CN116226880A - Block chain ciphertext retrieval security traceability system based on searchable encryption - Google Patents

Abstract

The invention relates to the technical field of computers, in particular to a block chain ciphertext retrieval security traceability system based on searchable encryption. The system comprises an access record tracing module, a data tracing module and an authentication center, wherein a alliance chain distributed data storage system structure supporting data cooperation and an access control mechanism are constructed, and searchable encryption is utilized to realize block chain storage privacy protection and data tracing, so that authorized use, trusted transmission and comprehensive utilization of large-scale complex data of a cross-mechanism and a main body are realized, and further, management and tracing of key data are realized.

Description

Block chain ciphertext retrieval security traceability system based on searchable encryption

Technical Field

The invention relates to the technical field of computers, in particular to a block chain ciphertext retrieval security traceability system based on searchable encryption.

Background

In the alliance chain, the cryptography technology and the admission mechanism of the blockchain can prevent illegal data access, the chain data structure and the consensus mechanism make the data on the chain difficult to be illegally tampered and forged, and the distributed storage architecture improves the durability of the data storage, and the confidentiality and the credibility of the data are ensured. At the same time, the participants in the blockchain may view all of the transaction information in the blockchain, i.e., the world state ledgers and the data assets stored in the transaction information.

In the actual use process, the user unit can store the key data into the blockchain ledger, realize the tracing of the data based on the blockchain tamper-proof characteristic and ensure the authenticity of tracing information. However, in the actual data management process, sensitive information such as internal information of a user and some records is involved, and the user does not want all the participants of the alliance chain and the platform user to view all the data due to the worry about the leakage of the sensitive information.

Therefore, in the current technical scheme, there are problems of management and tracing of key data.

Disclosure of Invention

Aiming at the technical problems in the related art, the invention provides a block chain ciphertext retrieval security traceability system based on searchable encryption, which constructs a alliance chain distributed data storage system structure and an access control mechanism supporting data collaboration, and realizes block chain storage privacy protection and data traceability by using the searchable encryption, thereby realizing authorized use, trusted transmission and comprehensive utilization of large-scale complex data of cross-institutions and main bodies and overcoming the defects in the prior art.

In order to achieve the technical purpose, the invention provides a block chain ciphertext retrieval security traceability system based on searchable encryption, which comprises:

an access record tracing module, configured to generate a bloom filter including a plurality of transaction messages based on the generated transaction messages, and then send a recovery message to the consensus node, and then receive a response message from the consensus node, where the response message includes at least one additional transaction message;

the data tracing module is used for constructing a safe index for the data held by the data holder, storing the safe index and the encrypted data into the blockchain platform together, sending a query phrase to the data holder when an authorized user expects to query in a blockchain transaction set containing ciphertext data, generating a corresponding query trapdoor based on the query phrase by the data holder, giving the query trapdoor to the user, and sending the query trapdoor to the novel intelligent contract module when the user obtains the query trapdoor from the data holder, so as to be used for the novel intelligent contract module to execute and find blockchain transaction information containing specified data from a blockchain;

and the authentication center is used for receiving a decryption key request sent by a user, decrypting the obtained encrypted data based on the decryption key request and obtaining a plaintext inquiry result.

In some implementations, the tracing system further includes:

and the initialization and block synchronization module is used for directly communicating with other nodes based on the P2P network mode by the block and broadcasting data to the whole network, wherein each node is equal in position.

In some implementations, the tracing system further includes:

and deploying an intelligent contract module for storing the summary data and the file position data into the blockchain based on calling the intelligent contract.

In some implementations, the tracing system further includes:

and the data uploading module is used for storing the encrypted ciphertext data in a storage cluster in the form of a file.

In some implementations, the tracing system further includes:

and the data access module is used for embedding the decryption strategy into the secret when encrypting based on the CP-ABE algorithm, embedding the attribute of the user into the corresponding private key when generating the secret key, and associating the access strategy with the secret key to realize finer-granularity user-level data access control.

In some implementations, the tracing system further includes:

the data integrity checking module is used for executing integrity checking on the acquired ciphertext data by the basic service platform when a user accesses the data, or acquiring ciphertext data and communicating with a block chain node to acquire summary data under the condition that the user inquires the correctness of the data integrity checking executed by the basic service platform, and if the summaries of the ciphertext data are calculated locally and compared and are the same, the data are not tampered.

In some implementations, the tracing system further includes:

and the data index construction module is used for constructing a target index based on an internal data storage structure and searching the blockchain data.

