Distributed data sharing system based on dpos blockchain

Abstract

This invention discloses a distributed data sharing system based on the DPoS blockchain. The system includes modules for data acquisition, identity authentication, blockchain notarization, distributed storage, and access control. The data acquisition module encrypts files using the SM4 bit slicing algorithm to generate ciphertext and an SM4 session key. The key is then encapsulated using an ECC public-private key system to generate a file fingerprint. The distributed storage module stores the ciphertext based on IPFS and returns a CID. The blockchain notarization module records file fingerprints, CIDs, and other information using the DPoS consensus mechanism, forming an immutable registration record. The identity authentication module uses an on-chain ECC public key to complete identity authentication and key distribution. The access control module verifies the user's private key signature and distributes a key for the user to decrypt the ciphertext. This system can achieve encrypted data storage, trusted identity authentication, and access control, ensuring the security and traceability of data sharing.

Description

Technical Field

[0001] This application relates to the field of cross-organizational document sharing and data transmission, and in particular to a distributed data sharing system, apparatus, medium and device based on DPoS blockchain. Background Technology

[0002] In recent years, the "blockchain + distributed storage" technology approach has been widely adopted in the field of cross-institutional file sharing and data transmission, aiming to provide traceable, tamper-proof, and highly available basic support capabilities for multi-entity collaborative scenarios. However, this technology approach still exposes many common problems during engineering implementation, specifically as follows: First, the existence of centralized or quasi-centralized nodes means that the risk of single-point failure and data tampering cannot be completely eliminated; Second, the end-to-end encryption system and identity authentication link are imperfect, lacking a key lifecycle governance mechanism for sessions, including effective control over key generation, encapsulation, rotation, and revocation; Third, evidence retention is mostly limited to on-chain hashes and timestamps, making it difficult to cover the entire process of "authorization-transmission-access-revocation," and unable to achieve fine-grained auditing at the content identifier (CID) level; Fourth, in high-concurrency write scenarios, some consensus mechanisms suffer from high energy consumption and long confirmation latency, and are prone to on-chain state bloat, making it difficult to meet real-time interaction requirements. Summary of the Invention

[0003] The main purpose of this application is to provide a distributed data sharing system, device, medium and equipment based on DPoS blockchain. It aims to combine the high throughput and low latency characteristics of DPoS blockchain, the low on-chain load advantage of IPFS distributed content addressing, and the end-to-end security capabilities of the national cryptographic algorithm SM4 to create a new file sharing and data transmission scheme that significantly improves data security and trustworthiness, so as to realize the compliant implementation and large-scale application of data sharing in multiple industries and regions.

[0004] To achieve the above objectives, this application provides a distributed data sharing system based on DPoS blockchain, comprising:

[0005] Data acquisition module, identity authentication module, blockchain evidence storage module, distributed storage module, and access control module;

[0006] The data acquisition module is used to collect file data, encrypt the file data into groups using the SM4 bit slicing algorithm to generate ciphertext files and SM4 session keys, and encrypt and encapsulate the SM4 session keys using the ECC public-private key system. It calculates the digest value based on the ciphertext file to generate a file fingerprint, sends the ciphertext file to the distributed storage module, sends the SM4 session key to the identity authentication module, and sends the file fingerprint to the blockchain evidence storage module.

[0007] The distributed storage module is used in an IPFS-based file storage and distribution system to receive and distribute the encrypted file, and return a unique content identifier (CID).

[0008] The blockchain evidence storage module is used in a blockchain network based on the DPoS consensus mechanism to receive and record file fingerprints, content identifiers (CIDs), device identity identifiers, user ECC public key information, and upload time. The above information is written into the blockchain ledger through the DPoS consensus mechanism to form an immutable registration record.

[0009] The identity authentication module is used to perform user identity authentication and distribute SM4 session keys to the access control module using the user ECC public key information obtained from the blockchain evidence storage module;

[0010] The access control module is used to receive user access requests, verify the user's ECC private key signature by obtaining the user's ECC public key information from the blockchain notarization module, and verify the user's access request. After successful verification, the SM4 session key is distributed to the user, who can then download and decrypt the encrypted file from the distributed storage module.

[0011] Optionally, the SM4-bit slicing algorithm includes:

[0012] The n plaintext data blocks are rearranged into four groups of multiple bit planes, each bit plane containing m bits, forming a bit plane layout and a corresponding register storage layout. The plaintext data is then mapped to the bit planes and corresponding registers using a loading function in a loop assembly operation to obtain the bit plane data.

[0013] Based on the mapped bit plane, the mapping relationship of the S-box in the SM4 algorithm is expanded into a Boolean expression and simplified by Boolean algebra to form a gate-level network structure to adapt to the parallel processing of bit plane data.

[0014] Based on the register storage layout, the L function is performed using a five-term XOR combination through register index rotation. The expression for the L function is:

[0015]

[0016] in, The operation represents matching the distribution characteristics of the bit plane by offsetting the array index of the bit plane;

[0017] Based on the gate-level network structure and L function, bit plane data is encrypted and decrypted. During encryption, the round key rk[0]~rk

[31] is used, and during decryption, the round key rk

[31] ~rk[0] is used. The remaining logical paths are completely shared to maintain structural symmetry and logical consistency during the encryption and decryption process.

[0018] Optionally, the gate-level network structure includes:

[0019] The system consists of an input layer, a top-level logic layer, an intermediate layer, a bottom-level logic layer, and an output layer, each containing multiple logic operation units.

[0020] The input layer is used to extract bit plane data and perform an initial XOR combination to obtain combined data.

[0021] The top-level logic layer is used to extract the non-linear interaction relationships of combined data;

[0022] The intermediate layer simplifies intermediate terms to reduce the logical depth of non-linear interaction relationships, resulting in shallow logical relationships.

[0023] The lower logic layer aggregates output signals and generates control signals based on shallow logic relationships.

[0024] The output layer is used to combine the output signal and the control signal into 8-bit output bit plane data.

[0025] Optionally, each block in the blockchain evidence storage module also stores metadata of the encrypted file;

[0026] The metadata includes the hash value, file name, and timestamp of the encrypted file.

[0027] Optionally, the authentication process of the identity authentication module includes a system initialization phase, a device registration phase, a file signing and transmission phase, and a signature authentication phase;

[0028] During the system initialization phase, a fixed master key S_HEX is configured through a backend service containing ECC encryption logic to generate system parameters and initialize the key system required for identity authentication and signing. The system parameters include bilinear pairing parameters and public key points.

