Data sharing method, apparatus and device

Abstract

Provided in the present disclosure are a data sharing method, apparatus and device. The method comprises: a blockchain node receiving a data query request sent by a first device, wherein the data query request comprises attribute information of the first device; and the blockchain node executing a first operation, wherein the first operation comprises at least one of the following: determining ciphertext corresponding to the data query request, sending the ciphertext to the first device, and sending the data query request to a second device.

Description

Data sharing method, device and equipment

[0001] This disclosure claims priority to the Chinese patent application filed with the China Patent Office on June 9, 2023, with application number: 202310680310.1 and application name: “Data Sharing Method, Device and Equipment”, the entire content of which is incorporated by reference into this disclosure. Technical Field

[0002] The present disclosure relates to the field of communication technology, and in particular to a data sharing method, apparatus, and device. Background Art

[0003] The full coverage of the sixth generation of mobile communications (6G) will build an integrated network across air, space, land, and sea, enabling global interconnection. Through effective co-construction and sharing, different network resource providers can collaborate with each other, complement each other's strengths and weaknesses, and support seamless service access and provide enhanced services in an efficient and low-cost manner. In a network co-construction and sharing scenario, different network resource providers need to share data and information with each other. However, in a co-construction and sharing scenario, not all information of a participant is open to other participants. Participants need to authenticate other participants and also need to perform fine-grained access control on the content of their requests.

[0004] In the sharing scenarios of related technologies, the authentication and access control of each participant are mostly offline manual negotiations, which are not automated and cannot achieve safe and controllable information data sharing.

[0005] Summary of the Invention

[0006] The purpose of the present disclosure is to provide a data sharing method, device and equipment, which solves the problem that the data sharing solutions of related technologies cannot achieve safe and controllable information data sharing.

[0007] An embodiment of the present disclosure provides a data sharing method, including:

[0008] The blockchain node receives a data query request sent by a first device, where the data query request includes attribute information of the first device;

[0009] The blockchain node performs a first operation, where the first operation includes at least one of the following:

[0010] Determining a ciphertext corresponding to the data query request; and sending the ciphertext to the first device;

[0011] Send the data query request to the second device.

[0012] In some embodiments, the method further comprises:

[0013] generating a private key of the first device according to the data query request;

[0014] The private key is sent to the first device.

[0015] In some embodiments, the method further comprises:

[0016] Generate system public key and system master key;

[0017] The system public key and the system master key are broadcasted.

[0018] In some embodiments, the method further comprises:

[0019] Receive the ciphertext sent by the second device.

[0020] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0021] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0022] An embodiment of the present disclosure provides a data sharing method, including:

[0023] The first device sends a data query request to the blockchain node, where the data query request includes attribute information of the first device;

[0024] The first device receives the ciphertext corresponding to the data query request.

[0025] In some embodiments, receiving the ciphertext corresponding to the data query request includes at least one of the following:

[0026] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0027] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0028] The ciphertext includes data and an attribute-based access control structure.

[0029] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0030] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0031] In some embodiments, the method further comprises at least one of the following:

[0032] Obtain the system public key and system master key generated by the blockchain node;

[0033] Receive a private key corresponding to the first device sent by the blockchain node.

[0034] In some embodiments, the method further comprises

[0035] The ciphertext is decrypted according to the private key and the system public key.

[0036] An embodiment of the present disclosure provides a data sharing method, including:

[0037] The second device generates a ciphertext based on the first information;

[0038] The second device sends the ciphertext to the blockchain node and / or the first device.

[0039] In some embodiments, the first information includes at least one of the following:

[0040] System public key;

[0041] Attribute-based access control structure.

[0042] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0043] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0044] In some embodiments, the method further comprises:

[0045] Receive data query requests sent by blockchain nodes;

[0046] The data query request includes attribute information of the first device.

[0047] In some embodiments, the method further comprises:

[0048] Obtain the system public key and system master key generated by the blockchain node.

[0049] An embodiment of the present disclosure provides a network device, including: a memory, a transceiver, and a processor:

[0050] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0051] receiving a data query request sent by a first device, where the data query request includes attribute information of the first device;

[0052] Perform a first operation, where the first operation includes at least one of the following:

[0053] Determining a ciphertext corresponding to the data query request; and sending the ciphertext to the first device;

[0054] Send the data query request to the second device.

[0055] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0056] generating a private key of the first device according to the data query request;

[0057] The private key is sent to the first device.

[0058] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0059] Generate system public key and system master key;

[0060] The system public key and the system master key are broadcasted.

[0061] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0062] Receive the ciphertext sent by the second device.

[0063] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0064] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0065] An embodiment of the present disclosure provides a communication device, including: a memory, a transceiver, and a processor:

[0066] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0067] Sending a data query request to a blockchain node, wherein the data query request includes attribute information of the first device;

[0068] Receive the ciphertext corresponding to the data query request.

[0069] In some embodiments, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0070] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0071] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0072] The ciphertext includes data and an attribute-based access control structure.

[0073] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0074] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0075] In some embodiments, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0076] Obtain the system public key and system master key generated by the blockchain node;

[0077] Receive a private key corresponding to the first device sent by the blockchain node.

[0078] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0079] The ciphertext is decrypted according to the private key and the system public key.

[0080] An embodiment of the present disclosure provides a communication device, including: a memory, a transceiver, and a processor:

[0081] A memory for storing a computer program; a transceiver for receiving and sending data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0082] generating a ciphertext according to the first information;

[0083] The ciphertext is sent to the blockchain node and / or the first device.

[0084] In some embodiments, the first information includes at least one of the following:

[0085] System public key;

[0086] Attribute-based access control structure.

[0087] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0088] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0089] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0090] Receive data query requests sent by blockchain nodes;

[0091] The data query request includes attribute information of the first device.

[0092] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0093] Obtain the system public key and system master key generated by the blockchain node.

