Block chain evidence storage-based accountability attribute-based encrypted data sharing method and system

Abstract

The invention discloses an accountability attribute-based encrypted data sharing method and system based on block chain evidence storage, and relates to the technical field of cyberspace security and digital copyright management, and the method comprises the following steps: a key generation center generates an attribute private key containing a user identity certificate according to a user attribute and an identity label in combination with a homomorphic encryption algorithm, and sends the attribute private key to a server; the voucher is stored in the block chain; a data owner adopts a hybrid architecture combining symmetric encryption and attribute-based encryption to package and distribute data and keys; the user terminal recovers the data by using a decryption algorithm for optimizing the group structure; and when key leakage is found, the validity of the private key is automatically verified through the block chain smart contract, and an identity recovery algorithm is executed, so that decentralized traceability of the malicious user is realized. According to the blockchain evidence storage-based accountability attribute-based encrypted data sharing method and system, the calculation overhead of the terminal is reduced by optimizing the decryption process, and the problem that evidence obtaining and responsibility investigation are difficult after the secret key is leaked is solved by using the blockchain technology.

Description

Technical Field

[0001] This invention relates to the fields of cyberspace security and digital rights management technology, and in particular to a method and system for sharing accountable attribute-based encrypted data with blockchain-based evidence storage. Background Technology

[0002] With the rapid development of mobile internet and digital media technologies, the distribution model for high-value digital content (such as 4K / 8K ultra-high-definition video, high-frequency financial data, exclusive industry research reports, online educational courseware, etc.) is shifting from traditional physical media to cloud services. Digital Rights Management (DRM) systems, as core infrastructure for protecting the rights of content creators and preventing piracy, are becoming increasingly important.

[0003] In existing DRM systems, content providers often need to develop complex access control policies for different user subscription levels (such as "regular members," "VIP members," and "enterprise subscriptions"), geographical locations, and device types. Attribute-Based Encryption (ABE) technology, due to its support for "one-to-many" broadcast encryption and its ability to implement fine-grained access control based on user attributes (such as identity, role, and subscription period), is considered an ideal solution for managing access permissions in large-scale content distribution. Compared to traditional Role-Based Access Control (RBAC) or Identity-Based Encryption (IBE), ABE technology does not require encrypting data individually for each user. The data owner only needs to encrypt once according to the access policy, and all users who meet the attribute conditions can decrypt it, greatly reducing bandwidth and computing costs on the distribution end.

[0004] However, directly applying existing attribute-based encryption technology to data copyright distribution scenarios still faces two major technical bottlenecks: First, the decryption efficiency of terminal devices is low, making it difficult to meet the needs of real-time operation. In mobile terminal devices (such as smartphones and tablets), computing resources and battery life are often limited. Traditional ABE algorithms typically involve a large number of bilinear pairing operations and higher-order exponentiation operations, resulting in high computational complexity and significant decryption latency at the user end. Especially when processing high-bitrate audio and video data, this high computational overhead can easily cause playback stuttering, severe device overheating, and other problems, seriously affecting the user experience.

[0005] Second, the lack of key auditing and tracing mechanisms makes it difficult to address issues of "account sharing" and "key leakage." In standard policy-based encryption (CP-ABE) systems, different users with the same set of attributes (e.g., all users who purchased "annual gold memberships") have functionally equivalent private keys, and in some algorithmic constructions, they are even indistinguishable. Once a malicious user extracts and publishes their private key on the internet, or creates a "universal cracking tool" for illegal profit, system administrators, while able to detect the key leakage, cannot extract the user's true identity information from the leaked key. Because the source of the leakage (i.e., the specific violating user ID) cannot be accurately located, copyright holders cannot effectively ban accounts or pursue legal action, making it difficult to curb piracy. Furthermore, existing traceable solutions often rely on centralized authorized agencies for tracking, lacking transparent and tamper-proof evidence preservation mechanisms. In the event of a copyright dispute, malicious users may deny wrongdoing, or users may question whether the centralized agency forged the tracking results, making it difficult to pursue accountability and evidence collection, and casting doubt on the legal validity.

[0006] Therefore, there is an urgent need to develop a data sharing and protection technology that can maintain the advantages of ABE's fine-grained access control, significantly reduce terminal decryption overhead, and support mandatory tracing of the identity of maliciously leaked keys. Summary of the Invention

[0007] The purpose of this invention is to provide an accountable attribute-based encrypted data sharing method and system based on blockchain evidence storage, which solves the technical problems in existing cross-domain data sharing schemes, such as the high computational overhead and high decryption delay of attribute-based encryption algorithms on resource-constrained terminals, resulting in poor user experience, and the lack of a reliable identity tracing and accountability mechanism (i.e., "who will supervise the regulator") after key leakage.

[0008] To achieve the above objectives, this invention provides a method for sharing accountable attribute-based encrypted data with blockchain-based notarization, comprising the following steps: S1. System initialization and key generation: The key generation center generates attribute private keys based on user attributes and identity identifiers, combined with homomorphic encryption algorithms, and stores the identity credentials on the blockchain; S2. Data Content Encryption and Distribution: The data owner uses a hybrid architecture combining symmetric encryption and attribute-based encryption to encapsulate and distribute the data and keys. S3. User-side decryption and access: The user-side parses the ciphertext header, uses the attribute private key to match and eliminate the ciphertext components, recovers the decryption intermediate parameters, obtains the symmetric content key, and then decrypts the data slice. S4. Blockchain-based tracking and accountability for malicious users: By automatically verifying the validity of private keys and executing identity recovery algorithms through blockchain smart contracts, decentralized tracing of malicious users can be achieved.

[0009] Preferably, the specific steps of S1 are as follows: S11. The key generation center constructs a bilinear mapping group environment based on prime order to generate system public parameters and master private key; S12. The key generation center generates an attribute private key based on the attribute set and identity identifier submitted by the user, combined with a homomorphic encryption algorithm. The attribute private key contains the user's identity certificate. The attribute private key is distributed to the user and the identity certificate is stored on the blockchain.

[0010] Preferably, the specific steps of S12 are as follows: S121. The key generation center randomly selects a random number. Using Paillier homomorphic encryption algorithm to identify users Perform encryption to generate user proof The calculation formula is: ； The specific calculation is as follows: ; in, The homomorphic ciphertext (i.e., user proof) generated after encrypting the user's identity. n The modulus of the public key for the Paillier encryption algorithm. Common parameters generated for system initialization r The random number randomly selected by the key generation center To encrypt random numbers, mod Modulo operation; S122, Based on the system master private key and user proof Calculate and generate user attribute private keys sk , sk Specifically, it includes: ; ; ; ; in, sk 1 is the master key component containing the system master private key and user identity credentials. sk 2 is a key randomization component based on random number generation. sk 3 corresponds to specific user attributes The attribute key component, sk 4 is a homomorphic identity credential component used for tracking malicious users. For group generators, For hash functions, This is the size of the complete set of system attributes. For specific user attributes.

[0011] Preferably, the specific steps of S2 are as follows: S21. The data owner generates a symmetric content key and uses the symmetric content key to symmetrically encrypt the data slice; S22. Using system public parameters and access control policies, the symmetric content key is encapsulated and encrypted using an attribute-based encryption algorithm to generate a ciphertext header. S23. Publish the encrypted data along with the ciphertext header.

[0012] Preferably, step S22 uses a monotonic span procedure (MSP) to generate the access control matrix. And select a random vector to calculate and generate the ciphertext header, which includes: ; ; ; ; ; in, For random number based The generated ciphertext randomization component, For the corresponding index The ciphertext auxiliary randomization component, For the access control matrix corresponding to the first The attribute ciphertext component of the line, Ciphertext components used to assist in decryption calculations, This is the key for the encapsulated symmetric content. v To construct a random vector for a monotonic span program MSP, T This is the transpose operation of a matrix. For the access matrix OK, For the attribute corresponding to this row, For attributes In the Each position and the number of times it has appeared before it This is the mask calculated using the system's master public key.

