CN115801276A - Automobile network threat information security sharing method, system and storage medium - Google Patents
Automobile network threat information security sharing method, system and storage medium Download PDFInfo
- Publication number
- CN115801276A CN115801276A CN202211503325.2A CN202211503325A CN115801276A CN 115801276 A CN115801276 A CN 115801276A CN 202211503325 A CN202211503325 A CN 202211503325A CN 115801276 A CN115801276 A CN 115801276A
- Authority
- CN
- China
- Prior art keywords
- ciphertext
- key
- threat
- intelligence
- keyword
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 79
- 238000013475 authorization Methods 0.000 claims abstract description 53
- 230000008569 process Effects 0.000 claims abstract description 41
- 238000011217 control strategy Methods 0.000 claims abstract description 5
- 238000004422 calculation algorithm Methods 0.000 claims description 61
- 238000004364 calculation method Methods 0.000 claims description 9
- 238000004590 computer program Methods 0.000 claims description 9
- 238000012545 processing Methods 0.000 claims description 7
- 238000012795 verification Methods 0.000 claims description 4
- 238000005516 engineering process Methods 0.000 description 11
- 230000006870 function Effects 0.000 description 8
- 230000003993 interaction Effects 0.000 description 6
- 230000007246 mechanism Effects 0.000 description 6
- 238000010845 search algorithm Methods 0.000 description 5
- 230000007123 defense Effects 0.000 description 3
- 230000008520 organization Effects 0.000 description 3
- 230000008901 benefit Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000013500 data storage Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 241000157302 Bison bison athabascae Species 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000009545 invasion Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000008447 perception Effects 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000011144 upstream manufacturing Methods 0.000 description 1
Images
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a method, a system and a storage medium for safely sharing automobile network threat information, which comprises the steps of initializing a third party authorization server to generate a public key and a master key; the threat intelligence owner processes the intelligence data to obtain process data based on the public key and the set access control strategy, uploads the intelligence data ciphertext to the IPFS, and determines an access ciphertext hash value; storing the metadata to a federation blockchain; the metadata comprises process data and an access ciphertext hash value; the threat intelligence user determines a keyword trapdoor based on the interested keyword, the public key and a private key generated by the third party authorization server according to the stored main key and the received attribute set; then, calling an intelligent contract from the alliance block chain to acquire metadata; and finally, acquiring an intelligence data ciphertext and decrypting the intelligence data ciphertext to obtain threat intelligence. The method solves the problems of trust and privacy protection in the threat information sharing process, and realizes one-to-many secure sharing, fine-grained access control and ciphertext retrieval.
Description
Technical Field
The invention relates to the technical field of automobile network security. In particular to a method, a system and a storage medium for safely sharing automobile network threat intelligence.
Background
With the development of automobile intelligentization and networking degrees, security events such as remote attack and malicious control caused by network security problems are increasing while efficiency of the automobile is improved. Attackers can use loopholes in networking to obtain further control authority so as to cause serious functional safety problems, influence driving safety and personal safety, and even realize group control of automobiles. In the process of continuously intensifying network security attack and defense countermeasures, natural asymmetry exists between attack and defense parties. Only local attack information can be obtained by depending on the technical strength of a single organization, and network attack cannot be accurately and effectively prevented. The sharing of the network threat information can maximize the value of the threat information, well improve the information island problem, further improve the threat detection and emergency response capability of each party, and realize the dynamic defense effect of 'not attacking and defending first'. However, most existing threat intelligence sharing schemes are implemented based on centralized management organizations, and threat intelligence sharing efficiency is low and data of each participant is not equal. In addition, the data is too concentrated, so that a single point of failure problem can be faced, and the safety of the data cannot be guaranteed.
The automobile industry is a highly complex ecosystem spanning numerous fields, the supply system is deep and numerous, and the globalization degree of the industrial chain is high. In an automotive network security ecosystem, a security vulnerability in one upstream and downstream part or component can cascade from a source node to a plurality of target nodes in the entire network ecosystem, resulting in a potential security threat to a plurality of vehicle models or parts. Meanwhile, automobile network threat intelligence is highly sensitive in nature, and in the face of a highly complex ecosystem environment, the threat intelligence sharing has inherent trust obstacle and sensitive information problems. Therefore, the open credible network threat intelligence data sharing among users is ensured as much as possible, one-to-many safe sharing and flexible fine-grained access control in an automobile industry chain are realized, and only data related to the expected organization is ensured to be shared, and sensitive data is not leaked to organizations without permission to view. The safety and credibility of automobile network threat information sharing are guaranteed, and the information island problem of the network threat information in the automobile industry is improved, so that the network safety threat perception and emergency response capability of the intelligent networked automobile is improved.
The block chain integrates various key technologies such as distributed storage, a consensus mechanism and intelligent contract, has the characteristics of decentralization, non-tampering property, traceability and the like, and can ensure that a sharing organization carries out safe threat information sharing without a trusted institution. Aiming at the privacy protection problem in threat intelligence sharing, a federation chain limits the maintenance nodes and visibility of a blockchain to the inside of the federation, and trusted participants can privately propagate highly sensitive data through member management services and a channel mechanism. Homan et al implemented a threat intelligence sharing federation blockchain prototype, allowing trusted participants to disseminate highly sensitive data in a private manner based on traffic light protocol TLP sharing rules. Still other scholars integrate other privacy protection mechanisms such as an interplanetary file system IPFS and an encryption technology under the framework of a alliance chain. Shi et al propose a federation blockchain-based threat intelligence sharing model that uses local consensus-based "under-the-chain" storage and symmetric encryption techniques to address privacy security issues of threat intelligence. However, the channel mechanism and the public key encryption system of the federation license chain utilized in these schemes cannot realize fine-grained access control of threat intelligence sensitive information. The ciphertext in the ciphertext strategy attribute-based encryption CP-ABE mechanism is associated with an access structure, a key corresponds to an attribute set, decryption can be successful only when the attribute in the attribute set can meet the access structure, and one-to-many encryption and decryption of users can be realized. The data owner may decide which attributes the user owning the ciphertext can access by specifying a policy to access the ciphertext. Badsha, preuveneers et al attempt to improve the flexibility of threat intelligence sharing access control using CP-ABE encryption techniques. In other fields, some schemes combining block chains and attribute-based encryption technologies are available to achieve privacy protection and fine-grained access control of data sharing. However, many schemes require interaction between the data owner and the user, which may further result in leakage of user sensitive information. Furthermore, to ensure confidentiality and privacy, sharers typically choose to encrypt the data before submitting it to the blockchain. However, encrypting data makes it impossible for a user to directly retrieve it, which also hinders the intelligence data sharing based on the block chain technique.