[0094] An embodiment of the present disclosure provides a data sharing device, comprising:

[0095] A first receiving unit, configured to receive a data query request sent by a first device, wherein the data query request includes attribute information of the first device;

[0096] The first processing unit is configured to perform a first operation, where the first operation includes at least one of the following:

[0097] Determining a ciphertext corresponding to the data query request; and sending the ciphertext to the first device;

[0098] Send the data query request to the second device.

[0099] An embodiment of the present disclosure provides a data sharing device, comprising:

[0100] A first sending unit, configured to send a data query request to a blockchain node, wherein the data query request includes attribute information of the first device;

[0101] The second receiving unit is configured to receive the ciphertext corresponding to the data query request.

[0102] An embodiment of the present disclosure provides a data sharing device, comprising:

[0103] A first generating unit, configured to generate a ciphertext according to the first information;

[0104] The second sending unit is used to send the ciphertext to the blockchain node and / or the first device.

[0105] An embodiment of the present disclosure provides a processor-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned data sharing method are implemented.

[0106] The beneficial effects of the above technical solution disclosed in the present invention are:

[0107] In embodiments of the present disclosure, a blockchain node receives a data query request from a first device, determines a corresponding ciphertext based on the request, and sends it to the first device; and / or, after receiving a data query request from the first device, the blockchain node forwards the request to a second device, which then provides the corresponding ciphertext to the first device. Due to the distributed and tamper-proof nature of blockchain, using blockchain nodes as trusted authorization centers can avoid single points of failure caused by third-party servers and ensure the security, authenticity, transparency, and fairness of transaction information between devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0108] FIG1 shows a flow chart of a data sharing method according to an embodiment of the present disclosure;

[0109] FIG2 shows one of the schematic diagrams of the architecture of blockchain nodes and devices according to an embodiment of the present disclosure;

[0110] FIG3 shows a second flow chart of the data sharing method according to an embodiment of the present disclosure;

[0111] FIG4 shows a second schematic diagram of the architecture of blockchain nodes and devices according to an embodiment of the present disclosure;

[0112] FIG5 shows a third flow chart of the data sharing method according to an embodiment of the present disclosure;

[0113] FIG6 shows a fourth flow chart of the data sharing method according to an embodiment of the present disclosure;

[0114] FIG7 shows a fifth flow chart of the data sharing method according to an embodiment of the present disclosure;

[0115] FIG8 shows one structural diagram of a data sharing device according to an embodiment of the present disclosure;

[0116] FIG9 shows a second structural diagram of the data sharing device according to an embodiment of the present disclosure;

[0117] FIG10 shows a third structural diagram of the data sharing device according to an embodiment of the present disclosure;

[0118] FIG11 is a schematic diagram showing the structure of a network device according to an embodiment of the present disclosure;

[0119] FIG12 shows one structural diagram of a communication device according to an embodiment of the present disclosure;

[0120] FIG13 shows a second schematic structural diagram of the communication device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0121] To make the technical problems, technical solutions, and advantages to be solved by the present disclosure more clear, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments. In the following description, specific details such as specific configurations and components are provided only to help fully understand the embodiments of the present disclosure. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of known functions and configurations have been omitted.

[0122] It should be understood that references throughout this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic associated with the embodiment is included in at least one embodiment of the present disclosure. Therefore, the appearances of "in one embodiment" or "in an embodiment" throughout this specification do not necessarily refer to the same embodiment. Furthermore, these particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0123] In the various embodiments of the present disclosure, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure.

[0124] In the embodiments of the present disclosure, the term "and / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0125] In the embodiments of the present disclosure, the term "plurality" refers to two or more than two, and other quantifiers are similar thereto.

[0126] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure and not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0127] The embodiments of the present disclosure provide a data sharing method, apparatus, and device to solve the problem that data sharing solutions in related technologies cannot achieve secure and controllable information data sharing.

[0128] Among them, the method and the device are based on the same application concept. Since the principles of solving problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0129] As shown in FIG1 , an embodiment of the present disclosure provides a data sharing method, which is applied to a blockchain node and specifically includes the following steps:

[0130] Step 101: A blockchain node receives a data query request sent by a first device, where the data query request includes attribute information of the first device.

[0131] Step 102: The blockchain node performs a first operation, where the first operation includes at least one of the following:

[0132] Determining a ciphertext corresponding to the data query request; and sending the ciphertext to the first device;

[0133] Send the data query request to the second device.

[0134] In this embodiment, the first device may be a data requester, i.e., used to request access to data. The second device may be a data owner, i.e., used to contribute data. It should be noted that the data requester and the data owner may interchange roles in other data request processes.

[0135] The blockchain node is a node in the blockchain network. In the disclosed embodiments, the blockchain node serves as a trusted authorization center and can be used to forward data query requests or ciphertext. The blockchain node can store the ciphertext reported by the second device. The first device sends the data query request to the blockchain node, which then searches for the corresponding ciphertext based on the data query request and sends it to the first device. Furthermore, upon receiving the data query request from the first device, the blockchain node forwards the data query request to the second device, which then sends the corresponding ciphertext to the first device.

[0136] In this embodiment, the data query request sent by the first device includes attribute information of the first device, where the attribute refers to the identity attribute of the device, such as: teacher, student, leader, ordinary employee. The attribute information can be an attribute set (also called an identity information set). When requesting data, the first device reports its own attribute information. The blockchain node and / or the second device can perform authentication based on the attributes of the first device to implement access control to the data. In the embodiments of the present disclosure, data access control can be implemented based on the attribute information of the device.

[0137] In embodiments of the present disclosure, a blockchain node receives a data query request from a first device, determines a corresponding ciphertext based on the request, and sends it to the first device; and / or, after receiving a data query request from the first device, the blockchain node forwards the request to a second device, which then provides the corresponding ciphertext to the first device. Due to the distributed and tamper-proof nature of blockchain, using blockchain nodes as trusted authorization centers can avoid single points of failure caused by third-party servers and ensure the security, authenticity, transparency, and fairness of transaction information between devices.

