A kind of archival data management method and system based on blockchain

Abstract

The present application discloses a method for managing archive data based on blockchain, characterized in that it includes a system architecture constructed by blockchain digital archives, system services, digital archives alliance blockchain, etc., to complete the distributed storage and verification of archives; the blockchain digital archives are composed of multiple nodes in the hyperledger, and the nodes in the same archives are in the same channel; in the archive storage module, a master-slave library replication mechanism is established, and a granularity-aware method is adopted to store large files on IPFS and obtain hash addresses, and small files are directly stored on the chain; a practical and secure cross-archive data sharing scheme is proposed to connect the data transmission of each archive; the offline registration of the archives is completed by defining the election of anchor nodes and the generation of ordinary nodes, and the online registration of ordinary users is completed by generating Tokens and storing them on the chain. The present application also discloses a blockchain-based archive data management system, which has the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present application belongs to the field of computer application technology, and in particular, relates to an archive data management method and system based on blockchain. Background Art

[0002] In the era of big data, traditional archive storage and management methods are difficult to effectively deal with the efficiency and security issues faced in the archive management process. The rapid development of the Internet, cloud technology and mobile terminals has promoted government departments to vigorously develop digital means to improve the storage and management efficiency of archives, and cater to users' needs for in-depth use of archive data, creating favorable conditions for the information integration of paperless office and e-government of government departments. However, while the existing digital archive management methods based on Internet communication technology bring convenience to archive management, they also have the following disadvantages: (1) Most existing digital archive systems use digital signatures and digital watermarks to solve data security protection problems, and it is difficult to recover data after being damaged; (2) Archives in various regions are information "islands" that independently store archives and lack safe and effective information sharing channels; (3) The authenticity and originality of the archive system are overly dependent on the system center or third-party entities, and the centralized archive database is subject to security risks such as data tampering, hacker attacks, and information disputes; (4) Compared with traditional paper archives, digital archives are bits and bytes stored on physical media, and archives are highly volatile during processing, transmission and storage.

[0003] Comparing centralized digital archive technology and blockchain technology, both are aimed at electronic information stored on magnetic media. The information stored in digital archive technology includes digitized archive data, user data and user operation records. Among them, digital archive data is the core element of digital archives. Once the data is damaged, it will cause irreparable consequences to individuals, society, enterprises and even the country; user operation records are the operation traces formed by the acceptor's editing, filing, modification, and filing of archive information. Such records have high traceability and are important evidence of archive information; traditional distributed file storage technology brings efficient storage while still not getting rid of centralized structure and management methods. It is of practical significance to seek a reliable and secure storage technology for archive data and files. The advantages of blockchain such as decentralization, multi-party maintenance, tamper-proof and trusted storage are combined with digital archive management to solve the problems of low security, poor sharing and untraceable history that are common in digital archive management. Summary of the invention

[0004] The purpose of this application is to solve the above-mentioned problems of existing archival data management and to provide an archival data management method and system based on blockchain, that is, to apply the decentralization, transparency, traceability and other characteristics of blockchain technology to digital archive management, and to combine distributed data management tools to complete the storage, backup and security verification of archival information and operation information, and to build a new archival data management system that takes into account high performance, economy and flexibility.

[0005] In the first aspect, the present application provides a blockchain-based archival data management method, comprising:

[0006] This method defines a network topology jointly constructed by blockchain digital archives, system services, digital archives alliance blockchain, public blockchain, IPFS cluster and external users. The functions and roles of each component are as follows:

[0007] 1) A blockchain-based digital archive (hereinafter referred to as a digital archive) is composed of multiple peer nodes in the alliance chain technology hyperledger participating in the blockchain network. Nodes in the same digital archive are in the same channel, and the nodes enjoy archive verification, query, protection, sharing and other services;

[0008] 2) System services include data extraction module and RESTful service. RESTful service provides the digital archive management system with interface calls to blockchain smart contracts and IPFS, while data extraction module is used to realize the secure storage of heterogeneous archive data.

[0009] 3) The digital archives alliance blockchain (hereinafter referred to as the alliance chain) adopts the alliance chain platform Hyperledger Fabric (hereinafter referred to as Fabric) technology, and adopts the message queue sorting consensus plug-in based on Kafka and Zookeeper clusters;

[0010] 4) The public blockchain uses the Ethereum blockchain platform based on the PoW consensus mechanism. The public blockchain will regularly store snapshot information of the alliance chain blocks to strengthen the data protection of the alliance chain Fabric;

[0011] 5) The IPFS cluster stores the original information of the encrypted archives and ensures information security through technologies such as hash tables and block exchanges.

