A zero-knowledge proof-based encrypted data detection method, device and medium

Abstract

The application discloses a kind of encryption data detection methods, equipment and medium based on zero-knowledge proof, it is related to data detection technical field.The method comprises: by first client, using proof generation algorithm to generate proof file to the plaintext data item to be uploaded;Proof file is uploaded to interstellar file system, the storage address of proof file is generated, and the storage address is returned to first client;By first client, using symmetric encryption algorithm, the plaintext data item is encrypted, and encrypted data file is obtained;The storage address and encrypted data file are uploaded to block chain, and are identified as unreviewed data;Unreviewed data is viewed by administrator system, and initiates review to unreviewed data;In the case where review passes, unreviewed data is updated to review passed data.The application realizes the data in data transaction process by the above method effectively hidden, ensures the privacy, security and compliance of data in secret state.

Description

Technical Field

[0001] This application relates to the field of data detection technology, and in particular to a method, device and medium for detecting encrypted data based on zero-knowledge proof. Background Technology

[0002] Zero-knowledge proofs are a cryptographic technique that allows a prover to demonstrate the truth of a statement to a verifier without revealing any additional information. Pederson commitments are a cryptographic commitment scheme that allows a promisor to "commit" a value to a verifier, but the value cannot be determined until it is revealed. It has two key properties: concealment and binding. Concealment ensures that the verifier cannot deduce the value from the commitment, while binding guarantees that once the promisor generates the commitment, the value cannot be modified. Bulletproofs are an efficient, non-interactive zero-knowledge proof protocol primarily used to prove the correctness of certain computations without exposing the input data.

[0003] Existing data trading platforms face a significant challenge: how to effectively detect and manage non-compliant data. During the transaction process, platforms need to be able to identify encrypted data that exceeds specific standards or does not conform to regulations, thereby ensuring the quality of data obtained by data consumers and preventing it from affecting their research and decision-making. Although various technologies, such as homomorphic encryption and obfuscation, are focused on protecting the privacy of data providers, existing solutions often fail to consider how to achieve compliance detection while maintaining data privacy in multi-party data transactions.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows: Existing trading platforms cannot effectively detect non-compliant data, especially in data transactions involving multiple parties. They cannot achieve compliance detection while maintaining data privacy, thereby ensuring the quality of data obtained by data consumers. Summary of the Invention

[0005] This application provides a method, device, and medium for detecting encrypted data based on zero-knowledge proofs, which can solve the problem that existing trading platforms cannot effectively detect non-compliant data, especially in data transactions involving multiple parties, where compliance detection cannot be achieved while maintaining data privacy, thereby ensuring the quality of data obtained by data consumers.

[0006] In a first aspect, embodiments of this application provide a method for detecting encrypted data based on zero-knowledge proofs. The method includes: generating a proof file for a plaintext data item to be uploaded using a proof generation algorithm through a first client; uploading the proof file to the InterPlanetary File System (IPS), generating a storage address for the proof file, and returning the storage address to the first client; encrypting the plaintext data item using a symmetric encryption algorithm through the first client to obtain an encrypted data file; uploading the storage address and the encrypted data file to the blockchain and marking it as unverified data; viewing the unverified data through an administrator system and initiating a verification of the unverified data; and updating the unverified data to verified data if the verification is successful.

[0007] In one implementation of this application, the unapproved data is viewed through the administrator system, and an approval is initiated for the unapproved data. Specifically, this includes: obtaining the storage address of the proof document corresponding to the encrypted data file through the administrator system, and sending the storage address to a third-party organization; the third-party organization requests the proof document from the InterPlanetary File System (IPS) based on the storage address; the IPS returns the proof document; the third-party organization verifies the proof document using a verification algorithm, obtains the verification result, and returns the verification result to the first client.

[0008] In one implementation of this application, after updating the unapproved data to approved data upon successful approval, the method further includes: a second client purchasing approved data from the blockchain; the blockchain returning the corresponding encrypted data file; and the second client exchanging keys with the first client to complete decryption.