In some implementations, the block, based on the P2P network mode, communicates directly with other nodes, broadcasting data to the whole network, where each node is equal in position, comprising:

the data storage service provider executes a block chain initialization script file starting node to generate an creation block, waits for the block chain node of a corresponding user entity to be accessed, and starts a storage cluster, a basic service platform program and a monitoring platform program;

the user starts the block chain link point to access the alliance chain, the access process alliance chain network can verify the identity of the node, and the legal node can be successfully added into the alliance chain; after accessing the network, the node starts a monitoring thread, waits for the peer node in the network to broadcast data, checks whether the self block is up to date, and synchronizes the block from other nodes if not;

after the node monitors the broadcasted transaction or block data, if the signature of the transaction or block is verified to be valid, the data is further processed and forwarded to other peer nodes; and passes chains containing the same information data through the establishment of unique hash values and establishes master-slave blocks based on the unique hash values.

In some implementations, the storing summary data and file location data in the blockchain based on invoking the smart contract includes:

compiling the written intelligent contract into binary codes and deploying the binary codes into a blockchain network;

in the case of a user transmitting access data, verifying data integrity, querying a data access record, etc., transaction data is constructed and signed using a private key.

In some implementations, the building a target index based on the internal data storage structure, retrieving blockchain data, includes:

based on the primary key index of the storage bottom layer address and the auxiliary index pointing to the address primary key index, the blockchain bottom layer level DB is used as the primary key index, actual data is obtained from the level DB after key is obtained, and the auxiliary index is designed to organize and manage the primary key index, so that inquiry is realized.

The invention discloses a block chain ciphertext retrieval security tracing system based on searchable encryption, which comprises an access record tracing module, a data tracing module and an authentication center, wherein a alliance chain distributed data storage system structure supporting data collaboration and an access control mechanism are constructed, and the searchable encryption is utilized to realize the block chain storage privacy protection and the data tracing, so that the authorized use, the trusted transmission and the comprehensive utilization of large-scale complex data of a cross-mechanism and a main body are realized, and further the management and the tracing of key data are realized.

Drawings

In order to more clearly illustrate the technical solution of the embodiments of the present invention, the drawings that are needed to be used in the embodiments of the present invention will be briefly described, and other drawings can be obtained according to these drawings without inventive effort for a person skilled in the art.

The structures, proportions, sizes, and sequences of elements in the drawings are shown in the specification, and are used for understanding and reading by those skilled in the art, and are not intended to limit the scope of the invention, so that any structural modifications, changes in proportions, or adjustments of the sequences of operations, without affecting the efficacy or achievement of the present invention, should fall within the scope of the technical disclosure.

Fig. 1 is a schematic structural diagram of a block chain ciphertext retrieval security traceability system based on searchable encryption according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a novel bloom filter according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a main-side block structure according to an embodiment of the present invention;

fig. 4 is a schematic diagram of a large-scale distributed storage data uploading process according to an embodiment of the present invention.

Detailed Description

Features and exemplary embodiments of various aspects of the present invention will be described in detail below, and in order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely configured to illustrate the invention and are not configured to limit the invention. It will be apparent to one skilled in the art that the present invention may be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the invention by showing examples of the invention.

It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.

In the alliance chain, the cryptography technology and the admission mechanism of the blockchain can prevent illegal data access, the chain data structure and the consensus mechanism make the data on the chain difficult to be illegally tampered and forged, and the distributed storage architecture improves the durability of the data storage, and the confidentiality and the credibility of the data are ensured. At the same time, the participants in the blockchain may view all of the transaction information in the blockchain, i.e., the world state ledgers and the data assets stored in the transaction information.

In the actual use process, the user unit can store the key data into the blockchain ledger, realize the tracing of the data based on the blockchain tamper-proof characteristic and ensure the authenticity of tracing information. However, in the actual data management process, sensitive information such as internal information of a user and some records is involved, and the user does not want all the participants of the alliance chain and the platform user to view all the data due to the worry about the leakage of the sensitive information.

Therefore, in the current technical scheme, there are problems of management and tracing of key data.

Taking intelligent medical treatment as an example, a hospital can store key data into a blockchain ledger, and the traceability of medical health data is realized and the authenticity of traceability information is ensured based on the blockchain tamper-proof characteristic. However, in the actual medical data management process, sensitive information such as internal information of a hospital and medical records of a patient may be involved, and the hospital does not want all participants of the alliance chain and platform users to view all data due to concerns about leakage of the sensitive information.

