A method and system for encrypted storage and access of IPFS file system

Abstract

This invention discloses a method for encrypted storage and access in the IPFS file system. The upload client obtains the file to be uploaded and its encryption level based on user actions, and retrieves a first public key from the key management server. The upload client generates a random string and uses it to encrypt the file to be uploaded, resulting in an encrypted file. The random string is then encrypted according to the encryption level and the first public key, yielding the key ciphertext. The upload client sends the encrypted file to the IPFS server, obtaining a content identifier generated by the IPFS server based on the encrypted file. The server then sends metadata to the application server for storage. The metadata includes the content identifier, the key ciphertext, and the encryption level. This invention stores encrypted files in the IPFS file system and encrypts the random string according to the encryption level, thus solving the security problems of the IPFS file system and better meeting users' security needs.

Description

Technical Field

[0001] This invention relates to the field of data storage technology, and in particular to a method and system for encrypted storage and access of the IPFS file system. Background Technology

[0002] IPFS (InterPlanetary File System) is a peer-to-peer distributed file system used for storing and accessing files, websites, applications, and data. However, IPFS does not prioritize the anonymity of data content. In other words, IPFS does not provide efficient security guarantees for file storage. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method and system for encrypted storage and access of IPFS file system, which can effectively improve the security of IPFS file system.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0005] A method for encrypted storage and access of an IPFS file system, comprising the following steps:

[0006] S1. The upload client obtains the file to be uploaded and the encryption level based on the user's operation, and obtains the first public key from the key management server;

[0007] S2. The upload client generates a random string and uses the random string to encrypt the file to be uploaded to obtain an encrypted file. According to the encryption level and the first public key, the random string is encrypted with the corresponding encryption level to obtain the key ciphertext.

[0008] S3. The uploading client sends the encrypted file to the IPFS server, obtains the content identifier generated by the IPFS server based on the encrypted file, and sends the metadata to the application server for storage. The metadata includes the content identifier, the key ciphertext, and the encryption level.

[0009] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows:

[0010] A system for encrypted storage and access of an IPFS file system includes an upload client. The upload client includes a first processor, a first memory, and a first computer program stored in the first memory and executable on the first processor. When the first processor executes the first computer program, it performs the following steps:

[0011] S1. Obtain the file to be uploaded and its encryption level based on the user's operation, and obtain the first public key from the key management server;

[0012] S2. Generate a random string and use the random string to encrypt the file to be uploaded to obtain an encrypted file. According to the encryption level and the first public key, perform encryption steps corresponding to the encryption level on the random string to obtain the key ciphertext.

[0013] S3. Send the encrypted file to the IPFS server to obtain the content identifier generated by the IPFS server based on the encrypted file, and send the metadata to the application server for storage. The metadata includes the content identifier, the key ciphertext, and the encryption level.

[0014] The beneficial effects of this invention are as follows: This invention stores encrypted files in the IPFS file system, and the encryption key of the encrypted files is in the form of a random string. After the random string is encrypted according to the corresponding level of encryption, it is stored together with the content identifier and the encryption level on a third-party server. The files and keys are stored separately, and the original files cannot be obtained from the IPFS file system, thus solving the security problem of the IPFS file system. At the same time, different encryption processes are used according to different encryption levels, which better meets the security needs of users. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating a method for encrypted storage and access of an IPFS file system according to an embodiment of the present invention;

[0016] Figure 2 This is a structural diagram of a system for encrypted storage and access of the IPFS file system according to an embodiment of the present invention;

[0017] Figure 3 This is a schematic diagram of the encryption process of an IPFS file system encrypted storage and access method according to an embodiment of the present invention;

[0018] Figure 4 This is a schematic diagram of the decryption process of a method for encrypted storage and access of an IPFS file system according to an embodiment of the present invention;

[0019] Figure 5 This is a schematic diagram of the first-level encryption process of a method for encrypted storage and access of an IPFS file system according to an embodiment of the present invention;

[0020] Figure 6 This is a schematic diagram of the first-level decryption process of a method for encrypted storage and access of an IPFS file system according to an embodiment of the present invention. Detailed Implementation

[0021] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0022] Definitions of abbreviations and key terms:

[0023] IPFS (InterPlanetary File System): An inter-point distributed file system.

