hash value based on the system master private key msk of the key generation center, random number value a DO and the first upload user hash value to calculate the center private key y DO , wherein the system master private key and the system public key are both parameters of the key generation center.

[0082] Specifically, the calculation formula of the first upload user hash value is as follows: The calculation formula of the center private key y DO of the key generation center is as follows:

[0083] It should be noted that after the key generation center generates the center public key A DO and the center private key y DO , the center public key A DO and the center private key y DO are sent to the data upload user through the SSL / TSL protocol, and the data upload user can also summarize the user partial public key X DO and the center public key A DO into a set to form a complete public key PK DO ={X DO , A DO}; the user partial private key x DO and the center private key y DO are summarized into a set to form a complete private key sk DO ={x DO , y DO}.

[0084] On the other hand, after the complete public key is generated, the complete public key is also uploaded to the blockchain network for public disclosure; and after receiving the center private key and the center public key, the data upload user also verifies the correctness of the center private key and the center public key, and only after successful verification can the data upload user finally use it.

[0085] Wherein, the data upload user verifies the correctness of the center private key and the center public key of the key generation center, which specifically includes the following steps: calculating a first hash verification value DO , user partial public key X DO , center public key A DO , and system public key SPK of the key generation center through the first hash function Based on the center private key one, the center public key one, the first hash verification value and the system public key, a correctness verification condition is set; it is judged whether the correctness verification condition is established, if yes, the received center public key one and center private key one are stored, if not, the key generation center re-generates the center public key one and the center private key one.

[0086] Specifically, the correctness verification condition is:

[0087]

[0088] Wherein, P is a base point on an elliptic curve, used to generate other points on the elliptic curve; y DO P represents the point P added to itself y DO The second is a scalar multiplication operation in elliptic curve cryptography; the equation is used to verify whether the center private key one of the key generation center matches the center public key one, if the equation is established, it means that the center private key one of the key generation center is correctly generated, and the data uploading user can receive this center private key one and generate a complete private key pair in combination with the user partial private key one, if the equation is not established, it means that the center private key one of the key generation center may be tampered or calculated incorrectly, and the data uploading user needs to re-obtain the correct center private key one of the key generation center.

[0089] The present application sets the correctness verification condition, ensures that the center public key one and the center private key one obtained by the data uploading user are correct and can be used for signing and encrypting, thereby determining that the key generation center has not leaked or tampered with the center private key one, and further ensuring the security of the system.

[0090] After verifying the correctness of the center private key one and the center public key one of the key generation center, the data uploading user can upload {RID DO , PK DO} to the alliance blockchain.

[0091] Then the user partial public key two of the data application user and the center public key two of the key generation center are obtained, and the signing and encrypting parameter is calculated, the response data is encrypted based on the user partial public key two, the center public key two, the application user information, the signing and encrypting parameter and the system public key, and the second ciphertext is generated.

[0092] Wherein, the user partial public key two of the data application user includes the following steps:

[0093] The data application user obtains the encryption parameter disclosed by the key generation center, which is used for the data application user to generate the user partial public key two and the user partial private key two.

[0094] After the data application user obtains the encryption parameter, a random integer x DU is generated as the user partial private key two, and xDU satisfy Then the user part public key two X DU is calculated, and the calculation formula is X DU = x DU ·P, After obtaining the user part private key two and the user part public key two, the data application user packs the application user information, the timestamp and the user part public key two, and sends them to the key generation center through the SSL / TLS protocol, wherein the form of the uploaded data after packing can be represented as {RID DU , X DU , T}, RID DU represents the application user information, which is carried by the data application user himself, and T represents the timestamp.

[0095] After the key generation center obtains the user part public key two, the center public key two is generated based on the user part public key two, first, a random number value two a DU is selected, and the random number value two satisfies Then the center public key two of the key generation center is calculated according to the random number value two, and the calculation formula is A DU =a DU ·P, After generating the center public key two, the key generation center sends the center public key two to the data application user through the SSL / TSL protocol, and the center public key two is also uploaded to the blockchain network for public disclosure.