[0012] Furthermore, in terms of data storage, an efficient heterogeneous archive data storage method is proposed, which can be divided into a data and file extraction stage, a data encryption storage stage, and an electronic file distributed storage stage.

[0013] 1) In the data and file extraction stage, the real-time monitoring node extracts the new transaction log, records and parses the transaction log, extracts the electronic files of the archive, and completes the master-slave replication, specifically:

[0014] a) The master database completes the transaction operation update and records the updated data details in the log file or log table;

[0015] b) Establish an intermediate client connection by opening a listening thread with the main database to extract the transaction log of the main database;

[0016] c) The intermediate client extracts the operation log and stores it in a private network through an encrypted channel. It also obtains the electronic file by parsing the file storage path in the log and stores it in the IPFS network;

[0017] d) The slave database can reproduce the transaction logs stored on the blockchain to reconstruct the data according to the synchronization requirements.

[0018] 2) In the data encryption storage stage, the data encryption storage process is described as follows: converting the log object into JSON format and then into a string; encrypting the log characters and generating ciphertext; encapsulating the archive data; encapsulating the metadata; encapsulating all stored information into blockchain transactions; publishing transactions to the blockchain and obtaining transaction IDs.

[0019] 3) In the distributed storage stage of electronic files, the traditional file storage system is abandoned, which is specifically described as follows:

[0020] a) Using a private IPFS distributed file storage system, when the file memory is larger than 256KB, the file is split into multiple IPFS storage sub-objects, each of which contains the current object data and link subordinate objects links , and the block Merkle root links the subordinate objects links Set it to empty;

[0021] b) A granularity-aware file storage method is proposed to extract archival electronic files according to the file storage path. If the file is larger than 65536 bytes (64KB), the file is stored on IPFS and its hash address is obtained. If it is less than 65536 bytes, it is directly stored.

[0022] Furthermore, in combination with the overall architecture of the archival data management method described in this application, a practical and secure digital archival data sharing method is proposed. This method enables secure and practical archival data sharing between digital archives or between digital archives and external users through smart contracts, IPFS and hybrid encryption mechanisms, and safely and efficiently combines traditional archival systems with blockchain technology, thereby protecting archival data security.

[0023] Furthermore, in the archive data management method, an efficient and reliable digital archive pre-registration and rapid authentication method is proposed, wherein the pre-registration is divided into two parts: offline registration and online registration.

[0024] 1) Offline registration includes the election of the leader peer and the generation of ordinary nodes. The steps of the anchor peer election include:

[0025] a) Each node in the alliance chain proposes itself as the leader and broadcasts the message;

[0026] b) Each node in the P2P network collects proposals within a specified waiting time;

[0027] c) After waiting for collection, compare the hash value of its own node ID with the hash values ​​of other node IDs;

[0028] d) If the hash value of its own ID is smaller than the hash value of any other node ID, it declares itself as an anchor node, otherwise it abandons the election process.

[0029] The steps for generating a common node include:

[0030] a) When a peer is authenticated offline, the CA verifies the authenticity of its application materials;

[0031] b) After the archive confirms the administrator, the CA generates the Peer's public key using the RSA cryptographic algorithm P_Peer Private Key S_Peer ;

[0032] c) CA issues a certificate to Peer Cert_Peer ;

[0033] d) Leader Peer stores the public parameters, certificate information, and public and private keys of the Peer;

[0034] e) CA records the mapping relationship between each digital archive and its Leader Peer identity.

[0035] 2) Online registration refers to the identity registration of ordinary users, and its steps include:

[0036] a) The nearby Peer will automatically generate a public-private key pair for the registered user {P_User, S_User} , and P_User , Peer The zone number in the certificate is timestamped and constitutes Token , sends a response to the Leader Peer Token Request for registration;

[0037] b) The Leader Peer performs a preliminary PKI identity authentication to ensure that the public key is not on the revocation list and confirmsToken The area number in the peer certificate is consistent with that in the peer certificate;

[0038] c) After receiving the registration information, each node will verify it separately. If more than half of the nodes return a successful result, the smart contract will be triggered. Token Storage on chain.

[0039] 3) The quick authentication interaction process includes the following steps:

[0040] a) User_A Make your own Token_A and timestamp T Sign and send to User_B ;

[0041] b) User_B Attach yourself Token_B The authentication request is composed of the public key of the neighboring peer and then sent to the leader peer;

[0042] c) The Leader Peer decrypts the request with the Peer private key and triggers the smart contract to retrieve the blockchain to see if the blockchain has any record. Token_A and Token_B, and verify the signature and timestamp;

[0043] d) Peer The successfully authenticated signature Sign_Leader and randomly generated Token_Peer Send to User_ B ;

[0044] e) User_B Will Sign_Leader and Token_Peer Send to User_A , User_A verify Sign_Leader Confirm after confirmation Token_Peer This is their common temporary session key.

