Government affair data trusted shared signature method and system based on block chain

Abstract

The invention discloses a block chain-based government affair data trusted shared signature method and system, and aims to solve the problems of easy leakage of identity privacy in an authorization process, opaque cross-department verification, difficulty in tracing and credibility in a data circulation process and the like in existing government affair data sharing. The method comprises the following steps: firstly, constructing a government affair data trusted sharing alliance chain network, and registering distributed identities by participants; the data owner encrypts and links the private data and issues a directory; when a data user applies for use, a data owner generates a ring signature of a specified verifier based on a lattice password as an authorization certificate for uplink, and the signature can hide the identity of a real signer and can only be verified by a specified authorization verification node; the verification node automatically verifies the signature validity and the authorization strategy through the smart contract; and after the verification is passed, the encrypted data or the processing result is securely transmitted in an'available and invisible 'mode. According to the method, the identity privacy of the authorizer is protected through the ring signature, authorization controllability is realized through a specified verifier mechanism, whole-course traceability is realized in combination with the block chain, and the credibility, the security and the compliance of cross-department government affair data sharing are improved on the premise of ensuring the data privacy.

Description

Technical Field

[0001] This invention belongs to the fields of blockchain technology, government data sharing and privacy protection technology, and specifically relates to a blockchain-based trusted sharing signature method and system for government data, which is applicable to cross-departmental and cross-regional scenarios for secure sharing and authorized use of government privacy data. Background Technology

[0002] Traditional data sharing models often rely on centralized data exchange platforms, which pose risks such as single points of failure, data misuse, and privacy leaks. Furthermore, they lack effective identity verification and authorization traceability mechanisms, making it difficult to build a trust system involving multiple parties.

[0003] Blockchain technology, with its decentralized, immutable, and traceable characteristics, provides a new technological path for the trusted sharing of government data. Existing blockchain solutions for government data mostly focus on on-chain data storage, attribute encryption, and simple access control, but they still have shortcomings in supporting flexible authorization, multi-party collaborative signatures, and privacy-verifiable computation. Especially in scenarios involving cross-departmental and cross-chain data transfer, how to achieve controllable authorization by data owners, protection of signature identity privacy, and verification by designated recipients remain pressing technical problems that need to be solved.

[0004] To address this, this invention proposes a ring signature scheme based on lattice cryptography with a designated verifier, and combines it with blockchain to build a trusted data sharing system for government affairs, thereby achieving a secure data sharing mode that is "usable but invisible, controllable and traceable". Summary of the Invention

[0005] To address the shortcomings of the aforementioned background technologies, the purpose of this invention is to provide a blockchain-based trusted sharing signature method and system for government data. By introducing a ring signature mechanism based on lattice cryptography with a designated verifier, the invention achieves identity anonymity, controllable authorization, designated verification, and full traceability of government data during cross-chain and cross-departmental sharing, thereby enhancing the security and trustworthiness of data sharing.

[0006] The technical solution of this invention is implemented as follows: A blockchain-based trusted signing method for government data sharing includes the following steps: S1. Construct a trusted sharing alliance chain network for government data. Participants include government agency nodes, data owner nodes, data user nodes, and authorized verification nodes. Each node registers a distributed identity and obtains a digital certificate on the alliance chain network. S2. The data owner node encrypts the government privacy data, generates a data fingerprint, stores it on the blockchain, and publishes the data resource catalog to the blockchain. S3. The data user node initiates a data usage authorization request to the data owner node; S4. The data owner node responds to the authorization request, constructs a ring signature for the designated verifier based on lattice cryptography, generates an authorization certificate, and stores the authorization certificate on the blockchain; wherein, the ring members of the ring signature include the public key of the data owner node and the public keys of one or more other entities, in order to conceal the identity of the actual signer. S5. The authorized verification node calls the smart contract deployed on the blockchain to verify the validity of the ring signature of the specified verifier in the authorization certificate, and to verify the scope and validity of the authorization. S6. Once the authorization verification is successful, the authorized government privacy data or its calculation results will be securely transmitted to the data user node, and the key information of the entire sharing process will be recorded on the blockchain.

[0007] Preferably, the process of constructing a ring signature for a designated verifier based on lattice cipher in step S4 includes system initialization, key generation, ring signature generation, designated verification, and signature simulation, as follows: S4.1 The system initialization is as follows: The key generation center sets parameters , , Gaussian parameters ,in Represents the space of integer matrices. The column vector dimension of an integer matrix. Represents the row vector dimension of an integer matrix. Represents the order of an integer matrix. Indicates the length limit of the vertical lattice base; Randomly select a series of grids and its corresponding vertical grid Medium linearly independent short vector lattice ,in ; , The number of signers in the ring. Represents a randomly selected lattice basis. Represents an unknown vector; Set hash function , ; Set master and private keys Publish public parameters .

[0008] S4.2 The key generation is as follows: The key generation center uses the user's identity. ,calculate ; calculate , so that satisfaction ,in , It is a Gaussian sampling algorithm; Output As a ring user public key, It is returned to each ring user as the ring user's private key.

[0009] S4.3 The ring signature generation is as follows: Ring user computing ; Randomly select vector parameters ; calculate ,in This is a message awaiting signature; calculate ; Using designated validators public key ,calculate ,in ; Output ring signature .

[0010] S4.4 The specified verification is as follows: Only pre-designated authorized verification nodes Using their private key The validity of the ring signature can be verified; non-designated verifiers cannot complete valid verification. Specifically: The signature verifier verifies that when... ,and If the signature is accepted, it will be accepted; otherwise, it will be rejected.

[0011] S4.5 The signature simulation is as follows: The designated authorization verification node calculate ; Randomly select vector parameters ; calculate ,in This is a message awaiting signature; calculate ; Using signer public key ,calculate ,in ; Output the simulated ring signature .

[0012] Preferably, the authorized verification node is a government data sharing management center node or a specific government agency node designated by a smart contract.

[0013] Preferably, the blockchain-based trusted sharing system for government data includes: The consortium blockchain network module is used to build and maintain a consortium blockchain for sharing government data with multiple parties, providing a distributed ledger, consensus mechanism and smart contract runtime environment; The identity and permission management module is used to manage the distributed digital identities, digital certificates, and role and permission information of each participating node; The data resource management module is used by data owner nodes to encrypt government privacy data, generate fingerprints, store evidence on the blockchain, and publish resource catalogs. The designated verifier ring signature module integrates a lattice-based designated verifier ring signature algorithm for generating authorization credentials, verifying signatures, and simulating signatures. The authorization verification smart contract module, deployed on the blockchain, is used to automatically execute the verification logic of authorization credentials, including signature validity verification and authorization policy compliance check. The secure transmission and auditing module is used to securely transmit data or calculation results after authorization and verification, and write the operation records of the entire data sharing process into the blockchain as an immutable audit log.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: 1) By introducing a ring signature based on lattice cryptography with a designated verifier, the privacy of the signer's identity is protected during the authorization process of government data, preventing the leakage of authorization relationships. At the same time, it ensures that only designated verification nodes can verify the validity of the authorization, thereby enhancing the controllability and security of the system.

[0015] 2) By combining blockchain technology, a decentralized, multi-party consensus-based trust foundation for government data sharing has been built, realizing on-chain evidence storage for the entire process of data ownership confirmation, authorization, use, and auditing, thus preventing data abuse and tampering.

[0016] 3) Supports a "data available but not visible" sharing mode. Privacy data remains encrypted during transmission and processing, and only calculation results within the authorized scope are output, effectively protecting sensitive personal and institutional information.

[0017] 4) The system has high scalability and cross-chain interoperability, which can adapt to the data sharing needs of multiple levels of government departments and multiple blockchain platforms, and promote the secure integration and value release of government data resources. Attached Figure Description

[0018] Figure 1 A flowchart of the trusted sharing signature method for government data provided in this embodiment of the invention; Figure 2 A schematic diagram of the designated verifier ring signature generation and verification process based on lattice cipher provided in an embodiment of the present invention; Figure 3 This is a diagram illustrating the architecture of a trusted government data sharing system provided in an embodiment of the present invention. Figure 4 The flowchart for the execution of the authorization verification smart contract is provided for an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] To make the objectives, technical solutions, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0021] Example 1: like Figure 1 As shown, the trusted sharing signature method for government data in this embodiment specifically includes the following steps: Step S1: Initialization of the government data sharing consortium blockchain. Multiple government departments, data owners (such as citizens and enterprises), and data users (such as banks and hospitals) jointly establish a consortium blockchain network. Each node completes distributed identity registration and obtains a digital certificate.

[0022] Step S2: Data resource on-chain notarization. The data owner encrypts government privacy data (such as identity information, social security records, corporate credit information, etc.), generates data fingerprints, and stores them on the blockchain for notarization. At the same time, the data catalog is published to the on-chain resource library.

[0023] Step S3: The data user initiates an authorization request. The data user queries the data catalog through the blockchain and sends a data usage application to the data owner, specifying the purpose, scope, and duration of the use.

[0024] Step S4: The data owner generates a ring signature for a designated validator. The data owner selects multiple public keys, including their own, to form a ring. They then use a lattice-based ring signature algorithm to sign the authorization information, hiding their true identity within the signature. This signature is then uploaded to the blockchain as an authorization credential.

