CN111914027A

CN111914027A - Searchable encryption method and system for block chain transaction keywords

Info

Publication number: CN111914027A
Application number: CN202010778012.2A
Authority: CN
Inventors: 陈红松; 张艺潆
Original assignee: University of Science and Technology Beijing USTB
Current assignee: University of Science and Technology Beijing USTB
Priority date: 2020-08-05
Filing date: 2020-08-05
Publication date: 2020-11-10
Anticipated expiration: 2040-08-05
Also published as: CN111914027B

Abstract

The invention discloses a searchable encryption method and a searchable encryption system for keywords of block chain transaction, wherein the method comprises the following steps: encrypting and signing the transaction order file by using an identification cryptographic algorithm; carrying out searchable encryption processing on the keywords by using a searchable encryption algorithm; after the chain of the transaction order is finished, establishing a mapping relation between the keywords which are stored in the transaction order and are encrypted through searching and stored and the corresponding block serial numbers in the index structure; when the user searches, the corresponding block is searched by using the index structure according to the search keyword, and the search result is returned to the user. The invention solves the problems of encrypted storage and effective inquiry of sensitive transaction data on a block chain and the difficulty in certificate management of the traditional Public Key Infrastructure (PKI) cryptosystem. The safety and the privacy of the transaction data of the blockchain user are guaranteed, and reliable platform-level safety service is provided for the application of the blockchain technology in a high-privacy scene.

Description

Searchable encryption method and system for block chain transaction keywords

Technical Field

The invention relates to the technical field of block chains, in particular to a searchable encryption method and system for a block chain transaction keyword.

Background

In the blockchain system, any single node is equal, and corresponding data can be obtained, and the data exist in a distributed storage mode, a distributed encryption mode and a distributed accounting mode. In order to achieve consistency of the consensus nodes, the blockchain data transaction records must be disclosed to all nodes in the blockchain, which necessarily causes a risk of leakage of user transaction data.

For the difficult problem, some researchers propose to encrypt the transaction data and upload the encrypted transaction data to the block chain, but the searchability of the user to the transaction data on the block chain is deteriorated, and all the data need to be downloaded and locally decrypted to search, so that the time and space complexity of the search is further increased. The searchable encryption technology is proposed to solve the problem, but most of the current searchable encryption technologies are searchable encryption algorithms in a cloud computing environment, and related technologies for supporting searchable encryption on a blockchain system are lacked. In addition, the current digital signature algorithm is generally based on the traditional pki (public Key infrastructure) public Key cryptosystem, and has certain defects in management, such as the fact that a large amount of computing, storage and network resources are required to be occupied for finding, revoking, storing, issuing and verifying certificates. The identification cryptosystem can effectively solve the problems, and under the identification cryptosystem, the public key of the user is the public identification information of the user, so that the problem of complex management in the traditional public key cryptosystem is solved.

At present, for the privacy protection problem of blockchain data, two solutions for detecting malicious nodes and encrypting data exist. And setting rules for adding the blockchain nodes, wherein nodes which are not authorized cannot be added into the blockchain. For existing malicious nodes, the prior art provides a detection method based on malicious node behavior analysis, which can identify and locate the malicious nodes and eliminate potential safety hazards. In data currency, a' Coin mix (Coin) mechanism is widely applied, and the main measure of the scheme is to confuse the contents in a transaction list, so that the analysis difficulty of an attacker is increased. The Zcash encryption scheme is a method using Zero-Knowledge Proof (Zero-Knowledge Proof) to achieve the goal of not revealing the relevant information of the transaction, but the algorithm proves and the calculation process is too complex. The method is mainly improved by blocking data generated in the Internet of things to realize decentralized storage, each block only stores a small part of the data, and then the data is encrypted to achieve the purpose of privacy protection. This distributed storage and computing approach is resource intensive. Researchers also adopt a blockchain database to store an encrypted form of personal private data, but when the blockchain database is constructed, some plaintext is still reserved to achieve identification of the data, and data confidentiality cannot be completely achieved. And researchers encrypt medical data, and only patients can decrypt the encrypted data, but the blockchain system also exposes some plaintext information, so that malicious users can search and destroy the data, and the ability of privacy protection is not thorough. Researchers also propose a block chain data privacy protection mechanism based on searchable encryption, but the search efficiency is not high, and the block chain data privacy protection mechanism is only suitable for safe storage of small data volume.