[0096] On the other hand, after the data application user receives the center public key two, the user part public key two X DU and the center public key two A DU can be summarized as a set to form a complete public key two PK DU ={X DU , A DU}, and then the complete public key two is uploaded to the blockchain network for public disclosure, so that the data uploading user can obtain the user part public key two and the center public key two in the complete public key two through the blockchain network.

[0097] After obtaining the user part public key two and the center public key two, the signing and encryption parameter can be calculated, which includes the following steps: selecting a random number u, and u satisfies The signing and encryption parameter U is calculated based on the random number, and the calculation formula is U = u*P.

[0098] After obtaining the user part public key two, the center public key two and the signing and encryption parameter, the second ciphertext generation step can be executed, which is as follows:

[0099] Based on the application user information RID DU , the user part public key two X DU , and the center public key two A DUand a system public key SPK, a first application user hash value is calculated through a first hash function The calculation formula is

[0100] Based on the random number, the user partial public key two, the center public key two, the first application user hash value, the system public key and the sign-cipher parameter, an encryption mask B is calculated through a second hash function, and the calculation formula is: B = H2(RID DU , U, W), wherein

[0101] After obtaining the encryption mask B, the response data is encrypted through the encryption mask to obtain a second ciphertext c, wherein the calculation formula of the second ciphertext c is: Wherein, M represents the response data.

[0102] After obtaining the second ciphertext, the second ciphertext is signed based on the uploaded user information, the user partial public key one, the center public key one, the random number, the timestamp, the user partial private key one and the center private key one to obtain the sign-cipher data. Specifically, first, a third upload user hash value is calculated through a third hash function, and a signature is calculated through the third upload user hash value, the random number, the user partial private key one and the center private key one to obtain the sign-cipher data.

[0103] Wherein, the calculation formula of the third upload user hash value is: The calculation formula of the sign-cipher data is:

[0104] At this point, the data upload user completes the encryption process. The application generates an encryption key by using a bidirectional hash chain, and uses the encryption key to perform a first layer encryption on the flow data, and then uses an efficient encryption algorithm to perform a second layer sign-cipher on the response data, thereby solving the privacy problem of large-scale flow data stored in the cloud. It can also greatly save the key management overhead. On the other hand, the IPFS distributed storage system is used to store data, which can well avoid the problem of system single point failure and improve the system robustness.

[0105] It should be noted that the response data in the embodiment is regenerated according to the application request of the data application user each time, and the user part public key one and the user part private key one generated by the data upload user; the center public key one, the center private key one, the center public key two and the center private key two generated by the key generation center; the user part public key two and the user part private key two generated by the data application user all only need to be generated once, are long-term held, and do not change no matter how many times the response data is regenerated. On the other hand, the method for sharing stream data based on two-way hash chain symmetric encryption and signcryption of the application also performs data decryption at the data application user, for decrypting and processing the signcryption data generated by the data upload user, including the following steps:

[0106] Sending a data application request to the data upload user.

[0107] Receiving the signcryption data returned by the data upload user and the large prime number set uploaded by the data upload user to the block chain network, wherein the signcryption data includes upload user information RID DO , signature σ, second ciphertext c, signcryption parameter U and timestamp T, and the signcryption data are all calculated in the signcryption process and can be directly used in the signcryption decryption process.

[0108] Verifying the timeliness of the signcryption data, and obtaining the user part private key two and the center private key two after the verification is passed, wherein the timeliness verification is performed according to the sending time of the application request and the return time of the signcryption data, if the return time of the signcryption data is after the sending time of the application request, and the sending time of the application request satisfies the set time difference threshold, the timeliness verification is passed, otherwise the timeliness verification is not passed.

[0109] Decrypting the second ciphertext in the signcryption data based on the user part private key two, the center private key two, the application user information in the signcryption data and the signcryption parameter in the signcryption data, to obtain the response data.

[0110] Specifically, the calculation formula of the response data is as follows:

[0111]

[0112] Wherein, B' = H2(RID DU , U, W');

[0113] W' = U·(x DU +y DU ).