When the alliance chain is applied to scenes with high security level and large data volume, such as intelligent medical treatment, the data assets need to be combined with on-chain storage and off-chain storage mechanisms, namely, information such as source addresses, hash hashes and the like of key data stored in a secret state form in a blockchain, and the original data is stored in a remote server in an encrypted mode. At present, a federation chain distributed data storage system structure supporting data collaboration and an access control mechanism are urgently required to be constructed, and block chain storage privacy protection and data security traceability are realized by utilizing searchable encryption so as to realize: a user with access authority firstly obtains related ciphertext information from a blockchain, obtains a decryption key, and then obtains information such as a data source address, a hash value and the like through decrypting data. Based on the decrypted data, the user will issue a data request to the out-of-chain server. After receiving the request, the out-of-chain server judges the user permission based on the intelligent contract, and if the permission is satisfied, the data is returned to the user.

In order to realize the management and tracing of key data, the scheme provides a block chain ciphertext retrieval safety tracing model based on searchable encryption, and provides technical support for full life cycle tracing of key data in a system while meeting the requirement of large-scale heterogeneous data fine granularity management.

The technical scheme provided by the embodiment of the invention is described below with reference to the accompanying drawings.

Fig. 1 is a schematic structural diagram of a block chain ciphertext retrieval security traceability system based on searchable encryption according to an embodiment of the present invention, as shown in fig. 1, the system includes:

an access record tracing module 101, configured to generate a bloom filter including a plurality of transaction messages based on a generated transaction message, then send a recovery message to a consensus node, and finally receive a response message from the consensus node, where the response message includes at least one additional transaction message;

a data tracing module 102, configured to construct a secure index for the data held by the data holder, store the secure index in the blockchain platform together with the encrypted data, and send a query phrase to the data holder when the authorized user desires to query in the blockchain transaction set including ciphertext data, generate a corresponding query trapdoor based on the query phrase, and give the query trapdoor to the user, and send the query trapdoor to the new type intelligent contract module when the user obtains the query trapdoor from the data holder, for the new type intelligent contract module to execute and find blockchain transaction information including specified data from the blockchain;

and the authentication center 103 is used for receiving a decryption key request sent by a user, and decrypting the obtained encrypted data based on the decryption key request to obtain a plaintext inquiry result.

It should be further noted that, in the execution of the data tracing using the bloom filter, a plurality of transaction messages may be stored in the bloom filter, where each transaction message includes a transaction value. However, conventional bloom filters may suffer multiple access failures during a data query. This is because in blockchain applications, the vast amount of data information and limited memory resources makes it necessary for the bloom filter to select off-chip storage. The blockchain data is stored in a file form, and tens of thousands of elements are often corresponding to one bloom filter, and accordingly, the number of bits contained in the blockchain data is increased, and the blockchain data can only be continuously stored on a plurality of cache lines. Then in the worst case, making a block (transaction) query can result in a memory miss, which can be fatal to the impact of the query performance. To reduce memory misses generated in bloom filter calculations, a new bloom filter is used, the filter structure of which is shown in fig. 2. The system is to generate a bloom filter of the transaction message, wherein the bloom filter is generated using a plurality of hash cycles and has a size that is at least twice the number of transaction messages. At the same time, the system will generate a number of hash cycles that includes the number of transaction messages. The system then sends a recovery message to the consensus node. Finally, a response message is received from the consensus node, including at least one additional transaction message. Through the prefiltering operation of the bloom filter, the searching efficiency of the data can be improved, and the data tracing time under the large-scale heterogeneous data storage can be reduced.

Therefore, the main content of the invention is to construct a alliance chain distributed data storage system structure and an access control mechanism supporting data collaboration, and realize block chain storage privacy protection and data tracing by utilizing searchable encryption, thereby realizing authorized use, trusted transmission and comprehensive utilization of large-scale complex data of cross-institutions and main bodies.

In some embodiments, the invention constructs a block structure oriented to support data collaboration, wherein a novel master-slave block structure is adopted for adapting across-organization and entity heterogeneous data scenes. This structure is shown in fig. 3. The left block and the right block are simple representations of a previous block and a next block of the middle block, and the upper part of the middle block is a block head and comprises a previous block hash, a unique information hash value and a self hash value. The lower part is a block body containing the data information of the block. Compared with the block chain of the traditional single-chain structure, the master-slave block structure is added with a unique information hash value for matching and converting heterogeneous data.

In some embodiments, the traceability system further comprises an initialization and block synchronization module for the block to communicate directly with other nodes based on the P2P network mode, broadcasting data to the whole network, wherein each node is equal in status.

In some embodiments, the tracing system further comprises a deployment smart contract module for storing summary data and file location data in the blockchain based on invoking the smart contract.

In some embodiments, the tracing system further includes a data upload module configured to store the encrypted ciphertext data in a storage cluster in the form of a file. In particular the data upload process may be as shown in fig. 4.

In some embodiments, the traceability system further includes a data access module, configured to embed the decryption policy into the secret when encrypting based on the CP-ABE algorithm, and the attribute of the user is embedded into the corresponding private key when generating the key, and associate the access policy with the secret, so as to implement finer-granularity user-level data access control.

In some embodiments, the tracing system further includes a data integrity verification module, configured to perform integrity verification on the obtained ciphertext data by the base service platform when the user accesses the data, or obtain the ciphertext data and communicate with the blockchain node to obtain summary data if the user challenges the correctness of the data integrity verification performed by the base service platform, and if the summaries of the ciphertext data calculated locally are compared and the summaries obtained from the blockchain are the same, it is indicated that the data has not been tampered;

in some embodiments, the traceability system further comprises a data index construction module for constructing a target index based on the internal data storage structure to retrieve the blockchain data.

In some embodiments, the block, based on the P2P network mode, communicates directly with other nodes, broadcasting data to the whole network, wherein each node is equal in position, comprising:

the data storage service provider executes a block chain initialization script file starting node to generate an creation block, waits for the block chain node of a corresponding user entity to be accessed, and starts a storage cluster, a basic service platform program and a monitoring platform program;

the user starts the block chain link point to access the alliance chain, the access process alliance chain network can verify the identity of the node, and the legal node can be successfully added into the alliance chain; after accessing the network, the node starts a monitoring thread, waits for the peer node in the network to broadcast data, checks whether the self block is up to date, and synchronizes the block from other nodes if not;

after the node monitors the broadcasted transaction or block data, if the signature of the transaction or block is verified to be valid, the data is further processed and forwarded to other peer nodes; and passes chains containing the same information data through the establishment of unique hash values and establishes master-slave blocks based on the unique hash values.

In some embodiments, storing summary data and file location data into a blockchain based on invoking a smart contract includes:

compiling the written intelligent contract into binary codes and deploying the binary codes into a blockchain network;

in the case of a user transmitting access data, verifying data integrity, querying a data access record, etc., transaction data is constructed and signed using a private key.

In some embodiments, building a target index based on an internal data storage structure, retrieving blockchain data includes:

based on the primary key index of the storage bottom layer address and the auxiliary index pointing to the address primary key index, the blockchain bottom layer level DB is used as the primary key index, actual data is obtained from the level DB after key is obtained, and the auxiliary index is designed to organize and manage the primary key index, so that inquiry is realized.

The block chain ciphertext retrieval safety tracing system based on the searchable encryption provided by the invention adopts the improved bloom filter as an index to realize ciphertext retrieval and safety tracing of block chain data. The structure of the novel bloom filter limits the mapping space of one element to one set. One cache line may hold at least one set, and multiple sets may be read by one access operation during a query. Even if the group to which the element is mapped is not in the cache, all the mapping bits can be read only by one access operation, so that the access failure times are limited to 1. This ensures efficient, accurate and reliable traceability in large scale heterogeneous data scenarios. Through the prefiltering operation of the bloom filter, the query performance of the data can be improved, and the data tracing time under the large-scale heterogeneous data storage can be reduced.

It should be understood that the invention is not limited to the particular arrangements and instrumentality described above and shown in the drawings. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present invention are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after appreciating the spirit of the present invention.

The functional blocks shown in the above-described structural block diagrams may be implemented in hardware, software, firmware, or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), suitable firmware, a plug-in, a function card, or the like. When implemented in software, the elements of the invention are the programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine readable medium or transmitted over transmission media or communication links by a data signal carried in a carrier wave. A "machine-readable medium" may include any medium that can store or transfer information. Examples of machine-readable media include electronic circuitry, semiconductor Memory devices, read-Only Memory (ROM), flash Memory, removable Read-Only Memory (Erasable Read Only Memory, EROM), floppy disks, compact discs (Compact Disc Read-Only Memory, CD-ROM), optical discs, hard disks, fiber optic media, radio Frequency (RF) links, and so forth. The code segments may be downloaded via computer networks such as the internet, intranets, etc.

It should also be noted that the exemplary embodiments mentioned in this disclosure describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above-described steps, that is, the steps may be performed in the order mentioned in the embodiments, or may be performed in a different order from the order in the embodiments, or several steps may be performed simultaneously.