In summary, the prior art mainly has the following disadvantages: 1. the transaction sheet uploaded to the block chain is only suitable for storing a small amount of plaintext data, and network transmission consumption is large. 2. The safety protection strength of the data stored in the block chain database is not enough, and some plaintext transaction information is revealed. 3. The traditional public key encryption method has the problems of difficult digital certificate management and overlarge consumption of computing and storing resources.

Disclosure of Invention

The invention provides a searchable encryption method and system for a block chain transaction keyword, which aim to solve the technical problems of encrypted storage and effective query of sensitive transaction data on a block chain and difficulty in certificate management of a traditional Public Key Infrastructure (PKI) password system.

In order to solve the technical problems, the invention provides the following technical scheme:

in one aspect, the present invention provides a searchable encryption method for a blockchain transaction keyword, including:

acquiring the information of a transaction order uploaded by a current user; the transaction list information comprises files to be uploaded by a current user, keywords of the files, an identity public key and an identity private key;

compressing the file, encrypting the compressed file by using the identity identification public key, and digitally signing the hash value of the current transaction order to be constructed by using the identity identification private key; carrying out searchable encryption processing on the keywords by using a searchable encryption algorithm; to complete construction of the current transaction order;

completing the trade order uplink processing based on the constructed trade order; establishing a mapping relation between keywords which are stored in a current uplink trade list and are subjected to searchable encryption processing and corresponding block serial numbers in an index structure;

and acquiring a search keyword input by a current user, searching a block corresponding to the search keyword by using the index structure according to the search keyword, and returning a search result to the current user.

Further, the construction of the completion current transaction order includes:

and storing the timestamp, the serialized encrypted file, the keyword which can be searched and encrypted, the identity identification public key and the digital signature of the hash value of the transaction order into the transaction order to complete the construction of the current transaction order.

Further, the build-based transaction order completes a transaction order uplink process, comprising:

after the current block chain link point packs the transaction list constructed in a period of time, adding a voting state code in a pre-preparation state to form voting information;

the current block chain node sends the voting information to other nodes in the block chain for PBFT consensus verification, the other nodes in the block chain receive the voting information and sequentially verify the transaction sheets in the voting information, and if the verification is passed, an accounting node is elected; if the verification fails, returning the current transaction list and not recording the current transaction list into a block;

and constructing a new block by the accounting right node selected by PBFT consensus and broadcasting the new block to other nodes, verifying the transaction list contained in the new block by the node receiving the broadcast information, receiving the new block after the verification is valid, and adding the new block at the tail of each block chain.

Further, acquiring a search keyword input by a current user, searching a block corresponding to the search keyword by using the index structure according to the search keyword, and returning a search result to the current user, including:

acquiring a search keyword input by a current user, and carrying out searchable encryption processing on the search keyword by using a searchable encryption algorithm to generate a trapdoor corresponding to the search keyword;

matching the trapdoor with the index structure, checking a corresponding block if the trapdoor is successfully matched, and returning a matching transaction list; and if the trapdoor matching fails, returning no corresponding file.

Further, acquiring a search keyword input by a current user, searching a block corresponding to the search keyword by using the index structure according to the search keyword, and returning a search result to the current user, further comprising:

and after the matched transaction order is returned, verifying the digital signature of the transaction order, decrypting the encrypted file through the identity identification key after the verification is passed, and decompressing to obtain a corresponding plaintext file.

In another aspect, the present invention also provides a blockchain transaction keyword searchable encryption system, which includes:

the transaction order information acquisition module is used for acquiring the transaction order information uploaded by the current user; the transaction list information comprises files to be uploaded by a current user, keywords of the files, an identity public key and an identity private key;

the data encryption module is used for compressing the file, encrypting the compressed file by using the identity identification public key and digitally signing the hash value of the current transaction order to be constructed by using the identity identification private key; carrying out searchable encryption processing on the keywords by using a searchable encryption algorithm;

the trade list uplink module is used for completing the construction of the current trade list and completing the trade list uplink processing based on the constructed trade list;

the index construction module is used for establishing a mapping relation between keywords which are stored in a current uplink trade list and are subjected to searchable encryption processing and corresponding block serial numbers in an index structure;

and the trade list downlink module is used for acquiring the search keywords input by the current user, searching the blocks corresponding to the search keywords by using the index structure according to the search keywords, and returning the search results to the current user.