[0045] In the second aspect, the present application provides a blockchain-based archive data management system, including:

[0046] The system possesses all the beneficial features and effects of the aforementioned blockchain-based archival data management method, and is defined as consisting of the aforementioned digital archives alliance chain, public chain and IPFS cluster; a blockchain-based data archive serves as an organization in the alliance chain super ledger, which is composed of the super ledger's main master node and several ordinary nodes, and is defined in the same channel; the system services described in the above method conform to the functional design of the blockchain-based archival data management system.

[0047] Furthermore, the file data transfer of each component in the system is completed through the following steps:

[0048] 1) The digital archive stores archive hashes and various operation contract records in the alliance chain Fabric;

[0049] 2) The digital archive stores the original information of the encrypted archive in the IPFS private cluster and verifies the authenticity of the data by calling the archive hash of the alliance chain;

[0050] 3) The IPFS private cluster calculates the archive fingerprint by storing the archive content and transmits it to the alliance chain Fabric;

[0051] 4) The alliance chain Fabric transmits the generated block hash to the public blockchain Ethereum to complete snapshot storage and realize the anchoring of archive data.

[0052] The system meets all the characteristics of the above-mentioned heterogeneous archive data storage method, digital archive data sharing method and digital archive pre-registration and rapid authentication method. It can generate multiple blockchain digital archives in real time, and achieve independent autonomy and data interoperability of each digital archive, and has the scalability of a consortium chain.

[0053] Compared with the existing technology, the advantages of this application are: while maintaining the decentralization, trusted storage and traceability of archive storage applications on the blockchain, it can also take into account the performance, economy and flexibility of data storage; while ensuring that each archive maintains its own data and privacy security, it can also complete the secure sharing of some archive data between archives in actual applications; and it realizes the internal autonomy and identity security of each digital archive within the alliance chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. It should be understood that the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 This is the overall architecture diagram of the blockchain-based archive data management system.

[0056] Figure 2 It is a digital archive data flow diagram.

[0057] Figure 3 It is a diagram of a method for secure storage of heterogeneous archival data.

[0058] Figure 4 It is a granularity-aware file storage model.

[0059] Figure 5 It is a flow chart of digital archive data sharing.

[0060] Figure 6 It is a quick certification process diagram. DETAILED DESCRIPTION

[0061] In order to more clearly illustrate the technical methods, purposes and advantages of the present application, the present application is combined with the following embodiments and embodiment drawings to provide a more profound and complete description of the application content. It should be understood that the specific embodiments described herein are used to explain the present application and cannot limit the present application. The described embodiments refer only to a part of the embodiments of the present application, rather than all embodiments. The techniques, methods and equipment known to ordinary technicians in the relevant fields may not be discussed in detail, but in appropriate cases, the techniques, methods and equipment should be regarded as part of the specification. Based on the embodiments of the present application, other embodiments obtained by technicians in the relevant fields before doing creative work all belong to the scope of protection of this application.

[0062] This application proposes a blockchain-based archival data management method and system, which solves the current problems of digital archive management by combining blockchain alliance chain technology and distributed data management tools. While maintaining the decentralization, trusted storage and traceability of archival storage applications to blockchain, it can also take into account high performance, economy and flexibility. In combination with the above ideas, this application first designs an efficient heterogeneous archival data storage method, which aims to solve the storage problem caused by the different file types and memory when using blockchain to store data, and the large memory usage of some files; secondly, while ensuring that each archive maintains its own data and privacy security, it can also complete the safe sharing of some archival data between archives in actual applications. This application proposes a practical and secure digital archive data sharing method; finally, it proposes an efficient and reliable digital archive pre-registration and rapid authentication method, which realizes the internal autonomy and identity security of each digital archive in the alliance chain.

[0063] 1. Overall architecture.