The searchable encryption technology can realize effective retrieval of ciphertext keywords by a user in an untrusted cloud server environment, and any information of data cannot be revealed. Several tasks are focused on keyword search on a block chain, but most of the existing schemes adopt a symmetric encryption technology, data files and keyword trapdoors must use the same key to perform encryption operation, and the encryption operation can be completed only by interaction between a data owner and a user, so that efficient retrieval and access control cannot be realized, and even privacy invasion can be caused. In the asymmetric searchable scheme, key agreement between a data owner and a data user is not required, and the method is more suitable for a multi-user data sharing scene. Tahir et al propose a privacy-preserving searchable encryption framework to enable data retrieval over a blockchain. Authors protect the privacy of keywords by introducing probabilistic trapdoors, but unfortunately this approach only supports data retrieval by the data owner. Subsequently, yang et al propose an attribute-based keyword search scheme that allows users to search for encrypted files on blockchains according to attributes without any interaction by the data owner, avoiding possible privacy disclosure by the users. However, in the scheme, ciphertext retrieval under the condition that the shared data key words are the same is mainly considered, differences possibly exist in access control strategies needed by data with the same key words are ignored, the symmetric key is adopted for encryption operation of the encryption key, the shared data fine-grained access control is realized with weak capacity, a flexible fine-grained access control mechanism is lacked, and the feasibility of practical application is low. Moreover, the scheme does not consider the storage bottleneck of the block chain system, and has poor expandability.
Disclosure of Invention
The invention aims to provide a method, a system and a storage medium for safely sharing automobile network threat information facing a complex ecosystem, so as to solve the problems of trust and privacy protection in the process of sharing the threat information, ensure credible threat information data sharing among users and realize one-to-many safe sharing, fine-grained access control and ciphertext retrieval in an automobile industry chain. In addition, the invention can avoid the interaction between the owner of the information data and the user, reduce the calculation overhead and the system complexity and is beneficial to improving the efficiency of information sharing. Meanwhile, the storage burden of the block chain of the alliance can be reduced, and the integrity and expandability of threat intelligence are enhanced.
In order to solve the problems, the invention is realized by adopting the following technical scheme:
a method for safely sharing automobile network threat information comprises the following steps:
the third party authorization server carries out system initialization and generates a public key and a master key;
the threat intelligence owner processes the intelligence data based on the public key and the set access control strategy to obtain process data, and uploads an intelligence data ciphertext obtained by encrypting the intelligence data to an interplanetary file system IPFS to determine an access ciphertext hash value; sending a request for storing metadata to a federation blockchain, the federation blockchain receiving the request and triggering a storage intelligence contract; wherein the metadata comprises process data and an access ciphertext hash value;
the threat intelligence user determines a keyword trapdoor based on the interested keyword, the public key and a private key generated by the third party authorization server according to the stored main key and the received attribute set; calling an intelligent contract from the alliance block chain to acquire the metadata according to the keyword trapdoor; and acquiring an information data ciphertext according to the metadata and decrypting the information data ciphertext to obtain threat information.
Optionally, the process data includes an intelligence data hash value, a keyword ciphertext, and an encryption key ciphertext, and the specific processing procedure includes: the threat information owner carries out hash operation on the information data to obtain an information data hash value, the threat information owner sends request public key information to the third party authorization server, and an encryption key and a keyword of the information data are encrypted according to a set access structure and a public key transmitted by the third party authorization server to respectively obtain a keyword ciphertext and an encryption key ciphertext.
Optionally, the determining, by the threat intelligence user, a keyword trapdoor based on the keyword of interest, the public key, and a private key generated by the third-party authorization server according to the stored master key and the received attribute set includes:
the threat intelligence user sends the attribute set of the threat intelligence user to the third-party authorization server to request a public key and a private key; the third party authorization server generates a private key according to the stored public key and the master key and the received attribute set, and sends the public key and the private key to the threat intelligence user;
and the threat information user generates a keyword trapdoor according to the public key, the private key and the interested keyword.
Optionally, the invoking an intelligent contract from the federation block chain to obtain the metadata according to the keyword trapdoor includes:
the threat information user uploads the keyword trapdoor to the alliance blockchain; and searching whether a keyword ciphertext corresponding to the keyword trapdoor exists in the block chain of the alliance according to the intelligent contract, and if so, acquiring an intelligence data hash value, an encryption key ciphertext and an access ciphertext hash value in corresponding metadata from the block chain of the alliance by the threat intelligence user.
Optionally, obtaining an intelligence data ciphertext according to the metadata and decrypting the intelligence data ciphertext to obtain threat intelligence, including:
the threat intelligence user acquires an intelligence data ciphertext from the IPFS according to an access ciphertext hash value in the metadata; decrypting the encrypted key ciphertext to obtain a decryption key; and decrypting the information data ciphertext by using the decryption key to obtain threat information.
