Lightweight block chain encryption method based on hybrid encryption

Abstract

The invention relates to the technical field of block chains, in particular to a lightweight block chain encryption method based on hybrid encryption, and the method comprises the following steps: S1, carrying out the encryption of transaction data in a block chain through employing a lightweight symmetric encryption algorithm, and generating encrypted transaction data; s2, using an asymmetric encryption algorithm and an anti-quantum encryption algorithm to cooperatively encrypt a key of the lightweight symmetric encryption algorithm in the S1 to generate an encrypted key; s3, carrying out signature processing on the encrypted transaction data and the encryption key by adopting a lightweight digital signature algorithm to generate signature information; and S4, setting access authority for the encrypted transaction data by adopting an attribute-based encryption algorithm. According to the invention, the transaction data is encrypted by adopting the lightweight symmetric encryption algorithm, so that the problem that the application is limited in the resource limited scene such as lightweight equipment due to the fact that most of the traditional block chain encryption methods adopt a single encryption mechanism is solved.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to a lightweight blockchain encryption method based on hybrid encryption. Background Technology

[0002] Blockchain is a distributed ledger technology that uses a decentralized network of nodes to collaboratively maintain data. Data is stored in blocks, each containing transaction information, its own hash value, and the hash value of the previous block, forming a chain-like structure. Combined with encryption algorithms, this ensures the data's immutability. Relying on a consensus mechanism, nodes autonomously achieve data consistency without the need for a central authority. Its transparent, traceable, secure, and tamper-proof characteristics have led to its widespread application in areas such as cryptocurrencies, supply chain traceability, cross-border payments, and digital identity, reshaping traditional trust mechanisms and driving innovation in multi-party collaboration models.

[0003] Traditional blockchain encryption methods mostly employ a single encryption mechanism. Because it is difficult to balance encryption strength and computational resource consumption, their application is limited in resource-constrained scenarios such as lightweight devices. Summary of the Invention

[0004] To overcome the above shortcomings, this invention provides a lightweight blockchain encryption method based on hybrid encryption, which aims to improve the problem that most traditional blockchain encryption methods adopt a single encryption mechanism, which makes it difficult to balance encryption strength and computing resource consumption, thus limiting their application in resource-constrained scenarios such as lightweight devices.

[0005] In a first aspect, the present invention provides the following technical solution: a lightweight blockchain encryption method based on hybrid encryption, comprising the following steps:

[0006] S1. Encrypt the transaction data in the blockchain using a lightweight symmetric encryption algorithm to generate encrypted transaction data;

[0007] S2. The key of the lightweight symmetric encryption algorithm in S1 is encrypted by using a combination of asymmetric encryption algorithm and quantum-resistant encryption algorithm to generate an encryption key;

[0008] S3. The encrypted transaction data and encryption key are processed using a lightweight digital signature algorithm to generate signature information;

[0009] S4. Use an attribute-based encryption algorithm to set access permissions for the encrypted transaction data, and generate encrypted transaction data with permission identifiers;

[0010] S5. Update the key of the lightweight symmetric encryption algorithm in S1 using the proxy re-encryption algorithm to generate a new encryption key;

[0011] S6. Upload the encrypted transaction data with permission identifier, encryption key, new encryption key and signature information to the blockchain for storage.

[0012] By adopting the above technical solution, a lightweight symmetric encryption algorithm is used to encrypt transaction data. Asymmetric encryption algorithm and quantum-resistant encryption algorithm are combined to protect the symmetric encryption key. At the same time, the encrypted data and key are signed, access permissions are set based on attributes, the key is updated by re-encryption through a proxy, and the relevant information is uploaded to the blockchain storage. Thus, while ensuring the security of data encryption, the overall efficiency of the encryption process is improved. This improves the problem that traditional blockchain encryption methods mostly use a single encryption mechanism, which is difficult to balance encryption strength and computing resource consumption, resulting in limited application in resource-constrained scenarios such as lightweight devices.