[0009] In one implementation of this application, a first client uses a proof generation algorithm to generate a proof file for the plaintext data item to be uploaded. Specifically, this includes: generating public parameters and random numbers based on preset security parameters, whereby the security parameters are used to generate the proof file and the random numbers are used to generate a key; randomly selecting a range of proof data items from the plaintext data items to be uploaded; and making a commitment to the secret value of the proof based on the public parameters and the range of proof data items, thereby calculating the proof file.

[0010] In one implementation of this application, a first client uses a symmetric encryption algorithm to encrypt plaintext data items to obtain an encrypted data file. Specifically, this includes: obtaining a public key and a private key based on public parameters and random numbers, and obtaining a symmetric key using a symmetric encryption algorithm. The public key and private key are used for key exchange between the first client and the second client, and the symmetric key is used to encrypt plaintext data items. The encrypted data file is then calculated based on the symmetric key and the plaintext data items.

[0011] In one implementation of this application, a third-party organization verifies the proof document using a verification algorithm, obtains the verification result, and returns the verification result to the first client. Specifically, this includes: obtaining public parameters and proof documents; parsing and calculating the proof document to verify whether the secret value is within a preset range; and if the secret value is within the preset range, returning a verification pass to the first client.

[0012] In one implementation of this application, after updating the unapproved data to approved data upon successful approval, the method further includes: when the plaintext data item is updated, the first client updates the proof document and the encrypted data file; when the plaintext data item is revoked, the revocation operation is recorded.

[0013] In one implementation of this application, the method further includes: introducing authentication and access control mechanisms to enable authorized users to access and manipulate data.

[0014] Secondly, embodiments of this application also provide an encrypted data detection device based on zero-knowledge proof. The device includes at least one processor and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: generate a proof document for a plaintext data item to be uploaded using a proof generation algorithm via a first client; upload the proof document to the InterPlanetary File System, generate a storage address for the proof document, and return the storage address to the first client; encrypt the plaintext data item using a symmetric encryption algorithm via the first client to obtain an encrypted data file; upload the storage address and the encrypted data file to the blockchain and mark it as unverified data; view the unverified data through an administrator system and initiate a verification of the unverified data; and update the unverified data to verified data if the verification is successful.

[0015] Thirdly, embodiments of this application also provide a non-volatile computer storage medium for encrypted data detection based on zero-knowledge proofs, storing computer-executable instructions. These instructions are configured to: generate a proof file for the plaintext data item to be uploaded using a proof generation algorithm via a first client; upload the proof file to the InterPlanetary File System (IPS), generate a storage address for the proof file, and return the storage address to the first client; encrypt the plaintext data item using a symmetric encryption algorithm via the first client to obtain an encrypted data file; upload the storage address and the encrypted data file to the blockchain and mark it as unaudited data; view the unaudited data through the administrator system and initiate an audit of the unaudited data; and update the unaudited data to audited data if the audit is successful.

[0016] This application provides a method, device, and medium for detecting encrypted data based on zero-knowledge proofs. By using cryptographic techniques such as Pederson commitments, blinded vector factors, non-interactive proofs, and Bulletproofs, it effectively hides data during data transactions, ensuring the privacy, security, and compliance of data in a encrypted state. By combining IPFS for proof file storage, it avoids the transaction platform storing useless data while maintaining high security, further improving data storage and transmission efficiency. It significantly reduces communication volume during multiple file transfers, and experiments have verified that it has low space and time overhead for generating proof files.

[0017] Encrypted data verification schemes based on range proofs address the problem in existing supply chains or data trading platforms where effective compliance verification of uploaded data is impossible without decryption. Through zero-knowledge range proofs, data quality is ensured by verifying compliance with predetermined standards while guaranteeing data privacy. Non-interactive zero-knowledge proofs and Fiat-Shamir transformations reduce communication overhead and the complexity of proof generation and verification. Data providers can upload data to the blockchain, clearly defining their ownership and transaction rules. Data requesters can securely and automatically obtain data through smart contracts without relying on intermediaries. These platforms often incorporate privacy-preserving computation technologies to protect data privacy during transactions.