[0029] During the device registration phase, users input the device identity identifier through the front-end terminal and submit it to the back-end service. The back-end service processes the device identity identifier based on the ECC algorithm, obtains the corresponding ECC key pair, feeds back the public key in the ECC key pair to the front-end terminal, and completes the user registration by associating the device identity identifier.

[0030] During the file signing and transmission phase, the user selects the file to be signed and shares through the front-end terminal, and initiates a signing request to the back-end service containing the file content and device identity. The back-end service calculates the content digest of the file, signs the content digest and device identity in combination with the ECC public key, generates a signature packet, and sends it back to the front-end terminal. The front-end terminal serializes the information containing the device identity, the public key in the ECC key pair, and the signature packet through the UDP transmission service and sends it to the symmetric encryption system.

[0031] During the signature verification phase, the symmetric encryption system parses the serialized information, calls the fixed master key S_HEX of the backend service to obtain the corresponding public key point and bilinear pairing parameters; it verifies the signature packet based on the public key point and bilinear pairing parameters to complete the validity verification of the signature; the symmetric encryption system feeds back the verification result to the front-end terminal, which then displays the verification result.

[0032] Optionally, all logical operations of the gate-level network structure use the CPU's basic bitwise operation instructions;

[0033] The CPU platform includes at least one of x86, ARM, and RISC-V.

[0034] Optionally, the blockchain evidence storage module adopts the DPoS consensus mechanism;

[0035] The DPoS consensus mechanism includes electing a small number of trustees in the blockchain through a delegate node election mechanism. These trustees are responsible for packaging and generating blocks in the blockchain.

[0036] Optionally, the SM4 session key is encrypted and encapsulated using the ECC public-private key system, including:

[0037] A signature associated with the SM4 session key is generated using the user equipment's ECC private key, and the SM4 session key is encapsulated to always bind the device identity to the SM4 session key.

[0038] Optionally, the multiple bit planes are 128 bit planes, each containing 64 bits, so that the same bit from each of the 64 parallel plaintext data blocks can be stored at once using a 64-bit register.

[0039] Optionally, the SM4-bit slicing algorithm features unconditional branching, no data-dependent memory access, and a fixed logical path length.

[0040] This application proposes a distributed data sharing system, apparatus, medium, and device based on DPoS blockchain. The system includes a data acquisition module, an identity authentication module, a blockchain evidence storage module, a distributed storage module, and an access control module. The data acquisition module collects file data, encrypts the file data into blocks using the SM4 bit slicing algorithm to generate ciphertext files and SM4 session keys, and encrypts and encapsulates the SM4 session keys using the ECC public-private key system. It then calculates a digest value from the ciphertext file to generate a file fingerprint, sends the ciphertext file to the distributed storage module, sends the SM4 session key to the identity authentication module, and sends the file fingerprint to the blockchain evidence storage module. The distributed storage module is used in an IPFS-based file storage and distribution system, receiving and distributively storing the ciphertext file, and returning a unique... The content identifier (CID) is used in the DPoS consensus mechanism-based blockchain network. It receives and records file fingerprints, content identifiers (CIDs), device identification, user ECC public key information, and upload time. This information is written into the blockchain ledger to form an immutable registration record. The identity authentication module uses the user ECC public key information obtained from the blockchain storage module to authenticate the user and distribute the SM4 session key to the access control module. The access control module receives user access requests, verifies the user's ECC private key signature using the user ECC public key information obtained from the blockchain storage module, and distributes the SM4 session key to the user after successful verification. The user can then download and decrypt encrypted files from the distributed storage module. This application utilizes the high throughput and low latency characteristics of the DPoS blockchain, combined with the low on-chain load advantage of IPFS distributed content addressing, and the end-to-end security capabilities of the national cryptographic algorithm SM4 to create a novel file sharing and data transmission scheme. This significantly improves data security and trustworthiness, achieving trusted on-chain data storage, secure transmission, and controllable sharing. Attached Figure Description

[0041] Figure 1 This is a system structure block diagram provided for an embodiment of the distributed data sharing system based on DPoS blockchain in this application;

[0042] Figure 2 The overall file sharing process between EOS blockchain (DPoS) and IPFS is provided in an embodiment of the distributed data sharing system based on DPoS blockchain in this application.

[0043] Figure 3 The system hierarchy architecture and functional module distribution diagram provided for an embodiment of the distributed data sharing system based on DPoS blockchain in this application;

[0044] Figure 4This is a flowchart illustrating the file encryption signing and distributed storage process provided in an embodiment of the DPoS blockchain-based distributed data sharing system of this application.

[0045] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0046] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0047] While existing technologies can reduce on-chain load to some extent, they introduce new governance nodes and security risks. High-throughput consensus mechanisms, such as Delegated Proof-of-Stake (DPoS), and sharding parallel technologies have demonstrated high throughput and confirmation rates in IoT data sharing scenarios. The content addressing characteristics of distributed storage are widely used to alleviate the burden of on-chain data; however, overall, there are still gaps in the connection between these performance optimization technologies and file-level security governance systems, failing to create a synergistic effect.

[0048] To address shortcomings in file-level security and governance, some existing solutions attempt to adopt an "ownership on-chain / data off-chain" model, combining elliptic curve cryptography algorithms for lightweight key negotiation and enhancing traceability through tokenization or non-fungible tokens (NFTs). Other solutions explore the introduction of searchable encryption or edge computing technologies in vertical domains to improve data retrieval efficiency and reduce transmission latency. For example, in electronic medical record sharing systems, managing indexes and access control on-chain and storing ciphertext off-chain, combined with searchable encryption and secret sharing technologies, enables encrypted data retrieval and authorized access. In medical image sharing frameworks, integrated blockchain, distributed storage, and edge computing technologies, employing a combination of elliptic curve cryptography and symmetric encryption, can reduce access latency.

[0049] While the aforementioned solutions have achieved some empirical results in their respective target scenarios, they still have significant shortcomings. For example, in multi-entity, high-frequency sharing scenarios, these solutions often fail to form stable collaboration with high-throughput consensus mechanisms, easily leading to on-chain state bloat and increased cost pressures. Regarding key management, they tend to favor static authorization models, lacking session-level key revocation and resealing mechanisms, as well as operational details for CID-level auditing. More critically, the compliance requirements of key industries such as government, energy, and finance for the national cryptographic algorithm system (SM2 / SM4 / SM3) are becoming increasingly stringent, while existing technological achievements generally fail to construct a national cryptographic end-to-end security framework deeply coupled with distributed storage and blockchain consensus, making it difficult to simultaneously satisfy the three requirements of "scalability, secure forensics, and compliance."