[0013] Furthermore, the lightweight symmetric encryption algorithm in S1 is either the AES-128-GCM algorithm or the Chacha20-Poly1305 algorithm;

[0014] When using the AES-128-GCM algorithm, the encryption process is as follows: generate a 128-bit initial key, divide the transaction data into groups, each group of data is 128 bits long, perform 10 rounds of iterative encryption operations on each group of data using the initial key, and generate a message authentication code to obtain encrypted transaction data;

[0015] When using the Chacha20-Poly1305 algorithm, an encrypted stream is generated using a 256-bit key and a 96-bit random number. The transaction data is XORed with the encrypted stream to obtain encrypted transaction data, and a message authentication code is generated using the Poly1305 algorithm.

[0016] Furthermore, the asymmetric encryption algorithm in S2 is the ECC algorithm, the quantum-resistant encryption algorithm is the CRYSTALS-Kyber algorithm, and the cooperative encryption process is as follows:

[0017] The key of the lightweight symmetric encryption algorithm is encrypted using the ECC algorithm to obtain the first encryption key;

[0018] The first encryption key is then encrypted again using the CRYSTALS-Kyber algorithm to obtain the final encryption key.

[0019] The ECC algorithm uses Curve25519 elliptic curves. The public key is generated by multiplying the private key and the elliptic curve generator. The public and private keys of the CRYSTALS-Kyber algorithm are generated by lattice basis operations.

[0020] Furthermore, the lightweight digital signature algorithm in S3 is the Ed25519 algorithm, and the signature processing procedure is as follows:

[0021] Perform a hash operation on the encrypted transaction data and the encryption key to obtain a hash value;

[0022] The hash value is signed using the signing private key to generate signature information;

[0023] The signature private key is derived from the root key through a pseudo-random function, and the root key is encrypted and stored using the CRYSTALS-Kyber algorithm.

[0024] Furthermore, the attribute-based encryption algorithm in S4 is the lightweight CP-ABE algorithm, and the process for setting access permissions is as follows:

[0025] Determine the attribute set, which includes device type, region, and level;

[0026] An access structure is constructed based on the attribute set, wherein the access structure is a sensor device, a specified region, and a specified level.

[0027] The lightweight CP-ABE algorithm is used to encrypt the encrypted transaction data according to the access structure to generate encrypted transaction data with permission identifiers. The node private key is aggregated from partial private keys generated by multiple attribute authorization centers.

[0028] Furthermore, the proxy re-encryption algorithm in S5 adopts the PRE-LESS algorithm, and the re-encryption key generation formula during the key update process is rk = sk old ·pk new +hash(sk old ||pk new )·G, where sk old This is the node's old private key, derived by the node from the initial root key using a pseudo-random function and stored locally; pk new The receiving node uses its new public key (sk) to send the new public key to the receiving node. new The generator G is generated by an elliptic curve dot product operation; G is an elliptic curve generator using the Curve25519 standard; hash(·) is the SHA-256 hash function; the re-encryption key rk generated by the formula is used by the proxy node to convert the ciphertext encrypted with the old key into the ciphertext encrypted with the new key.

[0029] Furthermore, after signing the encrypted transaction data and encryption key in step S3, the step also includes anonymizing the signature information using a dynamic ring signature algorithm. The dynamic ring signature algorithm dynamically adjusts the ring size according to the transaction sensitivity level. When the transaction sensitivity level is high, the ring size is set to 7 public keys; when the transaction sensitivity level is low, the ring size is set to 3 public keys. The public keys are generated based on the node identity information.

[0030] Secondly, the present invention provides the following technical solution: a lightweight blockchain encryption system based on hybrid encryption, the system comprising:

[0031] The encryption module is used to encrypt transaction data in the blockchain using a lightweight symmetric encryption algorithm to generate encrypted transaction data.

[0032] The key encryption module is used to encrypt the key of the lightweight symmetric encryption algorithm in the encryption module by using an asymmetric encryption algorithm and a quantum-resistant encryption algorithm in concert, and to generate an encryption key;

[0033] The signature module is used to process the encrypted transaction data and encryption key using a lightweight digital signature algorithm to generate signature information;

[0034] The permission setting module is used to set access permissions for the encrypted transaction data using an attribute-based encryption algorithm, and generate encrypted transaction data with permission identifiers;

[0035] The key update module is used to update the key of the lightweight symmetric encryption algorithm in the encryption module through the proxy re-encryption algorithm, and generate a new encryption key;

[0036] The storage module is used to upload the encrypted transaction data with permission identifiers, encryption keys, new encryption keys, and signature information to the blockchain for storage.