Optionally, the method further includes performing integrity verification on the threat intelligence, and the specific process includes:
and carrying out hash calculation on the threat intelligence, comparing the calculation result with the intelligence data hash value, and if the hash value is the same, completing the content of the threat intelligence.
Optionally, the method further comprises:
the third-party authorization server fuses a CP-ABE algorithm and a CP-ABKS algorithm to generate private keys, wherein the private keys comprise a first private key and a second private key, and the specific process comprises the following steps: generating a first private key by the third-party authorization server according to the master key and the attribute set by utilizing a KeyGen algorithm of the CP-ABKS; generating a second private key by the third-party authorization server according to the public key, the master key and the attribute set by utilizing the KeyGen algorithm of the CP-ABE;
the threat information owner embeds the access strategy into the keyword ciphertext and the encryption key ciphertext through a CP-ABE algorithm and a CP-ABKS algorithm, and the specific process comprises the following steps: generating an encryption key ciphertext by the threat intelligence owner according to the public key, the access structure and the encryption key by using an Encrypt algorithm of the CP-ABE; generating a keyword ciphertext by the threat information owner according to the public key, the access structure and the keyword by using an Encrypt algorithm of CP-ABKS;
the threat information user generates a keyword trapdoor according to the first private key and decrypts an encrypted key ciphertext according to the second private key to obtain a decrypted key, and the process comprises the following steps: the threat intelligence user generates a keyword trapdoor according to the public key, the first private key and the interested keyword; and calling a CP-ABE decryption algorithm, and decrypting the encrypted key ciphertext by the threat information user according to the public key and the second private key to obtain a decryption key.
An automobile network threat intelligence security sharing system, comprising:
the third party authorization server is used for initializing the system, generating and transmitting a public key, storing a master key and generating a private key of a threat intelligence user;
the IPFS is used for storing the information data ciphertext and generating an access ciphertext hash value according to the information data ciphertext;
the threat intelligence owner is connected with the IPFS and the third party authorization server and used for processing intelligence data based on the public key to obtain process data, uploading an intelligence data ciphertext obtained by encrypting the intelligence data to the IPFS and determining an access ciphertext hash value; uploading metadata to a federation blockchain; wherein the metadata comprises process data and an access ciphertext hash value;
the alliance block chain is connected with the threat information owner and the threat information user and used for executing an intelligent contract storage and an intelligent contract inquiry so as to store the metadata and retrieve and obtain the metadata of the corresponding access authority according to the information data ciphertext;
the threat intelligence user is connected with the third party authorization server and the block chain of the alliance and used for determining a keyword trapdoor based on an interested keyword, a public key and a private key generated by the third party authorization server according to a stored main key and a received attribute set; and uploading the keyword trapdoors to the alliance block chain in a transaction mode, and calling an intelligent contract inquiry to execute a search operation.
Optionally, the threat intelligence owner is configured to:
and carrying out hash operation on the information data to obtain an information data hash value, sending request public key information to the third party authorization server, and encrypting the encryption key and the keyword of the information data according to a set access structure and the public key transmitted by the third party authorization server to respectively obtain a keyword ciphertext and an encryption key ciphertext.
A computer readable storage medium having a computer program stored thereon, said computer readable storage medium having an automotive cyber-threat intelligence security sharing program stored thereon, said automotive cyber-threat intelligence security sharing program when executed by a processor implementing any of the steps of a method for automotive cyber-threat intelligence security sharing described herein.
Compared with the prior art, the method integrates alliance block chains, attribute-based encryption, attribute-based searchable encryption, IPFS, symmetric encryption and hash function technologies, solves the problems of trust and sensitive information of automobile network threat information sharing, and realizes one-to-many network threat information safe sharing. Compared with the existing CP-ABE algorithm or CP-ABE searchable encryption algorithm utilizing the blockchain technology, the automobile network threat information security sharing method realizes flexible fine-grained access control and ciphertext retrieval of threat information security sharing, ensures that a data user can independently search information on the blockchain without interaction with a data owner, further avoids the problem of sensitive information leakage, and reduces corresponding communication overhead. In the embodiment of the invention, initialization, encryption, decryption, key generation and keyword trapdoor generation are all calculated under a chain, the ciphertext of the network threat intelligence is stored in an IPFS network, and the intelligence metadata is stored and inquired on the chain through an intelligent contract, so that the calculation and storage overhead of a block chain is relieved, and the expandability of an intelligence sharing system is improved. In addition, compared with other similar schemes, the method improves the confidentiality and the integrity of the threat information sharing system based on the technologies of AES symmetric encryption, hash functions and the like, and integrates the CP-ABE attribute-based encryption algorithm and the CP-ABKS attribute searchable encryption algorithm to completely realize the sharing processes of encryption uploading, ciphertext retrieval, ciphertext decryption and the like of the automobile network threat information.
Drawings
In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the embodiments of the present specification, and other drawings can be obtained by those skilled in the art according to the drawings.
FIG. 1 is a schematic diagram of a framework of a vehicle cyber-threat intelligence security sharing system according to an embodiment of the present invention;
FIG. 2 is a block diagram of a method for sharing security threat information of an automobile network according to an embodiment of the present invention;
FIG. 3 is a flow chart of a threat intelligence metadata storage intelligence contract algorithm of an automobile network threat intelligence security sharing method according to an embodiment of the present invention;
fig. 4 is a flowchart of a threat intelligence keyword ciphertext search intelligent contract algorithm of an automobile network threat intelligence security sharing method according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
For the convenience of understanding of the embodiments of the present invention, the following description will be further explained with reference to specific embodiments, which are not to be construed as limiting the embodiments of the present invention.
