Block chain data management method and system

Abstract

The invention provides a block chain data management method and system, and relates to the technical field of block chains, and the method comprises the steps: receiving and preprocessing an electronic file; encrypting the archive by using a public key and calculating a hash value; packaging the encrypted file and the hash value into a block chain transaction and broadcasting the block chain transaction; acquiring block information and safely storing the private key; verifying the integrity of the electronic file; recording a full life cycle operation log; the log is stored in an on-chain and off-chain combined mode; auditing the electronic file; and realizing access authority automatic management based on the intelligent contract. According to the method, the security, traceability and management efficiency of the electronic archives are improved.

Description

Technical Field

[0001] The present invention relates to blockchain technology, and in particular to a blockchain data management method and system. Background Art

[0002] Traditional centralized storage methods cannot guarantee the authenticity and integrity of electronic files. Since data is stored in a single database, it is vulnerable to hacker attacks or internal tampering. Once the data is illegally modified, it will be difficult to discover and trace, and the credibility of the electronic files cannot be ensured.

[0003] Secondly, the existing electronic archive management system lacks an effective full life cycle tracking mechanism. There is a lack of complete records and auditing methods for uploading, accessing, and modifying electronic archives, making it difficult to accurately restore the operation history of archives, which is not conducive to subsequent accountability and security management.

[0004] Traditional systems are relatively rigid in terms of access control and authority management. They usually use static authority configuration methods, which cannot flexibly adjust access policies according to actual business needs. Authority changes require manual intervention, which is prone to authority management confusion and security vulnerabilities. These problems seriously restrict the standardization and credibility of electronic archive management. Summary of the invention

[0005] The embodiments of the present invention provide a blockchain data management method and system, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention, Provides blockchain data management methods, including: Receive the electronic archive uploaded by the user, and pre-process the electronic archive, including format unification and metadata extraction; generate a public key and a private key pair using an asymmetric encryption algorithm, and use the public key to encrypt the electronic archive to obtain the encrypted electronic archive; calculate the hash value of the encrypted electronic archive, and encapsulate the hash value and the encrypted electronic archive together as a blockchain transaction; broadcast the blockchain transaction to the blockchain network, and the consensus node in the blockchain network verifies and packages the blockchain transaction into a block; after the block is added to the blockchain, obtain the block height and timestamp information of the block; encrypt the private key, the block height and the timestamp information and store them in an isolated secure storage area; Receive an electronic file verification request initiated by a user, the verification request including identification information of the electronic file to be verified; locate the corresponding block and transaction on the blockchain according to the identification information; extract the encrypted electronic file and hash value from the transaction; recalculate the hash value of the encrypted electronic file, and compare the recalculated hash value with the hash value extracted from the transaction; if the two hash values ​​are consistent, confirm that the encrypted electronic file has not been tampered with; obtain the corresponding private key from the secure storage area, and use the private key to decrypt the encrypted electronic file to obtain the original electronic file; Based on the tamper-proof characteristics of blockchain, the operation log of the entire life cycle of electronic archives is recorded, including operations such as uploading, accessing, modifying and verifying; the operation log is stored in a combination of on-chain and off-chain methods, specifically including: storing the hash value of the operation log on the blockchain, and encrypting the complete operation log and storing it in a distributed storage system; when an electronic archive audit is required, the operation log hash value on the blockchain and the encrypted operation log in the distributed storage system are obtained; the integrity and authenticity of the encrypted operation log are verified; the encrypted operation log is decrypted, and the operation track and access history report of the electronic archive is generated according to the decrypted operation log; based on smart contracts, the automated management of access rights to electronic archives is realized, including setting access policies, recording access requests and automatically executing access control.

[0007] Preprocessing also includes: Scan the electronic files for viruses and sensitive information; convert the electronic files into a unified file format; Extracting metadata of the electronic archive, including file name, creation time, author, and file size; A unique identifier for the electronic archive is generated; and the unique identifier is associated with the metadata and stored.

[0008] The asymmetric encryption algorithm uses the elliptic curve encryption algorithm, which includes: Choose a secure elliptic curve and base point; generate the private key as a large random number; Calculating a public key by using elliptic curve point multiplication; encrypting the electronic file using the public key; The private key is sharded, and a threshold key sharing scheme is adopted to distribute the private key shards to multiple trusted nodes for safekeeping.

[0009] Electronic file integrity verification also includes: Calculating the Merkle root of the encrypted electronic file; comparing the Merkle root with the Merkle root stored on the blockchain; If the two Merkle tree roots are consistent, each data block of the electronic archive is further verified; for each data block, its hash value is calculated and its position in the Merkle tree is verified; The integrity of the encrypted electronic file is confirmed only when all data blocks are verified.

[0010] The storage methods that combine on-chain and off-chain include: Divide the operation log into sensitive information and non-sensitive information; encrypt the sensitive information, and combine the encrypted sensitive information and non-sensitive information into a complete operation log; Calculate the hash value of the complete operation log and submit the hash value to the blockchain; store the complete operation log in the distributed storage system and record the index information of the storage location on the blockchain; Regularly perform integrity checks on the operation logs in the distributed storage system. If any abnormality is found, immediately restore the data from other nodes and update the index information on the blockchain.

[0011] Automated management based on smart contracts also includes: Define the access control policy of electronic archives in the smart contract, including role definition, permission level and access conditions; register user identity information and role information on the blockchain; When receiving an access request, the smart contract automatically verifies the identity and role of the requesting user; based on the preset access control policy, the smart contract determines whether to authorize access; If access is authorized, the smart contract generates a time-limited access token; the access request, judgment result, and token information are recorded on the blockchain to ensure traceability.

[0012] A multi-layer encryption scheme is used, including: Dividing the electronic file into a plurality of data blocks; encrypting each data block using a different symmetric encryption key; Encrypt all symmetric encryption keys using the public key of the asymmetric encryption algorithm; construct a Merkle tree containing all encrypted data blocks and encryption keys; submit the Merkle tree root hash value and the encrypted symmetric key to the blockchain; The asymmetric encrypted private key is split using a threshold cryptographic scheme and distributed to multiple authorized nodes.

[0013] Automated management based on smart contracts also includes dynamic access control mechanisms: Implement an attribute-based encrypted access control scheme; encode user attributes and archive access policies into smart contracts; when a user requests to access an archive, the smart contract automatically evaluates whether the user attributes satisfy the access policy; If satisfied, a one-time decryption key is generated and transmitted to the user through a secure channel; access events are recorded, including a summary of user identity, access time, and access content; Implement adaptive access control strategies to dynamically adjust access rules based on access patterns and security threats; use machine learning algorithms to analyze access patterns, detect abnormal access behaviors, and trigger corresponding security response mechanisms.

[0014] According to a second aspect of the embodiments of the present invention, Provide blockchain data management system, including: The first unit is used to receive an electronic file uploaded by a user, pre-process the electronic file, including format unification and metadata extraction; generate a public key and a private key pair using an asymmetric encryption algorithm, encrypt the electronic file using the public key, and obtain an encrypted electronic file; calculate a hash value of the encrypted electronic file, and encapsulate the hash value and the encrypted electronic file together as a blockchain transaction; broadcast the blockchain transaction to the blockchain network, and the consensus node in the blockchain network verifies and packages the blockchain transaction into a block; after the block is added to the blockchain, obtain the block height and timestamp information of the block; encrypt the private key, the block height and the timestamp information and store them in an isolated secure storage area; The second unit is used to receive an electronic file verification request initiated by a user, wherein the verification request includes identification information of the electronic file to be verified; locate the corresponding block and transaction on the blockchain according to the identification information; extract the encrypted electronic file and the hash value from the transaction; recalculate the hash value of the encrypted electronic file, and compare the recalculated hash value with the hash value extracted from the transaction; if the two hash values ​​are consistent, it is confirmed that the encrypted electronic file has not been tampered with; obtain the corresponding private key from the secure storage area, and use the private key to decrypt the encrypted electronic file to obtain the original electronic file; The third unit is used to record the operation log of the entire life cycle of electronic archives based on the tamper-proof characteristics of blockchain, including operations such as uploading, accessing, modifying and verifying; storing the operation log in a combined on-chain and off-chain manner, specifically including: storing the hash value of the operation log on the blockchain, and encrypting the complete operation log and storing it in a distributed storage system; when an electronic archive audit is required, obtaining the hash value of the operation log on the blockchain and the encrypted operation log in the distributed storage system; verifying the integrity and authenticity of the encrypted operation log; decrypting the encrypted operation log, and generating the operation track and access history report of the electronic archive based on the decrypted operation log; and realizing automated management of access rights to electronic archives based on smart contracts, including setting access policies, recording access requests and automatically executing access control.

[0015] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0016] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0017] The beneficial effects of this application are as follows: 1. Through the combination of blockchain technology and asymmetric encryption algorithms, the secure storage and tamper-proofing of electronic archives are achieved. Specifically, the archive content is stored using public key encryption, and the private key is stored in a secure and isolated manner; the authenticity and integrity of electronic archives are ensured through the tamper-proof characteristics of blockchain and the hash verification mechanism; at the same time, based on the characteristics of blockchain distributed storage, the reliability and disaster recovery capabilities of electronic archive storage are improved.

[0018] 2. The operation log is stored in a combination of on-chain and off-chain methods, which not only ensures the credibility of log data but also improves storage efficiency. The hash value of the operation log is uploaded to the chain to ensure its immutability, and the complete log is encrypted and stored in the distributed system to save on-chain storage space; the operation records of the entire life cycle of the electronic archive can be traced through hash verification and decryption, realizing a complete electronic archive audit function.

[0019] 3. Based on smart contracts, the automatic management of electronic archive access rights is realized, which improves the security and management efficiency of the system. Smart contracts can automatically execute preset access policies, record access requests in real time, effectively control archive access rights, reduce manual management costs, and reduce the risk of human operational errors. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flowchart of a blockchain data management method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a blockchain data management system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0023] Figure 1 Schematic diagram of the process of blockchain data management method according to an embodiment of the present invention. Figure 1 As shown, the method includes: S101. Receive the electronic archive uploaded by the user, pre-process the electronic archive, including format unification and metadata extraction; generate a public key and a private key pair using an asymmetric encryption algorithm, encrypt the electronic archive using the public key, and obtain the encrypted electronic archive; calculate the hash value of the encrypted electronic archive, and encapsulate the hash value and the encrypted electronic archive together as a blockchain transaction; broadcast the blockchain transaction to the blockchain network, and the consensus node in the blockchain network verifies and packages the blockchain transaction into a block; after the block is added to the blockchain, obtain the block height and timestamp information of the block; encrypt the private key, the block height and the timestamp information and store them in an isolated secure storage area; S102. Receive an electronic file verification request initiated by a user, the verification request including identification information of the electronic file to be verified; locate the corresponding block and transaction on the blockchain according to the identification information; extract the encrypted electronic file and hash value from the transaction; recalculate the hash value of the encrypted electronic file, and compare the recalculated hash value with the hash value extracted from the transaction; if the two hash values ​​are consistent, confirm that the encrypted electronic file has not been tampered with; obtain the corresponding private key from the secure storage area, and use the private key to decrypt the encrypted electronic file to obtain the original electronic file; S103. Based on the tamper-proof characteristics of blockchain, record the operation log of the entire life cycle of electronic archives, including operations such as uploading, accessing, modifying and verifying; store the operation log in a combined on-chain and off-chain manner, specifically including: storing the hash value of the operation log on the blockchain, and encrypting the complete operation log and storing it in a distributed storage system; when an electronic archive audit is required, obtain the hash value of the operation log on the blockchain and the encrypted operation log in the distributed storage system; verify the integrity and authenticity of the encrypted operation log; decrypt the encrypted operation log, and generate the operation track and access history report of the electronic archive based on the decrypted operation log; realize automated management of access rights to electronic archives based on smart contracts, including setting access policies, recording access requests and automatically executing access control.

[0024] The blockchain data management method first receives the electronic files uploaded by the user. The received electronic files are preprocessed, including format unification and metadata extraction. Format unification is to convert electronic files of different formats into a standard format, such as PDF. Metadata extraction is to extract key information such as title, author, creation time, etc. from the electronic files.

[0025] Next, use an asymmetric encryption algorithm such as RSA to generate a pair of public and private keys. Use the generated public key to encrypt the preprocessed electronic file to obtain the encrypted electronic file. For example, for a contract file in PDF format, use a 2048-bit RSA public key to encrypt it and obtain the encrypted binary data.

[0026] Then, the hash value of the encrypted electronic file is calculated using a hash algorithm such as SHA256. The calculated hash value and the encrypted electronic file are packaged together as a blockchain transaction. The transaction data structure contains fields such as transaction ID, encrypted electronic file, and hash value.

[0027] The packaged blockchain transaction is broadcast to the blockchain network. The consensus node in the network verifies the transaction after receiving it, and packages the transaction into the candidate block after verification. The final new block is determined through consensus algorithms such as PoW and added to the blockchain.

[0028] After the block is successfully added to the blockchain, the block height and timestamp information of the block are obtained. For example, the block height is 10086 and the timestamp is 1621234567. The previously generated private key is encrypted together with the block height and timestamp information using a symmetric encryption algorithm such as AES, and then stored in an isolated secure storage area, such as a hardware security module HSM.

[0029] When receiving an electronic file verification request initiated by a user, the request contains the unique identifier of the electronic file to be verified, such as the file ID. Based on the identification information, the corresponding block and transaction are located on the blockchain. The encrypted electronic file and hash value are extracted from the located transaction.

[0030] Recalculate the hash value of the encrypted electronic file, using the same hash algorithm as when it was stored. Compare the calculated new hash value with the original hash value extracted from the transaction. If the two hash values ​​are exactly the same, it can be confirmed that the encrypted electronic file has not been tampered with on the blockchain.

[0031] Get the corresponding private key from the secure storage area, use the private key to decrypt the encrypted electronic file, and restore the original electronic file. For example, use the stored RSA private key to decrypt the encrypted PDF file to get the original contract file.

[0032] Based on the tamper-proof characteristics of blockchain, the operation log of the entire life cycle of electronic archives is recorded. The log content includes detailed information on operations such as upload, access, modification, and verification, such as operation type, operation time, and operator. The operation log is stored in a combination of on-chain and off-chain methods: the complete operation log is encrypted and stored in a distributed storage system such as IPFS; the hash value of the operation log is calculated and stored on the blockchain.

[0033] When an electronic archive audit is required, first obtain the hash value of the operation log from the blockchain and obtain the encrypted complete operation log from the distributed storage system. Recalculate the hash value of the encrypted operation log and compare it with the hash value stored on the blockchain to verify the integrity and authenticity of the operation log. Use the preset key to decrypt the operation log, and generate a detailed operation track and access history report of the electronic archive based on the decrypted log content.

[0034] Automated management of access rights to electronic archives is achieved based on smart contracts. Access policies are set in smart contracts, such as access rights for users with different roles. When a user requests access to an electronic archive, the smart contract automatically records the access request and determines whether access is allowed based on the preset access policy. If access is allowed, the smart contract automatically executes the corresponding access control logic to authorize the user to access the electronic archive.

[0035] The beneficial effects of this method include: 1. Blockchain technology ensures the authenticity and integrity of electronic files, prevents tampering and forgery, and improves the credibility and legal effect of electronic files.

[0036] 2. The use of encrypted storage and access control protects the security and privacy of electronic files, while achieving flexible permission management.

[0037] 3. Recording the entire life cycle operation log realizes the traceability and auditability of electronic files, which is conducive to supervision and compliance management.

[0038] In an optional embodiment, the preprocessing further includes: Scan the electronic files for viruses and sensitive information; convert the electronic files into a unified file format; Extracting metadata of the electronic archive, including file name, creation time, author, and file size; A unique identifier for the electronic archive is generated; and the unique identifier is associated with the metadata and stored.

[0039] In the process of electronic file preprocessing, the electronic files are first scanned for viruses and sensitive information. Virus scanning can use the latest antivirus software to conduct a comprehensive scan of the file to detect whether there are known or unknown viruses, Trojans and other malicious programs. Sensitive information detection uses keyword matching, regular expressions and other methods to identify whether the file contains sensitive content such as personal privacy and commercial secrets. If a virus or sensitive information is found, the system will issue a warning and isolate it.

[0040] Next, the electronic files are converted into a unified file format. According to the original file type, the system will call the corresponding format conversion module, such as converting doc to pdf, xls to csv, etc. The format, style and other information of the original file will be retained during the conversion process to ensure the integrity of the content. The unified format is conducive to subsequent processing and long-term preservation.

[0041] Then, metadata information is extracted from the electronic archive. The system will parse the file attributes and extract basic information such as file name, creation time, last modification time, author, file size, etc. For structured documents, content metadata such as title, abstract, keywords, etc. can also be extracted. The extracted metadata is stored in XML format for subsequent management and retrieval.

[0042] Next, a unique identifier is generated for each electronic file. The UUID algorithm can be used to generate a 32-bit hexadecimal string, such as 550e8400-e29b-41d4-a716-446655440000. This identifier is globally unique and can be used for unique identification and association of files.

[0043] Finally, the unique identifier is associated with the metadata and stored in the database. A relational database can be used to create an archive metadata table containing fields such as the unique identifier, file name, and creation time. The unique identifier is used as the primary key to achieve a one-to-one correspondence between metadata and electronic archives.

[0044] This pretreatment method has the following beneficial effects: 1. Through virus scanning and sensitive information detection, the security and compliance of electronic files are guaranteed, avoiding the risk of information leakage.

[0045] 2. Unifying file formats and extracting metadata improves the efficiency of subsequent management and utilization and facilitates the long-term preservation of archives.

[0046] 3. Generate a unique identifier and store it in association with metadata, which enables accurate positioning and traceability of electronic archives and is beneficial to the integrity management of archives.

[0047] In an optional implementation, the encryption algorithm uses an elliptic curve encryption algorithm, which specifically includes: Choose a secure elliptic curve and base point; generate the private key as a large random number; Calculating a public key by using elliptic curve point multiplication; encrypting the electronic file using the public key; The private key is sharded, and a threshold key sharing scheme is adopted to distribute the private key shards to multiple trusted nodes for safekeeping.

[0048] In this implementation, the asymmetric encryption algorithm uses the elliptic curve encryption algorithm to protect the security of the electronic file. The specific implementation steps are as follows: First, select a secure elliptic curve and base point. The choice of elliptic curve is crucial to the security of the encryption system. Usually, a standard curve that has been widely studied and verified is selected, such as the P-256 curve recommended by NIST. This curve is defined on the prime field and has a 256-bit modulus. The base point G is selected as a generator on the elliptic curve, and the order of G is a large prime number n.

[0049] Next, generate a private key as a large random number. The private key d is a random integer less than n. To ensure the security and randomness of the private key, a cryptographically secure random number generator (CSPRNG) can be used to generate the private key. For example, you can use the / dev / urandom or CryptGenRandom function provided by the operating system to generate a 256-bit random number as the private key.

[0050] Then, the public key is calculated by elliptic curve point multiplication. The public key Q is the scalar product of the private key d and the base point G, that is, Q = d* G. This operation is performed on the elliptic curve, and the result is another point on the curve. The public key Q consists of two coordinates, x and y, and is usually expressed in the form of (x, y).

[0051] The electronic file is encrypted using the public key. The encryption process uses the Elliptic Curve Integrated Encryption Scheme (ECIES). First, a temporary private key k is generated for each encryption. Then R = k * G is calculated, which is a temporary public key. Then the recipient's public key Q is used to calculate the shared key S = k * Q. S is input into the key derivation function (KDF) to obtain the symmetric encryption key and MAC key. The plaintext is encrypted using the symmetric encryption key to obtain the ciphertext C. Finally, the MAC value T of the ciphertext is calculated. The encryption result consists of R, C and T.

[0052] For example, suppose the content of the electronic file to be encrypted is "Hello, World!". First, generate a temporary private key k = 987654321. Calculate R = k * G = (0x..., 0x...). Then calculate S = k * Q. Use KDF to derive a 128-bit AES key and a 256-bit HMAC-SHA256 key from S. Encrypt the plaintext in AES-CTR mode to obtain the ciphertext C. Calculate the HMAC-SHA256 value T of C. The final ciphertext is R||C||T.

[0053] The private key is sharded and the threshold key sharing scheme is used to distribute the private key shards to multiple trusted nodes for safekeeping. Shamir's Secret Sharing scheme is used here for private key sharding. Select a threshold t and a total number of shares n, satisfying t <= n. Construct a t-1 degree polynomial f(x), where f(0) is equal to the private key d. Randomly select n different x values, calculate the corresponding y = f(x), and obtain n key shards (x, y). Distribute these n shards to n trusted nodes for safekeeping.

[0054] For example, set the threshold t = 3 and the total number of shares n = 5. Assume that the private key d = 123456789. Randomly construct a quadratic polynomial f(x) = 123456789 + 87654321x + 56789012x^2. Select x = 1, 2, 3, 4, 5 and calculate the corresponding y value. Get 5 key shards: (1, 267900122), (2, 468232477), (3, 724453854), (4,1036564253), (5, 1404563674). Send these 5 shards to 5 trusted nodes for safekeeping.

[0055] This program has the following beneficial effects: 1. By adopting the elliptic curve encryption algorithm, the key length is greatly reduced while ensuring security, thus improving encryption efficiency. Compared with the RSA algorithm, the elliptic curve algorithm can achieve the same security strength with a shorter key, thereby reducing storage and transmission overhead.

[0056] 2. The introduction of temporary keys and key derivation functions achieves forward security. Even if the temporary key of a communication is leaked, it will not affect the security of other communications. At the same time, the derived symmetric key is different each time, which enhances the security of the system.

[0057] 3. The threshold key sharing scheme is used to manage the private key in shards, which not only protects the security of the private key, but also improves the availability of the system. The private key can be restored as long as there are t shards, avoiding single point failure. At the same time, the attacker must break into t nodes at the same time to obtain the private key, which greatly increases the difficulty of the attack.

[0058] In an optional implementation, the archive integrity verification further includes: Calculating the Merkle root of the encrypted electronic file; comparing the Merkle root with the Merkle root stored on the blockchain; If the two Merkle tree roots are consistent, each data block of the electronic archive is further verified; for each data block, its hash value is calculated and its position in the Merkle tree is verified; The integrity of the encrypted electronic file is confirmed only when all data blocks are verified.

[0059] The integrity verification process of electronic archives specifically includes the following implementation contents: The encrypted electronic file is first divided into blocks, and the entire file is divided into several data blocks according to a fixed size (for example, 4KB). The SHA-256 hash value of each data block is calculated to generate the corresponding hash string. Taking a specific example, assuming that the size of an electronic file is 12KB, it can be divided into 3 4KB data blocks, and the hash values ​​hash1, hash2, and hash3 are calculated respectively.

[0060] Then merge the hash values ​​of the two adjacent data blocks, recalculate the merged hash value, and build the Merkle tree upwards. In the above case, hash1 and hash2 are first merged to get hash12, and hash12 is merged with hash3 to get the final Merkle tree root hash123.

[0061] The calculated Merkle root is compared with the Merkle root pre-stored on the blockchain. If the two values ​​are exactly the same, the next step of verification is entered; if they are inconsistent, it indicates that the electronic file has been tampered with and the verification fails.

[0062] For electronic files that have passed the verification, the integrity of each data block needs to be further verified. The hash value of each data block is recalculated and its position in the Merkle tree is verified to be correct. Taking the above case as an example, first verify whether hash1 is in the first position at the bottom of the Merkle tree, then verify whether hash2 is in the second position, and finally verify whether hash3 is in the third position.

[0063] Only when all data blocks are verified can the integrity of the encrypted electronic file be finally confirmed. Failure of any data block verification means that the file has been tampered with. The entire verification process adopts a layered verification method, which not only verifies the overall integrity but also ensures the local integrity.

[0064] This scheme has the following beneficial effects: First, the Merkle tree structure is used for verification, which can quickly locate the tampered data blocks and improve the verification efficiency. Through the layered verification method, even if some data blocks are tampered, the specific location can be accurately identified.

[0065] Secondly, by combining the storage of the Merkle tree root on the blockchain and taking advantage of the tamper-proof nature of the blockchain, the reliability of the verification benchmark is ensured. No one can tamper with the Merkle tree root on the blockchain, thus ensuring the credibility of the verification results.

[0066] Finally, the block verification method not only verifies the overall integrity, but also ensures the local integrity, making the verification result more comprehensive and reliable. Even if only one data block is tampered with, it can be accurately detected, avoiding omissions in verification.

[0067] In an optional implementation, the off-chain storage method specifically includes: Divide the operation log into sensitive information and non-sensitive information; encrypt the sensitive information, and combine the encrypted sensitive information and non-sensitive information into a complete operation log; Calculate the hash value of the complete operation log and submit the hash value to the blockchain; store the complete operation log in the distributed storage system and record the index information of the storage location on the blockchain; Regularly perform integrity checks on the operation logs in the distributed storage system. If any abnormality is found, immediately restore the data from other nodes and update the index information on the blockchain.

[0068] This embodiment provides a storage method combining on-chain and off-chain, which specifically includes the following steps: First, the operation logs are divided into sensitive information and non-sensitive information. Sensitive information may include user privacy data, account passwords and other content that requires special protection, while non-sensitive information is ordinary operation records that can be made public. For example, for a user login log, the user name and IP address can be regarded as non-sensitive information, while the password is sensitive information.

[0069] Next, encrypt the sensitive information. Symmetric encryption algorithms such as AES or asymmetric encryption algorithms such as RSA can be used. Taking the AES-256 algorithm as an example, a 256-bit key is used to encrypt sensitive data to obtain ciphertext. The encrypted sensitive information ciphertext is combined with the non-sensitive information plaintext to form a complete operation log.

[0070] Then, calculate the hash value of the complete operation log. You can use a hash algorithm such as SHA-256, take the operation log content as input, and calculate a hash value of a fixed length. This hash value can uniquely identify the log and be used for subsequent integrity verification.

[0071] Submit the calculated hash value to the blockchain for evidence storage. You can choose a public chain that supports smart contracts, such as Ethereum, and write a smart contract to record the log hash value. Data structures such as mapping can be set in the contract to establish a mapping relationship between the log ID and the hash value.

[0072] At the same time, the complete operation log is stored in a distributed storage system, such as IPFS. IPFS generates a content-addressed hash value for the stored content. This IPFS address hash value is used as index information and also recorded on the blockchain to establish an association with the log hash value.

[0073] Regularly perform integrity checks on the operation logs in the distributed storage system. First, obtain the log hash value from the blockchain, then read the complete log content from IPFS, recalculate the hash value and compare. If inconsistencies are found, it means that the log may have been tampered with.

[0074] Once an anomaly is found, the correct log copy is immediately obtained from other IPFS nodes for recovery. At the same time, the IPFS address index information on the blockchain is updated to point to the correct copy location. This allows the damaged data to be repaired in a timely manner.

[0075] Throughout the process, sensitive data is always in encrypted form, and even if the distributed storage system is hacked, the plain text cannot be obtained. Non-sensitive data can be easily retrieved and analyzed. Only hash values ​​and index information are stored on the blockchain, which greatly reduces the amount of data on the chain. At the same time, the tamper-proof nature of the blockchain is used to ensure the credible storage of logs.

[0076] This scheme has the following beneficial effects: 1. It realizes the secure storage of sensitive data and the efficient use of non-sensitive data, achieving a good balance between security and practicality.

[0077] 2. By combining on-chain evidence storage with off-chain storage, the credibility of data is guaranteed, the storage pressure of the blockchain is reduced, and the overall efficiency of the system is improved.

[0078] 3. The use of distributed storage and periodic verification mechanisms enhances data availability and integrity, and improves the system's fault tolerance and reliability.

[0079] In an optional implementation, the automated management implemented by the smart contract also includes: Define the access control policy of electronic archives in the smart contract, including role definition, permission level and access conditions; register user identity information and role information on the blockchain; When receiving an access request, the smart contract automatically verifies the identity and role of the requesting user; based on the preset access control policy, the smart contract determines whether to authorize access; If access is authorized, the smart contract generates a time-limited access token; the access request, judgment result, and token information are recorded on the blockchain to ensure traceability.

[0080] The automated management of electronic archives based on smart contracts first requires the deployment of smart contracts in the blockchain system. Smart contracts contain access control policies such as role definition, permission levels, and access conditions. Roles can be divided into system administrators, archive administrators, ordinary users, etc., and each role has different permission levels. Permission levels include read, modify, delete and other operation permissions. Access conditions include time limits, IP address limits, etc.

[0081] The system registers user information on the blockchain through the identity authentication module, including basic information such as username, password hash value, public key, etc. For example, when user Zhang San registers, the system writes his username "zhangsan", password hash value "7e240de74fb1ed08fa08d38063f6a6a91462a815", role "ordinary user" and other information into the blockchain. At the same time, the user is assigned corresponding roles and permissions.

[0082] When a user initiates an access request, the request contains information such as the user's identity, the resource ID requested for access, and the type of operation. The smart contract first verifies the authenticity of the user's identity by comparing the identity information provided by the user with the information stored on the blockchain. For example, if user Zhang San requests to access file A001, the system verifies whether the identity information he provides matches the registration information on the chain.

[0083] After verification, the smart contract determines whether to authorize access based on the preset access control policy. The judgment process includes: checking whether the user role has the authority to access the resource, checking whether the current time is within the time range allowed for access, checking whether the user's IP address is within the allowed range, etc. For example, if ordinary user Zhang San requests to modify file A001, the system checks and finds that ordinary users only have read permissions, so access is denied.

[0084] For requests to allow access, the smart contract generates an access token containing information such as user identity, resource ID, and validity period. The token is signed using an asymmetric encryption algorithm to ensure that it cannot be tampered with. For example, a token "TOKEN-2023120110-A001-READ" is generated for Zhang San, which is valid for 1 hour.

[0085] The system records the access request information (request time, user identity, requested resources, etc.), judgment results (allow / reject), token information, etc. on the blockchain. For example, the record "2023-12-01 10:00:00 user zhangsan requested access to A001, authorized access, token TOKEN-2023120110-A001-READ".

[0086] Beneficial effects include: 1) automatically executing access control policies through smart contracts, reducing manual intervention and improving management efficiency; 2) using the tamper-proof nature of blockchain to record access history and ensure that access behavior is traceable; 3) protecting access tokens based on cryptography to ensure the security of access authorization.

[0087] In an optional implementation, the multi-level encryption scheme specifically includes: Dividing the electronic file into a plurality of data blocks; encrypting each data block using a different symmetric encryption key; Encrypt all symmetric encryption keys using the public key of the asymmetric encryption algorithm; construct a Merkle tree containing all encrypted data blocks and encryption keys; submit the Merkle tree root hash value and the encrypted symmetric key to the blockchain; The asymmetric encrypted private key is split using a threshold cryptographic scheme and distributed to multiple authorized nodes.

[0088] In the electronic archive management system, the electronic archive to be processed is first divided into preset sizes, for example, a 100MB PDF document is divided into 100 data blocks of 1MB each. For each data block, the system dynamically generates a different symmetric encryption key and encrypts it using the AES-256 algorithm. Specifically, the first data block is encrypted using key Key1, the second data block is encrypted using key Key2, and so on.

[0089] Next, the system uses the RSA-2048 asymmetric encryption algorithm to generate a public-private key pair. All the symmetric encryption keys (Key1, Key2, etc.) generated above are encrypted using the RSA public key to obtain a set of encrypted ciphertext keys. For each encrypted data block and the corresponding encryption key, calculate its SHA-256 hash value and build a Merkle hash tree. For example, for data block 1, calculate Hash1=SHA256(encrypted data block 1||encrypted Key1); for data block 2, calculate Hash2=SHA256(encrypted data block 2||encrypted Key2). Then pair adjacent hash values ​​in pairs to calculate the upper-level hash, and finally obtain the Merkle tree root hash value RootHash.

[0090] The system submits the Merkle tree root hash value RootHash and the encrypted symmetric key set as transaction data to the blockchain network. The blockchain network uses a consensus mechanism to verify and confirm the transaction and then stores the data permanently. This ensures the confidentiality of the data and verifies the integrity of the data.

[0091] In order to achieve secure key management, the system uses the (t,n) threshold scheme to split the RSA private key. Specifically, the private key is divided into n parts and distributed to n different authorized nodes for safekeeping, of which any t authorized nodes can collaborate to reconstruct the complete private key. For example, using the (3,5) scheme, the private key is divided into 5 parts and distributed to 5 authorized nodes respectively, of which any 3 nodes can reconstruct the private key. In this way, even if individual nodes fail or are attacked, it will not affect the normal operation of the system.

[0092] When access to an encrypted electronic file is required, the user first initiates an application to the authorization node. After identity authentication and permission verification, at least t authorization nodes collaborate to reconstruct the RSA private key for decrypting the symmetric key. The decrypted symmetric key is then used to decrypt the corresponding data block, and the original electronic file is finally obtained.

[0093] This program has the following beneficial effects: 1. Multi-level encryption and block encryption enable more fine-grained access control and improve data security. Even if part of the data is leaked, it will not affect the security of other data blocks.

[0094] 2. Blockchain and Merkle tree are used to achieve data integrity verification and tamper-proofing, ensuring the trusted storage and verification of electronic archives.

[0095] 3. The use of threshold cryptography avoids the risk of single point failure, improves the availability and fault tolerance of the system, and also prevents the risk of private keys being stolen by a single node.

[0096] In an optional implementation, the automated management implemented by the smart contract also includes a dynamic access control mechanism: Implement an attribute-based encrypted access control scheme; encode user attributes and archive access policies into smart contracts; when a user requests to access an archive, the smart contract automatically evaluates whether the user attributes satisfy the access policy; If satisfied, a one-time decryption key is generated and transmitted to the user through a secure channel; access events are recorded, including a summary of user identity, access time, and access content; Implement adaptive access control strategies to dynamically adjust access rules based on access patterns and security threats; use machine learning algorithms to analyze access patterns, detect abnormal access behaviors, and trigger corresponding security response mechanisms.

[0097] The automated management system based on smart contracts first establishes a mapping relationship between user attributes and access policies. User attributes include identity, job level, department affiliation, security level and other information, which are stored in the form of attribute key-value pairs. Access policies are defined through a set of rules, including required attribute conditions, attribute combination logic, etc.

[0098] The system encodes user attribute information into an attribute vector, with each attribute corresponding to a binary bit. The access policy is encoded into a policy tree structure, with the leaf nodes of the tree being attribute conditions and the internal nodes being logical operators. The smart contract stores the encoded attribute vector and policy tree.

[0099] When a user initiates an access request, the smart contract first verifies the legitimacy of the user's identity. After verification, the user's attribute vector is extracted and matched with the archive's access policy tree. The system traverses the policy tree, evaluates the satisfaction of attribute conditions layer by layer, and performs logical combinations to finally obtain the access permission determination result.

[0100] For requests that meet the access policy, the system generates a one-time decryption key based on the timestamp and random number. The key is encrypted using an asymmetric encryption algorithm and transmitted to the user through a secure channel. The system also records access events on the blockchain, including user ID, timestamp, file ID, access type and other information.

[0101] The system continuously collects user access behavior data, including access time distribution, access file type, access frequency and other characteristics. Cluster analysis is used to identify normal access patterns, and anomaly detection algorithms are used to detect behaviors that deviate from normal patterns. When abnormal access is detected, security responses such as access restrictions and secondary authentication are triggered.

[0102] Based on the results of access behavior analysis, the system dynamically adjusts access control policies. It increases access restrictions for high-risk users and appropriately relaxes access rights for trusted users. Policy adjustments are executed through smart contracts to ensure the transparency and immutability of the adjustment process.

[0103] Specific implementation case: User A has an attribute vector [1,1,0,1], indicating that he has the identity of administrator, technical department, and ordinary security level. The access policy of file X is "(administrator AND technical department) OR advanced security level", encoded as a policy tree. The system determines that user A meets the access conditions, generates a decryption key "7d8f9e2a" and encrypts it for transmission. The access log contains information such as user A's ID, timestamp "2023-12-01 10:30:25", and file X's ID.

[0104] The beneficial effects include: 1) realizing refined attribute access control to ensure data access security; 2) automated policy execution and key distribution improve system efficiency; 3) dynamic adaptive access control improves system security and flexibility.

[0105] Figure 2 Schematic diagram of the structure of the blockchain data management system according to an embodiment of the present invention. Figure 2 As shown, the system comprises: The first unit is used to receive an electronic file uploaded by a user, pre-process the electronic file, including format unification and metadata extraction; generate a public key and a private key pair using an asymmetric encryption algorithm, encrypt the electronic file using the public key, and obtain an encrypted electronic file; calculate a hash value of the encrypted electronic file, and encapsulate the hash value and the encrypted electronic file together as a blockchain transaction; broadcast the blockchain transaction to the blockchain network, and the consensus node in the blockchain network verifies and packages the blockchain transaction into a block; after the block is added to the blockchain, obtain the block height and timestamp information of the block; encrypt the private key, the block height and the timestamp information and store them in an isolated secure storage area; The second unit is used to receive an electronic file verification request initiated by a user, wherein the verification request includes identification information of the electronic file to be verified; locate the corresponding block and transaction on the blockchain according to the identification information; extract the encrypted electronic file and the hash value from the transaction; recalculate the hash value of the encrypted electronic file, and compare the recalculated hash value with the hash value extracted from the transaction; if the two hash values ​​are consistent, it is confirmed that the encrypted electronic file has not been tampered with; obtain the corresponding private key from the secure storage area, and use the private key to decrypt the encrypted electronic file to obtain the original electronic file; The third unit is used to record the operation log of the entire life cycle of electronic archives based on the tamper-proof characteristics of blockchain, including operations such as uploading, accessing, modifying and verifying; storing the operation log in a combined on-chain and off-chain manner, specifically including: storing the hash value of the operation log on the blockchain, and encrypting the complete operation log and storing it in a distributed storage system; when an electronic archive audit is required, obtaining the hash value of the operation log on the blockchain and the encrypted operation log in the distributed storage system; verifying the integrity and authenticity of the encrypted operation log; decrypting the encrypted operation log, and generating the operation track and access history report of the electronic archive based on the decrypted operation log; and realizing automated management of access rights to electronic archives based on smart contracts, including setting access policies, recording access requests and automatically executing access control.

[0106] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0107] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0108] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A blockchain data management method, characterized in that: include: Receive the electronic archive uploaded by the user, and pre-process the electronic archive, including format unification and metadata extraction; generate a public key and a private key pair using an asymmetric encryption algorithm, and encrypt the electronic archive using the public key to obtain an encrypted electronic archive; Calculating a hash value of the encrypted electronic file, encapsulating the hash value together with the encrypted electronic file into a blockchain transaction; broadcasting the blockchain transaction to the blockchain network, having the consensus node in the blockchain network verify and package the blockchain transaction into a block; after the block is added to the blockchain, obtaining the block height and timestamp information of the block; encrypting the private key, the block height and the timestamp information and storing them in an isolated secure storage area; Receiving an electronic file verification request initiated by a user, wherein the verification request includes identification information of the electronic file to be verified; Locating the corresponding block and transaction on the blockchain according to the identification information; extracting the encrypted electronic file and hash value from the transaction; recalculating a hash value of the encrypted electronic file, and comparing the recalculated hash value with the hash value extracted from the transaction; If the two hash values ​​are consistent, it is confirmed that the encrypted electronic file has not been tampered with; Obtaining a corresponding private key from the secure storage area, and using the private key to decrypt the encrypted electronic file to obtain the original electronic file; Based on the tamper-proof characteristics of blockchain, the operation log of the entire life cycle of electronic archives is recorded, including upload, access, modification and verification operations; Storing the operation log in a combined on-chain and off-chain manner, specifically including: storing the hash value of the operation log on the blockchain, and encrypting the complete operation log and storing it in a distributed storage system; When an electronic archive audit is required, obtain the operation log hash value on the blockchain and the encrypted operation log in the distributed storage system; verify the integrity and authenticity of the encrypted operation log; decrypt the encrypted operation log, and generate the operation track and access history report of the electronic archive based on the decrypted operation log; realize automated management of access rights to electronic archives based on smart contracts, including setting access policies, recording access requests, and automatically executing access control.

2. The method according to claim 1, characterized in that Preprocessing also includes: Scan the electronic files for viruses and sensitive information; convert the electronic files into a unified file format; Extracting metadata of the electronic archive, including file name, creation time, author, and file size; A unique identifier for the electronic archive is generated; and the unique identifier is associated with the metadata and stored.

3. The method according to claim 1, characterized in that The asymmetric encryption algorithm uses the elliptic curve encryption algorithm, which includes: Choose a secure elliptic curve and base point; generate the private key as a large random number; Calculating a public key by using elliptic curve point multiplication; encrypting the electronic file using the public key; The private key is sharded, and a threshold key sharing scheme is adopted to distribute the private key shards to multiple trusted nodes for safekeeping.

4. The method according to claim 1, characterized in that: Electronic file integrity verification also includes: Calculating the Merkle root of the encrypted electronic file; comparing the Merkle root with the Merkle root stored on the blockchain; If the two Merkle tree roots are consistent, each data block of the electronic archive is further verified; for each data block, its hash value is calculated and its position in the Merkle tree is verified; The integrity of the encrypted electronic file is confirmed only when all data blocks are verified.

5. The method according to claim 1, characterized in that The storage methods that combine on-chain and off-chain include: Divide the operation log into sensitive information and non-sensitive information; encrypt the sensitive information, and combine the encrypted sensitive information and non-sensitive information into a complete operation log; Calculate the hash value of the complete operation log and submit the hash value to the blockchain; store the complete operation log in the distributed storage system and record the index information of the storage location on the blockchain; Regularly perform integrity checks on the operation logs in the distributed storage system. If any abnormality is found, immediately restore the data from other nodes and update the index information on the blockchain.

6. The method according to claim 1, characterized in that Automated management based on smart contracts also includes: Define the access control policy of electronic archives in the smart contract, including role definition, permission level and access conditions; register user identity information and role information on the blockchain; When receiving an access request, the smart contract automatically verifies the identity and role of the requesting user; based on the preset access control policy, the smart contract determines whether to authorize access; If access is authorized, the smart contract generates a time-limited access token; the access request, judgment result, and token information are recorded on the blockchain to ensure traceability.

7. The method according to claim 1, characterized in that A multi-layer encryption scheme is used, including: Dividing the electronic file into a plurality of data blocks; encrypting each data block using a different symmetric encryption key; Encrypt all symmetric encryption keys using the public key of the asymmetric encryption algorithm; construct a Merkle tree containing all encrypted data blocks and encryption keys; submit the Merkle tree root hash value and the encrypted symmetric key to the blockchain; The asymmetric encrypted private key is split using a threshold cryptographic scheme and distributed to multiple authorized nodes.

8. The method according to claim 1, characterized in that Automated management based on smart contracts also includes dynamic access control mechanisms: Implement attribute-based cryptographic access control schemes; encode user attributes and profile access policies into smart contracts; When a user requests access to a profile, the smart contract automatically evaluates whether the user’s attributes satisfy the access policy; If satisfied, a one-time decryption key is generated and transmitted to the user through a secure channel; access events are recorded, including a summary of user identity, access time, and access content; Implement adaptive access control strategies to dynamically adjust access rules based on access patterns and security threats; use machine learning algorithms to analyze access patterns, detect abnormal access behaviors, and trigger corresponding security response mechanisms.

9. A blockchain data management system for implementing the method according to any one of claims 1 to 8, characterized in that: include: The first unit is used to receive the electronic archive uploaded by the user, pre-process the electronic archive, including format unification and metadata extraction; generate a public key and a private key pair using an asymmetric encryption algorithm, and encrypt the electronic archive using the public key to obtain the encrypted electronic archive; Calculating a hash value of the encrypted electronic file, encapsulating the hash value together with the encrypted electronic file into a blockchain transaction; broadcasting the blockchain transaction to the blockchain network, having the consensus node in the blockchain network verify and package the blockchain transaction into a block; after the block is added to the blockchain, obtaining the block height and timestamp information of the block; encrypting the private key, the block height and the timestamp information and storing them in an isolated secure storage area; The second unit is used to receive an electronic file verification request initiated by a user, wherein the verification request includes identification information of the electronic file to be verified; Locating the corresponding block and transaction on the blockchain according to the identification information; extracting the encrypted electronic file and hash value from the transaction; recalculating a hash value of the encrypted electronic file, and comparing the recalculated hash value with the hash value extracted from the transaction; If the two hash values ​​are consistent, it is confirmed that the encrypted electronic file has not been tampered with; Obtaining a corresponding private key from the secure storage area, and using the private key to decrypt the encrypted electronic file to obtain the original electronic file; The third unit is used to record the operation log of the entire life cycle of electronic archives based on the tamper-proof characteristics of blockchain, including upload, access, modification and verification operations; Storing the operation log in a combined on-chain and off-chain manner, specifically including: storing the hash value of the operation log on the blockchain, and encrypting the complete operation log and storing it in a distributed storage system; When an electronic archive audit is required, obtain the operation log hash value on the blockchain and the encrypted operation log in the distributed storage system; verify the integrity and authenticity of the encrypted operation log; decrypt the encrypted operation log, and generate the operation track and access history report of the electronic archive based on the decrypted operation log; realize automated management of access rights to electronic archives based on smart contracts, including setting access policies, recording access requests, and automatically executing access control.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images