[0018] Through theoretical analysis and experimental verification, it has been demonstrated that the proposed scheme has low space and time overhead when generating and verifying proof documents. Compared with other similar schemes, communication volume and storage costs are significantly reduced, verifying the applicability and efficiency of the scheme in practical data trading platforms. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating an encrypted data detection method based on zero-knowledge proof provided in an embodiment of this application; Figure 2 A schematic diagram of a method for detecting encrypted data based on zero-knowledge proof provided in an embodiment of this application; Figure 3 A schematic diagram illustrating the upload process of encrypted data files and proof files for an encrypted data detection method based on zero-knowledge proof provided in this application embodiment; Figure 4 A schematic diagram of a data audit process for an encrypted data detection method based on zero-knowledge proof, provided for an embodiment of this application; Figure 5 This is a schematic diagram of the internal structure of an encrypted data detection device based on zero-knowledge proof, provided as an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] This application provides a method, device, and medium for detecting encrypted data based on zero-knowledge proofs, which solves the problem that existing trading platforms cannot effectively detect non-compliant data, especially in multi-party data transactions, where compliance detection cannot be achieved while maintaining data privacy, thereby ensuring the quality of data obtained by data consumers.

[0022] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0023] Figure 1 This document provides a flowchart of an encrypted data detection method based on zero-knowledge proof, as illustrated in an embodiment of this application. Figure 1 As shown in the figure, the encrypted data detection method based on zero-knowledge proof provided in this application embodiment specifically includes the following steps: Step 10: Using the first client, generate a proof file for the plaintext data item to be uploaded using the proof generation algorithm; First, it is understood that the embodiments of this application are based on range proof for encrypted data detection. Addressing the lack of data compliance detection in data sharing schemes, it utilizes data with range standards to ensure the feasibility of applying range proofs to data detection. Then, it uses IPFS (InterPlanetary File System) to store the proof data files, separating the actual shared files from the proof files, reducing the burden on the actual shared file storage system, and ensuring the immutability of the proof files. Starting from the designed encrypted data detection scheme, and after comparing other schemes, the Bulletproofs range proof algorithm is selected as the theoretical basis for the detection scheme. The performance of the detection scheme is analyzed based on the space consumption, time consumption, and verification time consumption of proof generation.

[0024] In the embodiments of this application, such as Figure 2As shown, the system model of the encrypted dirty data detection scheme can include six entities: Trusted Institution (TI): A trusted third-party institution that provides specified cryptographic services and can provide range proof verification services for the platform. Therefore, TI will work when the platform's data auditors conduct data audits; InterPlanetary File System (IPFS): A blockchain-like file system that can store data. It is only responsible for storing the proof files generated by the DP on the local client for the data uploaded to the platform, without storing the actual data files. After storing the proof files, IPFS will return a storage address (i.e., the hash value of the file) to the DP; Blockchain Platform (BC): A Fabric consortium blockchain platform that supports multiple institutions to jointly maintain the blockchain network by registering nodes through identity authentication. BC also supports chaincode to perform ledger analysis on the world state database. The user information operations are handled as follows: BC is used to store uploaded encrypted data and related transaction information; Data Producer (DP): The entity that generates and uploads encrypted data to the sharing platform. Before uploading the data to the blockchain, the DP first generates a proof document on its local client, uploads the successfully generated proof document to IPFS, encrypts the data using a key, and finally uploads the encrypted file and the storage address of the proof document together to BC; Data Consumer (DC): The purchaser and user of data, i.e., the user of shared data on the platform. The DC needs authorization from the corresponding data DP before it can access the true information of the data; Platform Data Auditor (DA): The auditor who checks the data uploaded to the platform. Usually, they are full-time managers in the data sharing platform, mainly responsible for auditing the data uploaded to the platform for sharing.