[0138] As an optional embodiment, the method further includes:

[0139] Generate a private key of the first device according to the data query request; and send the private key to the first device.

[0140] In this embodiment, after receiving a data query request, the blockchain node can generate a user private key based on the device attribute information in the data query request and send the private key to the first device. The blockchain node can be a blockchain smart contract. The first device initiates a data query request to the blockchain network. The blockchain node generates a corresponding private key (User-Secret Key, U-SK) for the user based on the attribute set (S) submitted by the data requester (i.e., the first device), the system public key (S-PK), and the system master key (S-MK).

[0141] As an optional embodiment, the method further includes: generating a system public key and a system master key; and broadcasting the system public key and the system master key.

[0142] In this embodiment, during the initialization phase, blockchain nodes can generate a system public key (S-PK) and a system master key (S-MK) based on implicit security parameters and broadcast them to each device. The device can generate ciphertext based on the system public key. The security parameters can be preconfigured or predefined, or even random.

[0143] As an optional embodiment, the method further includes: receiving a ciphertext sent by the second device.

[0144] In some embodiments, the ciphertext carries an attribute-based access control structure; wherein the ciphertext can be decrypted by a device that meets a first condition, the first condition including: the device has attribute information corresponding to the access control structure.

[0145] In this embodiment, the second device is the data owner and can generate attribute-based encrypted ciphertext based on the system public key, the message content to be encrypted, and the access control structure. The ciphertext implicitly includes the access control structure, which restricts decryption of the ciphertext to users with attributes that satisfy the access control structure. For example, if the ciphertext reported by the second device is encrypted using an access control structure with the "teacher" attribute, users with the "teacher" attribute can decrypt the ciphertext, but users with the "student" attribute cannot.

[0146] When the first device decrypts the ciphertext, it needs to decrypt the ciphertext based on the system public key and the device's own private key. If the attribute information in the key meets the access control structure of the ciphertext, the corresponding plaintext message can be obtained using the decryption algorithm.

[0147] The implementation process of the data sharing method is described below through specific embodiments.

[0148] In some embodiments, assuming that the data owner's ciphertext is uploaded to the blockchain network, as shown in Figures 2 and 3, the method includes:

[0149] Step 31: Initialization: Generate the system public key (S-PK) and system master key (S-MK) based on the implicit security parameter (λ), broadcast them, and send them to each device.

[0150] This step is executed by the blockchain's smart contract. The implicit security parameters can be system-specified. The system parameters generated in this step provide parameter support for subsequent steps.

[0151] Step 32: The data requester (first device) sends a data query request to the blockchain network, which carries the attribute set S.

[0152] Step 33: Key generation: Generate a corresponding private key for the user based on the attribute set submitted by the data requester (first device), the system public key (S-PK) and the system master key (S-MK).

[0153] This step, executed by a blockchain smart contract, generates a user private key (U-SK) and distributes it to the data requester (first device). Specifically, the data requester (first device) initiates a data query request to the blockchain network, which includes the data requester's (first device's) attribute set (identity set). Based on the attribute set (identity set) submitted by the data requester, the system public key, and the system master key, a corresponding private key is generated for the user.

[0154] Step 34: Data encryption: The data owner (second device) generates attribute-based encryption ciphertext (CT) based on the system public key (S-PK), the message m to be encrypted, and the access control structure A and uploads it to the blockchain network.

[0155] In this step, the data owner (second device) generates an attribute-encrypted ciphertext CT based on the system public key (S-PK), the message m, and the access control structure A. The ciphertext can only be decrypted by users who have attributes that satisfy the access control structure A, that is, A is implicitly included in the ciphertext CT.

[0156] The data owner (second device) returns the generated ciphertext to the blockchain network, and the blockchain network returns the requested ciphertext CT to the data requester (first device).

[0157] It should be noted that the execution order between step 33 and step 34 is not limited here.

[0158] Step 35: Data decryption: The data requester (first device) uses its own private key (U-SK) and the system public key (S-PK) to decrypt the ciphertext CT and obtain the plaintext message m.

[0159] This step decrypts the encrypted data uploaded to the blockchain network. The data requester (first device) decrypts the ciphertext using its own private key (U-SK) and the system public key (S-PK). If the attribute set S in the key satisfies the access control structure A, the corresponding plaintext message m is obtained through the decryption algorithm.

[0160] In this embodiment, in some data sharing scenarios, there is a lack of trust in third-party servers storing data. In this embodiment, data is encrypted by the data owner and uploaded to the blockchain network for storage. This allows data requesters to directly download the data they need from the blockchain network for decryption, avoiding the data owner's frequent data encryption and transmission when multiple data requesters request data in sequence. As a trusted authorization center, the blockchain network, due to its distributed and tamper-proof nature, allows for the upload and download of ciphertext and attribute-based access control of data requests, ensuring the authenticity, transparency, and fairness of transaction information, thereby ensuring data security.

[0161] In some embodiments, it is assumed that the data owner's ciphertext does not need to be uploaded to the blockchain network. As shown in Figures 4 and 5, the method includes:

[0162] Step 51: Initialization: Generate the system public key (S-PK) and system master key (S-MK) according to the implicit security parameter (λ), broadcast them, and send them to each device.

[0163] This step is executed by the blockchain's smart contract. The implicit security parameters can be system-specified. The system parameters generated in this step provide parameter support for subsequent steps.

[0164] Step 52: The data requester (first device) sends a data query request to the blockchain network, which carries the attribute set S.

[0165] Step 53: Key generation: Generate a corresponding private key for the user based on the attribute set submitted by the data requester (first device), the system public key (S-PK) and the system master key (S-MK).

[0166] This step, executed by a blockchain smart contract, generates a user private key (U-SK) and distributes it to the data requester (first device). Specifically, the data requester (first device) initiates a data query request to the blockchain network, which includes the data requester's (first device's) attribute set (identity set). Based on the attribute set (identity set) submitted by the data requester, the system public key, and the system master key, a corresponding private key is generated for the user.