Example 1
The embodiment provides a method for safely sharing automobile network threat information, which is shown in fig. 1 and includes:
s1: and the third party authorization server performs system initialization to generate a public key and a master key.
S2: the threat information owner processes the information data based on the public key and the set access control strategy to obtain process data, and uploads an information data ciphertext obtained by encrypting the information data to an interplanetary file system IPFS to determine an access ciphertext hash value; sending a request for storing metadata to a federation blockchain, the federation blockchain receiving the request and triggering a storage intelligence contract; wherein the metadata includes process data and an access ciphertext hash value.
S3: the threat intelligence user determines a keyword trapdoor based on the interested keyword, the public key and a private key generated by the third party authorization server according to the stored main key and the received attribute set; calling an intelligent contract from the alliance block chain to acquire the metadata according to the keyword trapdoor; and acquiring an information data ciphertext according to the metadata and decrypting the information data ciphertext to obtain threat information.
The embodiment of the invention can be realized according to a cipher text strategy Attribute Encryption (CP-ABE) algorithm or an Attribute-Based searchable Encryption (CP-ABKS) algorithm in the prior art, and can also realize safe sharing of automobile network threat information by combining the CP-ABE algorithm and the CP-ABKS algorithm, wherein the CP-ABE algorithm and the CP-ABKS algorithm embed an access strategy into a Keyword cipher text and an Encryption key cipher text, and a sender specifies the cipher text access strategy, so that the method is suitable for a message distribution scene. In the embodiment of the invention, the CP-ABKS algorithm adopts 5 polynomial time algorithms which are respectively a system initialization algorithm Setup, a key generation algorithm KeyGen, an encryption algorithm Encrypt, a Trapdoor generation algorithm Trpdoor and a Search algorithm Search.
Setup(1 λ ) → PK, MK }: the algorithm is executed by a third-party authorization server, a security parameter lambda is used as input, and a system public key PK and a master key MK are output.
KeyGen (MK, a) → SK: the algorithm is executed by a third-party authorization server, the attribute set A and the master key MK of the threat information user are used as input, and the private key SK of the threat information user is output.
Encrypt (PK, w, T) → Iw: the threat intelligence owner executes an encryption algorithm. And inputting the system public key PK, the keyword w of the intelligence data and the access structure T to generate a keyword ciphertext Iw.
Trapwood (PK, SK, ω) → T ω: the threat intelligence user executes a keyword trapdoor generation algorithm. And inputting a system public key PK, a private key SK of a threat intelligence user and an interested keyword omega, and outputting a keyword trapdoor T omega.
Search (Iw, T ω) → (1, 0): the search algorithm is performed by a node on the federation blockchain. And inputting the keyword ciphertext Iw and the keyword trapdoor T omega. If the attribute set A of the threat intelligence user meets the access tree T embedded in Iw and w is consistent with omega, the search is successful and the stored information is returned to the threat intelligence user, otherwise, the search fails.
In step S1, the third party authorization server executes a system initialization Setup algorithm, takes security parameter λ as input, and outputs a system public key PK and a master key MK, where PK may be the formula MK = cpabks.
Preferably, in S2, the process data includes an intelligence data hash value, a keyword ciphertext, and an encryption key ciphertext, and the specific processing includes: the threat intelligence owner carries out Hash operation on the intelligence data to obtain an intelligence data Hash value, sends request public key information to the third party authorization server, and encrypts an encryption key and a keyword of the intelligence data according to a set access structure and a public key transmitted by the third party authorization server to respectively obtain a keyword ciphertext and an encryption key ciphertext.
Specifically, one implementable step of S2 in the embodiment of the present invention includes:
calling an Advanced Encryption Standard (AES) algorithm by Owner of a threat intelligence Owner to generate an Encryption key for encrypting intelligence data to obtain an intelligence data ciphertext encdata, wherein encadata = AES.
The threat information Owner Owner stores the information data ciphertext encadata in the IPFS, the IPFS returns a hash value hashifs for accessing the ciphertext, hashifs = IPFS. Store (encadata);
calling SHA256 algorithm by Owner of a threat intelligence Owner to hash intelligence data to obtain intelligence data hash value hashdata, wherein the hashdata = SHA256.
The threat information Owner Owner requests a public key PK from a third-party authorization server, calls CP-ABE and CPABKS encryption algorithms respectively, encrypts a keyword w and an AES encryption key according to an access structure T set by the Owner to obtain a keyword ciphertext Iw and an encryption key ciphertext, wherein the specific formula is enckey = CPABBE. Iw = cpabks. Encrypt (PK, T, w);
the threat intelligence Owner Owner uploads hashifs, hashdata, enckey and Iw to the federation blockchain, and the federation blockchain receives the data storage request and triggers and stores intelligent contracts StoreCont and StoreCont (hashifs, hashdata, enckey and Iw).
The SHA256 algorithm operates primarily on 512-bit message chunks and 256-bit intermediate hash values, primarily by encrypting the intermediate hash values using the message chunks as keys.
Preferably, in step S3, the determining a keyword trapdoor by the threat intelligence user based on the keyword of interest, the public key, and the private key generated by the third party authorization server according to the stored master key and the received attribute set includes:
the threat intelligence user sends the attribute set of the threat intelligence user to the third-party authorization server to request a public key and a private key; the third party authorization server generates a private key according to the stored public key and the master key as well as the received attribute set, and sends the public key and the private key to the threat information user;
and the threat intelligence user generates a keyword trapdoor according to the public key, the private key and the interested keyword.