[0064] like Figure 1 As shown, the archival data management method and system based on blockchain in the embodiment of the present application is completed by the blockchain digital archive, system services (data extraction module, RESTful service), digital archive alliance blockchain, public blockchain, IPFS cluster and external users to form a system, in which the alliance chain, public blockchain and IPFS cluster jointly complete the storage, backup and security verification of archival information and operation information. The contents of each part are detailed as follows:

[0065] 1) Blockchain-based digital archives: A digital archive is composed of multiple peer nodes in the Hyperledger Fabric participating in the Hyperledger consortium chain (the figure shows two digital archives, A and B). Nodes in the same digital archive are in the same channel, and nodes in different digital archives are in different channels. Nodes enjoy archive verification, query, protection, sharing and other services;

[0066] 2) System services: System services include data extraction module and RESTful service. RESTful is a design style and development method for network applications based on HTTP. It is also a decentralized application (DApp) and does not store any archival data information. This method uses the RESTful interface to provide digital archive management systems with calls to blockchain smart contracts and IPFS interfaces. The data extraction module extracts archival database transaction logs and electronic files, designs data security storage models for different archival data sizes, and connects with the alliance chain and IPFS cluster to achieve secure storage of heterogeneous archival data.

[0067] 3) Digital Archives Alliance Blockchain: The alliance chain uses the alliance chain platform Hyperledger Fabric, and based on the sorting consensus mechanism of Kafka and Zookeeper clusters, calls the digital identity information and archive summary information of the smart contract storage system through the RESTful interface to achieve data access control and complete business logic;

[0068] 4) Public blockchain: The public blockchain uses the Ethereum blockchain platform based on the PoW consensus mechanism. The chain will regularly store snapshot information of the alliance chain blocks to strengthen the data protection of the alliance chain Fabric. Conversely, the alliance chain Fabric will also regularly strengthen the protection of the originality and authenticity of the data through anchoring with the chain;

[0069] 5) IPFS cluster: IPFS is a distributed file system. It has the technical advantages of self-authentication, hash table, block exchange, etc. It has the characteristics of content addressability, non-tamperability and decentralization. When storing files, IPFS will calculate the file fingerprint through the file content, which can serve as a verification for users when reading files. With IPFS private cluster, only nodes with the same swarm-key can participate in the network. IPFS cluster stores the original information of encrypted archives and ensures information security through hash table, block exchange and other technologies.

[0070] As mentioned above, the data transmission flow of the system based on the combination of consortium chain Hyperledger Fabric, public blockchain Ethereum and private IPFS cluster is as follows: Figure 2As shown. It can be described as:

[0071] S201: The digital archive stores archive hashes and various operation contract records in the alliance chain Fabric;

[0072] S202: The digital archive stores the original information of the encrypted archive in the IPFS private cluster and verifies the authenticity of the data by calling the archive hash of the alliance chain;

[0073] S203: The IPFS private cluster calculates the archive fingerprint by storing the archive content and transmits it to the alliance chain Fabric;

[0074] S204: The alliance chain Fabric transmits the generated block hash to the public blockchain Ethereum to complete the snapshot storage and realize the anchoring of the archive data.

[0075] 2. Safe storage method for heterogeneous archive data.

[0076] The data streams extracted from digital archives can be roughly divided into two categories according to the data format type, namely archival database logs and archival electronic files. Each transaction log recorded in the database is similar to each transaction in the blockchain, so it is feasible to store transaction logs on the blockchain; while for archival electronic files, the type and memory of each file are different, and the file memory accounts for a large proportion, so it is no longer necessary to use blockchain transaction storage. The existing centralized data backup method based on master-slave replication generally completes the storage of the target database behavior log by setting up an intermediate library. This method is only used to back up the database and does not take archival files into consideration. It is also prone to single point failures. In order to solve the above problems, the present application proposes a method for secure storage of heterogeneous archival data, which corresponds to Figure 1 The data extraction module in .

[0077] The transaction log is one of the core components of the database. All operations after the database is created will be recorded in this component. This type of transaction log information can help the system complete data recovery in the event of a failure, and support transaction replication to achieve data backup without affecting the existing upper-level archive business. This method proposes a data storage method that coordinates the consortium chain and the IPFS cluster. By extracting the transaction logs and electronic files of the archives, a granularity-aware secure storage model is designed for data of different sizes to achieve secure storage of heterogeneous archive data. This method model can be found in Figure 3 .

[0078] The specific implementation of the method can be divided into three stages, namely, data and file extraction stage, data encryption storage stage, and electronic file distributed storage stage. Each stage is described in detail as follows:

[0079] 1) Data and file extraction stage.

[0080] Extract new transaction logs through real-time monitoring nodes, record and parse transaction logs, extract archive electronic files, and complete master-slave replication. The specific steps are as follows:

[0081] a) The archive database (main database) completes the transaction operation update and records the updated data details in the log file or log table;

[0082] b) Establish an intermediate client connection by opening a listening thread with the main database to extract the transaction log of the main database;

[0083] c) The intermediate client extracts the operation log and stores it in the private network through an encrypted channel. For operations involving newly added electronic files, the electronic files are obtained by parsing the file storage path in the log and stored in the IPFS network;

[0084] d) The backup database (slave database) can reproduce the transaction logs stored on the blockchain to rebuild the data according to synchronization requirements.