[0024] KMS (Key Management Server): Key management service, identity authentication center.

[0025] MDMS (Metadata Management Server): Metadata management service, i.e., the application server in this application, records file CID, name, fingerprint, file key, etc.

[0026] AES (Advanced Encryption Standard): Advanced Encryption Standard.

[0027] CID: Content Identifier. In IPFS, every file is identified by a unique CID.

[0028] File key (AES key): The file is encrypted using AES, and the file key is the random string provided for AES encryption.

[0029] RSA: RSA public-key encryption algorithm.

[0030] Please refer to Figure 1 as well as Figures 3 to 6 A method for encrypted storage and access of the IPFS file system, comprising the following steps:

[0031] S1. The upload client obtains the file to be uploaded and the encryption level based on the user's operation, and obtains the first public key from the key management server;

[0032] S2. The upload client generates a random string and uses the random string to encrypt the file to be uploaded to obtain an encrypted file. According to the encryption level and the first public key, the random string is encrypted with the corresponding encryption level to obtain the key ciphertext.

[0033] S3. The uploading client sends the encrypted file to the IPFS server, obtains the content identifier generated by the IPFS server based on the encrypted file, and sends the metadata to the application server for storage. The metadata includes the content identifier, the key ciphertext, and the encryption level.

[0034] As can be seen from the above description, the beneficial effects of the present invention are as follows: The present invention stores encrypted files in the IPFS file system, and the encryption key of the encrypted files is in the form of a random string. After the random string is encrypted according to the corresponding level of encryption, it is stored together with the content identifier and the encryption level on a third-party server. The files and keys are stored separately, and the original files cannot be obtained from the IPFS file system, thus solving the security problem of the IPFS file system. At the same time, different encryption processes are adopted according to different encryption levels, which better meets the security needs of users.

[0035] Furthermore, it also includes the following steps:

[0036] S4. The client obtains the encrypted file from the IPFS server and sends a decryption request to the key management server through the application server. The decryption request includes the encryption level corresponding to the encrypted file and the key ciphertext.

[0037] S5. The key management server performs the corresponding decryption process according to the encryption level, and obtains the random string after successful decryption, and sends the random string to the access client.

[0038] S6. The access client decrypts the encrypted file according to the random string to obtain the target file.

[0039] As described above, after the client obtains the file from the IPFS server, it still needs to obtain a random string used to encrypt the file from the application server and the key management server to decrypt the encrypted file in order to obtain the target file, thus ensuring the security of the file.

[0040] Furthermore, the metadata also includes file fingerprints;

[0041] Step S1 specifically involves:

[0042] The upload client obtains the file to be uploaded and the encryption level based on the user's operation, calculates the file fingerprint of the file to be uploaded, and sends the file fingerprint to the application server for comparison. If the same file fingerprint exists, the file already exists and no further operation is performed; otherwise, the application server obtains the first public key from the key management server and returns it to the upload client.

[0043] As described above, before encrypting and storing a file, the file fingerprint is calculated and stored on the application server as part of the metadata. By comparing the file fingerprint with the file fingerprints of files already stored in IPFS, file deduplication storage based on the file fingerprint is achieved.

[0044] Furthermore, the encryption levels include no encryption, level 1 encryption, and level 2 encryption, and the metadata also includes uploaded client information;

[0045] The step preceding step S1 includes the following steps:

[0046] S01. Upload the client to initialize and generate the second public key and the second private key;

[0047] Step S2 includes the following steps:

[0048] S21. The upload client generates the random string and uses the random string to encrypt the file to be uploaded to obtain the encrypted file;

[0049] S22. Determine the encryption level. If the encryption level is no encryption, then directly use the random string as the key ciphertext.