[0025] Step S5: Authorized verification node verifies signature. The authorized verification node (such as the government data sharing center) calls the smart contract, uses the designated verifier's private key to verify the validity of the ring signature, and checks the scope and validity of the authorization.

[0026] Step S6: Secure Data Transmission and Processing. After successful verification, the data owner or relevant government agency will send the encrypted data or privacy-preserving computation results to the data user through a secure channel. The data user can then decrypt the data locally or use the processing results directly.

[0027] All the above operations are recorded on the blockchain, forming a trusted audit log that supports authorized traceability and behavior supervision.

[0028] Example 2: like Figure 2 As shown, the designated verifier ring signature process based on lattice ciphers includes system initialization, key generation, ring signature generation, designated verification, and signature simulation: S4.1 The system initialization is as follows: The key generation center sets parameters , , Gaussian parameters ,in Represents the space of integer matrices. The column vector dimension of an integer matrix. Represents the row vector dimension of an integer matrix. Represents the order of an integer matrix. Indicates the length limit of the vertical lattice base; Randomly select a series of grids and its corresponding vertical grid Medium linearly independent short vector lattice ,in ; , The number of signers in the ring. Represents a randomly selected lattice basis. Represents an unknown vector; Set hash function , ; Set master and private keys Publish public parameters .

[0029] S4.2 The key generation is as follows: The key generation center uses the user's identity. ,calculate ; calculate , so that satisfaction ,in , It is a Gaussian sampling algorithm; Output As a ring user public key, It is returned to each ring user as the ring user's private key.

[0030] S4.3 The ring signature generation is as follows: The data owner node selects a set of public keys, including its own public key, to form a ring. Using its own private key and other public keys in the ring, it generates a ring signature through lattice operations, making it impossible for verifiers to distinguish the specific signer within the ring. Specifically: Ring user computing ; Randomly select vector parameters ; calculate ,in This is a message awaiting signature; calculate ; Using designated validators public key ,calculate ,in ; Output ring signature .

[0031] S4.4 The specified verification is as follows: Only pre-designated authorized verification nodes Using their private key The validity of the ring signature can be verified; non-designated verifiers cannot complete valid verification. Specifically: The signature verifier verifies that when... ,and If the signature is accepted, it will be accepted; otherwise, it will be rejected.

[0032] S4.5 The signature simulation is as follows: The authorized verification node can use its own private key to generate a simulated signature that is computationally indistinguishable from the real ring signature generated by the data owner node. Specifically: The designated authorization verification node calculate ; Randomly select vector parameters ; calculate ,in This is a message awaiting signature; calculate ; Using signer public key ,calculate ,in ; Output the simulated ring signature .

[0033] Example 3: like Figure 3 As shown, the trusted government data sharing system includes modules such as a consortium blockchain network, identity management, data resource management, ring signature engine, smart contracts, secure transmission and audit traceability. These modules work together to achieve trusted and controllable data sharing throughout the entire process.

[0034] The consortium blockchain network module provides a distributed ledger, consensus mechanism, and peer-to-peer network as a trusted underlying infrastructure for multi-party collaboration, ensuring that data and operation records are tamper-proof and fully traceable.

[0035] The identity and access control module issues verifiable digital identities and certificates to each participant based on the distributed identity standard, and manages fine-grained data access permission policies to achieve precise identity authentication and authorization control.

[0036] The data resource management module supports data owners in encrypting government privacy data, generating fingerprints, and storing them on the blockchain. It also publishes a standardized data catalog to achieve the confirmation and reliable publication of data ownership.

[0037] The designated verifier ring signature engine module integrates a lattice-based ring signature algorithm to generate, verify, and simulate authorized signatures, ensuring that only the designated verifier can verify the validity while concealing the identity of the signer.

[0038] The authorization verification smart contract module automatically executes the authorization verification logic in the form of on-chain code, including calling the signature verification algorithm and checking the compliance of business strategies, to ensure the decentralization and immutability of the adjudication process.

[0039] The secure transmission and audit traceability module is responsible for the secure transmission of encrypted data or calculation results, and records all key operations in the process as tamper-proof audit logs on the blockchain, providing a complete chain of evidence for compliance review and post-event traceability.

[0040] Example 4: like Figure 4 As shown, the authorization verification smart contract execution process includes steps such as receiving authorization requests, extracting ring signatures, calling verification algorithms, checking policy compliance, and returning verification results. All of these steps are automatically executed by on-chain code, ensuring fairness and transparency.

[0041] The process involves receiving authorization requests and credentials. The smart contract receives a transaction request containing a ring signature and authorization information, and automatically triggers the verification process.