Further, the process of completing the current trade list construction by the trade list uplink module comprises the following steps:

Further, the process of the transaction list uplink module completing the transaction list uplink processing based on the constructed transaction list comprises the following steps:

Further, the trade order downlink module is specifically configured to:

Further, the trade order downlink module is further configured to:

In yet another aspect, the present invention also provides an electronic device comprising a processor and a memory; wherein the memory has stored therein at least one instruction that is loaded and executed by the processor to implement the above-described method.

In yet another aspect, the present invention also provides a computer-readable storage medium having at least one instruction stored therein, the instruction being loaded and executed by a processor to implement the above method.

The technical scheme provided by the invention has the beneficial effects that at least:

1. the method of the invention compresses the file uploaded to the block chain transaction list by the user and then carries out encryption storage, thereby saving the storage space of the block chain and simultaneously reducing the data volume of network transmission;

2. the method of the invention carries out searchable encryption processing on the keywords in the transaction list, increases the security, ensures the privacy of the user and can effectively realize the keyword query;

3. the method of the invention uses the identification cryptographic algorithm to encrypt the plaintext data in the transaction order and digitally signs the hash value of the transaction order through the identification cryptographic algorithm, thus solving the problems of difficult certificate management and resource waste of the traditional PKI public key cryptographic system.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a flowchart of a blockchain transaction keyword searchable encryption method provided by an embodiment of the present invention;

FIG. 2 is a diagram of a system model provided by an embodiment of the invention;

FIG. 3 is a block diagram according to an embodiment of the present invention;

FIG. 4 is an interactive diagram of a transaction Single uplink process according to an embodiment of the present invention;

fig. 5 is a process interaction diagram of a user searching a transaction order provided by an embodiment of the invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First embodiment

The embodiment provides a searchable encryption method for a blockchain transaction keyword, which can be implemented by an electronic device, and the electronic device can be a terminal or a server. The execution flow of the block chain transaction keyword searchable encryption method is shown in fig. 1, and includes the following steps:

s101, acquiring transaction list information uploaded by a current user; the transaction list information comprises files to be uploaded by a current user, keywords of the files, an identity public key and an identity private key;

s102, compressing the file, encrypting the compressed file by using an identity public key, and digitally signing the hash value of the current transaction order to be constructed by using an identity private key; carrying out searchable encryption processing on the keywords by using a searchable encryption algorithm; to complete construction of the current transaction order;

s103, completing the trade list uplink based on the constructed trade list; establishing a mapping relation between the keywords which are stored in the current transaction list and are encrypted by searching and the corresponding block serial numbers in an index structure;

and S104, acquiring the search keyword input by the current user, searching the block corresponding to the search keyword by using the index structure according to the search keyword, and returning the search result to the current user.

In summary, the method of this embodiment encrypts and signs the transaction order file using the identification cryptographic algorithm, processes the transaction order keyword using the searchable encryption algorithm, and stores the encrypted file, the digital signature, and the processed keyword together in the transaction order of the block chain, so that they are effectively combined with the block, and an index is set. Therefore, the problems of encrypted storage and effective query of sensitive transaction data on a block chain and the difficulty in certificate management of a traditional Public Key Infrastructure (PKI) cryptosystem are solved. The safety and the privacy of the transaction data of the blockchain user are effectively guaranteed, and reliable platform-level safety service is provided for the application of the blockchain technology in a high-privacy scene.

Second embodiment

The embodiment provides a searchable encryption method for a blockchain transaction keyword, which can be implemented by an electronic device, and the electronic device can be a terminal or a server. The execution flow of the blockchain transaction keyword searchable encryption method is shown in fig. 2, the blockchain transaction keyword searchable encryption method is shown in fig. 3, and the method comprises the following steps:

step one, initialization: including searchable encryption algorithm parameters and blockchain ledger database initialization.

1. Initializing parameters of a searchable encryption algorithm, and storing the parameters to a local file; the searchable encryption algorithm includes the following parameters to be initialized: the product primeM of two randomly generated 512-bit prime numbers, the generator g, and the euler function value fainM of primeM.