[0037] The present invention has the following beneficial effects:

[0038] 1. In this invention, a lightweight symmetric encryption algorithm is used to encrypt transaction data. This is combined with an asymmetric encryption algorithm and a quantum-resistant encryption algorithm to protect the symmetric encryption key. Simultaneously, the encrypted data and key are signed, access permissions are set based on attributes, the key is updated by proxy re-encryption, and the relevant information is uploaded to the blockchain storage. This improves the overall efficiency of the encryption process while ensuring data encryption security. This addresses the problem that traditional blockchain encryption methods mostly use a single encryption mechanism, which is difficult to balance encryption strength and computational resource consumption, resulting in limited application in resource-constrained scenarios such as lightweight devices.

[0039] 2. In this invention, by employing a quantum-resistant encryption algorithm and an asymmetric encryption algorithm in concert to encrypt and protect the key, the security of the key is enhanced in the face of quantum computing attacks. This improves the problem that traditional blockchain encryption methods mostly rely on conventional asymmetric encryption algorithms, which are easily cracked by quantum algorithms due to the mathematical problems on which their security is based, thus causing the risk of key leakage in a quantum computing environment.

[0040] 3. In this invention, the key is dynamically updated by using a proxy re-encryption algorithm, which simplifies the key update process and reduces the computation and communication overhead required for the update. This improves the problem that traditional blockchain encryption methods mostly use manual or static methods to update keys. Since the update process requires re-encrypting historical data and depends on nodes being online in real time, the key update efficiency is low and data interruption is likely to occur. Attached Figure Description

[0041] Figure 1 This is a flowchart of a lightweight blockchain encryption method based on hybrid encryption proposed in this invention.

[0042] Figure 2 This is a system architecture diagram of a lightweight blockchain encryption system based on hybrid encryption proposed in this invention. Detailed Implementation

[0043] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Example 1

[0045] In a first embodiment of the present invention, the present invention provides a lightweight blockchain encryption method based on hybrid encryption, such as... Figure 1 As shown, it includes the following steps:

[0046] S1. Encrypt the transaction data in the blockchain using a lightweight symmetric encryption algorithm to generate encrypted transaction data;

[0047] Furthermore, the lightweight symmetric encryption algorithm in S1 is either the AES-128-GCM algorithm or the Chacha20-Poly1305 algorithm;

[0048] When using the AES-128-GCM algorithm, the encryption process is as follows: generate a 128-bit initial key, divide the transaction data into groups of 128 bits each, perform 10 rounds of iterative encryption operations on each group of data using the initial key, and generate a message authentication code to obtain the encrypted transaction data.

[0049] When using the Chacha20-Poly1305 algorithm, an encrypted stream is generated using a 256-bit key and a 96-bit random number. The transaction data is XORed with the encrypted stream to obtain encrypted transaction data, and a message authentication code is generated using the Poly1305 algorithm.

[0050] Specifically, when using the AES-128-GCM algorithm, the input data includes transaction data from the blockchain and a 128-bit initial key. The transaction data is the original transaction information to be encrypted in the blockchain, and the 128-bit initial key is a system-generated random key. The transaction data is grouped into 128-bit blocks, and each block is iterated and encrypted for 10 rounds using the 128-bit initial key, generating a message authentication code. The output is encrypted transaction data and the message authentication code. When using the Chacha20-Poly1305 algorithm, the input data includes transaction data from the blockchain, a 256-bit key, and a 96-bit random number. The 256-bit key and the 96-bit random number are system-generated random keys. An encrypted stream is generated using the 256-bit key and the 96-bit random number. The transaction data is XORed with the encrypted stream to obtain encrypted transaction data, and the Poly1305 algorithm is used to generate a message authentication code. The output is encrypted transaction data and the message authentication code.