[0025] In the embodiments of this application, the following algorithms may be included: (Initialization) Setup(ρ) → Param: This algorithm is executed by the DP local client, taking the security parameter ρ as input and outputting the common parameter Param used in the range proof and the random number R used to generate the key.

[0026] (Key generation) KeyGen(R,Param)→(Pk,Sk,K): Takes a random number R as input and outputs a public-private key pair Pk and Sk for key exchange and a symmetric key K for encrypting files.

[0027] (Data Encryption) Encrypt(Data,K)→(cipherData): The input contains the symmetric key K for data encryption and the plaintext data Data to be uploaded. The output contains the ciphertext data cipherData after symmetric encryption.

[0028] (Proof) Prove(Param,Data)→evidence: Input parameters include the common parameter Param, the plaintext data Data uploaded to the platform by DP, and the output is the proof file evidence generated after proof.

[0029] (Verification) Verify(Param,evidence) → {true,false}: This algorithm is executed by TI. The input includes the common parameter Param and the corresponding evidence obtained by TI from IPFS. After verification by the algorithm, the output result {true,false} corresponds to the verification result.

[0030] (Data Decryption) Decrypt(cipherData,K)→(Data): This algorithm is executed by DC on the user client. The input parameters include the encrypted data file Data obtained from BC and the symmetric key K obtained from DP. The output is the decrypted plaintext data file Data.

[0031] A cryptographic data inspection scheme based on the zero-knowledge proof algorithm Bulletproofs is designed for compliance inspection of cryptographic data in supply chain data trading platforms. By constructing a range proof for confidential data, the scheme enables reviewers to verify the compliance of cryptographic data without revealing any information.

[0032] Furthermore, the solution was expanded and optimized based on the characteristics of supply chain data. First, support for proofs of arbitrary ranges was provided. Then, the construction process of proof documents was optimized. By aggregating range proofs of similar data items, the size of proofs generated in scenarios with multiple data items was effectively reduced. Finally, a loosely coupled and highly cohesive system model was designed based on the solution, which effectively separated the computation and storage overhead from the blockchain and achieved efficient on-chain and off-chain interaction.

[0033] The entities and algorithms mentioned above will be explained in detail below.

[0034] As an optional embodiment, such as Figure 3 As shown, through the first client, a proof generation algorithm is used to generate a proof file for the plaintext data item to be uploaded. Specifically, it may include: Step 101: Generate public parameters and random numbers according to preset security parameters. The security parameters are used to generate the proof file, and the random numbers are used to generate the key. In this step, initialization is performed first. On the DP client, security parameters are entered. Generate common parameters ,in It is an elliptic curve group. The order of the elliptic curve is a large prime number. yes generator, Output the generated random number R and common parameters:

[0035] Step 102: Randomly select a range proof data item from the plaintext data items to be uploaded; In this step, the Prove(Param,Data) proof generation algorithm includes the common parameter Param and the shared data file Data that needs to be uploaded. A data item data1 that can be used for range proof is randomly selected from the shared data file Data. After the selected data item is standardized and preprocessed according to the algorithm, the secret value m of the proof is committed. After all the materials required for proof generation are prepared, the proof can be generated.

[0036] Step 103: Based on the public parameters and range, prove the data items, commit to the secret value of the proof, and calculate the proof document.

[0037] In this step: 1: Random selection Calculate the secret value promise Although M hides m, it is possible to verify whether M corresponds to a specific value of m without revealing m.

[0038] 2: Calculate the binary representation of the secret value m based on its specific value. And let the vector .

[0039] 3: Definition , can and The representation of is converted to .

[0040] 4: Randomly select a random number Calculate the vector sum vector The value of the commitment, Make a commitment to the secret value vector form.

[0041] 5: Randomly select a number Randomly select two blinding vector factors Make a commitment to the randomly selected blinding vector factor and calculate .

[0042] 6: Use the Fiat-Shamir transformation to generate the challenge. Choose a secure hashing algorithm. ,Will As input, perform calculations respectively. Output two challenge values

[0043] 7: Use challenge points to... vector polynomial and The generation of . ; Here, the definition of is... . .

[0044] 8: Transform the vector polynomial Perform an inner product operation to generate a value about The quadratic expression The constant in the quadratic expression is represented as .

[0045] 9: Random selection As blinding factors, respectively for coefficient of the linear term and quadratic coefficient Make a commitment, calculate The Fiat-Shamir transform is used again to generate a third challenge value. .

[0046] 10: Based on the generated challenge value To calculate and calculate Complete the data generation for all proof files. Use inner product optimization proofs to reduce the amount of data transfer required. .

[0047] 11: will Combine and generate a JSON file named "evidence", and upload and store it in the InterPlanetary File System (IPFS).

[0048] Step 20: Upload the proof document to the InterPlanetary File System, generate the storage address of the proof document, and return the storage address to the first client; In this step, IPFS (InterPlanetary File System) is used to store the proof documents, ensuring the decentralization, security, and immutability of data storage, effectively avoiding the single point of failure and data loss risks that occur in traditional centralized storage.

[0049] Step 30: Using the first client, encrypt the plaintext data items using a symmetric encryption algorithm to obtain an encrypted data file; As an optional embodiment, the plaintext data item is encrypted using a symmetric encryption algorithm through the first client to obtain an encrypted data file. Specifically, it may include: Step 301: Obtain a public key and a private key based on public parameters and random numbers, and obtain a symmetric key using a symmetric encryption algorithm. The public key and private key are used for key exchange between the first client and the second client, and the symmetric key is used to encrypt the plaintext data item. In this step, the private key is randomly selected. ,calculate , This is the private key for DP. This is the generated public key, which will be used in subsequent encryption key exchanges; based on the selected AES symmetric encryption algorithm, a random number is used. Generate a symmetric key for encrypting data files. .

[0050] Step 302: Calculate the encrypted data file based on the symmetric key and the plaintext data items.

[0051] In this step, you will input the symmetric key for encrypting the data file. The shared data file "Data" is uploaded and encrypted using a master key expansion process, an initial round of key addition, multiple rounds of function operations, and a final round of function operations. Finally, the encrypted data file "cipherData" is output.

[0052] Step 40: Upload the storage address and encrypted data file to the blockchain and mark it as unverified data; In this step, a blockchain-based data trading platform is used. This platform leverages the decentralized, immutable, and transparent characteristics of blockchain to ensure data ownership, authenticity, and transaction security.

[0053] Step 50: View the unapproved data through the administrator system and initiate an approval process for the unapproved data; As an optional embodiment, such as Figure 4 As shown, the administrator system can be used to view unapproved data and initiate an audit of the unapproved data. Specifically, this may include: Step 501: Obtain the storage address of the proof document corresponding to the encrypted data file through the administrator system and send the storage address to a third-party organization. Step 502: A third-party organization requests proof documents from the InterPlanetary File System based on the storage address; Step 503: InterPlanetary File System returns proof files; Step 504: The third-party organization verifies the proof document using a verification algorithm, obtains the verification result, and returns the verification result to the first client.

[0054] As an optional embodiment, a third-party organization verifies the proof document using a verification algorithm, obtains the verification result, and returns the verification result to the first client. Specifically, this may include: Step 5041: Obtaining public parameters and proof document; In this step, the third-party organization TI obtains the public parameter Param and the evidence file obtained from IPFS.

[0055] Step 5042: Parse and calculate the proof document to verify whether the secret value is within the preset range; In this step, 1: the evidence file is parsed into the required proof data. , If parsing fails, return false directly.

[0056] 2: Verify the challenge value The system checks the correctness of the condition; if an error occurs, it returns false.

[0057] 3: Verify the supporting documents The correctness is determined by calculation. If the results of the expressions on both sides are equal, then it means If it has not been modified, it is correct and will continue to the next verification step; otherwise, return false directly.

[0058] 4: According to generated commitment ,generate promise ,in .

[0059] 5: Utilize generated commitments ,judge Whether it is correct, that is, to judge If the expressions on both sides are equal, then it means... If it has not been modified, it is correct and will continue to the next verification step; otherwise, return false directly.

[0060] 6: Finally, make a judgment Is it equal to The result of the inner product, i.e., the judgment. Here, a proof verification method based on inner product optimization is used to... As input for validation; if the expressions on both sides are equal, it proves that the value of m is within the specified range, that is, it proves that DP does have data within the range, and returns true; otherwise, it returns false, indicating that it does not have data within the range.

[0061] Step 5043: If the secret value is within the preset range, return a verification pass to the first client.

[0062] Step 60: If the review is approved, update the unreviewed data to the approved data.

[0063] In this step, for data that is normally shared, the DC can purchase the decryption key from the DP to obtain the corresponding file, and then the DC can decrypt the data locally; otherwise, it will be marked as unsuccessful, and all other DCs will be unable to obtain the relevant information about the data.

[0064] To ensure the confidentiality of shared data uploaded in the scheme, users generate a new key as an encryption key each time they upload data, preventing situations where a Data Center (DC) can purchase and use all of a Data DP's shared data at once. Furthermore, to ensure the scheme's availability, the Data DP must upload data according to the specified upload template. In cases where the generation of supporting documentation fails (i.e., the scheme is incomplete), the platform will reject upload requests lacking supporting documentation.

[0065] As an optional embodiment, after updating the unapproved data to approved data upon successful approval, the method may further include: Step 70: The second client selects the approved data from the blockchain; Step 80: The blockchain returns the corresponding encrypted data file; Step 90: The second client exchanges keys with the first client to complete decryption.

[0066] In this step, the DC client inputs the symmetric key obtained from the DP. The encrypted file cipherData downloaded from BC is decrypted using the input master key. The decryption process involves key expansion in the initial round, multiple rounds of function operations, and a final round of function operations, outputting the plaintext data file Data.

[0067] As an optional embodiment, after updating the unapproved data to approved data upon successful approval, the method may further include: when the plaintext data item is updated, the first client updates the proof document and the encrypted data file; when the plaintext data item is revoked, the revocation operation is recorded.

[0068] As an optional embodiment, the method may further include: introducing authentication and access control mechanisms to enable authorized users to access and manipulate data.

[0069] The above are embodiments of the method proposed in this application. Based on the same inventive concept, embodiments of this application also provide an encrypted data detection device based on zero-knowledge proof, the structure of which is as follows: Figure 5 As shown.

[0070] Figure 5 This is a schematic diagram of the internal structure of an encrypted data detection device based on zero-knowledge proof, provided as an embodiment of this application. Figure 5 As shown, the device includes: At least one processor 501; And a memory 502 that is communicatively connected to at least one processor; The memory 502 stores instructions executable by at least one processor. These instructions are executed by at least one processor 501 to enable the processor 501 to: generate a proof file for the plaintext data item to be uploaded using a proof generation algorithm via a first client; upload the proof file to the InterPlanetary File System (IPS), generate a storage address for the proof file, and return the storage address to the first client; encrypt the plaintext data item using a symmetric encryption algorithm via the first client to obtain an encrypted data file; upload the storage address and the encrypted data file to the blockchain and mark it as unaudited data; view the unaudited data through the administrator system and initiate an audit of the unaudited data; and update the unaudited data to audited data if the audit is successful.

[0071] Some embodiments of this application provide corresponding to Figure 1 A non-volatile computer storage medium for encrypted data detection based on zero-knowledge proofs stores computer-executable instructions. These instructions are configured to: generate a proof file for the plaintext data item to be uploaded using a proof generation algorithm via a first client; upload the proof file to the InterPlanetary File System (IPS), generate a storage address for the proof file, and return the storage address to the first client; encrypt the plaintext data item using a symmetric encryption algorithm via the first client to obtain an encrypted data file; upload the storage address and the encrypted data file to the blockchain and mark it as unverified data; view the unverified data through an administrator system and initiate a verification process for the unverified data; and update the unverified data to verified data if the verification is successful.

