# A Blockchain-Based Supervision Data Security Sharing Framework
## 3 Blockchain-Based Framework for Secure Sharing of Engineering Supervision Data
### Engineering Supervision Data-Sharing Framework Based on Consortium Blockchain
#### 3.2.2 Supervision Data-Sharing Protocol  
(1) Key generation stage  
Users register with the CA (Certificate Authority) organization, interact with the CA organization and the consortium network through the client, and use the initialization algorithm setup (\(\lambda\)) to generate the master key \(MK\) and public parameter \(PK\) in the CP-ABE framework based on the given security parameters. The user sends a registration application to the supervision department, which verifies the user's identity. After verification, the public and private key pairs _Upk_ and _Usk_ are sent to the user. Then, the corresponding digital certificate _Ucert_ attribute set \(Su\) is generated based on the registration request sent by the user, and the key distribution algorithm KeyGen (\(MK\), \(SU\)) is run to generate the user attribute private key \(U\)'_sk_. Finally, the supervision department will send the public key _Upk_, private key _Usk_, digital certificate _Ucert_, and attribute private key \(U\)'_sk_ to the user for safekeeping through a secure channel. (2) Data encryption storage stage  
In the process of sharing engineering supervision data, larger-scale supervision data original files will be stored in the IPFS file system. After storage is completed, the IPFS file system returns the hash address \(CID\) (Content Identifier) that uniquely identifies the file to the client. Users can use \(CID\) to query the stored files in the IPFS file system. For the supervision data stored in the IPFS file system, it is necessary to encrypt the data and use the CP-ABE algorithm to encrypt the symmetric key before uploading to the system. Firstly, the data uploader specifies the encryption strategy \(Pa\) and the supervision data to be stored, then selects the key \(K\) and uses a symmetric encryption algorithm to encrypt the supervision data, obtains the ciphertext, and uploads the ciphertext to the IPFS file system. Then, encrypt the symmetric key \(K\) and use the encrypt algorithm to encrypt the key \(K\) based on the policy, obtaining \(Enck(K)=Encrypt(PK,K,Pa)\), where \(PK\) is a common parameter in the CP-ABE framework and \(Pa\) is the encryption policy. Finally, the uploader constructs the supervision data metadata \(Tx\) and uploads the file address \(CID\) returned by the IPFS file system to the blockchain along with the user's department, file name, timestamp, and digital signature. (3) Data-sharing stage \begin{table}
\begin{tabular}{c c c c} \hline \hline
**User Attribute** & **Operator** & **Attribute Value** & **Remark** \\ \hline User position permission & \(\geq\) & \begin{tabular}{c} Supervisor, Engineer, Department \\ head, Documenter \\ \end{tabular} & \begin{tabular}{c} Only allow users with permissions not \\ lower than specified level to access \\ \end{tabular} \\ \hline User department & in & \begin{tabular}{c} Supervision party, Construction party, \\ Government department \\ \end{tabular} & \
\begin{tabular}{c} Only allow users located in the \\ department to access \\ \end{tabular} \\ \hline Registration time period & between & The start and end dates &
\begin{tabular}{c} Only allow users registered within time \\ period to access \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Access policy definition. Firstly, the requester sends a file download request to the file uploader who sends the private key signature and encrypts key \(K^{\prime}\) to the requester after verifying the identity of the requester. The visitor requests metadata information from the consortium blockchain network through the file \(ID\), and obtains encrypted files from the IPFS file system using the file address \(CID\) in the metadata information. The requester takes the attribute key ciphertext \(Enck(K)\) and attribute private key \(U\)'\(sk\) as inputs. When the private key attribute satisfies the access control policy \(Pa\) contained in the ciphertext, decryption obtains plaintext \(K\), that is, decryption obtains symmetric key \(K\) = _Decrypt_ (\(Enck(K)\), \(U\)'\(sk\)).