Multi-user authorization data sharing method based on block chain

Abstract

The invention provides a multi-user authorization data sharing method based on a block chain, belongs to the technical field of information security, and solves the problems that data arrangement is difficult and the security, privacy and credibility of data are difficult to guarantee in multi-user data sharing. An initialization algorithm, a data encryption algorithm, an index generation algorithm, a trap door generation algorithm, a matching algorithm and a data decryption algorithm are applied. In order to conveniently retrieve a ciphertext, a data owner O needs to extract a keyword w from encrypted data and then generate a keyword index I based on w, a data requester R also needs to select a keyword w'to be queried and generate a trap door Tw based on w ', if the keyword in Tw is the same as the keyword in I, matching can be successful, and if not, the keyword in Tw is matched with the keyword in I; and decrypting the received ciphertext data Epk (m) according to the decryption key sk to obtain plaintext data m.

Description

Technical Field

[0001] The present invention relates to a multi-user authorized data sharing method based on blockchain, and belongs to the field of information security technology. Background Art

[0002] With the rapid development of information technology, data has become a critical strategic resource. Multi-user data sharing holds enormous potential for promoting data circulation, driving innovation, and improving decision-making quality. However, traditional multi-user data sharing approaches face numerous challenges, such as data consistency, security, and trustworthiness. The emergence of blockchain technology offers new solutions to these challenges.

[0003] Blockchain is a distributed database technology that stores data in blocks and uses cryptographic methods to ensure data security and integrity. Each block contains a certain amount of transaction information and is cryptographically linked to the previous block, forming a continuously growing chain. This design makes data tamper-proof within the network, as any attempt to modify a block would disrupt the continuity of the entire chain. Through its decentralized network structure, blockchain technology enables distributed sharing and management of data, ensuring data security and reliability without the need for trusted intermediaries.

[0004] The core of blockchain lies in its consensus mechanism: how multiple nodes in a distributed network reach consensus on a particular state or transaction. Common consensus mechanisms include Proof of Work (PoW), Proof of Stake (PoS), Delegated Proof of Stake (DPoS), Practical Byzantine Fault Tolerance (PBFT), and Pooled Verification. Each consensus mechanism has its own characteristics and applicable scenarios. PoW achieves consensus through the competition of computing power and is suitable for scenarios requiring a high degree of decentralization; PBFT, on the other hand, reaches consensus through a voting mechanism among multiple nodes and is suitable for scenarios requiring fast transaction confirmation.

[0005] Multi-user data sharing refers to the integration and sharing of data from different users to enable more comprehensive and accurate data analysis and decision-making. However, traditional multi-user data sharing methods face the following challenges: Data consistency: Data from different sources may have inconsistent formats and semantics, making data integration difficult. Data security and privacy: Ensuring data security and privacy is a key issue in the data sharing process. Data credibility: Ensuring data credibility and preventing data tampering or forgery is another important challenge in multi-user data sharing.

[0006] Blockchain technology, through its decentralization, immutability, and consensus mechanism, provides a secure and reliable solution for multi-user data sharing: Data consistency: Blockchain's distributed ledger structure ensures data consistency and immutability across all nodes. Data security and privacy: Through encryption and consensus mechanisms, blockchain ensures the security and privacy of data during sharing. Data credibility: Blockchain's consensus mechanism and smart contracts ensure data credibility, preventing tampering or forgery.

[0007] However, the application of blockchain technology in multi-user data sharing also faces some challenges, such as performance and efficiency issues, data privacy and confidentiality issues, data storage and management issues, etc. Therefore, further research and exploration of secure and trustworthy multi-source data sharing methods based on blockchain consensus mechanisms are needed to overcome these challenges and give full play to the advantages of blockchain technology. Summary of the Invention

[0008] In order to solve the problems of data organization difficulties and data security, privacy and credibility in multi-user data sharing, the present invention proposes a multi-user authorized data sharing method based on blockchain.

[0009] The technical solution adopted by the present invention to solve the above problems is: the present invention comprises the following steps:

[0010] Step 1: The data owner O predefines an access tree T to control the data requester R's access to the data m. The initialization algorithm generates the public key Pk and master key Msk for data encryption and decryption, as well as the public parameter Pub for matching index and trapdoor.