[0042] The process involves parsing and extracting the ring signature, separating the ring signature, the message to be verified, and metadata from the authorization certificate, and preparing input for subsequent verification.

[0043] The ring signature verification algorithm is invoked, using the specified verifier's private key parameter, and the grid cryptography verification algorithm is run to determine whether the signature was generated by a valid ring member.

[0044] The compliance of the business strategy is checked by comparing the fields such as purpose, scope, and time limit in the authorization request with the preset on-chain strategy to ensure compliance.

[0045] The verification results are generated and returned. Based on the combined verification results, a "pass / reject" conclusion is generated and recorded on the blockchain, completing this automated verification.

[0046] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A blockchain-based trusted sharing signature method for government data, characterized in that, Includes the following steps: S1. Construct a trusted sharing alliance chain network for government data. Participants include government agency nodes, data owner nodes, data user nodes, and authorized verification nodes. Each node registers a distributed identity and obtains a digital certificate on the alliance chain network. S2. The data owner node encrypts the government privacy data, generates a data fingerprint, stores it on the blockchain, and publishes the data resource catalog to the blockchain. S3. The data user node initiates a data usage authorization request to the data owner node; S4. The data owner node responds to the authorization request, constructs a ring signature for the designated verifier based on lattice cryptography, generates an authorization certificate, and stores the authorization certificate on the blockchain; wherein, the ring members of the ring signature include the public key of the data owner node and the public keys of one or more other entities, in order to conceal the identity of the actual signer. S5. The authorized verification node calls the smart contract deployed on the blockchain to verify the validity of the ring signature of the specified verifier in the authorization certificate, and to verify the scope and validity of the authorization. S6. Once the authorization verification is successful, the authorized government privacy data or its calculation results will be securely transmitted to the data user node, and the key information of the entire sharing process will be recorded on the blockchain.

2. The method according to claim 1, characterized in that, The process of constructing a ring signature for a designated verifier based on lattice cipher in step S4 includes system initialization, key generation, ring signature generation, designated verification, and signature simulation, as detailed below: S4.1 The system initialization is as follows: The key generation center sets parameters , , Gaussian parameters ,in Represents the space of integer matrices. The column vector dimension of an integer matrix. Represents the row vector dimension of an integer matrix. Represents the order of an integer matrix. Indicates the length limit of the vertical lattice base; Randomly select a series of grids and its corresponding vertical grid Medium linearly independent short vector lattice ,in ; , The number of signers in the ring. Represents a randomly selected lattice basis. Represents an unknown vector; Set hash function , ; Set master and private keys Publish public parameters . S4.2 The key generation is as follows: The key generation center uses the user's identity. ,calculate ; calculate , so that satisfaction ,in , It is a Gaussian sampling algorithm; Output As a ring user public key, It is returned to each ring user as the ring user's private key. S4.3 The ring signature generation is as follows: Ring user computing ; Randomly select vector parameters ; calculate ,in This is a message awaiting signature; calculate ; Using designated validators public key ,calculate ,in ; Output ring signature . S4.4 The specified verification is as follows: Only pre-designated authorized verification nodes Using their private key The validity of the ring signature can be verified; non-designated verifiers cannot complete valid verification. Specifically: The signature verifier verifies that when... ,and If the signature is accepted, it will be accepted; otherwise, it will be rejected. S4.5 The signature simulation is as follows: The designated authorization verification node calculate ; Randomly select vector parameters ; calculate ,in This is a message awaiting signature; calculate ; Using signer public key ,calculate ,in ; Output the simulated ring signature .

3. The method according to claim 1, characterized in that, The authorized verification node is either the government data sharing management center node or a specific government agency node designated by the smart contract.

4. A blockchain-based trusted data sharing system for government affairs, characterized in that, include: The consortium blockchain network module is used to build and maintain a consortium blockchain for sharing government data with multiple parties, providing a distributed ledger, consensus mechanism and smart contract runtime environment; The identity and permission management module is used to manage the distributed digital identities, digital certificates, and role and permission information of each participating node; The data resource management module is used by data owner nodes to encrypt government privacy data, generate fingerprints, store evidence on the blockchain, and publish resource catalogs. The designated verifier ring signature module integrates a lattice-based designated verifier ring signature algorithm for generating authorization credentials, verifying signatures, and simulating signatures. The authorization verification smart contract module, deployed on the blockchain, is used to automatically execute the verification logic of authorization credentials, including signature validity verification and authorization policy compliance check. The secure transmission and auditing module is used to securely transmit data or calculation results after authorization and verification, and write the operation records of the entire data sharing process into the blockchain as an immutable audit log.

Images