CN118214614B - Method, device and system for controlling access of data on block chain system - Google Patents

Method, device and system for controlling access of data on block chain system Download PDF

Info

Publication number
CN118214614B
CN118214614B CN202410622278.6A CN202410622278A CN118214614B CN 118214614 B CN118214614 B CN 118214614B CN 202410622278 A CN202410622278 A CN 202410622278A CN 118214614 B CN118214614 B CN 118214614B
Authority
CN
China
Prior art keywords
ciphertext
key
encryption algorithm
data
decryption
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202410622278.6A
Other languages
Chinese (zh)
Other versions
CN118214614A (en
Inventor
张海滨
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Yangtze Delta Region Institute of Tsinghua University Zhejiang
Original Assignee
Yangtze Delta Region Institute of Tsinghua University Zhejiang
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Yangtze Delta Region Institute of Tsinghua University Zhejiang filed Critical Yangtze Delta Region Institute of Tsinghua University Zhejiang
Priority to CN202410622278.6A priority Critical patent/CN118214614B/en
Publication of CN118214614A publication Critical patent/CN118214614A/en
Application granted granted Critical
Publication of CN118214614B publication Critical patent/CN118214614B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/104—Peer-to-peer [P2P] networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a method, a device and a system for controlling data access on a block chain system, wherein the method comprises the following steps: receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner, wherein the message ciphertext is obtained by encrypting the message plaintext by adopting a first encryption algorithm, and the key ciphertext is obtained by encrypting a key of the first encryption algorithm by adopting a second encryption algorithm; generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm; encrypting the distributed decryption shares by using an access control list of the data owner to obtain a decryption ciphertext; sending the decrypted ciphertext to a database, and asynchronously waiting for the decrypted ciphertext corresponding to the access control list of the first number of matched data owners by the database to be asynchronously stored; the hash value of the message ciphertext is shared to all data visitors. The invention can realize fine granularity access control while guaranteeing the safety of the user privacy data.

Description

Method, device and system for controlling access of data on block chain system
Technical Field
The present invention relates to the field of software development, distributed systems, and blockchain technologies, and in particular, to a method, an apparatus, and a system for controlling access to data on a blockchain system.
Background
This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. The description herein is not admitted to be prior art by inclusion in this section.
Blockchains are a new generation of information technology that combines distributed systems and cryptography. The secure data storage and processing mode of blockchain technology makes it promising as an impetus for the evolution of information technology. From a technical perspective, blockchains can be roughly divided into unlicensed chains and licensed chains. The unlicensed links should typically run on public networks, mostly public links, and participants can participate in consensus and transactions without going through an admission approval process. The license chain requires that the nodes (servers) involved in the system operation be authorized and authenticated by an administrator or regulatory agency. The license chain may be divided into private chains maintained by a single organization and federated chains commonly maintained by organizations that are mutually aware of identity.
BFT (Byzantine fault tolerance, bayer fault tolerance, consensus) is a well-known model of the license chain. With the rise of blockchain, a BFT consensus system, which is a blockchain operating system and a key core, has been widely used.
BFT is a "user-server" mode of operation based on state machine replication. BFT should meet safety and activity. Security requires that the individual server states remain consistent and activity requires service implementation availability. The consensus protocol is a vital component in the blockchain technology, it ensures that all nodes in the distributed system agree on shared data so that no centralized mechanism or mechanisms in the blockchain network can control the entire network, ensuring the decentralization characteristics of the blockchain, and it directly determines the blockchain performance. Distributed storage based on the consensus protocol is a technique for storing data on multiple nodes, each storing a portion of the data, all of which cooperate to provide data storage and access services. Unlike conventional centralized storage, distributed storage has the advantages of high availability, high performance, strong expandability, and the like. Because the data is stored on a plurality of nodes, the distributed storage has higher availability and fault tolerance, and even if one node or a plurality of nodes fail, the operation of the whole system is not affected.
The blockchain has the functions of high reliability, fault tolerance, integrity, usability, traceability, evidence storage and the like. But there are the following problems with existing blockchain systems:
(1) Only trace data is stored on the chain, core data cannot be stored on the chain and operated on the chain, the real circulation of the data is limited, and the phenomenon of data island is not eliminated due to the existence of a block chain.
(2) Traditional block chain systems cannot guarantee confidentiality of data, and backup storage of data reduces confidentiality of data instead.
(3) The existing blockchain system cannot safely and finely control the reading and writing of data, and the potential safety hazard of data access is increased.
Disclosure of Invention
The embodiment of the invention provides a method for controlling data access on a blockchain system, which is used for realizing fine-granularity access control while guaranteeing the security of user privacy data and is applied to any node on the blockchain system, and the method comprises the following steps:
Receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner, wherein the message ciphertext is obtained by encrypting a message plaintext by the blockchain client by adopting a first encryption algorithm, the key ciphertext is obtained by encrypting a key of the first encryption algorithm by the blockchain client by adopting a second encryption algorithm, and the message plaintext and the access control list of the data owner are sent to the blockchain client by the data owner;
Generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm;
encrypting the distributed decryption shares by using an access control list of the data owner to obtain a decryption ciphertext;
The decryption ciphertext is sent to a database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext;
And sharing the hash value of the message ciphertext to all data visitors, and obtaining a decrypted ciphertext from a database by the data visitors through the hash value and an access control list of the data visitors, and then decrypting to obtain a message plaintext.
The embodiment of the invention also provides another access control method of data on the blockchain system, which is used for realizing fine granularity access control while guaranteeing the security of user privacy data and is applied to a blockchain client, and the method comprises the following steps:
receiving a message plaintext input by a data owner and an access control list of the data owner;
encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext;
encrypting a key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext;
Generating a hash value of a message ciphertext, wherein the hash value is used for a data visitor to obtain the message plaintext;
And sending the hash value of the message ciphertext, the key ciphertext and the access control list to a block chain system, wherein after the key ciphertext obtains a distributed decryption share through a node private key, a node on the block chain system encrypts the decryption share by using the access control list of a data owner to obtain a decryption ciphertext, and sending the decryption ciphertext to a database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext.
The embodiment of the invention provides a device for controlling data access on a blockchain system, which is used for realizing fine-granularity access control while guaranteeing the security of user privacy data and is applied to any node on the blockchain system, and comprises the following components:
The first receiving module is used for receiving a hash value of a message ciphertext sent by the blockchain client, a key ciphertext and an access control list of a data owner, wherein the message ciphertext is obtained by encrypting a message plaintext by the blockchain client through a first encryption algorithm, the key ciphertext is obtained by encrypting a key of the first encryption algorithm by the blockchain client through a second encryption algorithm, and the message plaintext and the access control list of the data owner are sent to the blockchain client by the data owner;
the distributed decryption share generating module is used for generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm;
The decryption ciphertext obtaining module is used for encrypting the distributed decryption shares by using the access control list of the data owner to obtain a decryption ciphertext;
The sending module is used for sending the decrypted ciphertext to a database, and the database asynchronously waits for the decrypted ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decrypted ciphertext;
The hash value sharing module is used for sharing the hash value of the message ciphertext to all data visitors, and the data visitors acquire the decryption ciphertext from the database through the hash value and the access control list of the data visitors, and then decrypt the decryption ciphertext to acquire the message plaintext.
The embodiment of the invention provides a device for controlling data access on a blockchain system, which is used for realizing fine-granularity access control while guaranteeing the security of user privacy data and is applied to a blockchain client, and comprises the following components:
the second receiving module is used for receiving the message plaintext input by the data owner and the access control list of the data owner;
the first encryption module is used for encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext;
The second encryption module is used for encrypting the key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext;
The hash value generation module is used for generating a hash value of the message ciphertext, wherein the hash value is used for a data visitor to obtain the message plaintext;
The second sending module is used for sending the hash value of the message ciphertext, the key ciphertext and the access control list to the blockchain system, wherein after the key ciphertext obtains the distributed decryption share through the node private key, the node on the blockchain system encrypts the decryption share through the access control list of the data owner to obtain the decryption ciphertext, and sends the decryption ciphertext to the database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext.
The embodiment of the invention provides a system for controlling the access of data on a blockchain system, which is used for realizing fine granularity access control while guaranteeing the security of user privacy data, and comprises the following steps: a blockchain system, a blockchain client, and a database, wherein,
A blockchain client for: receiving a message plaintext and an access control list which are input by a data owner; encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext, encrypting a key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext, and generating a hash value of the message ciphertext; sending the hash value of the message ciphertext, the key ciphertext and the access control list to a block chain system;
A node on a blockchain system for: receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner; generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm, and encrypting the distributed decryption share by using an access control list of a data owner to obtain a decryption ciphertext; sending the decrypted ciphertext to a database; the hash value of the message ciphertext is shared to all data visitors, and the data visitors acquire a decryption ciphertext from a database through the hash value and an access control list of the data visitors, and then decrypt the decryption ciphertext to acquire a message plaintext;
a database for: and asynchronously storing the decrypted ciphertext corresponding to the first number of matched access control lists after asynchronously waiting for the decrypted ciphertext.
The embodiment of the invention also provides computer equipment, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the method for controlling the access of the data on the block chain system when executing the computer program.
The embodiment of the invention also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program realizes the method for controlling the access of the data on the blockchain system when being executed by a processor.
The embodiment of the invention also provides a computer program product, which comprises a computer program, wherein the computer program realizes the method for controlling the access of the data on the block chain system when being executed by a processor.
In the embodiment of the invention, the blockchain client can receive a message plaintext and an access control list which are input by a data owner; encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext, encrypting a key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext, and generating a hash value of the message ciphertext; sending the hash value of the message ciphertext, the key ciphertext and the access control list to a block chain system; a node on the blockchain system can receive a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner; generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm, and encrypting the distributed decryption share by using an access control list of a data owner to obtain a decryption ciphertext; sending the decrypted ciphertext to a database; the hash value of the message ciphertext is shared to all data visitors, and the data visitors acquire a decryption ciphertext from a database through the hash value and an access control list of the data visitors, and then decrypt the decryption ciphertext to acquire a message plaintext; the database may asynchronously wait for the decrypted ciphertext corresponding to the first number of matching access control lists and then asynchronously store the decrypted ciphertext. Compared with the traditional blockchain system with low performance, the method and the system provided by the embodiment of the invention do not depend on open source software or the existing blockchain platform, can quickly update and iterate, can store a large amount of core data in an uplink manner through a database and support on-chain operation, open a data island barrier, really realize the cooperative sharing and high-efficiency use of data resources, can ensure the activity of the system, reduce the difficulty and pressure of data maintenance, reduce the cost of the system in the storage and calling processes, and improve the safety and reliability of the system; through the access control list of the data owner, the query control can be precisely controllable in fine granularity, which data are available, when and by which people the data are read or used, and the access control authority can be dynamically determined and modified, so that the whole process is free from single-point errors, a trusted third party is not needed, and the reliability, activity and integrity of the blockchain system are ensured.
Drawings
In order to more clearly illustrate the embodiments of the invention or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art. In the drawings:
FIG. 1 is a flow chart of a method for controlling access to data on a block chain system in accordance with an embodiment of the present invention;
FIG. 2 is a schematic diagram of a write operation in an embodiment of the invention;
FIG. 3 is a flow chart of another method for controlling access to data on a blockchain system in accordance with an embodiment of the present invention;
FIG. 4 is a schematic diagram of a read operation in an embodiment of the invention;
FIG. 5 is a schematic diagram of an apparatus for controlling access to data on a block chain system according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of an apparatus for controlling access to data on a blockchain system in accordance with an embodiment of the present invention;
FIG. 7 is a schematic diagram of a block chain system data access control system in accordance with an embodiment of the present invention;
Fig. 8 is a schematic diagram of a computer device in an embodiment of the invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the embodiments of the present invention will be described in further detail with reference to the accompanying drawings. The exemplary embodiments of the present invention and their descriptions herein are for the purpose of explaining the present invention, but are not to be construed as limiting the invention.
FIG. 1 is a flow chart of a fine grain access control method of a blockchain system in accordance with an embodiment of the invention, the method being applied to any node on the blockchain system, the method comprising:
Step 101, receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner, wherein the message ciphertext is obtained by encrypting a message plaintext by the blockchain client by adopting a first encryption algorithm, the key ciphertext is obtained by encrypting a key of the first encryption algorithm by adopting a second encryption algorithm, and the message plaintext and the access control list of the data owner are sent to the blockchain client by the data owner;
Step 102, generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm;
step 103, encrypting the distributed decryption shares by using the access control list of the data owner to obtain a decryption ciphertext;
step 104, sending the decrypted ciphertext to a database, wherein the database asynchronously waits for the decrypted ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decrypted ciphertext;
And 105, sharing the hash value of the message ciphertext to all data visitors, and obtaining a decrypted ciphertext from a database by the data visitors through the hash value and an access control list of the data visitors, and then decrypting to obtain the message plaintext.
In the embodiment of the invention, the message plaintext comprises user privacy data: the user privacy data contains personal information of the user (e.g., age, gender, etc.) and also includes data generated by the personal electronic device.
The block chain system provided by the embodiment of the invention comprises a block chain consensus module, a block chain storage module, an access control module, a network communication protocol module and a password component.
A block chain consensus module: a consensus algorithm refers to a distributed algorithm in which multiple nodes operate to achieve the same data state in a distributed scenario. In a distributed scenario, network packet loss, clock drift, node downtime, node disuse, and other fault conditions may occur, and the consensus algorithm needs to be able to tolerate these errors, so as to ensure that multiple nodes acquire the same data state. Depending on the type of fault that can be tolerated, consensus algorithms can be divided into two classes: the fault tolerance algorithm (crash fault tolerant consensus algorithm) can tolerate the benign faults of network packet loss, clock drift and partial node downtime, and common algorithms include Paxos and Raft. The Bayesian error class algorithm (byzantine fault tolerant consensus algorithm) can tolerate some of the node errors of any type, including node aversion, common algorithms are PBFT, poW, poS, etc.
According to different use scenes, the consensus algorithm can be divided into two types of public chain consensus and alliance chain consensus. In distributed technology, consensus has become a synonym for a particular algorithm within a single function. However, consensus includes not only simply agreeing on the order of information, but by its fundamental role in the overall information flow, this distinction is highlighted from proposal and endorsement to ordering, verification and submission. In short, consensus is defined as closed-loop verification of the correctness of a set of information that makes up a block. The alliance chain is characterized in that the network among the nodes is stable, the nodes have access requirements, raft and PBFT algorithms can be selected according to the type of errors which need to be tolerated, the algorithms have the advantages that TPS is higher, transactions can be confirmed in millisecond level, and the disadvantage that the number of supported nodes is limited, and the number of supported nodes is usually not more than 100 nodes.
A blockchain storage module: the storage module is responsible for persistence of account book data such as blocks, transactions, states, historical read-write sets and the like on a storage chain, and provides the inquiry function of the data. The blockchain performs batch data submission in blocks, and one block submission can involve submission of multiple ledger data, such as: transaction submission, status data modification, etc., the storage module needs to maintain the atomicity of ledger data. The embodiment of the invention aims to support a common database to store account book data, such as LevelDB, badgerDB, tikvDB, mySQL and other databases, and a business can select any one of the databases to deploy a blockchain. In the embodiment of the invention, the hash value of the message ciphertext, the key ciphertext and the access control list of the data owner can be provided with a blockchain storage module.
And an access control module: access control is used to define how decisions are made and specific results are achieved. To this end, access control generally describes who and what, such as a person, accesses or rights to private data. Access control is the management mechanism of the infrastructure in embodiments of the invention. Access control indicates how a member agrees or denies a network, etc. Access control is agreed upon by federation members at the time of initial configuration of the network, but may be modified during evolution of the network. For example, they define criteria for adding or deleting members, changing the block format or specifying the number of organizations that need endorsements. All these actions defining who can do what are described in the access control. In brief, all things that want to do in a blockchain platform are subject to access control. In the existing blockchain system, the read-write of the data which cannot be safely and finely controlled cannot be realized, the potential safety hazard of data access is increased, and the problem can be solved by the access control scheme of the data on the blockchain system provided by the embodiment of the invention.
Network communication protocol module: all nodes in the blockchain system communicate by adopting a national secret TLS+ gRPC, wherein TLS is a transmission layer protocol based on a TCP protocol, and the TCP protocol has the characteristic of data retransmission, so that the reliability and the high efficiency of data transmission are ensured; meanwhile, components such as a name resolver, a load balancer and the like of gRPC ensure the activity, the health and the usability of the connection.
A password component: software implementations of signature and verification, hash computation, encryption and decryption functions, cryptographic protocols based on sm2 and sm3 algorithms are provided.
FIG. 2 is a schematic diagram of a write operation according to an embodiment of the present invention, corresponding to the write operations of steps 101-105. Symmetric encryption cannot be innovated. However, in the embodiment of the invention, a hybrid encryption mode is formed by a first encryption algorithm and a second encryption algorithm, wherein the first encryption algorithm is a symmetric encryption algorithm, the second encryption algorithm is a distributed encryption algorithm, and since symmetric encryption does not have a method for encrypting large data, the message is encrypted by adopting distributed encryption, but in order to ensure confidentiality, a secret key is encrypted by adopting symmetric encryption.
(1) The blockchain client receives a message plaintext m sent by a data owner and an access control list ACL of the data owner, wherein the access control list of the data owner comprises a public key of the data visitor. The blockchain client may be a client browser that communicates with the data owner through an interface.
(2) The blockchain client encrypts the message plaintext m by adopting a first encryption algorithm to obtain a message ciphertext C, and in the embodiment of the invention, the first encryption algorithm is a symmetric encryption algorithm, and then the blockchain client encrypts the message plaintext m by adopting a key sm4 of the first encryption algorithm to obtain the message ciphertext C.
Symmetric encryption algorithms use the same key (or private key) to encrypt and decrypt data. In symmetric encryption, the sender and the receiver must share the same key in advance, which means that both encryption and decryption use the same key, and thus are also referred to as "shared key encryption".
The step of the symmetric encryption algorithm (which may employ the national cipher SM 4) includes:
In the symmetric encryption key generation stage, determining a key sm4 required by a symmetric encryption algorithm according to a security parameter l;
in the encryption stage, a message plaintext m and a key sm4 are obtained, and the message plaintext m is encrypted by a symmetric encryption algorithm to obtain a message ciphertext C;
in the decryption stage, a message ciphertext C and a key sm4 are obtained, and the message plaintext m is obtained through decryption by a symmetric encryption algorithm.
(3) The blockchain client encrypts a key sm4 of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext c;
The distributed encryption algorithm can avoid a single node obtaining a secret key, which causes a single point error. Distributed encryption algorithms are used to protect confidential information from leakage or abuse by individual key holders. It is based on the concept of distributed key generation and sharing, where the key is split into parts and distributed to multiple participants so that the participants can cooperate in decryption only if predetermined conditions are met. The embodiments of the present invention employ a robust tag-based distributed encryption scheme. Where the tag lb, i.e. the data owner, can specify in what way, when and where the data visitor accesses the data, where the tag is the following access control list ACL. The embodiment of the invention creatively combines the distributed encryption algorithm with the fine-granularity access control mode. In a conventional distributed encryption scheme, only the tag of a message is input in the encryption stage. According to the embodiment of the invention, the distributed encryption algorithm is modified, and the tags in the distributed encryption algorithm are replaced with the fine-granularity access control list for the data, so that a fine-granularity access control method for the message is formed.
In an embodiment, the second encryption algorithm is a distributed encryption algorithm (which may be referred to as TDH 2);
The steps of the distributed encryption algorithm include:
in the distributed encryption key generation stage, according to the security parameters, the number n of nodes in the blockchain system and the number t of fault-tolerant error nodes in the blockchain system, obtaining a public key pk of the blockchain system, a private key (sk 1,...,skn) of each node and a verification key vk;
In the encryption stage, a key sm4 of a first encryption algorithm, an access control list (including a public key of a data visitor) of a data owner and a blockchain system public key pk are obtained, and a key ciphertext c is output to a key sm4 of the first encryption algorithm through the encryption algorithm;
In the decryption share generation stage, a node inputs a secret key ciphertext c, a private key sk i of the node and an access control list of a data owner, and outputs a distributed decryption share sigma i of the corresponding node;
In the decryption share verification stage, according to a decryption ciphertext E pkSM2i(σi input by a data visitor, a verification key vk, an access control list of the data owner and a decryption share sigma i, verifying the decryption ciphertext E pkSM2i(σi), determining that verification is successful when a verification result is 1, and determining that verification is failed when the verification result is 0;
In the recovery stage, the plaintext m or the illegal signature of the message is output according to the verification key vk (t) input by the data visitor and the access control list of the data owner and the decryption share sigma i.
(4) The block chain client generates a message ciphertext hash value h for C;
(5) The block chain client sends the hash value of the message ciphertext, the key ciphertext and the access control list of the data owner to a node on the block chain system, and sends the hash value of the message ciphertext and the access control list of the message ciphertext data owner to the database.
(6) And the node adopts a second encryption algorithm to generate a distributed decryption share corresponding to the key ciphertext, namely a decryption share generation stage corresponding to the distributed encryption algorithm.
(7) The access control list of the data visitor comprises a public key pk SM2i of the data visitor; the node encrypts the distributed decryption share sigma i by using the access control list pk SM2i of the data owner to obtain a decryption ciphertext Epk SM2i(σi); the decryption ciphertext is sent to a database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext;
in order to avoid the problems of the traditional blockchain system that information needs to be acquired from a chain when information is read, the performance of the whole system is reduced, and the like. The embodiment of the invention can directly operate the database, thereby greatly improving the performance of the block chain system. The whole read operation is based on write operation, namely, when the database is written in the embodiment of the invention, a brand-new flow is adopted, single-point errors and the like possibly existing in the database are avoided, and the operation of the database is innovatively combined with the distributed encryption algorithm.
In one embodiment, the database is an SQL database;
The main key of the SQL database is a hash value of the message ciphertext when in storage, and the key value is the message ciphertext;
The first number is 1 plus the number of fault-tolerant error nodes in the block chain system;
the decryption ciphertext corresponding to the access control list ACL of the first number of matching data owners is obtained according to the access control list of the same data owner.
Wherein the first number may be denoted as t+1; for example, 4 blockchain nodes (1 is the wrong node), i.e., the database receives 2 epks SM2i(σi and they have the same ACL before writing to Epk SM2i(σi) to the database.
In summary, each blockchain node generates a decrypted ciphertext. However, if only the decrypted ciphertext is locally stored in the blockchain, the user can read the blockchain to cause performance degradation; thus, the blockchain node will send the decrypted ciphertext to the SQL database. However, the ciphertext may be lost due to decryption when the information is transmitted; asynchronous waiting is required for the SQL database, and is very important because decryption ciphertext cannot reach the database at the same time due to problems such as network factors, so the SQL database asynchronously waits for the reached decryption ciphertext; SQL not only needs to asynchronously wait for decrypting ciphertext, but also needs to wait for t+1 decrypted texts to be written into the SQL database, so that single-point errors are avoided, and the number of the decrypted ciphertext is also the number of the decrypted ciphertext in the subsequent recovery stage. Only when the database writing operation is performed, the data visitor can directly read t+1 decryption ciphertexts in the reading stage.
(8) And sharing the hash value of the message ciphertext to all data visitors, and obtaining a decrypted ciphertext from a database by the data visitors through the hash value and an access control list of the data visitors, and then decrypting to obtain a message plaintext.
FIG. 3 is a flowchart of another method for controlling access to data on a blockchain system, applied to a blockchain client, according to an embodiment of the present invention, including:
step 301, receiving a message plaintext input by a data owner and a data owner access control list;
step 302, encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext;
step 303, encrypting the key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext;
Step 304, generating a hash value of the message ciphertext, wherein the hash value is used for a data visitor to obtain the message plaintext;
Step 305, sending the hash value of the message ciphertext, the key ciphertext and the access control list to the blockchain system, wherein after the key ciphertext obtains the distributed decryption share through the node private key, the node on the blockchain system encrypts the decryption share by using the access control list of the data owner to obtain the decryption ciphertext, and sending the decryption ciphertext to the database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext.
FIG. 3 is a write operation recited from the perspective of a blockchain client, in an embodiment, the method further includes:
generating a private key and a public key of the data visitor by adopting a third encryption algorithm, and transmitting the public key of the data visitor to the blockchain system;
And encrypting the distributed decryption shares by using an access control list of the data owner by adopting a third encryption algorithm to obtain a decryption ciphertext, wherein the access control list of the data visitor comprises a public key of the data visitor.
In one embodiment, the third encryption algorithm is a public key encryption algorithm;
The steps of the public key encryption algorithm include:
In the stage of generating a secret key of a public key secret algorithm, obtaining a private key sk SM2 and a public key pk SM2 of a data visitor according to the security parameters;
in the encryption stage, a distributed decryption share and a public key of a data visitor are obtained, and the distributed decryption share is encrypted to output a decryption ciphertext.
In the decryption stage, a decryption ciphertext and a private key of a data visitor are obtained, and a distributed decryption share is obtained through decryption.
The embodiment of the invention uses a public key encryption algorithm and creatively proposes that the block chain encrypts the decryption ciphertext by adopting the public key of the data visitor in access control, thereby more protecting the confidentiality of the decryption ciphertext.
The process by which the data visitor gets the plaintext of the message is a read operation. Next, the steps of the read operation are described.
FIG. 4 is a schematic diagram of a read operation in an embodiment of the invention.
(1) Sending the hash value h of the message ciphertext, the message ciphertext C and an access control list ACL of a data owner to a database;
(2) Receiving a read request sent by a data visitor through a blockchain client and sending the read request to a database, wherein the read request comprises a hash value h of a message ciphertext and an access control list ACL of the data visitor, and the database feeds back the message ciphertext C and a decryption ciphertext Epk SM2i(σi when the access database list of the data visitor is in the range of the access control list of the data owner;
(3) Decrypting the decrypted ciphertext Epk SM2i(σi) to obtain a message plaintext m, comprising the following steps:
(3.1) decrypting the decrypted ciphertext Epk SM2i(σi) according to the private key sk SM2 of the data visitor to obtain a distributed decryption share sigma i;
(3.2) verifying whether the distributed decryption share sigma i is legal or not by adopting a second encryption algorithm;
(3.3) if yes, adding the distributed decryption share sigma i to the queue;
(3.4) when there is a first number of legitimate distributed decryption shares σ i in the queue, obtaining a key for the first encryption algorithm using the second encryption algorithm;
(3.5) decrypting the message ciphertext C using the key of the first encryption algorithm to obtain the message plaintext m.
Referring to fig. 5, the embodiment of the present invention further provides an access control device for data on a blockchain system, which is applied to any node on the blockchain system, and includes:
A first receiving module 501, configured to receive a hash value of a message ciphertext sent by a blockchain client, a key ciphertext, and an access control list of a data owner, where the message ciphertext is obtained by encrypting a message plaintext by the blockchain client using a first encryption algorithm, the key ciphertext is obtained by encrypting a key of the first encryption algorithm by the blockchain client using a second encryption algorithm, and the message plaintext and the access control list of the data owner are sent to the blockchain client by the data owner;
the distributed decryption share generating module 502 is configured to generate a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm;
A decryption ciphertext obtaining module 503, configured to encrypt the distributed decryption shares using the access control list of the data owner to obtain a decryption ciphertext;
A sending module 504, configured to send the decrypted ciphertext to a database, where the database asynchronously waits for the decrypted ciphertext corresponding to the access control list of the first number of matching data owners and then asynchronously stores the decrypted ciphertext;
The hash value sharing module 505 is configured to share hash values of message ciphertext to all data visitors, where the data visitors obtain decryption ciphertext from the database through the hash values and an access control list of the data visitors, and decrypt the decryption ciphertext to obtain a message plaintext.
Referring to fig. 6, the embodiment of the present invention further proposes another access control device for data on a blockchain system, which is applied to a blockchain client, and includes:
A second receiving module 601, configured to receive a message plaintext and a data owner access control list input by a data owner;
the first encryption module 602 is configured to encrypt the message plaintext by using a first encryption algorithm to obtain a message ciphertext;
A second encryption module 603, configured to encrypt a key of the first encryption algorithm with a second encryption algorithm to obtain a key ciphertext;
A hash value generation module 604, configured to generate a hash value of a message ciphertext, where the hash value is used for a data visitor to obtain the message plaintext;
The second sending module 605 is configured to send the hash value of the message ciphertext, the key ciphertext, and the access control list to the blockchain system, where after the key ciphertext obtains the distributed decryption share through the node private key, a node on the blockchain system encrypts the decryption share by using the access control list of the data owner to obtain a decryption ciphertext, and send the decryption ciphertext to the database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matching data owners and then asynchronously stores the decryption ciphertext.
Referring to fig. 7, an embodiment of the present invention further proposes an access control system for data on a blockchain system, including a blockchain system 702, a blockchain client 701, and a database 703, wherein,
A blockchain client for: receiving a message plaintext and an access control list which are input by a data owner; encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext, encrypting a key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext, and generating a hash value of the message ciphertext; sending the hash value of the message ciphertext, the key ciphertext and the access control list to a block chain system;
A node on a blockchain system for: receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner; generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm, and encrypting the distributed decryption share by using an access control list of a data owner to obtain a decryption ciphertext; sending the decrypted ciphertext to a database; the hash value of the message ciphertext is shared to all data visitors, and the data visitors acquire a decryption ciphertext from a database through the hash value and an access control list of the data visitors, and then decrypt the decryption ciphertext to acquire a message plaintext;
a database for: and asynchronously storing the decrypted ciphertext corresponding to the first number of matched access control lists after asynchronously waiting for the decrypted ciphertext.
The method and the system provided by the embodiment of the invention can be used for a personal digital health file system, and can be used for covering the medical data collection safety, the medical data transmission safety, the medical data storage safety, the medical data exchange safety, the medical data processing safety and the medical data destruction safety of the medical data full life cycle safety system standard.
The method and the system provided by the embodiment of the invention can be used for a data recording system in the public service field, the efficiency and the transparency of public service are improved by establishing a decentralized, transparent and non-tamperable data recording system, the data sharing and the safety among public service departments and between the public service departments and citizens are improved, and administrative procedures and the provision of the public service are simplified. By storing the key information and transaction records on the blockchain, the public service department can achieve a higher level of data traceability and compliance, and strengthen the supervision and administration capabilities, thereby providing more fair, efficient and trusted services to the public.
The method and the system provided by the embodiment of the invention have the beneficial effects that:
Compared with the traditional blockchain system with low performance, the method and the system provided by the embodiment of the invention do not depend on open source software or the existing blockchain platform, can quickly update and iterate, can store a large amount of core data in an uplink manner through a database and support on-chain operation, open a data island barrier, really realize the cooperative sharing and high-efficiency use of data resources, can ensure the activity of the system, reduce the difficulty and pressure of data maintenance, reduce the cost of the system in the storage and calling processes, and improve the safety and reliability of the system; through the access control list of the data owner, the query control can be precisely controllable in fine granularity, which data are available, when and by which people the data are read or used, and the access control authority can be dynamically determined and modified, so that the whole process is free from single-point errors, a trusted third party is not needed, and the reliability, activity and integrity of the blockchain system are ensured. In fine-grained access control, the scheme can add attributes of a data visitor and can add attributes of a supervisor at the same time. Therefore, the validity of the data can be ensured, and the supervisor can trace back the information.
An embodiment of the present invention further provides a computer device, and fig. 8 is a schematic diagram of the computer device in the embodiment of the present invention, where the computer device 800 includes a memory 810, a processor 820, and a computer program 830 stored in the memory 810 and capable of running on the processor 820, and when the processor 820 executes the computer program 830, the method for controlling access of data on the blockchain system is implemented.
The embodiment of the invention also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program realizes the method for controlling the access of the data on the blockchain system when being executed by a processor.
The embodiment of the invention also provides a computer program product, which comprises a computer program, wherein the computer program realizes the method for controlling the access of the data on the block chain system when being executed by a processor.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The foregoing description of the embodiments has been provided for the purpose of illustrating the general principles of the invention, and is not meant to limit the scope of the invention, but to limit the invention to the particular embodiments, and any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the invention are intended to be included within the scope of the invention.

Claims (16)

1. A method for controlling access to data on a blockchain system, applied to any node on the blockchain system, comprising:
Receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner, wherein the message ciphertext is obtained by encrypting a message plaintext by the blockchain client by adopting a first encryption algorithm, the key ciphertext is obtained by encrypting a key of the first encryption algorithm by the blockchain client by adopting a second encryption algorithm, and the message plaintext and the access control list of the data owner are sent to the blockchain client by the data owner;
Generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm;
encrypting the distributed decryption shares by using an access control list of the data owner to obtain a decryption ciphertext;
The decryption ciphertext is sent to a database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext;
The hash value of the message ciphertext is shared to all data visitors, and the data visitors acquire a decryption ciphertext from a database through the hash value and an access control list of the data visitors, and then decrypt the decryption ciphertext to acquire a message plaintext;
When the blockchain client encrypts a key of the first encryption algorithm by adopting a second encryption algorithm, acquiring the key of the first encryption algorithm, an access control list of a data owner and a blockchain system public key in an encryption stage of the second encryption algorithm, and outputting a key ciphertext to the key of the first encryption algorithm through the encryption algorithm;
When the second encryption algorithm is adopted to generate the distributed decryption share corresponding to the key ciphertext, in the decryption share generation stage of the second encryption algorithm, the node inputs the key ciphertext, the private key of the node and the access control list of the data owner, and the distributed decryption share of the corresponding node is output.
2. The method of claim 1, wherein the first encryption algorithm is a symmetric encryption algorithm;
The symmetrical encryption algorithm comprises the following steps:
In the symmetric encryption key generation stage, determining a key required by a symmetric encryption algorithm according to the security parameters;
in the encryption stage, a message plaintext and a secret key are obtained, and the message plaintext is encrypted by a symmetric encryption algorithm to obtain a message ciphertext;
in the decryption stage, a message ciphertext and a secret key are obtained, and a message plaintext is obtained through decryption by a symmetric encryption algorithm.
3. The method of claim 1, wherein the second encryption algorithm is a distributed encryption algorithm;
The steps of the distributed encryption algorithm include:
In the distributed encryption key generation stage, according to the security parameters, the number of nodes in the blockchain system and the number of fault-tolerant error nodes in the blockchain system, obtaining a public key of the blockchain system, a private key of each node and a verification key;
in the encryption stage, a key of a first encryption algorithm, an access control list of a data owner and a blockchain system public key are obtained, and a key ciphertext is output to the key of the first encryption algorithm through the encryption algorithm;
In the recovery stage, the plaintext or illegal tag of the message is output according to the verification key, decryption share and access control list of the data owner, which are input by the data visitor.
4. The method of claim 1, wherein the database is an SQL database;
The main key of the SQL database is a hash value of the message ciphertext when in storage, and the key value is the message ciphertext;
The first number is 1 plus the number of fault-tolerant error nodes in the block chain system;
the decryption ciphertext corresponding to the access control list of the first number of matching data owners is obtained according to the access control list of the same data owner.
5. The method of claim 1, wherein the access control list of data owners comprises a public key of a data visitor;
the access control list of the data visitor includes a public key of the data visitor.
6. The method for controlling the access of the data on the blockchain system is characterized by being applied to a blockchain client and comprising the following steps:
receiving a message plaintext input by a data owner and an access control list of the data owner;
encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext;
encrypting a key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext;
Generating a hash value of a message ciphertext, wherein the hash value is used for a data visitor to obtain the message plaintext;
The method comprises the steps that a hash value of a message ciphertext, a key ciphertext and an access control list are sent to a block chain system, wherein after the key ciphertext obtains a distributed decryption share through a node private key, a node on the block chain system encrypts the decryption share through the access control list of a data owner to obtain a decryption ciphertext, the decryption ciphertext is sent to a database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of a first number of matched data owners and then asynchronously stores the decryption ciphertext;
when a second encryption algorithm is adopted to encrypt a key of a first encryption algorithm to obtain a key ciphertext, in an encryption stage of the second encryption algorithm, the key of the first encryption algorithm, an access control list of a data owner and a blockchain system public key are obtained, and the key ciphertext is output to the key of the first encryption algorithm through the encryption algorithm;
when the key ciphertext obtains the distributed decryption share through the node private key, in the decryption share generation stage of the second encryption algorithm, the node inputs the key ciphertext, the private key of the node and the access control list of the data owner, and outputs the distributed decryption share of the corresponding node.
7. The method as recited in claim 6, further comprising:
generating a private key and a public key of the data visitor by adopting a third encryption algorithm, and transmitting the public key of the data visitor to the blockchain system;
And encrypting the distributed decryption shares by using an access control list of the data owner by adopting a third encryption algorithm to obtain a decryption ciphertext, wherein the access control list of the data visitor comprises a public key of the data visitor.
8. The method of claim 7, wherein the third encryption algorithm is a public key encryption algorithm;
The steps of the public key encryption algorithm include:
In the stage of generating a secret key of a public key secret algorithm, obtaining a private key and a public key of a data visitor according to the security parameters;
In the encryption stage, obtaining a distributed decryption share and a public key of a data visitor, and encrypting the distributed decryption share to output a decryption ciphertext;
In the decryption stage, a decryption ciphertext and a private key of a data visitor are obtained, and a distributed decryption share is obtained through decryption.
9. The method as recited in claim 6, further comprising:
sending the hash value of the message ciphertext, the message ciphertext and the access control list of the data owner to a database;
Receiving a read request sent by a data visitor through a blockchain client and sending the read request to a database, wherein the read request comprises a hash value of a message ciphertext and an access control list of the data visitor, and the database feeds back the message ciphertext and a decryption ciphertext when the access database list of the data visitor is within the range of the access control list of a data owner;
And decrypting the decrypted ciphertext to obtain a message plaintext.
10. The method of claim 6, wherein decrypting the decrypted ciphertext to obtain message plaintext, comprises:
decrypting the decrypted ciphertext according to the private key of the data visitor to obtain a distributed decryption share;
verifying whether the distributed decryption share is legal or not by adopting a second encryption algorithm;
If yes, adding the distributed decryption share into a queue;
When a first number of legal distributed decryption shares exist in the queue, a second encryption algorithm is adopted to obtain a key of the first encryption algorithm;
And decrypting the message ciphertext by using the key of the first encryption algorithm to obtain a message plaintext.
11. An access control device for data on a blockchain system, applied to any node on the blockchain system, comprising:
The first receiving module is used for receiving a hash value of a message ciphertext sent by the blockchain client, a key ciphertext and an access control list of a data owner, wherein the message ciphertext is obtained by encrypting a message plaintext by the blockchain client through a first encryption algorithm, the key ciphertext is obtained by encrypting a key of the first encryption algorithm by the blockchain client through a second encryption algorithm, and the message plaintext and the access control list of the data owner are sent to the blockchain client by the data owner;
the distributed decryption share generating module is used for generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm;
The decryption ciphertext obtaining module is used for encrypting the distributed decryption shares by using the access control list of the data owner to obtain a decryption ciphertext;
The sending module is used for sending the decrypted ciphertext to a database, and the database asynchronously waits for the decrypted ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decrypted ciphertext;
the hash value sharing module is used for sharing the hash value of the message ciphertext to all data visitors, and the data visitors acquire the decryption ciphertext from the database through the hash value and the access control list of the data visitors, and then decrypt the decryption ciphertext to acquire the message plaintext;
When the blockchain client encrypts a key of the first encryption algorithm by adopting a second encryption algorithm, acquiring the key of the first encryption algorithm, an access control list of a data owner and a blockchain system public key in an encryption stage of the second encryption algorithm, and outputting a key ciphertext to the key of the first encryption algorithm through the encryption algorithm;
When the second encryption algorithm is adopted to generate the distributed decryption share corresponding to the key ciphertext, in the decryption share generation stage of the second encryption algorithm, the node inputs the key ciphertext, the private key of the node and the access control list of the data owner, and the distributed decryption share of the corresponding node is output.
12. An access control device for data on a blockchain system, applied to a blockchain client, comprising:
the second receiving module is used for receiving the message plaintext input by the data owner and the access control list of the data owner;
the first encryption module is used for encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext;
The second encryption module is used for encrypting the key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext;
The hash value generation module is used for generating a hash value of the message ciphertext, wherein the hash value is used for a data visitor to obtain the message plaintext;
the second sending module is used for sending the hash value of the message ciphertext, the key ciphertext and the access control list to the blockchain system, wherein after the key ciphertext obtains a distributed decryption share through a node private key, a node on the blockchain system encrypts the decryption share by using the access control list of the data owner to obtain a decryption ciphertext, and sends the decryption ciphertext to the database, and the database asynchronously waits for the decryption ciphertext corresponding to the access control list of the first number of matched data owners and then asynchronously stores the decryption ciphertext;
when a second encryption algorithm is adopted to encrypt a key of a first encryption algorithm to obtain a key ciphertext, in an encryption stage of the second encryption algorithm, the key of the first encryption algorithm, an access control list of a data owner and a blockchain system public key are obtained, and the key ciphertext is output to the key of the first encryption algorithm through the encryption algorithm;
when the key ciphertext obtains the distributed decryption share through the node private key, in the decryption share generation stage of the second encryption algorithm, the node inputs the key ciphertext, the private key of the node and the access control list of the data owner, and outputs the distributed decryption share of the corresponding node.
13. A data access control system on a blockchain system is characterized by comprising a blockchain system, a blockchain client and a database, wherein,
A blockchain client for: receiving a message plaintext and an access control list which are input by a data owner; encrypting the message plaintext by adopting a first encryption algorithm to obtain a message ciphertext, encrypting a key of the first encryption algorithm by adopting a second encryption algorithm to obtain a key ciphertext, and generating a hash value of the message ciphertext; sending the hash value of the message ciphertext, the key ciphertext and the access control list to a block chain system;
A node on a blockchain system for: receiving a hash value of a message ciphertext sent by a blockchain client, a key ciphertext and an access control list of a data owner; generating a distributed decryption share corresponding to the key ciphertext by adopting a second encryption algorithm, and encrypting the distributed decryption share by using an access control list of a data owner to obtain a decryption ciphertext; sending the decrypted ciphertext to a database; the hash value of the message ciphertext is shared to all data visitors, and the data visitors acquire a decryption ciphertext from a database through the hash value and an access control list of the data visitors, and then decrypt the decryption ciphertext to acquire a message plaintext;
A database for: asynchronously waiting for decryption ciphertext corresponding to the first number of matching access control lists, and then asynchronously storing;
when a second encryption algorithm is adopted to encrypt a key of a first encryption algorithm to obtain a key ciphertext, in an encryption stage of the second encryption algorithm, the key of the first encryption algorithm, an access control list of a data owner and a blockchain system public key are obtained, and the key ciphertext is output to the key of the first encryption algorithm through the encryption algorithm;
When the second encryption algorithm is adopted to generate the distributed decryption share corresponding to the key ciphertext, in the decryption share generation stage of the second encryption algorithm, the node inputs the key ciphertext, the private key of the node and the access control list of the data owner, and the distributed decryption share of the corresponding node is output.
14. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method of any of claims 1 to 10 when executing the computer program.
15. A computer readable storage medium, characterized in that the computer readable storage medium stores a computer program which, when executed by a processor, implements the method of any of claims 1 to 10.
16. A computer program product, characterized in that the computer program product comprises a computer program which, when executed by a processor, implements the method of any of claims 1 to 10.
CN202410622278.6A 2024-05-20 2024-05-20 Method, device and system for controlling access of data on block chain system Active CN118214614B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202410622278.6A CN118214614B (en) 2024-05-20 2024-05-20 Method, device and system for controlling access of data on block chain system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202410622278.6A CN118214614B (en) 2024-05-20 2024-05-20 Method, device and system for controlling access of data on block chain system