[0050] If the encryption level is Level 1 encryption, then the first public key is used to encrypt the random string to obtain the key ciphertext;

[0051] If the encryption level is level 2 encryption, then the first public key is used to encrypt the random string to obtain intermediate ciphertext, and the second public key is used to encrypt the intermediate ciphertext to obtain the key ciphertext;

[0052] Step S4 includes the following steps:

[0053] S41. The access client obtains the encrypted file from the IPFS server based on the content identifier provided by the user, and sends a first decryption request to the application server, wherein the first decryption request contains the content identifier.

[0054] S42. The application server searches for the file's metadata based on the content identifier to obtain the encryption level and the key ciphertext corresponding to the content identifier;

[0055] S43. The application server determines whether the encryption level is level 2 encryption. If the encryption level is not level 2 encryption, it sends a second decryption request to the key management server. The second decryption request includes the key ciphertext. Otherwise, it proceeds to step S44.

[0056] S44. The application server sends a third decryption request, including the encryption key, to the upload client based on the upload client information. The upload client receives the third decryption request and determines whether to agree to decryption based on user operation or a user-preset whitelist. If decryption is agreed, the key ciphertext is decrypted using the second private key to obtain the intermediate ciphertext, and the intermediate ciphertext is returned to the application server. The application server then sends a second decryption request, including the intermediate ciphertext, to the key management server. Otherwise, a decryption rejection message is returned.

[0057] Step S5 specifically involves:

[0058] The key management server performs a corresponding decryption process on the key ciphertext or intermediate ciphertext according to the encryption level, and obtains the random string after successful decryption, and sends the random string to the access client.

[0059] As described above, the encryption levels are divided into no encryption, Level 1 encryption, and Level 2 encryption. This tiered encryption effectively meets users' encryption needs for different files. Furthermore, for Level 2 encrypted files, decryption can only be completed with confirmation from the uploading client, thus providing higher security.

[0060] Furthermore, step S5 specifically includes the following steps:

[0061] S51. The key management server determines the encryption level. If the encryption level is no encryption, the key ciphertext is the random string required for decryption, and the random string is returned to the application server. Otherwise, the key ciphertext or the intermediate ciphertext is decrypted using the first private key to obtain the random string and is returned to the application server.

[0062] S52, The application server returns the random string to the accessing client.

[0063] As described above, even if the encryption level is no encryption, it still requires the application server and key management server. For encryption levels of Level 1 and Level 2, the key management server is required to obtain the random string used to decrypt the encrypted file, thus ensuring the security of the file.

[0064] Furthermore, the first decryption request also includes a third public key generated by the access client;

[0065] Step S52 specifically involves:

[0066] The application server uses the third public key to encrypt the random string and returns the encrypted random string to the accessing client;

[0067] Step S6 specifically involves:

[0068] The access client decrypts the random string encrypted with the third public key using the third private key to obtain the original random string, and then uses the random string to decrypt the encrypted file to obtain the target file.

[0069] As described above, after obtaining the random string used for decryption, it needs to be encrypted using a third public key before being transmitted to the accessing client. The accessing client then needs to decrypt it using a third private key to obtain the random string used for decryption. This solves the security problem that may exist if data is stolen during the transmission of data to the accessing client.

[0070] Further, step S01 specifically includes:

[0071] The client is uploaded for initialization, and the second public key and the second private key are generated using the RSA algorithm.

[0072] As described above, the second public and private keys are generated using the RSA algorithm. The RSA algorithm is recognized as one of the best public key schemes and has extremely high security.

[0073] Furthermore, the specific steps of encrypting the file to be uploaded using the random string to obtain the encrypted file are as follows:

[0074] The file to be uploaded is encrypted using the AES encryption algorithm with the random string to obtain the encrypted file.