In an embodiment of the present invention, an implementable process for generating a keyword trapdoor includes:
the threat intelligence User sends the attribute set A to a third party authorization server to request a public key PK and a private key, and the third party authorization server executes a CP-ABE and a CP-ABE key generation algorithm to generate SK according to the PK, the MK and the attribute set A of the threat intelligence User 1 And SK 2 And sends PK, SK to threat information user 1 And SK 2 ，SK 1 ＝CPABKS.KeyGen(PK，MK，A)，SK 2 ＝CPABE.KeyGen(MK，A)；
Threat information User based on PK, SK 1 And an interested keyword omega, calling a Trapdoor generation algorithm Trpdoor to generate a keyword Trapdoor T omega, T omega = Trpdoor (PK, SK) 1 ，ω)。
Preferably, in the step S3, the invoking an intelligent contract from the federation block chain to obtain the metadata according to the keyword trapdoor and the keyword trapdoor includes:
the threat information user uploads the keyword trapdoor to the alliance blockchain; and searching whether a keyword ciphertext corresponding to the keyword trapdoor exists in the block chain of the alliance according to the intelligent contract, and if so, acquiring an information data hash value, an encryption key ciphertext and an access ciphertext hash value in corresponding metadata from the block chain of the alliance by the threat information user.
In an embodiment of the present invention, an implementable process for obtaining the metadata includes:
the threat intelligence User uploads the keyword trapdoor T omega to a alliance block chain network, queries an intelligent contract QueryCont to execute a Search algorithm, and returns hashdata, hashipfs and enckey to the threat intelligence data User if the Search is successful, wherein the threat intelligence data User sends hashdata, hashipfs and enckey = QueryCont Search (T omega, iw).
Preferably, in the step S3, obtaining an intelligence data ciphertext according to the metadata and decrypting the intelligence data ciphertext to obtain threat intelligence includes:
the threat intelligence user acquires an intelligence data ciphertext from the IPFS according to an access ciphertext hash value in the metadata; decrypting the encrypted key ciphertext to obtain a decryption key; and decrypting the information data ciphertext by using the decryption key to obtain threat information.
In an embodiment of the present invention, an implementable process for obtaining threat intelligence includes:
the threat intelligence User invokes an IPFS query algorithm according to hashipfs obtained from a union block chain, and obtains an intelligence data ciphertext (encdata) from an IPFS network, wherein encdata = IPFS. Query (hashipfs);
the threat intelligence User uses calls the CP-ABE decryption algorithm to decrypt the AES key ciphertext enckey which is locally encrypted and obtain a decryption key deckey, deckey = CPABBE 2 ，enckey)；
The threat intelligence User calls the AES decryption algorithm, decrypts encadata by using the decryption key deckey, and obtains the decrypted file decdata, that is, the threat intelligence, decdata = AES.
Preferably, in the step S3, integrity verification is further performed on the threat intelligence, and the specific process includes:
and carrying out hash calculation on the threat intelligence, comparing the calculation result with the intelligence data hash value, and if the hash value is the same, completing the content of the threat intelligence.
In an embodiment of the present invention, an implementable process for verifying the threat intelligence includes:
the threat intelligence User uses calls SHA256 algorithm to carry out hash operation on the decdata to obtain a hash value dechash; if hashdata and hash are the same, access is successful, hash = sha256.
Referring to fig. 2, the invention constructs an automobile network threat information sharing block structure, each block structure consists of a block head, block data and block metadata, and the block head comprises 3 fields of a block number, a hash value of a previous block head and a hash value of a current block. The hash value of the previous chunk header links the isolated chunks into a chunk chain. The block data comprises an ordered transaction list T1, T2 \8230, 8230, wherein each transaction records transaction information including a transaction header, a transaction signature, a transaction proposal and a series of endorsement fields. Each transaction can store the hash value hashdata of the intelligence data, the hash value hashipfs generated by the IPFS, the ciphertext enckey of the AES encryption key and the keyword ciphertext Iw. The chunk metadata includes a timestamp, a certificate of the chunk writer, a public key, and a signature.
Referring to fig. 3 and 4, the invention provides a data storage StoreCont and a data query QueryCont intelligent contract algorithm. Wherein, storeCont is mainly used for storing hashdata, hashipfs, enckey and Iw metadata of the intelligence data. QueryCont is mainly a search algorithm for realizing CP-ABKS attribute searchable encryption, and checks whether an attribute set A of a threat information data user meets an access tree T embedded in Iw, and whether a keyword w set by the threat information data owner is consistent with a keyword omega interested by the threat information data user. If the search is successful, the information stored in the block chain of the alliance is returned to the user of the threat information data. QueryCont searches each ciphertext keyword Iw according to the keyword trapdoor T omega. The Search algorithm Search (T ω, iw) is implemented based on go language, and first checks whether there is an attribute subset S in the attribute set a given by T ω that satisfies the keyword ciphertext Iw specified access tree T. If S does not exist, returning to 0; otherwise, the intelligent contract QueryCont calculates the secret value of the T node of the access tree from the leaf node from bottom to top until the secret value of the recovery root node returns to 1 if the search is successful, otherwise returns to 0.
Preferably, the present invention also includes a Goland editor, a Pair-based cipher library (PBC) runtime environment for implementing AES symmetric encryption, SHA256 hash functions, and the execution operations of CP-ABE, CP-ABKS encryption algorithms. In addition, the invention compiles the M4, bison, flex, GMP and PBC code libraries which are depended by the CP-ABKS encryption algorithm into a ccenv container of a federation chain so as to provide a compiling environment for instantiating an intelligence ciphertext retrieval chain code.
