US 11,777,745 B2
Cloud-side collaborative multi-mode private data circulation method based on smart contract
Feng Gao, Zhejiang (CN); and Wenyuan Bai, Zhejiang (CN)
Assigned to Zhejiang Lab, Zhejiang (CN)
Filed by Zhejiang Lab, Zhejiang (CN)
Filed on Aug. 11, 2022, as Appl. No. 17/885,556.
Application 17/885,556 is a continuation of application No. PCT/CN2022/091909, filed on May 10, 2022.
Claims priority of application No. 202110886663.8 (CN), filed on Aug. 3, 2021.
Prior Publication US 2023/0041862 A1, Feb. 9, 2023
Int. Cl. H04L 9/32 (2006.01); H04L 9/00 (2022.01); H04L 9/30 (2006.01)
CPC H04L 9/3268 (2013.01) [H04L 9/30 (2013.01); H04L 9/50 (2022.05)] 6 Claims
OG exemplary drawing
 
1. A cloud-side collaborative multi-mode private data circulation method based on a smart contract, comprising:
initializing a system:
initializing, by the system, a key algorithm of a Key-Policy as a Service (KaaS) to obtain a public system key (PSK) and a master secret key (MSK); and
creating, by the system, a user account for each user, wherein the user account comprises a user account identifier (ID), a corresponding public key IDpub-key, a private key IDpri-key, a data owner (DO), a data user (DU), and a user profile comprising an account IDSC, a public key SCpub-key, and a private key SCpri-key;
encrypting, by the DO, original data into private data and generating an encryption certificate, wherein the encryption certificate comprises metadata and a data certificate key:
applying to the KaaS, by the DO, for the PSK; and
obtaining, by the DO, the data certificate key according to the PSK, an encryption key, and an access policy, comprising:
generating the metadata based on the original data to form the private data by generating a random number as the encryption key of the original data and encrypting the original data through the encryption key to form the private data, and storing the private data in a cloud storage space; and
generating the access policy based on the user account ID and generating the data certificate key based on the key algorithm according to a key of a message to be encrypted, the PSK and the access policy;
uploading, by the DO, the encryption certificate to a block chain by using a smart contract which is accessible to all user accounts;
determining, by the DO, a data circulation in response to identifying the DU, wherein the determining comprises:
in response to releasing the data certificate key, setting an account IDDU through the access policy, wherein the DU obtains the encryption key by executing the smart contract and the key algorithm, and the DU obtains the private data through the metadata and decrypts the private data to obtain a plaintext, comprising:
obtaining the encryption certificate by executing the smart contract for the account IDDU;
sending a request to the KaaS through the smart contract to apply for a user secret key (USK), wherein the USK is generated by the KaaS based on the key algorithm according the PSK, the MSK, and the account IDDU, and the USK is encrypted by a public key DUpub-key of the DU and uploaded to a block chain through the smart contract which is only accessible to the DU;
executing the smart contract to obtain the encrypted USK and obtaining the USK from the encrypted USK through a private key DUpri-key of the DU by the DU;
decrypting the data certificate key in the encryption certificate by the USK to obtain the encryption key; and
obtaining the private data through the metadata in the encryption certificate and decrypting the private data through the encryption key to obtain the original data;
determining, by the DO, the data circulation in response to not identifying the DU and releasing the data certificate key, wherein the DU retrieves the block chain, browses the metadata, and publishes a file reading request through the smart contract, comprising:
calling the smart contract, retrieving the block chain, and browsing the metadata;
sending an access request to the DO through the smart contract, wherein the DO submits a policy with a time attribute to the block chain, the time attribute is associated with a current contract execution time t, a circulation cycle start timestart, and a circulation cycle ending timeend, wherein the user profile is used to execute the smart contract, obtain a policy from the block chain, verify a validity of the policy, and informs the DU if the validity is fail, wherein the USK is generated by the KaaS based on the key algorithm according the PSK, the MSK, and the access policy, and the USK is encrypted by the public key DUpub-key of the DU and uploaded to the block chain through the smart contract which is only accessible to the DU; and
obtaining the encryption key based on the key algorithm according to the PSK, the USK, and the data certificate key through decryption as long as the account IDDU satisfies an enabling characteristic in the access policy within an effective time limit, obtaining the private data through the metadata in the encryption certificate, and decrypting the private data through the encryption key to obtain the original data, wherein the data circulation is completed if an authority passes a review after the DO executes the smart contract; and
submitting a transaction certificate of the data circulation and confirming that the data circulation is completed by the DO.