[0075] As described above, the uploaded file is encrypted using the AES symmetric encryption algorithm with a random string. Each encryption uses a random string, making the encryption unpredictable and more difficult to crack.

[0076] Please refer to Figure 2 A system for encrypted storage and access of the IPFS file system includes an upload client. The upload client includes a first processor, a first memory, and a first computer program stored in the first memory and executable on the first processor. When the first processor executes the first computer program, it performs the following steps:

[0077] S1. Obtain the file to be uploaded and its encryption level based on the user's operation, and obtain the first public key from the key management server;

[0078] S2. Generate a random string and use the random string to encrypt the file to be uploaded to obtain an encrypted file. According to the encryption level and the first public key, perform encryption steps corresponding to the encryption level on the random string to obtain the key ciphertext.

[0079] S3. Send the encrypted file to the IPFS server to obtain the content identifier generated by the IPFS server based on the encrypted file, and send the metadata to the application server for storage. The metadata includes the content identifier, the key ciphertext, and the encryption level.

[0080] As can be seen from the above description, the beneficial effects of the present invention are as follows: The present invention stores encrypted files in the IPFS file system, and the encryption key of the encrypted files is in the form of a random string. After the random string is encrypted according to the corresponding level of encryption, it is stored together with the content identifier and the encryption level on a third-party server. The files and keys are stored separately, and the original files cannot be obtained from the IPFS file system, thus solving the security problem of the IPFS file system. At the same time, different encryption processes are adopted according to different encryption levels, which better meets the security needs of users.

[0081] Please refer to Figure 1 , Figure 3 and Figure 4 Embodiment 1 of the present invention is as follows:

[0082] A method for encrypted storage and access of an IPFS file system, comprising the following steps:

[0083] S01. Upload the client to initialize and generate the second public key and the second private key;

[0084] The specific steps of S01 are as follows:

[0085] The client is uploaded for initialization, and the second public key and the second private key are generated using the RSA algorithm.

[0086] In this embodiment, the client is first uploaded for initialization, generating its own public and private keys, namely the second public key and the second private key, which is implemented using the RSA algorithm.

[0087] S1. The upload client obtains the file to be uploaded and the encryption level based on the user's operation, and obtains the first public key from the key management server;

[0088] Step S1 specifically involves:

[0089] The upload client obtains the file to be uploaded and the encryption level based on the user's operation, calculates the file fingerprint of the file to be uploaded, and sends the file fingerprint to the application server for comparison. If the same file fingerprint exists, the file already exists and no further operation is performed; otherwise, the application server obtains the first public key from the key management server and returns it to the upload client.

[0090] like Figure 3 As shown in this embodiment, when a user uploads a file, they need to select an encryption level and calculate the file fingerprint, which is then sent to MDMS, the application server. MDMS checks if the file fingerprint exists to determine if the file exists. If a matching file fingerprint exists, the file already exists, and no further operation is performed. If no matching file fingerprint exists, MDMS requests the KMS public key (the first public key) from the KMS (Key Management Server) and sends it to the uploading client.

[0091] S2. The upload client generates a random string and uses the random string to encrypt the file to be uploaded to obtain an encrypted file. According to the encryption level and the first public key, the random string is encrypted with the corresponding encryption level to obtain the key ciphertext.

[0092] Step S2 includes the following steps:

[0093] S21. The upload client generates the random string and uses the random string to encrypt the file to be uploaded to obtain the encrypted file;

[0094] The specific steps of encrypting the file to be uploaded using the random string to obtain the encrypted file are as follows:

[0095] The file to be uploaded is encrypted using the AES encryption algorithm with the random string to obtain the encrypted file.

[0096] In this embodiment, the client generates a random string AESKey and uses this string to encrypt the file. In this embodiment, the AES encryption algorithm is used to generate the encrypted file.

[0097] S22. Determine the encryption level. If the encryption level is no encryption, then directly use the random string as the key ciphertext.