[0011] Step 2: Data owner O encrypts data m with public key Pk to generate ciphertext data E pk (m), for the ciphertext data E pk (m) is signed with the ciphertext tag and uploaded to the cloud server S for storage;

[0012] Step 3: Cloud server S sends the encrypted data E pk The storage address Addr of (m) is given to the data owner O, who then extracts the ciphertext data E pk (m) generates an index I from the keyword, and combines the keyword index I, the ciphertext tag tag and the ciphertext data E pk The storage address Addr of (m) is broadcast to blockchain N;

[0013] Step 4: Data requester R encrypts the keyword to generate a trapdoor T w , the trapdoor T w Broadcast to blockchain N, blockchain N pairs index I and trapdoor T wPerform matching and obtain the corresponding ciphertext data E pk The storage address Addr and ciphertext tag of (m) are sent to the data requester R;

[0014] Step 5: The data requester R sends the data storage address Addr sent by the blockchain N to the cloud server S, and the server S sends the ciphertext data E corresponding to the data storage address Addr. pk (m) and signature Sign are returned to the data requester R;

[0015] Step 6: The data requester R verifies the received signature Sign. If the attribute set of the data requester R satisfies the access tree T predefined by the data owner O, the decryption key sk is generated and the received ciphertext data E is decrypted according to the decryption key sk. pk (m) is decrypted to obtain the plaintext data m.

[0016] Furthermore, step 1 specifically includes:

[0017] Step 1.1: Define a bilinear group G of order p, from Z p Randomly select two random numbers a and b to obtain the public key Pk and the master key Msk;

[0018] Step 1.2: Define two multiplicative cyclic groups G1 and G2, with the combined order of G1 and G2 being q, and obtain a set of public parameters Pub;

[0019] The calculation formula for the public key Pk and the master key Msk is:

[0020] Pk=(G,g,h=g b ,e(g,g) a ),Msk=(b,g a ) (1);

[0021] In formula (1), p is a prime number, g is a generator of G;

[0022] The calculation formula of the public parameter Pub is:

[0023] Pub=(G1,G2,q,q1,q2,g1,e,H) (2);

[0024] In formula (2), g1 is a generator of G1, e:G1×G1→G2 is a bilinear mapping, l is a security parameter, is a secure hash function, q1 and q2 are two l-bit prime numbers, and q = q1·q2.

[0025] Furthermore, step 2 specifically includes:

[0026] Combine the predefined access tree T of data m to obtain the ciphertext data E of data m pk (m), for the ciphertext data E pk (m) Add the ciphertext tag tag and ciphertext data E pk (m) and the corresponding ciphertext tag are digitally signed to obtain Sign, and the ciphertext data E pk (m) and Sign are uploaded to the cloud server S for storage simultaneously;

[0027] Ciphertext data E pk The calculation formula for (m) is:

[0028] Step 2 specifically includes:

[0029] Combine the predefined access tree T of data m to obtain the ciphertext data E of data m pk (m), for the ciphertext data E pk (m) Add the ciphertext tag tag and ciphertext data E pk (m) and the corresponding ciphertext tag are digitally signed to obtain Sign, and the ciphertext data E pk (m) and Sign are uploaded to the cloud server S for storage simultaneously;

[0030] Ciphertext data E pk The calculation formula for (m) is:

[0031]

[0032] In formula (3), q y is the polynomial for accessing the node y in the tree T, q y (0) = q parent(y) index(y),q parent(y) is the polynomial of the parent node of node y. index(y) is the order of node y in its parent node, y∈Y={y1,y2,…,y n}, att(y) represents the attribute value associated with node y.

[0033] In formula (3), q y is the polynomial for accessing the node y in the tree T, q y (0) = q parent(y) index(y),q parent(y) is the polynomial of the parent node of node y. index(y) is the order of node y in its parent node, y∈Y={y1,y2,…,y n}, att(y) represents the attribute value associated with node y.

[0034] Furthermore, the step of generating index I in step 3 includes:

[0035] Step 3.1: Extract the keyword w from the data m and input the keyword w into the Bloom filter, where the Bloom filter BF has a length of m bits and contains k hash functions, namely h i (x), 1≤i≤k;

[0036] Step 3.2: Pass the extracted keyword w through h i (x) are hashed and mapped to j∈{0,1,…,m-1}, and the position corresponding to j in BF is set to 1, that is, BF i (w) = j, and we get an m-bit binary number BF(w);

[0037] Step 3.3: Data owner O selects a random number Calculate the keyword index I,

[0038] Furthermore, in step 4, the data requester R encrypts the keyword to generate a trapdoor T w The steps include:

[0039] Set the keyword of the data requester R to access the data as w', repeat steps 3.1-3.2, use the keyword w' as the input of the Bloom filter, get an m-bit binary number BF(w'), and randomly select And calculate the inverse t of t -1 , perform mathematical transformation on the binary number BF(w') to obtain the trapdoor T of the keyword w' w , T w =(T1,T2,T3);

[0040] Keyword w'trapdoor T w =(T1, T2, T3) is calculated as:

[0041]

[0042] Furthermore, in step 4, blockchain N pairs index I and trapdoor T w The steps for matching include:

[0043] Step 4.1: Trapdoor T based on keyword w' w Calculate v(T w ) and e(I,T3), judge v(T w ) is equal to e(I,T3), if v(T w )=e(I,T3), then the match is successful, trapdoor T w The keyword w' in the matching index is the same as the keyword w in v(T w )≠e(I,T3), the match fails;

