CN109040012A - A kind of data security protecting and sharing method based on block chain and system and application - Google Patents

Abstract

The invention belongs to digital information transmission technical field, discloses a kind of data security protecting based on block chain and sharing method and system and application, each participant provide authentication information and key；The summary info of initial data and cryptographic Hash packing are uploaded into block catenary system；It is packaged node and all summary infos received in the period and cryptographic Hash is packaged into block according to a graded, be sent to common recognition node；The whole network broadcast common recognition result after efficiently reaching common understanding according to RPBFT agreement；Block is recorded in account book according to common recognition result；Different access-control protocols is associated with block；User may have access to account book after access-control protocol authorization, obtain the data summarization recorded in account book and prime information storage location using quick-searching function, and user accesses raw information storing data library, obtains initial data.The present invention can resist distorting for malicious node, efficiently realize common recognition, significantly improve data search efficiency.

Description

A blockchain-based data security protection and sharing method, system and application

technical field

The invention belongs to the technical field of digital information transmission, and in particular relates to a block chain-based data security protection and sharing method, system and application.

Background technique

At present, the existing technologies commonly used in the industry are as follows: with the development of information and network technology, the era of big data is coming, and various data are showing explosive growth. People's mining and application of massive data provide important support for the quantitative progress of the national economy, life, military and other fields. For example, through big data mining and analysis, it is possible to detect business trends, determine the quality of research, prevent the spread of diseases, fight crime, or measure real-time traffic conditions. However, while enjoying the convenience brought by data resources, individuals and institutions are also bearing the risk of privacy leakage. Due to the cross-domain interconnection of various heterogeneous networks, all kinds of data are spread across terminal devices, networks and clouds, and driven by black economic interests, the risk of data privacy exposure is increasing. In this context, big data security and privacy protection are very necessary. Only by increasing the research on data security technology can we ensure the safe storage of data, protect the privacy of users, and ensure the integrity, availability and security of data information when people use the Internet. Confidentiality, to avoid loss of personal interests. On the one hand, data requesters hope to obtain users' past data to create social value. On the other hand, stored data records contain a lot of privacy related to institutions and users. Therefore, querying data and sharing it can pose serious confidentiality risks for data providers. In order to meet the high requirements of data sharing, researchers have proposed some related schemes about cloud storage and computing technology, providing suitable solutions for compressed storage and processing requirements. However, cloud service providers (CSPs) face significant hurdles in convincing institutions to use centralized cloud services due to the risks posed by exposing data content. At the same time, due to centralization issues, these solutions also have many problems in terms of efficiency and usability. It is not reassuring for organizations to store data in third-party organizations such as cloud disks. These semi-trusted third parties may abuse and disclose the provider's privacy. Based on the defects in the retrieval efficiency in the sharing process in the existing solutions and the trust problem of the cloud service provider, the present invention stores the abstract information on the block chain, and stores the original files in different places on the server, and records them in the distributed ledger The unique access control strategy implements file access control, and uses the fast retrieval mechanism to improve retrieval efficiency, thereby improving sharing efficiency on the basis of ensuring file security.

To sum up, the problems existing in the existing technology are: Internet system data is very vulnerable to attack and leakage, and currently there is no suitable data sharing method to solve the problem of data security protection and cross-agency sharing, and realize data security protection and sharing.

The difficulty and significance of solving the above technical problems:

Solve the problem of data security protection and cross-agency sharing, how to overcome the bottleneck of blockchain technology itself in terms of efficiency, and how to efficiently realize data retrieval with encrypted data. The above problems bring difficulties to existing security sharing methods.

Contents of the invention

Aiming at the problems existing in the prior art, the present invention provides a block chain-based data security protection and sharing method, system and application.

The present invention is achieved in this way, a blockchain-based data security protection and sharing method, the blockchain-based data security protection and sharing method includes: each participant issues identity authentication information and keys; The summary information and hash value of the data are packaged and uploaded to the blockchain system; the packaging node packs all the summary information and hash value received within the time period into blocks in a certain order and sends them to the consensus node; it is efficiently achieved according to the RPBFT protocol After consensus, the whole network broadcasts the consensus result; according to the consensus result, the block is recorded in the ledger; different access control protocols are associated with the block; users can access the ledger after being authorized by the access control protocol, and use the quick search function to obtain the records in the ledger The data summary and original information storage location, the user accesses the original information storage database to obtain the original data.

Further, the initialization method of the blockchain-based data security protection and sharing method includes:

(1) Each participant issues identity authentication information and keys;

(2) Nodes participating in the system need to apply for identity authentication information and keys, and clarify their responsibilities;

(3) Nodes that pass the verification will get a security certificate issued by the certification authority;

(4) The node chooses to become a data node, a packaging node, a consensus node, and an accounting node;

(5) The certification authority needs to supervise whether each round of consensus is normal, and whether the random seed can correctly select the current round of consensus nodes.

Further, the data organization uploading data method of the blockchain-based data security protection and sharing method includes:

(1) After a certain period of time, the data node processes the data that needs to be uploaded locally through the client, and extracts summary information, data hash value, and the previous block code related to the user;

(2) The previous block code related to the user will be protected by the access control protocol along with the information summary;

(3) The data node needs to specify the access control policy of the file and upload it together with the file;

(4) Raw data files are stored in a local database or uploaded to a trusted cloud database.

Further, the data received by the packaging node of the blockchain-based data security protection and sharing method includes:

(1) After the packaging node receives the data uploaded by the data node, it will return the response information;

(2) The packaging node will collect relevant data nodes to upload files, record the source and access control policy of each file, and package all files into a block in chronological order;

(3) All packaging nodes will upload blocks to consensus nodes in turn according to the system agreement. When the current round of packaging nodes uploads, other nodes will be silent;

(4) The block header contains the packaging node address, timestamp, block hash value, and file hash value.

Further, the consensus nodes of the blockchain-based data security protection and sharing method reach a consensus including:

(1) According to the rules, a random number generator will generate random numbers in each round to determine which nodes among the candidate consensus nodes can become the consensus nodes of the current round, and the newly selected consensus nodes will receive blocks;

(2) The consensus nodes reach a consensus according to the PBFT protocol;

(3) After the consensus node reaches a consensus, it broadcasts the result to the whole network;

(4) The consensus node sends the block to the accounting node;

(5) The same node cannot continuously become a consensus node.

Further, the bookkeeping node of the blockchain-based data security protection and sharing method writes the block into the ledger specifically includes:

(1) The accounting node receives the block sent by the consensus node and writes it into the ledger;

(2) After the accounting node completes the accounting, it will broadcast to the whole network.

Further, the configuration access control protocol of the blockchain-based data security protection and sharing method specifically includes:

(1) The accounting node needs to configure the access control strategy according to the access control strategy recorded in the file, and anchor the strategy to the block;

(2) The access control strategy will hide the file information and only expose the block header information;

(3) The user can update the access policy as needed.

Further, the user information acquisition method of the blockchain-based data security protection and sharing method includes:

(1) The user accesses the ledger information through the client, and submits personal identity authentication information to the system as needed;

(2) The access control policy will review the user's identity information, and if it complies with the access policy, the user will be allowed to view the content of specific files; if it is not authenticated, it cannot be viewed;

(3) The user checks the information summary and applies for access to the database storing the original data according to the data source information recorded in the ledger;

(4) The user finds the information of the previous block according to the information recorded in the relevant block, and associates different files for use;

(5) The user compares the hash value of the file to verify whether the file has been maliciously tampered with.

Another object of the present invention is to provide a blockchain-based data security protection and sharing system that implements the blockchain-based data security protection and sharing method, and the blockchain-based data security protection and sharing system include:

The authentication authority module is used to issue identity authentication information and keys to each participant in the system;

The data organization module is used to package and upload the summary information and hash value of the original data to the blockchain system, and the summary information in the file contains the code of the previous block associated with it;

The block chain module is used for packing nodes to pack all the summary information and hash values received within the time period into blocks in a certain order and send them to the consensus nodes;

Consensus node module, which is used to broadcast consensus results on the whole network after reaching a consensus according to the improved PBFT protocol;

The bookkeeping node module is used to record the block into the ledger according to the consensus result;

The access control protocol module is used to associate different access control protocols with blocks according to the requirements of the data organization;

The access control protocol module is used by the user to access the account book after authorization, and obtain the data summary recorded in the account book and the original information storage location according to the quick search function, and the user accesses the original information storage database to obtain the original data.

Another object of the present invention is to provide an information data processing terminal applying the blockchain-based data security protection and sharing method.

To sum up, the advantages and positive effects of the present invention are: the abstract information in the file contains the code of the previous block associated with it to facilitate subsequent rapid data retrieval, and the improved data retrieval mechanism can greatly improve the efficiency of the system. On the basis of the RPBFT consensus mechanism being able to achieve consensus efficiently, it can well prevent greedy attacks and malicious node bifurcation attacks, and further improve the efficiency of the system on the basis of ensuring the safety and reliability of the scheme. The summary information on the system chain is separated from the original data off the chain to ensure the privacy of the original data. The blockchain technology used ensures that the information in the distributed ledger cannot be tampered with. The file ciphertext hash value on the ledger ensures the integrity and tamper-proof of the file. The access policy on the ledger realizes the safe sharing of files and can Unauthorized users are blocked from the system.

The present invention utilizes block chain technology to realize the safe sharing of files by users, so as to ensure the storage and sharing security of original data files; In the database, only the data summary, hash value, and associated block number are written into the blockchain ledger; at the same time, users can customize fine-grained access policies for files and associate them with the blockchain ledger. Identity verification is required in the process of obtaining files, and only users who meet the access policy can obtain the information content in the ledger and further obtain files. The invention ensures the security of user data, and is easy and convenient for users to use; traditional public-private key cryptography technology makes files more secure; the non-tamperable modification of blockchain technology's own ledger further ensures the integrity and availability of files, and at the same time allows users to target Different access policies are formulated for different files, and complete control over files is achieved while sharing files; user-controlled file encryption uploads based on the system, fine-grained access control, and file security sharing within the system are realized.

Description of drawings

Fig. 1 is a flowchart of a blockchain-based data security protection and sharing method provided by an embodiment of the present invention.

Fig. 2 is an implementation flow chart of a blockchain-based data security protection and sharing method provided by an embodiment of the present invention.

Fig. 3 is a schematic diagram of a system implementation of a blockchain-based data security protection and sharing method provided by an embodiment of the present invention.

Fig. 4 is a system model diagram provided by an embodiment of the present invention.

Fig. 5 is a block chain system model diagram provided by the embodiment of the present invention.

Fig. 6 is a structural diagram of a blockchain ledger provided by an embodiment of the present invention.

FIG. 7 is a simulation diagram of data efficiency provided by an embodiment of the present invention.

FIG. 8 is a simulation diagram of network congestion provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention more clear, the present invention will be further described in detail below in conjunction with the examples. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

On the basis of ensuring data integrity, confidentiality and availability, the present invention realizes fast data retrieval and efficient system consensus on data to achieve the purpose of sharing, realizes data mining and analysis, and generates value.

The application principle of the present invention will be described in detail below in conjunction with the accompanying drawings.

As shown in Figure 1, the blockchain-based data security protection and sharing method provided by the embodiment of the present invention includes the following steps:

S101: Build and manage the system, and issue identity authentication information and keys to each participant in the system;

S102: Pack and upload the summary information and hash value of the original data to the blockchain system, and the summary information in the file contains the code of the previous block associated with it;

S103: The packaging node packages all the summary information and hash values received within the time period into blocks in a certain order and sends them to the consensus node;

S104: After efficiently reaching a consensus according to the RPBFT protocol, the whole network broadcasts the consensus result;

S105: Record the block into the ledger according to the consensus result;

S106: According to the requirements of the data organization, associate different access control protocols with blocks;

S107: After being authorized by the access control protocol, the user can access the account book, use the quick search function to obtain the data summary recorded in the account book and the storage location of the original information, and the user accesses the original information storage database to obtain the original data.

The application principle of the present invention will be further described below in conjunction with the accompanying drawings.

As shown in Figure 2, the blockchain-based data security protection and sharing method provided by the embodiment of the present invention specifically includes the following steps:

(1) The certification authority, that is, the initiator of the alliance chain, has the highest system authority and is responsible for building and managing the system. At the same time, it is responsible for issuing identity authentication information and keys to each participant in the system.

(2) The data organization packages and uploads the abstract information and hash value of the original data to the blockchain system, and the abstract information in the file contains the code of the previous block associated with it to facilitate subsequent retrieval. Raw data is stored in a local database or in the cloud.

(3) The packaging node in the blockchain system packs all the summary information and hash values received within the time period into blocks in a certain order and sends them to the consensus node.

(4) After the consensus nodes reach a consensus according to the improved PBFT protocol, the consensus result is broadcast across the entire network.

(5) The bookkeeping node records the block into the ledger according to the consensus result.

(6) Access control protocols Different access control protocols can be associated with blocks according to the requirements of the data organization.

(7) After being authorized by the access control protocol, the user can access the account book, and obtain the data summary recorded in the account book and the original information storage location according to the quick search function, and the user accesses the original information storage database to obtain the original data.

As shown in Figure 3, the blockchain-based data security protection and sharing method provided by the embodiment of the present invention includes the following steps:

(1) System initialization: In order to realize the normal operation of the system, it is necessary to initialize the system at the initial stage. The initialization process includes:

a) The certification authority, that is, the initiator of the alliance chain, has the highest system authority and is responsible for building and managing the system. At the same time, it is responsible for issuing identity authentication information and keys to each participant in the system.

b) Nodes who want to participate in the system need to apply for identity authentication information and keys, and clarify their responsibilities.

c) The verified node will get a security certificate issued by the certification authority. This certificate contains a unique serial number and a public-private key pair. The serial number represents the identity of the node, and the public-private key pair is used for signatures. When the terminal device first connects to the node for initialization, the security certificate can prove the legitimacy of the node's identity, and the node will become a node in the system.

d) Nodes can choose to become data nodes, packaging nodes, consensus nodes, accounting nodes and other responsibilities. Nodes can take on one or more of these responsibilities.

e) The certification authority needs to supervise whether each round of consensus is normal, and whether the random seed can correctly select the current round of consensus nodes to ensure the health and order of the system.

(2) Data institutions upload data

a) According to the system agreement, after a period of time, the data node processes the data that needs to be uploaded locally through the client, and extracts the summary information, data hash value, and the previous block code related to the user. The summary information contains the code of the previous block associated with it, so as to facilitate the user's subsequent fast data retrieval. Organize all the information into a file and upload it to the adjacent packaging node.

b) The previous block code related to this user will be protected by the access control protocol along with the information digest.

c) The data node needs to specify the access control policy of the file and upload it together with the file.

d) Raw data files are stored in a local database or uploaded to a trusted cloud database.

(3) Packing node receives data

a) After the packaging node receives the data uploaded by the data node, it will return a response message.

b) The packaging node will collect relevant data nodes to upload files, record the source and access control policy of each file, and package all files into a block in chronological order.

c) All packaging nodes will upload blocks to consensus nodes in turn according to the system agreement. When the current round of packaging nodes uploads, the remaining nodes will be silent.

d) The block header contains information such as packaging node address, timestamp, block hash value, and file hash value.

(4) Consensus nodes reach a consensus

a) According to the system rules, a random number generator will generate random numbers in each round to determine which nodes among the candidate consensus nodes can become the consensus nodes of the current round, and the newly selected consensus nodes will receive blocks. A certification authority oversees the process.

b) The consensus nodes reach a consensus according to the PBFT protocol.

c) After the consensus node reaches a consensus, it broadcasts the result to the whole network.

d) The consensus node sends the block to the accounting node.

e) In order to ensure the security of the system, the same node cannot continuously become a consensus node.

(5) The accounting node writes the block into the ledger

a) The accounting node receives the block sent by the consensus node and writes it into the ledger.

b) After the accounting node completes the accounting, it will broadcast to the whole network.

(6) Configure access control protocol

a) The accounting node needs to configure the access control strategy according to the access control strategy recorded in the file, and anchor the strategy to the block.

b) The access control strategy will hide the file information and only expose the block header information. To ensure the security and privacy of information. Access control policies will be updated and maintained by accounting nodes.

c) The user can update the access policy as needed.

(7) User obtains information

a) The user accesses the ledger information through the client, and submits personal identity authentication information to the system as needed.

b) The access control policy will review the user identity information, and if the access policy is met, the user will be allowed to view the specific file content. If you are not authenticated, you cannot view it.

c) The user views the information summary and needs to further view the original data, and can further apply for access to the database storing the original data according to the data source information recorded in the ledger.

d) The user can quickly find the information of the previous block according to the information recorded in the relevant block, and associate different files for use.

e) The user compares the hash value of the file to verify whether the file has been maliciously tampered with.

The application effect of the present invention will be described in detail below in combination with simulation.

1. Simulation conditions

The simulation environment is: Lenovo notebook, the configuration is Intel(R) Core(TM) i5-3210M CPU@2.50GHz 4.0GRAM.

2. Simulation content and result analysis

The efficiency of information retrieval differs between different systems using the method of the present invention, and the result is shown in Figure 7. In the solution of the present invention, the present invention uses an associated block numbering mechanism to improve the efficiency of information retrieval. If a user wants to retrieve specific information, he can directly find the corresponding block according to the associated block number record. The original search method needs to traverse the data blocks until useful data is found. Although concatenated block numbers will bring additional data volume, compared with the traditional way of data retrieval, its efficiency will increase too much. This invention and other proposals such as Medrecord A Lippman, T Vieira, A Ekblaw, AAzaria. Et al, "MedRec: Using Blockchain for Medical Data," Presented at International Conference on Open & Big Data. [Online] 2016. Available: http://ieeexplore .ieee.org/document/7573685/ and Medshare Qi Xia, Emmanuel BoatengSifah, et al. “MeDShare: Trust-Less Medical Data Sharing via Blockchain,” IEEE Access, July, 2017.Vol.5.DOI.10.1109/ACCESS.2017.2730843 .. As the number of visitors increases, the present invention uses less time. The results show that the efficiency of data retrieval is greatly improved.

When the number of users is small, the effective information volume of each user accounts for a higher proportion of the total information volume. The original search method can also quickly find relevant information. However, as the number of users increases, the advantages of the present invention over other methods become more and more obvious. The associated block number record can directly guide the user to find the corresponding block. Even if the proportion of valid information is low, it will not constrain the efficiency. Between different systems adopting the method of the present invention, the system network congestion is different, and the result is shown in FIG. 8 . When the packaging node sends out a suggestion to add blocks to the system, the present invention changes the method of real-time uploading to alternate uploading. If the packaging node chooses to upload real-time data, the system will bear a large high load, which may cause data congestion. To avoid this situation, improve the stability of the system. The present invention uses the method of sequentially uploading in rounds. Uploading asynchronous data smoothes the system load and helps avoid system data congestion. Theoretical analysis and simulation results show that the scheme is effective in avoiding massive high loads that may cause data congestion.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range.

Claims (10)

1. a kind of data security protecting and sharing method based on block chain, which is characterized in that the data based on block chain Safeguard protection and sharing method include: that each participant provides authentication information and key；The abstract of initial data is believed Breath and cryptographic Hash packing upload to block catenary system；It is packaged all summary infos and cryptographic Hash that node will receive in the period It is packaged into block according to a graded, is sent to common recognition node；The whole network broadcast common recognition after efficiently reaching common understanding according to RPBFT agreement As a result；Block is recorded in account book according to common recognition result；Different access-control protocols is associated with block；User's warp It may have access to account book after access-control protocol authorization, the data summarization and prime information recorded in account book obtained using quick-searching function Storage location, user access raw information storing data library, obtain initial data.

2. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the initial method of sharing method include:

(1) each participant provides authentication information and key；

(2) node for participating in system needs to apply authentication information and key, and the clear responsibility oneself undertaken；

(3) safety certificate issued by certification authority source can be obtained by the node of verifying；

(4) node is selected to back end, is packaged node, common recognition node, accounting nodes；

(5) certification authority needs to supervise whether every wheel common recognition is normal, and it is total whether random seed can correctly select current round Know node.

3. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the data structures of sharing method upload data method and include:

(1) per after a period of time, back end locally will need the data uploaded to handle by client, extraction is made a summary Information, data cryptographic Hash, previous block coding related to user；

(2) previous block coding related to user will be accessed together control protocol protection with informative abstract；

(3) back end needs the access control policy of clear this document, and uploads with file；

(4) raw data file is stored in local data base or is uploaded to reliable cloud database.

4. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the packing node received data packet of sharing method include:

(1) after being packaged the data that node receives back end upload, response message will be returned；

(2) transmitting file on relevant back end will be collected by being packaged node, and record each document source and access control plan Slightly, and in chronological order by All Files, it is packaged into a block；

(3) all packing nodes will arrange according to system, upload block in turn and give common recognition node, current round is packaged node and uploads When, remaining node will be silent；

(4) block head includes to be packaged node address, timestamp, block cryptographic Hash, file cryptographic Hash.

5. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the common recognition node of sharing method, which are reached common understanding, includes:

(1) according to rule, each round can generate random number by a randomizer, which is determined in alternative common recognition node Node can become the common recognition node of current round, receive block by the common recognition node newly selected；

(2) reached common understanding between common recognition node according to PBFT agreement；

(3) after common recognition node is reached common understanding, to the whole network broadcast results；

(4) block is sent to accounting nodes by common recognition node；

(5) same node cannot continuously become common recognition node.

6. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the accounting nodes of sharing method specifically include block write-in account book:

(1) accounting nodes receive the block that common recognition node is sent, and are written into account book；

(2) it after accounting nodes complete book keeping operation, will be broadcasted to the whole network.

7. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the configuration access control protocol of sharing method specifically include:

(1) accounting nodes are needed according to the access control policy recorded in file, configuration access control strategy, and by strategy and area Block anchoring；

(2) hidden file information is only exposed block head information by access control policy；

(3) user can according to need update access strategy.

8. data security protecting and sharing method as described in claim 1 based on block chain, which is characterized in that described to be based on The data security protecting of block chain and the user of sharing method obtain information approach and include:

(1) user accesses account book information by client, submits personal identification information to system as needed；

(2) access control policy will audit subscriber identity information, user will be allowed to check specific file if meeting access strategy Content；If unauthenticated, can not check；

(3) user checks informative abstract, according to the data origin information recorded in account book, the number of application access storage initial data According to library；

(4) user records information according to Correlation block, finds the information of a block, different files, which is associated, to be made With；

(5) user compares file cryptographic Hash, and whether verification file is maliciously tampered.

9. a kind of number based on block chain of the data security protecting realized based on block chain described in claim 1 and sharing method According to safeguard protection and shared system, which is characterized in that the data security protecting and shared system based on block chain include:

Certification authority module, for providing authentication information and key to each participant in system；

Data structures module uploads to block catenary system for the summary info of initial data and cryptographic Hash to be packaged, in file Summary info contains the previous block coding being associated；

Block chain module, for being packaged node for all summary infos received in the period and cryptographic Hash according to a graded It is packaged into block, is sent to common recognition node；

Common recognition node module, for the whole network broadcast common recognition result after reaching common understanding according to improvement PBFT agreement；

Accounting nodes module, for block to be recorded in account book according to common recognition result；

Access-control protocol module closes different access-control protocols with block for the requirement according to data structures Connection；

User obtains in account book according to quick-searching function and remembers for may have access to account book after authorizing through access-control protocol module The data summarization and prime information storage location of record, user access raw information storing data library, obtain initial data.

10. a kind of letter of data security protecting and sharing method using based on block chain described in claim 1~8 any one Cease data processing terminal.