CN113868708A

CN113868708A - Double-chain architecture-based method and equipment for safely sharing monitorable data

Info

Publication number: CN113868708A
Application number: CN202111471620.XA
Authority: CN
Inventors: 马兆丰; 张宇青; 刘霄; 段鹏飞; 刘嘉微; 王姝爽
Original assignee: Beijing University of Posts and Telecommunications
Current assignee: Beijing University of Posts and Telecommunications
Priority date: 2021-12-03
Filing date: 2021-12-03
Publication date: 2021-12-31
Anticipated expiration: 2041-12-03
Also published as: CN113868708B

Abstract

The invention provides a method and equipment for safely sharing supervisable data based on a double-chain architecture, wherein the method comprises the following steps: the data receiving party generates a retrieval trapdoor according to the keywords and sends a retrieval request to the cloud server; the cloud server verifies the validity of the data receiver through the supervision chain; if not, rejecting the search request; if the retrieval request is legal, forwarding the retrieval request to a data chain; the data chain matches the retrieval trapdoor with the retrieval index on the data chain; if the matching is passed, the matched data provider identity information and the linked data content are sent to a cloud server; the cloud server verifies the validity of the data provider through the supervision chain; if not, rejecting the search request; if the key is legal, the cloud server searches the proxy re-encryption key ciphertext and the upload data ciphertext according to the content of the linked data and returns the key ciphertext and the upload data ciphertext to the receiver; the data receiving party decrypts the proxy re-encrypts the key ciphertext to decrypt the upload data ciphertext. By the scheme, data privacy safety can be guaranteed, and data supervision is realized.

Description

Double-chain architecture-based method and equipment for safely sharing monitorable data

Technical Field

The invention relates to the technical field of block chains, in particular to a method and equipment for safely sharing monitorable data based on a double-chain architecture.

Background

With the rapid development of new-generation information technology, the property attribute, data ownership, data liquidity, and explicit and implicit values brought by large-scale, high-density and multi-dimensional data are increasingly improved. At present, the global data volume is exponentially increased, but the development of the big data industry is facing the data island dilemma of 'data is available to people and lacking data', which seriously restricts the release of data value. In order to solve the dilemma faced by the development of the data industry and improve the sharing value of data, a plurality of data sharing methods are carried out.

In order to release the pressure of mass data storage, transferring data storage and shared applications to the cloud is the choice of many current users, and an important data interaction mode is gradually formed, but at the same time, many risks are brought, such as data loss, privacy disclosure, and out-of-control use.

The blockchain is a distributed account book database in a P2P (person-to-person) network, is composed of data blocks generated by encryption, has the characteristics of non-tampering, traceability, programmability and the like, and promotes the safe sharing of data, so that users can jointly maintain a non-tampering account book without a credible third party, and the prosperity and development of sharing economy are promoted.

The blockchain also brings privacy disclosure risks while ensuring that data is not falsifiable and traceable. In order to protect privacy and security, users usually choose to uplink encrypted data, and the encrypted data makes the uplink data difficult to supervise, so that some bad content cannot be supervised and processed once uplink is performed, which inevitably pollutes the environment of data sharing. In order to build a safe and healthy data sharing environment of block chain data, a regulatory agency should be able to perform regulatory scrutiny on the chain data to ensure that the data retained or shared on the chain meets legal requirements, and thus for encrypted data, the regulatory agency needs a feasible regulatory scheme.

Therefore, it is of great significance to research a data sharing scheme supporting supervision, and construct a block chain-based secure and supervisable data sharing framework to meet the security requirements of data constraint, data opening, data sharing and transparent supervision.

Disclosure of Invention

In view of this, the present invention provides a method and a device for secure sharing of monitorable data based on a double-chain architecture, so as to achieve data monitoring while ensuring data privacy security.

In order to achieve the purpose, the invention is realized by adopting the following scheme:

according to an aspect of the embodiments of the present invention, there is provided a method for secure sharing of supervisable data based on a double-chain architecture, including:

the data receiving party generates a retrieval trapdoor for a set keyword contained in the data to be acquired according to the access structure of the data receiving party, and sends a retrieval request containing the retrieval trapdoor to the cloud server; the access structure comprises attribute information of data receivers and the relationship between the attribute information and the data receivers;

after receiving the retrieval request, the cloud server verifies the validity of the data receiver through a supervision chain which stores the validity state information of the data receiver in advance;

if the data receiver is illegal, the cloud server refuses the retrieval request of the data receiver; if the data receiver is legal, the cloud server forwards the retrieval request to a data chain;

the data chain matches the retrieval trap door in the retrieval request with a retrieval index which is stored on the data chain, is generated on the basis of a target attribute set and corresponds to the uploaded data of a data provider;

if the matching is passed, the data chain sends the identity information of the data provider corresponding to the matched retrieval index and the retrieval result of the corresponding data content on the data chain to the cloud server;

the cloud server verifies the validity of the corresponding data provider according to the identity information of the data provider in the retrieval result through a supervision chain which stores the validity state information of the data provider in advance;

if the data provider is illegal, the cloud server refuses the retrieval request of the data receiver; if the data provider is legal, the cloud server sends return information which comprises the identity information of the data provider in the pre-stored retrieval result, a proxy re-encryption key ciphertext generated by re-encrypting the corresponding data content on the data chain by using the proxy re-encryption key and a corresponding uploaded data ciphertext to the data receiver;

the data receiving party decrypts the proxy re-encryption key ciphertext in the return information by using the key generated by the data receiving party based on the key parameter, the public key parameter and the access structure to obtain a symmetric encryption key of the uploaded data ciphertext in the return information, and decrypts the uploaded data ciphertext by using the symmetric encryption key to obtain a corresponding data plaintext.

According to another aspect of the embodiments of the present invention, there is provided an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method according to any of the above embodiments when executing the program.

According to a further aspect of embodiments of the present invention, there is provided a computer-readable storage medium, on which a computer program is stored, which when executed by a processor, performs the steps of the method of any of the above embodiments.

The method, the electronic equipment and the computer readable storage medium for safely sharing the monitorable data based on the double-chain architecture realize the double-chain architecture based on the monitoring chain and the data chain, can ensure the data privacy, can monitor the data provider and the data receiver, and can realize the data monitoring under the condition of ensuring the data privacy safety.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts. In the drawings:

fig. 1 is a schematic flowchart of a method for secure sharing of supervisable data based on a dual-chain architecture according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a double-chain architecture-based supervised data security sharing model according to an embodiment of the present invention;

FIG. 3 is a diagram of a dual chain architecture and including roles in accordance with an embodiment of the present invention;

FIG. 4 is a schematic diagram illustrating a key generation process of a user and a supervisor according to an embodiment of the present invention;

FIG. 5 is a diagram illustrating a structure of a user hierarchical key tracking tree according to an embodiment of the present invention;

FIG. 6 is a schematic view of a double stranded RBC structure according to one embodiment of the present invention;

FIG. 7 is a schematic diagram of a data sharing process of a method for secure shareable data according to an embodiment of the present invention;

FIG. 8 is a diagram illustrating the structure of a double-stranded DBC according to an embodiment of the present invention;

fig. 9 is a schematic diagram of a data supervision flow of a method for supervising data security sharing according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. The exemplary embodiments and descriptions of the present invention are provided to explain the present invention, but not to limit the present invention.