[0044] Step 4.2: At Trapdoor T w After matching all indexes I, blockchain N returns the successfully matched data storage address Add and ciphertext tag to the data requester R at the same time;

[0045] v(T w ) is calculated as:

[0046]

[0047] The calculation formula of e(I,T3) is:

[0048]

[0049] Furthermore, step 6 specifically includes:

[0050] Step 6.1 The data requester R verifies the received signature Sign. If the ciphertext tag of keyword w' tag' = the ciphertext tag of keyword w, and E pk '(m)=E pk (m), it means the verification is successful;

[0051] Step 6.2: Based on step 6.1, if the attribute set S of the data requester R satisfies the ciphertext data E pk (m) The corresponding data owner O predefines the access tree T, that is, S∈T, then the data requester R randomly selects two random numbers r,r j ∈Z p (j∈S), calculate the ciphertext E pk (m) decryption key sk;

[0052] Step 6.3: Define a recursive algorithm Dec(E pk (m),sk,y), where y is a node in the visit tree T, y∈Y={y1,y2,…,y n};

[0053] Step 6.4: When y is a leaf node, j = att(y), if j∈S, then calculate Dec(E pk (m), sk, y) values, if Then Dec(E pk (m),sk,y)=⊥;

[0054] Step 6.5: When y is a non-leaf node, for all child nodes of y, define F l =Dec(E pk (m),sk,l), and randomly select a |k y |Size of node set S y, if S y All nodes in F are children of y, then l ≠⊥, then calculate F according to formula (8) y Otherwise, F l =⊥;

[0055] Step 6.6: If the attribute set S of the data requester R satisfies the ciphertext data E pk (m) The access tree T predefined by the corresponding data owner O can be obtained according to steps 6.3-6.5 And use the decryption key sk to decrypt E pk (m) decrypts and recovers the plaintext data m;

[0056] Ciphertext E pk The calculation formula of the decryption key sk of (m) is:

[0057]

[0058] When y is a leaf node, if j∈S, Dec(E pk The calculation formula of (m),sk,y) is:

[0059]

[0060] When y is a non-leaf node, Dec(E pk The calculation formula of (m),sk,y) is:

[0061]

[0062] In formula (8), i = index (l), S y '=(index(l):l∈S y );

[0063] Decryption key sk for E pk (m) The expression for decryption is:

[0064]

[0065] The beneficial effects of the present invention are:

[0066] 1. Data security: This invention uses attribute-based encryption technology with ciphertext strategy to encrypt data, which can protect the security and privacy of data. Secondly, the data owner can control access to the data to prevent unauthorized users from accessing the data.

[0067] 2. Keyword Index Security: This invention introduces a random number during the keyword index generation process. When indexing the same keyword, the generated keyword index is different. Therefore, no user can distinguish whether any two indexes contain the same keyword and successfully guess the keyword in the index.

[0068] 3. Trapdoor security: Since the present invention also introduces random numbers in the trapdoor generation process, no user can distinguish whether any two trapdoors contain the same keyword and successfully guess the keyword in the trapdoor. Secondly, due to the difficulty of discrete logarithms and secure hash functions, users cannot Restore the keyword w'.

[0069] 4. Completeness of search results: After the data owner signs the ciphertext and ciphertext label, they upload the ciphertext and signature to the cloud database. The keyword index, data storage address, and ciphertext label are then broadcast to the blockchain. By using digital signatures and transferring the matching process to the blockchain, the fairness of search results can be verified, ensuring their accuracy and integrity. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A flowchart of a multi-user authorized data sharing method based on blockchain provided by the present invention; DETAILED DESCRIPTION

[0071] Specific implementation method 1: Combination Figure 1 This embodiment describes data as an essential component of data analysis and prediction. Sharing data can fully realize its value. However, current cloud data sharing methods face challenges not only in terms of security and privacy, but also in terms of data accuracy and availability. To save storage and management costs, users store data in cloud databases. However, as a third-party user, the trustworthiness of cloud servers is questionable. Blockchain can address these shortcomings. Ciphertext-policy attribute-based encryption (CP-ABE) technology enables fine-grained control of data requester access rights, enabling one-to-many sharing without requiring repeated encryption. This embodiment combines the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) algorithm with blockchain technology to implement a secure and reliable multi-user authorized data sharing method. An analysis of the proposed method's security, efficiency, and performance demonstrates that it meets its design goals and exhibits reasonable practicality.

[0072] like Figure 1As shown, the multi-user authorized data sharing method based on blockchain described in this embodiment involves only four participants, including data owner O, data requester R, blockchain N and cloud server S;

[0073] The data owner O:O has the right to control access to the data and mainly performs three tasks: first, it predefines an access tree to control the data requester's access to the data; second, it encrypts the data, then signs the ciphertext and ciphertext label, and uploads the ciphertext and signature to the cloud database; third, it generates a keyword index and broadcasts it to the blockchain together with the ciphertext label and the data storage address returned by the cloud server.