2. Initializing the block chain account database, constructing block chain creation blocks, storing the block chain creation blocks into the block chain database after serialization, wherein the number of the initialized blocks is 0, and calculating and storing the hash value of the block head of the creation block.

Step two, the trade list uplink, as shown in fig. 4, includes trade list construction, voting information construction, Practical Byzantine Fault Tolerance (PBFT) consensus, and block warehousing.

1. And (4) constructing a transaction list, and inputting an original file to be uploaded, a keyword of the file, an identification public key and an identification private key by a user. Compressing the original file by a compression algorithm, and encrypting the compressed file by using an identity identification public key; the searchable encryption algorithm parameters are read from the local file, and searchable encryption processing is carried out on the keywords; then storing five parts of information such as a timestamp, a serialized encrypted file, a keyword which can be searched and encrypted, an identity identification secret key, a signature of a hash value of the transaction order and the like into the transaction order, and transmitting the transaction order to a block chain node; wherein the searchable encryption processing includes: the first prime number t1, which is larger than the key hash value, is taken as the searchable encryption processing result t2 ≡ g ^ t1(mod primeM).

2. And the block link point packs the transaction list constructed in a period of time and adds a voting state code in a pre-preparation state to form voting information.

3. PBFT consensus, namely sending the voting information to other nodes in the block chain to carry out PBFT consensus verification, receiving the voting information by the other nodes in the block chain, sequentially verifying the transaction sheets in the voting information and electing accounting nodes, if the verification is passed, indicating that the data has no problem, and modifying the voting state code of the voting information into a ready state and forwarding the ready state; if the verification is not passed, the data is tampered, and the transaction list is returned and is not recorded in the block. If the number of the nodes with correct verification results is larger than the minimum confirmation number, the voting state code of the voting information is modified into a submission state; otherwise, the uploaded transaction list is indicated to have a problem and needs to be uploaded again to be verified.

4. And (3) warehousing the blocks, constructing the blocks by the accounting right nodes selected by the PBFT consensus after the PBFT consensus: and storing the transaction list in the voting information into a block, reading the block number in the database and the hash value of the previous block head, storing the block number and the hash value of the previous block head into a block head, and then storing a time stamp, a version number, a random number and the Merkle tree root of the hash value of the transaction list. And storing the block body and the block head into the block, and storing the serialized block into a database. And updating the block sequence number and the hash value of the last block head. The node which obtains the accounting right broadcasts the new block to other nodes in the network, the node which receives the broadcast information verifies the transaction order contained in the block, receives the block after the verification is valid, and connects the new block at the tail of each block chain.

5. And the uplink result is returned to the user by the node.

And step three, index construction.

The node uses the list as an index structure, as shown in table 1, and uses the processed keyword t2 stored in each transaction list as an index, and locates the corresponding block sequence number from different t2, updates the block sequence number in time, and stores the block sequence number in the database.

Table 1 index structure

Further, referring to fig. 5, the method of the present embodiment further includes the following steps:

step four, keyword search.

The user inputs keywords to be searched, reads primeM, g and fainM from the local file, and processes the searched keywords by using the primeM, g and fainM: taking the first prime number s1 larger than the hash value of the search value, let s2 be the modular inverse of s1 with respect to fainM, i.e., s1 ≡ 2 ≡ 1(mod fainM), and s3 be 512 randomly generated bits, then s4 ≡ s2 ≡ s3, s5 ≡ g ≡ s3(mod primeM), and generating a trap gate (primeM, s4, s5) and transmitting the trap gate to the node.

And step five, matching the trap door.

The block chain node sink gate matches the index structure in the database, i.e., calculates whether t2^ s4(mod primeM) and s5 are equal.

And step six, transaction list downlink.

If the trapdoor matching is successful, obtaining the corresponding block serial number, and checking the blocks (verifying the integrity, namely checking the hash of the block from the back, checking the hash of the whole block by the hash of the previous block stored in the next block, and calculating the hash comparison of the block head again; if the matching fails, no result is returned. And after the user verifies the signature of the returned transaction order, the encrypted file in the transaction order is decrypted by adopting the identity identification secret key and then decompressed to obtain an initial file.