[0050] In summary, existing technical approaches suffer from a clear binary dilemma: scaling approaches focused on throughput and latency optimization fail to establish a closed-loop engineering framework for file-level confidentiality assurance and full lifecycle key governance; while approaches emphasizing security and traceability fail to effectively resolve the contradiction between high-concurrency writes and on-chain state controllability, and lack system adaptation to the national cryptographic algorithm system. Observations of existing research on the trade-offs between consensus mechanisms and storage models further clarify that the core technical requirement in this field is: how to achieve architectural-level synergy between the DPoS consensus mechanism and distributed storage content addressing characteristics while ensuring high throughput and low confirmation latency, and simultaneously construct a session-level key governance system and a low-state-burden forensic auditing mechanism based on national cryptographic algorithms. Specifically, how to construct a symmetric encryption system, key encapsulation / re-encapsulation, and revocation strategies based on national cryptographic algorithms to achieve CID-level association and verification of events throughout the entire process of authorization, transmission, access, and revocation, ultimately forming a tailorable, auditable, and compliant unified governance capability between on-chain and off-chain, is a problem that urgently needs to be solved.

[0051] In the national cryptographic algorithm system, the SM4 block cipher algorithm is the core cornerstone for ensuring data confidentiality. This algorithm is a standard algorithm released by the State Cryptography Administration and has become an international standard, with its security and universality widely recognized. The SM4 algorithm adopts a typical unbalanced Feistel structure and belongs to iterative block cipher algorithms. Both the block length and key length are 128 bits, and it includes 32 rounds of nonlinear iterative operations. Compared to the internationally accepted Advanced Encryption Standard (AES), the SM4 algorithm has similar or better performance efficiency in both hardware and software implementation. Furthermore, its design fully considers the efficient implementation requirements of various platforms such as general-purpose CPUs and smart card chips, and it possesses strong resistance to side-channel attacks.

[0052] Therefore, engineering practice urgently needs a novel file sharing and data transmission solution that leverages the high throughput and low latency characteristics of DPoS blockchain, the low on-chain load advantage of distributed storage content addressing, and the end-to-end security capabilities of the national cryptographic algorithm SM4. This solution aims to significantly improve data transmission security and reliability while maintaining transmission efficiency, thereby meeting the compliance requirements and large-scale application needs of multiple industries and regions.

[0053] In summary, this application aims to solve the following technical problems:

[0054] (1) How to construct an efficient and low-energy blockchain file sharing system based on the DPoS consensus mechanism to overcome the limitations of traditional PoW and PoS consensus mechanisms in terms of performance and energy consumption, and solve the problems of reduced system throughput and increased confirmation latency caused by limited computational parallelism, strong data dependence and poor cross-platform compatibility in high-concurrency scenarios.

[0055] (2) How to ensure that files are tamper-proof and traceable throughout the process of on-chain registration and distributed storage, and at the same time, in IPFS-based content addressing, overcome the risks of cache timing attacks and differential power consumption attacks introduced by the table lookup method to implement the SM4 algorithm, and ensure the security of the underlying encryption operation.

[0056] (3) How to combine SM4 symmetric encryption with ECC asymmetric encryption (especially the national standard SM2 algorithm) to protect confidentiality and authenticate identity during data acquisition, transmission and sharing. How to solve the performance bottleneck of the SM4 algorithm in embedded platforms or security modules due to the unavailability of the SIMD instruction set, and how to avoid the surge in computational complexity caused by the introduction of anti-side channel protection measures when balancing security and performance;

[0057] (4) How to achieve fast file content location and access control in the IPFS distributed storage environment, so as to achieve secure and efficient file sharing.

[0058] (5) How to implement bit slicing, bit mapping and storage layout of SM4, where bit slicing requires data to be distributed bit by bit in registers, and the mapping relationship must ensure the correct byte order and cyclic shift operation, otherwise it will destroy the algorithm structure; (6) How to solve the bit rotation consistency problem of SM4 bit slicing during linear diffusion;

[0059] (7) How to solve the symmetry problem of the decryption structure of SM4-bit slice.

[0060] The distributed data sharing system based on DPoS blockchain proposed in this application will be described in detail below with reference to the accompanying drawings and embodiments.

[0061] refer to Figure 1 This application provides a distributed data sharing system 1000 based on DPoS blockchain. The system 1000 may include: a data acquisition module 1001, an identity authentication module 1002, a blockchain evidence storage module 1003, a distributed storage module 1004, and an access control module 1005.

[0062] The data acquisition module 1001 is used to acquire file data, and to encrypt the file data into blocks using the SM4 bit slicing algorithm to generate ciphertext files and SM4 session keys. The SM4 session keys are also encrypted and encapsulated using the ECC public-private key system. The digest value is calculated based on the ciphertext file to generate a file fingerprint. The ciphertext file is sent to the distributed storage module 1004, the SM4 session key is sent to the identity authentication module 1002, and the file fingerprint is sent to the blockchain evidence storage module 1003.

[0063] The distributed storage module 1004 is used in IPFS-based file storage and distribution systems to receive and distribute encrypted files and return a unique content identifier (CID).

[0064] The blockchain evidence storage module 1003 is used in a blockchain network based on the DPoS consensus mechanism to receive and record file fingerprints, content identifiers (CIDs), device identity identifiers, user ECC public key information and upload time. The above information is written into the blockchain ledger through the DPoS consensus mechanism to form an immutable registration record.

[0065] The identity authentication module 1002 is used to perform user identity authentication and SM4 session key distribution to the access control module 1005 using the user ECC public key information obtained from the blockchain evidence storage module 1003;

[0066] The access control module 1005 is used to receive user access requests, verify the user's ECC private key signature by obtaining the user's ECC public key information from the blockchain evidence storage module 1003, and verify the user's access request. After successful verification, the SM4 session key is distributed to the user, who can then download and decrypt the encrypted file from the distributed storage module 1004.