[0167] Step 54: The blockchain network forwards the data query request to the data owner (second device).

[0168] Step 55: Data encryption: The data owner (second device) generates a ciphertext CT based on attribute encryption according to the system public key (S-PK), the message m to be encrypted and the access control structure A.

[0169] In this step, the data owner (second device) generates attribute-encrypted ciphertext CT based on the system public key (S-PK), the message m, and the access control structure A. This ciphertext can only be decrypted by users who possess attributes that satisfy the access control structure A. That is, A is implicitly included in the ciphertext CT. Only users whose attribute set satisfies the access control structure A can correctly decrypt the ciphertext CT.

[0170] The data owner (second device) sends the generated ciphertext directly to the data requester (first device).

[0171] Step 56: Data decryption: The data requester (first device) uses its own private key (U-SK) and the system public key (S-PK) to decrypt the ciphertext CT to obtain the plaintext message m.

[0172] This step decrypts the encrypted data sent by the data owner (the second device). The data requester (the first device) decrypts the ciphertext using its own private key (U-SK) and the system public key (S-PK). If the attribute set S in the key satisfies the access control structure A, the corresponding plaintext message m is obtained through the decryption algorithm.

[0173] In this embodiment, in some scenarios where data volumes are excessive, and if the blockchain network has limited storage capacity and data reuse is low, peer-to-peer data transmission can be employed. Specifically, ciphertext is not transmitted to the blockchain network; the blockchain network only forwards data query requests. As a trusted authorization center, the blockchain network, due to its distributed and tamper-proof nature, ensures the authenticity, transparency, and fairness of transaction information by forwarding data query requests. Attribute-based access control of data requests ensures data transmission security.

[0174] The disclosed embodiments utilize a blockchain network to make transaction information traceable, transparent, and public. Furthermore, the blockchain network serves as a trusted authorization center for data sharing among all participating parties in a co-construction and sharing system. Using its smart contracts, the network can initialize the system and generate parameters such as user private keys, system public keys, and master keys, thus avoiding single points of failure caused by third-party servers. In co-construction and sharing scenarios, based on the blockchain as a trusted authorization center, a ciphertext-policy attribute encryption access control mechanism is employed. This allows network resource providers to control data access and authenticate data requesters through data request policies, thereby improving data sharing efficiency.

[0175] As shown in FIG6 , an embodiment of the present disclosure further provides a data sharing method, which is applied to a first device and includes:

[0176] Step 601: The first device sends a data query request to a blockchain node, where the data query request includes attribute information of the first device.

[0177] Step 602: The first device receives the ciphertext corresponding to the data query request.

[0178] In this embodiment, the first device may be a data requester, i.e., a device for requesting access to data. The blockchain node is a node in the blockchain network. In the disclosed embodiment, the blockchain node serves as a trusted authorization center and may be used to forward data query requests or ciphertext.

[0179] A first device sends a data query request to a blockchain node. The request includes attribute information of the first device, where the attribute refers to the device's identity. The blockchain node may store the ciphertext reported by the second device. Upon receiving the request, the blockchain node searches for the corresponding ciphertext based on the request and sends it to the first device. Alternatively, the blockchain node may forward the request to the second device, which then sends the corresponding ciphertext to the first device.

[0180] In the disclosed embodiments, a first device sends a data query request to a blockchain node. The blockchain node and / or second device can then determine the corresponding ciphertext based on the data query request and send it to the first device. Due to the distributed and tamper-proof nature of blockchain, using blockchain nodes as trusted authorization centers can avoid single points of failure caused by third-party servers and ensure the security, authenticity, transparency, and fairness of transaction information between devices.

[0181] As an optional embodiment, the receiving the ciphertext corresponding to the data query request includes at least one of the following:

[0182] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0183] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0184] The ciphertext includes data and an attribute-based access control structure.

[0185] In this embodiment, the blockchain node can be used to forward data query requests or ciphertext. The blockchain node can store the ciphertext reported by the second device. The first device sends the data query request to the blockchain node, which then searches for the corresponding ciphertext based on the data query request and sends it to the first device. Alternatively, after receiving the data query request from the first device, the blockchain node forwards the data query request to the second device, which then sends the corresponding ciphertext to the first device.

[0186] In some embodiments, the ciphertext carries an attribute-based access control structure; wherein the ciphertext can be decrypted by a device that meets a first condition, the first condition including: the device has attribute information corresponding to the access control structure.

[0187] In this embodiment, the second device is the data owner and can generate attribute-based encrypted ciphertext based on the system public key, the message content to be encrypted, and the access control structure. The ciphertext implicitly includes the access control structure, which restricts decryption to users with attributes that satisfy the access control structure. When decrypting the ciphertext, the first device must use the system public key and its own private key to decrypt the ciphertext. If the attribute information in the key satisfies the access control structure of the ciphertext, the decryption algorithm can be used to obtain the corresponding plaintext message.

[0188] In some embodiments, the method further comprises at least one of the following:

[0189] Obtain the system public key and system master key generated by the blockchain node;

[0190] Receive a private key corresponding to the first device sent by the blockchain node.

[0191] In this embodiment, during the initialization phase, blockchain nodes can generate a system public key (S-PK) and a system master key (S-MK) based on implicit security parameters and broadcast them to each device. The device can generate ciphertext based on the system public key. The security parameters can be preconfigured or predefined, or even random.

[0192] After receiving the data query request from the first device, the blockchain node can generate a user private key based on the device attribute information in the data query request and send the private key to the first device.

[0193] In some embodiments, the method further includes: decrypting the ciphertext based on the private key and the system public key.

[0194] After receiving the ciphertext, the first device decrypts the ciphertext using its own private key and the system public key. If the attribute set in the key satisfies the access control structure of the ciphertext, the corresponding plaintext message can be obtained through the decryption algorithm.