[0074] Data requester R: If R wants to access data with the keyword "***", he needs to do three things: first, encrypt the keyword to generate a trapdoor and broadcast it to the blockchain; second, send the data storage address returned by the blockchain to the cloud server; third, after R obtains the data ciphertext and signature, he needs to verify the signature first. If R's attribute set satisfies the access tree corresponding to the ciphertext, he can successfully decrypt and obtain the plaintext data.

[0075] Blockchain N: N needs to store keyword indexes, data storage addresses, and ciphertext labels. A query request from R triggers a smart contract on N, which automatically executes a matching algorithm. When the on-chain keyword index successfully matches R's trapdoor, N returns the corresponding data storage address and ciphertext label to R.

[0076] Cloud server S: S needs to store the ciphertext data and signature uploaded by O. When S receives the data storage address sent by R, it needs to return the ciphertext data and signature corresponding to the data storage address to R.

[0077] This implementation assumes that S is a semi-honest and curious third-party user. As an untrustworthy third party, S may not honestly perform data retrieval operations. Furthermore, S attempts to infiltrate the privacy of O and R, including data privacy and data query privacy. N is considered trustworthy, and trusted retrieval can be achieved by invoking a smart contract. The specific design requirements are as follows:

[0078] (1) Data security: Because data is the private property of O, data security must be guaranteed. In this method, except for authorized users, other unauthorized users, including S and N, should not be able to successfully decrypt the ciphertext and obtain the plaintext data.

[0079] (2) Keyword index security: In data sharing methods, indexing can improve the efficiency of retrieval of ciphertext. To protect O’s data privacy, the keywords extracted from the data need to be encrypted. Even if a malicious user obtains two keyword indexes, they cannot infer whether the two indexes contain the same keyword.

[0080] (3) Trapdoor security: To protect R’s query privacy, the keywords R queries also need to be encrypted. Even if a malicious user obtains two trapdoors, they cannot infer whether the two trapdoors were generated by the same keyword. Secondly, even if R queries the same keyword twice in a row, two completely different trapdoors will be generated.

[0081] (4) Completeness of retrieval results: In order to ensure that the retrieval results obtained by R are correct and complete, it is necessary to digitally sign both the ciphertext and the ciphertext label, and transfer the ciphertext retrieval process from the untrusted S to the trusted N.

[0082] The specific steps of the multi-user authorized data sharing method based on blockchain described in this embodiment are as follows:

[0083] S1: The data owner O predefines an access tree T to control the data requester R's access to the data m. The initialization algorithm generates the public key Pk and master key Msk for data encryption and decryption, as well as the public parameter Pub for matching index and trapdoor.

[0084] This step applies the initialization algorithm, which needs to generate the public key Pk and the master key Msk to encrypt and decrypt the data, and also needs to generate the public parameter Pub for matching indexes and trapdoors.

[0085] S101: Define a bilinear group G of order p, where p is a prime number and g is a generator of G. p By randomly selecting two random numbers a and b, we can get the public key Pk and the master key Msk;

[0086] The calculation formula for the public key Pk and the master key Msk is:

[0087] Pk=(G,g,h=g b ,e(g,g) a ),Msk=(b,g a ) (1);

[0088] In formula (1), p is a prime number, g is a generator of G;

[0089] S102: Define G1 and G2 as two multiplicative cyclic groups, q as their composite order, g1 as a generator of G1, and e:G1×G1→G2 as a bilinear map. l is a security parameter, It is a secure hash function, q1 and q2 are two l-bit prime numbers, and q = q1·q2, and finally a set of public parameters Pub can be obtained;

[0090] The calculation formula of the public parameter Pub is:

[0091] Pub=(G1,G2,q,q1,q2,g1,e,H) (2);

[0092] In formula (2), g1 is a generator of G1, e:G1×G1→G2 is a bilinear mapping, l is a security parameter, is a secure hash function, q1 and q2 are two l-bit prime numbers, and q = q1·q2.

[0093] S2: Data owner O encrypts data m using public key Pk to generate ciphertext data E pk (m), for the ciphertext data E pk (m) is signed with the ciphertext tag and uploaded to the cloud server S for storage;

[0094] This step applies the data encryption algorithm. The data owner O uses the ciphertext strategy to encrypt the data based on the attribute encryption technology. It needs to submit the data m and the access tree T, and then generate the ciphertext E pk (m)Upload to S,q y is the polynomial for visiting node y in tree T, q y The highest degree in is d y =k y -1(k y is the threshold value of node y). O randomly selects s∈Z p , so that the polynomial q of the root node R R (0) = s, and select another random number as q R The remaining coefficients in . For other nodes in T, make q y (0) = q parent(y) index(y), where q parent(y) The polynomial representing the parent node of node y. index(y) represents the order of node y in its parent node, and other random numbers are selected as q y The remaining coefficients in y∈Y={y1,y2,…,y n}, att(y) represents the attribute value associated with node y.

