Summary of the invention
The present invention assuming that all information owners be all it is trusty, sharing request person be it is non-believable, i.e., it is shared to ask
It can be proposed a kind of based on property broker weight with collusion, under the premise of the user information of unauthorized access unauthorized between the person of asking
The block chain cloud storage sharing method of encryption, it has merged block chain technology and cryptological technique is a kind of shared with existing information
The technology that system is mutually compatible with.Simulation result shows that the present invention has lower be calculated as than existing information storage technology of sharing
Sheet and communication overhead, and user is more able to satisfy to the safety of information and the demand of confidentiality.
The present invention is achieved by the following technical solutions.
A kind of block chain ciphertext cloud storage sharing method based on property broker re-encryption of the present invention, by following step
It is rapid:
(S01): before carrying out information storage, system formulates intelligent contract first, and is signed jointly by information user.
(S02): information owner Alan sends storage request, verifies the transmission that pond common recognition mechanism is chosen by Pool and leads section
Masses node T of the point T into oneself clusternThe validity of verifying broadcasts information and user identity.
If 1) be temporarily stored in the log of oneself after effectively, extracting data by transmission leader node T;
If 2) invalid, " illegal user " is fed back.
(S03): masses node T of the transmission leader node T into all clustersnCopy Info and wait-for-response, in determination
The node that at least cluster internal alreadys exceed half quantity has received after information again to information owner's Alan confirmation message
It is received, it indicates that information is at this time after information owner Alan receives confirmation message and has been filed on state, T is again to TnHair
Notice informs that the data mode has been filed on.In the process, information owner Alan need to submit information offer and it is customized with
Machine character string obtains information sharing remuneration in order to user, and provides certain credit as guarantee fund, to avoid falseness,
Phenomena such as plagiarism.
(S04): transmission node sends storage information to memory node, from being responsible for the leader node M of storage to oneself cluster
Interior MiBroadcast storage request.After determining more than the completion storage of half node, to information owner's Alan feedback information, this is deposited
Storage process terminates.
(S05): sharing request person Bill sends sharing request, before information sharing, storage leader node M in cluster to
Masses' node M in oneself clusteriVerifying broadcasts user identity, determines whether it meets Cryptograph Sharing permission.
If 1) meet, from node M of the leader node M into oneself clusteriBroadcasting share request;
2) if it is not, then feeding back " illegal user ".
(S06): the keyword w provided according to sharing request person Bill, calculating will after metadata ciphertext CT in block chain
It is converted into meeting the ciphertext CT of the Share Permissions of sharing request person Bill using proxy re-encryption technologyB。
1) system generates corresponding search password TK according to public key PK, keyword w and obtains search result information and each information
Corresponding quotation.
2) sharing request person Bill credit and user sharing information price are determined, if credit is more than or equal to information valence
Lattice then enter ciphertext and convert the stage;Otherwise, " Sorry, your ticket has not enough value " is fed back.
(S07): transmission leader node T T into all clustersnNode Copy Info and wait-for-response.At least collect in determination
After the internal node for alreading exceed half quantity of group has received information, to memory node confirmation message after indicate that at this time
Information is in transmission state.
(S08): transmission node sends the metadata ciphertext obtained by keyword searching ciphertext to sharing request person Bill
CT, and the storage location LC by obtaining information after decryption, thus in corresponding position download decryption prime information ciphertext CTA, obtain
Information plaintext m.
(S09): system makees corresponding adjust and according to the data of feedback according to information exchange situation, to the credit of user
Carry out credit clearing.
Steps are as follows for more specific realization of the invention:
The present invention is mainly around three roles: cloud storage, information owner, sharing request person are designed, and Fig. 1 is this hair
Bright proposition block chain ciphertext storage system illustraton of model, Fig. 2 are that the present invention proposes block chain cipher-text information shared system illustraton of model, tool
Body character design is as follows:
1) cloud storage: it is responsible for providing memory space, user can buy corresponding memory space to CSP, convenient for storage
Record information.
2) information owner: all users possess the permission of record storage information in system, to information can encrypt and pre-
Share Permissions are first set, and only sharing request person could decrypt under the premise of meeting shared information permission obtains key, to obtain
The original plaintext message that the breath owner that wins the confidence shares, it is assumed that information owner is Alan.
3) sharing request person: user can initiate shared information request to information owner or local node in system, it is assumed that
Sharing request person is Bill.Symbol used in the present invention is as shown in table 1:
1 denotational description of table
Step 1: creation contract.
1) contract founder converts binary system contract for the contract with user property aggregating characteristic using high-level language
Code, is recorded in local network;
2) manager convenes all local users to sign contract;
3) after node confirmation signature, through ether mill deploying virtual machine in the block chain of ether mill;
4) contract address and call instruction are fed back into contract user
Step 2: election leadership's node, and verify the legitimacy of user identity.
It in the block catenary system of decentralization, is independent from each other between node, by knowing together, mechanism algorithm reaches " letter
Appoint ", each node realizes the unification of internal system information under the premise of meeting self benefits.It is verified in the present invention according to Pool
All nodes are divided into two classes: memory node, transmission node by the working principle of pond common recognition mechanism, and actual needs.Each section
Point can be at three kinds of states: leader node, election contest node and masses' node.
1) before in the initial state, information owner sends storage request, all participation nodes are all masses' nodes.
2) before being not received by leader node order, all masses' nodes can select by way of democracy is voted
Leader node is taken, who gets the most votes within the time of 150-300ms, and person's election contest node is chosen as leader node.
3) once campaigning for successfully, leader node can be according to all masses' nodes of tissue cluster internal of Raft agreement to system
Internal newest Transaction Information is transmitted, is stored;Remaining node becomes masses' node again automatically, and the instruction for obeying leader node is complete
At assigned work.
Step 3: information owner Alan submits information and provides certain guarantee gold and the shared report of user information to system
Reward, node is after the validity of confirmation transaction, cluster internal node Copy Info, after most node completion tasks and to information
Owner's Alan feedback information.
Step 4: the information that node is provided according to information owner Alan generates cipher-text information CTA, metadata Data → LC,
W, IN }, ciphertext CT, and storage request is broadcasted in cluster internal, after the most nodes of determination have completed storage, to information category
Main Alan feeds back storage result, and storage is completed.
The present invention realizes encryption, the decrypting process of information, wherein information is encrypted by property broker Re-encryption Technology
Journey is as follows:
1) system initialization: Setup (λ, U) → (GP, MSK, PK)
Given system security parameter λ, system property set U, then constructing addition cyclic group G, g that order is p is the life of G
Cheng Yuan, and exist and meet bilinear map e:G × G → GT, randomly select an integer and meet g1∈ G, and following target is set
Hash hash function H1:(0,1)2k→Zp, H2:(0,1)2k→GT, H3:(0,1)*→ G, H4:(0,1)*→ G, H5:(0,1)k→Zp,
H6:(0,1)*→ G randomly selects different integer α, a ∈ Zp, Z=e (g, g) randomly selects integer hx∈ZpIt calculatesWherein x ∈ U.
Wherein, GP indicates system common parameter, and MSK indicates that system master key, PK indicate system public key.
Key generation phase: KeyGen (GP, PK, MSK, SA)→(SKA,PKA)
Input common parameter GP, system master key MSK, information owner's Alan attribute setRandomly choose integer
t∈Zp, and generate the corresponding private key SK of information owner AlanA、PKA。
Similarly, the private key SK of sharing request person Bill is generatedB、PKB。
2) re-encrypted private key generating algorithm: RekeyGen (GP, SKA,(M',ρ'),PKB)→rkA→B
Information owner Alan takes an integer θ ∈ Z at randomp, and calculate gθ、According to the attribute of sharing request person Bill
Set SBIt constructs shared structure (M', ρ '), in conjunction with common parameter GP, the corresponding private key SK of information owner AlanA, sharing request person
The private key PK of BillB, calculate re-encrypted private key rkA→B。
rkA→B=(SA,rk1,rk2,rk3,rk4,Rx)(4)
Wherein M' is the matrix of a l' × n', and the row of matrix M' is mapped to attribute by function ρ '.Integer s is randomly selected,
y2,...,yn∈ZpConstitute ZpOne column vectorIt calculatesWherein s indicates that information owner is total
The secret enjoyed, Mi' the i-th row of homography M' vector, { εiIt is Mi'Live part, I={ i: ρ ' (i) ∈ SA,1≤i
≤ l'} indicates the attribute used in shared structure (M', ρ ').
3) information encrypts:
First step prime information encryption: input public key PKA, information owner inputs information plaintext m, and pre-set setting reads
It lookes at, Share Permissions (M, ρ), calculates ciphertext CTA, and cipher-text information is stored in Cloud Server.
Second step metadata encryption: input system public key PK and pre-set reading, Share Permissions (M, ρ), member
Data Data → { LC, w, IN }, wherein LC indicates storage location of the raw information ciphertext in cloud, and w is the keyword of information,
IN is the project number of information, and raw information ciphertext decruption key k' exports ciphertext CT, and is stored in block chain.
Ciphertext re-encryption algorithm: ReEncrypt (rkA→B,CT,PKB, (M', ρ ')) and → CTB
Node first determines whether sharing request person Bill is system contract user, if so, random selection δ ∈ GTAnd it counts
It calculates:
Then according to re-encrypted private key rkA→B, ciphertext CT calculates the important component φ of ciphertext, after final output re-encryption
Ciphertext CTB。
Wherein, ωi∈ZpAnd meet
Step 5: sharing request person Bill sends sharing request, and after confirming identity validity, node is according to sharing request person
The keyword that Bill is provided generates index code, and search password.
Index generates and keyword retrieval:
Index generates: inputting common parameter GP, the keyword w of information m, node calculates keyword w in raw informationAIt is corresponding
Message authentication code kw and re-encryption information ciphertext CTBMiddle wB' corresponding authentication code kw', generate index code ID, ID';
Keyword retrieval: according to the corresponding private key SK of input sharing request person BillB, keyword wBAnd its corresponding search
Key kw' exports keyword wACorresponding search password TK.
Step 6: metadata ciphertext CT being obtained according to index code and search password, then determines sharing request person Bill credit
The relationship of coin and user sharing information price uses proxy re-encryption under the premise of being more than or equal to user sharing information price
Technology is converted into meeting Share Permissions (M', ρ ') the ciphertext CT of sharing request person BillB。
Step 7: transmission node Copy Info in cluster, being in for confirmation message has transmitted shape after the response of most nodes
State.
Step 8: sending the metadata ciphertext CT that retrieval obtains to sharing request person Bill, and by obtaining information after decryption
Storage location LC, thus in corresponding position download decryption prime information ciphertext CTA, obtain information plaintext m.
Information decrypting process is divided into following two step:
1) proxy re-encryption decipherment algorithm: ReDecrypt (SKB,CTB)→CT
The attribute set S of system verification sharing request person BillBCiphertext CT after whether meeting re-encryptionBIn shared knot
Structure (M', ρ '), if satisfied, private key SK can be used in sharing request person BillBDecrypt the solution encrypted by ciphertext policy ABE base
Decryption method recovers the important component φ of ciphertext, obtains CT and recovers raw information ciphertext decruption key k', Data.If discontented
Foot is fed back " illegal user ".
User obtains prime information storage location LC and decruption key k' according to metadata Data, to CTADecryption restoration is in plain text
Information m.
2) prime information ciphertext is decrypted: Decrypt (CTA,k',GP)→m
In the present invention, decruption key k' is only grasped by block chain and information owner Alan, in the case where unauthorized, is only believed
Ceasing owner Alan can be to the raw information ciphertext CT on cloud storageA, utilize formula
Decryption obtains original plaintext message m.
Step 9: according to the actual conditions of information exchange, the credit of user being adjusted correspondingly.
1) guarantee fund of sharing request person Bill interactive not successfully is returned first.
2) Successful Transaction user information expense is then settled accounts according to transaction performance.
The present invention reduces user to the complexity of information management to improve the information security in existing information interactive process
The angle of degree is set out, and combines existing attribute base Encryption Algorithm and proxy re-encryption algorithm, has been merged block chain technology, has been mentioned
The shared mould of block chain cipher-text information storage a kind of shared compatible with conventional information storage, while supporting keyword retrieval is gone out
Type.By property broker Re-encryption Technology, make information sharing that there is more flexible Compliance control characteristic.When information, owner is offline
When, node can still complete information exchange work according to intelligent contract rule, realize the uninterrupted shared of information.Keyword is made
For metadata a part there are on block chain, be convenient for information retrieval, improve the efficiency of information sharing, save to a certain extent
About communications cost alleviates the pressure of cloud storage high frequency access.