[0114] Thus, the final response data

[0115] In another aspect, the embodiment further comprises a step of verifying the correctness of the signature, and the correctness verification condition of the signature is that the equation is established. If the equation is established, the verification is successful, the response data M' is calculated, otherwise the verification fails.

[0116] wherein h DO′ = H3(RID DO , X DO , A DO , c, U, T);

[0117]

[0118] After the verification step is completed, the large prime number set is downloaded from the blockchain network, and the compressed data in the response data is decompressed based on the large prime number set to obtain the index data.

[0119] After obtaining the index data, the first ciphertext corresponding to the request time period of the index data is downloaded in the interstellar file system according to the index data and the left start key and the right end key of the request segment in the response data are obtained.

[0120] Then, the data application user calculates the request segment encryption sub-key corresponding to the remaining encryption time unit in the request time period based on the left start key and the right end key of the request segment, and the calculation formula is:

[0121]

[0122] wherein, is all request segment encryption sub-keys, H4(·) is a fourth hash function, i represents the i-th encryption time unit, is the request segment encryption sub-key calculated according to the left start key of the request segment, is the request segment encryption sub-key calculated according to the right end key of the request segment, and the left start key and the right end key of the request segment are known.

[0123] Thus, the left start key of the request segment, the right end key of the request segment, and all request segment encryption sub-keys are summarized into a set to obtain The representation of the set is: encryption key set

[0124] Then, the first ciphertext is decrypted using the encryption key set , and finally the target data

[0125] It should be noted that since the encryption of streaming data in this invention is based on bidirectional hash chain heap encryption, the encryption key for streaming data is also used as the decryption key in the response data decryption process; on the other hand, as an example, the streaming data in this invention includes, but is not limited to, videos taken by users through surveillance cameras at various time periods.

[0126] Example 2

[0127] like Figure 1 As shown, a streaming data sharing system based on bidirectional hash chain symmetric encryption and signature encryption includes data uploading users, data requesting users, a key generation center, and an interplanetary file system;

[0128] The data upload user is used to perform the following steps:

[0129] Define the maximum time interval for the date and the encryption time unit. Calculate the original start left key corresponding to the first encryption time unit within the maximum time interval, and the original end right key corresponding to the last encryption time unit. Based on the original start left key and the original end right key, use the fourth hash function to calculate the original encryption subkeys corresponding to the remaining encryption time units. Gather all original encryption subkeys, original start left keys, and original end right keys into a list to obtain the encryption key. Use the encryption key to perform symmetric encryption on the streaming data, and obtain the response data for the requested time period based on the data request user's request. Perform signature encryption on the response data to obtain signature data.

[0130] Data request users are required to perform the following steps:

[0131] The signed data is desealed to obtain the response data, and the set of large prime numbers uploaded to the blockchain network by the data uploader is obtained. Based on the set of large prime numbers, the compressed data in the response data is decompressed to obtain the index data. Based on the index data, the first ciphertext corresponding to the index data is downloaded from the InterPlanetary File System, and the left-hand start key and the right-hand end key of the request segment in the response data are obtained. Based on the left-hand start key and the right-hand end key of the request segment, the request segment encryption subkeys corresponding to the other encryption time units within the request time period are calculated. The first ciphertext is decrypted using the left-hand start key, the right-hand end key of the request segment, and all request segment encryption subkeys to obtain the target data.

[0132] The key generation center receives user partial public key one and user partial public key two, and generates center public key one and center private key one based on user partial public key one, and generates center public key two and center private key two based on user partial public key two;

[0133] The InterPlanetary File System (IPS) receives the first ciphertext from the user uploading data and returns the set of indexes corresponding to that first ciphertext.

[0134] It should be noted that, since the flow data sharing system performs the flow data sharing method based on the two-way hash chain symmetric encryption and signcryption as described in Embodiment One, the flow data sharing method based on the two-way hash chain symmetric encryption and signcryption as described in Embodiment One will not be repeated herein.