[0051] When using the AES-128-GCM algorithm, a 128-bit initial key is used to perform 10 rounds of iterative encryption operations on 128-bit block transaction data to achieve encryption processing of the transaction data. At the same time, the generated message authentication code is used to verify the integrity and authenticity of the transaction data. When using the Chacha20-Poly1305 algorithm, a 256-bit key and a 96-bit random number-generated encrypted stream are XORed with the transaction data to achieve encryption processing of the transaction data. At the same time, the message authentication code generated by the Poly1305 algorithm is used to verify the integrity and authenticity of the transaction data. The application of the above lightweight symmetric encryption algorithms can ensure the confidentiality of transaction data while meeting the blockchain's requirements for data encryption efficiency and security verification through the corresponding encryption processing and message authentication code generation.

[0052] S2. The key of the lightweight symmetric encryption algorithm in S1 is encrypted by using a combination of asymmetric encryption algorithm and quantum-resistant encryption algorithm to generate an encryption key;

[0053] Furthermore, the asymmetric encryption algorithm in S2 is the ECC algorithm, the quantum-resistant encryption algorithm is the CRYSTALS-Kyber algorithm, and the cooperative encryption process is as follows:

[0054] The key of the lightweight symmetric encryption algorithm is encrypted using the ECC algorithm to obtain the first encryption key;

[0055] The first encryption key is re-encrypted using the CRYSTALS-Kyber algorithm to obtain the final encryption key;

[0056] The ECC algorithm uses the Curve 25519 elliptic curve, and the public key is generated by multiplying the private key with the elliptic curve generator. The CRYSTALS-Kyber algorithm generates the public and private keys through lattice basis operations.

[0057] Specifically, when using the ECC algorithm and the CRYSTALS-Kyber algorithm for collaborative encryption, the input data includes the key of the lightweight symmetric encryption algorithm in S1, the private and public keys of the ECC algorithm, and the public and private keys of the CRYSTALS-Kyber algorithm. The key of the lightweight symmetric encryption algorithm is the key generated in S1 for encrypting transaction data. The private key of the ECC algorithm is a random number generated locally by the node. The public key of the ECC algorithm is generated by multiplying the private key with the generator of the Curve25519 elliptic curve through a dot product operation. The public and private keys of the CRYSTALS-Kyber algorithm are generated through a lattice basis operation. First, the ECC algorithm takes the key of the lightweight symmetric encryption algorithm as input, uses its private and public keys to perform encryption processing, and outputs the first encryption key. Then, the CRYSTALS-Kyber algorithm takes the first encryption key as input, uses its public and private keys to perform encryption processing, and outputs the final encryption key.

[0058] The ECC and CRYSTALS-Kyber algorithms are used in synergy to encrypt the key of the lightweight symmetric encryption algorithm in S1 to generate an encryption key. The ECC algorithm uses the Curve 25519 elliptic curve, and its public key is generated by multiplying the private key and the elliptic curve generator. The CRYSTALS-Kyber algorithm generates the public and private keys through lattice basis operations. First, the key of the lightweight symmetric encryption algorithm is encrypted with the ECC algorithm to obtain the first encryption key. Then, the first encryption key is encrypted again with the CRYSTALS-Kyber algorithm to obtain the final encryption key. The above process achieves the initial encryption of the symmetric key through the efficiency of the ECC algorithm and achieves quantum resistance protection of the encryption key by leveraging the quantum resistance properties of the CRYSTALS-Kyber algorithm. The synergistic effect ensures that the key of the lightweight symmetric encryption algorithm is not leaked during transmission, ensuring the confidentiality and security of key transmission, while adapting to the requirements of lightweight blockchain for encryption efficiency and quantum resistance.

[0059] S3. The encrypted transaction data and encryption key are processed using a lightweight digital signature algorithm to generate signature information;

[0060] Furthermore, the lightweight digital signature algorithm in S3 is the Ed25519 algorithm, and the signature processing procedure is as follows:

[0061] Perform a hash operation on the encrypted transaction data and the encryption key to obtain a hash value;

[0062] The hash value is signed using the signing private key to generate signature information;

[0063] The signature private key is derived from the root key through a pseudo-random function, and the root key is encrypted and stored using the CRYSTALS-Kyber algorithm.