The method for safely sharing the automobile network threat information provided by the embodiment of the invention integrates alliance block chains, attribute base encryption, attribute base searchable encryption, IPFS, symmetric encryption and hash function technologies, solves the problems of trust and sensitive information of automobile network threat information sharing, and realizes one-to-many network threat information safety sharing. Compared with the existing CP-ABE algorithm or CP-ABE searchable encryption algorithm utilizing the blockchain technology, the automobile network threat information security sharing method in the embodiment of the invention realizes flexible fine-grained access control and ciphertext retrieval of threat information security sharing, ensures that a data user can independently search information on the blockchain without interaction with a data owner, further avoids the problem of sensitive information leakage, and simultaneously reduces corresponding communication overhead. In the embodiment of the invention, initialization, encryption, decryption, key generation and keyword trapdoor generation are all calculated under 'chain', the ciphertext of the network threat information is stored in the IPFS network, and the intelligent contract is used for storing and inquiring the metadata of the information on the chain, so that the calculation and storage overhead of a block chain is relieved, and the expandability of the information sharing system is improved. In addition, compared with other similar schemes, the method and the device improve the confidentiality and the integrity of the threat information sharing system based on the AES symmetric encryption, the hash function and other technologies, and integrate the CP-ABE attribute-based encryption algorithm and the CP-ABKS attribute searchable encryption algorithm to completely realize the sharing processes of encryption uploading, ciphertext retrieval, ciphertext decryption and the like of the automobile network threat information.
Example 2
The embodiment provides a car network threat information safety shared system, includes:
the third party authorization server is used for initializing the system, generating and transmitting a public key, storing a master key and generating a private key of a threat intelligence user;
the IPFS is used for storing the information data ciphertext and generating an access ciphertext hash value according to the information data ciphertext;
the threat intelligence owner is connected with the IPFS and the third party authorization server and used for processing intelligence data based on the public key to obtain process data, uploading an intelligence data ciphertext obtained by encrypting the intelligence data to the IPFS and determining an access ciphertext hash value; uploading metadata to a federation blockchain; wherein the metadata includes process data and an access ciphertext hash value;
the alliance block chain is connected with the threat information owner and the threat information user and used for executing an intelligent contract storage and an intelligent contract inquiry so as to store the metadata and retrieve and obtain the metadata of the corresponding access right according to the information data ciphertext;
the threat information user is connected with the third party authorization server and the block chain of the alliance and used for determining a keyword trapdoor based on an interested keyword, a public key and a private key generated by the third party authorization server according to a stored main key and a received attribute set; and uploading the keyword trapdoors to the alliance block chain in a transaction mode, and calling an intelligent contract inquiry to execute a search operation.
In the embodiment of the invention, the IPFS stores the information data ciphertext to ensure the confidentiality of the information data, reduce the storage burden of a alliance chain and improve the expandability of a sharing system.
Preferably, the threat intelligence owner is configured to:
and carrying out hash operation on the information data to obtain an information data hash value, sending request public key information to the third-party authorization server, and encrypting the encryption key and the keyword of the information data according to a set access structure and the public key transmitted by the third-party authorization server to respectively obtain a keyword ciphertext and an encryption key ciphertext.
Specifically, the threat intelligence owner is configured to perform encryption operation on intelligence data through an AES encryption algorithm, and perform hash operation on the intelligence data by using an SHA256 hash algorithm. And the threat intelligence owner encrypts the key words and the encryption key by using the access strategy defined by the owner, and calls a storage intelligent contract to upload the access ciphertext hash value, the key word ciphertext, the encryption key ciphertext and the intelligence data hash value information generated by the IPFS to the block chain of the alliance.
In the embodiment of the invention, when the data query intelligent contract is called to execute the search operation, if the search is successful, the threat intelligence user calls the CP-ABE algorithm and the Hash function to execute the ciphertext decryption, the consistency and integrity verification of the data is completed, and the required threat intelligence data is obtained.
The method for safely sharing the automobile cyber threat information can be implemented as a computer program stored in a memory and recorded in a processor to be executed so as to implement the method of the embodiment of the invention.
An embodiment of the present invention further provides a computer readable storage medium storing computer program code, which when executed by a processor implements the above-mentioned method for secure sharing of cyber-threat intelligence of an automobile.
When the automobile network threat intelligence security sharing method is implemented as a computer program, the computer program can also be stored in a computer readable storage medium as a product. For example, computer-readable storage media may include, but are not limited to, read only memory ROM or other types of static storage devices that can store static information and instructions, random access memory RAM or other types of dynamic storage devices that can store information and instructions, magnetic storage devices (e.g., hard disks, floppy disks), optical disks (e.g., compact disks, CDs), smart cards and flash memory devices (e.g., electrically erasable programmable read only memory EPROM, etc.), optical disk storage (including compact disks, laser disks, etc.), or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. In addition, various storage media described herein as embodiments of the invention can represent one or more devices and/or other machine-readable media for storing information.
The described embodiments of the invention may be implemented in whole or in part by hardware, software, firmware, or any combination thereof. For a hardware implementation, the processing units may be implemented within one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), processors, controllers, etc., and/or other electronic units designed to perform the functions described herein, or a combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer program instructions which, when loaded and executed on a device, cause the processes or functions described in the present application to be performed, in whole or in part. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium via wireline (e.g., coaxial cable, optical fiber) or wireless (e.g., infrared, wireless, etc.). Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by hardware related to instructions of a program, which may be stored in the above-mentioned computer readable storage medium.
The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.