Aspects of the present disclosure are described above with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions/acts specified in the flowchart and/or block diagram block or blocks. Such a processor may be, but is not limited to being, a general purpose processor, a special purpose processor, an application specific processor, or a field programmable logic circuit. It will also be understood that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware which performs the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In the foregoing, only the specific embodiments of the present invention are described, and it will be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the systems, modules and units described above may refer to the corresponding processes in the foregoing method embodiments, which are not repeated herein. It should be understood that the scope of the present invention is not limited thereto, and any equivalent modifications or substitutions can be easily made by those skilled in the art within the technical scope of the present invention, and they should be included in the scope of the present invention.

Claims (10)

1. A blockchain ciphertext retrieval security traceability system based on searchable encryption, the system comprising:

an access record tracing module, configured to generate a bloom filter including a plurality of transaction messages based on the generated transaction messages, and then send a recovery message to the consensus node, and then receive a response message from the consensus node, where the response message includes at least one additional transaction message;

the data tracing module is used for constructing a security index for the data held by the data holder, storing the security index and the encrypted data into the blockchain platform, sending a query phrase to the data holder when an authorized user expects to query in a blockchain transaction set containing ciphertext data, generating a corresponding query trapdoor based on the query phrase by the data holder, giving the query trapdoor to the user, and sending the query trapdoor to the novel intelligent contract module when the user obtains the query trapdoor from the data holder, so as to be used for the novel intelligent contract module to execute and find blockchain transaction information containing specified data from a blockchain;

and the authentication center is used for receiving a decryption key request sent by a user, decrypting the obtained encrypted data based on the decryption key request and obtaining a plaintext inquiry result.

2. The tracing system of claim 1, wherein said tracing system further comprises:

and the initialization and block synchronization module is used for directly communicating with other nodes based on the P2P network mode by the block and broadcasting data to the whole network, wherein each node is equal in position.

3. The tracing system of claim 1, wherein said tracing system further comprises:

and deploying an intelligent contract module for storing the summary data and the file position data into the blockchain based on calling the intelligent contract.

4. The tracing system of claim 1, wherein said tracing system further comprises:

and the data uploading module is used for storing the encrypted ciphertext data in a storage cluster in the form of a file.

5. The tracing system of claim 1, wherein said tracing system further comprises:

and the data access module is used for embedding the decryption strategy into the secret when encrypting based on the CP-ABE algorithm, embedding the attribute of the user into the corresponding private key when generating the secret key, and associating the access strategy with the secret key to realize finer-granularity user-level data access control.

6. The tracing system of claim 1, wherein said tracing system further comprises:

the data integrity checking module is used for executing integrity checking on the acquired ciphertext data by the basic service platform when a user accesses the data, or acquiring ciphertext data and communicating with a block chain node to acquire summary data under the condition that the user inquires the correctness of the data integrity checking executed by the basic service platform, and if the summaries of the ciphertext data are calculated locally and compared and are the same, the data are not tampered.

7. The tracing system of claim 1, wherein said tracing system further comprises:

and the data index construction module is used for constructing a target index based on an internal data storage structure and searching the blockchain data.

8. The traceability system of claim 2, wherein said block communicates directly with other nodes based on P2P network mode, broadcasting data to the whole network, wherein each node is equal in status, comprising:

the data storage service provider executes a block chain initialization script file starting node to generate an creation block, waits for the block chain node of a corresponding user entity to be accessed, and starts a storage cluster, a basic service platform program and a monitoring platform program;

the user starts the block chain link point to access the alliance chain, the access process alliance chain network can verify the identity of the node, and the legal node can be successfully added into the alliance chain; after accessing the network, the node starts a monitoring thread, waits for the peer node in the network to broadcast data, checks whether the self block is up to date, and synchronizes the block from other nodes if not;

after the node monitors the broadcasted transaction or block data, if the signature of the transaction or block is verified to be valid, the data is further processed and forwarded to other peer nodes; and passes chains containing the same information data through the establishment of unique hash values and establishes master-slave blocks based on the unique hash values.

9. The tracing system of claim 3, wherein said storing summary data and file location data into a blockchain based on invoking an intelligent contract comprises:

compiling the written intelligent contract into binary codes and deploying the binary codes into a blockchain network;

in the case of a user transmitting access data, verifying data integrity, querying a data access record, etc., transaction data is constructed and signed using a private key.

10. The traceability system of claim 7, wherein said constructing a target index based on an internal data storage structure, retrieving blockchain data, comprises:

based on the primary key index of the storage bottom layer address and the auxiliary index pointing to the address primary key index, the blockchain bottom layer level DB is used as the primary key index, actual data is obtained from the level DB after key is obtained, and the auxiliary index is designed to organize and manage the primary key index, so that inquiry is realized.

Images