[0095] Combine the predefined access tree T of data m to obtain the ciphertext data E of data m pk (m), for the ciphertext data E pk (m) Add a ciphertext tag tag, which is unique, and add a ciphertext tag tag to the ciphertext data E pk (m) and the corresponding ciphertext tag are digitally signed to obtain Sign, and the ciphertext data E pk (m) and Sign are uploaded to the cloud server S for storage at the same time, and the data storage address Addr returned by the cloud server is saved;

[0096] Ciphertext data E pk The calculation formula for (m) is:

[0097]

[0098] In formula (3), q y is the polynomial for accessing the node y in the tree T, q y (0) = q parent(y) index(y),q parent(y) is the polynomial of the parent node of node y. index(y) is the order of node y in its parent node, y∈Y={y1,y2,…,y n}, att(y) represents the attribute value associated with node y.

[0099] The present invention adopts the encryption technology based on attribute of ciphertext strategy to encrypt data, which can protect the security and privacy of data. Secondly, the data owner can control the access to the data to prevent unauthorized users from accessing the data.

[0100] S3: Cloud server S sends the encrypted data E pk The storage address Addr of (m) is given to the data owner O, who then extracts the ciphertext data E pk (m) generates an index I from the keyword, and combines the keyword index I, the ciphertext tag tag and the ciphertext data E pk The storage address Addr of (m) is broadcast to blockchain N;

[0101] This step applies the index generation algorithm. In order to facilitate data sharing, the data owner O needs to extract the keyword w from the data and generate the index I. First, w needs to be passed through the Bloom filter to obtain the binary number BF(w), and then after mathematical transformation, it is finally obtained I. The index generation algorithm is mainly used to facilitate the retrieval of the storage address of the ciphertext data. Assume that the length of the Bloom filter BF is m bits and contains k hash functions, that is, h i (x), 1≤i≤k. In order to obtain the keyword index I, O needs to extract a keyword from the data m, and then pass the extracted keyword w through h i (x) are hashed and mapped to j∈{0,1,…,m-1}, and the position corresponding to j in BF is set to 1, that is, BF i (w) = j. Finally, O will get an m-bit binary number BF(w). Then, O selects a random number After calculation, we finally get the keyword index

[0102] After the data owner O obtains the index I of w, it generates a blockchain transaction by combining I with the data storage address Addr and the ciphertext tag tag, and broadcasts (Addr, tag, I) to the blockchain. If the block containing the transaction is successfully verified by the entire network, (Addr, tag, I) will be permanently written to the blockchain and cannot be changed or deleted.

[0103] The present invention introduces a random number, and when the same keyword is indexed, the generated keyword index is different. Therefore, any user cannot distinguish whether any two indexes contain the same keyword and successfully guess the keyword in the index.

[0104] S4: The data requester R encrypts the keyword to generate a trapdoor T w , the trapdoor T w Broadcast to blockchain N, blockchain N pairs index I and trapdoor T w Perform matching and obtain the corresponding ciphertext data E pk The storage address Addr and ciphertext tag of (m) are sent to the data requester R;

[0105] In this step, the trapdoor T w The trapdoor generation algorithm is applied to obtain the data. When the data requester R wants to access the data with the keyword w', it is necessary to first map w' through the Bloom filter to obtain the binary number BF(w'), and then generate the trapdoor T through mathematical transformation. w , and finally T w Broadcast to blockchain N. In order to access data with keyword w', the data requester needs to generate a keyword trapdoor T w Similar to the generation process of I, the data requester R also needs to pass w' through BF to obtain an m-bit binary number BF(w'). Then the data requester R randomly selects And calculate the inverse t of t -1 Finally, the data requester R can obtain the trapdoor T of w' through the following formula w =(T1, T2, T3). Get T w After that, the data requester R will w Generate a transaction and broadcast it to the blockchain.

[0106] Keyword w'trapdoor T w =(T1, T2, T3) is calculated as:

[0107]

[0108] Since random numbers are also introduced in the trapdoor generation process, no user can distinguish whether any two trapdoors contain the same keyword and successfully guess the keyword in the trapdoor. Secondly, due to the difficulty of discrete logarithms and secure hash functions, users cannot Restore the keyword w'.

[0109] Index I and trapdoor T w Matching application matching algorithm, when blockchain N receives the data access request from data requester R, the smart contract on blockchain N will automatically execute the matching algorithm. w Match with all indexes I on the chain. If w=w', then the data requester R can get E pk (m) The storage address Addr in the cloud database; otherwise, the data requester R gets an empty set When the blockchain receives the trapdoor transaction T broadcast by the data requester R w After that, since the destination address of the transaction is the address of the smart contract that executes the matching algorithm, it will trigger the smart contract deployed in advance on the blockchain, and then the smart contract will automatically match the index and trapdoor according to the logic of the protocol. When matching, you need to first calculate v(T w ).