The existing centralized scheme has the problems of data lack of credibility, data flow direction is not transparent, and responsibility tracing is difficult afterwards, and how to fully utilize the characteristics that a block chain cannot be tampered and can be traced is a technical problem to be solved. In the existing data sharing scheme, the realization of data sharing between a shared data provider and a user requires multiple interactions of the two parties, so that the data provider must be online in real time in the data sharing process, and how to ensure that a user can be offline after uploading data and the data sharing process is not influenced is a technical problem to be solved. In order to protect data privacy and security, a user generally encrypts data and uploads the encrypted data to a block chain, so that the data on the chain is difficult to supervise. The cloud storage of mass data becomes a common data interaction mode for users to share data, but some potential safety hazards are brought, and how to safely store and share data is avoided.

In order to solve the problems of low data reliability, opaque data flow direction, difficulty in tracing responsibility afterwards and the like in a data sharing scheme in the prior art, the embodiment of the invention provides a supervised data security sharing method based on a double-chain architecture, wherein a double-chain structure (comprising a supervision chain RBC and a data chain DBC) is designed to ensure that data cannot be tampered and traceable, a user key tracing tree is constructed to facilitate a supervisor to supervise and trace responsibility for data contents and users, data is encrypted and shared by using an attribute-based proxy re-encryption algorithm supporting keyword retrieval, and a flexible access control and security sharing environment is provided.

Fig. 1 is a schematic flowchart of a method for secure sharing of supervisable data based on a dual-chain architecture according to an embodiment of the present invention, and referring to fig. 1, the method may include the steps of:

step S110: the data receiving party generates a retrieval trapdoor for a set keyword contained in the data to be acquired according to the access structure of the data receiving party, and sends a retrieval request containing the retrieval trapdoor to the cloud server; the access structure comprises attribute information of data receivers and the relationship between the attribute information and the data receivers;

step S120: after receiving the retrieval request, the cloud server verifies the validity of the data receiver through a supervision chain which stores the validity state information of the data receiver in advance;

step S130: if the data receiver is illegal, the cloud server refuses the retrieval request of the data receiver; if the data receiver is legal, the cloud server forwards the retrieval request to a data chain;

step S140: the data chain matches the retrieval trap door in the retrieval request with a retrieval index which is stored on the data chain, is generated on the basis of a target attribute set and corresponds to the uploaded data of a data provider;

step S150: if the matching is passed, the data chain sends the identity information of the data provider corresponding to the matched retrieval index and the retrieval result of the corresponding data content on the data chain to the cloud server;

step S160: the cloud server verifies the validity of the corresponding data provider according to the identity information of the data provider in the retrieval result through a supervision chain which stores the validity state information of the data provider in advance;

step S170: if the data provider is illegal, the cloud server refuses the retrieval request of the data receiver; if the data provider is legal, the cloud server sends return information which comprises the identity information of the data provider in the pre-stored retrieval result, a proxy re-encryption key ciphertext generated by re-encrypting the corresponding data content on the data chain by using the proxy re-encryption key and a corresponding uploaded data ciphertext to the data receiver;

step S180: the data receiving party decrypts the proxy re-encryption key ciphertext in the return information by using the key generated by the data receiving party based on the key parameter, the public key parameter and the access structure to obtain a symmetric encryption key of the uploaded data ciphertext in the return information, and decrypts the uploaded data ciphertext by using the symmetric encryption key to obtain a corresponding data plaintext.

In the step S110, the access structure includes the attribute information of the data receiver and the relationship between them, for example, the examination score of a certain subject of a student is accessed, and the attribute information may include school, college, class, student, subject, etc., and the access structure includes the attribute information and also embodies the association relationship between these information, for example, the student is at No. n … … at No. n certain class of school. When the data receiver needs to search data containing a set keyword (or called keyword), a search trapdoor can be generated for the keyword. The retrieval trapdoor can be generated based on the existing method, the retrieval trapdoor provides an entrance, and the access can be realized when the condition is met.

In step S120, the cloud server receives the retrieval request and also knows the information of the data receiver, so as to know which data receiver is, that is, to obtain the identity information of the data receiver. If the data receiver does not exist, or if the data receiver exists, the validity status information shows that the data receiver is illegal (or invalid), the data receiver is considered illegal. The newly added data receiver can register with the attribute authority, the chain of custody can record the relevant information of the data receiver, and the legality information of the data receiver can be marked as legal (or called as valid) at the beginning. The data receiving party can be informed by the user of the data monitoring party of the attribute authorization center to modify the validity information so as to play a monitoring role.

In a specific implementation, in step S120, that is, after receiving the retrieval request, the cloud server verifies the validity of the data receiver through the chain of custody storing the validity status information of the data receiver in advance, the method specifically includes the steps of: s121, the cloud server sends identity information of the data receiver to a supervision chain which stores validity state information of the data receiver in advance after receiving the retrieval request; and S122, the monitoring chain judges whether the corresponding data receiver exists on the data receiver according to the identity information of the data receiver and the validity state information of the corresponding data receiver is legal, if so, returns a legal verification result of the corresponding data receiver to the cloud server, and if not, returns an illegal verification result of the corresponding data receiver to the cloud server. In this embodiment, the validity of the data receiver may be verified by the chain of custody.

In the step S130, if the result is illegal, the cloud server may not continue to perform subsequent actions, or may send information rejecting the search request to the data receiver. In addition, access records may be recorded on the chain of custody. If the result is legal, the subsequent steps are continued.

In step S140, when the data provider newly joins, the data provider may upload the required information to the data chain, for example, may upload the data ciphertext (privacy information) and the corresponding search index to the data chain when newly joins. The index is generated based on the target attribute set and for the uploaded data (such as keywords therein), so that only the data receiver meeting the requirements of the target attribute set can request the data uploaded by the data provider. And if the access structure of the data receiver does not meet the requirement of the target attribute set, the uploaded data of the corresponding data provider cannot be accessed. For example, the target attribute set may be, for example, which schools and colleges that are allowed to access the uploaded data of the data provider only by the data receivers (access structure of which school ^ college). The data chain may store retrieval indexes corresponding to a plurality of uploaded data of one data provider, and may further include retrieval indexes of the uploaded data of a plurality of data providers, so that the retrieval indexes may be matched one by one, and if matching is consistent, a matching result is obtained. In step S150, after the search index is matched, it is known which data provider is, and then the corresponding identity information is known. The specific form of the identity information is not limited.

In step S160, if the data provider does not exist or if the data provider exists, the validity state information shows that the data provider is not valid (or invalid), the data provider is considered to be invalid. The newly added data provider can register with the attribute authority, the chain of custody can record the related information of the data provider, and the legality information of the data provider can be marked as legal (or called as valid) at the beginning. If the data provider is found to be illegal, the user of the data administrator can inform the attribute authorization center to modify the validity information of the data provider so as to play a role in supervision.

In a specific implementation, step S160, that is, the cloud server verifies the validity of the corresponding data provider according to the identity information of the data provider in the search result through the chain of custody storing the validity status information of the data provider in advance may specifically include the steps of: s161, the cloud server sends the identity information of the data provider to a supervision chain which stores the validity state information of the data provider in advance; and S162, the monitoring chain judges whether the corresponding data provider exists on the monitoring chain according to the identity information of the data provider and the validity state information of the corresponding data provider is legal, if so, the monitoring chain returns a legal verification result of the corresponding data provider to the cloud server, and if not, the monitoring chain returns an illegal verification result of the corresponding data provider to the cloud server. In this embodiment, the data provider's legitimacy may be verified by a chain of custody.

