# A Blockchain-Based Supervision Data Security Sharing Framework
## 3 Blockchain-Based Framework for Secure Sharing of Engineering Supervision Data
### Engineering Supervision Data-Sharing Framework Based on Consortium Blockchain
#### 3.2.1 Definition Form of Access Policy  
In order to achieve fine-grained access control, it can be divided into a key policy attribute-based encryption and CP-ABE according to different decryption positions. This article adopts the CP-ABE encryption algorithm based on ciphertext policy attributes. Data can be encrypted and assigned an access control structure, and the holders of which attributes can access the data are defined based on this structure. Each user has a set of attributes that can be used to determine who has access to the data, and only users whose attributes match the ciphertext access structure can decrypt the ciphertext. Under normal circumstances, CP-ABE mainly uses the following four algorithms:  
(1) Initialization algorithm  
\[\text{Setup}\ (\lambda)\rightarrow(PK,MK)\]  
Initialization parameters \(\lambda\) is input to generate public parameter \(PK\) and master key \(MK\), completing the initialization process, where \(\lambda\) is the security parameter. The Setup (\(\lambda\)) takes the number of attributes \(U\) in the system as input. It then selects a group of prime order \(p\), \(a\) generator \(g\), and \(U\) random group elements \(h_{1},\ldots,h_{U}\) related to system properties. And choose a random exponent \(\alpha\) and \(a\). The generated public key is:  
\[PK=g,e(g,g)^{\alpha},g^{a},h_{1},\ldots,h_{U} \tag{1}\]  
where \(MK=g^{\alpha}\) is set as the master key.  
(2) Key generation algorithm  
\[\text{KeyGen}\ (MK,S)\to SK\]  
The master key \(MK\) and attribute set \(S\) are entered to generate the attribute private key \(SK\) for the user. A random number \(t\) is selected to create a private key \(SK=g^{\alpha}g^{at}\) for user decryption.  
(3) Encryption algorithm  
\[\text{Encrypt}\ (PK,\ M,\ T(A,\rho))\to CT\]  
Public parameter \(PK\) and access structure \(T(A,\rho)\) are used to encrypt plaintext \(M\) into ciphertext \(CT\). The access structure \(T(A,\rho)\) uses LSSS (Linear Secret Sharing Scheme) to associate the rows and attributes of plaintext message \(M\), where \(A\) is the \(l\times n\) matrix, and \(\rho\) represents the mapping function that maps each row of \(A\) to the corresponding attribute. The secret value \(s\) is divided into \(l\) parts for encryption, and the final ciphertext obtained is:  
\[CT=(C=M\cdot e(g,g)^{\alpha s},C^{\prime}=g^{s},(C_{1}=g^{\alpha_{1}}h^{-r_{1 }},D_{1}=g^{r_{1}})),\ldots,(C_{l}=g^{\alpha_{l}}h^{-r_{n}}_{\rho(l)},D_{l}=g^{ r_{l}}) \tag{2}\]  
where \(\lambda_{i}=A_{i}\cdot\overset{\rightarrow}{\
u},\overset{\rightarrow}{\
u}\) is a random vector containing the secret value \(s\), \(r_{1},\ldots,r_{l}\) is a random number belonging to the group, and \(h_{\rho(1)}\) is corresponding to the random value of the first attribute involved in the access policy.  
(4) Decryption algorithm  
\[\text{Decrypt}\ (CT,\ SK,\ PK)\to M\]  
Public parameters \(PK\) and private key \(SK\) are used to decrypt the ciphertext \(CT\) into plaintext \(M\). Only when the attribute set \(S\) associated with \(SK\) satisfies the access policy \((A,\rho)\) related to ciphertext \(CT\) will decryption be successful and output plaintext \(M\). The definition form of access policy based on CP-ABE is shown in Table 3. The data access control strategy is defined by the initiator of the contract, combined with the application background of supervision data sharing. In this article, attributes are defined as position permission, user department, and registration time period. The supervision department defines the access control strategy and achieves more refined access control by combining these three attributes. The defined access strategy is as follows: users who meet the specified department attributes, while also meeting both permission level attributes and registration time period attributes, can access plaintext. Secure sharing and privacy protection of supervision data can be achieved by designing access control policies and using encryption algorithms based on CP-ABE to generate keys and access policies.