Third embodiment

The embodiment provides a blockchain transaction keyword searchable encryption system, which includes the following modules:

The block chain transaction keyword searchable encryption system of the present embodiment corresponds to the block chain transaction keyword searchable encryption method of the first embodiment; the functions realized by the functional modules in the blockchain transaction keyword searchable encryption system of the embodiment correspond to the flow steps in the blockchain transaction keyword searchable encryption method of the first embodiment one to one; therefore, it is not described herein.

Fourth embodiment

The present embodiment provides an electronic device, which includes a processor and a memory; wherein the memory stores at least one instruction, and the instruction is loaded and executed by the processor to implement the method of the above embodiment.

Of course, the electronic device may have a large difference due to different configurations or performances, and may include one or more processors (CPUs) and one or more memories.

The electronic device of the embodiment encrypts and signs the transaction order file by using the identification cryptographic algorithm, processes the keyword of the transaction order by using the searchable encryption algorithm, stores the encrypted file, the digital signature and the processed keyword into the transaction order of the block chain together, effectively combines the encrypted file, the digital signature and the processed keyword with the block chain, and sets the index. Therefore, the problems of encrypted storage and effective query of sensitive transaction data on a block chain and the difficulty in certificate management of a traditional Public Key Infrastructure (PKI) cryptosystem are solved. The safety and the privacy of the transaction data of the blockchain user are effectively guaranteed, and reliable platform-level safety service is provided for the application of the blockchain technology in a high-privacy scene.

Fifth embodiment

The present embodiment provides a computer-readable storage medium, which stores at least one instruction, and the instruction is loaded and executed by a processor to implement the method of the above embodiment. The computer readable storage medium may be, among others, ROM, Random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like. The instructions stored therein may be loaded and executed by a processor in the terminal.

The method stored in the storage medium of this embodiment encrypts and signs a transaction order file using an identification cryptographic algorithm, processes a transaction order keyword using a searchable encryption algorithm, and stores the encrypted file, a digital signature, and the processed keyword together in a transaction order of a block chain, so that they are effectively combined with a block, and an index is set. Therefore, the problems of encrypted storage and effective query of sensitive transaction data on a block chain and the difficulty in certificate management of a traditional Public Key Infrastructure (PKI) cryptosystem are solved. The safety and the privacy of the transaction data of the blockchain user are guaranteed, and reliable platform-level safety service is provided for the application of the blockchain technology in a high-privacy scene.

Furthermore, it should be noted that the present invention may be provided as a method, apparatus or computer program product. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied in the medium.

Embodiments of the present invention are described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, embedded processor, or other programmable data processing terminal to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal to cause a series of operational steps to be performed on the computer or other programmable terminal to produce a computer implemented process such that the instructions which execute on the computer or other programmable terminal provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It should also be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or terminal that comprises the element.

Finally, it should be noted that while the above describes a preferred embodiment of the invention, it will be appreciated by those skilled in the art that, once the basic inventive concepts have been learned, numerous changes and modifications may be made without departing from the principles of the invention, which shall be deemed to be within the scope of the invention. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the embodiments of the invention.

Claims

1. A blockchain transaction keyword searchable encryption method, the method comprising:

2. The blockchain transaction key searchable encryption method of claim 1, wherein said completing construction of the current transaction order comprises:

3. The blockchain transaction key searchable encryption method of claim 2, wherein the structured-based transaction order completes a transaction order uplink transaction comprising:

4. The method for encrypting the searchable keyword according to claim 1, wherein the step of obtaining a search keyword input by a current user, searching for a block corresponding to the search keyword by using the index structure according to the search keyword, and returning a search result to the current user comprises:

5. The blockchain transaction keyword searchable encryption method according to claim 4, wherein a search keyword input by a current user is acquired, and according to the search keyword, a block corresponding to the search keyword is searched by using the index structure, and a search result is returned to the current user, further comprising:

6. A blockchain transaction keyword searchable encryption system, the system comprising:

7. The blockchain transaction key searchable encryption system of claim 6, wherein the process of the transaction slip uplink module completing current transaction slip construction comprises:

8. The blockchain transaction key searchable encryption system of claim 7, wherein the transaction uplink module completing the transaction uplink process based on the constructed transaction order comprises:

9. The blockchain transaction key searchable encryption system of claim 6, wherein the transaction order downlinking module is specifically configured to:

10. The blockchain transaction key searchable encryption system of claim 9, wherein the transaction order downlinking module is further to: