CN110784463A - A blockchain-based file storage and access method and system - Google Patents

Abstract

The invention discloses a block chain-based file storage and access method and system, including file division, file encryption signature, file information on-chain, file access authorization, file reconstruction and sharing, and finally, the reconstruction target file is encrypted and sent to the visiting user Perform the associated read or write operation. The present invention adopts separate file storage and file management mechanism based on blockchain smart contracts, and the file access authority management module utilizes the main features of blockchain, such as openness, transparency and non-tampering, which effectively enhances the security and traceability of file access. sex. Unilateral manipulation of the file is prevented by dividing the file into multiple sub-files and encrypting them with different private keys. At the same time, the relevant information of sub-files is encrypted and stored in the blockchain and cannot be tampered with, which greatly enhances the security of file information.

Description

A blockchain-based file storage and access method and system

technical field

The present invention relates to the technical field of blockchain, in particular to a method and system for storing and accessing files based on blockchain.

Background technique

In human socialization activities, a centralized management mechanism is usually adopted for the storage, access and confidentiality of important files. Manage files to ensure file management efficiency. However, this centralized management method of authorizing administrators to manage files has potential risks, such as risks of tampering and information leakage.

Blockchain technology is a distributed ledger system, including a series of technologies such as encryption and decryption, consensus mechanism, peer-to-peer communication network, and chain storage. It has the characteristics of decentralization, self-trust, non-tampering, traceability, openness and transparency. At the same time, blockchain smart contract technology provides an execution environment and development framework for distributed applications, which greatly expands the business application space of blockchain. Therefore, the use of blockchain technology to solve management problems in the process of file management has very high application potential.

SUMMARY OF THE INVENTION

The present invention proposes a block chain-based file storage and access method and system, which aims to prevent administrators from unilaterally operating files and reduce risks such as malicious or illegal modification of files and leakage of file information.

In order to achieve the above purpose, the block chain-based file storage and access method proposed by the present invention includes the following steps:

Step S1: file division, first define a set of sub-file division methods, adopted division methods and control parameters, and divide the target file into several sub-files, each sub-file corresponds to an authorized user;

Step S2: file encryption signature, the authorized user sends the corresponding sub-file encryption signature to the file management module, the file management module performs signature verification, and decides whether the verification is passed;

Step S3: the file information is uploaded to the chain, the file management module creates a blockchain smart contract, uploads the encrypted sub-file and the related information of the encrypted sub-file that have passed the verification in step S2 to the chain, stores it in the blockchain smart contract, and stores the data in the blockchain smart contract. All encrypted files and encrypted sub-file information are backed up to the file storage module;

Step S4: file access authorization, during the file access service, the access user first initiates a file access request to the file management module, and the file access rights management module notifies each authority user of authorization confirmation;

Step S5: File reconstruction and sharing. After all authorized users complete the authorization and consent confirmation through the blockchain smart contract, the authorized user reads the encrypted sub-file from the blockchain smart contract and decrypts it into the corresponding sub-file, and encrypts signature and verification. After success, send it to the file management module to obtain the reconstruction target file, and finally encrypt the reconstruction target file and send it to the visiting user for related read or write operations;

If the access user is a read operation, the target file can be viewed after directly decrypting and reconstructing it;

If the access user is a write operation, after the access user submits the file information, the file management module submits each authority user for review. After the review is passed, the file management module re-executes the file update from step S1.

Preferably, in the step S1, several sub-files are respectively denoted as A1, A2, A3....AK , _K is the number of sub-files, each sub-file corresponds to an authorized user, and the authorized user corresponding to A _k is denoted as k;

In the described steps S2 to S5, the authority user processes the corresponding sub-files through its public and private keys, the authority user public and private keys are respectively recorded as PubKey _k and PrivKey _k , and the authority user encrypted sub-file is recorded as A _k ^cypher ;

The file management module performs information judgment and access request decision through its public and private keys. The public and private keys of the file management module are PubKey ^fileManager and PrivKey ^fileManager respectively. The file management module records the sub-file encrypted by the private key of the sub-file _Ak . is A _k ^M , and its digest signature is denoted as Sig _k ^M .

The file management module verifies by comparing the digest of the target file and the signature digest of the target file. If the digest of the target file and the signature digest of the target file are consistent, the verification succeeds; otherwise, the verification fails;

Among them, the digest is obtained by the digest calculation function, the file encryption and signature are obtained by the asymmetric encryption function, and the file decryption is obtained by the asymmetric decryption function.

Preferably, the step S2 includes the following steps:

a. File management module encrypted signature

First calculate the digest of the target file A, and sign the digest with the private key PrivKey ^Manager of the file management module, denoted as Sig;

Then encrypt the sub-file A _k with the public key Pubkey _k of the authorized user k to obtain A _k ^M ;

Then, through the private key PrivKey ^Manager of the file management module, the digest signature of the sub-file A _k is obtained, and the signature of the sub-file is obtained, which is denoted as Sig _k ^M ;

Finally, send A _k ^M and Sig _k ^M to the authorized user k;

b. Encrypted signature of sub-files of authorized users

After each authorized user k receives A _k ^M and Sig _k ^M , perform the following operations:

b1 subfile restore

First, decode A _k ^M through the private key PrivKey _k of the authorized user k to obtain the sub-file A _k ;

Then solve the abstract of the sub-file _Ak , denoted as H _k ^U ;

Then use the public key Pubkey ^fileManager of the file management module to decode Sig _k ^M to obtain the abstract H _k ^M ;

Finally verify the consistency of the digest: if H _k ^U =H _k ^M , the sub-file is restored successfully, and the next step is continued, otherwise, the restoration fails;

b2. Encrypted sub-file generation

First encrypt the sub-file A _k with the public key Pubkey _k of the authorized user k to obtain A _k ^cypher ;

Then encrypt A _k cypher with the public key ^{PubKey fileManager} of the file management module to obtain A _k ^U ;

Regenerate the digest of A _k ^cypher and sign it with PrivKey _k of the authorized user k private key to obtain Sig _k ^U ;

Finally, A _k ^U and Sig _k ^U are sent to the file management module.

Among them, the digest of the file is obtained by the digest calculation function, the file encryption and signature are obtained by the asymmetric encryption function, and the decryption of the file is obtained by the asymmetric decryption function.

Preferably, the blockchain smart contract is created in the step S3, that is, the blockchain smart contract access authorization function and the blockchain smart contract access authorization decision function are respectively defined, and the relevant information of the encrypted sub-file that has passed the verification is uploaded to the chain, It is stored in the blockchain smart contract, and all encrypted files and encrypted sub-file information are backed up to the file storage module.

Preferably, in the step S4, the file management module queries the blockchain smart contract to obtain the public key list of the authorized user, and initiates an authorization review request to each authorized user, and each authorized user invokes the blockchain smart contract to decide the access user's access Request, according to all the permissions determined in the blockchain smart contract, after the user authorizes and agrees, the blockchain smart contract sets the authorization decision status to passed, and proceeds to the next step; otherwise, the user authorization fails.

Preferably, the step S5 includes the following steps:

a. Permission user decrypts subfiles

The authorized user k reads A _k ^cypher from the blockchain smart contract, and obtains the sub-file A _{k by decrypting the authorized user's private key PrivKey k ;}

b. The privileged user encrypts the subfile and sends it to the file management module

Each authorized user encrypts the sub-file A _k with the public key PubKey ^fileManager of the file management module to obtain A _k ^U , then generates the digest of A _k and signs it with the private key PrivKey _k of the authorized user k to obtain Sig _k ^U , and converts A _k ^U . , Sig _k ^U sent to the file management module;

c. The file management module rebuilds the target file from the sub-file, including the following steps:

c1. The file management module first decrypts A _k ^U with the private key PrivKey ^Manager to obtain the sub-file A _k , calculates the digest of the sub-file A _k , denoted as H _k ^M , and solves the digest H of the sub-file A _k by Sig _k ^U _k ^U , if H _k ^U =H _k ^M , the sub-file A _k digest information verification is successful;

c2. The file management module reads the calculation summary of Sig _k ^M from the blockchain smart contract, and solves the summary H _k ^BlockChain corresponding to Sig _k ^M through the public key of the file management module. If H _k ^U = H _k ^BlockChain , then The verification of the file abstract A _k and the blockchain information is successful;

c3. The file management module reads the sub-file division configuration and control parameters stored in the blockchain smart contract to obtain the reconstruction target file, denoted as A ^reconstruct , and extracts the reconstruction target file abstract, denoted as H ^Reconstruct , and then uses the file management module The original digest corresponding to the signature digest Sig stored in the blockchain smart contract is solved by the public key, which is recorded as H ^BlockChain . If H ^Reconstruct = H ^BlockChain , the reconstruction target file A ^reconstruct and the blockchain smart contract storage information verification are successful;

d. The file management module encrypts the target file and sends it to the access user

The file management module obtains the encrypted and reconstructed target file by accessing the user's public key and encrypts A ^reconstruct , which is denoted as A ^access , and obtains the signature through the public key of the management module, denoted as Sig ^access , and sends A ^access and Sig ^access to the visiting user for related reading or Write operation; among them, the public key of the access user is recorded as PubKey ^accessUser .

The blockchain-based file storage and access system proposed by the present invention includes:

The file management module is used for the generation of target files to sub-files, file encryption and decryption, file information on-chain, and file access authorization control;

Users, including authorized users and access users, authorized users refer to users with sub-file control rights, and access users refer to users who need to view or change the target file;

Blockchain smart contracts for on-chain storage of file information, authorized collection and decision-making, etc.;

The file storage module is used for file information backup.

Preferably, the file management module includes a file access rights management module and a file information management module;

The file access authority management module is used to control the read and write operations of the target file;

The file information management module is used to save files, file signatures, authorized user public keys, and file management module public keys, and to perform information judgment and access request decisions on the file access rights management module.

Compared with the prior art, the beneficial effects of the present invention are:

1. Using a separate file storage mechanism, the target file is divided into several sub-files, and each sub-file is encrypted by an authorized user to store and control the operation authority of the sub-file.

2. The file-related information is stored in the blockchain, which is used for the reconstruction of the target file and information verification to ensure that the information is not tampered with.

The file-related information stored on the chain includes but is not limited to: the abstract information of the target file, the encrypted sub-file, the abstract information of the encrypted sub-file, the public key of the authorized user, the public key of the file management module, and the related information of file division, etc.

3. Complete the authorization of operations such as file reading or change through the blockchain smart contract, collect the user access authorization opinions of each authorized user, and make authorization decisions based on these opinions. After each authority user completes the authorization and consent, obtain all subfiles from each authority user, and then complete the reconstruction from the subfile to the target file. If the authorization user does not agree with the authorization, the authorization fails.

The file access rights management module takes advantage of the main features of blockchain, such as openness, transparency, and immutability, effectively enhancing the security and traceability of file access. Unilateral manipulation of the file is prevented by dividing the file into multiple sub-files and encrypting them with different private keys. At the same time, the relevant information of sub-files is encrypted and stored in the blockchain and cannot be tampered with, which greatly enhances the security of file information.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention, and for those of ordinary skill in the art, other drawings can also be obtained according to the structures shown in these drawings without creative efforts.

Fig. 1 is the functional flow chart of the present invention;

FIG. 2 is a functional block diagram of the system of the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

A block chain-based file storage and access method proposed by the present invention includes the following steps:

Step S1: file division, first define a set of sub-file division methods, adopted division methods and control parameters, and divide the target file into several sub-files, each sub-file corresponds to an authorized user;

Step S2: file encryption signature, the authorized user sends the corresponding sub-file encryption signature to the file management module, the file management module performs signature verification, and decides whether the verification is passed;

Step S3: the file information is uploaded to the chain, the file management module creates a blockchain smart contract, uploads the encrypted sub-file and the related information of the encrypted sub-file that have passed the verification in step S2 to the chain, stores it in the blockchain smart contract, and stores the data in the blockchain smart contract. All encrypted file encrypted sub-file information is backed up to the file storage module;

Step S4: file access authorization, during the file access service, the access user first initiates a file access request to the file management module, and the file access authority management module notifies each authority user for authorization confirmation;

Step S5: File reconstruction and sharing. After all authorized users complete the authorization and consent confirmation through the blockchain smart contract, the authorized user reads the encrypted sub-file from the blockchain smart contract and decrypts it into the corresponding sub-file, and encrypts signature and verification. After success, send it to the file management module to obtain the reconstruction target file, and finally encrypt the reconstruction target file and send it to the visiting user for related read or write operations;

If the access user is a read operation, the target file can be viewed after directly decrypting and reconstructing it;

If the access user is a write operation, after the access user submits the file information, the file management module submits each authority user for review. After the review is passed, the file management module re-executes the file update from step S1.

In the step S1, several sub-files are respectively denoted as A1, A2, A3....A _k , each sub-file corresponds to an authority user, and the authority user corresponding to A _k is denoted as k;

In the described steps S2 to S5, the authority user processes the corresponding sub-files through its public and private keys, the authority user public and private keys are respectively recorded as PubKey _k and PrivKey _k , and the authority user encrypted sub-file is recorded as A _k ^cypher ;

The file management module performs information judgment and access request decision through its public and private keys. The public and private keys of the file management module are PubKey ^fileManager and PrivKey ^fileManager respectively, wherein the encrypted sub-file of the file management module is recorded as _Ak ^M , and the file management module Digest signature for subfile _Ak , denoted as Sig _k ^M ;

The file management module verifies by comparing the digest of the target file and the signature digest of the target file. If the digest of the target file and the signature digest of the target file are consistent, the verification succeeds; otherwise, the verification fails;

Among them, the digest is obtained by the digest calculation function, and the digest calculation function can be a hash operation;

File encryption and signature are obtained by asymmetric encryption function, and the asymmetric encryption function can be RSA encryption function or elliptic curve encryption function;

File decryption is obtained by an asymmetric decryption function.

In this embodiment, the access user operation is a read operation:

Select the target file A as a Json format file, including 4 items of information, as follows:

The file division method adopts the domain mode, and the division method is recorded as Mode2;

The number of authorized users is 2;

The public and private keys of authorized user 1 are PubKey ₁ and PrivKey ₁ respectively;

The public and private keys of authorized user 2 are PubKey ₂ and PrivKey ₂ respectively;

The public and private keys of the file management module are: PubKey ^fileManager , PrivKey ^fileManager ;

The public and private keys of the access user are PubKey ^accessUser and PrivbKey ^{accessUser respectively} ;

The address of the access user is accessUserAddr;

Select the file division method as domain mode, and divide file A into two sub-files:

_Subfile A1 is:

_Subfile A2 is:

The step S2 file encryption signature specifically includes the following steps:

a. File management module encrypted signature:

First calculate the digest of the target file A, and sign the digest with the private key PrivKey ^Manager of the file management module, denoted as Sig;

Sig=ECC(MD5(A), PrivKey ^fileManager )

in:

The digest algorithm is MD5 digest algorithm;

The asymmetric encryption and decryption algorithm uses the elliptic curve encryption and decryption ECC method.

for user k=1, 2;

Then encrypt the subfile A _k with the public key Pubkey _k of the authorized user k to obtain A _k ^M ,

A _k ^M =ECC(A _k , Pubkey _k )

Then use the private key of the file management module, PrivKey ^Manager , to sign the digest of the sub-file A _k to obtain the signature of the sub-file, denoted as Sig _k ^M ,

Sig _k ^M =ECC(MD5(A _k ), PrivKey ^fileManager )

Finally, send A _k ^M and Sig _k ^M to the authorized user k;

b. Encrypted signature of permission user subfile:

After each authorized user k receives A _k ^M and Sig _k ^M , perform the following operations:

b1. Subfile restore:

First, decode A _k ^M through the private key PrivKey _k of the authorized user k to obtain the sub-file A _k ,

A _k = ECC ^-1 (A _k ^M , PrivKey _k )

Among them: ECC-1() is the private key decryption function of ECC().

Then solve the digest of the sub-file _Ak , denoted as H _k ^U ,

H _k ^U =MD5(A _k )

Then use the public key Pubkey ^fileManager of the file management module to decode Sig _k ^M to obtain the abstract H _k ^M ,

H _k ^M = ECC ^-1 (Sig _k ^M , PubKey ^fileManager )

Finally verify the consistency of the digest: if H _k ^U =H _k ^M , the sub-file is restored successfully, and the next step is continued, otherwise, the restoration fails;

b2. Encrypted sub-file generation:

First encrypt the subfile A _k with the public key Pubkey _k of the authorized user k to obtain A _k ^cypher ,

A _k ^cypher =ECC(A _k , Pubkey _k )

Then encrypt A _k cypher with the public key ^{PubKey fileManager} of the file management module to obtain A _k ^U ,

A _k ^U =ECC(A _k ^cypher , PubKey ^fileManager )

Regenerate the digest of A _k ^cypher and sign it with PrivKey _k of authorized user k to obtain Sig _k ^U ,

Sig _k ^U =ECC(MD5(A _k ^cypher ), PrivKey _k )

Finally, A _k ^U and Sig _k ^U are sent to the file management module.

Among them, the digest of the file is obtained by the digest calculation function, the file encryption and signature are obtained by the asymmetric encryption function, and the decryption of the file is obtained by the asymmetric decryption function.

In the step S3, the file information is uploaded to the chain, and a blockchain smart contract is created, that is, the blockchain smart contract access authorization function and the blockchain smart contract access authorization decision function are respectively defined, and the verified encrypted sub-file related information is uploaded to the chain , stored in the smart contract, back up all encrypted files and encrypted sub-file information to the file storage module, and the stored file-related information can include the following:

The summary information of the target file, the encrypted sub-file, the summary information of the encrypted sub-file, the public key of the authorized user, the public key of the file management module, and the related information of file division.

in,

The blockchain smart contract access authorization function is:

FileApprove(TargetFile, OPCode, "Agree" or "Disagree", accessUserAddr) blockchain smart contract access authorization decision function:

FileDecision(TargetFile, OPCode, accessUserAddr)

As shown in Table 1, the information table is stored for the blockchain smart contract.

Table 1

In the step S4 file access authorization, the file management module queries the blockchain smart contract to obtain the public key list of the authorized user, and initiates an authorization review request to each authorized user, and each authorized user invokes the blockchain smart contract to decide the access request of the access user , according to all the permissions determined in the blockchain smart contract, after the user has authorized and agreed, the blockchain smart contract will set the authorization decision status to passed, and proceed to the next step; otherwise, the user authorization has not passed.

Specifically, it includes the following steps:

(1) The access user accessUserAddr initiates an access request to the file management module;

FileRequest(TargetFile, OPCode)

Among them: If the OPCode is 0, it means a read operation.

(2) The file management module queries the blockchain smart contract to obtain the public key list of authorized users: PubKey ₁ and PubKey ₂ .

(3) The file management module initiates an authorization review request to authorized user 1 and authorized user 2;

(4) Each authorized user calls the blockchain smart contract to agree to the access request:

FileApprove(TargetFile, "0", "Agree", accessUserAddr)

(5) The file management module regularly calls the blockchain smart contract

FileDecision(TargetFile, "0", accessUserAddr)

The file access authorization decision is triggered. After the two authorized users complete the authorization and consent, the blockchain smart contract sets the authorization decision status to "Approved".

The step S5 file reconstruction and sharing includes the following steps:

a. Permission user decrypts subfiles:

The authorized user k reads A _k ^cypher from the blockchain smart contract, and obtains the sub-file A _{k by decrypting the authorized user's private key PrivKey k ;}

b. The authorized user encrypts the subfile and sends it to the file management module:

The file management module first encrypts the sub-file A _k public key PubKey ^fileManager to obtain A _k ^U ,

A _k ^U =ECC(A _k , PubKey ^fileManager )

Re-generate the digest of A _k ^U and sign it with PrivKey _k of the privileged user k to obtain Sig _k ^U ,

Sig _k ^U =ECC(MD5(A _k ), PrivKey _k )

and send A _k ^U and Sig _k ^U to the file management module;

c. The file management module rebuilds the target file from the sub-file, including the following steps:

c1. The file management module first decrypts the A _k ^U private key PrivKey ^Manager to obtain the sub-file A _k ,

A _k = ECC ^-1 (A _k ^U , PrivKey ^Manager )

Calculate the digest H _k ^M of _Ak ,

H _k ^M =MD5(A _k )

Solve the digest H _k ^U of the subfile _Ak ,

H _k ^U = ECC ^-1 (Sig _k ^U , PubKey _k )

If H _k ^U =H _k ^M , the verification of the digest information of the sub-file A _k is successful;

c2. Verify the consistency of the sub-file summary A _k with the blockchain information:

The file management module reads the Sig _k ^M calculation summary from the blockchain smart contract, denoted as H _k ^BlockChain ,

H _k ^BlockChain = ECC ^-1 (Sig _k ^M , PubKey ^fileManager )

If H _k ^U = H _k ^BlockChain , the sub-file digest _Ak and the blockchain information are verified successfully;

c3. Restore each subfile to the target original file:

(1) The file management module reads the sub-file division configuration and control parameters stored in the blockchain smart contract to obtain the reconstruction target file, denoted as A ^reconstruct ,

A ^reconstruct = Rec(A1, A2, Mode2, Null)

Reconstruct A ^reconstruct as follows:

Solve the summary of the reconstruction object file, denoted as H ^Reconstruct ,

H ^Reconstruct =MD5(A ^reconstruct )

Then use the public key of the file management module to solve the original abstract corresponding to the signature abstract Sig stored in the blockchain smart contract, denoted as H ^BlockChain ,

H ^BlockChain = ECC ^-1 (Sig, PubKey ^fileManager )

If H ^Reconstruct = H ^BlockChain , the reconstruction target file A ^reconstruct and the blockchain smart contract storage information are verified successfully;

d. The file management module encrypts the target file and sends it to the access user:

The file management module obtains the encrypted and reconstructed target file by accessing the user's public key PubKey ^{accessUser and} encrypting A ^reconstruct , denoted as A ^access ,

A ^access = ECC(A ^reconstruct , PubKey ^accessUser )

Then obtain the signature through the private key PrivKey ^fileManager of the file management module and record it as Sig ^access ,

Sig ^access = ECC(MD5(A ^reconstruct ), PrivKey ^fileManager )

Send A ^access and Sig ^access to the access user for related read or write operations. The access user decrypts A ^access through the user's private key, and verifies the information integrity of A ^access through Sig ^access . After the verification is correct, the target file can be obtained.

The invention effectively enhances the security and traceability of file access by utilizing the main features of the block chain, such as openness, transparency, and immutability. Unilateral manipulation of the file is prevented by dividing the file into multiple sub-files and encrypting them with different private keys. At the same time, the relevant information of the sub-file is encrypted and stored in the blockchain and cannot be tampered with, which greatly enhances the security of the file information.

A blockchain-based file storage and access system proposed by the present invention, as shown in Figure 2, includes:

The file management module is used for the generation of target files to sub-files, file encryption and decryption, file information on-chain, and file access authorization control;

Users, including authorized users and access users, authorized users refer to users with sub-file control rights, and access users refer to users who need to view or change the target file;

Blockchain smart contracts for on-chain storage of file information, authorized collection and decision-making, etc.;

The file storage module is used for file information backup.

Specifically, the file management module includes a file access rights management module and a file information management module;

The file access authority management module is used to control the read and write operations of the target file;

The file information management module is used to save files, file signatures, authorized user public keys, and file management module public keys, and to perform information judgment and access request decisions on the file access rights management module.

The file management module of the present invention adopts a separate file storage and a smart contract-based file management mechanism;

The separate file storage method is: divide the target file into several sub-files, encrypt the target file and each sub-file with different secret keys, generate a file digest and sign, and upload the file information to the chain to ensure that it cannot be tampered with.

Specifically, in this embodiment, a set of sub-file division methods, the adopted division methods and control parameters are first defined, and the target file is divided into several sub-files, each sub-file corresponds to an authorized user, and the several sub-files are respectively recorded as A1, A2, A3....AK , K is the number of sub-files, the authorized user corresponding to A _k is recorded as _k , the authorized user processes the corresponding sub-files through its public and private keys, and the public and private keys of the authorized user are recorded as PubKey _k respectively , PrivKey _k , the sub-file encrypted by the authorized user is recorded as A _k ^cypher ; the file management module performs information judgment and access request decision through its public and private keys, and the public and private keys of the file management module are PubKey ^fileManager and PrivKey ^fileManager respectively, among which, The encrypted sub-file by the file management module is denoted as A _k ^M , and the digest signature of the sub-file A by the file management module is denoted as Sig _{k M} ^.

Then, the file management module verifies by comparing the digest of the target file with the signature digest of the target file, if the digest of the target file and the signature digest of the target file are consistent, the verification succeeds, otherwise the verification fails. The file management module creates a blockchain smart contract, uploads the relevant information of the encrypted sub-files that have passed the verification, and backs up all the encrypted sub-file information to the file storage module or blockchain smart contract.

Among them, the digest is obtained by the digest calculation function, and the digest calculation function can be a hash operation;

File encryption and signature are obtained by asymmetric encryption function, and the asymmetric encryption function can be RSA encryption function or elliptic curve encryption function;

File decryption is obtained by an asymmetric private key decryption function.

The file management mechanism based on smart contracts mainly includes file information management and file access rights management;

The file access authority management is used to control the read and write operations of the target file; the access user first initiates a file access request to the file access authority management module, and the file access authority management module obtains a list of authority users through the blockchain smart contract, and notifies each authority user Authorization; After all authorized users have authorized and agreed through the blockchain smart contract, the file access rights management module receives each encrypted sub-file and restores the target file, and finally encrypts it and sends it to the access user for the required operation;

The file information management is used to save files, file signatures, public and private keys of authorized users, and public and private keys of the file management module in the file information management module, and to perform information judgment and access request decision on the file access rights management module.

Take the access user for read operation as an example:

Select the target file as a Json format file, including 4 items of information, as follows:

The file division method adopts the domain mode, and the division method is recorded as Mode2;

The number of authorized users is 2;

The public and private keys of authorized user 1 are PubKey ₁ and PrivKey ₁ ;

The public and private keys of authorized user 2 are PubKey ₂ and PrivKey ₂ ;

The public and private keys of the file management module are: PubKey ^fileManager , PrivKey ^fileManager ;

The public and private keys of the access user are PubKey ^accessUser and PrivbKey ^{accessUser respectively} ;

The address of the access user is accessUserAddr;

Select the file division method as domain mode, and divide file A into two sub-files:

_Subfile A1 is:

_Subfile A2 is:

File encryption signature, including the following steps:

a. File management module encrypted signature:

First calculate the digest of the target file A, and sign the digest with the private key PrivKey ^Manager of the file management module, denoted as Sig;

Sig=ECC(MD5(A), PrivKey ^fileManager )

in:

The digest algorithm is MD5 digest algorithm;

The asymmetric encryption and decryption algorithm uses the elliptic curve encryption and decryption ECC method.

for user k=1, 2;

Then encrypt the subfile A _k with the public key Pubkey _k of the authorized user k to obtain A _k ^M ,

A _k ^M =ECC(A _k , Pubkey _k )

Then use the private key of the file management module, PrivKey ^Manager , to sign the digest of the sub-file A _k to obtain the signature of the sub-file, denoted as Sig _k ^M ,

Sig _k ^M =ECC(MD5(A _k ), PrivKey ^fileManager )

Finally, send A _k ^M and Sig _k ^M to the authorized user k;

b. Encrypted signature of permission user subfile:

After each authorized user k receives A _k ^M and Sig _k ^M , perform the following operations:

b1. Subfile restore:

First, decode A _k ^M through the private key PrivKey _k of the authorized user k to obtain the sub-file A _k ,

A _k = ECC ^-1 (A _k ^M , Privkey _k )

Among them: ECC-1() is the private key decryption function of ECC().

Then solve the digest of the sub-file _Ak , denoted as H _k ^U ,

H _k ^U =MD5(A _k )

Then use the public key Pubkey ^fileManager of the file management module to decode Sig _k ^M to obtain the abstract H _k ^M ,

H _k ^M = ECC ^-1 (Sig _k ^M , PubKey ^fileManager )

Finally verify the consistency of the digest: if H _k ^U =H _k ^M , the sub-file is restored successfully, and the next step is continued, otherwise, the restoration fails;

b2. Encrypted sub-file generation:

First encrypt the subfile A _k with the public key Pubkey _k of the authorized user k to obtain A _k ^cypher ,

A _k ^cypher =ECC(A _k , Pubkey _k )

Then encrypt A _k cypher with the public key ^{PubKey fileManager} of the file management module to obtain A _k ^U ,

A _k ^U =ECC(A _k ^cypher , PubKey ^fileManager )

Regenerate the digest of A _k ^cypher and sign it with PrivKey _k of authorized user k to obtain Sig _k ^U ,

Sig _k ^U =ECC(MD5(A _k ^cypher ), PrivKey _k )

Finally, A _k ^U and Sig _k ^U are sent to the file management module.

Among them, the digest of the file is obtained by the digest calculation function, the file encryption and signature are obtained by the asymmetric encryption function, and the decryption of the file is obtained by the asymmetric decryption function.

The file information is uploaded to the chain, and the blockchain smart contract is created, that is, the access authorization function of the blockchain smart contract and the access authorization decision function of the blockchain smart contract are respectively defined, and the relevant information of the encrypted sub-file that has passed the verification is uploaded to the chain and stored in the smart In the contract, all encrypted files and encrypted sub-file information are backed up to the file storage module, and the stored file-related information can include the following:

The summary information of the target file, the encrypted sub-file, the summary information of the encrypted sub-file, the public key of the authorized user, the public key of the file management module, and the related information of file division.

in,

The blockchain smart contract access authorization function is:

FileApprove(TargetFile, OPCode, "Agree" or "Disagree", accessUserAddr) blockchain smart contract access authorization decision function:

FileDecision(TargetFile, OPCode, accessUserAddr)

As shown in Table 2, the information table is stored for the blockchain smart contract.

Table 2

File access authorization, including the following:

The file management module queries the blockchain smart contract to obtain the public key list of the authorized user, and initiates an authorization review request to each authorized user. Each authorized user invokes the blockchain smart contract to decide the access user's access request. After all the users with the determined permissions have authorized and agreed, the blockchain smart contract will set the authorization decision status to passed, and proceed to the next step; otherwise, the user authorization has not passed.

Specifically, it includes the following steps:

(1) The access user accessUserAddr initiates an access request to the file management module;

FileRequest(TargetFile, OPCode)

Among them: OPCode is 0 for read operation.

(2) The file management module queries the blockchain smart contract to obtain the public key list of authorized users: PubKey ₁ and PubKey ₂ .

(3) The file management module initiates an authorization review request to authorized user 1 and authorized user 2;

(4) Each authorized user calls the blockchain smart contract to agree to the access request:

FileApprove(TargetFile, "0", "Agree", accessUserAddr)

(5) The file management module regularly calls the blockchain smart contract

FileDecision(TargetFile, "0", accessUserAddr)

And trigger the file access authorization decision. After the two authorized users complete the authorization and consent, the blockchain smart contract sets the authorization decision status to "Approved".

After the file access authorization is approved, file reconstruction and sharing are performed, including the following steps:

a. Permission user decrypts subfiles:

The authorized user k reads A _k ^cypher from the blockchain smart contract, and obtains the sub-file A _{k by decrypting the authorized user's private key PrivKey k ;}

b. The authorized user encrypts the subfile and sends it to the file management module:

The file management module first encrypts the sub-file A _k public key PubKey ^fileManager to obtain A _k ^U ,

A _k ^U =ECC(A _k , PubKey ^fileManager )

Re-generate the digest of A _k ^U and sign it with PrivKey _k of the privileged user k to obtain Sig _k ^U ,

Sig _k ^U =ECC(MD5(A _k ), PrivKey _k )

and send A _k ^U and Sig _k ^U to the file management module;

c. The file management module rebuilds the target file from the sub-file, including the following steps:

c1. The file management module first decrypts the A _k ^U private key PrivKey ^Manager to obtain the sub-file A _k ,

A _k = ECC ^-1 (A _k ^U , PrivKey ^Manager )

Compute the ^digest _{HkM for Ak :}

H _k ^M =MD5(A _k )

Solve the digest H _k ^U of the subfile _Ak ,

H _k ^U = ECC ^-1 (Sig _k ^U , PubKey _k )

If H _k ^U =H _k ^M , the verification of the digest information of the sub-file A _k is successful;

c2. Verify the consistency of the sub-file summary A _k with the blockchain information:

The file management module reads the Sig _k ^M calculation summary from the blockchain smart contract, denoted as H _k ^BlockChain ,

H _k ^BlockChain = ECC ^-1 (Sig _k ^M , PubKey ^fileManager )

If H _k ^U = H _k ^BlockChain , the sub-file digest _Ak and the blockchain information are verified successfully;

c3. Restore each subfile to the target original file:

(1) The file management module reads the sub-file division configuration and control parameters stored in the blockchain smart contract to obtain the reconstruction target file, denoted as A ^reconstruct ,

A ^reconstruct = Rec(A1, A2, Mode2, Null)

Reconstruct A ^reconstruct as follows:

Solve the summary of the reconstruction object file, denoted as H ^Reconstruct ,

H ^Reconstruct =MD5(A ^reconstruct )

Then use the public key of the file management module to solve the original abstract corresponding to the signature abstract Sig stored in the blockchain smart contract, denoted as H ^BlockChain ,

H ^BlockChain = ECC ^-1 (Sig, PubKey ^fileManager )

If H ^Reconstruct = H ^BlockChain , the reconstruction target file A ^reconstruct and the blockchain smart contract storage information are verified successfully;

d. The file management module encrypts the target file and sends it to the access user:

The file management module obtains the encrypted and reconstructed target file by accessing the user's public key PubKey ^{accessUser and} encrypting A ^reconstruct , denoted as A ^access ,

A ^access = ECC(A ^reconstruct , PubKey ^accessUser )

Then obtain the signature through the private key PrivKey ^fileManager of the file management module and record it as Sig ^access ,

Sig ^access = ECC(MD5(A ^reconstruct ), PrivKey ^fileManager )

Send A ^access and Sig ^access to the access user for related read or write operations. The access user decrypts A ^access through the user's private key, and verifies the information integrity of A ^access through Sig ^access . After the verification is correct, the target file can be obtained.

The above descriptions are only the preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Under the inventive concept of the present invention, the equivalent structural transformations made by the contents of the description and drawings of the present invention, or the direct/indirect application Other related technical fields are included in the scope of patent protection of the present invention.

Claims (8)

1. A file storage and access method based on a block chain is characterized by comprising the following steps:

step S1: file division, namely firstly defining a subfile division mode set, an adopted division mode and control parameters, and dividing a target file into a plurality of subfiles, wherein each subfile corresponds to an authority user;

step S2: the file encryption signature is realized, the authorized user sends the corresponding subfile encryption signature to the file management module, and the file management module carries out signature verification and decides whether the verification is passed;

step S3: linking the file information, creating a block chain intelligent contract by the file management module, linking the encrypted subfiles and the related information of the encrypted subfiles which pass the verification in the step S2, storing the linked information in the block chain intelligent contract, and backing up all the encrypted files and the information of the encrypted subfiles to the file storage module;

step S4: file access authorization, in the file access service, an access user firstly initiates a file access request to a file management module, and the file access authority management module informs each authority user of authorization confirmation;

step S5: file reconstruction and sharing, after all authority users finish authorization agreement confirmation through a block chain intelligent contract, the authority users read the encrypted subfiles from the block chain intelligent contract and then decrypt the encrypted subfiles into corresponding subfiles, and after the encrypted subfiles are successfully signed and verified, the encrypted subfiles are sent to a file management module to obtain a reconstructed target file, and finally the reconstructed target file is encrypted and sent to an access user for related reading or writing operation;

if the access user is in reading operation, the access user can check the target file after directly decrypting and reconstructing the target file;

if the access user is write operation, after the access user submits the file information, the access user submits the audit of each authority user through the file management module, and after the audit is passed, the file management module re-executes from step S1 to complete the file update.

2. The blockchain-based file storage and access method of claim 1, wherein in the step S1, the sub-files are respectively marked as A1, A2 and A3 … … _KK is the number of subfiles, each subfile corresponds to an authority user, and A is defined as _kMarking the corresponding authority user as k;

in the steps S2 to S5, the authorized user processes the corresponding subfile by the public and private keys, and the public and private keys of the authorized user are respectively marked as PubKey _k、PrivKey _kThe encrypted subfile of the authorized user is marked as A _k ^cypher；

The file management module carries out information judgment and access request decision through a public key and a private key thereof, and the public key and the private key of the file management module are respectively PubKey ^fileManager、PrivKey ^fileManagerThe file management module is used for sub-file A _kThe subfile encrypted by the private key is marked as A _k ^MThe digest signature is Sig _k ^M。

The file management module verifies the target file abstract and the target file signature abstract by comparing, if the target file abstract and the target file signature abstract are consistent, the verification is successful, otherwise, the verification fails;

the digest is obtained by a digest calculation function, the file encryption and signature are obtained by an asymmetric encryption function, and the file decryption is obtained by an asymmetric decryption function.

3. The block chain-based file storage and access method according to claim 2, wherein the step S2 comprises the steps of:

a. file management module encryption signature

First, the abstract of the target file A is calculated, and the private key PrivKey of the file management module is used ^ManagerSigning the abstract, and marking as Sig;

reusing public key Pubkey of authorized user k _kEncrypted subfile A _kObtaining A _k ^M；

Then the PrivKey is private key of file management module ^ManagerFor subfile A _kTo obtain a signature of the sub-file, denoted as Sig _k ^M；

Finally, A is added _k ^M、Sig _k ^MSending the data to an authorized user k;

b. encrypted signature of authority user subfile

Waiting for each authorized user k to receive A _k ^M、Sig _k ^MThen, the following operations are performed:

b1 subfile recovery

First pass private key PrivKey of authority user k _kTo A _k ^MDecoding to obtain subfile A _k；

Then solve subfile A _kIs marked as H _k ^U；

Reusing public key Pubkey of file management module ^fileManagerDecoding Sig _k ^MGet the abstract H _k ^M；

And finally, checking the consistency of the abstract: if H is present _k ^U＝H _k ^MIf the sub-file is successfully restored, continuing the next step of processing, otherwise, failing to restore;

b2. encrypted subfile generation

Public key Pubkey of preemptive authority user k _kEncrypted subfile A _kObtaining A _k ^cypher；

Then uses the public key PubKey of the file management module ^fileManagerEncryption A _k ^cypherObtaining A _k ^U；

Regeneration of A _k ^cypherThe abstract of the user and the private key PrivKey of the authorized user k _kSign, obtain Sig _k ^U；

Finally, A is added _k ^UAnd Sig _k ^UAnd sending the file to a file management module.

The digest of the file is obtained by a digest calculation function, the file encryption and signature are obtained by an asymmetric encryption function, and the file decryption is obtained by an asymmetric decryption function.

4. The blockchain-based file storage and access method according to claim 2, wherein the step S3 creates a blockchain intelligent contract that is: and respectively defining a block chain intelligent contract access authorization function and a block chain intelligent contract access authorization decision function, chaining the relevant information of the verified encrypted subfiles, storing the related information into the block chain intelligent contract, and backing up all encrypted files and the encrypted subfile information to a file storage module.

5. The method according to claim 2, wherein in step S4, the file management module queries the intelligent block chain contract to obtain a public key list of authorized users, and sends an authorization and audit request to each authorized user, each authorized user invokes the access request of the intelligent block chain contract decision access user, and after all the authorized users determined in the intelligent block chain contract grant permission, the intelligent block chain contract sets the authorization decision state as pass, and continues the next step; otherwise, the user authorization is not passed.

6. The block chain-based file storage and access method according to claim 2, wherein said step S5 includes the steps of:

a. authorized user decrypting subfile

Authorized user k reads A from the blockchain intelligent contract _k ^cypherBy authority user private key PrivKey _kDecrypting to obtain the subfile A _k；

b. The authority user encrypts the subfile and sends the subfile to the file management module

Each authorized user will subfile A _kPublic key PubKey using file management module ^fileManagerEncrypting to obtain A _k ^URegeneration of A _kThe abstract of the user and the private key PrivKey of the authorized user k _kSign, obtain Sig _k ^UAnd A is _k ^U、Sig _k ^USending the file to a file management module;

c. the file management module reconstructs the target file from the subfiles, comprising the steps of:

c1. the file management module firstly checks A _k ^UPrivKey with private key ^ManagerDecrypting to obtain the subfile A _kComputing subfile A _kIs marked as H _k ^MAnd is formed by Sig _k ^USolve subfile A _kSummary of (1) _k ^UIf H is _k ^U＝H _k ^MThen subfile A _kThe verification of the abstract information is successful;

c2. the file management module reads Sig from the intelligent contract of the block chain _k ^MCalculating abstract, and solving Sig by public key of file management module _k ^MCorresponding abstract H _k ^BlockChainIf H is _k ^U＝H _k ^BlockChainThen subfile digest A _kThe verification of the block chain information is successful;

c3. the file management module reads the subfile division mode configuration and control parameters stored by the intelligent block chain contract to obtain a reconstructed target file, which is marked as A ^reconstructAnd solving the summary of the reconstructed target file, which is marked as H ^ReconstructThen, the intelligent combination of block chains is solved by the public key of the file management moduleThe original digest corresponding to the signature digest Sig stored in the contract is marked as H ^BlockChainIf H is ^Reconstruct＝H ^BlockChainThen rebuild the object file A ^reconstructThe verification with the intelligent contract storage information of the block chain is successful;

d. the file management module encrypts the target file and sends the encrypted target file to the access user

The file management module encrypts A by accessing the public key of the user ^reconstructObtaining an encrypted reconstruction target file, marked as A ^accessObtaining the signature Sig by the public key of the management module ^accessA is ^accessAnd Sig ^accessSending the information to an access user for related reading or writing operation; wherein, the public key of the access user is recorded as PubKey ^accessUser。

7. A blockchain-based file storage and access system, comprising:

the file management module is used for generating a target file to a subfile, encrypting and decrypting the file, chaining file information and controlling file access authorization;

the system comprises users and a server, wherein the users comprise an authority user and an access user, the authority user refers to a user with sub-file control authority, and the access user refers to a user needing to view or change a target file;

the block chain intelligent contract is used for storing, authorized gathering, decision making and the like on the file information chain;

and the file storage module is used for backing up file information.

8. The blockchain based file storage and access system of claim 7,

the file management module comprises a file access authority management module and a file information management module;

the file access authority management module is used for controlling the read-write operation of the target file;

the file information management module is used for storing files, file signatures, authority user public keys and file management module public keys and performing information judgment and access request decision on the file access authority management module.

Images