Metadata ciphertext is separated storage with prime information ciphertext by the present invention, and resistance against colluders have been better achieved, ensure that
The safety of information;The intelligent contract of information exchange is devised on the basis of block chain technology so that information sharing both sides without
Need central authority participation that can spontaneously be communicated according to presetting agreement, it is ensured that the safety of ciphertext conversion and letter
The shared high efficiency of breath.When information owner is offline, node can still complete information exchange work according to contract rule, realize
The uninterrupted of information is shared.Resistance against colluders, execution efficiency and in terms of have more advantage, be more suitable for current
Internet of things field demand for development.
Embodiment 3.Safety analysis of the invention.
A) Security Proof of information exchange:
The present invention is to carry out Security Proof based on q-parallel BDHE difficulty problem, and judge bilinearity difficulty
Property problem, if it is assumed that setting up, i.e. the opponent under random oracle modelAdvantageIt ignores, i.e., explanation should
Invention is selection plaintext secure (CPA, Chosen Plaintext Attack).
If 1 present invention of theorem solve the problems, such as the advantage of q-parallel BDHE be it is negligible, claim q-
Parallel BDHE assumes in (G, GT) set up, which is CPA safety under random oracle model.
It proves to assume that there are an attackersIn CPA game, its advantageIt can not ignore, oppose
Hand wins safe game.Then construct a game challengerIf there is attackerIt is broken through under security model with the advantage of ξ
CPA, it is only necessary to prove challengerIt can be by attackerProbability of the ability can not ignoreSolve prejudgementing character q-
The problem of parallel BDHE.
Initial phase: game challengerIt will will receive from attackerShare Permissions structure (the M of transmission*,ρ*)。
System establishment stage: challengerRandomly choose value χ ' a ∈ Zp, calculate: e (g, g)α=e (g, g)χ′e(g,gα)
And GP and PK are sent to attacker
Inquiry phase 1: private key extracts the stage: attackerBy to challengerSubmit property setChallengerWith
Machine chooses τ ∈ ZpCalculate (i, SKi), and by SKAIt is sent to attacker
Re-encrypted private key extracts the stage: with a property set SiKey is carried out with a Share Permissions structure (M', ρ ') to mention
It takes, it is first determined whether meeting (M', ρ '), if satisfied, can then obtain private key SKA, then calculate rkA→B=(S, rk1,rk2,
rk3,rk4,Rx), otherwise, challengerIt arbitrarily selects one and feeds back to attacker
The challenge stage: attackerThe message m of two sections of equal lengths is sent at random0And m1To challengerChallengerWith
Machine extracts a bits attributes b ∈ (0,1), utilizes (M*,ρ*) to mbEncryption obtains ciphertext CT and is sent to
Inquiry phase 2: the operation of inquiry phase 1 is repeated.
The conjecture stage:A b' ∈ (0,1) is provided to guess the challenger in the challenge stageThe b=0 or b=of selection
1, if conjecture is correct, i.e. b'=b, then A wins this game.If attackerGuess result b' ≠ b, then guesses mistake.We
Define challengerAdvantage:
When output is 0, i.e.,It cannot get any about mbAny information, cannot restore in plain text, therefore guess correct
Probability beWhen output is 1, i.e.,It obtains any about mbRelated cipher-text information, and can restore in plain text, not by theorem 1
It is rare to go out to guess that the correct probability obtained is
Therefore, q-paralle BDHE conjecture in the present invention is accurate, i.e. the advantage of b'=b is
I.e. the present invention can achieve the purpose for challenging plaintext attack.
Resistance against colluders: the present invention uses property broker re-encryption algorithm (such as Fig. 1), user property collectionWith
Shared structure (M, ρ) passes through A2It is verified, rk1、rk3、RxWith rk4Pass through δ ∈ GTAssociation, rk1、rk2And rk4Pass through θ ∈ ZpTightly
It is close to be connected, rk4In θ ∈ ZpAnd to δ ∈ G under Share Permissions structure (M, ρ)TIt is encrypted, so working as rk1、rk2、rk3、RxValue
Distorting its corresponding re-encryption ciphertext by attacker, also it is invalid, if(M, ρ) and rk4It is tampered, then can be with
Pass through following formulaVerifying.
Due to the special tectonic of the system, transmission node and memory node are separated, refer to Pool verifying pond common recognition
Mechanism, memory node are to be generated by way of democratic election, therefore ensure that the randomness for executing node with transmission node
And the ambiguity of position.I.e. memory node neither knows next transmission node position, does not know about sharer's information more, node
Randomness determines the difficulty that three gangs up, therefore memory node, transmission node, a possibility that ganging up between sharer three
It is extremely low.