[0098] If the encryption level is Level 1 encryption, then the first public key is used to encrypt the random string to obtain the key ciphertext;

[0099] If the encryption level is level 2 encryption, then the first public key is used to encrypt the random string to obtain intermediate ciphertext, and the second public key is used to encrypt the intermediate ciphertext to obtain the key ciphertext.

[0100] like Figure 3 As shown in this embodiment, after encrypting the file using the AES Key, the AES Key is encrypted according to the encryption level, which can be either no encryption, first-level encryption, or second-level encryption. The random string AES Key is encrypted once using the KMS public key (i.e., the first public key). If the encryption level is second-level encryption, the AES Key needs to be encrypted a second time using the second public key to obtain the encrypted AES Key, i.e., the key ciphertext.

[0101] S3. The uploading client sends the encrypted file to the IPFS server, obtains the content identifier generated by the IPFS server based on the encrypted file, and sends the metadata to the application server for storage. The metadata includes the content identifier, the file fingerprint, the key ciphertext, the uploading client information, and the encryption level.

[0102] like Figure 3 As shown in this embodiment, the uploading client sends the file to the IPFS data server, obtains the Content Identifier (CID) generated by IPFS based on the encrypted file, and then sends the metadata to MDMS for storage. The metadata includes the CID, file fingerprint, key ciphertext (i.e., the encrypted AESKey), uploading client information, and encryption level.

[0103] It also includes the following steps:

[0104] S4. The client obtains the encrypted file from the IPFS server and sends a decryption request to the key management server through the application server. The decryption request includes the encryption level corresponding to the encrypted file and the key ciphertext.

[0105] Step S4 includes the following steps:

[0106] S41. The access client obtains the encrypted file from the IPFS server based on the content identifier provided by the user, and sends a first decryption request to the application server, wherein the first decryption request contains the content identifier.

[0107] In this embodiment, the access client sends a file download request to the IPFS server via its CID and receives an encrypted file returned by IPFS. The access client then uses its CID to retrieve the file's metadata from MDMS and requests decryption. This request contains a third-party public key generated by the access client.

[0108] S42. The application server searches for the file's metadata based on the content identifier to obtain the encryption level and the key ciphertext corresponding to the content identifier.

[0109] In this embodiment, MDMS obtains the corresponding metadata based on the CID, including the encryption level 1 key ciphertext.

[0110] S43. The application server determines whether the encryption level is level 2 encryption. If the encryption level is not level 2 encryption, it sends a second decryption request to the key management server. The second decryption request includes the key ciphertext. Otherwise, it proceeds to step S44.

[0111] S44. The application server sends a third decryption request, including the encryption key, to the upload client based on the upload client information. The upload client receives the third decryption request and determines whether to agree to decryption based on user operation or a user-preset whitelist. If decryption is agreed, the client decrypts the key ciphertext using the second private key to obtain the intermediate ciphertext and returns the intermediate ciphertext to the application server. The application server then sends a second decryption request, including the intermediate ciphertext, to the key management server. Otherwise, a decryption rejection message is returned.

[0112] In this embodiment, MDMS will first ask the file owner, i.e. the uploading client, for permission to decrypt the ciphertext using the second private key, and then request decryption from KMS, depending on the encryption level. If the encryption level is no encryption or Level 1 encryption, MDMS will directly request decryption from KMS.

[0113] S5. The key management server performs the corresponding decryption process according to the encryption level, and obtains the random string after successful decryption, and sends the random string to the access client.

[0114] Step S5 specifically includes the following steps:

[0115] S51. The key management server determines the encryption level. If the encryption level is no encryption, the key ciphertext is the random string required for decryption, and the random string is returned to the application server. Otherwise, the key ciphertext or the intermediate ciphertext is decrypted using the first private key to obtain the random string and is returned to the application server.

[0116] S52, The application server returns the random string to the accessing client;

[0117] Step S52 specifically involves:

[0118] The application server uses the third public key to encrypt the random string and returns the encrypted random string to the accessing client.