[0085] The master-slave replication method is relatively flexible. The log information stored on the blockchain can serve as a relay station for the master database. Other databases achieve data synchronization by obtaining complete operation logs to ensure data consistency between the slave and master databases.

[0086] 2) Data encryption and storage stage.

[0087] In the process of archival information transmission and storage, in order to ensure data privacy and security, an encryption processing method is designed for the extracted archival transaction log. Based on the transaction format of BigchainDB, the definition Tx_log For encapsulated blockchain transactions, sk_user is the user's private key (used to sign the packaged transaction), Data_asset is a transaction asset (consisting of encrypted transaction logs), Data_meta The metadata is used to describe the asset category and content. The input of each transaction is the asset, metadata and user private key. Tx_log = {Data_asset, Data_meta, sk_user} ; Define the transaction number as scn , the operator is named os_user , ENC_AES(log, pk_user) Indicates that the user password pk_user Transaction log log For AES encryption, Data_asset = {scn, os_user, ENC_AES(log, pk_user)} .

[0088] Based on the above definition, the entire transaction log encryption process is as follows: convert the log object into JSON format and then into a string; encrypt the log characters and generate ciphertext; encapsulate Data_asset ; Encapsulation Data_meta; Encapsulate all stored information into blockchain transactions; Publish transactions to the blockchain and obtain transaction IDs.

[0089] 3) Distributed storage stage of electronic files.

[0090] At present, the large-scale data and heterogeneous file storage methods based on blockchain are usually implemented by combining a third-party file system with a blockchain system on-chain and off-chain. This combination causes the following problems: the off-chain file system adopts a centralized or distributed storage and management method, which cannot fully guarantee data security and consistency; when the off-chain file is damaged, the blockchain only serves as a file verification tool and cannot provide assistance in recovering the file.

[0091] Combined with the management scenarios of digital archives, such as Figure 4 The overall process shown in this application provides the following methods:

[0092] 1) Abandon the traditional file storage system and adopt the private IPFS distributed file storage system, which has the characteristics of decentralization, immutability, hash addressing, block exchange, etc., and cooperates with blockchain technology to enhance the authenticity and integrity of data storage;

[0093] 2) A granularity-aware file storage method is proposed, where small-sized files are directly uploaded to the chain after processing, and large-sized files are stored in IPFS and their fingerprints are stored on the chain.

[0094] For the convenience of discussion, the specific implementation steps of this method can be divided into the following parts:

[0095] 1) Define a data object structure for storing a file on IPFS ( IPFSobject ), which contains an array of links to IPFS objects ( links ), the array is IPFSLink The structure type also contains a binary object of type byte ( data ), used to store data no higher than 256KB, where IPFSLink The structure contains elements with link names ( Name ), link object hash value ( Hash ) and the cumulative size of linked objects ( Size );

[0096] 2) Based on the data structure defined above, when the file memory is larger than 256KB, the file is split into multiple IPFS storage sub-objects, each of which contains the current object data and link subordinate objects links , and the block Merkle root links the subordinate objects links Set to empty. Data links In IPFSLinkThe object stores the link Name , Hash and Size ;

[0097] 3) Set 64KB as the lower limit, and archive files larger than 64KB are large-size files, otherwise they are small-size files. Parse the extracted transaction logs and extract archive electronic files according to the file storage path. If the file is larger than 65536 bytes (64KB), store the file on IPFS and obtain its hash address. If it is smaller than 65536 bytes, store it directly;

[0098] 4) Based on the parsed transaction log, further determine the confidentiality attributes of the current archive file. If it is a public file, directly integrate and package it according to the relevant parameters. If it is a private file, encrypt it with a shared key and then integrate and package it according to the relevant parameters.

[0099] 3. Digital archive data sharing methods.

[0100] The data between digital archives in the digital archives alliance chain is isolated across channels to ensure that each digital archive maintains its own data security and privacy. However, in actual applications, it is generally necessary to share some archive data between archives. Combined with the overall architecture of this application, this application proposes a method for sharing archive data between digital archives under the above alliance chain architecture. Specifically:

[0101] Smart contracts, IPFS and hybrid encryption mechanisms are used to achieve secure and practical archival data sharing between members of the Digital Archives Alliance or between the Archives Alliance and external users, safely and efficiently combining traditional archival systems with blockchain systems to protect archival data security.

[0102] If a method model is defined for digital archive A to share data with target digital archive B, the model also needs to define the following consortium chain smart contract functions:

[0103] 1) Archives authority control contract: used for digital archives authority control;

[0104] 2) Archives sharing storage contract: used to store archive information shared by archives, including archive number, archives identity and sharing time;

[0105] 3) Digital identity management contract: Through democratic voting, some peer nodes within the archives are elected to achieve internal autonomy of the digital identity of the archives alliance.

[0106] Please note that here we only briefly describe the functions of the smart contract without describing it in detail, and this content is not the focus of this application.

[0107] The specific steps of the method are as followsFigure 5 As shown:

[0108] S501: If the digital archive A uses its own private key SK_A File number for shared files Record_ ID and the identity of the target archive B Identity_B The signature and endorsement are sent to the smart contract by calling the RESTful service interface. After receiving the request, the archive sharing storage smart contract first calls the archive permission control contract to verify the identity of the archive by verifying the signature. After the verification is passed, the identity information of the target archive B is written into the contract with the archive number. Record_ID The corresponding sharing list;

[0109] S502: If the digital archive B uses its own private key SK_B File number for shared files Record_ ID and its identity Identity_B Sign and send to the smart contract. After receiving the request, the archive sharing storage contract first calls the archive permission control contract to check the permission of digital archive B. After the check passes, it returns the archive fingerprint and the corresponding hash value;

[0110] S503: If the digital archive B relies on the archive fingerprint obtained from the contract, it asynchronously obtains the encrypted archive object from the private IPFS cluster RecordJson Furthermore, digital archive B sends its identity to the Identity_B and file number Record_ID Send to digital archive A and obtain the encrypted archive object RecordJson The decryption key;

[0111] S504: After the digital archive A receives the request from archive B, it Record_ID and identity Identity_B The authenticity of shared data is verified through the archive sharing storage contract, and obtained from the digital identity management contract. Identity_B Corresponding PK_B . Then use PK_B Decryption key edk Perform asymmetric encryption based on elliptic curve and return it to digital archive B;

[0112] S505: After receiving the returned data from archive A, digital archive B uses the private key SK_B Decryption gives the original encrypted edk , then use edk right RecordJsonDecrypt to get the original file object; or get the attachment ciphertext from IPFS through the file attachment fingerprint in the JSON structure and pass edk View archive data after decryption.

[0113] 4. Pre-registration and rapid certification of digital archives.

[0114] Defining the node identity and user identity in the digital archive is the prerequisite for the system to participate in the alliance chain Fabric, and is the basis for digital archive information protection and data sharing. Based on the overall system architecture constructed above, we propose an efficient and reliable digital archive pre-registration and fast authentication method.

[0115] Pre-registration includes offline registration and online registration.

[0116] Offline registration refers to the selection of anchor nodes and the generation of ordinary nodes.

[0117] The offline registration embodiment can be specifically described as follows:

[0118] The anchor node is a special node in the alliance chain Fabric network, also known as the master node. When there is cross-archive communication, the source archive needs to obtain at least one node communication address of the target archive, and the anchor node serves as the intersection of the archive. The generation of anchor nodes (Leader Peer) is a dynamic election process, specifically referring to each node in the alliance chain proposing itself as the Leader and broadcasting the message; then each node in the P2P network collects proposals within the specified waiting time; after waiting for the collection, the hash value of its own node ID is compared with the hash value of other node IDs. If the hash value of its own ID is smaller than the hash value of any other node ID, it declares itself as the master node, otherwise the election process is abandoned. Please note that the archive generation makes the alliance chain set at least two Peer nodes for it by default.

[0119] Before the deployment of ordinary nodes (hereinafter referred to as Peers), the alliance chain Fabric-CA issues a certificate for each offline recognized Peer Cert_Peer When the peer is authenticated offline, the CA will verify the authenticity of its application materials, record the mapping relationship between the real identity of the digital archives administrator and the public key, and issue a certificate to it. Specifically: After the digital archives confirms the administrator user, the CA uses the RSA cryptographic algorithm to generate the peer's public key P_Peer and private key S_Peer , and issue a certificate Cert_Peer The certificate contains: the public key of the peer, the certificate validity date, the private key signature of the CA, and the archive area number where the peer is deployed. N_PeerThe Leader Peer stores the public parameters, certificate information, and public and private keys of the Peer. The CA records the mapping relationship between each digital archive and its Leader Peer identity. It can be seen that the CA is responsible for generating the public and private key pairs of the Leader Peer and Peer representative identities of each archive, the CA is responsible for managing the identity of the Leader Peer, and the Leader Peer is responsible for managing the identity of the Peer.

[0120] The embodiment of the online registration can be specifically described as follows:

[0121] The nodes in each digital archive build a small alliance chain network in their own channel, and the Leader Peer exposes its identity information in the network.

[0122] 1) When an ordinary user needs to register an account, the nearby Peer will automatically generate a public-private key pair for him {P_user, S_ user} , and then P_user , the area number in the Peer certificate is attached with a timestamp and constitutes Token , sends a response to the Leader Peer Token Registration request.

[0123] 2) The Leader Peer uses the private key to decrypt the user registration request sent by the Peer, performs a preliminary PKI identity authentication, ensures that the public key is not on the revocation list and confirms Token The area number in the peer certificate is consistent with that in the peer certificate.

[0124] 3) After the verification, the user registration message is synchronized in each node of the archive; each node verifies it after receiving the message. If more than half of the nodes return a successful result, the smart contract is triggered and the user is generated. Token The mapping relationship between the public key and Token Storage on chain.

[0125] Here, Peer has the right to generate identities for ordinary users, and Leader Peer has the right to verify ordinary users. This approach weakens the centralization of small networks within the archive and reduces the burden on Fabric-CA.

[0126] The embodiment of the rapid authentication can be specifically described as follows:

[0127] After completing online registration, ordinary users in the same digital archive need to initiate a quick online identity authentication if they need to communicate with each other. The authentication method can be briefly described as follows: User_A To users User_BAfter sending the identity information, user B can request any nearby node to authenticate the identity of user A and generate a session key, otherwise the communication will be interrupted. Figure 6 The interactive process of fast authentication is given, and the specific contents are described as follows:

[0128] S601: User_A Make your own Token_A and timestamp T Sign and send to User_B ;

[0129] S602: User_B Will be from User_A The received identity information is appended with your own Token_B Compose an authentication request, encrypt it with the public key of the neighboring peer, and send it to the leader peer;

[0130] S603: Leader Peer decrypts the request with the Peer private key and triggers the smart contract to search the blockchain to see if the blockchain has any record. Token_A and Token_B , if they all exist and the time has not expired, verify the signature of the peer. After the verification is passed, finally check whether the message timestamp is valid;

[0131] S604: If all the above conditions are met, the Leader Peer will return the authentication success to the Peer Success , and sign it, Peer The successfully authenticated signature Sign_Leader and randomly generated Token_Peer use User_B The public key is encrypted and sent to User_B ;

[0132] S605: User_B Decrypt the message and use User_A The public key will Sign_Leader and Token_Peer Send to User_A , User_A verify Sign_Leader Confirm after confirmation Token_Peer This is their common temporary session key.

[0133] The various embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. A person of ordinary skill in the art may modify or replace the technical method of the present application with an equivalent without departing from the spirit and scope of the present application, and the scope of protection of the present application shall be subject to the claims. The selection of terms used herein is intended to best explain the principles, practical applications, or technical improvements in the market of the various embodiments, or to enable other persons of ordinary skill in the art to understand the various embodiments disclosed herein.