[0067] refer to Figures 2-3 The core function of the data acquisition module 1001 is to collect and encrypt file data, laying a secure foundation for subsequent sharing processes. Specifically, when a user terminal generates or needs to share a file, the data acquisition module 1001 first collects the original data of the file, then calls the SM4 bit-slicing algorithm to encrypt the original data in groups. Processing is done in batches of 64 plaintext data blocks (each 16 bytes), using bit-slicing technology to generate ciphertext data in parallel, while simultaneously generating an SM4 session key for decryption. Optionally, to address security vulnerabilities in the symmetric key distribution process, the system uses an ECC public-private key system to encrypt and encapsulate the SM4 session key. The user device generates a signature related to this session key using its own ECC private key, ensuring the session key is always bound to the uploader's identity. This enhances the security of key transmission and provides an identity verification basis for subsequent access. It should be noted that after encryption, the data acquisition module 1001 calculates the digest value of the ciphertext file, generating a unique file fingerprint (hash). This file fingerprint is not only used for subsequent file integrity verification but also serves as a unique identifier for file ownership confirmation on the blockchain. The data acquisition module 1001 then sends the encrypted file to the distributed storage module 1004, the SM4 session key to the identity authentication module 1002, and the file fingerprint to the blockchain evidence storage module 1003, completing the initial distribution and submission of the data.

[0068] Clearly, through the encryption processing of the SM4-bit slicing algorithm and the encapsulation of the ECC public-private key system, the file data has high security during the acquisition stage, effectively avoiding the risk of data leakage during transmission and storage; while the generation of file fingerprints provides support for the unique ownership and integrity verification of the file, ensuring a trustworthy foundation for data sharing.

[0069] Continue to refer to Figures 2-3 The distributed storage module 1004 uses IPFS (InterPlanetary File System) to construct a file storage and distribution system. Its core advantages lie in content addressing and distributed redundant storage. Specifically, after receiving the encrypted file sent by the data acquisition module 1001, the distributed storage module 1004 processes the file based on the IPFS content addressing mechanism, assigning a unique Content Identifier (CID) to each encrypted file. This CID is determined by the file content itself, ensuring that the file content is not tampered with while enabling rapid file location. For example, IPFS uses a distributed node network to redundantly store encrypted files. Even if some nodes are offline, the file can still be downloaded and distributed through file copies on other nodes in the network, effectively eliminating the single point of failure risk of centralized storage.

[0070] Undoubtedly, the IPFS-based distributed storage design reduces on-chain storage pressure while ensuring high availability and tamper resistance of files, providing reliable storage support for file sharing across institutions and multiple entities.

[0071] Continue to refer to Figures 2-3 The blockchain evidence storage module 1003 can build a blockchain network based on the DPoS (Delegated Proof of Stake) consensus mechanism. Its core function is to achieve immutable evidence storage and full-process traceability of file-related information. Specifically, after receiving the file fingerprint sent by the data acquisition module 1001, the blockchain evidence storage module 1003 simultaneously collects key data such as the CID, user device identity, user ECC public key information, and file upload time returned by the distributed storage module 1004, and writes this information into the block ledger through the DPoS consensus mechanism. It should be noted that the DPoS consensus mechanism, through a delegate node election mechanism, selects a small number of trustees to be responsible for block packaging and block production. Compared with the traditional PoW / PoS consensus mechanism, this significantly improves the block generation speed and network throughput while reducing energy consumption.

[0072] Continue to refer to Figures 2-3After the blockchain evidence storage module 1003 writes key information into the block ledger, it forms an immutable registration record. Each block is associated with the previous block through a hash value, forming a complete blockchain chain. This ensures that the entire process of uploading, storing, and accessing files is traceable and auditable, thus providing a reliable basis for judicial evidence collection or compliance inspection.

[0073] Continue to refer to Figures 2-3 The identity authentication module 1002 is the core of ensuring secure access to the system. Based on the user's ECC public key information registered in the blockchain evidence storage module 1003, it completes user identity authentication and secure distribution of the SM4 session key. Specifically, the identity authentication module 1002 first retrieves the ECC public key information of the user to be verified from the blockchain evidence storage module 1003, and combines it with its own stored SM4 session key. When the user initiates an access request, it confirms the user's legitimacy by verifying the user's ECC private key signature. After successful identity verification, it distributes the SM4 session key to the access control module 1005, providing key support for the user to decrypt files subsequently.

[0074] The identity authentication module 1002, in conjunction with the blockchain evidence storage module 1003, ensures the authenticity and immutability of public key information. The identity verification mechanism based on the ECC public-private key system effectively prevents the risk of identity forgery or replay attacks, providing a guarantee for the secure distribution of SM4 session keys.

[0075] Continue to refer to Figures 2-3 The access control module 1005 is responsible for receiving user access requests and completing permission verification and key distribution. Specifically, when a user submits an access request to the system, they must attach their own ECC private key signature. The access control module 1005 obtains the user's corresponding ECC public key from the blockchain evidence storage module 1003 and uses the public key to verify the signature. If the verification is successful, it indicates that the request was initiated by a legitimate user, and the access control module 1005 distributes the SM4 session key distributed by the identity authentication module 1002 to the user. After obtaining the session key, the user can download the encrypted file from the distributed storage module 1004 and decrypt the encrypted file using the key to recover the original file content. If the verification fails, the access control module 1005 rejects the user's access request and returns a verification failure message.

[0076] Clearly, the access control module 1005 ensures, through a strict signature verification mechanism, that only legitimate authorized users can obtain the decryption key, effectively controlling file access permissions. Combined with the evidence storage characteristics of blockchain, it achieves controllability and security in file sharing.

[0077] Further reference Figure 3For example, the system 1000 provided in this application embodiment presents a multi-level collaborative topology architecture, which aims to realize complex data sharing business logic through fine-grained component division. The architecture is logically divided into: a user-oriented application interaction layer (user layer and management layer), a core business logic control layer (system layer), and an underlying infrastructure support layer (underlying support layer).

[0078] Further reference Figure 2 and Figure 3 In the application interaction layer, the user layer integrates encryption / decryption and file modules. The encryption / decryption module specifically includes SM4 encryption and decryption units, responsible for localized privacy processing before data leaves or enters the user terminal; the file module provides a visual interface for file upload and download. The management layer manages the lifecycle of system parameters and user credentials through a configuration management module (including configuration file modification and configuration viewing units) and an information management module (including wallet query, public / private key generation and removal, and current node information display units).

[0079] Further reference Figure 2 and Figure 3 At the system layer, the user center, data center, and security center constitute the core of business processing. The user center, as the main implementation entity of the identity authentication module 1002, not only includes user creation and public / private key management components, but also defines the account permission structure through the wallet creation component. Specifically, the system configures each account with active permissions for daily transfers and data signature requests, and owner permissions for changes in account ownership. This dual-permission design provides a higher level of security for identity authentication.

[0080] Further reference Figure 2 and Figure 3 The data center handles the cross-layer interaction between the data acquisition module 1001 and the distributed storage module 1004. After receiving the encrypted data from the user layer, its file upload component calls the authorization verification component to verify the uploader's legitimacy. Subsequently, the file upload component encapsulates the generated CID, file fingerprint (Hash), and upload metadata into a transaction and submits it to the underlying blockchain for authorization.

[0081] Further reference Figure 2 and Figure 3The security center has further refined the defense strategy of the access control module 1005. Its unique "selecting Lorentz initial parameters" and "customizing key truncation start bits" components allow the system to obfuscate the SM4 session key using dynamic algorithms. The signature packet sending and signature packet verification components are responsible for verifying the authenticity of the user's ECC private key signature through a standard handshake protocol when the user initiates a data retrieval request, ensuring end-to-end security of the key distribution path.

[0082] Further reference Figure 2 and Figure 3 At the underlying support layer, the system achieves physical evidence storage and preservation of data through the EOS blockchain and the IPFS interplanetary link.

[0083] The EOS blockchain area is responsible for running the DPoS consensus algorithm, utilizing the producer (BP) model for rapid block generation. The account system and smart contract components, serving as the underlying logic of the blockchain evidence storage module 1003, are responsible for parsing and executing on-chain requests submitted by the data center, permanently embedding file ownership information in the distributed ledger. The IPFS file system area includes file fingerprint extraction, distributed storage, and a daemon process. The daemon process maintains network connections between nodes, and the file fingerprint extraction component performs secondary verification on the stored files to ensure that their content strictly matches the Content Identifier (CID) recorded on the blockchain, thereby achieving reliable "content-addressed" storage.

[0084] In summary, Figure 3 The system architecture shown effectively improves the scalability of the distributed data sharing system by breaking down macro-modules into specific sub-functional components and clarifying the calling relationships between each level. The user center is responsible for defining ownership, the data center is responsible for process scheduling, and the security center is responsible for logical guarding. Combined with the underlying support of EOS and IPFS, a high-performance and highly secure distributed evidence storage and sharing environment is jointly constructed.

[0085] In one embodiment of this application, the SM4 bit slicing algorithm may include: rearranging n plaintext data blocks into four groups of multiple bit planes, each bit plane containing m bits, forming a bit plane layout and a corresponding register storage layout, and using a loading function to perform a cyclic assembly operation to map the plaintext data to the bit planes and the corresponding registers to obtain bit plane data;

[0086] Based on the mapped bit plane, the mapping relationship of the S-box in the SM4 algorithm is expanded into a Boolean expression and simplified by Boolean algebra to form a gate-level network structure to adapt to the parallel processing of bit plane data.

[0087] Based on the register storage layout, the L function performs a five-term XOR combination by rotating the register index. The expression for the L function is:

[0088]

[0089] in, The operation represents matching the distribution characteristics of the bit plane by offsetting the array index of the bit plane;

[0090] Understandably, the SM4 bit-slicing algorithm is a core technology for achieving efficient file encryption. Its design goal is to improve parallel encryption processing capabilities, eliminate data dependencies and cache access differences, and reduce table lookup operations and storage access. Specifically, the SM4 bit-slicing algorithm of this application first performs orthogonal transpose and bit-plane mapping on the plaintext data, mapping 64 plaintext data blocks (16 bytes each) into 128 bit planes (corresponding to the 128-bit block length of the SM4 algorithm). Each bit plane is stored using a 64-bit register, containing 64 bits, corresponding to the bit values ​​at the same position in the 64 different plaintext blocks. Through bitwise operations of the data transpose function, the plaintext data is efficiently reassembled into the bit planes and registers, resulting in 128 64-bit wide bit-plane data, thus realizing the basis for parallel operation of 64 data blocks with a single instruction.

[0091] Furthermore, based on the mapped bit-plane data, the algorithm fully expands the 8→8 mapping relationship of the S-box in the SM4 algorithm into a Boolean expression, and obtains a gate-level network structure through Boolean algebra simplification. This structure is adapted to the parallel processing characteristics of bit-plane data, does not rely on external memory lookup tables, and eliminates the security risks and performance bottlenecks caused by lookup table operations.

[0092] It should be noted that the algorithm uses a path-sharing structure in the process of performing the five-term XOR combination of the L function through register index rotation. All other logical paths are shared. This ensures that the encryption and decryption process is structurally symmetrical and logically consistent, which reduces the implementation complexity and guarantees reverse consistency.

[0093] In summary, the SM4-bit slicing algorithm achieves simultaneous operation on the corresponding bits of multiple plaintext blocks by a single instruction through bit-plane parallel mapping, logical S-box and register-level L-transform optimization, which significantly improves encryption parallel efficiency. Meanwhile, the path-sharing structure and index offset design reduce computational complexity and data dependency, laying the foundation for constant-time execution of the algorithm.

[0094] In one embodiment of this application, the gate-level network structure may include: an input layer, a top-level logic layer, an intermediate layer, a bottom-level logic layer, and an output layer, each layer containing multiple logic operation units; wherein, the input layer is used to extract bit-plane data and perform initial XOR combination to obtain combined data; the top-level logic layer is used to extract the nonlinear interaction relationship of the combined data; the intermediate layer simplifies intermediate terms to reduce the logic depth of the nonlinear interaction relationship to obtain a shallow logic relationship; the bottom-level logic layer aggregates output signals and generates control signals based on the shallow logic relationship; the output layer is used to synthesize the output signal and control signal into 8-bit output bit-plane data.

[0095] Among them, the gate-level network structure is the core implementation form of the S-box nonlinear function in the SM4-bit slicing algorithm. It consists of an input layer, a top-level logic layer, an intermediate layer, a bottom-level logic layer, and an output layer, with each layer containing multiple logic operation units.

[0096] The input layer is responsible for extracting bit-plane data and performing an initial XOR combination on the extracted bits to obtain preliminary combined data, providing a foundation for subsequent nonlinear processing. The top-level logic layer forms the main nonlinear interaction relationships based on the combined data, constructing the core logic of the S-box nonlinear transformation. The intermediate layer simplifies the intermediate terms generated by the top-level logic layer, reducing the logic depth and computational complexity to obtain shallow logic relationships. The bottom-level logic layer aggregates output signals and generates control signals based on the shallow logic relationships, integrating the computation results of each path. The output layer combines the output signals generated by the bottom-level logic layer with the control signals to synthesize 8-bit output bit-plane data, completing the nonlinear transformation process of the S-box.

[0097] It should be noted that the logical operations of each layer are all completed through the CPU's basic bitwise operation instructions (XOR, AND, NOT), without relying on pre-computed S-box lookup tables. This eliminates the risk of side-channel attacks caused by table lookup operations and improves computational efficiency.

[0098] Clearly, the hierarchical gate-level network structure reduces logic depth and computational complexity while ensuring the nonlinear transformation function of the S-box. Combined with the parallel processing characteristics of the bit plane, it further improves the encryption efficiency and security performance of the SM4-bit slicing algorithm.

[0099] In one embodiment of this application, each block in the blockchain evidence storage module 1003 also stores metadata of the encrypted file; wherein, the metadata may include the hash value, file name and timestamp of the encrypted file.

[0100] In this embodiment, the blockchain evidence storage module 1003 stores not only file fingerprints, CIDs, device identifiers, user ECC public key information, and upload timestamps, but also metadata about the encrypted file. This metadata specifically includes the encrypted file's hash value, file name, and timestamp. Specifically, the hash value of the encrypted file matches the file fingerprint generated by the data acquisition module 1001, used for cross-verification of file integrity; the file name is the original name used by the user when uploading the file, facilitating file identification by both the user and the system; and the timestamp accurately records the time the file was uploaded to the blockchain, providing a basis for chronological traceability of file sharing.

[0101] For example, when it is necessary to audit the sharing process of a certain file, auditors can quickly locate the target file by the file name stored in the block, combine the timestamp to sort out the timeline of file upload and access, and verify whether the file has been tampered with during transmission and storage by hash value, so as to fully grasp the sharing trajectory of the file.

[0102] Undoubtedly, the addition of metadata to the encrypted files in the block enriches the data dimensions of on-chain evidence storage, making the file ownership information more complete. This not only facilitates file management for users and the system but also provides a more comprehensive basis for end-to-end auditing and traceability, further enhancing the system's credibility.

[0103] In one embodiment of this application, the authentication process of the identity authentication module 1002 may include a system initialization stage, a device registration stage, a file signing and transmission stage, and a signature authentication stage.

[0104] During the system initialization phase, a fixed master key S_HEX is configured through a backend service containing ECC encryption logic to generate system parameters and initialize the key system required for identity authentication and signing. The system parameters may include bilinear pairing parameters and public key points.

[0105] During the device registration phase, users input the device identity identifier through the front-end terminal and submit it to the back-end service. The back-end service processes the device identity identifier based on the ECC algorithm, obtains the corresponding ECC key pair, feeds back the public key in the ECC key pair to the front-end terminal, and completes the user registration by associating the device identity identifier.

[0106] During the file signing and transmission phase, the user selects the file to be signed and shares through the front-end terminal, and initiates a signing request to the back-end service containing the file content and device identity. The back-end service calculates the content digest of the file, signs the content digest and device identity in combination with the ECC public key, generates a signature packet, and sends it back to the front-end terminal. The front-end terminal serializes the information containing the device identity, the public key in the ECC key pair, and the signature packet through the UDP transmission service and sends it to the symmetric encryption system.

[0107] During the signature verification phase, the symmetric encryption system parses the serialized information, calls the fixed master key S_HEX of the backend service to obtain the corresponding public key point and bilinear pairing parameters; it verifies the signature packet based on the public key point and bilinear pairing parameters to complete the validity verification of the signature; the symmetric encryption system feeds back the verification result to the front-end terminal, which then displays the verification result.

[0108] refer to Figure 4 In this embodiment, during the system initialization phase, the backend service containing ECC encryption logic configures a fixed master key S_HEX, generates bilinear pairing parameters and public key points, and completes the initialization of the key system required for identity authentication and signing, providing basic key support for subsequent authentication processes. During the device registration phase, the user inputs the device identity identifier through the front-end terminal and submits it to the backend service. After verifying the validity of the identity identifier, the backend service generates a corresponding ECC key pair based on the ECC algorithm, feeds back the public key to the front-end terminal, and simultaneously associates the device identity identifier to complete registration, establishing a unique binding between the user's identity and the ECC key pair. During the file signing and transmission phase… In the first stage, after the user selects a file to share, they send a signature request to the backend service containing the file content and device identification. The backend service calculates the file content digest, combines it with the ECC public key to sign the digest and identification, and generates a signature packet. The frontend terminal serializes the identification, public key, and signature packet via UDP transmission service and sends them to the symmetric encryption system to ensure efficient and secure transmission. In the signature verification stage, the symmetric encryption system parses the serialized information, calls the fixed master key S_HEX to obtain the public key location and bilinear pairing parameters, verifies the signature packet based on these parameters, and after completing the signature validity verification, feeds back the verification result to the frontend terminal for the user to view.

[0109] Understandably, the four-stage authentication process covers the entire process from system initialization to access request verification. By leveraging the encryption features of the ECC algorithm and the efficiency of UDP transmission, it ensures the security of identity authentication while improving the execution efficiency of the authentication process, effectively preventing security risks such as identity forgery and replay attacks.

[0110] In one embodiment of this application, all logical operations of the gate-level network structure use the basic bitwise operation instructions of the CPU; wherein, the platform to which the CPU belongs may include at least one of x86, ARM and RISC-V.

[0111] In one embodiment of this application, all logical operations of the gate-level network structure are implemented using the CPU's basic bitwise operation instructions (XOR, AND, NOT), without relying on any dedicated instruction sets or hardware acceleration modules, thus possessing strong cross-platform adaptability. Specifically, the CPU platform can include mainstream architectures such as x86, ARM, and RISC-V. Whether it is the x86 platform of a general-purpose computer, the ARM platform of an embedded device, or the open-source RISC-V platform, the corresponding operational logic of the gate-level network structure can be directly compiled and run without additional adaptation modifications.

[0112] For example, when the system is applied to embedded security devices (ARM architecture) in the government sector or general-purpose servers (x86 architecture) in the financial sector, the gate-level network structure can maintain consistent computing performance and security features without the need to redesign logic circuits or algorithm processes for different platforms.

[0113] In fact, the design based on basic bitwise operation instructions frees the gate-level network structure from dependence on specific platforms, which not only reduces the deployment cost of the system, but also expands the application scenarios of the system and meets the hardware environment requirements of different industries such as government affairs, energy, and finance.

[0114] In one embodiment of this application, the blockchain evidence storage module 1003 adopts the DPoS consensus mechanism; wherein, the DPoS consensus mechanism may include electing a small number of trustees in the blockchain through a delegate node election mechanism, and the trustees are responsible for packaging and producing blocks in the blockchain.

[0115] The blockchain evidence storage module 1003 employs the DPoS consensus mechanism, which primarily improves consensus efficiency and reduces energy consumption through a delegate node election mechanism. Specifically, token holders in the blockchain network elect a small number of delegates (typically 21-101) through voting. These delegates are responsible for packaging and producing blocks, with each delegate taking turns producing blocks in a fixed order to ensure the continuity and efficiency of block generation. Compared to the traditional PoW consensus mechanism, DPoS eliminates the need for extensive computing power to compete for block production rights, significantly reducing energy consumption. Compared to the traditional PoS consensus mechanism, DPoS reduces the complexity of node synchronization and increases network throughput through centralized block production by delegates.

[0116] It should be noted that the trustee is replaceable. If a trustee engages in malicious behavior or a node malfunctions, users can vote to remove it and elect a new trustee to replace it, thus ensuring the security and stability of the consensus mechanism.

[0117] It can be said that the design of the DPoS consensus mechanism enables the blockchain evidence storage module 1003 to significantly improve the block generation speed and network throughput while ensuring that the data is immutable and traceable, and reduce the system's energy consumption. It can meet the needs of file registration and evidence storage in high-concurrency scenarios and provide efficient consensus support for high-frequency data sharing across institutions.

[0118] In one embodiment of this application, the SM4 session key is encrypted and encapsulated using the ECC public-private key system, including: generating a signature related to the SM4 session key using the user equipment's ECC private key, and encapsulating the SM4 session key to always bind the device identity identifier to the SM4 session key.

[0119] In this embodiment, the core logic of encrypting and encapsulating the SM4 session key using the ECC public-private key system is to forcibly bind the uploader's identity to the session key, ensuring the key's controllability and traceability. Specifically, after generating the SM4 session key, the user equipment uses its own ECC private key to sign the session key, generating encapsulated data containing identity information and key information. This encapsulated data, along with the SM4 session key, is transmitted to the identity authentication module 1002. During subsequent key distribution, the recipient can verify the validity of the signature using the uploader's ECC public key to confirm the legitimacy of the session key's origin. If the key is found to have been tampered with or the identity does not match, the recipient can directly refuse to receive the key.

[0120] It should be noted that the ECC public-private key system has high encryption strength. At the same security level, the key length of the ECC algorithm is much shorter than that of the RSA algorithm, which reduces the overhead of key transmission and storage and improves the efficiency of encryption and decryption operations.

[0121] Clearly, by using ECC private key signing for encapsulation, the SM4 session key is deeply bound to the uploader's identity, effectively preventing the risk of key forgery, tampering, or theft. At the same time, it provides an identity basis for tracing the key's usage trajectory, further enhancing the security and controllability of the data sharing process.

[0122] In one embodiment of this application, the multiple bit planes are 128 bit planes, each bit plane containing 64 bits, so that the same bit in each of the 64 parallel plaintext data blocks can be stored at once using a 64-bit register.

[0123] In this embodiment, the SM4-bit slicing algorithm has 128 bit planes, each containing 32 bits. The core objective of this design is to fully utilize the parallel processing capability of the 64-bit register to improve encryption efficiency. Specifically, the 128 bit planes correspond to the bit distribution of 64 16-byte plaintext blocks. Each bit plane stores the same bit from the 64 parallel plaintext data blocks. The 64-bit register can store all 64 bits of a bit plane at once, enabling parallel operation on the same bit of 64 plaintext blocks with a single instruction.

[0124] For example, when processing 64 plaintext blocks, the 128-bit plane can complete the data loading and operation through a 64-bit register, eliminating the need for data splitting or multiple operations. This significantly reduces the number of instruction executions and data transmission latency, increasing the parallelism of the encryption operation by 64 times. The adaptation design of the 128-bit plane and 64-bit register maximizes the parallel processing capabilities of the hardware platform, significantly improving the encryption efficiency of the SM4-bit slicing algorithm. This meets the file encryption requirements in high-concurrency scenarios and provides performance support for large-scale data sharing.

[0125] In one embodiment of this application, the SM4-bit slicing algorithm has unconditional branching, no data-dependent memory access, and a fixed logical path length.

[0126] In this embodiment, the SM4-bit slicing algorithm employs an unconditional branching and data-dependent memory access design, ensuring a fixed logical path length and achieving constant-time execution. Specifically, during execution, regardless of changes in the input data, the order, number of times, and timing of instruction execution remain consistent, eliminating cache access timing differences or branch prediction biases caused by data variations. For example, in the S-box logic operations, all paths have the same logical depth, and different operation paths are not selected based on different input bits; in the L-transform register index rotation, the index offset calculation method is fixed and independent of the input data. It should be noted that the constant-time execution mechanism is crucial for defending against side-channel attacks (such as CacheTimingAttack and Differential Power Analysis (DPA)). Attackers cannot deduce keys or data content by monitoring side-channel information such as operation time and power consumption changes. The constant-time execution design of the SM4-bit slicing algorithm eliminates the possibility of side-channel attacks at the underlying logic level, giving the algorithm stronger anti-attack capabilities in high-security scenarios, while ensuring consistent encryption operation efficiency for different input data, thus improving system stability and reliability.

[0127] Compared with the prior art, the present invention has the following beneficial effects:

[0128] (1) The S-box replacement lookup structure is optimized. The non-linear replacement function of the SM4S box is realized through Boolean expression, which completely eliminates the memory lookup dependency and realizes a constant execution path.

[0129] (2) Bit-to-parallel mapping mechanism: Data bit slice mapping allows a single instruction to operate on the corresponding bits of multiple plaintext blocks simultaneously, achieving 64 times the parallel efficiency.

[0130] (3) Register-level linear diffusion optimization: L-transform is achieved by rotating register bits, eliminating the need for shift instructions or mask operations and reducing computational complexity.

[0131] (4) Constant timing resistance to attacks, unconditional branching of the algorithm and data dependency access, naturally defends against side-channel attacks such as CacheTiming and BranchPrediction.

[0132] (5) It has strong cross-platform and embedded compatibility. All operations are based on standard C language logic instructions and can be directly compiled and run on architectures such as x86, ARM, and RISC-V. It is suitable for both software and hardware implementation.

[0133] (6) Enhanced security: Combining SM4 and ECC ensures the confidentiality and anti-attack capabilities of the entire process of file acquisition, transmission and sharing;

[0134] (7) High-efficiency consensus: It adopts the DPoS consensus mechanism, which provides higher performance and lower energy consumption compared with the traditional PoW / PoS.

[0135] (8) Storage reliability: IPFS-based distributed storage eliminates the risk of centralization and ensures data availability and tamper resistance;

[0136] (9) Trustworthy and traceable: Blockchain registration of document fingerprints and CIDs ensures that the entire sharing process is traceable and can be used for judicial evidence collection or auditing;

[0137] (10) Cross-domain application: This solution can be applied to multiple fields such as medical data sharing, financial record transmission, government document filing, and power data collection.

[0138] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A distributed data sharing system based on DPoS blockchain, characterized in that, include: Data acquisition module, identity authentication module, blockchain evidence storage module, distributed storage module, and access control module; The data acquisition module is used to collect file data, encrypt the file data into groups using the SM4 bit slicing algorithm to generate ciphertext files and SM4 session keys, and encrypt and encapsulate the SM4 session keys using the ECC public-private key system. It calculates the digest value based on the ciphertext file to generate a file fingerprint, sends the ciphertext file to the distributed storage module, sends the SM4 session key to the identity authentication module, and sends the file fingerprint to the blockchain evidence storage module. The distributed storage module is used in an IPFS-based file storage and distribution system to receive and distribute the encrypted file, and return a unique content identifier (CID). The blockchain evidence storage module is used in a blockchain network based on the DPoS consensus mechanism to receive and record file fingerprints, content identifiers (CIDs), device identity identifiers, user ECC public key information, and upload time. The above information is written into the blockchain ledger through the DPoS consensus mechanism to form an immutable registration record. The identity authentication module is used to perform user identity authentication and distribute SM4 session keys to the access control module using the user ECC public key information obtained from the blockchain evidence storage module; The access control module is used to receive user access requests, verify the user's ECC private key signature by obtaining the user's ECC public key information from the blockchain notarization module, and verify the user access request. After the verification is successful, the SM4 session key is distributed to the user, who can then download and decrypt the encrypted file from the distributed storage module. The SM4-bit slicing algorithm includes: The n plaintext data blocks are rearranged into four groups of multiple bit planes, each bit plane containing m bits, forming a bit plane layout and a corresponding register storage layout. The plaintext data is then mapped to the bit planes and corresponding registers using a loading function in a loop assembly operation to obtain the bit plane data. Based on the mapped bit plane, the mapping relationship of the S-box in the SM4 algorithm is expanded into a Boolean expression and simplified by Boolean algebra to form a gate-level network structure to adapt to the parallel processing of bit plane data. Based on the register storage layout, the L function is performed using a five-term XOR combination through register index rotation. The expression of the L function is: wherein, The operation represents shifting the distribution characteristics of the matching bit plane by the array index of the bit plane. Based on the gate-level network structure and L function, bit plane data is encrypted and decrypted. During encryption, the round key rk[0]~rk[31] is used, and during decryption, the round key rk[31]~rk[0] is used. The rest of the logical paths are completely shared to maintain structural symmetry and logical consistency during the encryption and decryption process. The authentication process of the identity authentication module includes a system initialization phase, a device registration phase, a file signing and transmission phase, and a signature authentication phase. During the system initialization phase, a fixed master key S_HEX is configured through a backend service containing ECC encryption logic to generate system parameters and initialize the key system required for identity authentication and signing. The system parameters include bilinear pairing parameters and public key points. During the device registration phase, users input the device identity identifier through the front-end terminal and submit it to the back-end service. The back-end service processes the device identity identifier based on the ECC algorithm, obtains the corresponding ECC key pair, feeds back the public key in the ECC key pair to the front-end terminal, and completes the user registration by associating the device identity identifier. During the file signing and transmission phase, the user selects the file to be signed and shares through the front-end terminal, and initiates a signing request to the back-end service containing the file content and device identity. The back-end service calculates the content digest of the file, signs the content digest and device identity in combination with the ECC public key, generates a signature packet, and sends it back to the front-end terminal. The front-end terminal serializes the information containing the device identity, the public key in the ECC key pair, and the signature packet through the UDP transmission service and sends it to the symmetric encryption system. During the signature verification phase, the symmetric encryption system parses the serialized information, calls the fixed master key S_HEX of the backend service to obtain the corresponding public key point and bilinear pairing parameters; it verifies the signature packet based on the public key point and bilinear pairing parameters to complete the validity verification of the signature; the symmetric encryption system feeds back the verification result to the front-end terminal, which then displays the verification result.

2. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, The gate-level network structure includes: The system consists of an input layer, a top-level logic layer, an intermediate layer, a bottom-level logic layer, and an output layer, each containing multiple logic operation units. The input layer is used to extract bit plane data and perform an initial XOR combination to obtain combined data. The top-level logic layer is used to extract the non-linear interaction relationships of combined data; The intermediate layer simplifies intermediate terms to reduce the logical depth of non-linear interaction relationships, resulting in shallow logical relationships. The lower logic layer aggregates output signals and generates control signals based on shallow logic relationships. The output layer is used to combine the output signal and the control signal into 8-bit output bit plane data.

3. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, Each block in the blockchain evidence storage module also stores metadata of the encrypted file; The metadata includes the hash value, file name, and timestamp of the encrypted file.

4. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, All logical operations in the gate-level network structure use the CPU's basic bitwise operation instructions. The CPU platform includes at least one of x86, ARM, and RISC-V.

5. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, The blockchain evidence storage module adopts the DPoS consensus mechanism. The DPoS consensus mechanism includes electing a small number of trustees in the blockchain through a delegate node election mechanism. These trustees are responsible for packaging and generating blocks in the blockchain.

6. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, The SM4 session key is encrypted and encapsulated using the ECC public-private key system, including: A signature associated with the SM4 session key is generated using the user equipment's ECC private key, and the SM4 session key is encapsulated to always bind the device identity to the SM4 session key.

7. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, The multiple bit planes consist of 128 bit planes, each containing 64 bits, so that the same bit from each of the 64 parallel plaintext data blocks can be stored at once using a 64-bit register.

8. The distributed data sharing system based on DPoS blockchain as described in claim 1, characterized in that, The SM4-bit slicing algorithm features unconditional branching, no data-dependent memory access, and a fixed logical path length.

Images