[0110] v(T w ) is calculated as:

[0111]

[0112] The calculation formula of e(I,T3) is:

[0113]

[0114] If the trapdoor T w The keyword w' in the matching index is the same as the keyword w, then v(T w )=e(I,T3), indicating successful matching; otherwise, the matching fails.

[0115] When T w After matching with all indexes I, blockchain N will return the successfully matched data storage address and ciphertext tag (Addr, tag) to the data requester R at the same time. The data requester R will send the received Addr to the cloud server S. The cloud server S will search the corresponding ciphertext data E in the library according to the Addr. pk (m), and E pk (m) and the signature Sign are returned to the data requester R at the same time.

[0116] After the data owner signs the ciphertext and ciphertext label, they upload both the ciphertext and signature to the cloud database. The keyword index, data storage address, and ciphertext label are then broadcast to the blockchain. By using digital signatures and transferring the matching process to the blockchain, the fairness of search results can be verified, ensuring their accuracy and integrity.

[0117] S5: The data requester R sends the data storage address Addr sent by the blockchain N to the cloud server S, and the server S sends the ciphertext data E corresponding to the data storage address Addr. pk (m) and signature Sign are returned to the data requester R;

[0118] S6: The data requester R verifies the received signature Sign. If the attribute set of the data requester R satisfies the access tree T predefined by the data owner O, the decryption key sk is generated and the received ciphertext data E is decrypted according to the decryption key sk. pk (m) is decrypted to obtain the plaintext data m.

[0119] In this step, the data decryption algorithm is applied to the data decryption. If the attribute set of the data requester R satisfies the access tree defined in the access data, the decryption key sk can be generated. When the data requester R receives the ciphertext data E returned by the cloud server S pk (m), the decryption key sk can be used to successfully decrypt E pk (m), get the plaintext data m. When the data requester R receives (E pk (m), Sign), first verify the signature Sign, if tag'=tag, and E pk '(m)=E pk (m), then the verification is successful, indicating that the cloud server S is honest. If the attribute set of the data requester R and the cloud server S meet the ciphertext data E pk (m) The corresponding access policy T, that is, S∈T, then the data requester R randomly selects two random numbers r,r j ∈Z p (j∈S), the data requester R can obtain the ciphertext E through the following formula pk (m)'s decryption key sk.

[0120] Ciphertext E pk The calculation formula of the decryption key sk of (m) is:

[0121]

[0122] The data requester R has obtained the ciphertext data E pk (m), and the decryption key sk is obtained. Then we can pk(m) Perform decryption operation. In order to successfully decrypt E pk (m), we need to define a recursive algorithm Dec(E pk (m),sk,y), where y is a node in the visit tree T, y∈Y={y1,y2,…,y n}.

[0123] ① When y is a leaf node, make j = att(y).

[0124] a) If j∈S, then calculate Dec(E pk (m),sk,y) values.

[0125]

[0126] b) If Then Dec(E pk (m),sk,y)=⊥.

[0127] ②When y is a non-leaf node, for all child nodes of y, it is necessary to define F l =Dec(E pk (m),sk,l), and randomly select a |k y |Size of node set S y If S y All nodes in are children of y, then let F l ≠⊥, then we can get F according to the following formula y Otherwise, record F l =⊥. In the following formula, i=index(l), S y '=(index(l):l∈S y ).

[0128]

[0129] As long as the attribute set S of R satisfies the access policy T, we can get R can finally successfully decrypt E with sk through the following formula pk (m), and recover m.

[0130] Decryption key sk for E pk (m) The expression for decryption is:

[0131]

[0132] Specific implementation method 2: To verify the security of the multi-user authorized data sharing method based on blockchain described in specific implementation method 1, this implementation method designs the following verification:

[0133] Assuming adversary A is a probabilistic polynomial-time adversary, if A can successfully distinguish the keywords in the index and trapdoor with negligible probability ∈ = Pr(b = b'), then the BMADS method can be proven to be resistant to keyword guessing attacks. The security proof of the entire method is based on the DDH assumption (Decisional Diffie-Hellman) and the random oracle model.

[0134] Design a security game between challenger C and adversary A to resist keyword guessing attacks, and define As a random oracle, A can challenge the random oracle. The security game process between C and A is as follows:

[0135] (1) Initialization: C first executes the initialization algorithm and then sends the public parameters Pub = (G1, G2, q, q1, q2, g1, e, H) to A.

[0136] (2) Round 1: A sends two keywords w0 and w1 to C.

[0137] (3) Challenge: C selects a keyword from w0, w1 and records it as w b ,b∈{0,1}. Then C selects a random number u and uses the random oracle to predict w b Perform encryption calculation and send the result I(w b ) is returned to A.