[0072] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for IoT devices and media are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0073] The systems, media, and methods provided in this application are one-to-one correspondences. Therefore, the systems and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the systems and media will not be repeated here.

[0074] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0078] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0079] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0080] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0081] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0082] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting encrypted data based on zero-knowledge proofs, characterized in that, The method includes: Using the first client, a proof generation algorithm is employed to generate a proof file for the plaintext data item to be uploaded, specifically including: Public parameters and random numbers are generated based on preset security parameters. The security parameters are used to generate proof documents, and the random numbers are used to generate keys. Randomly select a range of proof data items from the plaintext data items to be uploaded; Based on the public parameters and range of the data items, a commitment is made to the secret value of the proof, and the proof document is calculated. The proof document is uploaded to the InterPlanetary File System, a storage address for the proof document is generated, and the storage address is returned to the first client; The plaintext data items are encrypted using a symmetric encryption algorithm through the first client to obtain an encrypted data file; The storage address and encrypted data file are uploaded to the blockchain and marked as unverified data; The administrator can view the unapproved data through the system and initiate an approval process for it, specifically including: The administrator system obtains the storage address of the proof document corresponding to the encrypted data file and sends the storage address to a third-party organization. The third-party organization requests the proof document from the InterPlanetary File System based on the storage address; The Interplanetary File System returns the proof file; The third-party organization verifies the proof document using a verification algorithm, obtains the verification result, and returns the verification result to the first client. If the review is approved, the unreviewed data will be updated to the approved data.

2. The encrypted data detection method based on zero-knowledge proof according to claim 1, characterized in that, If the review is approved, after updating the unreviewed data to the approved data, the method further includes: The second client selects the approved data from the blockchain; The blockchain returns the corresponding encrypted data file; The second client exchanges keys with the first client to complete the decryption.

3. The encrypted data detection method based on zero-knowledge proof according to claim 1, characterized in that, The first client uses a symmetric encryption algorithm to encrypt the plaintext data item, resulting in an encrypted data file, specifically including: Based on the public parameters and random numbers, a public key and a private key are obtained, and a symmetric key is obtained using a symmetric encryption algorithm. The public key and private key are used for key exchange between the first client and the second client, and the symmetric key is used to encrypt the plaintext data item. The encrypted data file is calculated based on the symmetric key and the plaintext data items.

4. The encrypted data detection method based on zero-knowledge proof according to claim 1, characterized in that, The third-party organization verifies the proof document using a verification algorithm, obtains the verification result, and returns the verification result to the first client, specifically including: Obtain the aforementioned public parameters and supporting documents; The proof document is parsed and calculated to verify whether the secret value is within a preset range; If the secret value is within a preset range, a verification pass is returned to the first client.

5. The encrypted data detection method based on zero-knowledge proof according to claim 1, characterized in that, If the review is approved, after updating the unreviewed data to the approved data, the method further includes: When the plaintext data item is updated, the first client updates the proof document and the encrypted data file; When the plaintext data item is revoked, the revocation operation is recorded.

6. The encrypted data detection method based on zero-knowledge proof according to claim 5, characterized in that, The method further includes: Introduce authentication and access control mechanisms to enable authorized users to access and manipulate data.

7. A device for detecting encrypted data based on zero-knowledge proofs, characterized in that, The device includes: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: Perform the steps of the encrypted data detection method based on zero-knowledge proof as described in any one of claims 1-6.

8. A non-volatile computer storage medium for encrypted data detection based on zero-knowledge proofs, storing computer-executable instructions, characterized in that, The computer-executable instructions are set as follows: Perform the steps of the encrypted data detection method based on zero-knowledge proof as described in any one of claims 1-6.

Images