Publications (2)

Publication Number Publication Date
CN118214614A CN118214614A (en) 2024-06-18
CN118214614B true CN118214614B (en) 2024-07-30

Family

ID=91448923

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202410622278.6A Active CN118214614B (en) 2024-05-20 2024-05-20 Method, device and system for controlling access of data on block chain system

Country Status (1)

Country Link
CN (1) CN118214614B (en)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109120639A (en) * 2018-09-26 2019-01-01 众安信息技术服务有限公司 A kind of data cloud storage encryption method and system based on block chain
CN112836229A (en) * 2021-02-10 2021-05-25 北京深安信息科技有限公司 Attribute-based encryption and block-chaining combined trusted data access control scheme

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10084600B1 (en) * 2018-04-16 2018-09-25 Xage Security, Inc. Decentralized information protection for confidentiality and tamper-proofing on distributed database
CN111371561B (en) * 2020-02-27 2023-07-11 华信咨询设计研究院有限公司 Alliance block chain data access control method based on CP-ABE algorithm
CN113098697B (en) * 2021-06-08 2022-03-18 清华大学 Block chain data writing and accessing method and device
CN113783836B (en) * 2021-08-02 2023-06-20 南京邮电大学 Internet of things data access control method and system based on block chain and IBE algorithm
CN114679271A (en) * 2022-05-25 2022-06-28 南京理工大学 Block chain private data access control method and system
CN118013573A (en) * 2024-01-30 2024-05-10 安徽师范大学 Block chain-based health data multilayer secure sharing method and system

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109120639A (en) * 2018-09-26 2019-01-01 众安信息技术服务有限公司 A kind of data cloud storage encryption method and system based on block chain
CN112836229A (en) * 2021-02-10 2021-05-25 北京深安信息科技有限公司 Attribute-based encryption and block-chaining combined trusted data access control scheme

Also Published As

Publication number Publication date
CN118214614A (en) 2024-06-18

Similar Documents

Publication Publication Date Title
US10673626B2 (en) Threshold secret share authentication proof and secure blockchain voting with hardware security modules
US12088568B2 (en) Systems and methods for secure key service
EP3610606B1 (en) Managing sensitive data elements in a blockchain network
US11159307B2 (en) Ad-hoc trusted groups on a blockchain
CN110933020B (en) Cryptographic logic exports submissions from execution blockchain
CN108418680B (en) Block chain key recovery method and medium based on secure multi-party computing technology
US20220327530A1 (en) Digital signature generation using a cold wallet
CN111371790B (en) Data encryption sending method based on alliance chain, related method, device and system
CN110601830B (en) Key management method, device, equipment and storage medium based on block chain
CN109547218B (en) Alliance link node key distribution and backup system for improving BIP (building information processing) protocol
US11588631B2 (en) Systems and methods for blockchain-based automatic key generation
US11563575B2 (en) Communication node, method of operating thereof and collaborative system
CN115495768A (en) Secret-related information processing method and system based on block chain and multi-party security calculation
CN115345618B (en) Block chain transaction verification method and system based on mixed quantum digital signature
CN113676328A (en) Design for exchanging key information
US20240048361A1 (en) Key Management for Cryptography-as-a-service and Data Governance Systems
CN115913513A (en) Distributed credible data transaction method, system and device supporting privacy protection
Zhang et al. Data security in cloud storage
CN112187767A (en) Multi-party contract consensus system, method and medium based on block chain
CN118214614B (en) Method, device and system for controlling access of data on block chain system
CN114782160A (en) Method and system for obtaining total credit lines of different subsidiaries in group
CN110912688B (en) Anti-quantum-computation private key backup, loss reporting and recovery method and system based on alliance chain
CN111858768A (en) Device for optimizing block chain trusted node and consensus algorithm
CN116938985B (en) Data streaming method, device, terminal equipment and medium based on digital certificates
EP4283918B1 (en) Methods and arrangements for enabling secure digital communications among a group

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 40105751

Country of ref document: HK