An efficient and intelligent traceable cloud industrial data security sharing method

Abstract

The application discloses a high-efficiency and intelligent traceable cloud industrial data security sharing method. The application realizes multi-dimensional fine-grained access control by fusing user credibility and attribute encryption, constructs an intelligent traceable framework based on a large language model and a Merkle tree structure, reduces local computing power consumption of a user through cloud outsourcing calculation, and greatly improves the traceability efficiency of malicious users, reduces manual and calculation costs on the basis of guaranteeing the security of cloud industrial data sharing.

Description

Technical Field

[0001] This invention belongs to the field of data security sharing and cloud storage technology, specifically involving an efficient and intelligent traceable cloud-based industrial data security sharing method. It is applicable to scenarios in the industrial internet, such as encrypted sharing of industrial data from multiple departments in the cloud, fine-grained access control, and intelligent tracking of malicious users. It can effectively ensure the security and traceability of the industrial data sharing process. Background Technology

[0002] With the rapid development of informatization and digitalization, industrial internet systems have become core infrastructure for various industries. Massive industrial data is characterized by its large volume, diverse types, and high sensitivity, making it impossible to complete full storage and management relying on local infrastructure. Cloud environments, with their elastic storage space advantages, have become the core carrier for persistent storage and efficient retrieval of multi-source industrial data. Enterprises generally adopt centralized cloud storage models to achieve unified management of data across multiple departments, effectively avoiding the resource redundancy and excessively high operation and maintenance costs associated with distributed deployments.

[0003] The rapid iteration of the Industrial Internet has spurred the demand for training large-scale models in vertical industries. Various business departments need to share industrial data stored in the cloud to independently or jointly train their own industry-specific models. However, cross-departmental data sharing involves a complex relationship of collaboration and sovereignty competition, imposing stringent requirements for fine-grained access control. Simultaneously, uploading data to untrusted cloud servers poses a significant risk of privacy breaches. Attribute-based encryption (ABE) solutions, with their advantage of "encryption once, controlled sharing by multiple parties," are well-suited for multi-user collaborative sharing scenarios in cloud environments, making them the mainstream technology for secure industrial data sharing.

[0004] Existing traditional ABE data security sharing solutions still suffer from several technical bottlenecks: First, it is difficult to hold individuals accountable for key misuse. User private keys are only associated with attributes and not with identities. If an internal user maliciously leaks their private key, the system cannot accurately identify the responsible party, resulting in extremely high data security risks. Second, the traceability efficiency is low. Traditional traceability methods require traversing all user keys one by one for comparison. As the system scales up, this creates a serious computational bottleneck and incurs huge manual maintenance costs. Third, users face high local computing pressure. Complex decryption operations must be completed on local devices, resulting in high resource consumption. Fourth, access control is limited to a single dimension, relying solely on user attributes for permission management, which is insufficient in terms of the fineness of security protection.

[0005] In summary, existing cloud-based industrial data sharing solutions suffer from problems such as poor security, low traceability efficiency, high resource consumption, and insufficient control precision. There is an urgent need for a secure cloud-based industrial data sharing method that balances security, efficiency, and intelligent traceability. Summary of the Invention

[0006] This invention aims to address the technical problems of existing cloud-based industrial data sharing solutions, such as the inability to accurately trace responsibility for key misuse, low traceability efficiency, high local computational overhead, and insufficient fine-grained access control. It provides a highly efficient and intelligent traceable cloud-based industrial data secure sharing method. This invention integrates user trustworthiness and attribute encryption to achieve multi-dimensional fine-grained access control. It builds an intelligent traceability framework based on a large language model and Merkle tree structure, and reduces the user's local computing power consumption through cloud-outsourced computation. While ensuring the security of cloud-based industrial data sharing, it significantly improves the efficiency of tracing malicious users and reduces manual and computational costs.

[0007] The system used in this method includes an attribute authority, a data owner, a data user, a cloud server, and a trusted authority. The attribute authority establishes communication connections with the data owner, data user, and trusted authority, respectively. The data owner establishes a communication connection with the cloud server. The data user establishes communication connections with the cloud server, the attribute authority, and the trusted authority, respectively. The trusted authority establishes communication connections with the attribute authority and the cloud server, respectively. This method includes the following steps:

[0008] S1. System Initialization: The attribute organization defines system security parameters and global attribute set, constructs encryption group structure and bilinear mapping, generates system core operation parameters, hash function, encryption algorithm and trusted signature key pair, and finally outputs system master public key MPK and master private key MSK.

[0009] S2. Initial user credibility calculation: Collect and store historical behavior data of data users, calculate the weighted score of data user behavior through a weighted summation algorithm, and obtain the initial credibility of data users by normalization with the Sigmoid function.

[0010] S3. User Key Generation: The attribute agency assigns a unique set of attributes, a unique identity identifier, and an initial trust level to the data user. It calculates the data user's identity hash value and the core basic components of the key, generates a trustworthy and tamper-proof digital signature, and integrates all components to generate a complete private key exclusively for the data user.

[0011] S4. Industrial Data Encryption: The data owner constructs an access policy that includes data user attributes and trust thresholds, sets basic encryption parameters, generates core basic components of ciphertext and policy-matching ciphertext components corresponding to secret shares, integrates all ciphertext components to obtain ciphertext data and uploads it to the cloud server for storage.

[0012] S5, Cloud-based Outsourced Industrial Data Decryption: After the data user downloads the encrypted data, the system verifies the data user's credibility, signature validity, and attribute permissions. Once the verification is successful, the cloud server performs complex bilinear pairing operations and outputs intermediate results. The data user then performs simple calculations based on the intermediate results to restore the plaintext data and performs encrypted integrity verification.

[0013] S6. Intelligent Tracing of Malicious Data Users: Verify the key structure, identity, and credibility signature of suspicious data users. Calculate the suspiciousness score of data users through a large language model. Combine the preset suspiciousness threshold and Merkle tree hierarchical retrieval mechanism to complete the verification of suspicious data user behavior and identity, and output the judgment and handling decision of malicious data users.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] 1. Higher security and precision: This invention breaks through the traditional single-attribute access control mode, integrates the credibility of user's historical behavior to build a dual access strategy, realizes fine-grained and multi-dimensional permission control, deeply binds user identity, behavior and permissions, completely solves the problem of key leakage and lack of accountability, and greatly improves the security of cloud-based industrial data sharing.

[0016] 2. Significantly improved traceability efficiency: The Merkle tree retrieval framework is built based on the credibility hierarchy. Combined with intelligent suspicion prediction of large models, it abandons the traditional full key traversal and comparison mode, reduces more than 90% of invalid verification operations, reduces manual operation and maintenance costs, and solves the traceability calculation bottleneck in large-scale systems.

[0017] 3. Lower user resource overhead: The complex bilinear pairing operations in the decryption process are all outsourced to the cloud server, and the user end only performs simple multiplication and verification operations, which greatly reduces the computing power and memory consumption of the user's local device and adapts to the lightweight deployment requirements of industrial terminals.

[0018] 4. Enhanced practicality and adaptability: Perfectly adapted to data sharing scenarios for multi-department data collaboration and vertical large-scale model training in the industrial internet cloud, taking into account security, efficiency, and intelligence, effectively solving various shortcomings of existing technologies, and possessing extremely high industrial application value. Attached Figure Description

[0019] Figure 1 This is a system model diagram.

[0020] Figure 2 Flowchart for initializing trusted values.

[0021] Figure 3 This is a schematic diagram of the traceability process. Detailed Implementation

[0022] I. System Composition and Functions of Each Component

[0023] like Figure 1As shown. The method of this invention is implemented based on a five-entity collaborative architecture. The system includes an attribute organization (AA), a data owner (DO), a data user (DU), a cloud server (CSS), and a trusted authority (TA). The specific functions of each component are as follows:

[0024] 1. Attribute Structure (AA)

[0025] As the core initializer and key generation entity of the system, it is mainly responsible for performing system initialization operations and generating basic parameters for the system's public and private keys; calculating the initial trustworthiness of users based on historical user behavior data and analysis results from large models; assigning each user a unique set of attributes and a unique identity identifier; generating a user private key containing trustworthiness, identity information, and attribute keys; and completing the trustworthiness signature to prevent tampering, ensuring the legality and uniqueness of the key.

[0026] 2. Data Owner (DO)

[0027] As the main entity responsible for data publishing and encryption, it is responsible for setting up refined data access policies based on business security needs, and constructing access rules by combining user attributes and trustworthiness as dual constraints; it encrypts industrial plaintext data used for training large models in vertical fields, generates ciphertext data, and uploads it to cloud server storage, ensuring the security of the transmission and storage of shared data from the source.

[0028] 3. Data User (DU)

[0029] As the data user, it is responsible for applying for a dedicated user private key from the attribute agency; downloading encrypted industrial ciphertext data from the cloud server; and decrypting the data by combining the results of cloud-outsourced calculations when its own attributes and trustworthiness meet the access policy, thereby obtaining plaintext industrial data for training large-scale models in vertical fields.

[0030] 4. Cloud Server (CSS)

[0031] As the main body for data storage and outsourced computing, it is responsible for persistently storing encrypted industrial data uploaded by data owners and responding to data download requests from data users; it undertakes complex, bilinear pairing operations and other intensive computing tasks, and returns intermediate results to outsourced computing, significantly reducing the local computing overhead for data users.

[0032] 5. Trusted Authority (TA)

[0033] As the entity responsible for tracing and holding accountable, it is responsible for receiving malicious user tracing requests, extracting the identity and credibility information of suspicious users, analyzing user suspiciousness by combining large language models, and completing user behavior and identity verification based on the Merkle tree structure. Ultimately, it realizes the location, tracing, and punishment of malicious users, ensuring that the entire process of data sharing is traceable and accountable.

[0034] The core innovation of this invention lies in the integration of a trustworthy attribute encryption mechanism, intelligent traceability of large models, rapid hierarchical retrieval using Merkle trees, and cloud computing outsourcing technology. The overall process includes six core steps: system initialization, user key generation, initial user trust calculation, industrial data encryption, industrial data decryption, and intelligent tracking of malicious users. It enables fine-grained secure sharing of industrial data in the cloud, low-overhead decryption, and accurate intelligent tracking of malicious behavior.

[0035] The method described in this invention specifically includes the following steps:

[0036] Step 1: System Initialization

[0037] Step Function Summary: This step is executed by the Attribute Organization (AA) to initialize the system security environment, define basic system parameters, encryption group structure, hash function, and signature key pair, and generate the system's global master public key and master private key, providing basic encryption support for subsequent key generation, data encryption, and data decryption. The following section combines... Figure 2 Please provide an explanation.

[0038] S1.1 Define the system's basic parameters and attribute set.

[0039] Set system security parameters , This serves as a system encryption security strength identifier, used to constrain the security level of encryption operations; it also defines a set of global system attributes. Φ represents the complete set of all user attributes available for access control in the system. Let n be a single independent attribute of the system, and n be the total number of system attributes.

[0040] S1.2 Constructing the cryptographic group structure and bilinear mapping

[0041] The order is chosen to be a prime number. cyclic multiplication group and , The parameter is of prime order to ensure the safety of group operations; This is the primitive cyclic multiplication group, used for regular encryption operations; The target cyclic multiplicative group is used for the bilinear mapping output; specify A generator , Cyclic group The basic generating unit is used to generate all operational elements within the group; a bilinear mapping is defined. , It is a bilinear pairing operation function, which is the core operation logic for encryption and decryption.

[0042] S1.3, Generate the core operation parameters of the system

[0043] Random selection , The core random parameters of the system master key; calculate the core public key parameters of the system. , These are system-wide public parameters. This applies to each attribute within the system. Random selection , For attribute sequence number, The random key parameter corresponding to the j-th attribute; calculate the attribute public key. , This is the public key component corresponding to the j-th attribute.

[0044] S1.4 Initializing the hash function and encryption algorithm

[0045] Select two collision-resistant one-way hash functions: , , This is a user identity hash mapping function used to convert user identity identifiers into in-group operation parameters; A hash function for verifying ciphertext integrity; The hash output bit length is fixed to a system preset value; {0,1} is a set of binary strings of arbitrary length. Initialize the asymmetric encryption algorithm. and corresponding decryption algorithms Matching public and private key pairs , , Encryption algorithms for user information Algorithm for decrypting user information; For encryption public key, To decrypt the private key.

[0046] S1.5, Generate trusted signature key pairs and the system's final key.

[0047] Generate key pairs for user trust signing. , The private key for signing the attribute authority is used to prevent tampering of the trusted signature; This is the public key used for signing by the attribute authority, and is used to verify the validity of the signature. The final output includes the system master public key MPK and master private key MSK.

[0048]

[0049]

[0050] MPK is the system's public key, shared globally; MSK is the system's private key, held only by the designated organization and strictly prohibited from being disclosed.

[0051] Step 2: Calculation of Initial User Trustworthiness

[0052] Step Function Summary: This step is used to generate the user's initial credibility based on the user's historical behavior data through weighted scoring and the Sigmoid function, providing a behavioral dimension constraint basis for subsequent access control and realizing the binding of user behavior and permissions.

[0053] S2.1 User Behavior Data Collection and Storage

[0054] Collect historical user behavior data, including the number of failed user operations, system access frequency, and number of login device and IP changes. Store all behavior records in a vector database as a basic indicator for credibility assessment.

[0055] S2.2 Calculate the weighted score of user behavior

[0056] The weighted score s of user behavior is calculated using a weighted summation algorithm, and the formula is as follows:

[0057]

[0058] in: This represents the number of failed user operations, including failed attempts such as file downloads, viewing, and system logins. The weighting coefficient corresponding to the number of operation failures; User system access frequency; The weighting coefficient corresponding to the access frequency; This is the sum of the number of times a user changed their login device and the number of times their login IP address changed. These are the weighting coefficients corresponding to equipment and IP changes; all weighting coefficients are preset fixed empirical values, and the subscripts 1, 2, and 3 are the classification numbers of the evaluation indicators, respectively.

[0059] S2.3 Calculate the initial confidence level based on the Sigmoid function

[0060] Substituting the weighted score s into the Sigmoid activation function and normalizing it, we obtain the user's initial credibility c, calculated using the following formula:

[0061]

[0062] in: The initial credibility score for a user is represented by the subscript u, which ranges from 0 to 1. A higher value indicates a more credible user behavior. k is the slope parameter of the Sigmoid function, used to adjust the rate of change of credibility. is the offset threshold for the Sigmoid function, used to calibrate the baseline confidence score; e is a natural constant.

[0063] Step 3: User Key Generation

[0064] Step Function Summary: This step is performed by the attribute organization AA, which combines the user attribute set, unique identity identifier, and initial trust level to generate a signed user-specific private key, realizing deep binding of user attributes, identity, and trust level, and ensuring the uniqueness and tamper-proof nature of the key.

[0065] S3.1 Initialize user basic parameters

[0066] Assign a unique set of attributes to each user Unique Identifier Initial credibility The subscript u corresponds to the current data user; randomly selected. , Generate random perturbation parameters for the user key. Calculate the user's identity hash value using a hash function. Further calculate identity key parameters It serves as a dedicated key component corresponding to a user's identity.

[0067] S3.2, Core Basic Components for Computing Keys

[0068] Core basic components for calculating user private keys , : , As a core universal component of the user private key, it binds the system master parameters and user identity parameters, serving as a universal key unit for all users.

[0069] For each attribute that the user possesses , For the j-th attribute held by the user; randomly selected. , The key random perturbation parameter for the j-th attribute; calculate the attribute key components sequentially: , The subscript j corresponds to the attribute number held by the user.

[0070] S3.4, Generate a trusted signature and the complete user private key

[0071] Use attribute authority to sign private key Combination of user identity and credibility information Generate digital signature The σ is a tamper-proof digital signature used for subsequent trust and identity verification. Integrate all components to generate the user's complete private key:

[0072]

[0073] Step 4: Industrial Data Encryption

[0074] Step Function Summary: This step is executed by the data owner (DO) to encrypt the industrial plaintext training data based on a custom access policy, generating standardized ciphertext data, and realizing encrypted data storage and fine-grained access control.

[0075] S4.1 Setting Access Policies and Basic Encryption Parameters

[0076] The data owner constructs an access policy P that includes user attributes and trust thresholds based on business security requirements. Policy P is implemented through a linear secret sharing scheme matrix. Characterized by t, where t is the number of rows in the matrix and d is the number of columns in the matrix; Let be a space of t rows and d columns of a p-order finite field. A secret value is randomly selected. s is the core secret parameter for data encryption, used for plaintext blind encryption. Let be a finite field of order P.

[0077] S4.2, Core basic components for generating ciphertext

[0078] Industrial plaintext training data (m represents the original industrial training plaintext data to be encrypted) Blinding is performed, and the core ciphertext components are calculated: , Simultaneously calculate the integrity verification hash value. .

[0079] S4.3, Generate secret share and strategy matching ciphertext component

[0080] Constructing a secret sharing vector ,in Let T be the random dimension parameter of the vector, and T be the matrix transpose symbol; used to split the encrypted secret value. For each row of the matrix... and corresponding mapping attributes ( (For the system attributes corresponding to the mapping of the i-th row of the matrix), calculate the corresponding secret share. The ciphertext matching component is based on the secret share generation strategy. , The subscripts 1,i and 2,i are the identifiers of the two types of ciphertext components corresponding to the i-th row of the matrix.

[0081] Integrate all encrypted components to generate the final encrypted data CT that can be uploaded and stored:

[0082]

[0083] The data owner uploads the encrypted CT to the cloud server CSS for persistent storage.

[0084] Step 5: Decrypting Industrial Data (Cloud-based Outsourced Computing)

[0085] Step-by-step function summary: This step realizes permission verification and low-overhead data decryption. First, it verifies the user's credibility and attribute permissions. Then, it outsources complex bilinear pairing operations to the cloud server. The user only needs to perform simple operations to restore the plaintext data, which greatly reduces the local computing overhead.

[0086] S5.1 User Permission Validation

[0087] After obtaining the encrypted CT, the data user first uses the signing public key. Verify trusted signature within private key legitimacy, confirming user credibility Unaltered; verified simultaneously Is it higher than the preset threshold of the access policy? (Subscript P corresponds to the access policy parameter), and verify whether the user attribute set matches the access policy P. If any verification fails, the decryption process is terminated directly.

[0088] S5.2, Cloud-based outsourced computation intermediate results

[0089] After the permission verification is passed, the cloud server performs a complex bilinear pairing operation, calculating the intermediate results W and V based on the user key component and the ciphertext component. The calculation formula is as follows:

[0090]

[0091] in: I represents the set of matrix row indices that satisfy the access policy; ω represents the reconstruction coefficient corresponding to the secret share in the i-th row, used to restore the core secret value s, satisfying the reconstruction formula. .

[0092] S5.3, Local restoration of plaintext data by the user

[0093] The user receives the intermediate results W and V returned from the cloud, and performs a simple multiplication operation to obtain the aggregate parameter B: By using the ciphertext core components and aggregation parameters to cancel out key association terms, the original plaintext data can be restored. , where m is the plaintext data restored after decryption.

[0094] S5.4, Ciphertext Integrity Verification

[0095] User verification hash equation If the condition is met, the decryption is considered successful and the ciphertext is intact and has not been tampered with; if the condition is not met, the ciphertext is considered abnormal and the decryption result is discarded.

[0096] Step Six: Intelligent Tracing of Malicious Users

[0097] like Figure 3 As shown. Step-by-step function summary: This step relies on intelligent analysis of large language models and Merkle tree hierarchical retrieval mechanism to quickly locate and hold accountable malicious users, abandoning the full traversal mode, reducing invalid verification operations, and improving the intelligence and efficiency of traceability.

[0098] S6.1 Verification of Suspicious User Basic Information

[0099] After the system triggers the tracing process, it first verifies the suspicious user's key. The system checks the validity of the structure; if the structure is abnormal, the tracing process terminates; if the structure is valid, the user's credibility is extracted. Identity identification And verify the signature a second time. This ensures that user information has not been tampered with.

[0100] S6.2, Large-scale intelligent calculation of user suspiciousness

[0101] Record user behavior Credibility Identity identification Input the trained large language model, where 'a' represents user historical behavior records and 'u' corresponds to the current user; the model analyzes and outputs a user suspiciousness score based on preset prompt word templates. (User malicious behavior probability score, value 0-1). Preset system suspiciousness threshold. (θ is the threshold value for traceability judgment, which is fixed and preset).

[0102] S6.3, Hierarchical Intelligent Traceability Judgment and Verification

[0103] (1) High suspicion level determination: If If the model outputs "NO", the system will directly determine the user's trust level. Match the user's identity Merkle tree with the corresponding reputation range, retrieve and verify the user's identity information. If the verification is successful, the user is directly identified as a malicious user and is subject to accountability and punishment.

[0104] (2) Low suspicion level determination: If If the model outputs "YES", the system first retrieves the user's behavior Merkle tree, traverses and verifies the user's historical behavior records to check for malicious behaviors such as key leakage or unauthorized access. If malicious behavior is verified, the system then matches the corresponding reputation interval Merkle tree to complete identity verification, determines the user as malicious, and holds them accountable. If no malicious behavior is found, the tracing process is terminated, and the user is determined to have not violated any rules.

[0105] S6.4, Execution of the traceability algorithm

[0106] The core traceability algorithm automates the entire process, and the algorithm logic is as follows:

[0107] S6.4.1 Obtain the behavior records of the user to be detected. Current credibility and identity markers .

[0108] S6.4.2 Input the above data into the Large Language Model (LLM) to calculate the user's suspiciousness score. .

[0109] S6.4.3 Determine whether the suspiciousness score is greater than or equal to a preset threshold. .

[0110] S6.4.4 If the score is greater than or equal to the threshold, then based on the user's credibility... Retrieve the corresponding identity information Merkle tree and verify the identity identifier. Does it exist in the tree structure? If the verification passes, proceed to step S6.4.5; otherwise, end the process.

[0111] S6.4.5. Determine that the user is a malicious user and set the processing decision P to PUNISH. PUNISH is the malicious user accountability function.

[0112] S6.4.6 If the score in step S6.4.3 is less than the threshold, then retrieve the user's behavior record Merkle tree and proceed accordingly. The function verifies the behavior record. Whether there was indeed malicious intent.

[0113] S6.4.7 If malicious behavior is verified, repeat the authentication process (retrieve the Merkle tree and verify). Once the verification is successful, a penalty operation will be performed.

[0114] S6.4.8 If step S6.4.6 verifies that there is no malicious behavior, then the processing decision P is set to No Operation (NO_ACTION). NO_ACTION is a termination indicator for no violation.

[0115] S6.4.9 Output the final processing decision P.

[0116] The algorithm code is as follows:

[0117]

[0118] PUNISH, NO_ACTION

[0119] 1: function ANALYZEUSER

[0120] 2: suspicion_score_LLM

[0121] 3: if suspicion_score then

[0122] 4: tree GetMerkleTree

[0123] 5: valid VerifyInTree ,tree)

[0124] 6:if valid then

[0125] 7: PUNISH

[0126] 8:end if

[0127] 9:else

[0128] 10:behavior_tree_GetBehaviorMerkleTree

[0129] 11:malicious VerifyBehavior ,behavior_tree)

[0130] 12:if malicious then

[0131] 13:tree GetMerkleTree

[0132] 14:valid VerifyInTree ,tree)

[0133] 15:if valid then

[0134] 16: PUNISH

[0135] 17:end if

[0136] 18: else

[0137] 19: NO_ACTION()

[0138] 20: end if

[0139] 21:end if

[0140] 22:return

[0141] 23:end function

[0142] The first part is a Merkle tree for recording user behavior, used to store and verify historical user behavior data; the second part is a Merkle tree for user identity and reputation, storing user identity information hierarchically according to confidence intervals; the third part is a Boolean result for identity verification; and the fourth part is a Boolean result for determining the malice of the behavior.

[0143] The innovative aspects of this invention are as follows:

[0144] 1. This invention proposes an attribute-based encryption scheme that integrates user credibility. It incorporates the credibility generated by the user's historical behavior into the access policy, breaks the traditional single attribute control mode, realizes dual fine-grained access control of attribute + credibility, strengthens the binding relationship between user identity and behavior, and significantly improves the accuracy of system security protection.

[0145] 2. Based on the Merkle tree structure, user reputation intervals are divided according to user credibility, and a hierarchical screening and tracing framework is constructed. This abandons the traditional full-scale traversal comparison mode, narrows the search scope, and significantly improves the efficiency of user tracing and verification.

[0146] 3. Introduce a large language model to analyze user behavior data and output a suspiciousness score. Intelligently determine whether secondary behavior verification is needed, reduce invalid verification operations, reduce manual operation and maintenance costs, and realize the intelligent upgrade of the traceability process.

[0147] 4. By adopting cloud computing outsourcing technology, the complex bilinear pairing operation in the decryption process is migrated to the cloud server for execution, allowing only simple calculations to be performed on the user's end, which greatly reduces the user's local computing power and resource consumption.

Claims

1. A highly efficient and intelligent method for securely sharing traceable cloud-based industrial data, wherein the system used in this method includes an attribute organization, a data owner, a data user, a cloud server, and a trusted authority; the attribute organization establishes communication connections with the data owner, the data user, and the trusted authority respectively; the data owner establishes a communication connection with the cloud server; the data user establishes communication connections with the cloud server, the attribute organization, and the trusted authority respectively; and the trusted authority establishes communication connections with the attribute organization and the cloud server respectively; characterized in that, The method includes the following steps: S1. System Initialization: The attribute organization defines system security parameters and global attribute set, constructs encryption group structure and bilinear mapping, generates system core operation parameters, hash function, encryption algorithm and trusted signature key pair, and finally outputs system master public key MPK and master private key MSK. S2. Initial user credibility calculation: Collect and store historical behavior data of data users, calculate the weighted score of data user behavior through a weighted summation algorithm, and obtain the initial credibility of data users by normalization with the Sigmoid function. S3. User Key Generation: The attribute agency assigns a unique set of attributes, a unique identity identifier, and an initial trust level to the data user. It calculates the data user's identity hash value and the core basic components of the key, generates a trustworthy and tamper-proof digital signature, and integrates all components to generate a complete private key exclusively for the data user. S4. Industrial Data Encryption: The data owner constructs an access policy that includes data user attributes and trust thresholds, sets basic encryption parameters, generates core basic components of ciphertext and policy-matching ciphertext components corresponding to secret shares, integrates all ciphertext components to obtain ciphertext data and uploads it to the cloud server for storage. S5, Cloud-based Outsourced Industrial Data Decryption: After the data user downloads the encrypted data, the system verifies the data user's credibility, signature validity, and attribute permissions. Once the verification is successful, the cloud server performs complex bilinear pairing operations and outputs intermediate results. The data user then performs simple calculations based on the intermediate results to restore the plaintext data and performs encrypted integrity verification. S6. Intelligent Tracing of Malicious Data Users: Verify the key structure, identity, and credibility signature of suspicious data users. Calculate the suspiciousness score of data users through a large language model. Combine the preset suspiciousness threshold and Merkle tree hierarchical retrieval mechanism to complete the verification of suspicious data user behavior and identity, and output the judgment and handling decision of malicious data users.

2. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 1, characterized in that, Step S1 specifically includes: S1.1 Set the system security parameter λ and define the system global attribute set Φ={A1,A2,A3,...,A... n }, where n is the total number of system attributes; S1.2, Select a cyclic multiplication group G of order p. And for the generator g of a group G, define a bilinear mapping. ; S1.3 Randomly select the core random parameter α of the system master key and the random key parameters corresponding to each attribute. The core public key parameter Y of the computing system and the public keys of each attribute ; S1.4 Select two collision-resistant one-way hash functions H1 and H2, and initialize the asymmetric encryption algorithm. Decryption algorithm and supporting public / private key pairs , ; S1.5, Generate a trusted signature key pair ( ), integrate system parameters to generate the system master public key With the system master private key .

3. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 1, characterized in that, Step S2 specifically includes: S2.1 Collect historical behavioral data such as the number of failed user operations, system access frequency, and number of login device and IP changes, and store it in a vector database; S2.2, According to the formula Calculate the weighted score of user behavior in the data, where The number of failed data user operations. For data user system access frequency, This represents the total number of device and IP changes. , , For the corresponding preset weighting coefficients; S2.3, Weighted scores Substitute into the Sigmoid function Normalization yields the initial user confidence score, which ranges from 0 to 1. Where k is the slope parameter of the function. is the offset threshold, and e is a natural constant.

4. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 1, characterized in that, Step S3 specifically includes: S3.1 Assign a unique attribute set to the data user. Unique Identifier Initial credibility Select random disturbance parameters The hash value of the user's identity is calculated using a hash function. Further calculate identity key parameters ; S3.2, Calculate the core basic components of user private key data , Randomly select perturbation parameters for each attribute of the data user. Calculate the corresponding attribute key component , ; S3.3, Sign the private key through the attribute authority Combined information of user identity and credibility Generate a digital signature σ; S3.4 Integrate all key components to generate the complete private key for the data user: .

5. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 1, characterized in that, Step S4 specifically includes: S4.1 The data owner constructs an access policy P containing data user attributes and trust thresholds. The access policy is represented by a linear secret sharing scheme matrix M* with t rows and d columns, and the core encryption secret value is randomly selected. ; S4.2 Calculating the core ciphertext component based on industrial plaintext training data m: , Calculate the ciphertext integrity verification hash value ; , The core random parameters of the system master key; S4.3 Constructing the Secret Sharing Vector Based on the mapping attributes of each row of the matrix and the secret share, a policy matching ciphertext component is generated. , ;in The vector has random dimension parameters; i represents the i-th row; S4.4 Integrate all ciphertext components to generate ciphertext data. The encrypted data CT is then uploaded to the cloud server.

6. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 1, characterized in that, Step S5 specifically includes: S5.1, Data users use the signing public key Verify the validity of the private key signature σ and check the initial trustworthiness of the data user. Not lower than the preset threshold of the access policy If the data user attribute set fails to match the access policy P, the decryption process will be terminated. S5.2 The cloud server performs a bilinear pairing operation based on the data user key component and the ciphertext component to calculate the intermediate results W and V; S5.3 Data users aggregate parameters B=W·V through local calculations and restore industrial plaintext data based on the formula m=C0 / B; S5.4, Data User Verification Hash Equation To determine if the condition is met, complete the ciphertext integrity verification.

7. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 1, characterized in that, Step S6 specifically includes: S6.1 Verify suspicious data user private key Structural legitimacy, extracting user credibility data Identity identification Secondary verification of the signature σ's validity; S6.2 Record user behavior data Credibility Identity identification Input a large language model and output a user suspicion score ranging from 0 to 1, with a preset suspicion threshold θ. S6.3 If the suspiciousness score is greater than or equal to θ, retrieve the identity Merkle tree corresponding to the data user's credibility interval, complete the data user identity verification, and if the verification is successful, determine the user as a malicious data user and execute the penalty decision. S6.4 If the suspicion score is < θ, retrieve the Merkle tree of the data user behavior, verify whether there is malicious behavior in the data user's historical behavior. If there is malicious behavior, complete the identity Merkle tree verification and execute the penalty decision. If there is no malicious behavior, output the no-action decision. S6.5 Output the final data for user processing decisions.

8. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 7, characterized in that, In step S6, the Merkle tree includes an identity Merkle tree that stores data user identity information hierarchically according to the data user's trust interval, and a behavior Merkle tree that stores data user's historical behavior data.

9. The efficient and intelligent traceable cloud-based industrial data secure sharing method according to claim 3, characterized in that: In S2.1, the vector database performs structured storage and time-series updates on the collected historical behavior data of data users to support the dynamic calculation of data user credibility in real time.

Images