In the step S170, the cloud server may reject the retrieval request of the data receiver without any action, or may send information of rejecting the retrieval request to the data receiver. When a data provider is newly added, various required information can be uploaded to the cloud server, such as a symmetric encryption key ciphertext and an upload data ciphertext. The proxy re-encryption key ciphertext is generated by the cloud server through proxy re-encryption, for example, a symmetric encryption key (a key used for encrypting uploaded data) is encrypted by a key generated by the data provider for the data provider by using the attribute authorization center, and after the key ciphertext is uploaded to the cloud server, re-encryption by the proxy re-encryption key can be equivalent to re-computing a key used by the data provider for a data receiver conforming to the access condition, so that the cloud server can allow the data receiver conforming to the access control to directly decrypt the symmetric encryption key ciphertext.

In step S180, the key of the data receiver may be generated when it is newly added, for example, the attribute authority generates the key, and since the key and the proxy re-encryption key are generated based on the same parameters, the key on the data receiver may be used to decrypt the upload data ciphertext transmitted (i.e., requested) by the cloud server.

In some embodiments, the return information may also include respective data provider identity information and respective data content on the data chain. The method of fig. 1 may further include: s191, the data receiver calculates the hash value of the data plaintext obtained by decryption, and compares the calculated hash value with the uploaded data hash value corresponding to the data provider in the corresponding data content on the data chain; if the comparison is consistent, determining that the data plaintext obtained by decryption is the real data of the corresponding data provider; if the comparison is inconsistent, the data receiver sends reporting information containing the identity information of the corresponding data provider and the corresponding uploaded data ciphertext to the data supervisor of the corresponding data provider; s192, after the data supervisor of the data provider receives the report information, calculating key parameters based on the parameters which are transmitted to the supervisor and used for generating key parameters for the corresponding data provider, the retrieval path from the newly-added data provider to the corresponding data supervisor and the legality initial information of the newly-added data provider, decrypting the symmetric encryption key ciphertext by using the key parameters, and decrypting the upload data ciphertext corresponding to the identity of the data provider in the report information by using the obtained symmetric encryption key so as to judge the legality of the upload data of the corresponding data provider; and under the condition that the data is judged to be illegal, the data monitoring party sends a revocation notice to upload the information of which the corresponding data provider identity information is changed into illegal information to the monitoring chain.

In this embodiment, the data receiver can verify the authenticity of the uploaded data after receiving the data, and the required data can be uploaded to the data chain in advance. If the data is not real, the data can be reported to a data supervisor.

Further, in step S191, the data receiving side sends, to the data administrator of the corresponding data provider, report information including the identity information of the corresponding data provider and the corresponding upload data ciphertext, and more specifically, the method may include the steps of: s1911, the data receiving side sends reporting information containing the identity information of the corresponding data provider and the corresponding uploaded data cipher text to any data monitoring side; if any data supervisor is not the data supervisor of the corresponding data provider, the data supervisor of the corresponding data provider is found by the any data supervisor according to the mapping information between the data supervisor and the data provider, which is stored in advance, and the reporting information is forwarded to the data supervisor of the corresponding data provider.

In this embodiment, there may be multiple data supervisors, and different data providers may be supervised by the same or different data supervisors. The data receiving party can report to any data supervisor, and if the data supervisor does not directly supervise the corresponding data providing party, the reporting information can be forwarded.

In some embodiments, the method for secure sharing of policeable data based on a dual-chain architecture described in fig. 1 further includes:

s1111, a newly added data supervisor generates a public and private key pair and discloses a public key in the public and private key pair; the attribute authorization center generates a unique identity for the newly added data supervisor and a retrieval path from the attribute authorization center to the newly added data supervisor, so as to select the newly added data supervisor for the data provider and encrypt and transmit parameters for generating key parameters for the corresponding data provider to the selected newly added data supervisor by using the public key of the selected newly added data supervisor.

An attribute authorization center initializes and generates a public key parameter; a newly-added data provider holds an own access structure and sends a registration application to an attribute authorization center; the attribute authorization center selects a corresponding data supervisor for the newly added data provider after receiving the registration application, and generates a retrieval path from the newly added data provider to the corresponding data supervisor; the attribute authorization center generates a key parameter for the corresponding data provider according to a retrieval path from the newly added data provider to the corresponding data supervisor, the parameter which is transmitted to the supervisor and used for generating the key parameter for the corresponding data provider and the legality initial information of the newly added data provider; the attribute authorization center generates a key and a unique identity of the newly added data provider according to the key parameter, the initialized and generated public key parameter and the access structure of the newly added data provider; the attribute authorization center transmits the key of the newly added data provider to the newly added data provider, and uploads the registration record of the data provider to a supervision chain according to the unique identity of the data provider; the attribute authorization center encrypts and transmits parameters used for generating key parameters for the newly added data provider to a data supervisor of the newly added data provider; the registration record may include a unique identification of the user, validity initial information, registration time, and the like.

S1112, a newly-added data provider randomly generates a symmetric encryption key, and symmetrically encrypts uploaded data by using the symmetric encryption key to obtain an uploaded data ciphertext; newly adding a key transmitted by the data provider by using the attribute authorization center and encrypting the generated symmetric encryption key by using an attribute-based proxy re-encryption algorithm supporting keyword retrieval to obtain a symmetric encryption key ciphertext of the newly added data provider; newly adding a data provider, and generating an agent re-encryption key by taking a target attribute set of a data receiver to be shared as a limiting condition; the newly-added data provider uploads the uploaded data cipher text, the symmetric encryption key cipher text and the proxy re-encryption key to the cloud server; the cloud server uses the proxy re-encryption key to re-encrypt the symmetric encryption key ciphertext to obtain the proxy re-encryption key ciphertext of the symmetric encryption key, so that a data receiver confirmed to be legal by the cloud server can obtain the symmetric encryption key plaintext; and the newly added data provider selects keywords in the uploaded data to generate corresponding retrieval indexes, and uploads the metadata of the uploaded data, the retrieval indexes and the hash values of the uploaded data ciphertext to the data chain.

And S1113, the attribute authorization center generates a key for the newly added data receiver based on the key parameter, the public key parameter and the access structure of the newly accessed data receiver, and transmits the key generated for the newly added data receiver to the newly added data receiver, so that the newly added data receiver decrypts the uploaded data ciphertext, obtained from the cloud server, of the corresponding data provider by using the key generated for the newly added data receiver.

In some embodiments, the transaction to access the Data chain may be recorded on the Data chain in a transaction Data structure containing a transaction number (Tx ID), an Action (Action), identification information (identity), a user Role (Role), Data content (Data content), a Timestamp (Timestamp), and a validity Status (Status); transactions that access the chain of custody may be recorded in a transaction Data structure that contains a transaction number (Tx ID), an Initiator (Initiator), an Action (Action), identification information (identity), a user Role (Role), Data (Data), a Timestamp (Timestamp), and a validity Status (Status).

In some embodiments, if the data provider is legal, after the cloud server sends, to the data receiver, the return information including the proxy re-encryption key ciphertext generated by re-encrypting the identity information of the data provider in the retrieval result and the corresponding data content in the data chain, which are stored in advance on the data provider, and the corresponding upload data ciphertext, the method in fig. 1 may further include: and sharing and recording the uploaded data of the corresponding data provider to the corresponding data receiver on the supervision chain.

In some embodiments, the public key parameters may include: setting parameters of an effective elliptic curve, two groups with set orders, parameters of bilinear mapping, two generating elements of one group, parameters of a hash function and mapping of the generating elements; a random number used by the corresponding symmetric encryption key at the time of generation. The public key parameter can be generated by the attribute authorization center and is mainly used for generating keys for a data provider and a data receiver, and the corresponding symmetric key can be generated by the data provider and is not public and is used for encrypting data uploaded by the data provider.