[0013] Preferably, the specific steps for obtaining the symmetric content key in step S3 are as follows: S31. If the user attribute set satisfies the access control policy, does a coefficient exist? Make The user terminal reconstructs intermediate parameters through bilinear pairing operations.d The specific formula for bilinear pairing operation is as follows: ; in, e For bilinear pairing operations, To satisfy the set of matrix row indices corresponding to the attributes of the access control policy, For all corresponding The maximum value in the matrix represents the maximum value in the matrix. The maximum number of times a certain attribute is used; S32. Calculate the symmetric content key. The specific calculation formula is as follows: ; in, CEK It is a symmetric content key.

[0014] Preferably, the specific steps of S4 are as follows: S41. When a leaked private key is detected, the auditor extracts the private key and submits it to the blockchain network. S42. The blockchain node runs a smart contract to verify the validity of the private key. After successful verification, it executes an identity recovery algorithm to restore the original user identity identifier bound to the private key and store it on the blockchain.

[0015] Preferably, the specific steps of S42 are as follows: S421: The smart contract receives a suspected leaked private key and verifies its validity using system public parameters and the algebraic properties of bilinear pairings. The calculation formula is as follows: ; ; ; in, k These are intermediate parameters for bilinear pairing operations generated by the smart contract during the private key validity verification process. S422: Determine whether the following equation is true: ; If the equation holds true, the smart contract is based on the private key component. By using the Chinese Remainder Theorem (CRT) and preset parameters, the influence of random numbers is removed, and the user identity identifier bound to the private key is restored. ; S423: Restore the user The hash value of the tracking process is written into the blockchain block.

[0016] A system for an accountable attribute-based encrypted data sharing method based on blockchain notarization includes: The key generation module is used to initialize system parameters and generate attribute private keys for embedded homomorphic identity credentials based on user attributes and identity identifiers, while storing the credentials on the blockchain. The data encryption and publishing module is used to generate symmetric key encryption data, encapsulate the symmetric key using attribute-based encryption algorithms and access policies, and publish the ciphertext to the storage network. The user decryption module is used to verify whether user attributes meet the policy and to obtain the symmetric key through the attribute private key to access the data; The blockchain audit trail module is used to deploy smart contracts, receive leaked private keys, and automatically execute private key validity verification and identity recovery algorithms on the chain to achieve decentralized tracing of malicious users.

[0017] Preferably, the smart contract performs identity recovery calculations under the witness of all network nodes. The calculation process does not rely on the intervention of the private key of a centralized institution, but only uses public parameters and leaked private keys to restore the user's identity.

[0018] Therefore, the present invention employs the above-mentioned blockchain-based method and system for sharing accountable attribute-based encrypted data, which has the following beneficial effects: (1) Excellent computational efficiency and adaptability: This invention deploys the core elements of the ciphertext and private key in a group structure that is faster and smaller in size, and optimizes the encryption and decryption process by reusing random numbers, which greatly reduces the length of the ciphertext and the number of pairing operations during decryption. Combined with the hybrid architecture of "symmetric encrypted data + ABE encryption key", it effectively solves the shortcomings of traditional ABE schemes that cannot meet the needs of real-time data use.

[0019] (2) Decentralized Trustworthy Accountability Mechanism: Innovatively introduces blockchain technology to solve the trust problem in "white-box tracking". Traditional tracking relies on centralized servers, which poses a risk of evidence forgery. This invention solidifies the tracking algorithm into an on-chain smart contract. Once a key leak is discovered, the tracing process is automatically executed and witnessed by the entire network, ensuring the fairness and non-repudiation of the accountability results and effectively curbing copyright infringement.

[0020] (3) Balancing fine-grainedness and privacy protection: It supports complex access control based on attributes, and data owners can flexibly formulate "one-to-many" sharing strategies. At the same time, the user's specific identity information is not visible to the cloud server during normal access. It will only be restored by the authorized smart contract when malicious leakage triggers the tracking conditions, thus achieving a balance between privacy protection and regulatory requirements.

[0021] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0022] Figure 1This is a flowchart illustrating an embodiment of the accountability attribute-based encrypted data sharing method and system based on blockchain evidence storage of the present invention. Figure 2 This is a model diagram of an embodiment of the accountable attribute-based encrypted data sharing method and system based on blockchain evidence storage of the present invention; Figure 3 This is a comparison chart of the Setup runtime of an embodiment of the blockchain-based accountable attribute-based encrypted data sharing method and system for evidence storage of the present invention. Figure 4 This is a comparison chart of KeGen runtime of an embodiment of the accountable attribute-based encrypted data sharing method and system based on blockchain evidence storage of the present invention; Figure 5 This is a comparison chart of the Encrypt runtime of an embodiment of the accountability attribute-based encrypted data sharing method and system based on blockchain evidence storage of the present invention. Figure 6 This is a comparison chart of the Decrypt runtime of an embodiment of the accountability attribute-based encrypted data sharing method and system based on blockchain evidence storage of the present invention. Detailed Implementation

[0023] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0025] Example Please see Figures 1-6 This invention provides a method for sharing accountable attribute-based encrypted data with blockchain-based notarization, comprising the following steps: S1. System initialization and key generation.

[0026] The Key Generation Center (KGC) performs initialization operations, constructs a bilinear mapping group environment based on prime order, and selects random numbers to configure the system public parameters and master private key. The system public parameters contain variables to control the range of randomness, balancing cryptographic security and computational overhead. The KGC initializes and generates the system public parameters and master private key, following these steps: S11. The key generation center executes the initialization algorithm. Enter security parameters The algorithm first generates the swarm parameters: ; in, For group parameters, prime order The (asymmetric) bilinear group, Groups generator, For bilinear mapping pairs .

[0027] from Random selection A hash function Randomly select two large prime numbers. and ,calculate Random selection ,calculate ,calculate The calculated public key mpk and msk are as follows: ; ; in, for finite field, Set as This is used to control the range of randomness, ensuring sufficient randomness while reducing the cost of exponentiation operations. `keysize` is the key length. For the calculation result, hash function , Represents a set of bit strings of arbitrary length.

[0028] S12. KGC generates a private key containing the user's identity credentials based on the set of attributes and identity identifier (ID) submitted by the user, using a homomorphic encryption algorithm. The specific steps are as follows: S121, KGC execution Input the system's master public key, master private key, user attribute set, and user identity ID. The key generation center will then randomly select... Execute the Paillier algorithm to generate user proofs. The calculation formula is: ; The specific calculation is as follows: ; in, The homomorphic ciphertext (i.e., user proof) generated after encrypting the user's identity. n The modulus of the public key for the Paillier encryption algorithm. Common parameters generated for system initialization r The random number randomly selected by the key generation center To encrypt random numbers, mod Modulo operation.

[0029] S122, Based on the system master private key and user proof Then calculate the user's private key. The specific calculation formula is as follows: ; ; ; ; The final user's attribute private key obtained is: ; in, The specific steps of the algorithm are as follows: Select a random number ,calculate . This indicates the number of user attributes set by the system. This represents the user's specific attributes.

[0030] S13. Distribute the attribute private key to the user through a secure channel, and at the same time, store the hash digest or attribute certificate of the user's identity in the distributed ledger of the blockchain network.

[0031] S2, Data content encryption and distribution.

[0032] The data owner first generates a symmetric content encrypting key (CEK) for encrypting data (such as streaming media data) and its index file. This CEK is then used to efficiently symmetrically encrypt the original data slices. Next, the data owner formulates an access control policy (such as an access matrix) and, using system public parameters and the access control policy, encapsulates and encrypts the CEK using the attribute-based encryption (ABE) algorithm, generating a ciphertext header. Finally, the ciphertext header is embedded in the data index file, and the encrypted data slices are uploaded to cloud storage or a content delivery network (CDN). The specific steps are as follows: S21. The data owner first generates a symmetric content key (CEK) for encrypting the data and its index file. This CEK is then used to efficiently symmetrically encrypt the original data slice, forming symmetric ciphertext. Specifically: Data owner randomly selected The HKDF key derivation function is executed to generate a symmetric key for the SM4 block cipher algorithm using the SM3 national cryptographic hash algorithm. The SM4 block cipher algorithm is then used to encrypt the original data to obtain the ciphertext. C .

[0033] S22. The data owner formulates an access control policy and, using system public parameters and the access control policy, encapsulates and encrypts the symmetric content key (CEK) using an attribute-based encryption algorithm to generate a ciphertext header. The specific steps are as follows: S221. User-specified access policy, generating an access control matrix via Monotonous Span Programs (MSPs). as well as Monotonic Span Program (MSP) is a linear algebraic structure for secret sharing that enables monotonic access, meaning that if a set satisfies a condition, its supersets also satisfy the condition. It determines whether a participant can recover the secret by using linear dependence in the vector space.

[0034] S222, Random selection The ciphertext header is calculated and generated. The specific calculation process is as follows: ; For each The calculation formula is as follows: ; For access control matrix Each line in The calculation formula is as follows: ; , ; ; The final ciphertext header is obtained using the following formula: ; in, For random number based The generated ciphertext randomization component, For the corresponding index The ciphertext auxiliary randomization component, For the access control matrix corresponding to the first The attribute ciphertext component of the line, Ciphertext components used to assist in decryption calculations, This is the key for the encapsulated symmetric content. v To construct the random vector used in the Monotonic Span Program (MSP), T This is the transpose operation of a matrix. Indicates that when the condition is met and Under the conditions, The number of attributes In the Each position and the number of times it has appeared before it; It is all corresponding The maximum value in the matrix represents the maximum value in the matrix. The maximum number of times a certain attribute is used.

[0035] S23, The data owner will encrypt the header. CT Embedded in the data index file, and the encrypted data sliced C Upload to cloud storage or a content delivery network (CDN).

[0036] S3, User-side decryption and access.

[0037] After downloading the encrypted data packet, the data user terminal parses the ciphertext header. If the user's attribute set satisfies the access control policy embedded in the ciphertext, the terminal performs a bilinear pairing operation with the ciphertext components using its attribute private key. During this process, a specific group operation structure is used to match and eliminate the attribute portion of the private key with the ciphertext policy portion, recovering the intermediate decryption parameters, and then decrypting to obtain the symmetric content key CEK. Finally, the CEK is used to decrypt the data slice and perform operations. The specific steps are as follows: S31. If the data user's attributes The data owner has specified access control policies. Then it exists Make .

[0038] The intermediate parameters can be reconstructed through the following calculations. : ; S32, Obtain intermediate parameters Afterwards, a simple calculation can be performed to obtain the symmetric content key. At this time The HKDF key derivation function is executed to generate the symmetric content key for the SM4 block cipher algorithm using the SM3 national cryptographic hash algorithm. The original data can then be obtained by performing the SM4 block cipher decryption algorithm.

[0039] Among them, due to the deterministic nature of the SM3 national cryptographic hash algorithm—that is, the same input will always produce the same hash value—for correct decryption... It will generate the same key as the one used for encryption for decryption.

[0040] S4. Blockchain-based tracking and accountability for malicious users.

[0041] When the system detects a leaked illegal private key or a misused decryption device on the internet, it initiates an on-chain tracing process, as follows: S41. Evidence Submission: The auditor extracts the suspected leaked private key data, constructs it into a tracking transaction request, and submits it to the blockchain network.

[0042] S42. Smart Contract Verification: The blockchain node runs the pre-deployed audit smart contract. First, it uses the system's public parameters to verify the validity of the submitted private key (Sanity Check). Then, it uses the algebraic properties of bilinear pairs to determine whether the private key was issued by a legitimate KGC.

[0043] When a user's private key is suspected of being leaked, this private key is accessed via... The specific steps for verifying the algorithm are as follows: S421. The key generation center collects suspected keys, and the calculation formula is as follows: ; ; ; S422. Finally, the following judgment is made: ; If the equation is true, it means the key is valid.

[0044] S43. Identity Recovery and Evidence Preservation: After successful verification, the smart contract automatically executes the identity recovery algorithm, which calculates and restores the original user identity identifier ID bound to the private key based on the homomorphic encrypted component hidden in the private key.

[0045] Once the verification is successful, the private key is decrypted to find the data user corresponding to this private key, as follows; The key generation center collects suspected keys and performs the following operations using the system's master private key: Define function Calculate them separately, using the following formulas: ; ; in: ; ; The Chinese Remainder Theorem (CRT) is used for merging, and the formula is as follows: ; ; Get key binding Accountability should be enforced for data users.

[0046] S44. Results on the blockchain: The final traceable user ID and the hash value of the tracking process are written into the blockchain block as an immutable legal evidence.

[0047] Therefore, this invention proposes an accountable attribute-based encrypted data sharing method based on blockchain evidence storage, which effectively solves the core defects of existing attribute-based encryption in large-scale data distribution and resource-constrained terminal scenarios, such as high computational overhead, high decryption latency, and difficulty in tracing the source after key leakage.

[0048] In terms of efficiency, this invention employs a hybrid architecture of "high-efficiency symmetric encryption + ABE key encapsulation," and processes the complex bilinear pairing operations through group structure optimization and polynomial function simplification techniques, requiring only a minimal number of pairing operations during terminal decryption. This design significantly reduces the local computing burden, making it particularly suitable for high-real-time, large-data-volume access scenarios such as high-definition streaming media and large-scale medical imaging, ensuring rapid data decryption and a smooth user experience.

[0049] Meanwhile, in terms of security, this invention introduces blockchain and smart contract technologies to reconstruct an accountability mechanism. By storing user attribute credentials and key distribution records on the blockchain, it enables data owners to exercise fine-grained autonomy over content through "ciphertext embedding access strategies and private key binding attribute sets." Furthermore, in the event of abuse of permissions (such as private key leakage or illegal data dissemination), the on-chain smart contract automatically executes an identity recovery algorithm, achieving decentralized, tamper-proof, and precise tracing of violating users. This completely solves the key shortcomings of traditional ABE algorithms, which "only control permissions, not trace accountability" and rely on the credit endorsement of centralized institutions.

[0050] S5. Experimental verification.

[0051] S51. Experimental environment and parameter settings.

[0052] To evaluate the actual performance of the proposed solution, we conducted a complete algorithm implementation and benchmark tests in a simulated data distribution environment. The experimental hardware environment consisted of an Intel Core i5-125H processor (allocated 4 vCPUs, 8GB of memory) and an Ubuntu 24.04 LTS operating system.

[0053] The algorithm is implemented using the Python language, and the encryption library uses the charm-crypto framework. Both this algorithm and the comparison scheme (BSW07 CP-ABE) are based on the BLS12-381 asymmetric bilinear pairing curve.

[0054] S52, Comparative Analysis of Encryption and Decryption Efficiency.

[0055] We increased the number of attribute sets from 10 to 50 and tested the average time for each stage (running 200 times and taking the average).

[0056] S521, System Setup and Key Generation (SetUp & KeyGen).

[0057] Experimental results are as follows Figure 3 and Figure 4 As shown, due to the introduction of traceability support in this solution, the setup phase takes approximately 117.05ms, slightly longer than the BSW07 solution. However, system setup is a one-time operation and does not affect the user's subsequent real-time interactive experience. In the KeyGen phase, as the number of attributes increases, the time taken by both solutions increases linearly, but the time cost of this solution remains in the millisecond range, which is within an acceptable range.

[0058] S522, Data Encryption.

[0059] like Figure 5As shown, encryption time is directly proportional to the complexity of the access strategy (number of attributes). This scheme adopts a hybrid encryption architecture, that is, only ABE is used to encrypt the short SM4 symmetric key, while the data body is encrypted using SM4. Experiments show that regardless of the size of the video file, the encryption time of the ABE part depends only on the strategy complexity, and is usually around 42ms (10 attributes), effectively avoiding the performance bottleneck caused by directly using ABE to encrypt large files.

[0060] S523, Data Decryption.

[0061] The core advantages of this invention are as follows: Figure 6 As shown, this is the part where the gap between this solution and existing technologies is most significant.

[0062] The BSW07 solution exhibits a significant linear increase in decryption time as the number of attributes in the strategy increases. When the number of attributes reaches 50, the decryption time reaches as high as 1448.05ms, which can cause noticeable latency on mobile devices.

[0063] This invention benefits from an algorithm design that reduces the number of bilinear pairings, requiring the user terminal to perform only a minimal number of exponential operations. Experimental data shows that regardless of the complexity of the attribute strategy, the local decryption time remains constant (approximately 58.47 ms).

[0064] S53. Conclusion.

[0065] Compared to BSW07, this invention improves decryption efficiency on the user side by approximately 4.5 times (10 attributes), greatly reducing the computational burden on terminal devices and ensuring a smooth user experience.

[0066] This invention also provides a system for an accountable attribute-based encrypted data sharing method based on blockchain notarization, comprising: The key generation module is used to initialize system parameters and generate attribute private keys for embedded homomorphic identity credentials based on user attributes and identity identifiers, while storing the credentials on the blockchain. The data encryption and publishing module is used to generate symmetric key encryption data, encapsulate the symmetric key using attribute-based encryption algorithms and access policies, and publish the ciphertext to the storage network. The user decryption module is used to verify whether user attributes meet the policy and to obtain the symmetric key through the attribute private key to access the data. The blockchain audit trail module is used to deploy smart contracts, receive leaked private keys, and automatically execute private key validity verification and identity recovery algorithms on the chain to achieve decentralized tracing of malicious users.

[0067] The smart contract in the blockchain audit trail module is configured as follows: Identity recovery calculations are performed under the witness of all network nodes. The calculation process does not rely on the intervention of the private key of a centralized institution, and the user's identity can be restored using only public parameters and leaked private keys.

[0068] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method of the present invention as described in any one of claims 1 to 5.

[0069] The present invention also provides a computer-readable storage medium having a computer program stored thereon, characterized in that the program, when executed by a processor, implements the method as described in any one of claims 1 to 5.

[0070] Therefore, this invention employs the aforementioned blockchain-based, accountable attribute-based encrypted data sharing method and system. By optimizing the encryption group structure and hybrid encryption mechanism, it overcomes terminal performance bottlenecks and utilizes the distributed ledger characteristics of blockchain to record key distribution and trace evidence. This ensures fine-grained data access control while achieving decentralized, tamper-proof malicious user tracing. It significantly reduces terminal computational overhead and solves the problem of difficulty in obtaining evidence and assigning responsibility after key leakage in traditional solutions.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for accountable attribute-based encryption data sharing based on blockchain storage, characterized in that, Includes the following steps: S1. System initialization and key generation: The key generation center generates attribute private keys based on user attributes and identity identifiers, combined with homomorphic encryption algorithms, and stores the identity credentials on the blockchain; S2. Data Content Encryption and Distribution: The data owner uses a hybrid architecture combining symmetric encryption and attribute-based encryption to encapsulate and distribute the data and keys. S3. User-side decryption and access: The user-side parses the ciphertext header, uses the attribute private key to match and eliminate the ciphertext components, recovers the decryption intermediate parameters, obtains the symmetric content key, and then decrypts the data slice. S4. Blockchain-based tracking and accountability for malicious users: By automatically verifying the validity of private keys and executing identity recovery algorithms through blockchain smart contracts, decentralized tracing of malicious users can be achieved. 2.The blockchain-based accountable attribute-based encryption data sharing method of claim 1, wherein, The specific steps of S1 are as follows: S11. The key generation center constructs a bilinear mapping group environment based on prime order to generate system public parameters and master private key; S12. The key generation center generates an attribute private key based on the attribute set and identity identifier submitted by the user, combined with a homomorphic encryption algorithm. The attribute private key contains the user's identity certificate. The attribute private key is distributed to the user and the identity certificate is stored on the blockchain. 3.The blockchain-based accountable attribute-based encryption data sharing method of claim 2, wherein, The specific steps of S12 are as follows: S121, the key generation center randomly selects a random number , the user identity is encrypted by using a Paillier homomorphic encryption algorithm to generate a user certificate The calculation formula is:​ ； The specific calculation is as follows: ； in, The homomorphic ciphertext (i.e., user proof) generated after encrypting the user's identity. n The modulus of the public key for the Paillier encryption algorithm. Common parameters generated for system initialization r The random number randomly selected by the key generation center To encrypt random numbers, mod Modulo operation; S122, Based on the system master private key and user proof Calculate and generate user attribute private keys sk , sk Specifically, it includes: ； ； ； ； in, sk 1 is the master key component containing the system master private key and user identity credentials. sk 2 is a key randomization component based on random number generation. sk 3 corresponds to specific user attributes The attribute key component, sk 4 is a homomorphic identity credential component used for tracking malicious users. For group generators, For hash functions, This is the size of the complete set of system attributes. For specific user attributes.