Claims

1. A blockchain-based archival data management method, characterized in that: include: Define all roles including blockchain digital archives, system services, digital archives alliance blockchain, public blockchain, IPFS cluster and external users. The digital archives alliance blockchain, public blockchain and IPFS cluster jointly complete the storage, backup and security verification of archive information and operation information; The blockchain digital archive is composed of multiple peer nodes in the hyperledger. Nodes in the same digital archive are in the same channel, and nodes in different digital archives are in different channels. The nodes enjoy archive verification, query, protection, and sharing services. The system service provides blockchain smart contracts and IPFS interface calls for archival data storage and application management through the RESTful interface format. The data extraction module completes the connection between the digital archives alliance blockchain and the IPFS cluster by extracting archival database transaction logs and electronic files and designing data security storage models for different archival data sizes, thereby achieving secure storage of heterogeneous archival data. The digital archive alliance blockchain adopts the Hyperledger technology, and calls the digital identity information and archive summary information of the smart contract storage system through the RESTful interface to realize data access control and complete business logic; The blocks of the digital archive alliance blockchain periodically store snapshot information in the public blockchain to strengthen the protection of archive data; The IPFS cluster stores the original information of the encrypted archive and ensures information security through hash tables and block exchange technology; Combined with the overall architecture proposed in the method, a heterogeneous archive data storage solution, a digital archive data sharing solution, and a blockchain-based digital archive pre-registration and rapid authentication solution are obtained; The file data transmission flow is described as follows: the blockchain-based digital archive stores the archive hash and various operation contract records in the digital archive alliance blockchain; the blockchain-based digital archive stores the encrypted archive original information in the IPFS private cluster and verifies the data authenticity by calling the digital archive alliance blockchain archive hash; the IPFS private cluster calculates the archive data fingerprint by storing the archive content and transmits it to the digital archive alliance blockchain; The Digital Archives Alliance blockchain transmits the generated block hash to the public blockchain Ethereum to complete snapshot storage and realize the anchoring of archive data; The blockchain-based digital archive is pre-registered in the digital archive alliance blockchain, including offline registration and online registration. Offline registration includes the election of anchor nodes and the generation of ordinary nodes, and online registration refers to the identity registration of ordinary users. The generation of anchor nodes in the online registration is a dynamic election process, which includes: Each node in the alliance blockchain proposes itself as the Leader and broadcasts the proposal; then each node in the P2P network collects proposals within the specified waiting time; after waiting for the collection, the hash value of its own node ID is compared with the hash value of other node IDs. If the hash value of its own ID is smaller than the hash value of any other node ID, it declares itself as the master node, otherwise the election process is abandoned; the ordinary node generation refers to the CA being responsible for generating the public-private key pairs representing the identities of the anchor nodes and ordinary nodes of each archive, the CA is responsible for managing the identities of the anchor nodes, and the anchor nodes are responsible for managing the identities of the ordinary nodes; the online registration refers to the ordinary nodes having the right to generate identities for ordinary users, and the anchor nodes having the right to verify ordinary users; when the ordinary user registers an account, the neighboring nodes will automatically generate a public-private key pair for it, and then attach a timestamp to the public key and the area number in the node certificate to form a Token, and send a registration request for the Token to the anchor node, the Token will be recorded on the chain and a user registration and revocation list will be maintained on the chain; The purpose of the quick authentication is for the communicating parties to request the user's registration Token from the chain through the adjacent node. If the Token verification is correct, the user's identity is reliable, and the communicating parties can negotiate the session key, otherwise the communication will be interrupted.

2. The method according to claim 1, characterized in that The secure storage solution for heterogeneous archive data divides the archive data flow into transaction logs and electronic files. By extracting the archive's transaction logs and electronic files, a granularity-aware secure storage model is designed for data of different sizes to achieve secure storage of heterogeneous archive data. The solution is divided into the data and file extraction stage, the data encryption storage stage, and the electronic file distributed storage stage in real time.

3. The method according to claim 2, characterized in that The data and file extraction phase includes real-time monitoring of nodes to extract new transaction logs, record and parse transaction logs and extract archive electronic files, and complete master-slave replication; Specifically, the main database completes the transaction operation update and records the updated data details in the log file or log table; an intermediate client connection is established by opening a listening thread with the main database to extract the transaction log of the main database; the intermediate client extracts the operation log and stores it in the private network through an encrypted channel, and for operations on newly added electronic files of the archive, the electronic files are obtained by parsing the file storage path in the log and stored in the IPFS network; the slave database reproduces the transaction log stored on the blockchain according to the synchronization requirements to reconstruct the data.

4. The method according to claim 2, characterized in that: The data encryption and storage stage is based on the transaction format of BigchainDB. The log object is converted into json format and then into a string. The log characters are encrypted and ciphertext is generated. Then it is encapsulated into a blockchain transaction. Finally, the transaction is published to the blockchain and the transaction ID is obtained.

5. The method according to claim 2, characterized in that: The electronic file distributed storage stage includes parsing the extracted transaction logs, extracting the archive electronic files according to the file storage path, and if the file is larger than 64KB, storing the file on IPFS and obtaining its hash address; if it is smaller than 64KB, directly storing it; in addition, based on the parsed transaction logs, further determine the confidentiality attributes of the current archive file; if it is a public file, directly integrate and package it according to the relevant parameters; if it is a private file, encrypt it with a shared key and then integrate and package it according to the relevant parameters.

6. The method according to claim 1, characterized in that The digital archive data sharing scheme defines a method model for digital archive A to share data with target digital archive B, and also includes multiple smart contract functions, among which: Archives permission control contract: used for digital archives permission control; Archives sharing storage contract: used to store archive information shared by archives, including archive number, archives identity and sharing time; Digital identity management contract: Through democratic voting, some peer nodes within the archives are elected to realize the internal autonomy of digital identities in the digital archives alliance blockchain.

7. A blockchain-based archive data management system, characterized in that: Using the method as claimed in claim 1, comprising: The system consists of a digital archive alliance blockchain, a public blockchain and an IPFS cluster; a blockchain data archive acts as an organization in the alliance chain hyperledger, which consists of the hyperledger's master node and several ordinary nodes and is defined in the same channel.

Images