The embodiment of the present invention further provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and when the processor executes the computer program, the steps of the method described in any of the above embodiments are implemented.

Embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the steps of the method according to any of the above embodiments.

The above method is described below with reference to a specific example, however, it should be noted that the specific example is only for better describing the present application and is not to be construed as limiting the present application.

Fig. 2 is a model of a supervised data security sharing method based on a double-chain architecture, fig. 3 is a double-chain architecture of a supervised data security sharing method and includes roles, fig. 4 is a key generation flow of a user and a supervisor of the supervised data security sharing method, fig. 5 is a user hierarchical key tracking tree of the supervised data security sharing method, fig. 6 is a double-chain RBC structure of the supervised data security sharing method, fig. 7 is a data sharing flow of the supervised data security sharing method, fig. 8 is a double-chain DBC structure of the supervised data security sharing method, and fig. 9 is a data supervision flow of the supervised data security sharing method. Fig. 2 shows a model of a supervised data security sharing method based on a dual-chain architecture, which includes a storage layer, a blockchain layer, a data layer, and a user layer. The storage layer utilizes a cloud server for storage, which is assumed to be a semi-honest server, i.e., following data sharing flow operations, but attempting to infer private information from the obtained data. The present invention utilizes a cloud server to store encrypted data from a data provider and other critical data for decryption and searching. The cloud server provides data uploading and downloading services for the invention, interaction with double chains and user identity authentication. A double-chain architecture is constructed by a block chain layer, and comprises a supervision chain RBC and a data chain DBC, as shown in FIG. 3, wherein the RBC is used for storing a secret key tracking record of a user and a shared record of private information, and verifying the identities of a data provider and a data receiver, so that the data and the user can be conveniently subjected to tracing and supervision after bad contents are linked, nodes of the RBC comprise high-credible institutions and nodes such as supervision departments, legal departments and government departments, and the DBC is used for storing key data of the data provider and a hash value of private information, so that the authenticity and integrity of the data can be conveniently verified after the data are received by the data receiver. The data layer mainly comprises various key data generated in the process of sharing the private information, including the private information, an uploaded data cipher text, a symmetric encryption key cipher text, an agent re-encryption key cipher text, a key retrieval index, a key retrieval trapdoor and the like. The user layer comprises main participation roles in the invention, and comprises an attribute authorization center, a data supervisor, a data provider and a data receiver, wherein the data provider and the data receiver are collectively called as data users.

In a system based on a double-chain architecture based method for safely sharing supervisable data, roles mainly comprise: the system comprises an attribute authorization center AA, a data supervisor DR, a data provider DO, a data receiver DU and a cloud server CS.

The attribute authorization center AA is a third-party trusted authority and is mainly responsible for generating system public parameters, a system master key, key parameters, an associated supervision path between a data supervisor and a user (including a data provider and the data supervisor), unique identifiers of the data supervisor and the user and a key of the user; meanwhile, when the illegal data content of the data provider reports that the verification is successful, the attribute authorization center AA has the right to revoke the position of the illegal data provider, and reallocates the position to the newly joined data provider and generates a key for the newly joined data provider.

The data monitoring party DR is a highly credible node and is a builder and a maintainer of a data security sharing health environment; in order to achieve effective supervision, a data supervisor has the ability to directly decrypt a symmetric encryption key that the data provider uses to encrypt information; when the supervision and accountability rules are triggered, namely the reporting information from the data receiving party is received, the data monitoring party plays the role of maintaining a healthy data sharing environment.

The data owner (data provider) DO is the holder of the shared private information; their keys are generated and distributed by the AA to the respective data supervisors for supervision; the data provider is mainly responsible for encrypting the private information by using a symmetric encryption algorithm, encrypting the symmetric encryption key by using an attribute proxy re-encryption algorithm (ABPRE-KS) supporting keyword retrieval, generating a re-encryption key, packaging all encrypted information and storing the encrypted information on the cloud server, and uploading the metadata, the keyword retrieval index and the hash value of the private information to the data chain DBC.

The data receiving party DU is a requester for sharing the privacy information; similar to data providers, their keys are generated by the AA and are also under the supervision of the respective regulators; when a data receiver wants to acquire certain private information, the data receiver firstly creates a retrieval trapdoor of a keyword to be retrieved and sends the retrieval trapdoor to a cloud server; after double identity validity verification, a key ciphertext re-encrypted by the key decryption cloud server CS generated by the attribute authorization center is used for obtaining a symmetric encryption key and further decrypting the symmetric encryption key to obtain privacy information of the data provider DO; in addition, the data receiver has the right to report illegal information contents to the data supervisor DR after decrypting the ciphertext.

The cloud server CS is a semi-honest server, i.e. follows the execution of each step of the sharing process, but keeps curious about the private data, and always tries to guess the plaintext private information of the data provider from the obtained data; the cloud server CS is mainly responsible for storing encrypted privacy information, symmetric encryption key ciphertexts, retrieval indexes of a data provider and agent re-encryption key ciphertexts, re-encrypting the symmetric encryption key ciphertexts, verifying the legality and validity of the user identity, and interacting with the double chains.

In an embodiment, a specific implementation manner of a method for secure sharing of supervisable data based on a double-chain architecture includes the following steps:

s1: and (5) initializing the system. The AA generates a system master key and public parameters. And the data supervisor generates a public and private key pair of the data supervisor and discloses a public key of the data supervisor. And the AA generates a unique identity and a feasible retrieval path for the data administrator according to the public key of the data administrator. For the data provider, the AA firstly negotiates a corresponding data administrator for the data provider and generates a retrieval path, then transmits the retrieval path to the corresponding data administrator to encrypt parameters and generate key parameters based on the parameters, the retrieval path and the node state, and generates a key and a unique identity for the data provider based on the key parameters, public parameters, an access structure (including an attribute set, such as students, colleges and classes; the access structure includes a hierarchical relationship of information in addition to attribute information) and other information. And finally, uploading the user registration record to the RBC for supervision.

In step S1, the encryption algorithm selected by the key tracking of the data administrator and the parameter encryption transmission between the data administrator and the AA is SM2 public key encryption algorithm, which is an elliptic curve public key encryption algorithm released by the national crypto-authority in 2010 at 12 months and 17 days. In addition, in order to generate a key of the data provider and ensure the supervision capability of the data administrator, in this embodiment, the data administrator generates a public and private key pair and then discloses the public key over the network, the AA encrypts the transmitted parameter with the public key of the data administrator (the parameter is used for generating a key parameter to directly decrypt a symmetric encryption key ciphertext generated by the data provider when the subsequent data administrator receives the report information), and simultaneously generates a search path of "AA → data administrator", "AA → data administrator → data provider", generates a key parameter for the data provider based on the parameter, the search path and the node state, and generates a key for the data provider based on information such as the key parameter, the access structure and the public parameter. Therefore, a layered key tracking tree is formed among the AA, the data supervisor and the data provider, the data supervisor can automatically infer the key parameters of the data provider according to the information interacted with the AA so as to realize supervision, and the data provider cannot infer the key of the supervisor and the keys of other data providers, even if the data provider is supervised by the same data supervisor.

In the above step S1, as shown in fig. 4, the attribute authority AA generates a system master key and a public parameter. The data supervisor DR generates its own public-private key pair and publishes its own public key. And the AA generates a unique identity and a feasible and effective retrieval path for the data administrator according to the public key of the data administrator. The key of the data provider (the key of the data provider is an attribute-based encryption key) is generated by the AA, the AA firstly negotiates a corresponding data supervisor for the data provider and generates a retrieval path, then the retrieval path is transmitted to the encrypted parameter of the corresponding data supervisor, and the key and the unique identity are generated for the data provider based on the information of the parameter, the retrieval path, the node state, the access structure and the like. And finally, uploading the user registration record to the RBC for supervision. The specific generation process is as follows:

1) the attribute authority AA first defines an effective elliptic curveF _q(q is an odd prime number and is greater than 3), two p-order groupsG ₁，G ₂And a bilinear map

Wherein, in the step (A),F _qis a cyclic group of order q,g ₁，g ₂is thatG ₁Then define a global property set and select three hash functions:H:{0,1}^*→Z_p ^*、H ₁:{0,1}^*→G ₁andH ₂:{0,1}^*→Z_p ^*wherein the hash functionNumber ofH:{0,1}^*→Z_p ^*A hash function representing a binary string of arbitrary length mapped to a group of integers of order p (other than 0),H ₁:{0,1}^*→G ₁mapping binary strings representing arbitrary lengths to p-th order groupsG ₁The hash function of (a) of (b),H ₂:{0,1}^*→Z_p ^*a hash function representing a binary string of arbitrary length mapped to a group of integers of order p (other than 0), with y e Z being randomly selected_p ^*Computing

Wherein, in the step (A),

representing a bilinear map calculation, y being an arbitrarily chosen number in a group of p-th order integers (other than 0), followed by selection for each attributet _i∈Z_p ^*Finally, the attribute authorization center AA generates a master key

,t _i} and common parameter-p,q,F _q ,G ₁ ,G ₂ ,g ₁ ,g ₂ ,

,H,H ₁ ,H ₂ ,Y,A _iWhere y is a randomly generated secret value,t _ithe public parameter is an attribute value generated for each attribute, and is mainly used for generating a key and a re-encryption key of a newly added data provider and a data receiver, encrypting and decrypting data shared data, generating a retrieval index containing a keyword and generating a retrieval trapdoor.

2) In this embodiment, a user hierarchical key tracking tree is introduced, as shown in fig. 5, which can ensure that the administrator has the right to directly authenticate and process the illegal user. Different key tracking strategies for different roles can be classified into the following two categories:

the key generation strategy of the supervisor i is as follows: the supervisor is assumed to be a highly trusted node, and the supervisor i first generates a random number d_DR∈[1,n-2]As a private key, its public key P is calculated_DRAnd the public key is published in the whole network, wherein the public key calculation formula is as follows:

P_DR=(x_P,y_P )=[d_DR ]G；

where G is a base point of the elliptic curve, n is the order of G, P_DRI.e. (x)_P,y_P) The data monitoring method is characterized in that points obtained by multiplying G points on an elliptic curve are public keys, subscript DR represents a data monitoring party, and p represents a public key.

Subsequently, the AA will generate a unique identity DR for the supervisor i_i,uidAnd corresponding search path_DRi。

Key generation policy for data provider j: in order to realize effective supervision of data and users, when a data provider node j is added, the AA negotiates with a supervisor to select a proper position and a corresponding supervisor i for the data provider node j, and a retrieval path from the AA to the data provider is generated_j. Subsequently, the AA will select a random parameter α of length klen for data provider j_i,j∈Z_p ^*For directly decrypting a symmetric encryption key generated by a data provider when a subsequent data supervisor receives a report message, wherein a subscript indicates that the data provider j is supervised by the supervisor i, and Z_p ^*Are groups of order p except 0. The AA then utilizes the public key P of the corresponding supervisor_DRParameter alpha is encrypted by SM2 encryption algorithm_i,jIs encrypted to obtain alpha_i,jParameter ciphertext C of_αi,jAnd sends it to the corresponding supervisor. Wherein, C_αi,jParameter alpha transmitted to data supervisor for attribute authority_i,jThe supervisor can decrypt the parameter to obtain the symmetric encryption key, and the subsequent data supervisor can decrypt the parameter to obtain the parameter when receiving the report information and uses the parameterThe symmetric encryption key is decrypted.

；

Wherein Enc_pke（P_DRi, α_i,j) Representation of utilization of data-supervisor public key P_DRiEncrypting the parameter alpha by a public key encryption algorithm_i,jThe subscript pke denotes a public key encryption algorithm. AA according to path_j、α_i,jAnd node state S_jGenerating a key parameter delta_jThe following were used:

；

wherein S is_jIndicating the state of the node, which has a normal value of 0, or 1 if the node has been revoked. In this embodiment, the initial values of the values are all 0, and it is assumed that the values are not revoked when being added, and the present invention only provides one opportunity of revoking the node. The user access structure contains attribute information of the user and their relationship. For holding access structure gamma_jThe data provider j, AA selects two random numbers r, r_i∈Z_p ^*And calculating:

；

to form the partial components of the data provider key, g1, g2 are p-th order groupsG ₁Y is a randomly generated secret value,t _iis the attribute value generated for each attribute,H ₁mapping binary strings representing arbitrary lengths to p-th order groupsG ₁Hash function of A_jAn attribute representing data provider j. Finally, the key of the data provider is integrated to form

And AA will generate a unique identity DO for it_j,uid。

3) To better perform the function of tracking illegal users, the AA is responsible for generating the relevant registration records and uploading to the RBC after generating the keys. This embodiment defines a transaction data structure on RBCs, as shown in table 1, where each transaction represents a registration record for a user.

TABLE 1 transaction data Structure on RBC

In the table, "ID" indicates a record number, "initiator" indicates who initiated or performed the operation, "Act" is an operation type, where "Re" is registration, "Un" is revocation, "Ve" is verification, "Sh" is sharing, "Identity" is a unique identifier of a registered user, "Role" is a type of the registered user, i.e., a supervisor or a Data user, "Data" includes a retrieval path from an AA to the supervisor or the Data user, "Timestamp" indicates a joining time of the registered user, and "St" is a node state, indicating that the state of the registered user is normal or revoked. On the RBC, a plurality of transaction data forms a transaction data block, and after performing hash calculation layer by layer, a Merkle root (Merkle root) hash value of all transaction data blocks is obtained and stored in a block chain block header, and finally a plurality of blocks are combined to form a block chain structure, as shown in fig. 6.

S2: and encrypting the private information. The data provider encrypts private information of the data provider by adopting a symmetric encryption algorithm to obtain a data ciphertext, and encrypts a symmetric encryption key by using an attribute-based proxy re-encryption algorithm (ABPRE-KS) supporting keyword retrieval to obtain the symmetric encryption key ciphertext.

In the step S2, the cloud server is used to solve the storage pressure of the mass data of the user, improve the flexibility of data sharing, but the semi-honest cloud server makes the data have the risk of privacy disclosure. In the embodiment, the data provider firstly encrypts the private information by using a symmetric encryption algorithm, and the symmetric encryption key is encrypted and transmitted by using an ABPRE-KS algorithm, so that the data of the data provider cannot be obtained by the semi-honest cloud server, and the security and the privacy of the data stored on the cloud are ensured.

In step S2, the symmetric encryption key for encrypting the private information is encrypted using the ABPRE-KS algorithm, which combines the attribute-based proxy re-encryption algorithm and the keyword search algorithm, so that the secure sharing of data in the ciphertext state is ensured, and only if the attribute set of the ciphertext satisfies the access structure in the user key, the data can be decrypted, thereby providing more flexible access control for data sharing between users.