[0195] In the disclosed embodiments, a first device sends a data query request to a blockchain node. The blockchain node and / or second device can then determine the corresponding ciphertext based on the data query request and send it to the first device. Due to the distributed and tamper-proof nature of blockchain, using blockchain nodes as trusted authorization centers can avoid single points of failure caused by third-party servers and ensure the security, authenticity, transparency, and fairness of transaction information between devices.

[0196] As shown in FIG7 , an embodiment of the present disclosure further provides a data sharing method, which is applied to a second device and includes:

[0197] Step 701: The second device generates a ciphertext based on the first information;

[0198] Step 702: The second device sends the ciphertext to the blockchain node and / or the first device.

[0199] In this embodiment, the first device may be a data requester, i.e., used to request access to data. The second device may be a data owner, i.e., used to contribute data. It should be noted that the data requester and the data owner may interchange roles in other data request processes.

[0200] The blockchain node is a node in the blockchain network. In the disclosed embodiments, it serves as a trusted authorization center and can be used to forward data query requests or ciphertext. The second device can generate ciphertext based on the first information and upload the ciphertext to the blockchain node for storage. When the first device requests data from the blockchain node, the blockchain node transmits the ciphertext to the first device. Alternatively, the first device can send a data query request to the blockchain node, which forwards the request to the second device. After generating the ciphertext, the second device directly transmits the ciphertext to the first device.

[0201] In the disclosed embodiments, after generating ciphertext, the second device can upload it to a blockchain node, which then stores it and sends it to the first device. Alternatively, the second device can directly send the ciphertext to the first device. Due to the distributed and tamper-proof nature of blockchain, using blockchain nodes as trusted authorization centers avoids single points of failure caused by third-party servers and ensures the security, authenticity, transparency, and fairness of transaction information between devices.

[0202] In some embodiments, the first information includes at least one of the following:

[0203] System public key;

[0204] Attribute-based access control structure.

[0205] In this embodiment, the second device generates an attribute-encrypted ciphertext CT based on the system public key (S-PK), the message m, and the access control structure A. The ciphertext can only be decrypted by users who have attributes that satisfy the access control structure A, that is, A is implicitly included in the ciphertext CT.

[0206] In some embodiments, the ciphertext carries an attribute-based access control structure; wherein the ciphertext can be decrypted by a device that meets a first condition, the first condition including: the device has attribute information corresponding to the access control structure.

[0207] In this embodiment, the second device is the data owner and can generate attribute-based encrypted ciphertext based on the system public key, the message content to be encrypted, and the access control structure. The ciphertext implicitly includes the access control structure, which restricts decryption of the ciphertext to users with attributes that satisfy the access control structure. For example, if the ciphertext reported by the second device is encrypted using an access control structure with the "teacher" attribute, users with the "teacher" attribute can decrypt the ciphertext, but users with the "student" attribute cannot.

[0208] In some embodiments, the method further includes: receiving a data query request sent by a blockchain node; the data query request includes attribute information of the first device.

[0209] In this embodiment, the first device sends a data query request to the blockchain node. After receiving the data query request sent by the first device, the blockchain node forwards the data query request to the second device, and the second device sends the corresponding ciphertext to the first device. The data query request includes the attribute information of the first device. The attribute refers to the identity attribute of the device. The attribute information can be an attribute set (also called an identity information set). When requesting data, the first device reports its own attribute information. The blockchain node and / or the second device can perform authentication based on the attributes of the first device to achieve access control for the data. In the embodiment of the present disclosure, access control of data can be achieved based on the attribute information of the device.

[0210] In some embodiments, the method further includes: obtaining a system public key and a system master key generated by the blockchain node.

[0211] In this embodiment, during the initialization phase, blockchain nodes can generate a system public key (S-PK) and a system master key (S-MK) based on implicit security parameters and broadcast them to each device. The device can generate ciphertext based on the system public key. The security parameters can be preconfigured or predefined, or even random.

[0212] In the disclosed embodiments, after generating ciphertext, the second device can upload it to a blockchain node, which will store it and send it to the first device. Alternatively, the second device can directly send the ciphertext to the first device. Due to the distributed and tamper-proof nature of blockchain, using blockchain nodes as trusted authorization centers can avoid single points of failure caused by third-party servers and ensure the security, authenticity, transparency, and fairness of transaction information between devices.

[0213] The above embodiments have introduced the data sharing method disclosed in the present invention. The following embodiments will further illustrate the corresponding devices in conjunction with the accompanying drawings.

[0214] Specifically, as shown in FIG8 , an embodiment of the present disclosure provides a data sharing device 800 applied to a blockchain node, including:

[0215] A first receiving unit 810 is configured to receive a data query request sent by a first device, where the data query request includes attribute information of the first device;

[0216] The first processing unit 820 is configured to perform a first operation, where the first operation includes at least one of the following:

[0217] Determining a ciphertext corresponding to the data query request; and sending the ciphertext to the first device;

[0218] Send the data query request to the second device.

[0219] In some embodiments, the apparatus further comprises:

[0220] a second generating unit, configured to generate a private key of the first device according to the data query request;

[0221] The third sending unit is configured to send the private key to the first device.

[0222] In some embodiments, the apparatus further comprises:

[0223] A third generating unit, configured to generate a system public key and a system master key;

[0224] A broadcasting unit is used to broadcast the system public key and the system master key.

[0225] In some embodiments, the apparatus further comprises:

[0226] The third receiving unit is used to receive the ciphertext sent by the second device.

[0227] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0228] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0229] It should be noted that the above-mentioned device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiment applied to the blockchain node, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0230] Specifically, as shown in FIG9 , an embodiment of the present disclosure provides a data sharing apparatus 900 , which is applied to a first device and includes:

[0231] A first sending unit 910 is configured to send a data query request to a blockchain node, where the data query request includes attribute information of the first device;

[0232] The second receiving unit 920 is configured to receive the ciphertext corresponding to the data query request.