[0135] The above description is only the preferred embodiment of the present application, and is not any form of and substantial limitation of the present application. It should be noted that, for those skilled in the art, without departing from the method of the present application, a number of improvements and supplements can also be made, which should be considered as the protection scope of the present application. For those skilled in the art, without departing from the spirit and scope of the present application, some changes, modifications and equivalent changes made by using the above disclosed technical content are equivalent embodiments of the present application; at the same time, any equivalent changes, modifications and evolution of the above-mentioned embodiments according to the essential technology of the present application are still within the scope of the technical solutions of the present application.

Claims

1. A method for sharing streaming data based on bidirectional hash chain symmetric encryption and signature encryption, characterized in that, Includes the following steps: Set the maximum time interval for the date and the encryption time unit, calculate the original start left key corresponding to the first encryption time unit within the maximum time interval, and the original end right key corresponding to the last encryption time unit. Based on the original start left key and the original end right key, the original encryption subkeys corresponding to the remaining encryption time units are calculated using the fourth hash function. Collect all the original encryption subkeys, the original starting left key, and the original ending right key into a list to obtain the encryption key; The streaming data is symmetrically encrypted using an encryption key, and response data for the requested time period is obtained based on the data request user's request. The response data is then signed to obtain signed data. The signed data is sent to the data requesting user so that the data requesting user can deseal the signed data to obtain response data, and then decrypt the response data to obtain the target data; The process of the data requesting user decrypting the response data to obtain the target data includes the following steps: Obtain the set of large prime numbers uploaded to the blockchain network by the data upload user, and decompress the compressed data in the response data based on the set of large prime numbers to obtain index data; Based on the index data, download the first ciphertext corresponding to the index data in the InterPlanetary File System, and obtain the left-starting key and the right-ending key of the request segment in the response data; Based on the left-starting key and the right-ending key of the request segment, calculate the request segment encryption subkeys corresponding to the other encryption time units within the request time period; The first ciphertext is decrypted using the key at the beginning of the request segment, the key at the end of the request segment, and all the encryption subkeys of the request segments to obtain the target data; The formula for calculating the encryption subkey for the remaining encryption time units within the requested time period is as follows: ， ； ； ； in, Encrypt subkeys for all request segments. Let i be the fourth hash function, and i represent the i-th encryption time unit. For the left key at the beginning of the request segment The calculated request segment encryption subkey, For the right key at the end of the request segment The calculated request segment encryption subkey.

2. The streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption according to claim 1, characterized in that, The formulas for calculating the original start left key, the original end right key, and the original encryption subkey are as follows: ； ， ； ； ， ； Where α and β are two long-term secret keys of the data uploading user, DT represents the date, and n is the maximum time interval. Let i be the fourth hash function, and i represent the i-th encryption time unit. The original left key at the beginning, The original right key at the end. and Together they constitute the original encryption subkey, and Calculated based on the original initial left key. It is calculated based on the original end right key.

3. A streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption according to any one of claims 1-2, characterized in that, The process of obtaining response data for a specific time period based on a user's application request includes the following steps: Upload the first ciphertext obtained by symmetric encryption to the InterPlanetary File System (IPS) and receive the set of indices returned by the IPS based on the first ciphertext. Based on the requested time period in the application request, the index data of the requested time period in the index set is compressed, and the compressed index data, the left key at the beginning of the request segment and the right key at the end of the request segment corresponding to the index data are packaged together to generate response data.

4. The streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption according to claim 3, characterized in that, The process of signing and cryptographically processing the response data includes the following steps: Obtain the encryption parameters published by the key generation center, randomly select a random number as the user's private key one, generate the user's public key one based on the encryption parameters, and send the user's public key one to the key generation center. The receiving key generation center generates a central public key 1 and a central private key 1 based on the user's partial public key 1 and encryption parameters; Obtain the user's second public key and the key generation center's second public key from the data application user, calculate the signature parameters, and encrypt the response data based on the user's second public key, the center's second public key, the application user information, the signature parameters, and the system public key to generate a second ciphertext. The second ciphertext is signed using the uploaded user information, user's partial public key 1, central public key 1, random number, timestamp, user's partial private key 1, and central private key 1 to obtain the signed ciphertext data.