In step S2, as shown in fig. 7, to ensure the data privacy, the data provider j first generates a random key sek_DOj∈Z_p ^*As a symmetric encryption key:

sek_DOj=random()；

and uses it to encrypt the private information M to obtain the data ciphertext C_data：

C_data=Enc_sym (sek_DOj,M)；

Wherein random () represents a random number generating function, Enc_sym（sek_DOjM) denotes the use of a symmetric encryption key sek_DOjThe information M is encrypted by a symmetric encryption algorithm, and the subscript sym denotes the symmetric encryption algorithm. Subsequently, in step S3 described later, based on the attribute set { A }_jPairs sek_DOjEncryption is performed using delta by the data provider j_jAnd (3) calculating:

C_key=sek_DOj⋅Y^δj；

C₁=g₁ ^δj；

C₂=g₂ ^δj；

C_3,j=H₁ (A_j )^δj。

form a key ciphertext C_ori={C_key,C₁,C₂,C_3,j}. Wherein, C_oriRepresents the symmetric encryption key ciphertext, delta, of the symmetric encryption key encrypted by the ABPRE-KS algorithm_jKey parameter, C, representing data provider j_keyRepresenting the ciphertext part encrypted by a symmetric encryption key, C₁、C₂、C_3,jFor the ciphertext part of the computation for access policy matching, A_jIs attribute information of the data provider j.

S3: a re-encryption key is generated. In order to restrict access to data of a data provider, the data provider sets a target attribute set of a recipient to be shared as a restriction condition to generate a corresponding re-encryption key.

In the above step S3, as shown in fig. 7, in order to restrict access to data of the data provider, it utilizes the target attribute set { a } of the receiver to be shared_kAnd generating a corresponding re-encryption key as a limiting condition. Holding access structure gamma_jData provider j of (1) selects l, v₁∈Z_p ^*,ξ∈G₂Generating a re-encryption key

：

。

Wherein, rek₁、rek₂、rek_3，j、rek_4，j、C₁' and j are re-encryption keysL, v₁Is a random number in a group with order p except 0, and xi is G₂Of (1).

S4: and generating a retrieval index. And when the attribute set of the ciphertext meets the access structure in the key of the data receiver, the access is allowed to acquire the privacy information of the data provider. The data provider selects the keywords related to the data to be shared and generates a keyword retrieval index. And then, the data provider packs the data ciphertext, the symmetric encryption key ciphertext and the proxy re-encryption key and sends the data ciphertext, the symmetric encryption key ciphertext and the proxy re-encryption key to the cloud server. Meanwhile, the data provider uploads the relevant metadata, the keyword retrieval index and the hash value of the privacy information to the DBC.

In step S4, the data provider uploads the hash values of the relevant metadata, the keyword search index, and the privacy information to the DBC, and the hash function may select the SHA256 hash algorithm, which ensures that the data receiver can perform hash calculation to verify the decrypted data after decrypting the privacy data to determine whether the data is tampered.

In step S4, as shown in fig. 7, the key index facilitates secure retrieval of private data in a ciphertext state and further facilitates data sharing when the attribute set { a } of the ciphertext is set_kAnd when the access structure in the key of the data receiver is satisfied, the request for accessing and acquiring the privacy data of the data provider is allowed. The data provider will select v₂∈Z_p ^*And generates a search index SI = { ksi) of the keyword w₀,ksi₁,ksi₂,ksi_3,k}：

Wherein, ksi₀,ksi₁,ksi₂,ksi_3,kIs a component of the search index, v₂Is a random number in a group of integers of order p except 0, A_kIs the attribute information of the data receiver k, and w is a keyword.

Subsequently, the data provider packs the data ciphertext C_dataSymmetric encryption key ciphertext C_oriAnd sending the proxy re-encryption key RK to the cloud server. Meanwhile, the data provider uploads the hash values of the related metadata, the key index and the privacy information Hash (M) to DBC. Where Hash () may select the SHA256 Hash algorithm with the transaction data structure on DBC as shown in table 2.

TABLE 2 transaction data structures on DBC

In the table, "ID" represents a record number, "Identity" represents a unique identifier of a user, "Role" represents a type of the user, that is, a Data provider or a Data receiver, "Data" includes information that is uploaded to a chain for storage and traceability, "Act" represents an operation type, where Up represents upload Data, Se represents search Data, "Timestamp" represents a joining time of a registered user, and "Sign" represents a signature of the Data user. A plurality of transaction data on the DBC form transaction data blocks, the mercker root hash values of all transaction data blocks are obtained through hash calculation layer by layer, and are stored in a block chain block header, and finally a plurality of blocks are combined to form a block chain structure as shown in fig. 8.

S5: and (5) encrypting the ciphertext again. After receiving the data sent by the data provider, the cloud server uses the re-encryption key to re-encrypt the symmetric encryption key ciphertext and stores the proxy re-encryption key ciphertext;

in step S5, the cloud server serves as a proxy server to re-encrypt the ciphertext, which provides a powerful computational support for the present invention. And the re-encryption task is finished by the cloud server, so that the data provider can be off-line after the data are uploaded, and real-time on-line waiting is not needed.

In step S5, as shown in fig. 7, the cloud server receives the data ciphertext C_dataSymmetric encryption key ciphertext C_oriRe-encrypting the symmetric encryption key data by using the re-encryption key after re-encrypting the proxy re-encryption key RK, and re-encrypting the proxy re-encryption key ciphertext

Storing the data in a cloud server;

。

wherein, C₂' for the data recipient to decrypt the symmetric encryption key ciphertext,

is a calculation formula for the bilinear mapping,

representing a continuous product.

S6: and generating a retrieval trapdoor. When a data receiver wants to obtain data containing a certain keyword, the data receiver generates a retrieval trapdoor of the keyword according to an access structure of the data receiver and sends a retrieval request and the trapdoor to a cloud server.

In the above step S6, as shown in fig. 7, when the corresponding access structure γ is held_kWhen the receiver k wants to obtain data containing a certain key w, he will select s e Z_p ^*And calculating to generate a retrieval trapdoor

：

Wherein, γ_kFor access structure of data receiver, std₁、std_2,k、std_3,k、std₄For each component of the search trapdoor generated by data provider k, s is a random number in a group of integers of order p except 0,

are the parts that make up the data receiver k key.

And then the data receiver sends a retrieval request and the trapdoor to the cloud server.

S7: and detecting the validity of the trap door. In order to ensure the legal access to the data, the cloud server firstly verifies the legality of the data receiver through the RBC. If the receiver does not exist or its status value is 1 (revoked), RBC returns ≠ to cloud server, otherwise cloud server will send retrieval request to DBC, and the node on the chain will match the retrieval index and retrieval trap on its copy first. And if the matching is passed, the trapdoor is proved to be effective, and the DBC sends the retrieval result and the data content on the related chain to the cloud server. And then, the cloud server verifies the identity validity of the provider of the retrieved data to the RBC, if the verification is passed, the cloud server sends a re-encryption key ciphertext and a data ciphertext to a data receiver and uploads the shared record to the RBC, and if not, the cloud server outputs the value of T.

In step S7, the RBC performs double authentication on the identities of the data provider and the data receiver, so that it is ensured that a user who uploads illegal data content and has a revoked authority cannot upload data any more, cannot share data of another person, and cannot share uploaded data any more.