[0233] In some embodiments, the second receiving unit is configured to perform at least one of the following:

[0234] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0235] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0236] The ciphertext includes data and an attribute-based access control structure.

[0237] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0238] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0239] In some embodiments, the apparatus further includes: a second processing unit configured to:

[0240] Obtain the system public key and system master key generated by the blockchain node;

[0241] Receive a private key corresponding to the first device sent by the blockchain node.

[0242] In some embodiments, the apparatus further comprises:

[0243] A decryption unit is used to decrypt the ciphertext according to the private key and the system public key.

[0244] It should be noted here that the above-mentioned device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiment applied to the first device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0245] Specifically, as shown in FIG10 , an embodiment of the present disclosure provides a data sharing apparatus 1000 , which is applied to a second device and includes:

[0246] A first generating unit 1010 is configured to generate a ciphertext according to the first information;

[0247] The second sending unit 1020 is used to send the ciphertext to the blockchain node and / or the first device.

[0248] In some embodiments, the first information includes at least one of the following:

[0249] System public key;

[0250] Attribute-based access control structure.

[0251] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0252] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0253] In some embodiments, the apparatus further comprises:

[0254] A fourth receiving unit, configured to receive a data query request sent by a blockchain node;

[0255] The data query request includes attribute information of the first device.

[0256] In some embodiments, the apparatus further comprises:

[0257] The acquisition unit is used to obtain the system public key and system master key generated by the blockchain node.

[0258] It should be noted here that the above-mentioned device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiment applied to the second device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0259] It should be noted that the division of units in the embodiments of the present disclosure is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0260] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0261] As shown in FIG11 , an embodiment of the present disclosure further provides a network device, which may be a blockchain node, comprising: a memory 1120, a transceiver 1100, and a processor 1110; wherein the memory 1120 is configured to store a computer program; the transceiver 1100 is configured to receive and send data under the control of the processor 1110; and the processor 1110 is configured to read the computer program in the memory and perform the following operations:

[0262] receiving a data query request sent by a first device, where the data query request includes attribute information of the first device;

[0263] Perform a first operation, where the first operation includes at least one of the following:

[0264] Determining a ciphertext corresponding to the data query request; and sending the ciphertext to the first device;

[0265] Send the data query request to the second device.

[0266] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0267] generating a private key of the first device according to the data query request;

[0268] The private key is sent to the first device.

[0269] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0270] Generate system public key and system master key;

[0271] The system public key and the system master key are broadcasted.

[0272] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0273] Receive the ciphertext sent by the second device.

[0274] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0275] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0276] In FIG11 , the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits such as one or more processors represented by processor 1110 and memory represented by memory 1120. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and, therefore, will not be further described herein. The bus interface provides an interface. The transceiver 1100 may be multiple components, including a transmitter and a transceiver, providing a unit for communicating with various other devices over a transmission medium. The processor 1110 is responsible for managing the bus architecture and general processing, while the memory 1120 may store data used by the processor 1110 when performing operations.

[0277] The processor 1110 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0278] It should be noted here that the above-mentioned network device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiment applied to the blockchain node, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0279] As shown in FIG12 , an embodiment of the present disclosure further provides a communication device, which may be a first device, including: a memory 1220, a transceiver 1200, and a processor 1210; wherein the memory 1220 is configured to store a computer program; the transceiver 1200 is configured to receive and send data under the control of the processor 1210; and the processor 1210 is configured to read the computer program in the memory and perform the following operations:

[0280] Sending a data query request to a blockchain node, wherein the data query request includes attribute information of the first device;

[0281] Receive the ciphertext corresponding to the data query request.

[0282] In some embodiments, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0283] Receiving the ciphertext corresponding to the data query request sent by the blockchain node;

[0284] Receiving a ciphertext corresponding to the data query request sent by the second device;

[0285] The ciphertext includes data and an attribute-based access control structure.

[0286] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0287] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0288] In some embodiments, the processor is configured to read the computer program in the memory and perform at least one of the following operations:

[0289] Obtain the system public key and system master key generated by the blockchain node;

[0290] Receive a private key corresponding to the first device sent by the blockchain node.

[0291] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0292] The ciphertext is decrypted according to the private key and the system public key.

[0293] In FIG12 , the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1210 and memory represented by memory 1220. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1200 may be a plurality of components, including a transmitter and a transceiver, providing a unit for communicating with various other devices over a transmission medium. The processor 1210 is responsible for managing the bus architecture and general processing, and the memory 1220 may store data used by the processor 1210 when performing operations.

[0294] The processor 1210 may be a CPU, an ASIC, an FPGA, or a CPLD, and the processor may also adopt a multi-core architecture.

[0295] It should be noted here that the above-mentioned communication device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiment applied to the first device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0296] As shown in FIG13 , an embodiment of the present disclosure further provides a communication device, which may be a second device, including: a memory 1320, a transceiver 1300, and a processor 1310; wherein the memory 1320 is configured to store a computer program; the transceiver 1300 is configured to receive and send data under the control of the processor 1310; and the processor 1310 is configured to read the computer program in the memory and perform the following operations:

[0297] generating a ciphertext according to the first information;

[0298] The ciphertext is sent to the blockchain node and / or the first device.

[0299] In some embodiments, the first information includes at least one of the following:

[0300] System public key;

[0301] Attribute-based access control structure.

[0302] In some embodiments, the ciphertext carries an attribute-based access control structure;

[0303] The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

[0304] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0305] Receive data query requests sent by blockchain nodes;

[0306] The data query request includes attribute information of the first device.

[0307] In some embodiments, the processor is configured to read the computer program in the memory and perform the following operations:

[0308] Obtain the system public key and system master key generated by the blockchain node.

[0309] In FIG13 , the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1310 and memory represented by memory 1320. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1300 may be a plurality of components, namely, a transmitter and a transceiver, providing a unit for communicating with various other devices over a transmission medium. The processor 1310 is responsible for managing the bus architecture and general processing, and the memory 1320 may store data used by the processor 1310 when performing operations.