[0119] In this embodiment, KMS determines the encryption level. If the encryption level is no encryption, KMS directly returns the AESKey; otherwise, KMS uses its private key (i.e., the first private key) to decrypt the AESKey and returns it. After receiving the AESKey returned by KMS, MDMS uses the third public key of the accessing client to encrypt the AESKey and then sends it to the accessing client.

[0120] S6. The access client decrypts the encrypted file according to the random string to obtain the target file.

[0121] Step S6 specifically involves:

[0122] The access client decrypts the random string encrypted with the third public key using the third private key to obtain the original random string, and then uses the random string to decrypt the encrypted file to obtain the target file.

[0123] In this embodiment, after receiving the data returned by MDMS, the accessing client decrypts the data using its private key to obtain the AESKey, and then decrypts the encrypted file to obtain the target file.

[0124] Please refer to Figure 1 , Figure 3 and Figure 4 Embodiment two of the present invention is as follows:

[0125] A method for encrypted storage and access in the IPFS file system:

[0126] Client A selects the file f.txt to upload, sets the encryption level, calculates the file fingerprint, and compares it with MDMS. At this point, the file does not yet exist in IPFS.

[0127] Client A randomly generates the string "abc" as the AES symmetric encryption key. Using the AES algorithm and "abc" as the key, client A encrypts the original file "f.txt". After encryption, the original file becomes "f.txt.crypto".

[0128] Client A determines that the encryption level is Level 1 encryption. It uses the public key obtained from KMS to encrypt the symmetric key abc. After encryption, the symmetric key becomes 123.

[0129] Client A uploads the encrypted file f.txt.crypto to the IPFS system, and at the same time sends the IPFS-generated CID, file fingerprint information, client A information, and the encrypted symmetric key 123 to MDMS.

[0130] Client B sends a request to download f.txt via CID. After receiving the request, the IPFS server returns the f.txt.crypto file to the client.

[0131] Client B sends a decryption request to MDMS.

[0132] After receiving the request, MDMS determines that the encryption level is Level 1 encryption and sends a decryption request to KMS. KMS uses its private key to decrypt 123 into abc, and then uses B's public key to encrypt abc into 456, which is then sent to B's client.

[0133] After receiving key 456, client B uses its own private key to decrypt abc, and then uses AES symmetric decryption to decrypt f.txt.crypto back into the original f.txt.

[0134] Please refer to Figure 5 and Figure 6 Embodiment 3 of the present invention is as follows:

[0135] A method for encrypted storage and access in the IPFS file system:

[0136] The client first calculates a fingerprint for each file, a unique identifier used to recognize its content. Then, it requests MDMS to check if a duplicate file exists. If not, MDMS requests KMS's public key and returns it to the client. The client randomly generates a 32-bit file key and encrypts the file using the AES256 symmetric encryption algorithm. Simultaneously, it encrypts the file key using the public key returned by KMS. The file is then sent to the IPFS data storage server, while the file information and the encrypted file key are sent to MDMS for safekeeping.

[0137] In particular, by encrypting the file key, we can divide the file security level into two levels, allowing users to control the security level of the uploaded files themselves:

[0138] Level 1: Client A randomly generates a 32-byte AES key and encrypts the file using the AES256 symmetric encryption algorithm before uploading it to the IPFS data storage server. Simultaneously, the AES key is encrypted using a KMS public key and stored in MDMS. When another user, B, accesses the file, they must request the file key from MDMS, decrypt it using their KMS private key to obtain the AES key, encrypt it again using B's public key, and send it to client B. Client B then decrypts the AES key using their own private key and can then access the file.

[0139] Level 2: Client A randomly generates an AES key (32 bytes) and uses the AES256 symmetric encryption algorithm to encrypt the file before uploading it to the IPFS data storage server. Simultaneously, Client A generates a public and private key pair. Then, it uses its public key to encrypt the AES key once, obtaining a string of (AES key + user public key encryption). This string is then encrypted a second time using the KMS public key, resulting in a string of (AES key + user public key encryption + KMS public key encryption), which is then uploaded to MDMS for storage. When another user, B, accesses a file, they send a request to MDMS. MDMS first asks client A if they allow B access. If allowed, MDMS instructs KMS to decrypt the string (AES key + user's public key encrypted once) using its private key and send it to client A. Client A decrypts the string using its private key to obtain the AES key file key, and then encrypts it again using KMS's public key before sending it to the MDMS server. MDMS decrypts the AES key a second time using KMS's private key, encrypts it again using B's public key, and returns it to client B. Client B decrypts the string using their own private key to obtain the AES key and can then access the file. The key difference lies in the double encryption of the file key. Other users need the file owner's consent to access the file, allowing users to control their own whitelist and blacklist of users who can access uploaded files, resulting in a higher level of security.

[0140] Please refer to Figure 2 Embodiment 4 of the present invention is as follows:

[0141] A system for encrypted storage and access of IPFS file system includes an upload client, an access client, an application server, and a key management server. The upload client and the access client are both IPFS clients. The upload client includes a first processor, a first memory, and a first computer program stored in the first memory and executable on the first processor. When the first processor executes the first computer program, it implements steps S01 to S3 in the above embodiment 1.

[0142] The access client includes a second processor, a second memory, and a second computer program stored in the second memory and capable of running on the second processor. When the second processor executes the second computer program, it implements step S6 and step S41 in step S4 of the above embodiment 1.

[0143] The application server includes a third processor, a third memory, and a third computer program stored in the third memory and capable of running on the third processor. When the third processor executes the third computer program, it implements steps S42, S43, and S44 in step S4 of the above embodiment and step S52 in step S5.

[0144] The key management server includes a fourth processor, a fourth memory, and a fourth computer program stored in the fourth memory and executable on the fourth processor. When the fourth processor executes the fourth computer program, it implements step S51 in step S5 of the above embodiment 1.

[0145] In summary, the present invention provides a method and system for encrypted storage and access of IPFS file system. The IPFS file system stores encrypted files, and the encryption key for these files is a random string. The random string is encrypted according to the corresponding encryption level and then stored on a third-party server along with the content identifier and encryption level. This separates the storage of files and keys, making it impossible to obtain the original file from the IPFS file system, thus solving the security problem of IPFS file system. Furthermore, the encryption levels are divided into no encryption, Level 1 encryption, and Level 2 encryption. Different encryption processes are used for the random string according to different encryption levels. When using Level 2 encryption, decryption requires confirmation from the file upload client, resulting in higher security and better meeting users' security needs.

[0146] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for encrypted storage and access of an IPFS file system, characterized in that, Including the following steps: S1. The upload client obtains the file to be uploaded and the encryption level based on the user's operation, and obtains the first public key from the key management server; S2. The upload client generates a random string and uses the random string to encrypt the file to be uploaded to obtain an encrypted file. According to the encryption level and the first public key, the random string is encrypted with the corresponding encryption level to obtain the key ciphertext. S3. The uploading client sends the encrypted file to the IPFS server, obtains the content identifier generated by the IPFS server based on the encrypted file, and sends the metadata to the application server for storage. The metadata includes the content identifier, the key ciphertext, and the encryption level. S4. The client obtains the encrypted file from the IPFS server and sends a decryption request to the key management server through the application server. The decryption request includes the encryption level corresponding to the encrypted file and the key ciphertext. S5. The key management server performs the corresponding decryption process according to the encryption level, and obtains the random string after successful decryption, and sends the random string to the access client. S6. The access client decrypts the encrypted file according to the random string to obtain the target file; The encryption levels include no encryption, Level 1 encryption, and Level 2 encryption; the metadata also includes uploaded client information. The step preceding step S1 includes the following steps: S01. Upload the client to initialize and generate the second public key and the second private key; Step S2 includes the following steps: S21. The upload client generates the random string and uses the random string to encrypt the file to be uploaded to obtain the encrypted file; S22. Determine the encryption level. If the encryption level is no encryption, then directly use the random string as the key ciphertext. If the encryption level is Level 1 encryption, then the first public key is used to encrypt the random string to obtain the key ciphertext; If the encryption level is level 2 encryption, then the first public key is used to encrypt the random string to obtain intermediate ciphertext, and the second public key is used to encrypt the intermediate ciphertext to obtain the key ciphertext; Step S4 includes the following steps: S41. The access client obtains the encrypted file from the IPFS server based on the content identifier provided by the user, and sends a first decryption request to the application server, wherein the first decryption request contains the content identifier. S42. The application server searches for the file's metadata based on the content identifier to obtain the encryption level and the key ciphertext corresponding to the content identifier; S43. The application server determines whether the encryption level is level 2 encryption. If the encryption level is not level 2 encryption, it sends a second decryption request to the key management server. The second decryption request includes the key ciphertext. Otherwise, it proceeds to step S44. S44. The application server sends a third decryption request, including the encryption key, to the upload client based on the upload client information. The upload client receives the third decryption request and determines whether to agree to decryption based on user operation or a user-preset whitelist. If decryption is agreed, the key ciphertext is decrypted using the second private key to obtain the intermediate ciphertext, and the intermediate ciphertext is returned to the application server. The application server then sends a second decryption request, including the intermediate ciphertext, to the key management server. Otherwise, a decryption rejection message is returned. Step S5 specifically involves: The key management server performs a corresponding decryption process on the key ciphertext or intermediate ciphertext according to the encryption level, and obtains the random string after successful decryption, and sends the random string to the access client.

2. The method for encrypted storage and access of an IPFS file system according to claim 1, characterized in that, The metadata also includes file fingerprints; Step S1 specifically involves: The upload client obtains the file to be uploaded and the encryption level based on the user's operation, calculates the file fingerprint of the file to be uploaded, and sends the file fingerprint to the application server for comparison. If the same file fingerprint exists, the file already exists and no further operation is performed; otherwise, the application server obtains the first public key from the key management server and returns it to the upload client.

3. The method for encrypted storage and access of an IPFS file system according to claim 1, characterized in that, Step S5 specifically includes the following steps: S51. The key management server determines the encryption level. If the encryption level is no encryption, the key ciphertext is the random string required for decryption, and the random string is returned to the application server. Otherwise, the key ciphertext or the intermediate ciphertext is decrypted using the first private key to obtain the random string and is returned to the application server. S52, The application server returns the random string to the accessing client.

4. The method for encrypted storage and access of an IPFS file system according to claim 3, characterized in that, The first decryption request also includes a third public key generated by the access client; Step S52 specifically involves: The application server uses the third public key to encrypt the random string and returns the encrypted random string to the accessing client; Step S6 specifically involves: The access client decrypts the random string encrypted with the third public key using the third private key to obtain the original random string, and then uses the random string to decrypt the encrypted file to obtain the target file.

5. The method for encrypted storage and access of an IPFS file system according to claim 1, characterized in that, The specific steps of S01 are as follows: The client is uploaded for initialization, and the second public key and the second private key are generated using the RSA algorithm.

6. The method for encrypted storage and access of an IPFS file system according to claim 1, characterized in that, The specific steps of encrypting the file to be uploaded using the random string to obtain the encrypted file are as follows: The file to be uploaded is encrypted using the AES encryption algorithm with the random string to obtain the encrypted file.

7. A system for encrypted storage and access of an IPFS file system, comprising an upload client, the upload client including a first processor, a first memory, and a first computer program stored in the first memory and executable on the first processor, characterized in that, When the first processor executes the first computer program, it implements the method as described in any one of claims 1-6.

Images