5. A streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption according to claim 4, characterized in that, The response data is encrypted using the user's second public key, the central public key, the applicant's information, the signature parameters, and the system public key to generate a second ciphertext, including the following steps: Based on the applicant user information, the user's partial public key II, the central public key II, and the system public key, the hash value of the first applicant user is calculated using the first hash function. The formula for calculating the hash value of the first applicant user is as follows: ,in, For the first hash function, To apply for user information, For the user's part of the public key 2, SPK is the public key of the key generation center; Based on random numbers, user's partial public key II, central public key II, the hash value of the first applicant user, the system public key, and signature parameters, the encryption mask is calculated using the second hash function. The encryption mask calculation formula is as follows: , For the second hash function, , Represents a random number, which is a value within the group of positive integers generated by the key generation center; signature parameters. P is the generator of the additive group of the key generation center; These are intermediate calculation parameters; The response data is encrypted using an encryption mask to obtain the second ciphertext, which is calculated using the following formula: , where M represents the response data.

6. A streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption according to claim 5, characterized in that, Signing the second ciphertext includes the following steps: The hash value of the third uploading user is calculated using the third hash function, and the signature is calculated using the hash value of the third uploading user, a random number, the user's partial private key one, and the central private key one to obtain the signature data. The formula for calculating the hash value of the third uploading user is as follows: , For the third hash function, To upload user information, For the user's partial public key one, The central public key is 1, and T is the timestamp; The formula for calculating the signature data is: , Provide the user with a partial private key. Private key 1 is the central key.

7. A streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption according to any one of claims 1-2, characterized in that, The process for data requesting users to decrypt signed data includes the following steps: Receive the signature data sent by the data upload user, and verify the timeliness of the signature data. After the verification is successful, obtain the user's partial private key 2 and the central private key 2. Based on the user's private key 2, the central private key 2, the applicant user information in the signature data, and the signature parameters in the signature data, the second ciphertext in the signature data is desealed to obtain the response data.

8. A streaming data sharing system based on bidirectional hash chain symmetric encryption and signature encryption, characterized in that, The streaming data sharing system implements the streaming data sharing method based on bidirectional hash chain symmetric encryption and signature encryption as described in any one of claims 1-7, including data uploading users, data requesting users, key generation center, and interplanetary file system; The data uploading user is used to perform the following steps: Set the maximum time interval for the date and the encryption time unit, calculate the original start left key corresponding to the first encryption time unit within the maximum time interval, and the original end right key corresponding to the last encryption time unit. Based on the original start left key and the original end right key, the original encryption subkeys corresponding to the remaining encryption time units are calculated using the fourth hash function; all original encryption subkeys, original start left keys and original end right keys are collected into a list to obtain the encryption key; The streaming data is symmetrically encrypted using an encryption key, and response data for the requested time period is obtained based on the data request user's request. The response data is then signed to obtain signed data. The data requesting user is used to perform the following steps: The signed data is desealed to obtain response data, and the set of large prime numbers uploaded to the blockchain network by the data uploading user is obtained. Based on the set of large prime numbers, the compressed data in the response data is decompressed to obtain index data. Based on the index data, download the first ciphertext corresponding to the index data from the InterPlanetary File System, and obtain the request segment start key and request segment end key from the response data; based on the request segment start key and request segment end key, calculate the request segment encryption subkeys corresponding to the other encryption time units within the request time period; use the request segment start key, request segment end key, and all request segment encryption subkeys to decrypt the first ciphertext to obtain the target data; The key generation center is used to receive user partial public key one and user partial public key two, and generate center public key one and center private key one based on user partial public key one, and generate center public key two and center private key two based on user partial public key two; The InterPlanetary File System is used to receive the first ciphertext from the data uploader and return the index set corresponding to the first ciphertext. The formula for calculating the encryption subkey for the remaining encryption time units within the request time period is as follows: ， ； ； ； in, Encrypt subkeys for all request segments. Let i be the fourth hash function, and i represent the i-th encryption time unit. For the left key at the beginning of the request segment The calculated request segment encryption subkey, For the right key at the end of the request segment The calculated request segment encryption subkey.

Images