[0138] (4) Round 2: A continues to repeat the operations in Round 1, but the selected keyword cannot be the same as the keyword in Round 1.

[0139] (5) Guess: A guesses w selected by C b Which keyword is it? That is, guess the value of b'. If b' = b, then A guessed successfully and won the safe game.

[0140] For a probabilistic polynomial-time adversary A, the probability of winning the security game against keyword guessing attacks is:

[0141]

[0142] The probability of the adversary A successfully distinguishing two keywords by adding a probabilistic polynomial is ∈=Pr(b=b'). The probability ∈ is negligible, which means that the present invention can resist keyword guessing attacks.

[0143] If a probabilistic polynomial-time adversary A can win the security game against keyword guessing attacks with a non-negligible probability ∈, then there must be a polynomial-time algorithm B, and the probability that B successfully solves the DDH problem is ∈.

[0144] Assume B is known When x=0, Otherwise T1 is a random number picked from G1.

[0145] (1) First, B sends Give it to A, and then A randomly selects two keywords w0 and w1 and sends them to B.

[0146] (2) After receiving w0 and w1, B selects a keyword w from w0 and w1. b , b∈{0,1} is encrypted. Then the encrypted result is Send to A.

[0147] (3) A guesses which of the keywords w0 and w1 B selected, that is, guesses the value of b'. If b' = b, it means that T can be confirmed. x =T0.

[0148] ① When T x =T0, B is known and Then A can successfully guess x = 0 with a non-negligible probability ∈. Therefore, the probability that B guesses x = 0 is 1 / 2 + ∈.

[0149] ②When T x =T1, B is known and The probability that A successfully guesses x = 1 is 1 / 2. Therefore, the probability of guessing x = 1 is 1 / 2.

[0150] From the above proof process, it can be seen that the probability that B can successfully solve the DDH problem is:

[0151]

[0152] If A can obtain I(w b ), then there must be a polynomial time algorithm B, and the probability that B successfully solves the DDH problem is It cannot be ignored, proving that the conclusion is inconsistent with the DDH hypothesis, so the present invention can resist keyword guessing attacks.

[0153] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed as a preferred embodiment as above, it is not intended to limit the present invention. Any technician familiar with the present profession can make some changes or modifications to equivalent embodiments of equivalent changes using the technical content disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent replacement and improvement of the above embodiments made according to the technical essence of the present invention, within the spirit and principles of the present invention, without departing from the content of the technical solution of the present invention, shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A multi-user authorized data sharing method based on blockchain, characterized in that: The steps of the multi-user authorized data sharing method based on blockchain include: Step 1: The data owner O predefines an access tree T to control the data requester R's access to the data m. The initialization algorithm generates the public key Pk and master key Msk for data encryption and decryption, as well as the public parameter Pub for matching index and trapdoor. Step 2: Data owner O encrypts data m with public key Pk to generate ciphertext data E pk (m), for the ciphertext data E pk (m) is signed with the ciphertext tag and uploaded to the cloud server S for storage; Step 3: Cloud server S sends the encrypted data E pk The storage address Addr of (m) is given to the data owner O, who then extracts the ciphertext data E pk (m) generates an index I from the keyword, and combines the keyword index I, the ciphertext tag and the ciphertext data E pk The storage address Addr of (m) is broadcast to blockchain N; Step 4: Data requester R encrypts the keyword to generate a trapdoor T w , the trapdoor T w Broadcast to blockchain N, blockchain N pairs index I and trapdoor T w Perform matching and obtain the corresponding ciphertext data E pk The storage address Addr and ciphertext tag of (m) are sent to the data requester R; Step 5: The data requester R sends the data storage address Addr sent by the blockchain N to the cloud server S, and the server S sends the ciphertext data E corresponding to the data storage address Addr. pk (m) and signature Sign are returned to the data requester R; Step 6: The data requester R verifies the received signature Sign. If the attribute set of the data requester R satisfies the access tree T predefined by the data owner O, the decryption key sk is generated and the received ciphertext data E is decrypted according to the decryption key sk. pk (m) is decrypted to obtain the plaintext data m.

2. A multi-user authorized data sharing method based on blockchain according to claim 1, characterized in that: Step 1 specifically includes: Step 1.1: Define a bilinear group G of order p, from Z p Randomly select two random numbers a and b to obtain the public key Pk and the master key Msk; Step 1.2: Define two multiplicative cyclic groups G1 and G2, with the combined order of G1 and G2 being q, and obtain a set of public parameters Pub; The calculation formula for the public key Pk and the master key Msk is: Pk=(G,g,h=g b ,e(g,g) a ),Msk=(b,g a ) (1); In formula (1), p is a prime number, g is a generator of G; The calculation formula of the public parameter Pub is: Pub=(G1,G2,q,q1,q2,g1,e,H) (2); In formula (2), g1 is a generator of G1, e:G1×G1→G2 is a bilinear mapping, l is a security parameter, is a secure hash function, q1 and q2 are two l-bit prime numbers, and q = q1·q2.

