A method and device for detecting security of oil and gas data

Abstract

The application discloses an oil and gas data integrity detection method and device, comprising the following steps: an audit device generates challenge information according to public parameters set by a private key generator, and sends the challenge information to an oil and gas industry cloud server; the oil and gas industry cloud server generates integrity detection proof information according to the challenge information, a ciphertext data block set and a signature set, and sends the integrity detection proof information to the audit device; the audit device precomputes intermediate parameters according to the challenge information and integrity auxiliary verification information in a block chain, and detects the integrity of oil and gas data according to the integrity detection proof information and the intermediate parameters. The audit device can detect the integrity of oil and gas data by comparing the integrity detection proof information fed back by the cloud server with the intermediate parameters obtained by precomputing based on the integrity auxiliary verification information in the block chain, so that the integrity of oil and gas data in the cloud server can be accurately obtained, and the safety of the oil and gas data is ensured.

Description

Technical Field

[0001] This invention relates to the field of oil and gas safe storage technology, and in particular to a method and apparatus for detecting the safety of oil and gas data. Background Technology

[0002] In a smart oil and gas industrial IoT system, smart oil and gas sensors are distributed across various areas to achieve real-time acquisition and monitoring of sensitive oil and gas data. However, this sensitive oil and gas data requires substantial storage and computing resources to ensure real-time processing and analysis, thereby optimizing the entire production process and improving oil and gas production efficiency and recovery rates. Therefore, cloud servers with powerful computing and storage capabilities are integrated into the smart oil and gas industrial IoT system.

[0003] While cloud storage systems for the oil and gas industry offer significant benefits for maintaining industry data, security and privacy issues also arise. In particular, as outsourced oil and gas industry data serves as the foundation for precise control of oil and gas processes, it often contains sensitive information. Therefore, ensuring the confidentiality and integrity of oil and gas data is of paramount importance.

[0004] However, current cloud server data outsourcing storage services deprive users of physical control over their data, inevitably causing them to worry about the integrity and availability of this outsourced data. Furthermore, due to economic interests or other reasons, oil and gas industry cloud servers may accidentally tamper with or lose oil and gas industry data, potentially causing irreparable safety accidents or even endangering lives during critical oil and gas production processes. Therefore, establishing a robust data integrity verification mechanism for oil and gas industry cloud storage to ensure the integrity of outsourced oil and gas industry cloud data is both urgent and necessary. Summary of the Invention

[0005] This invention provides a method for detecting the integrity of oil and gas data, so as to perform accurate integrity detection of oil and gas data.

[0006] According to a first aspect of the present invention, a method for detecting the integrity of oil and gas data is provided, applied to an integrity detection system, the integrity detection system comprising a private key generator, a user terminal, an oil and gas industry cloud server, auditing equipment, and a blockchain, the method comprising:

[0007] The user terminal sends the set of encrypted data blocks and the set of signatures corresponding to the oil and gas data to the oil and gas industry cloud server, and sends the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain. The integrity auxiliary verification information includes the anonymous identity of the user terminal and the set of identifiers corresponding to the set of encrypted data blocks.

[0008] When the auditing device receives an integrity detection task request sent by the user terminal at a specified time, it generates challenge information according to the public parameters set by the private key generator and sends the challenge information to the oil and gas industry cloud server.

[0009] The oil and gas industry cloud server generates integrity detection proof information based on the challenge information, the set of encrypted data blocks, and the set of signatures, and sends the integrity detection proof information to the auditing device.

[0010] The auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, and then detects the integrity of the oil and gas data based on the integrity detection proof information and the intermediate parameters.

[0011] According to another aspect of the present invention, an oil and gas data integrity detection device is provided, comprising: a data upload module, configured to send a set of encrypted data blocks and a set of signatures corresponding to the oil and gas data to the oil and gas industry cloud server, and send integrity auxiliary verification information corresponding to the oil and gas data to the blockchain, wherein the integrity auxiliary verification information includes the anonymous identity of the user terminal and a set of identifiers corresponding to the set of encrypted data blocks;

[0012] The challenge information generation module is used to generate challenge information according to the public parameters set by the private key generator when the auditing device receives an integrity detection task request sent by the user terminal at a specified time, and send the challenge information to the oil and gas industry cloud server.

[0013] The integrity verification certificate information generation module is used by the oil and gas industry cloud server to generate integrity verification certificate information based on the challenge information, the encrypted data block set, and the signature set, and send the integrity verification certificate information to the auditing device.

[0014] The integrity detection module is used by the auditing device to pre-calculate intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, and to detect the integrity of the oil and gas data based on the integrity detection proof information and the intermediate parameters.

[0015] In the technical solution of this invention, when the user terminal uploads encrypted oil and gas data to the cloud server, it also sends the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain. Therefore, when the auditing device performs oil and gas data integrity detection, it can use the integrity detection proof information fed back by the cloud server and the intermediate parameters obtained by pre-calculation based on the integrity auxiliary verification information in the blockchain to accurately obtain the integrity status of the oil and gas data in the cloud server, thereby ensuring the security of the oil and gas data.

[0016] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a method for detecting the safety of oil and gas data according to Embodiment 1 of the present invention;

[0019] Figure 2 This is a schematic diagram of the integrity detection system provided in Embodiment 1 of the present invention;

[0020] Figure 3 This is a flowchart of a method for detecting the safety of oil and gas data according to Embodiment 2 of the present invention;

[0021] Figure 4 This is a schematic diagram of the structure of an oil and gas data security detection device provided in Embodiment 4 of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] Example 1

[0025] Figure 1 This is a flowchart illustrating a method for detecting the integrity of oil and gas data according to Embodiment 1 of the present invention. This embodiment is applicable to situations involving the integrity detection of oil and gas data. The method can be executed by an oil and gas data integrity detection device, which can be implemented in hardware and / or software. Figure 1 As shown, the method includes:

[0026] In step S101, the user terminal sends the set of encrypted data blocks and the signature set corresponding to the oil and gas data to the oil and gas industry cloud server, and sends the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain.

[0027] Specifically, such as Figure 2The diagram shows the structure of an integrity verification system, which includes a private key generator, a user terminal, an oil and gas industry cloud server, auditing equipment, and a blockchain. This implementation mainly involves three stages: system initialization, oil and gas data upload, and blockchain-assisted integrity verification. The private key initialization stage primarily involves the interaction between the private key generator and the user terminal. The private key generator sets public parameters, and the user terminal interacts with the generator based on these parameters to generate a complete signature private key and a complete signature public key on the user terminal side. The oil and gas data upload stage mainly involves the interaction between the user terminal, the cloud service, and the blockchain. The user terminal encrypts the oil and gas data file in blocks and signs each ciphertext block. Finally, the set of ciphertext blocks and the set of signatures are uploaded to the oil and gas industry cloud server. In addition, the user terminal also sends the generated integrity verification information to the blockchain for storage. The blockchain-assisted integrity verification phase mainly involves the interaction between the auditing device, the cloud server, and the blockchain, and primarily involves three steps: challenge information generation, integrity verification proof information generation, and integrity verification. Challenge information generation is performed by the auditing device to generate challenge information and send it to the oil and gas industry cloud server. Integrity verification proof information generation is performed by the oil and gas industry cloud server to generate integrity verification proof information and send it to the auditing device. Integrity verification is performed by the auditing device to verify the correctness of the integrity verification proof information and upload the integrity verification log to the blockchain for recording. This embodiment focuses primarily on the third stage, namely, how to perform integrity verification based on blockchain assistance after confirming that the system initialization and oil and gas data upload stages have been completed.

[0028] Optionally, after the user terminal sends the set of encrypted data blocks and the set of signatures corresponding to the oil and gas data to the oil and gas industry cloud server, the process further includes: the oil and gas industry cloud server performing a consistency check on the set of encrypted data blocks and the set of signatures using bilinear operations; and when the oil and gas industry cloud server determines that the consistency check has passed, it saves the set of encrypted data blocks and the set of signatures.

[0029] Specifically, the public parameters set by the private key generator during the system initialization phase mainly include {e,G,G1,g,q,P}. sys ,b,H1,H2,H3,H4,H,fun k Fun k}, where e denotes a bilinear mapping, e: G×G→G1, where G and G1 are two multiplicative cyclic groups of order q, q is a large prime number, g is a generator of G, and P sysThis represents the system's master public key. H1, H2, H3, and H4 are four secure one-way hash functions, and H is a homomorphic hash function. k It is a pseudo-random permutation function, Fun k It is a pseudo-random number generator. Additionally, the set of ciphertext data blocks obtained by encrypting the oil and gas data D by the user terminal is specifically C = {c1, c2, ..., c...} n The signature set is δ = {δ1, δ2, ..., δ}. n}, where δ1 is the signature corresponding to the encrypted data block c1, and the aforementioned encrypted data block set C and signature set δ are sent to the oil and gas industry cloud server in the form of message tuple {Cδ}. In addition, the user terminal will also send the integrity auxiliary verification information {PID} corresponding to the oil and gas data. user ,lab} is sent to the blockchain, where PID user `lab` represents the anonymous identity, and `ab` represents the set of identifiers. After receiving the message tuple `Cδ`, the oil and gas industry cloud server performs a bilinear operation on the ciphertext data block set and signature set within the message tuple for consistency checking. Only if the consistency check passes will the ciphertext data block set and signature set be saved. The consistency check can be verified using the following formula: Among them, lab i It is encrypted data block c i The corresponding identifiers, F and Q, are constants, and the remaining parameters are already described in the public parameters set by the private key generator. Therefore, the oil and gas industry cloud server will store the message tuple {Cδ} only when the calculations on both sides of the equation are equal, after substituting the received message tuple into the above formula.

[0030] In step S102, when the auditing device receives an integrity detection task request sent by the user terminal at a specified time, it generates challenge information according to the public parameters set by the private key generator and sends the challenge information to the oil and gas industry cloud server.

[0031] Optionally, challenge information is generated based on the public parameters set by the private key generator, including: the auditing device calculates a secure random seed based on a specified time using an Ethereum pseudo-random function, and generates a bit stream based on the random seed and a pre-configured pseudo-random bit generator; the auditing device obtains the key of the pseudo-random permutation function and the key of the pseudo-random number generator based on the bit stream, wherein the public parameters include the pseudo-random permutation function and the pseudo-random number generator; and the challenge information is constructed based on the specified time, the key of the pseudo-random permutation function, and the key of the pseudo-random number generator.

[0032] Specifically, when a user terminal needs to check whether the data stored on the oil and gas industry cloud server is complete and has not been tampered with, it needs to send an integrity check task request to the auditing device to entrust the auditing device to check the data stored on the oil and gas industry cloud server. When the auditing device receives a request from the anonymous user terminal PID at a specified time T... user When requesting an integrity check task, a secure random seed based on a specified time T is calculated using an Ethereum pseudo-random function. And based on a random seed Generate a sufficiently long bitstream with a pre-configured pseudo-random bit generator (PGR), for example, Based on the generated bitstream, a sufficiently long pseudo-random bitstream is extracted and used to form a key pair. in It is the key of the pseudo-random permutation function fun. It is the key of the pseudo-random number generator Fun, which will obtain an undeniable challenge message based on the hash value of the Ethereum blockchain at time T. The generated challenge information CI (T) Send to the oil and gas industry cloud server.

[0033] In step S103, the oil and gas industry cloud server generates integrity verification information based on the challenge information, the set of encrypted data blocks, and the signature set, and sends the integrity verification information to the auditing device.

[0034] Optionally, the oil and gas industry cloud server generates integrity verification information based on the challenge information, the set of encrypted data blocks, and the signature set. This includes: the oil and gas industry cloud server using a pseudo-random permutation function and a pseudo-random number generator to generate an index and a set of calculated coefficients for a random number of encrypted data blocks based on the challenge information; the oil and gas industry cloud server generating integrity verification parameters based on the index and calculated coefficient set, the set of encrypted data blocks, and the signature set; and constructing integrity verification information based on the integrity verification parameters and a specified time.

[0035] Specifically, when the oil and gas industry cloud server receives challenge information sent from the auditing equipment... At that time, the oil and gas industry cloud server will use the pseudo-random permutation function fun and the pseudo-random number generator Fun to generate an index and a set of calculated coefficients for u encrypted data blocks. in Oil and gas industry cloud servers in finite domain Z q Select a non-zero random number χ T It calculates the integrity verification parameters based on time T based on the stored message tuple {Cδ}, and constructs the integrity verification information IPro based on the integrity verification parameters and time T. (T) ={T,η(T) ,γ (T) ,κ (T)}, where the first integrity test proof parameter Second integrity test proof parameter γ (T) =χ T ·H3(b χT Third integrity test proof parameters The oil and gas industry cloud server will transmit integrity verification information (IPro). (T) ={T,η (T) ,γ (T) ,κ (T) The information is sent to the auditing device. Of course, this embodiment is only an example and does not limit the specific content of the integrity detection proof information.

[0036] In step S104, the auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, and then checks the integrity of the oil and gas data based on the integrity detection proof information and the intermediate parameters.

[0037] Optionally, the auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, including: the auditing device uses a pseudo-random permutation function and a pseudo-random number generator to generate an index and a set of calculated coefficients for a random number of encrypted data blocks based on the challenge information; the auditing device pre-calculates intermediate parameters based on the index, the set of calculated coefficients, and the integrity auxiliary verification information.

[0038] Optionally, the integrity of oil and gas data is checked based on integrity verification information and intermediate parameters, including: the auditing equipment performs integrity verification using bilinear operation on the integrity verification information and intermediate parameters; it is determined whether the integrity verification passes. If it does, the oil and gas data stored in the oil and gas industry cloud server is confirmed to be complete, and a verification pass message is generated; otherwise, the oil and gas data stored in the oil and gas industry cloud server is confirmed to be abnormal, and a verification failure message is generated.

[0039] Specifically, in this implementation, after receiving the integrity verification information based on time T sent by the oil and gas industry cloud server, the auditing equipment will perform pre-calculation operations based on the generated challenge information, that is, based on the challenge information CI. (T) The pseudo-random permutation function `fun` and the pseudo-random number generator `Fun` generate an index and a set of calculated coefficients for a random number of encrypted data blocks to be challenged. The specific generation process is the same as that of the oil and gas industry cloud server, and will not be described in detail in this implementation. The auditing device will use the integrity auxiliary verification information {PID} uploaded by the end user in the blockchain to perform verification. user Pre-calculation is performed on ,lab} to obtain intermediate parameters. and intermediate parameter two

[0040] Upon receiving the integrity verification information from the oil and gas industry cloud server, along with its own pre-calculated intermediate parameters, the auditing equipment performs integrity verification using bilinear operations based on these pre-calculated intermediate parameters. For example, it can perform the verification through the following equation: To check the integrity verification information {PID} sent by the oil and gas industry cloud server user The system checks whether the equation {lab} holds true. If the equation does not hold true, it indicates that the outsourced oil and gas data is abnormally missing, thus generating a detection failure message (false) and notifying the user terminal. Otherwise, it indicates that the outsourced oil and gas data is complete, generating a detection pass message (true) and notifying the user terminal. Therefore, in this embodiment, when performing integrity checks on the oil and gas data in the oil and gas industry cloud server using auditing equipment, intermediate parameters generated from integrity auxiliary verification information stored in the blockchain by the user terminal are used to verify the integrity detection proof information of the oil and gas industry cloud server. This avoids tampering or loss of the stored oil and gas data by the oil and gas industry cloud server and ensures the accuracy of the integrity check.

[0041] Optionally, after verifying the integrity of the oil and gas data based on the integrity verification information and intermediate parameters, the process further includes: the auditing device generating a log entry for the integrity verification task request based on a specified time, the integrity verification information, and the intermediate parameters; the auditing device calculating the hash value of the log entry and uploading the log entry and hash value to the blockchain.

[0042] It should be noted that, in this embodiment, the auditing device also generates integrity detection logs and uploads them to the blockchain for recording. For each integrity detection task, the auditing device generates a log entry for the integrity detection task request based on the specified time, integrity detection proof information, and intermediate parameters. All log entries are stored in the integrity detection log in chronological order, and the auditing device also calculates the hash value of each log entry. For example, it calculates the hash value of log entry le at time T. (T) The corresponding hash value is The calculated log entries, along with their hash values, are uploaded to the blockchain, specifically by creating a transaction Tra within the blockchain. (T) and log entries le (T) and hash value As a message tuple Send it to the blockchain for storage.

[0043] In this embodiment, while uploading encrypted oil and gas data to the cloud server, the user terminal also sends the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain. Therefore, the auditing device can use the integrity detection proof information fed back by the cloud server and the intermediate parameters obtained by pre-calculation based on the integrity auxiliary verification information in the blockchain to perform oil and gas data integrity detection, so as to accurately obtain the integrity status of oil and gas data in the cloud server and thus ensure the security of oil and gas data.

[0044] Example 2

[0045] Figure 3 This invention provides a flowchart of a method for detecting the integrity of oil and gas data, based on the previous embodiment. Before the user terminal sends the set of encrypted data blocks and the signature set corresponding to the oil and gas data to the oil and gas industry cloud server, and before sending the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain, the method further includes the user terminal interacting with a private key generator to generate a complete signature private key, the generation process of the encrypted data block set and signature set based on the integrity signature private key, and the generation process of the integrity auxiliary verification information. Figure 3 As shown, the method includes:

[0046] Step S201: The user terminal generates a complete signature private key and an integrity signature public key based on the public parameters set by the private key generator during the system initialization phase.

[0047] Specifically, in this embodiment, the system initialization phase will be based on security parameters. Set up a bilinear mapping e: G×G→G1, where G and G1 are two multiplicative cyclic groups of order q, q is a large prime number, and g is a generator of G; the private key generator will operate in the finite field Z. q Select a non-zero random number λ as the system master private key, and calculate the corresponding system master public key P. sys =g λ The private key generator selects the public group element b from the multiplicative cyclic group G and sets four secure one-way hash functions: Where len1 and len2 represent the output lengths of the corresponding hash functions, and a homomorphic hash function H:Z is set. q →G, by introducing a homomorphic hash function, makes the computational cost of the integrity verification equation tend to a constant value, and will not increase with the increase of the number of challenged data blocks; the private key generator sets a pseudo-random permutation function. And set up a pseudo-random number generator Therefore, based on the publicly available parameters set above, the set of publicly available parameters is determined to be {e,G,G1,g,q,P}. sys ,b,H1,H2,H3,H4,H,funk Fun k The set of public parameters will be made public to user terminals, cloud servers, and auditing devices.

[0048] Optionally, the user terminal generates a full-signature private key and an integrity-signature public key based on the public parameters set by the private key generator during the system initialization phase. This includes: the user terminal sending a system registration request to the private key generator based on the public parameters, wherein the system registration request includes the real identity and group elements; the private key generator generating a message tuple according to the system registration request and sending the message tuple to the user terminal, wherein the message tuple includes the anonymous identity, the validity period of the anonymous identity, the first sub-private key, and the first sub-public key; when the user terminal verifies that the received message tuple is correct, it generates a second sub-private key and a second sub-public key according to the public parameters, and generates a full-signature private key and a full-signature public key according to the first sub-private key and the second sub-private key.

[0049] Specifically, in this embodiment, the user terminal is in the finite domain Z. q Select a non-zero random number ω and calculate the group element W = g. ω Send a system registration request {ID} to the private key generator via a secure channel. user ,W}, where, This is the user's real identity. After receiving the system registration request, the private key generator calculates the user's anonymous identity. Where T user It is the validity period of the end-user's anonymous identity, and in the finite field Z q Select a non-zero random number α, and calculate the partial private key of the user terminal, i.e., the first sub-private key. Calculate the user terminal's partial public key, i.e., the first sub-public key, as Q = g. α Message tuples are transmitted via a secure channel Send to the corresponding user terminal.

[0050] In this process, after receiving the message tuple, the user terminal verifies its correctness through bilinear operations, for example, by using... Verify the correctness of the received message tuple. If the equation holds, the received message tuple is determined to be correct, and the user terminal will receive the message tuple and execute it in the finite field Z. q Choose a non-zero random number β as the other part of the private key, i.e., the second sub-private key, and calculate the corresponding part of the public key as F = f β That is, the second public key, where And generate a complete signature private key based on the first and second sub-private keys. Generate a complete signature public key P based on the first and second public keys. user={Q,F}. In this embodiment, the integrity signature private key is ultimately generated and managed by the user terminal, without the need for key escrow, thus avoiding the complexities of key escrow or certificate management.

[0051] In step S202, the user terminal divides the oil and gas data into multiple oil and gas data blocks, encrypts each oil and gas data block to obtain a set of ciphertext data blocks, and signs each oil and gas data block according to the complete signature private key to obtain a signature set.

[0052] Specifically, in this embodiment, the user terminal will divide the oil and gas data D to be uploaded into n data blocks, i.e., D = {d1, d2, ..., dn}. n The oil and gas industry data block set is encrypted using a symmetric encryption algorithm to obtain the corresponding ciphertext data block set C = {c1, c2, ..., c...}. n}, each d i ,c i ∈Z q For each ciphertext data block c i The user terminal signs it using the full signing private key to obtain the ciphertext data block c. i The corresponding signature Among them, lab i It is encrypted data block c i For the corresponding identifier, the user terminal will generate a signature set δ = {δ1, δ2, ..., δ} corresponding to the set of ciphertext data blocks. n}

[0053] In step S203, the user terminal obtains the identifier set corresponding to the ciphertext data block set, as well as the anonymous identity generated by the private key generator based on the user terminal's real identity, and generates integrity auxiliary verification information based on the identifier set and the anonymous identity.

[0054] Specifically, in this embodiment, the identifier set lab = {lab1, lab2, ..., lab} corresponding to the set of ciphertext data blocks will also be obtained. n Additionally, it will also obtain the anonymous identity PID generated by the private key generator based on the user's real identity. user And generate integrity auxiliary verification information {PID} based on the identifier set and anonymous identity. user ,lab}, where,lab={lab i ∈Z q} 1≤i≤n .

[0055] In step S204, the user terminal sends the set of encrypted data blocks and the signature set corresponding to the oil and gas data to the oil and gas industry cloud server, and sends the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain.

[0056] Optionally, after the user terminal sends the set of encrypted data blocks and the set of signatures corresponding to the oil and gas data to the oil and gas industry cloud server, the process further includes: the oil and gas industry cloud server performing a consistency check on the set of encrypted data blocks and the set of signatures using bilinear operations; and when the oil and gas industry cloud server determines that the consistency check has passed, it saves the set of encrypted data blocks and the set of signatures.

[0057] Step S205: When the auditing device receives an integrity detection task request sent by the user terminal at a specified time, it generates challenge information according to the public parameters set by the private key generator and sends the challenge information to the oil and gas industry cloud server.

[0058] Optionally, challenge information is generated based on the public parameters set by the private key generator, including: the auditing device calculates a secure random seed based on a specified time using an Ethereum pseudo-random function, and generates a bit stream based on the random seed and a pre-configured pseudo-random bit generator; the auditing device obtains the key of the pseudo-random permutation function and the key of the pseudo-random number generator based on the bit stream, wherein the public parameters include the pseudo-random permutation function and the pseudo-random number generator; and the challenge information is constructed based on the specified time, the key of the pseudo-random permutation function, and the key of the pseudo-random number generator.

[0059] In step S206, the oil and gas industry cloud server generates integrity verification information based on the challenge information, the set of encrypted data blocks, and the signature set, and sends the integrity verification information to the auditing device.

[0060] Optionally, the oil and gas industry cloud server generates integrity verification information based on the challenge information, the set of encrypted data blocks, and the signature set. This includes: the oil and gas industry cloud server using a pseudo-random permutation function and a pseudo-random number generator to generate an index and a set of calculated coefficients for a random number of encrypted data blocks based on the challenge information; the oil and gas industry cloud server generating integrity verification parameters based on the index and calculated coefficient set, the set of encrypted data blocks, and the signature set; and constructing integrity verification information based on the integrity verification parameters and a specified time.

[0061] In step S207, the auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, and then checks the integrity of the oil and gas data based on the integrity detection proof information and the intermediate parameters.

[0062] Optionally, the auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, including: the auditing device uses a pseudo-random permutation function and a pseudo-random number generator to generate an index and a set of calculated coefficients for a random number of encrypted data blocks based on the challenge information; the auditing device pre-calculates intermediate parameters based on the index, the set of calculated coefficients, and the integrity auxiliary verification information.

[0063] Optionally, the integrity of oil and gas data is checked based on integrity verification information and intermediate parameters, including: the auditing equipment performs integrity verification using bilinear operation on the integrity verification information and intermediate parameters; it is determined whether the integrity verification passes. If it does, the oil and gas data stored in the oil and gas industry cloud server is confirmed to be complete, and a verification pass message is generated; otherwise, the oil and gas data stored in the oil and gas industry cloud server is confirmed to be abnormal, and a verification failure message is generated.

[0064] Optionally, after verifying the integrity of the oil and gas data based on the integrity verification information and intermediate parameters, the process further includes: the auditing device generating a log entry for the integrity verification task request based on a specified time, the integrity verification information, and the intermediate parameters; the auditing device calculating the hash value of the log entry and uploading the log entry and hash value to the blockchain.

[0065] In this embodiment, when the user terminal uploads encrypted oil and gas data to the cloud server, it also sends the corresponding integrity auxiliary verification information to the blockchain. Therefore, the auditing device can use the integrity verification information returned by the cloud server, along with pre-calculated intermediate parameters based on the integrity auxiliary verification information in the blockchain, to perform oil and gas data integrity checks. This accurately obtains the integrity status of the oil and gas data in the cloud server, thereby ensuring the security of the oil and gas data. Furthermore, in this embodiment, the integrity signature private key is ultimately generated and managed by the user terminal, eliminating the need for key escrow and avoiding the complexities of key escrow or certificate management.

[0066] Example 3

[0067] Figure 4 A schematic diagram of the structure of an oil and gas data integrity detection device provided in Embodiment 4 of the present invention is shown. Figure 4 As shown, the device includes: a data upload module 310, a challenge information generation module 320, an integrity detection proof information generation module 330, and an integrity detection module 340.

[0068] The data upload module 310 is used by the user terminal to send the set of encrypted data blocks and the signature set corresponding to the oil and gas data to the oil and gas industry cloud server, and to send the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain. The integrity auxiliary verification information includes the anonymous identity of the user terminal and the identifier set corresponding to the set of encrypted data blocks.

[0069] The challenge information generation module 320 is used to generate challenge information according to the public parameters set by the private key generator when the auditing device receives an integrity detection task request sent by the user terminal at a specified time, and then send the challenge information to the oil and gas industry cloud server.

[0070] The integrity verification certificate information generation module 330 is used by the oil and gas industry cloud server to generate integrity verification certificate information based on challenge information, encrypted data block set and signature set, and send the integrity verification certificate information to the auditing device;

[0071] The integrity detection module 340 is used by the auditing equipment to pre-calculate intermediate parameters based on challenge information and integrity auxiliary verification information in the blockchain, and to detect the integrity of oil and gas data based on integrity detection proof information and intermediate parameters.

[0072] Optionally, the device also includes a system initialization module, used by the user terminal to generate a complete signature private key and an integrity signature public key based on the public parameters set by the private key generator during the system initialization phase. The complete signature private key includes a first sub-private key generated by the private key generator and a second sub-private key generated by the user terminal.

[0073] The user terminal divides the oil and gas data into multiple oil and gas data blocks, encrypts each oil and gas data block to obtain a set of ciphertext data blocks, and signs each oil and gas data block according to the complete signature private key to obtain a signature set.

[0074] The user terminal obtains the set of identifiers corresponding to the set of encrypted data blocks, as well as the anonymous identity generated by the private key generator based on the user terminal's real identity, and generates integrity auxiliary verification information based on the set of identifiers and the anonymous identity.

[0075] Optionally, the system initialization module is also used for the user terminal to send a system registration request to the private key generator based on public parameters, wherein the system registration request includes the real identity and group elements;

[0076] The private key generator generates a message tuple based on the system registration request and sends the message tuple to the user terminal. The message tuple includes the anonymous identity, the validity period of the anonymous identity, the first sub-private key, and the first sub-public key.

[0077] When the user terminal verifies that the received message tuple is correct, it generates a second sub-private key and a second sub-public key based on the public parameters, generates a complete signature private key based on the first sub-private key and the second sub-private key, and generates a complete signature public key based on the first sub-public key and the second public key.

[0078] Optionally, the device also includes a consistency detection module, which is used by the oil and gas industry cloud server to perform consistency detection on the ciphertext data block set and the signature set using bilinear operations;

[0079] When the oil and gas industry cloud server determines that the consistency check has passed, it saves the set of encrypted data blocks and the set of signatures.

[0080] Optionally, a challenge information generation module is used to audit the device to calculate a secure random seed based on a specified time using an Ethereum pseudo-random function, and to generate a bit stream based on the random seed and a pre-configured pseudo-random bit generator;

[0081] The auditing device obtains the key of the pseudo-random permutation function and the key of the pseudo-random number generator based on the bit stream. The public parameters include the pseudo-random permutation function and the pseudo-random number generator.

[0082] The challenge information is constructed based on the specified time, the key of the pseudo-random permutation function, and the key of the pseudo-random number generator.

[0083] Optionally, an integrity verification proof information generation module is used by the oil and gas industry cloud server to generate an index and calculation coefficient set of random number of encrypted data blocks based on the challenge information using a pseudo-random permutation function and a pseudo-random number generator.

[0084] The oil and gas industry cloud server generates integrity verification parameters based on the set of indexes and calculated coefficients, the set of encrypted data blocks, and the set of signatures.

[0085] Integrity verification information is constructed based on integrity verification parameters and a specified time.

[0086] Optionally, an integrity detection module is used by the auditing device to generate an index and calculation coefficient set of a random number of encrypted data blocks based on the challenge information using a pseudo-random permutation function and a pseudo-random number generator.

[0087] The auditing equipment pre-calculates intermediate parameters based on the index and the set of calculated coefficients, as well as integrity auxiliary verification information.

[0088] Optionally, an integrity detection module is provided, which is used by the auditing device to perform integrity detection using bilinear operations on integrity detection proof information and intermediate parameters;

[0089] Determine whether the integrity check passes. If it does, the oil and gas data stored in the oil and gas industry cloud server is considered complete, and a check pass message is generated. Otherwise, the oil and gas data stored in the oil and gas industry cloud server is considered abnormal, and a check failure message is generated.

[0090] Optionally, the device also includes a log upload module, which is used by the audit device to generate log entries for the integrity detection task request based on the specified time, integrity detection proof information and intermediate parameters;

[0091] The auditing device calculates the hash value of the log entries and uploads the log entries and hash values ​​to the blockchain.

[0092] The oil and gas data integrity detection device provided in the embodiments of the present invention can execute the oil and gas data integrity detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0093] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0094] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting the integrity of oil and gas data, applied to an integrity detection system, characterized in that, The integrity detection system includes a private key generator, a user terminal, an oil and gas industry cloud server, auditing equipment, and a blockchain. The methods include: The user terminal sends the set of encrypted data blocks and the set of signatures corresponding to the oil and gas data to the oil and gas industry cloud server, and sends the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain. The integrity auxiliary verification information includes the anonymous identity of the user terminal and the set of identifiers corresponding to the set of encrypted data blocks. When the auditing device receives an integrity detection task request sent by the user terminal at a specified time, it generates challenge information according to the public parameters set by the private key generator and sends the challenge information to the oil and gas industry cloud server. The oil and gas industry cloud server generates integrity detection proof information based on the challenge information, the set of encrypted data blocks, and the set of signatures, and sends the integrity detection proof information to the auditing device. The auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, and then detects the integrity of the oil and gas data based on the integrity detection proof information and the intermediate parameters.

2. The method according to claim 1, characterized in that, Before the user terminal sends the set of encrypted data blocks and the signature set corresponding to the oil and gas data to the oil and gas industrial cloud server, and before sending the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain, it also includes: The user terminal generates a complete signature private key and an integrity signature public key based on the public parameters set by the private key generator during the system initialization phase. The complete signature private key includes a first sub-private key generated by the private key generator and a second sub-private key generated by the user terminal. The user terminal divides the oil and gas data into multiple oil and gas data blocks, encrypts each oil and gas data block to obtain the ciphertext data block set, and signs each oil and gas data block according to the complete signature private key to obtain the signature set. The user terminal obtains the identifier set corresponding to the ciphertext data block set, and the anonymous identity generated by the private key generator based on the real identity of the user terminal, and generates the integrity auxiliary verification information based on the identifier set and the anonymous identity.

3. The method according to claim 2, characterized in that, The user terminal generates a full-signature private key and an integrity-signature public key based on the public parameters set by the private key generator during the system initialization phase, including: The user terminal sends a system registration request to the private key generator based on the public parameters, wherein the system registration request includes the real identity and group elements; The private key generator generates a message tuple based on the system registration request and sends the message tuple to the user terminal. The message tuple includes the anonymous identity, the validity period of the anonymous identity, the first sub-private key, and the first sub-public key. When the user terminal verifies that the received message tuple is correct, it generates a second sub-private key and a second sub-public key according to the public parameters, generates the complete signature private key according to the first sub-private key and the second sub-private key, and generates the complete signature public key according to the first sub-public key and the second sub-public key.

4. The method according to claim 1, characterized in that, After the user terminal sends the set of encrypted data blocks and the set of signatures corresponding to the oil and gas data to the oil and gas industrial cloud server, it also includes: The oil and gas industry cloud server performs consistency checks on the encrypted data block set and the signature set using bilinear operations. When the oil and gas industry cloud server determines that the consistency check has passed, it saves the set of encrypted data blocks and the set of signatures.

5. The method according to claim 1, characterized in that, The step of generating challenge information based on the public parameters set by the private key generator includes: The auditing device calculates a secure random seed based on the specified time using an Ethereum pseudo-random function, and generates a bit stream based on the random seed and a pre-configured pseudo-random bit generator. The auditing device obtains the key of the pseudo-random permutation function and the key of the pseudo-random number generator based on the bit stream, wherein the public parameters include the pseudo-random permutation function and the pseudo-random number generator; The challenge information is constructed based on the specified time, the key of the pseudo-random permutation function, and the key of the pseudo-random number generator.

6. The method according to claim 5, characterized in that, The oil and gas industry cloud server generates integrity verification information based on the challenge information, the set of encrypted data blocks, and the set of signatures, including: The oil and gas industry cloud server uses the pseudo-random permutation function and the pseudo-random number generator to generate an index and calculation coefficient set of random number of encrypted data blocks based on the challenge information. The oil and gas industry cloud server generates integrity detection proof parameters based on the index and calculation coefficient set, the encrypted data block set, and the signature set; The integrity detection proof information is constructed based on the integrity detection proof parameters and the specified time.

7. The method according to claim 5, characterized in that, The auditing device pre-calculates intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, including: The auditing device uses the pseudo-random permutation function and the pseudo-random number generator to generate an index and a set of calculated coefficients for a random number of encrypted data blocks based on the challenge information. The auditing device pre-calculates the intermediate parameters based on the index and the set of calculated coefficients, as well as the integrity auxiliary verification information.

8. The method according to claim 1, characterized in that, The process of verifying the integrity of the oil and gas data based on the integrity verification information and the intermediate parameters includes: The auditing device performs integrity testing on the integrity verification information and the intermediate parameters using bilinear operations. Determine whether the integrity check passes. If it does, the oil and gas data stored in the oil and gas industry cloud server is considered complete, and a check pass message is generated. Otherwise, the oil and gas data stored in the oil and gas industry cloud server is considered abnormal, and a check failure message is generated.

9. The method according to claim 8, characterized in that, After verifying the integrity of the oil and gas data based on the integrity verification information and the intermediate parameters, the method further includes: The auditing device generates a log entry for the integrity detection task request based on the specified time, the integrity detection proof information, and the intermediate parameters. The auditing device calculates the hash value of the log entry and uploads the log entry and the hash value to the blockchain.

10. A device for detecting the integrity of oil and gas data, characterized in that, include: The data upload module is used by the user terminal to send the set of encrypted data blocks and the signature set corresponding to the oil and gas data to the oil and gas industry cloud server, and to send the integrity auxiliary verification information corresponding to the oil and gas data to the blockchain. The integrity auxiliary verification information includes the anonymous identity of the user terminal and the identifier set corresponding to the set of encrypted data blocks. The challenge information generation module is used to generate challenge information according to the public parameters set by the private key generator when the auditing device receives an integrity detection task request sent by the user terminal at a specified time, and send the challenge information to the oil and gas industry cloud server. The integrity verification certificate information generation module is used by the oil and gas industry cloud server to generate integrity verification certificate information based on the challenge information, the encrypted data block set, and the signature set, and send the integrity verification certificate information to the auditing device. The integrity detection module is used by the auditing device to pre-calculate intermediate parameters based on the challenge information and the integrity auxiliary verification information in the blockchain, and to detect the integrity of the oil and gas data based on the integrity detection proof information and the intermediate parameters.

Images