Blockchain-based file storage method, system, and storage medium

Abstract

The present application discloses a file storage method and system based on blockchain, storage medium and computer equipment. The method includes: the first client generates a first encryption key and a first decryption key, and uses the first encryption key to encrypt a shared file; uploads the encrypted shared file to the storage network and obtains the file path; the certificate issuance center generates a second encryption key and a second decryption key; sends the second encryption key to the first client, and sends the second decryption key to the second client; the first client encrypts the first decryption key with the second encryption key, and uploads the file path and the encrypted first decryption key to the blockchain; the second client obtains the file path and the encrypted first decryption key, and uses the second decryption key to decrypt the encrypted first decryption key; obtains the encrypted shared file according to the file path, and uses the first decryption key to decrypt the encrypted shared file. The method of the present application has high storage stability and can realize directional sharing of files.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a blockchain-based file storage method and system, storage medium, and computer device. Background Art

[0002] The traditional file storage method is based on centralized server storage, which has a large maintenance workload and poor stability. In addition, the traditional file storage method lacks the file sharing targeting function and cannot be shared with specific users. Summary of the invention

[0003] In view of this, the present application provides a blockchain-based file storage method and system, storage medium and computer device, which helps to improve the stability of file storage and realize the directional storage of files.

[0004] According to one aspect of the present application, a blockchain-based file storage method is provided, comprising:

[0005] The first client randomly generates a first encryption key and a first decryption key, and uses the first encryption key to encrypt the shared file;

[0006] The first client uploads the encrypted shared file to the storage network, and obtains the file path of the encrypted shared file in the storage network;

[0007] The certificate issuing center randomly generates a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to the plurality of second clients;

[0008] The certificate issuing center sends the second encryption key to the first client, and sends the second decryption key to the second client;

[0009] The first client encrypts the first decryption key using the second encryption key, and uploads the file path and the encrypted first decryption key to the blockchain;

[0010] The second client obtains the file path and the encrypted first decryption key in the blockchain, and uses the second decryption key to decrypt the encrypted first decryption key to obtain the first decryption key;

[0011] The second client obtains the encrypted shared file in the storage network according to the file path, and decrypts the encrypted shared file using the first decryption key to obtain the shared file.

[0012] Optionally, the first client randomly generates a first encryption key and a first decryption key, and uses the first encryption key to encrypt the shared file, specifically including:

[0013] The first client randomly generates the first decryption key;

[0014] The first client generates the first encryption key corresponding to the first decryption key using elliptic cryptography;

[0015] The first client adopts the elliptic encryption method and uses the first encryption key to encrypt the shared file.

[0016] Optionally, the certificate issuing center randomly generates a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to the plurality of second clients, specifically including:

[0017] The certificate issuing center randomly generates the second encryption key;

[0018] The certificate issuing center determines at least one target attribute according to the directional sharing policy sent by the first client;

[0019] If the second client has the target attribute, the certificate issuing center generates a second decryption key corresponding to the second client.

[0020] Optionally, the method further comprises:

[0021] The certificate issuing center establishes a second client credential corresponding to each second client according to the target attribute, and establishes a second client set according to the second client credential, wherein the second client set includes a key-value pair consisting of a second client code and the second client credential;

[0022] The certificate issuing center establishes an attribute set according to the at least one target attribute, wherein the attribute set includes a key-value pair consisting of a target attribute code and an attribute revocation identifier;

[0023] Before decrypting the encrypted first decryption key using the second decryption key, the method further includes:

[0024] The second client verifies, by using the second client credential and the attribute revocation identifier, whether the authority of the second client is revoked;

[0025] If it is revoked, the decryption ends.

[0026] Optionally, the method further comprises:

[0027] The certificate issuing center parses the revocation instruction to obtain the second client to be revoked;

[0028] The certificate issuing center searches the second client set for the second client certificate to be revoked corresponding to the second client to be revoked;

[0029] The certificate issuing center searches the attribute set for an attribute revocation identifier corresponding to a target attribute to be revoked of the second client to be revoked;

[0030] The attribute revocation identifier corresponding to the target attribute to be revoked is updated according to the second client credential to be revoked.

[0031] Optionally, the first client generates the first encryption key corresponding to the first decryption key by using elliptic cryptography, specifically including:

[0032] Determine a base point G on the ellipse, and generate the first encryption key K corresponding to the first decryption key k, where K=kG;

[0033] The first client adopts the elliptic encryption method and uses the first encryption key to encrypt the shared file, specifically including:

[0034] Using the random number r, the base point G and the first encryption key K, the shared file M encoded on the ellipse is encrypted to obtain an encrypted shared file C, where C = {C1, C2} = {M + rK, rG};

[0035] The decrypting the encrypted shared file by using the first decryption key specifically includes:

[0036] The encrypted shared file C is used to obtain the shared file M encoded on the ellipse according to M=C1-kC2, and the shared file M encoded on the ellipse is decoded to obtain the shared file.

[0037] Optionally, the file path is a hash address of the file in the network storage.

[0038] According to another aspect of the present application, a blockchain-based file storage system is provided, comprising:

[0039] A first encryption module, used to randomly generate a first encryption key and a first decryption key, and encrypt the shared file using the first encryption key;

[0040] A first uploading module, used to upload the encrypted shared file to the storage network and obtain the file path of the encrypted shared file in the storage network;

[0041] A key generation module, used for randomly generating a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to the plurality of second clients;

[0042] A second uploading module, configured to send the second encryption key to the first client, and send the second decryption key to the second client;

[0043] A second encryption module, configured to encrypt the first decryption key using the second encryption key, and upload the file path and the encrypted first decryption key to the blockchain;

[0044] A first decryption module, used to obtain the file path and the encrypted first decryption key in the blockchain, and decrypt the encrypted first decryption key using the second decryption key to obtain the first decryption key;

[0045] The second decryption module is used to obtain the encrypted shared file in the storage network according to the file path, and decrypt the encrypted shared file using the first decryption key to obtain the shared file.

[0046] Optionally, the first encryption module is specifically used to:

[0047] The first client randomly generates the first decryption key;

[0048] The first client generates the first encryption key corresponding to the first decryption key using elliptic cryptography;

[0049] The first client adopts the elliptic encryption method and uses the first encryption key to encrypt the shared file.

[0050] Optionally, the key generation module is specifically used to:

[0051] The certificate issuing center randomly generates the second encryption key;

[0052] The certificate issuing center determines at least one target attribute according to the directional sharing policy sent by the first client;

[0053] If the second client has the target attribute, the certificate issuing center generates a second decryption key corresponding to the second client.

[0054] Optionally, the key generation module is further used to:

[0055] The certificate issuing center establishes a second client credential corresponding to each second client according to the target attribute, and establishes a second client set according to the second client credential, wherein the second client set includes a key-value pair consisting of a second client code and the second client credential;

[0056] The certificate issuing center establishes an attribute set according to the at least one target attribute, wherein the attribute set includes a key-value pair consisting of a target attribute code and an attribute revocation identifier;

[0057] The first decryption module is further used for:

[0058] The second client verifies, by using the second client credential and the attribute revocation identifier, whether the authority of the second client is revoked;

[0059] If it is revoked, the decryption ends.

[0060] Optionally, the key generation module is further used for:

[0061] The certificate issuing center parses the revocation instruction to obtain the second client to be revoked;

[0062] The certificate issuing center searches the second client set for the second client certificate to be revoked corresponding to the second client to be revoked;

[0063] The certificate issuing center searches the attribute set for an attribute revocation identifier corresponding to a target attribute to be revoked of the second client to be revoked;

[0064] The attribute revocation identifier corresponding to the target attribute to be revoked is updated according to the second client credential to be revoked.

[0065] Optionally, the first encryption module is specifically used to:

[0066] Determine a base point G on the ellipse, and generate the first encryption key K corresponding to the first decryption key k, where K=kG;

[0067] Using the random number r, the base point G and the first encryption key K, the shared file M encoded on the ellipse is encrypted to obtain an encrypted shared file C, where C = {C1, C2} = {M + rK, rG};

[0068] The second decryption module is specifically used for:

[0069] The encrypted shared file C is used to obtain the shared file M encoded on the ellipse according to M=C1-kC2, and the shared file M encoded on the ellipse is decoded to obtain the shared file.

[0070] Optionally, the file path is a hash address of the file in the network storage.

[0071] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned blockchain-based file storage method is implemented.

[0072] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned blockchain-based file storage method when executing the program.

[0073] By means of the above technical solution, the first client of the present application stores the encrypted shared file in the storage network, and stores the file path of the encrypted shared file in the storage network and the encrypted first decryption key in the blockchain; and the second client obtains the file path and the encrypted first decryption key from the blockchain, obtains the encrypted shared file according to the file path, and decrypts the encrypted first decryption key to obtain the first decryption key, and finally uses the first decryption key to obtain the decrypted shared file. The present application encrypts the first decryption key, and only the second client that meets the requirements can perform the decryption operation and obtain the first decryption key, so only the second client that meets the requirements can decrypt the shared file. The present application uploads the shared file to the storage network, and through the dual encryption of the shared file and the first decryption key, on the basis of improving the storage stability, file encryption and directional sharing of files are realized at the same time.

[0074] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0076] Figure 1 A flowchart of a blockchain-based file storage method provided in an embodiment of the present application is shown;

[0077] Figure 2 A schematic diagram of a process of another blockchain-based file storage method provided in an embodiment of the present application is shown;

[0078] Figure 3A schematic diagram of a process of another blockchain-based file storage method provided in an embodiment of the present application is shown;

[0079] Figure 4 A schematic diagram of a process of another blockchain-based file storage method provided in an embodiment of the present application is shown;

[0080] Figure 5 A structural block diagram of a blockchain-based file storage system provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0081] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0082] In this embodiment, a file storage method based on blockchain is provided. Figure 1 As shown, the method includes:

[0083] Step 101: The first client randomly generates a first encryption key and a first decryption key, and encrypts a shared file using the first encryption key;

[0084] The blockchain-based file storage method provided in the embodiment of the present application can limit the access rights of the file, so the shared file can be encrypted first before storing the shared file.

[0085] Specifically, the first client can be used to randomly generate a first encryption key and a first decryption key corresponding to the first encryption key, and the first encryption key can be used to encrypt the shared file. The first encryption key is a public key that can encrypt the shared file; and the first decryption key is a private key that can decrypt the shared file encrypted by the public key.

[0086] In this embodiment, the first encryption key and the first decryption key can be generated according to encryption algorithms such as RSA (Ron Rivest, Adi Shamir, Leonard Adleman) algorithm and ECC (Elliptic Curves Cryptography) algorithm, which are not limited here.

[0087] Step 102, the first client uploads the encrypted shared file to the storage network, and obtains the file path of the encrypted shared file in the storage network;

[0088] In this embodiment, the shared file encrypted by the first encryption key is uploaded to the storage network, and the location of the shared file in the storage network is obtained as the file path of the shared file. The encrypted shared file can be accessed through the file path.

[0089] Furthermore, the storage network consists of two parts. The encrypted first decryption key and file path are stored in the blockchain network, and the encrypted shared files are stored in the file storage network, wherein the file storage network adopts a distributed storage method.

[0090] Step 103: The certificate issuing center randomly generates a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to the plurality of second clients;

[0091] In this embodiment, the certificate issuing center randomly generates a second encryption key and a second decryption key corresponding to the second encryption key, wherein the second encryption key is a public key and the second decryption key is a private key.

[0092] Optionally, the second decryption key may be one or more.

[0093] Step 104: The certificate issuing center sends the second encryption key to the first client and sends the second decryption key to the second client;

[0094] In this embodiment, the certificate issuing center sends the second encryption key and the second decryption key to the first client and the second client respectively, so that the first client can use the second encryption key to perform encryption operations, and the second client can use the second decryption key to perform decryption operations to decrypt the files encrypted by the first client.

[0095] Step 105: The first client encrypts the first decryption key using the second encryption key, and uploads the file path and the encrypted first decryption key to the blockchain;

[0096] In this embodiment, the first client uses the second encryption key to encrypt the first decryption key to obtain the encrypted first decryption key. At this time, the encrypted first decryption key can only be decrypted by the second decryption key, thereby ensuring that the second client without the second decryption key cannot decrypt the first decryption key, and thus cannot use the first decryption key to decrypt the shared file.

[0097] Furthermore, the file path and the encrypted first decryption key are uploaded to the blockchain. Since the blockchain is tamper-proof, it can be ensured that the file path and the encrypted first decryption key will not be maliciously tampered with. At the same time, since the blockchain is open, each second client can obtain the file path and the encrypted first decryption key.

[0098] Step 106, the second client obtains the file path and the encrypted first decryption key in the blockchain, and uses the second decryption key to decrypt the encrypted first decryption key to obtain the first decryption key;

[0099] In this embodiment, since the blockchain has an open nature, the second client can obtain the file path and the encrypted first decryption key in the blockchain. Then the second client uses the second decryption key corresponding to the second encryption key to decrypt the first decryption key encrypted by the second encryption key to obtain the first decryption key.

[0100] Step 107: The second client obtains the encrypted shared file in the storage network according to the file path, and decrypts the encrypted shared file using the first decryption key to obtain the shared file.

[0101] In this embodiment, after obtaining the file path, the second client obtains the encrypted shared file according to the file path. Then, the second client uses the first decryption key corresponding to the first encryption key to decrypt the shared file encrypted by the first encryption key to obtain the shared file.

[0102] By applying the technical solution of this embodiment, the first client stores the encrypted shared file in the storage network, and stores the file path of the encrypted shared file in the storage network and the encrypted first decryption key in the blockchain; and the second client obtains the file path and the encrypted first decryption key from the blockchain, obtains the encrypted shared file according to the file path, and decrypts the encrypted first decryption key to obtain the first decryption key, and finally uses the first decryption key to obtain the decrypted shared file. This application encrypts the first decryption key, and only the second client that meets the requirements can perform the decryption operation and obtain the first decryption key. Therefore, only the second client that meets the requirements can decrypt the shared file. This application uploads the shared file to the storage network, and through the dual encryption of the shared file and the first decryption key, it realizes file encryption and directional sharing of files on the basis of improving storage stability.

[0103] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another file storage method based on blockchain is provided, such as Figure 2 As shown, in this method, the first client randomly generates a first encryption key and a first decryption key, and uses the first encryption key to encrypt the shared file, which specifically includes:

[0104] Step 201: The first client randomly generates a first decryption key;

[0105] Step 202, the first client generates a first encryption key corresponding to the first decryption key using elliptic cryptography;

[0106] Step 203: The first client uses elliptic cryptography to encrypt the shared file using a first encryption key.

[0107] In this embodiment, the first client generates a first encryption key corresponding to the first decryption key using elliptic cryptography, also known as ECC (Elliptic Curves Cryptography) algorithm, and encrypts the shared file using the first encryption key to obtain the encrypted shared file. Elliptic cryptography is an asymmetric encryption algorithm based on elliptic curve mathematical theory.

[0108] Furthermore, if Figure 3 As shown, in another blockchain-based file storage method, the certificate issuing center randomly generates a second encryption key and multiple second decryption keys, wherein the multiple second decryption keys correspond one-to-one to the multiple second clients, specifically including:

[0109] Step 301, the certificate issuing center randomly generates a second encryption key;

[0110] Step 302: The certificate issuing center determines at least one target attribute according to the directional sharing policy sent by the first client.

[0111] In this embodiment, the first client sends a directional sharing policy according to actual needs, and the certificate authority determines at least one target attribute according to the directional sharing policy. The second client with the target attribute is the sharing object of the first client, and the first client believes that the second client can access the shared file.

[0112] For example, if the first client sends a directional sharing policy "shared files are only available to the School of Information", the certificate authority can determine the target attribute "affiliated to the School of Information" accordingly. At this time, the first client believes that only the second client affiliated to the School of Information can access the shared files.

[0113] Step 303: If the second client has the target attribute, the certificate issuing center generates a second decryption key corresponding to the second client.

[0114] In this embodiment, if the second client has the target attribute, it can be considered that the first client allows the second client to access the shared file. At this time, the certificate authority can use the attribute encryption algorithm, namely the ABE (Attribute-Based Encryption) algorithm, to generate a second decryption key UK corresponding to the second encryption key PK.

[0115] Furthermore, in another blockchain-based file storage method, the method further includes:

[0116] Step 401: The certificate issuing center establishes a second client certificate corresponding to each second client according to the target attribute, and establishes a second client set according to the second client certificate, wherein the second client set includes a key-value pair consisting of a second client code and a second client certificate;

[0117] In this embodiment, the official issuing center establishes a second client certificate prime for each client with the target attribute, and establishes a second client set map1 according to the second client certificate prime.<userGID,prime> , wherein userGID is the second client code, and prime is the second client credential, that is, the second client set map1 includes a key-value pair consisting of userGID and prime.

[0118] Step 402: the certificate issuing center establishes an attribute set according to at least one target attribute, wherein the attribute set includes a key-value pair consisting of a target attribute code and an attribute revocation identifier;

[0119] In this embodiment, the certificate issuing center establishes an attribute set map2 according to the target attribute.<att,list> , where att is the target attribute and list is the attribute revocation identifier. List can be used to identify whether the second client containing the target attribute has the authority to access the shared file, that is, the attribute set map2 includes a key-value pair consisting of att and list.

[0120] Before decrypting the encrypted first decryption key using the second decryption key, the method further includes:

[0121] Step 403, the second client verifies whether the permission of the second client is revoked using the second client credential and the attribute revocation identifier;

[0122] In this embodiment, list%prime is calculated to determine whether the permission of the second client is revoked. Specifically, if the calculation result is not 0, it indicates that the permission of the second client is not revoked; if the calculation result is 0, it indicates that the permission of the second client has been revoked.

[0123] Through this method, if the first client changes the directional sharing strategy, it only needs to set the list value corresponding to the target attribute att, without regenerating the second client set and attribute set. For example, if the first client no longer wants the second client belonging to the School of Information to view the shared file, it only needs to set the list value corresponding to the target attribute "belongs to the School of Information".

[0124] Step 404: If it is revoked, the decryption ends.

[0125] In this embodiment, if the authority of the second client has been revoked, it means that the first client does not want the second client to access the shared file, so the decryption ends, and the second client cannot complete the decryption operation even if it holds the second decryption key.

[0126] Furthermore, in another blockchain-based file storage method, the method further includes:

[0127] Step 501: The certificate issuing center parses the revocation instruction and obtains the second client to be revoked;

[0128] In this embodiment, when a target attribute (ie, a revocation instruction) is revoked for the second client, the certificate issuing center parses the corresponding revocation instruction to obtain the second client to be revoked.

[0129] For example, if a second client no longer belongs to the School of Information, the attribute of "belonging to the School of Information" will be revoked for the second client.

[0130] Step 502: The certificate issuing center searches the second client set for the second client certificate to be revoked corresponding to the second client to be revoked;

[0131] Step 503: The certificate issuing center searches the attribute set for the attribute revocation identifier corresponding to the target attribute to be revoked of the second client to be revoked;

[0132] In this embodiment, the certificate authority respectively takes out the second client credential prime to be revoked corresponding to the second client to be revoked and the attribute revocation identifier list corresponding to the target attribute to be revoked from the second client set map1<user, prime> and the attribute set map2<att, list>.

[0133] Step 504: update the attribute revocation identifier corresponding to the target attribute to be revoked according to the second client credential to be revoked.

[0134] In this embodiment, the attribute revocation identifier corresponding to the target attribute to be revoked is updated according to list'=list×prime, and the updated attribute identifier no longer includes the second client to be revoked.

[0135] Furthermore, in another blockchain-based file storage method, the first client uses elliptic cryptography to generate a first encryption key corresponding to the first decryption key, specifically including:

[0136] Step 601, determine a base point G on the ellipse, and generate a first encryption key K corresponding to a first decryption key k, where K=kG;

[0137] In this embodiment, an elliptic curve is selected, and a point on the elliptic curve is taken as the base point G. The first client randomly generates a private key, that is, the first decryption key k, and generates a public key, that is, the first encryption key K = kG.

[0138] The first client uses the elliptic encryption method to encrypt the shared file using the first encryption key, specifically including:

[0139] Step 602, using the random number r, the base point G, and the first encryption key K, encrypt the shared file M encoded on the ellipse to obtain the encrypted shared file C, where C = {C1, C2} = {M + rK, rG};

[0140] In this embodiment, the first client encodes the plaintext of the shared file into a point on the elliptic curve to obtain the file M, and randomly selects an integer r, where r < n, and n is the order of G. The first client uses the random number r to encrypt the plaintext shared file to obtain the ciphertext C, that is, the encrypted shared file. Among them, the ciphertext is a point pair, C = {rG, M + rK}.

[0141] Using the first decryption key to decrypt the encrypted shared file, specifically including:

[0142] Step 603, using the encrypted shared file C, according to M = C1 - kC2, obtain the shared file M encoded on the ellipse, and decode the shared file M encoded on the ellipse to obtain the shared file.

[0143] In this embodiment, first calculate C1 = M + rK, C2 = rG. Since C1 - kC2 = M + rK - k(rG) = M + rkG - krG = M, calculating C1 - kC2 can obtain the plaintext encoding M of the shared file on the elliptic curve. Decoding M can obtain the shared file.

[0144] Further, in another blockchain-based file storage method, the file path is the hash address of the file in network storage.

[0145] In this embodiment, the hash address of the encrypted shared file in the network path is used as the file path, rather than directly using the storage address of the encrypted shared file. Utilizing the irreversible characteristic of the hash, the true address of the encrypted shared file is hidden, improving the security of storage.

[0146] Further, as Figure 4As shown, in another file storage method based on blockchain, the user sends the original shared file through the client (here the first client), the user's attributes are stored in the first client, and after the user uploads the file, the first client will automatically upload the shared file encrypted by ECC to the storage system. Among them, the first client sends the encrypted shared file to the file storage system, and obtains the hash address of the shared file from the storage network as the file path. After obtaining the hash address of the shared file, the first client stores the hash address of the shared file (that is, the file path) and the private key encrypted based on the attribute decryption (that is, the encrypted first decryption key) in pairs in the blockchain node. The receiving user obtains the file path and the encrypted first decryption key in the blockchain through the client (this time the second client), obtains the encrypted shared file using the file path, and obtains the original shared file using the encrypted first decryption key and the encrypted shared file.

[0147] Furthermore, as a specific implementation of the above-mentioned blockchain-based file storage method, the present application embodiment provides a blockchain-based file storage system, such as Figure 5 As shown, the system includes: a first encryption module, a first upload module, a key generation module, a second upload module, a second encryption module, a first decryption module and a second decryption module.

[0148] A first encryption module, used to randomly generate a first encryption key and a first decryption key, and encrypt the shared file using the first encryption key;

[0149] The first uploading module is used to upload the encrypted shared file to the storage network and obtain the file path of the encrypted shared file in the storage network;

[0150] A key generation module, used for randomly generating a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to the plurality of second clients;

[0151] A second uploading module, used to send the second encryption key to the first client and send the second decryption key to the second client;

[0152] A second encryption module, used to encrypt the first decryption key using the second encryption key, and upload the file path and the encrypted first decryption key to the blockchain;

[0153] A first decryption module, used to obtain a file path and an encrypted first decryption key in the blockchain, and decrypt the encrypted first decryption key using a second decryption key to obtain the first decryption key;

[0154] The second decryption module is used to obtain the encrypted shared file in the storage network according to the file path, and decrypt the encrypted shared file using the first decryption key to obtain the shared file.

[0155] In a specific application scenario, optionally, the first encryption module is specifically used to:

[0156] The first client randomly generates a first decryption key;

[0157] The first client generates a first encryption key corresponding to the first decryption key using elliptic cryptography;

[0158] The first client uses elliptic cryptography to encrypt the shared file using a first encryption key.

[0159] In a specific application scenario, optionally, the key generation module is specifically used to:

[0160] The certificate issuing center randomly generates a second encryption key;

[0161] The certificate issuing center determines at least one target attribute according to the directional sharing policy sent by the first client;

[0162] If the second client has the target attribute, the certificate issuing center generates a second decryption key corresponding to the second client.

[0163] In a specific application scenario, optionally, the key generation module is also used to:

[0164] The certificate issuing center establishes a second client certificate corresponding to each second client according to the target attribute, and establishes a second client set according to the second client certificate, wherein the second client set includes a key-value pair consisting of a second client code and a second client certificate;

[0165] The certificate issuing center establishes an attribute set according to at least one target attribute, wherein the attribute set includes a key-value pair consisting of a target attribute code and an attribute revocation identifier;

[0166] The first decryption module is further used for:

[0167] The second client verifies, using the second client credential and the attribute revocation identifier, whether the authority of the second client is revoked;

[0168] If it is revoked, the decryption ends.

[0169] In a specific application scenario, optionally, the key generation module is also used to:

[0170] The certificate issuing center parses the revocation instruction and obtains the second client to be revoked;

[0171] The certificate issuing center searches the second client set for the second client certificate to be revoked corresponding to the second client to be revoked;

[0172] The certificate issuing center searches the attribute set for an attribute revocation identifier corresponding to the target attribute to be revoked of the second client to be revoked;

[0173] An attribute revocation identifier corresponding to the target attribute to be revoked is updated according to the second client credential to be revoked.

[0174] In a specific application scenario, optionally, the first encryption module is specifically used to:

[0175] Determine a base point G on the ellipse and generate a first encryption key K corresponding to the first decryption key k, where K=kG;

[0176] Using the random number r, the base point G and the first encryption key K, the shared file M encoded on the ellipse is encrypted to obtain the encrypted shared file C, where C = {C1, C2} = {M + rK, rG};

[0177] The second decryption module is specifically used for:

[0178] The encrypted shared file C is used to obtain the shared file M encoded on the ellipse according to M=C1-kC2, and the shared file M encoded on the ellipse is decoded to obtain the shared file.

[0179] In a specific application scenario, optionally, the file path is a hash address of the file in the network storage.

[0180] It should be noted that for other corresponding descriptions of the functional modules involved in the blockchain-based file storage system provided in the embodiment of the present application, please refer to Figures 1 to 4 The corresponding description in will not be repeated here.

[0181] Based on the above Figures 1 to 4 The method shown in the embodiment of the present application accordingly provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned Figures 1 to 3 The blockchain-based file storage method shown.

[0182] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0183] Based on the above Figures 1 to 4 The method shown, and Figure 5 In order to achieve the above-mentioned purpose, the embodiment of the present application further provides a computer device, which can be a personal computer, a server, a network device, etc. The computer device includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to achieve the above-mentioned Figures 1 to 4 The blockchain-based file storage method shown.

[0184] Optionally, the computer device may further include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display, an input unit such as a keyboard, etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a Bluetooth interface, a WI-FI interface), etc.

[0185] Those skilled in the art will appreciate that the computer device structure provided in this embodiment does not limit the computer device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0186] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages and saves the hardware and software resources of the computer device, and supports the operation of information processing programs and other software and / or programs. The network communication module is used to realize communication between the components inside the storage medium, and communication with other hardware and software in the physical device.

[0187] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform, or by hardware.

[0188] Those skilled in the art will appreciate that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the units or processes in the accompanying drawings are not necessarily necessary for implementing the present application. Those skilled in the art will appreciate that the units in the system in the implementation scenario can be distributed in the system of the implementation scenario according to the implementation scenario description, or can be changed accordingly and located in one or more systems different from the present implementation scenario. The units of the above-mentioned implementation scenario can be combined into one unit, or can be further split into multiple sub-units.

[0189] The above serial numbers of this application are only for description and do not represent the advantages and disadvantages of the implementation scenarios. The above disclosure is only a few specific implementation scenarios of this application, but this application is not limited to them, and any changes that can be thought of by technicians in this field should fall within the scope of protection of this application.

Claims

1. A file storage method based on blockchain, characterized in that: The method comprises: The first client randomly generates a first encryption key and a first decryption key, and uses the first encryption key to encrypt the shared file; The first client uploads the encrypted shared file to the storage network, and obtains the file path of the encrypted shared file in the storage network; The certificate issuing center randomly generates a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to a plurality of second clients, including: the certificate issuing center randomly generates the second encryption key, determines at least one target attribute according to the directional sharing policy sent by the first client, and if the second client has the target attribute, the certificate issuing center generates a second decryption key corresponding to the second client; The certificate issuing center sends the second encryption key to the first client and sends the second decryption key to the second client; establishes a second client credential corresponding to each second client according to the target attribute, and establishes a second client set according to the second client credential, wherein the second client set includes a key-value pair consisting of a second client code and the second client credential; establishes an attribute set according to the at least one target attribute, wherein the attribute set includes a key-value pair consisting of a target attribute code and an attribute revocation identifier; The first client encrypts the first decryption key using the second encryption key, and uploads the file path and the encrypted first decryption key to the blockchain; The second client obtains the file path and the encrypted first decryption key in the blockchain, and uses the second client credential and the attribute revocation identifier to verify whether the permission of the second client is revoked; if it is revoked, decryption ends; otherwise, the encrypted first decryption key is decrypted using the second decryption key to obtain the first decryption key; The second client obtains the encrypted shared file in the storage network according to the file path, and decrypts the encrypted shared file using the first decryption key to obtain the shared file.

2. The file storage method according to claim 1, characterized in that: The first client randomly generates a first encryption key and a first decryption key, and uses the first encryption key to encrypt the shared file, specifically including: The first client randomly generates the first decryption key; The first client generates the first encryption key corresponding to the first decryption key using elliptic cryptography; The first client adopts the elliptic encryption method and uses the first encryption key to encrypt the shared file.

3. The file storage method according to claim 1, characterized in that: The method further comprises: The certificate issuing center parses the revocation instruction to obtain the second client to be revoked; The certificate issuing center searches the second client set for the second client certificate to be revoked corresponding to the second client to be revoked; The certificate issuing center searches the attribute set for an attribute revocation identifier corresponding to a target attribute to be revoked of the second client to be revoked; The attribute revocation identifier corresponding to the target attribute to be revoked is updated according to the second client credential to be revoked.

4. The file storage method according to claim 2, characterized in that: The first client generates the first encryption key corresponding to the first decryption key by using elliptic cryptography, specifically including: Determine a base point G on the ellipse, and generate the first encryption key K corresponding to the first decryption key k, where K=kG; The first client adopts the elliptic encryption method and uses the first encryption key to encrypt the shared file, specifically including: Using the random number r, the base point G and the first encryption key K, the shared file M encoded on the ellipse is encrypted to obtain an encrypted shared file C, where C={C1,C2}={M+rK,rG}; The decrypting the encrypted shared file by using the first decryption key specifically includes: The encrypted shared file C is used to obtain the shared file M encoded on the ellipse according to M=C1-kC2, and the shared file M encoded on the ellipse is decoded to obtain the shared file.

5. The file storage method according to claim 1, characterized in that: The file path is a hash address of the file in the network storage.

6. A file storage system based on blockchain, characterized in that: The system comprises: A first encryption module, used for the first client to randomly generate a first encryption key and a first decryption key, and to encrypt a shared file using the first encryption key; A first uploading module, used to upload the encrypted shared file to the storage network and obtain the file path of the encrypted shared file in the storage network; A key generation module, used for the certificate issuing center to randomly generate a second encryption key and a plurality of second decryption keys, wherein the plurality of second decryption keys correspond one-to-one to the plurality of second clients; A second uploading module, configured to send the second encryption key to the first client, and send the second decryption key to the second client; A second encryption module, configured to encrypt the first decryption key using the second encryption key, and upload the file path and the encrypted first decryption key to the blockchain; A first decryption module, used to obtain the file path and the encrypted first decryption key in the blockchain, and use the second decryption key to decrypt the encrypted first decryption key to obtain the first decryption key; a second decryption module, configured to obtain the encrypted shared file in the storage network according to the file path, and decrypt the encrypted shared file using the first decryption key to obtain the shared file; The key generation module is specifically used for: the certificate issuing center determines at least one target attribute according to the directional sharing policy sent by the first client; if the second client has the target attribute, the certificate issuing center generates a second decryption key corresponding to the second client; The key generation module is further used for: the certificate issuing center to establish a second client credential corresponding to each second client according to the target attribute, and to establish a second client set according to the second client credential, wherein the second client set includes a key-value pair consisting of a second client code and the second client credential; the certificate issuing center to establish an attribute set according to the at least one target attribute, wherein the attribute set includes a key-value pair consisting of a target attribute code and an attribute revocation identifier; The first decryption module is further used for: the second client uses the second client credential and the attribute revocation identifier to verify whether the permission of the second client is revoked; if it is revoked, the decryption ends.

7. A readable storage medium having a program or instruction stored thereon, characterized in that: When the program or instruction is executed by a processor, the steps of the file storage method according to any one of claims 1 to 5 are implemented.

8. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the program, the file storage method according to any one of claims 1 to 5 is implemented.

Images