In step S7, as shown in fig. 7, to ensure legitimate access to the data, the cloud server first verifies the validity of the receiver through the RBC. If the receiver does not exist or the state value of the receiver is 1, the RBC returns ≠ to the cloud server, otherwise, the cloud server sends a retrieval request to the DBC, as shown in Table 2. Then a node on the DBC will first match the index and retrieve the trapdoor on its ledger. The matching algorithm is as follows:

wherein the content of the first and second substances,

representing a continuous product. And if the algorithm is matched, the trap door is proved to be effective, and the DBC sends the retrieval result and the data content on the related chain to the cloud server. Thereafter, the cloud server verifies the identity validity of the provider of the retrieved data to the RBC, and if the verification is passed, it sends a re-encryption key ciphertext C_reencAnd data ciphertext C_dataAnd (3) uploading the shared record to a data receiver, as shown in table 3, wherein "st" represents a verification result, the pass is 0, otherwise, the output is ×, and "st" is 1.

TABLE 3 transaction data Structure on RBC

S8: and decrypting the re-encrypted ciphertext. And after receiving the data ciphertext and the re-encrypted ciphertext, the data receiver decrypts the re-encrypted ciphertext by using the key generated by the attribute authorization center to obtain a symmetric encrypted key, decrypts the uploaded data ciphertext by using the key, and finally obtains the privacy information of the data provider. Meanwhile, in order to ensure the integrity and authenticity of the data, the receiver can perform hash calculation on the private information obtained by decryption and compare the private information with the data on the DBC, and if the private information is consistent with the data on the DBC, the receiver proves that the data is real data of a data provider.

In step S8, as shown in fig. 7, the data receiving side receives the data ciphertext C_dataAnd re-encryption key ciphertext C_reencThen, the key generated by the attribute authority is used to calculate xi:

subsequently decrypting the re-encrypted key ciphertext C_reencObtaining a symmetric encrypted key:

finally, the data receiver uses the key sek_DOjDecryption of private information M':

where M' represents the private information obtained after decryption, Dec_sym（sek_DOj,C_data) Representation using symmetric encryption key sek_DOjDecrypting data ciphertext C via symmetric encryption algorithm_dataThe subscript sym denotes a symmetric encryption algorithm. To ensure data integrity and authenticity, the receiver may perform Hash calculation on the decrypted data M 'to obtain a Hash value, and compare the Hash value with the data on the DBC, and if Hash (M') = Hash (M), prove that the data is really the true data of the data provider.

S9: data supervision and user accountability. The rule for triggering supervision accountability is that the supervision party receives the report of illegal contents of the privacy information from the data receiving party. And after the data receiver decrypts the private data of the data provider, the data ciphertext is judged, and if the data ciphertext is considered as illegal content, the data ciphertext is reported to the supervisor. After receiving the report, the supervisor decrypts the parameters sent by the AA by using the private key of the supervisor, calculates key parameters based on the parameters, the retrieval path from the newly-added data provider to the corresponding data supervisor and the legality initial information of the newly-added data provider, decrypts the symmetric encryption key ciphertext by using the key parameters, and further decrypts the symmetric encryption key ciphertext to obtain the privacy information of the data provider. The supervisor will then make a decision on the private information, and if it is determined that the rule is not legal, notify the AA to set the state of the corresponding data provider to 1, i.e., to cancel the state.

In step 9, the administrator is set to be highly trusted and has the ability to directly decrypt and verify the data content of the data provider. Once the data content of the data provider is verified to be illegal, the supervisor will inform the AA to revoke its rights, and when a new node joins, the AA will negotiate with the supervisor to assign the location to the new node and generate a key for it. There is a special case where the data receiver, after decrypting to obtain private data content, does not report it, though it is considered illegal. For the situation, the supervisor tracks all data receivers downloading the private information content before the reporting of the user through the RBC from the beginning of receiving the report of the data content from other users, performs key supervision on the data receivers, periodically checks whether the downloaded data is shared again, and once the data receivers are found, the authority of the data receivers is cancelled.

In the above step 9, as shown in fig. 9, after the data receiver k decrypts the private data of the data provider j, the data ciphertext is determined, and if the data ciphertext is considered as illegal content, the data ciphertext is reported to the supervisor. After receiving the report, the supervisor inquires the supervisor i directly related to the data provider j, and then the corresponding supervisor i firstly decrypts AA by using the private key thereof and sends a parameter ciphertext C to the supervisor i_αi,j：

Wherein, Dec_pke（d_DRi, C_αi,j) Representation of utilization of data supervisor private Key d_DRiDecrypting parameter ciphertext C via public key encryption algorithm_αi,jThe subscript pke denotes a public key encryption algorithm. Then supervisor i can follow path_j、α_i,jAnd the node state calculates to obtain the key parameter delta of the corresponding data provider j_jAnd then decrypted to obtain symmetric encryption key sek_DOj：

The supervisor utilizes sek_DOjAnd the private data M' of the data provider is decrypted, and the authenticity and the integrity of the data can be verified through the DBC, and the legality of the data can be judged. If the notification AA determines that the node is illegal, the notification AA sets the state of the corresponding data provider to S' = S +1, that is, 1, which indicates the node revocation status. Finally, the AA records a data provider key revocation operation on the RBC, which has the following structure:

TABLE 4 transaction data Structure on RBC

In this embodiment, a double-chain structure is designed, including a chain of custody RBC and a data chain DBC, where the chain of custody RBC is used to store a key generation record of a user and a shared record of private information, and verify identities of a data provider and a receiver, so as to facilitate tracing and monitoring of data and the user after chain linking of objectionable content, and the DBC is used to store key data of the data provider and a hash value of the private information, so as to facilitate verifying authenticity and integrity of the data after being received by a data receiver.

The implementation of the method for safely sharing the monitorable data based on the double-chain architecture has the following beneficial effects:

the block chain technology can well solve the problems that the traditional centralized scheme has poor data credibility, opaque data flow and difficulty in tracing after the fact. Compared with the traditional data sharing scheme based on the block chain, the data sharing method based on the block chain has the advantages that the double-chain structure is built, the double-chain structure comprises the monitoring chain RBC and the data chain DBC, the monitoring chain RBC and the data chain DBC are respectively used for recording different data, data can be monitored under the condition that data privacy and safety are guaranteed, and meanwhile, the data provider uploading illegal data content cannot participate in the data sharing process any more.

According to the invention, the private data is encrypted and then uploaded to the cloud server, and the cloud server is used as the proxy server to re-encrypt the data ciphertext, so that the powerful computing capability of the cloud server is fully utilized while the data leakage on the cloud is avoided, and meanwhile, the data provider does not need to be online in real time in multiple rounds of sharing interaction after uploading the data to the cloud server.

The invention encrypts data by using the ABPRE-KS algorithm, the algorithm provides safe sharing and flexible access control of the data in a ciphertext state for data sharing, and meanwhile, a data provider has a decision right on a user accessing the data of the data provider. Based on the algorithm, the invention introduces the user hierarchical key tracking tree into the algorithm, ensures that a supervisor can directly acquire and verify data content when implementing supervision and responsibility tracing, and provides a reasonable, direct and effective supervision mode for the supervisor.

In the description herein, reference to the description of the terms "one embodiment," "a particular embodiment," "some embodiments," "for example," "an example," "a particular example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. The sequence of steps involved in the various embodiments is provided to schematically illustrate the practice of the invention, and the sequence of steps is not limited and can be suitably adjusted as desired.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. A secure sharing method of supervisable data based on a double-chain architecture is characterized by comprising the following steps:

2. The double-chain architecture based policeable data secure sharing method of claim 1,

after receiving the retrieval request, the cloud server verifies the validity of the data receiver through a chain of custody storing validity state information of the data receiver in advance, and the method comprises the following steps:

the cloud server sends the identity information of the data receiver to a supervision chain which stores the validity state information of the data receiver in advance after receiving the retrieval request;

the monitoring chain judges whether a corresponding data receiver exists on the data receiver according to the identity information of the data receiver and the validity state information of the corresponding data receiver is legal, if so, returns a legal verification result of the corresponding data receiver to the cloud server, and if not, returns an illegal verification result of the corresponding data receiver to the cloud server;

the cloud server verifies the validity of the corresponding data provider according to the identity information of the data provider in the retrieval result through a supervision chain which stores the validity state information of the data provider in advance, and the method comprises the following steps:

the cloud server sends the identity information of the data provider to a supervision chain which stores the validity state information of the data provider in advance;

the monitoring chain judges whether the corresponding data provider exists on the monitoring chain according to the identity information of the data provider and the validity state information of the corresponding data provider is legal, if so, the verification result that the corresponding data provider is legal is returned to the cloud server, and if not, the verification result that the corresponding data provider is illegal is returned to the cloud server.

3. The double-chain architecture based supervisable data security sharing method according to claim 1, wherein the return information further comprises corresponding data provider identity information and corresponding data content on a data chain; the method further comprises the following steps:

the data receiving party calculates the hash value of the data plaintext obtained by decryption, and compares the calculated hash value with the uploaded data hash value corresponding to the data provider in the corresponding data content on the data chain; if the comparison is consistent, determining that the data plaintext obtained by decryption is the real data of the corresponding data provider; if the comparison is inconsistent, the data receiver sends reporting information containing the identity information of the corresponding data provider and the corresponding uploaded data ciphertext to the data supervisor of the corresponding data provider;

after receiving the report information, a data supervisor of the data provider calculates key parameters based on parameters which are transmitted to the supervisor and used for generating key parameters for the corresponding data provider, a retrieval path from a newly-added data provider to the corresponding data supervisor and the legality initial information of the newly-added data provider, decrypts a symmetric encryption key ciphertext by using the key parameters, and decrypts an upload data ciphertext corresponding to the identity of the data provider in the report information by using the obtained symmetric encryption key so as to judge the legality of upload data of the corresponding data provider; and under the condition that the data is judged to be illegal, the data monitoring party sends a revocation notice to upload the information of which the corresponding data provider identity information is changed into illegal information to the monitoring chain.

4. The double-chain architecture based supervisable data security sharing method of claim 3, wherein the data receiving party sends the report information including the identity information of the corresponding data provider and the corresponding upload data cipher text to the data supervisor of the corresponding data provider, comprising:

the data receiving party sends reporting information containing the identity information of the corresponding data provider and the corresponding uploaded data cipher text to any data monitoring party; if any data supervisor is not the data supervisor of the corresponding data provider, the data supervisor of the corresponding data provider is found by the any data supervisor according to the mapping information between the data supervisor and the data provider, which is stored in advance, and the reporting information is forwarded to the data supervisor of the corresponding data provider.

5. The double-chain architecture based secure shareable data method of claim 3, further comprising:

newly adding a data supervisor to generate a public and private key pair and disclosing a public key in the public and private key pair; the attribute authorization center generates a unique identity for a newly added data supervisor and a retrieval path from the attribute authorization center to the newly added data supervisor, so as to select the newly added data supervisor for a data provider and encrypt and transmit parameters for generating key parameters for the corresponding data provider to the selected newly added data supervisor by using a public key of the selected newly added data supervisor;

an attribute authorization center initializes and generates a public key parameter; a newly-added data provider holds an own access structure and sends a registration application to an attribute authorization center; the attribute authorization center selects a corresponding data supervisor for the newly added data provider after receiving the registration application, and generates a retrieval path from the newly added data provider to the corresponding data supervisor; the attribute authorization center generates a key parameter for the corresponding data provider according to a retrieval path from the newly added data provider to the corresponding data supervisor, the parameter which is transmitted to the supervisor and used for generating the key parameter for the corresponding data provider and the legality initial information of the newly added data provider; the attribute authorization center generates a key and a unique identity of the newly added data provider according to the key parameter, the initialized and generated public key parameter and the access structure of the newly added data provider; the attribute authorization center transmits a key of a newly added data provider to the newly added data provider, and uploads a registration record of the data provider to a supervision chain according to the unique identity of the data provider, wherein the registration record comprises the unique identity of a user, legal initial information and registration time; the attribute authorization center encrypts and transmits parameters used for generating key parameters for the newly added data provider to a data supervisor of the newly added data provider;

a newly added data provider randomly generates a symmetric encryption key, and symmetrically encrypts uploaded data by using the symmetric encryption key to obtain an uploaded data ciphertext; newly adding a key transmitted by the data provider by using the attribute authorization center and encrypting the generated symmetric encryption key by using an attribute-based proxy re-encryption algorithm supporting keyword retrieval to obtain a symmetric encryption key ciphertext of the newly added data provider; newly adding a data provider, and generating an agent re-encryption key by taking a target attribute set of a data receiver to be shared as a limiting condition; the newly-added data provider uploads the uploaded data cipher text, the symmetric encryption key cipher text and the proxy re-encryption key to the cloud server; the cloud server uses the proxy re-encryption key to re-encrypt the symmetric encryption key ciphertext to obtain the proxy re-encryption key ciphertext of the symmetric encryption key, so that a data receiver confirmed to be legal by the cloud server can obtain the symmetric encryption key plaintext; newly adding a data provider to select keywords in the uploaded data to generate corresponding retrieval indexes, and uploading metadata of the uploaded data, the retrieval indexes and hash values of uploaded data ciphertexts to a data chain;

the attribute authorization center generates a key for the newly added data receiver based on the key parameter, the public key parameter and the access structure of the newly added data receiver, and transmits the key generated for the newly added data receiver to the newly added data receiver, so that the newly added data receiver decrypts the uploaded data ciphertext of the corresponding data provider, which is obtained from the cloud server, by using the key generated for the newly added data receiver.

6. The double-chain architecture based supervised data security sharing method of claim 1, wherein transactions accessing a data chain are recorded on the data chain in a transaction data structure comprising transaction number, initiator, operation, identification information, user role, data, timestamp, and validity status; the transaction that accesses the chain of custody is recorded on the chain of custody in a transaction data structure containing a transaction number, an initiator, an action, identification information, a user role, data, a timestamp, and a validity status.

7. The method as claimed in claim 1, wherein if the data provider is legal, the cloud server sends, to the data receiver, return information including a proxy re-encryption key ciphertext generated by re-encrypting the identity information of the data provider in the pre-stored retrieval result and corresponding data content in the data chain using the proxy re-encryption key, and a corresponding upload data ciphertext, and the method further includes:

and sharing and recording the uploaded data of the corresponding data provider to the corresponding data receiver on the supervision chain.

8. The double-chain architecture based policeable data secure sharing method according to claim 3, wherein the public key parameters comprise: setting parameters of an effective elliptic curve, two groups with set orders, parameters of bilinear mapping, two generating elements of one group, parameters of a hash function and mapping of the generating elements; a random number used by the corresponding symmetric encryption key at the time of generation.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method according to any of claims 1 to 8 are implemented when the processor executes the program.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 8.