4. The method for sharing accountable attribute-based encrypted data with blockchain-based evidence storage according to claim 1, characterized in that, The specific steps of S2 are as follows: S21. The data owner generates a symmetric content key and uses the symmetric content key to symmetrically encrypt the data slice; S22. Using system public parameters and access control policies, the symmetric content key is encapsulated and encrypted using an attribute-based encryption algorithm to generate a ciphertext header. S23. Publish the encrypted data along with the ciphertext header.

5. The method for sharing accountable attribute-based encrypted data with blockchain-based evidence storage according to claim 4, characterized in that, S22 uses the Monotonic Span Program (MSP) to generate the access control matrix. And select a random vector to calculate and generate the ciphertext header, which includes: ； ； ； ； ； in, For random number based The generated ciphertext randomization component, For the corresponding index The ciphertext auxiliary randomization component, For the access control matrix corresponding to the first The attribute ciphertext component of the line, Ciphertext components used to assist in decryption calculations, This is the key for the encapsulated symmetric content. v To construct a random vector for a monotonic span program MSP, T This is the transpose operation of a matrix. For the access matrix OK, For the attribute corresponding to this row, For attributes In the Each position and the number of times it has appeared before it This is the mask calculated using the system's master public key.

6. The method for sharing accountable attribute-based encrypted data based on blockchain evidence storage according to claim 1, characterized in that, The specific steps for obtaining the symmetric content key in S3 are as follows: S31. If the user attribute set satisfies the access control policy, does a coefficient exist? Make The user terminal reconstructs intermediate parameters through bilinear pairing operations. d The specific formula for bilinear pairing operations is as follows: ； in, e For bilinear pairing operations, To satisfy the set of matrix row indices corresponding to the attributes of the access control policy, For all corresponding The maximum value in the matrix represents the maximum value in the matrix. The maximum number of times a certain attribute is used; S32. Calculate the symmetric content key. The specific calculation formula is as follows: ； in, CEK It is a symmetric content key.

7. The method for sharing accountable attribute-based encrypted data based on blockchain evidence storage according to claim 1, characterized in that, The specific steps of S4 are as follows: S41. When a leaked private key is detected, the auditor extracts the private key and submits it to the blockchain network. S42. The blockchain node runs a smart contract to verify the validity of the private key. After successful verification, it executes an identity recovery algorithm to restore the original user identity identifier bound to the private key and store it on the blockchain.

8. The method for sharing accountable attribute-based encrypted data based on blockchain evidence storage according to claim 7, characterized in that, The specific steps of S42 are as follows: S421: The smart contract receives a suspected leaked private key and verifies its validity using system public parameters and the algebraic properties of bilinear pairings. The calculation formula is as follows: ； ； ； in, k These are intermediate parameters for bilinear pairing operations generated by the smart contract during the private key validity verification process. S422: Determine whether the following equation is true: ； If the equation holds true, the smart contract is based on the private key component. By using the Chinese Remainder Theorem (CRT) and preset parameters, the influence of random numbers is removed, and the user identity identifier bound to the private key is restored. ; S423: Restore the user The hash value of the tracking process is written into the blockchain block.

9. A system applying the accountability attribute-based encrypted data sharing method based on blockchain evidence storage as described in any one of claims 1-8, characterized in that, include: The key generation module is used to initialize system parameters and generate attribute private keys for embedded homomorphic identity credentials based on user attributes and identity identifiers, while storing the credentials on the blockchain. The data encryption and publishing module is used to generate symmetric key encryption data, encapsulate the symmetric key using attribute-based encryption algorithms and access policies, and publish the ciphertext to the storage network. The user decryption module is used to verify whether user attributes meet the policy and to obtain the symmetric key through the attribute private key to access the data; The blockchain audit trail module is used to deploy smart contracts, receive leaked private keys, and automatically execute private key validity verification and identity recovery algorithms on the chain to achieve decentralized tracing of malicious users.

10. The system of the blockchain-based accountable attribute-based encrypted data sharing method according to claim 9, characterized in that, The smart contract performs identity recovery calculations under the witness of all nodes on the network. The calculation process does not rely on the private key intervention of a centralized institution, but only uses public parameters and leaked private keys to restore the user's identity.

Images