[0064] Specifically, when using the Ed25519 algorithm for signature processing, the input data includes encrypted transaction data, an encryption key, and a signature private key. The encrypted transaction data is the encrypted transaction data generated in S1, the encryption key is the encryption key generated in S2, and the signature private key is derived from the root key through a pseudo-random function. The root key is encrypted and stored using the CRYSTALS-Kyber algorithm. First, a hash operation is performed on the encrypted transaction data and the encryption key to obtain a hash value. Then, the signature private key is used to perform a signature operation on the hash value to output signature information. This signature information is used to verify the integrity and authenticity of the encrypted transaction data and the encryption key.

[0065] Efficient signing is achieved through the lightweight nature of the Ed25519 algorithm. Hash operations ensure the integrity of encrypted transaction data and encryption keys. The authenticity of the data source is verified through the signing operation of the signing private key. The encrypted storage of the root key ensures the security of the signing private key. It provides verifiable integrity and source proof for encrypted transaction data and encryption keys, and is suitable for the signing needs of lightweight blockchains.

[0066] S4. Use an attribute-based encryption algorithm to set access permissions for encrypted transaction data and generate encrypted transaction data with permission identifiers;

[0067] Furthermore, the attribute-based encryption algorithm in S4 is the lightweight CP-ABE algorithm, and the process for setting access permissions is as follows:

[0068] Define the attribute set, which includes device type, region, and level;

[0069] Construct an access structure based on the attribute set. The access structure is defined as follows: the device type is sensor, the region is a specified area, and the level is a specified level.

[0070] The lightweight CP-ABE algorithm is used to encrypt the encrypted transaction data according to the access structure, generating encrypted transaction data with permission identifiers. The node private key is aggregated from partial private keys generated by multiple attribute authorization centers.

[0071] Specifically, when setting access permissions for encrypted transaction data using the lightweight CP-ABE algorithm, the input data includes encrypted transaction data, an attribute set, an access structure, and a node private key. The encrypted transaction data is generated in S1. The attribute set includes device type, region, and level; the device type is determined by the node's own device type, the region by the node's location, and the level by the node's permission level. The access structure specifies the device type as "sensor," the region as "specified area," and the level as "specified level," and this structure is constructed based on the attribute set and permission requirements. The node private key is an aggregation of partial private keys generated by multiple attribute authorization centers, with each attribute authorization center generating a partial private key for a corresponding attribute. The processing involves determining the attribute set, constructing the access structure based on the attribute set, and using the lightweight CP-ABE algorithm to encrypt the encrypted transaction data according to the access structure, outputting encrypted transaction data with permission identifiers. This encrypted transaction data with permission identifiers ensures that only nodes meeting the attribute conditions in the access structure can decrypt the data, guaranteeing controllable access permissions for the encrypted transaction data.

[0072] Fine-grained access control to encrypted transaction data is achieved through attribute sets and access structures. The security of permission management is enhanced by aggregating and generating node private keys through multiple attribute authorization centers. The lightweight CP-ABE algorithm is adapted to the resource requirements of lightweight blockchains. The overall function is to ensure that encrypted transaction data can only be decrypted by nodes that meet the access structure attribute conditions, thereby achieving precise control over access permissions.

[0073] S5. Update the key of the lightweight symmetric encryption algorithm in S1 using the proxy re-encryption algorithm to generate a new encryption key;

[0074] Furthermore, the proxy re-encryption algorithm in S5 adopts the PRE-LESS algorithm, and the formula for generating the re-encryption key during the key update process is rk = sk old ·pk new +hash(sk old ||pk new )·G, where sk old This is the node's old private key, derived by the node from the initial root key using a pseudo-random function and stored locally; pk new The receiving node uses its new public key (sk) to send the new public key to the receiving node. newThe generator G is generated by elliptic curve dot product operation; G is an elliptic curve generator using the Curve25519 standard; hash (·) is the SHA-256 hash function; the re-encryption key rk generated by the formula is used by the proxy node to convert the ciphertext encrypted with the old key into the ciphertext encrypted with the new key.

[0075] Specifically, when updating the key of the lightweight symmetric encryption algorithm in S1 using the PRE-LESS algorithm, the input data includes the key of the lightweight symmetric encryption algorithm in S1, i.e., the old key that needs to be updated, and the node's old private key sk. old Receive the new public key pk of the receiving node new Elliptic curve generator G and SHA-256 hash function hash(·), where sk old pk is the private key that a node derives from the initial root key using a pseudo-random function and stores locally. new For the receiving node to use its new private key sk new The public key is generated by performing an elliptic curve dot product with the generator G, where G is an elliptic curve generator using the Curve 25519 standard. The processing involves using the above input data and generating a re-encryption key using the formula rk = sk. old ·pk new +hash(sk old ||pk new )·G, generate a re-encryption key rk, and then use rk to update the old key of the lightweight symmetric encryption algorithm in S1, and output a new encryption key; this new encryption key is used to replace the old key of the lightweight symmetric encryption algorithm in S1 to achieve dynamic key updates.

[0076] The re-encryption key rk generated by this formula is used by the proxy node to convert the ciphertext encrypted with the old key into the ciphertext encrypted with the new key. The above process uses the PRE-LESS algorithm to realize the dynamic update of the lightweight symmetric encryption algorithm key. The security of the re-encryption process is ensured by the synergistic effect of the parameters in the formula. The participation of the proxy node makes it possible to update the key without re-encrypting historical data, thus realizing secure and efficient key updates and adapting to the key management needs of lightweight blockchains.

[0077] S6. Upload the encrypted transaction data with permission identifier, encryption key, new encryption key and signature information to the blockchain for storage.

[0078] Specifically, by integrating and uploading the key data generated in each step to the blockchain, and leveraging the distributed storage and immutability of the blockchain, unified storage and management of encrypted transaction data with permission identifiers, encryption keys, new encryption keys, and signature information can be achieved. This ensures that subsequent nodes can decrypt, verify permissions, and verify signatures based on the stored data. As a result, encrypted transaction data and related information can be solidified in the blockchain, ensuring data integrity and traceability, and adapting to the transaction data storage needs of lightweight blockchains.

[0079] After signing the encrypted transaction data and encryption key, S3 also includes a step of anonymizing the signature information using a dynamic ring signature algorithm. The dynamic ring signature algorithm dynamically adjusts the ring size according to the transaction sensitivity level. When the transaction sensitivity level is high, the ring size is set to 7 public keys; when the transaction sensitivity level is low, the ring size is set to 3 public keys. The public keys are generated based on the node identity information.

[0080] Specifically, when using the dynamic ring signature algorithm to anonymize signature information, the input data includes the signature information generated in S3, the transaction sensitivity level, and the public key in the ring. The signature information is generated after signing the encrypted transaction data and the encryption key. The transaction sensitivity level is determined according to the sensitivity of the transaction content and is divided into high and low. The public key in the ring is generated based on the node identity information and its number is dynamically adjusted according to the transaction sensitivity level. When the transaction sensitivity level is high, the ring size is set to 7 public keys, and when the transaction sensitivity level is low, the ring size is set to 3 public keys. The processing procedure is to determine the ring size, i.e. the number of public keys, according to the transaction sensitivity level, and use the dynamic ring signature algorithm in combination with the public key in the ring to anonymize the signature information, and output the anonymized signature information.

[0081] By constructing a ring structure based on the public key generated from node identity information and dynamically adjusting the ring size according to the transaction sensitivity level, the signature information generated in S3 is anonymized. At a high sensitivity level, a larger ring structure is used to enhance anonymity, while at a low sensitivity level, a smaller ring structure is used to ensure processing efficiency. The overall effect is to achieve anonymous transmission and verification of signature information without revealing the identity of the signer, thereby further improving the lightweight blockchain's ability to protect transaction privacy.

[0082] Example 2:

[0083] In the context of connected vehicles, numerous onboard sensor nodes face resource constraints. The vehicle status data they collect suffers from latency due to low encryption efficiency when uploaded to the blockchain. Access permissions for data from roadside gateways in different areas are inconsistent, keys are easily cracked after long-term use, and re-encrypting historical data during updates is costly. Furthermore, there is a risk of data tampering after being uploaded to the blockchain. To address these issues, this invention provides a lightweight blockchain encryption system based on hybrid encryption, the structure of which is as follows: Figure 2 As shown. The specific implementation process of this system is as follows:

[0084] The encryption module uses the AES-128-GCM algorithm or the Chacha20-Poly1305 algorithm to encrypt the vehicle status data collected by the vehicle sensors, generating encrypted vehicle status data. It improves encryption efficiency through a lightweight symmetric encryption algorithm, adapts to the limited resources of vehicle nodes, and reduces data encryption latency.

[0085] The key encryption module uses the ECC algorithm and the CRYSTALS-Kyber algorithm in combination to encrypt the symmetric encryption key used in the encryption module and generate an encryption key. Through the synergy of asymmetric encryption and quantum-resistant encryption, it can ensure the security of symmetric key transmission while also having the ability to resist quantum attacks, thus preventing the key from being cracked.

[0086] The signature module uses the Ed25519 algorithm to sign the encrypted vehicle status data and encryption key, generating signature information. The digital signature ensures that the data is not tampered with after it is uploaded to the blockchain, and at the same time verifies the authenticity of the data source.

[0087] The permission setting module adopts the lightweight CP-ABE algorithm. Based on the access structure of "device type is vehicle sensor, region is East China, and level is roadside gateway", it sets access permissions for encrypted vehicle status data, generates encrypted vehicle status data with permission identifiers, and achieves fine-grained permission control through attribute set and access structure, solving the problem of chaotic access permissions of roadside gateways in different regions.

[0088] The key update module updates the symmetric encryption key used in the encryption module using the PRE-LESS algorithm to generate a new encryption key. This enables dynamic key updates without re-encrypting historical data, reducing key update costs.

[0089] The storage module uploads encrypted vehicle status data with permission identifiers, encryption keys, new encryption keys, and signature information to the vehicle network blockchain for storage. This enables efficient encryption of vehicle status data, controllable permissions, secure key updates, and tamper-proof storage. By leveraging the distributed storage and immutability of blockchain, the system ensures long-term secure and traceable data storage.

[0090] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A lightweight blockchain encryption method based on hybrid encryption, characterized in that, Includes the following steps: S1. Encrypt the transaction data in the blockchain using a lightweight symmetric encryption algorithm to generate encrypted transaction data; S2. The key of the lightweight symmetric encryption algorithm in S1 is encrypted by using a combination of asymmetric encryption algorithm and quantum-resistant encryption algorithm to generate an encryption key; S3. The encrypted transaction data and encryption key are processed using a lightweight digital signature algorithm to generate signature information; S4. Use an attribute-based encryption algorithm to set access permissions for the encrypted transaction data, and generate encrypted transaction data with permission identifiers; S5. Update the key of the lightweight symmetric encryption algorithm in S1 using the proxy re-encryption algorithm to generate a new encryption key; S6. Upload the encrypted transaction data with permission identifier, encryption key, new encryption key and signature information to the blockchain for storage.

2. The lightweight blockchain encryption method based on hybrid encryption according to claim 1, characterized in that, The lightweight symmetric encryption algorithm in S1 is either AES-128-GCM or Chacha20-Poly1305. When using the AES-128-GCM algorithm, the encryption process is as follows: generate a 128-bit initial key, divide the transaction data into groups, each group of data is 128 bits long, perform 10 rounds of iterative encryption operations on each group of data using the initial key, and generate a message authentication code to obtain encrypted transaction data; When using the Chacha20-Poly1305 algorithm, an encrypted stream is generated using a 256-bit key and a 96-bit random number. The transaction data is XORed with the encrypted stream to obtain encrypted transaction data, and a message authentication code is generated using the Poly1305 algorithm.

3. The lightweight blockchain encryption method based on hybrid encryption according to claim 1, characterized in that, The asymmetric encryption algorithm in S2 is the ECC algorithm, and the quantum-resistant encryption algorithm is the CRYSTALS-Kyber algorithm. The cooperative encryption process is as follows: The key of the lightweight symmetric encryption algorithm is encrypted using the ECC algorithm to obtain the first encryption key; The first encryption key is then encrypted again using the CRYSTALS-Kyber algorithm to obtain the final encryption key. The ECC algorithm uses Curve25519 elliptic curves. The public key is generated by multiplying the private key and the elliptic curve generator. The public and private keys of the CRYSTALS-Kyber algorithm are generated by lattice basis operations.

4. A lightweight blockchain encryption method based on hybrid encryption according to claim 3, characterized in that, The lightweight digital signature algorithm in S3 is the Ed25519 algorithm, and the signature processing procedure is as follows: Perform a hash operation on the encrypted transaction data and the encryption key to obtain a hash value; The hash value is signed using the signing private key to generate signature information; The signature private key is derived from the root key through a pseudo-random function, and the root key is encrypted and stored using the CRYSTALS-Kyber algorithm.

5. A lightweight blockchain encryption method based on hybrid encryption according to claim 1, characterized in that, The attribute-based encryption algorithm in S4 is the lightweight CP-ABE algorithm. The process for setting access permissions is as follows: Determine the attribute set, which includes device type, region, and level; An access structure is constructed based on the attribute set, wherein the access structure is a sensor device, a specified region, and a specified level. The lightweight CP-ABE algorithm is used to encrypt the encrypted transaction data according to the access structure to generate encrypted transaction data with permission identifiers. The node private key is aggregated from partial private keys generated by multiple attribute authorization centers.

6. A lightweight blockchain encryption method based on hybrid encryption according to claim 1, characterized in that, The proxy re-encryption algorithm in S5 uses the PRE-LESS algorithm, and the re-encryption key generation formula during the key update process is rk = sk. old ·pk new +hash(sk old ||pk new )·G, where sk old This is the node's old private key, derived by the node from the initial root key using a pseudo-random function and stored locally; pk new The receiving node uses its new public key (sk) to send the new public key to the receiving node. new The generator G is generated by an elliptic curve dot product operation; G is an elliptic curve generator using the Curve25519 standard; hash(·) is the SHA-256 hash function; the re-encryption key rk generated by the formula is used by the proxy node to convert the ciphertext encrypted with the old key into the ciphertext encrypted with the new key.

7. A lightweight blockchain encryption method based on hybrid encryption according to claim 1, characterized in that, After signing the encrypted transaction data and encryption key in step S3, the method further includes an anonymization step of the signature information using a dynamic ring signature algorithm. The dynamic ring signature algorithm dynamically adjusts the ring size according to the transaction sensitivity level. When the transaction sensitivity level is high, the ring size is set to 7 public keys; when the transaction sensitivity level is low, the ring size is set to 3 public keys. The public keys are generated based on the node identity information.

8. A lightweight blockchain encryption system based on hybrid encryption, characterized in that, A lightweight blockchain encryption method based on hybrid encryption as described in any one of claims 1-7, the system comprising: The encryption module is used to encrypt transaction data in the blockchain using a lightweight symmetric encryption algorithm to generate encrypted transaction data. The key encryption module is used to encrypt the key of the lightweight symmetric encryption algorithm in the encryption module by using asymmetric encryption algorithm and quantum-resistant encryption algorithm in concert, so as to generate an encryption key; The signature module is used to process the encrypted transaction data and encryption key using a lightweight digital signature algorithm to generate signature information; The permission setting module is used to set access permissions for the encrypted transaction data using an attribute-based encryption algorithm, and generate encrypted transaction data with permission identifiers; The key update module is used to update the key of the lightweight symmetric encryption algorithm in the encryption module through the proxy re-encryption algorithm, and generate a new encryption key; The storage module is used to upload the encrypted transaction data with permission identifiers, encryption keys, new encryption keys, and signature information to the blockchain for storage.

Images