[0310] The processor 1310 may be a CPU, an ASIC, an FPGA, or a CPLD, and the processor may also adopt a multi-core architecture.

[0311] It should be noted here that the above-mentioned communication device provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiment applied to the second device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0312] In addition, a specific embodiment of the present disclosure further provides a processor-readable storage medium having a computer program stored thereon, wherein when the program is executed by the processor, the steps of the data sharing method described above are implemented and the same technical effect is achieved. To avoid repetition, it is not described here. The readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), optical storage (such as a compact disc (CD), a high-density digital video disc (DVD), a Blu-ray disc (BD), a high-definition versatile disc (HVD), etc.), and semiconductor storage (such as ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), non-volatile memory (NAND FLASH), solid-state disk (SSD), etc.).

[0313] It should be noted that the technical solutions provided by the embodiments of the present disclosure can be applicable to a variety of systems, especially 5G systems. For example, applicable systems may be global system of mobile communication (GSM) systems, code division multiple access (CDMA) systems, wideband code division multiple access (WCDMA) general packet radio service (GPRS) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, long term evolution advanced (LTE-A) systems, universal mobile telecommunication systems (UMTS), worldwide interoperability for microwave access (WiMAX) systems, 5G new radio (NR) systems, etc. These various systems include terminal devices and network devices. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0314] The terminal device involved in the embodiments of the present disclosure may be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connection function, or other processing device connected to a wireless modem. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called User Equipment (UE). A wireless terminal device can communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges voice and / or data with a radio access network. For example, Personal Communication Service (PCS) phones, cordless phones, Session Initiated Protocol (SIP) phones, Wireless Local Loop (WLL) stations, Personal Digital Assistants (PDAs), and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, or a user device, but is not limited in the embodiments of the present disclosure.

[0315] The network device involved in the embodiments of the present disclosure may be a base station, which may include multiple cells providing services to terminals. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in an access network that communicates with a wireless terminal device through one or more sectors on an air interface, or may be called another name. The network device may be used to interchange received air frames with Internet Protocol (IP) packets, acting as a router between the wireless terminal device and the rest of the access network, wherein the rest of the access network may include an Internet Protocol (IP) communication network. The network device may also coordinate the attribute management of the air interface. For example, the network device involved in the embodiments of the present disclosure may be a base transceiver station (BTS) in the Global System for Mobile communications (GSM) or code division multiple access (CDMA), a network device (NodeB) in wide-band code division multiple access (WCDMA), an evolutionary Node B (eNB or e-NodeB) in the long term evolution (LTE) system, a 5G base station (gNB) in the 5G network architecture (next generation system), a home evolved Node B (HeNB), a relay node, a femto, a pico, etc., and is not limited in the embodiments of the present disclosure. In some network structures, the network device may include a centralized unit (CU) node and a distributed unit (DU) node, and the centralized unit and the distributed unit may also be geographically separated.

[0316] Network devices and terminal devices can each use one or more antennas for Multiple Input Multiple Output (MIMO) transmission. MIMO transmission can be single-user MIMO (SU-MIMO) or multi-user MIMO (MU-MIMO). Depending on the form and number of antenna combinations, MIMO transmission can be two-dimensional MIMO (2D-MIMO), three-dimensional MIMO (3D-MIMO), full-dimensional MIMO (FD-MIMO), or massive MIMO. It can also use diversity transmission, precoded transmission, or beamforming transmission.

[0317] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer-usable program code.

[0318] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0319] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0320] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0321] It should be noted that it should be understood that the division of the above modules is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, these modules can all be implemented in the form of software called by a processing element; or they can all be implemented in the form of hardware; or some modules can be implemented in the form of software called by a processing element, and some modules can be implemented in the form of hardware. For example, the determination module can be a separately established processing element, or it can be integrated into a chip of the above-mentioned device. In addition, it can also be stored in the memory of the above-mentioned device in the form of program code, and called by a processing element of the above-mentioned device to perform the functions of the above-mentioned determination module. The implementation of other modules is similar. In addition, these modules can all or partly be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by the hardware integrated logic circuit in the processor element or by instructions in the form of software.

[0322] For example, each module, unit, sub-unit or sub-module may be one or more integrated circuits configured to implement the above method, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented by scheduling program code through a processing element, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0323] The terms "first," "second," and the like in the specification and claims of the present disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present disclosure described herein may be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or units need not be limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or devices. In addition, the use of "and / or" in the specification and claims to indicate at least one of the connected objects, for example, A and / or B and / or C, means that seven situations are included: A alone, B alone, C alone, both A and B present, both B and C present, both A and C present, and all A, B, and C present. Similarly, the use of "at least one of A and B" in the specification and claims should be understood to mean "A alone, B alone, or both A and B present."

[0324] Obviously, those skilled in the art may make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and their equivalents, the present disclosure is intended to include these modifications and variations.

Claims

1. A data sharing method, comprising: The blockchain node receives a data query request sent by a first device, where the data query request includes attribute information of the first device; The blockchain node performs a first operation, where the first operation includes at least one of the following: Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device; The data query request is sent to the second device.

2. The method according to claim 1, further comprising: generating a private key of the first device according to the data query request; The private key is sent to the first device.

3. The method according to claim 1, further comprising: Generate system public key and system master key; The system public key and the system master key are broadcasted.

4. The method according to claim 1, further comprising: Receive the ciphertext sent by the second device.

5. The method according to claim 1 or 4, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

6. A data sharing method, comprising: The first device sends a data query request to the blockchain node, where the data query request includes attribute information of the first device; The first device receives the ciphertext corresponding to the data query request.

7. The method according to claim 6, wherein: The receiving the ciphertext corresponding to the data query request includes at least one of the following: Receiving the ciphertext corresponding to the data query request sent by the blockchain node; Receiving a ciphertext corresponding to the data query request sent by the second device; The ciphertext includes data and an attribute-based access control structure.

8. The method according to claim 6 or 7, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

9. The method according to claim 6, further comprising at least one of the following: Obtain the system public key and system master key generated by the blockchain node; Receive a private key corresponding to the first device sent by the blockchain node.

10. The method according to claim 9, further comprising: The ciphertext is decrypted according to the private key and the system public key.

11. A data sharing method, comprising: The second device generates a ciphertext based on the first information; The second device sends the ciphertext to the blockchain node and / or the first device.

12. The method according to claim 11, wherein: The first information includes at least one of the following: System public key; Attribute-based access control structure.

13. The method according to claim 11 or 12, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

14. The method according to claim 11, further comprising: Receive data query requests sent by blockchain nodes; The data query request includes attribute information of the first device.

15. The method according to claim 11, further comprising: Obtain the system public key and system master key generated by the blockchain node.

16. A network device comprising: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Receive a data query request sent by a first device, the data query request including the first device Attribute information of Perform a first operation, where the first operation includes at least one of the following: Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device; The data query request is sent to the second device.

17. The network device according to claim 16, wherein: The processor is configured to read the computer program in the memory and perform the following operations: generating a private key of the first device according to the data query request; The private key is sent to the first device.

18. The network device according to claim 16, wherein: The processor is configured to read the computer program in the memory and perform the following operations: Generate system public key and system master key; The system public key and the system master key are broadcasted.

19. The network device according to claim 16, wherein: The processor is configured to read the computer program in the memory and perform the following operations: Receive the ciphertext sent by the second device.

20. The network device according to claim 16 or 19, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

21. A communication device comprising: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Sending a data query request to a blockchain node, wherein the data query request includes attribute information of the first device; Receive the ciphertext corresponding to the data query request.

22. The communication device according to claim 21, wherein: The processor is configured to read the computer program in the memory and perform at least one of the following operations: Receiving the ciphertext corresponding to the data query request sent by the blockchain node; Receiving a ciphertext corresponding to the data query request sent by the second device; The ciphertext includes data and an attribute-based access control structure.

23. The communication device according to claim 21 or 22, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

24. The communication device according to claim 21, wherein: The processor is configured to read the computer program in the memory and perform at least one of the following operations: Obtain the system public key and system master key generated by the blockchain node; Receive a private key corresponding to the first device sent by the blockchain node.

25. The communication device according to claim 24, wherein: The processor is configured to read the computer program in the memory and perform the following operations: The ciphertext is decrypted according to the private key and the system public key.

26. A communication device comprising: Memory, transceiver, processor: Memory for storing computer programs; a transceiver for receiving and sending data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: generating a ciphertext according to the first information; The ciphertext is sent to the blockchain node and / or the first device.

27. The communication device according to claim 26, wherein: The first information includes at least one of the following: System public key; Attribute-based access control structure.

28. The communication device according to claim 26 or 27, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

29. The communication device according to claim 26, wherein: The processor is configured to read the computer program in the memory and perform the following operations: Receive data query requests sent by blockchain nodes; The data query request includes attribute information of the first device.

30. The communication device according to claim 26, wherein: The processor is configured to read the computer program in the memory and perform the following operations: Obtain the system public key and system master key generated by the blockchain node.

31. A data sharing device, comprising: A first receiving unit, configured to receive a data query request sent by a first device, wherein the data query request includes attribute information of the first device; The first processing unit is configured to perform a first operation, where the first operation includes at least one of the following: Determine a ciphertext corresponding to the data query request; and send the ciphertext to the first device; The data query request is sent to the second device.

32. The apparatus according to claim 31, further comprising: A second generating unit, configured to generate a private key of the first device according to the data query request; The third sending unit is used to send the private key to the first device.

33. The apparatus according to claim 31, further comprising: A third generating unit, used for generating a system public key and a system master key; The broadcast unit is used to broadcast the system public key and the system master key.

34. The apparatus of claim 31, further comprising: The third receiving unit is used to receive the ciphertext sent by the second device.

35. The device according to claim 31 or 34, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

36. A data sharing device, comprising: A first sending unit, configured to send a data query request to a blockchain node, wherein the data query request includes attribute information of the first device; The second receiving unit is used to receive the ciphertext corresponding to the data query request.

37. The device according to claim 36, wherein The second receiving unit is configured to perform at least one of the following: Receiving the ciphertext corresponding to the data query request sent by the blockchain node; Receiving a ciphertext corresponding to the data query request sent by the second device; The ciphertext includes data and an attribute-based access control structure.

38. The device according to claim 36 or 37, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

39. The apparatus of claim 36, further comprising: The second processing unit is configured to: Obtain the system public key and system master key generated by the blockchain node; Receive a private key corresponding to the first device sent by the blockchain node.

40. The apparatus of claim 39, further comprising: A decryption unit is used to decrypt the ciphertext according to the private key and the system public key.

41. A data sharing device, characterized in that: include: A first generating unit, used to generate a ciphertext according to the first information; The second sending unit is used to send the ciphertext to the blockchain node and / or the first device.

42. The device according to claim 41, wherein The first information includes at least one of the following: System public key; Attribute-based access control structure.

43. The device according to claim 41 or 42, wherein: The ciphertext carries an attribute-based access control structure; The ciphertext can be decrypted by a device that meets a first condition, and the first condition includes: the device has attribute information corresponding to the access control structure.

44. The apparatus of claim 41, further comprising: A fourth receiving unit, used to receive a data query request sent by a blockchain node; The data query request includes attribute information of the first device.

45. The apparatus of claim 41, further comprising: The acquisition unit is used to obtain the system public key and the system master key generated by the blockchain node.

46. ​​A processor-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data sharing method as described in any one of claims 1 to 5, or implements the steps of the data sharing method as described in any one of claims 6 to 10, or the steps of the data sharing method as described in any one of claims 11 to 15.

Images