3. A multi-user authorized data sharing method based on blockchain according to claim 1, characterized in that: Step 2 specifically includes: Combine the predefined access tree T of data m to obtain the ciphertext data E of data m pk (m), for the ciphertext data E pk (m) Add a ciphertext tag, where tag is unique, and add a ciphertext tag to the ciphertext data E. pk (m) and the corresponding ciphertext tag are digitally signed to obtain Sign, and the ciphertext data E pk (m) and Sign are uploaded to the cloud server S for storage simultaneously; Ciphertext data E pk The calculation formula for (m) is: In formula (3), q y is the polynomial for accessing the node y in the tree T, q y (0) = q parent(y) index(y),q parent(y) is the polynomial of the parent node of node y. index(y) is the order of node y in its parent node, y∈Y={y1,y2,…,y n }, att(y) represents the attribute value associated with node y.

4. The multi-user authorized data sharing method based on blockchain according to claim 1 is characterized in that: The steps of generating index I in step 3 include: Step 3.1: Extract the keyword w from the data m and input the keyword w into the Bloom filter, where the Bloom filter BF has a length of m bits and contains k hash functions, namely h i (x), 1≤i≤k; Step 3.2: Pass the extracted keyword w through h i (x) are hashed and mapped to j∈{0,1,…,m-1}, and the position corresponding to j in BF is set to 1, that is, BF i (w) = j, and we get an m-bit binary number BF(w); Step 3.3: Data owner O selects a random number Calculate the keyword index I, 5. The multi-user authorized data sharing method based on blockchain according to claim 1 is characterized in that: In step 4, the data requester R encrypts the keyword to generate a trapdoor T w The steps include: Set the keyword of the data requester R to access the data as w', repeat steps 3.1-3.2, use the keyword w' as the input of the Bloom filter, get an m-bit binary number BF(w'), and randomly select And calculate the inverse t of t -1 , perform mathematical transformation on the binary number BF(w') to obtain the trapdoor T of the keyword w' w , T w =(T1,T2,T3); Keyword w'trapdoor T w =(T1, T2, T3) is calculated as:

6. A multi-user authorized data sharing method based on blockchain according to claim 1, characterized in that: In step 4, blockchain N pairs index I and trapdoor T w The steps for matching include: Step 4.1: Trapdoor T based on keyword w' w Calculate v(T w ) and e(I,T3), judge v(T w ) is equal to e(I,t3), if v(T w )=e(I,T3), then the match is successful, trapdoor T w The keyword w' in the matching index is the same as the keyword w in v(T w )≠e(I,T3), the match fails; Step 4.2: At Trapdoor T w After matching all indexes I, blockchain N returns the successfully matched data storage address Add and ciphertext tag to the data requester R at the same time; v(T w ) is calculated as: The calculation formula of e(I,T3) is:

7. The multi-user authorized data sharing method based on blockchain according to claim 1 is characterized in that: Step 6 specifically includes: Step 6.1 The data requester R verifies the received signature Sign. If the ciphertext tag of keyword w' tag' = the ciphertext tag of keyword w, and E pk '(m)=E pk (m), it means the verification is successful; Step 6.2: Based on step 6.1, if the attribute set S of the data requester R satisfies the ciphertext data E pk (m) The corresponding data owner O predefines the access tree T, that is, S∈T, then the data requester R randomly selects two random numbers r,r j ∈Z p (j∈S), calculate the ciphertext E pk (m) decryption key sk; Step 6.3: Define a recursive algorithm Dec(E pk (m),sk,y), where y is a node in the visit tree T, y∈Y={y1,y2,…,y n }; Step 6.4: When y is a leaf node, j = att(y), if j∈S, then calculate Dec(E pk (m), sk, y) values, if Then Dec(E pk (m),sk,y)=⊥; Step 6.5: When y is a non-leaf node, for all child nodes of y, define And randomly select a |k y |Size of node set S y , if S y All nodes in are children of y, then Then, according to formula (8), we can calculate F y ,otherwise, Step 6.6: If the attribute set S of the data requester R satisfies the ciphertext data E pk (m) The access tree T predefined by the corresponding data owner O can be obtained according to steps 6.3-6.5 And use the decryption key sk to decrypt E pk (m) decrypts and recovers the plaintext data m; Ciphertext E pk The calculation formula of the decryption key sk of (m) is: When y is a leaf node, if j∈S, Dec(E pk The calculation formula of (m),sk,y) is: When y is a non-leaf node, Dec(E pk The calculation formula of (m),sk,y) is: In formula (8), Decryption key sk for E pk (m) The expression for decryption is:

Images