Claims (10)
1. A safe sharing method for automobile network threat information is characterized by comprising the following steps:
the third party authorization server carries out system initialization and generates a public key and a master key;
the threat intelligence owner processes the intelligence data based on the public key and the set access control strategy to obtain process data, and uploads an intelligence data ciphertext obtained by encrypting the intelligence data to an interplanetary file system IPFS to determine an access ciphertext hash value; sending a request for storing metadata to a federation blockchain, the federation blockchain receiving the request and triggering a storage intelligence contract; wherein the metadata comprises process data and an access ciphertext hash value;
the threat intelligence user determines a keyword trapdoor based on the interested keyword, the public key and a private key generated by the third party authorization server according to the stored main key and the received attribute set; calling an intelligent contract from the alliance block chain to acquire the metadata according to the keyword trapdoor; and acquiring an information data ciphertext according to the metadata and decrypting the information data ciphertext to obtain threat information.
2. The sharing method according to claim 1, wherein the process data includes an intelligence data hash value, a keyword ciphertext and an encryption key ciphertext, and the specific processing process includes: the threat intelligence owner carries out Hash operation on the intelligence data to obtain an intelligence data Hash value, sends request public key information to the third party authorization server, and encrypts an encryption key and a keyword of the intelligence data according to a set access structure and a public key transmitted by the third party authorization server to respectively obtain a keyword ciphertext and an encryption key ciphertext.
3. The sharing method of claim 1, wherein the threat intelligence user determines a keyword trapdoor based on a keyword of interest, a public key, and a private key generated by the third party authorization server from a stored master key and a received set of attributes, comprising:
the threat intelligence user sends the attribute set of the threat intelligence user to the third-party authorization server to request a public key and a private key; the third party authorization server generates a private key according to the stored public key and the master key as well as the received attribute set, and sends the public key and the private key to the threat information user;
and the threat intelligence user generates a keyword trapdoor according to the public key, the private key and the interested keyword.
4. The sharing method according to claim 2, wherein the invoking a query intelligence contract from the federation blockchain to obtain the metadata according to the keyword trapdoor comprises:
the threat intelligence user uploads the keyword trapdoors to the federation blockchain; and searching whether a keyword ciphertext corresponding to the keyword trapdoor exists in the block chain of the alliance according to the intelligent contract, and if so, acquiring an intelligence data hash value, an encryption key ciphertext and an access ciphertext hash value in corresponding metadata from the block chain of the alliance by the threat intelligence user.
5. The sharing method according to claim 2, wherein the obtaining and decrypting of informative data ciphertext according to the metadata results in threat intelligence, comprises:
the threat information user accesses a ciphertext hash value according to the metadata to obtain an information data ciphertext from the IPFS; decrypting the encrypted key ciphertext to obtain a decryption key; and decrypting the information data ciphertext by using the decryption key to obtain threat information.
6. The sharing method according to claim 2, further comprising integrity verification of the threat intelligence, the specific process comprising:
and carrying out Hash calculation on the threat intelligence, comparing the calculation result with the Hash value of the intelligence data, and if the Hash value is the same, ensuring that the content of the threat intelligence is complete.
7. The sharing method according to claim 2, further comprising:
the third party authorization server fuses a CP-ABE algorithm and a CP-ABKS algorithm to generate private keys, wherein the private keys comprise a first private key and a second private key, and the specific process comprises the following steps: generating a first private key by the third-party authorization server according to the master key and the attribute set by utilizing a KeyGen algorithm of CP-ABKS; generating a second private key by the third-party authorization server according to the public key, the master key and the attribute set by utilizing a KeyGen algorithm of the CP-ABE;
the threat information owner embeds the access strategy into the keyword ciphertext and the encryption key ciphertext through a CP-ABE algorithm and a CP-ABKS algorithm, and the specific process comprises the following steps: generating an encryption key ciphertext by the threat information owner according to the public key, the access structure and the encryption key by using an Encrypt algorithm of the CP-ABE; generating a keyword ciphertext by the threat intelligence owner according to the public key, the access structure and the keyword by using an Encrypt algorithm of CP-ABKS;
the threat information user generates a keyword trapdoor according to the first private key and decrypts an encryption key ciphertext according to the second private key to obtain a decryption key, and the process comprises the following steps: the threat intelligence user generates a keyword trapdoor according to the public key, the first private key and the interested keyword; and calling a CP-ABE decryption algorithm, and decrypting the encrypted key ciphertext by the threat information user according to the public key and the second private key to obtain a decryption key.
8. An automobile cyber threat intelligence security sharing system, comprising:
the third party authorization server is used for initializing the system, generating and transmitting a public key, storing a master key and generating a private key of a threat information user;
IPFS used for storing the information data cryptograph and generating an access cryptograph hash value according to the information data cryptograph;
the threat information owner is connected with the IPFS and the third party authorization server and used for processing the information data based on the public key to obtain process data, uploading an information data ciphertext obtained by encrypting the information data to the IPFS and determining an access ciphertext hash value; uploading metadata to a federation blockchain; wherein the metadata comprises process data and an access ciphertext hash value;
the alliance block chain is connected with the threat information owner and the threat information user and used for executing an intelligent contract storage and an intelligent contract inquiry so as to store the metadata and retrieve and obtain the metadata of the corresponding access right according to the information data ciphertext;
the threat intelligence user is connected with the third party authorization server and the block chain of the alliance and used for determining a keyword trapdoor based on an interested keyword, a public key and a private key generated by the third party authorization server according to a stored main key and a received attribute set; and uploading the keyword trapdoor to the alliance block chain in a transaction mode, and calling an intelligent contract to execute searching operation.
9. The sharing system of claim 8, wherein the threat intelligence owner is configured to:
and carrying out hash operation on the information data to obtain an information data hash value, sending request public key information to the third party authorization server, and encrypting the encryption key and the keyword of the information data according to a set access structure and the public key transmitted by the third party authorization server to respectively obtain a keyword ciphertext and an encryption key ciphertext.
10. A computer readable storage medium having a computer program stored thereon, the computer readable storage medium having an automotive cyber-threat intelligence security sharing program stored thereon, the automotive cyber-threat intelligence security sharing program when executed by a processor implementing the steps of an automotive cyber-threat intelligence security sharing method of any of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211503325.2A CN115801276A (en) | 2022-11-28 | 2022-11-28 | Automobile network threat information security sharing method, system and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211503325.2A CN115801276A (en) | 2022-11-28 | 2022-11-28 | Automobile network threat information security sharing method, system and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115801276A true CN115801276A (en) | 2023-03-14 |
Family
ID=85442332
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211503325.2A Pending CN115801276A (en) | 2022-11-28 | 2022-11-28 | Automobile network threat information security sharing method, system and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115801276A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117056983A (en) * | 2023-10-13 | 2023-11-14 | 中国移动紫金(江苏)创新研究院有限公司 | Multistage controllable data sharing authorization method, device and blockchain system |
| CN117251859A (en) * | 2023-03-15 | 2023-12-19 | 桂林电子科技大学 | System and method for sharing geographic information data based on blockchain |
| CN117596036A (en) * | 2023-11-20 | 2024-02-23 | 北京邮电大学 | Dynamic attribute-based encryption access control method with multi-time granularity constraint |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180324207A1 (en) * | 2017-05-05 | 2018-11-08 | Servicenow, Inc. | Network security threat intelligence sharing |
| CN109981564A (en) * | 2019-01-28 | 2019-07-05 | 中国科学院信息工程研究所 | A kind of threat information exchange sharing method based on block chain |
| CN112836229A (en) * | 2021-02-10 | 2021-05-25 | 北京深安信息科技有限公司 | Attribute-based encryption and block-chaining combined trusted data access control scheme |
| CN114666157A (en) * | 2022-04-14 | 2022-06-24 | 西安邮电大学 | Block chain cross-chain threat information sharing system and method |
-
2022
- 2022-11-28 CN CN202211503325.2A patent/CN115801276A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180324207A1 (en) * | 2017-05-05 | 2018-11-08 | Servicenow, Inc. | Network security threat intelligence sharing |
| CN109981564A (en) * | 2019-01-28 | 2019-07-05 | 中国科学院信息工程研究所 | A kind of threat information exchange sharing method based on block chain |
| CN112836229A (en) * | 2021-02-10 | 2021-05-25 | 北京深安信息科技有限公司 | Attribute-based encryption and block-chaining combined trusted data access control scheme |
| CN114666157A (en) * | 2022-04-14 | 2022-06-24 | 西安邮电大学 | Block chain cross-chain threat information sharing system and method |
Non-Patent Citations (1)
| Title |
|---|
| 黄克振: "基于区块链的网络安全威胁情报共享模型", 计算机研究与发展, 10 April 2020 (2020-04-10) * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117251859A (en) * | 2023-03-15 | 2023-12-19 | 桂林电子科技大学 | System and method for sharing geographic information data based on blockchain |
| CN117056983A (en) * | 2023-10-13 | 2023-11-14 | 中国移动紫金(江苏)创新研究院有限公司 | Multistage controllable data sharing authorization method, device and blockchain system |
| CN117056983B (en) * | 2023-10-13 | 2024-01-02 | 中国移动紫金(江苏)创新研究院有限公司 | Multistage controllable data sharing authorization method, device and blockchain system |
| CN117596036A (en) * | 2023-11-20 | 2024-02-23 | 北京邮电大学 | Dynamic attribute-based encryption access control method with multi-time granularity constraint |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Sidorov et al. | Ultralightweight mutual authentication RFID protocol for blockchain enabled supply chains | |
| Yang et al. | A blockchain-based approach to the secure sharing of healthcare data | |
| Mehmood et al. | Protection of big data privacy | |
| Puzio et al. | ClouDedup: Secure deduplication with encrypted data for cloud storage | |
| Salam et al. | Implementation of searchable symmetric encryption for privacy-preserving keyword search on cloud storage | |
| CN115801276A (en) | Automobile network threat information security sharing method, system and storage medium | |
| Hazay et al. | Constructions of truly practical secure protocols using standardsmartcards | |
| Xu et al. | An integrated privacy preserving attribute-based access control framework supporting secure deduplication | |
| Sun et al. | Research on logistics information blockchain data query algorithm based on searchable encryption | |
| Khashan | Secure outsourcing and sharing of cloud data using a user-side encrypted file system | |
| Manthiramoorthy et al. | Comparing several encrypted cloud storage platforms | |
| Bhandari et al. | A framework for data security and storage in Cloud Computing | |
| Kumar et al. | Data outsourcing: A threat to confidentiality, integrity, and availability | |
| Zhang et al. | Secdedup: Secure encrypted data deduplication with dynamic ownership updating | |
| KR101140576B1 (en) | Multi?user search system and method of encrypted document | |
| Yan et al. | Secure and efficient big data deduplication in fog computing | |
| CN112037870A (en) | Double-server light searchable encryption method and system supporting data partitioning | |
| KR20210009782A (en) | Encryption system, apparatus and method for providing searchable having forward stability | |
| Cai et al. | Vizard: A metadata-hiding data analytic system with end-to-end policy controls | |
| Yuan et al. | Towards a ledger-assisted architecture for secure query processing over distributed iot data | |
| Tian et al. | A trusted control model of cloud storage | |
| Ahmed et al. | A secure provenance scheme for detecting consecutive colluding users in distributed networks | |
| Xie et al. | Assured Deletion: A Scheme Based on Strong Nonseparability | |
| Aziz et al. | Assured data deletion in cloud computing: security analysis and requirements | |
| Passricha et al. | A secure deduplication scheme for encrypted data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |