A blockchain-based shield and its trusted monitoring system

Abstract

The present disclosure discloses a blockchain-based shield and a trusted monitoring system thereof, wherein the shield includes: a key generation interface for being called by a first interface outside the shield, and a key storage unit for generating a user public key and a user private key according to a user name and a first algorithm and storing them in the shield; wherein, when the shield is registered to the blockchain, the user name is pre-checked for duplicates by a CA server, and when it is confirmed that there is no identical user name, the user name is used as the user name associated with the shield, and then the key generation interface is called by the first interface. Through a blockchain-based shield, especially how to realize a blockchain shield that can be called by an external system or an external interface, the present disclosure can significantly improve the security of the hardware entity U shield during use, and can realize a blockchain digital shield, and can be used for smart devices and other fields in the field of information security, including monitoring systems, other Web systems, etc.

Description

Technical Field

[0001] The present disclosure belongs to the field of information security, and in particular relates to a blockchain-based shield and a trusted monitoring system thereof. Background Art

[0002] With the continuous development of information technology, the problems exposed in information security are also increasing. Although U-Shield and other products have been widely used to improve security in financial fields such as securities and banks, how to enable users to operate more safely in a wider range of fields and how to reliably monitor user operations are always urgent problems to be solved. Summary of the invention

[0003] In view of this, the present disclosure discloses a blockchain-based shield, comprising:

[0004] Generate a key interface, which is used to be called by the first interface outside the shield, and generate a user public key and a user private key according to the user name and the first algorithm and store them in the key storage unit of the shield;

[0005] Among them, when the shield is registered to the blockchain, the user name is checked for duplication in advance by the CA server. When it is confirmed that there is no identical user name, the user name is used as the user name associated with the shield, and then the key generation interface is called by the first interface.

[0006] Preferably,

[0007] The shield also includes a first hash value calculation unit and a first signature unit;

[0008] The first Hash value calculation unit is used to calculate a first Hash value according to the user name and the user public key;

[0009] The first signature unit is used to generate a first digital signature for the first hash value according to the user private key.

[0010] Preferably,

[0011] The shield also includes a first sending unit;

[0012] The first sending unit sends at least the user public key and the first digital signature to the CA server via the first interface.

[0013] Preferably,

[0014] The shield also includes a certificate storage unit;

[0015] After the first interface verifies and passes the first digital signature using the public key of the CA server, the storage unit stores the user name and the user certificate generated by the CA server.

[0016] Preferably,

[0017] The shield also includes a second sending unit;

[0018] When the shield is coupled to a data processing system outside of it, at a certain time or a certain period of time, the second sending unit sends at least the user name stored in the shield, the user's operation on the data processing system, and the time information to the blockchain via the first interface for on-linking.

[0019] Preferably,

[0020] The second sending unit also sends the user's operation on the U shield to the blockchain for on-chain.

[0021] Preferably,

[0022] The shield also includes a second hash value calculation unit and a second signature unit;

[0023] The second hash value calculation unit is at least used to calculate a second hash value according to the user name stored in the shield, the user's operation on the data processing system, time information and the user public key;

[0024] The second signature unit is used to generate a second digital signature for the second hash value according to the user private key;

[0025] The second sending unit also sends the second digital signature to the blockchain for on-chain.

[0026] Preferably,

[0027] The shield can be a hardware physical USB shield or a software digital shield;

[0028] When it is a software digital shield, the digital shield at least includes one or more interfaces to interact with systems or interfaces outside the digital shield.

[0029] Through the blockchain-based shield, especially how to realize a shield that can be called by an external system or external interface, the present disclosure significantly improves the security of the U shield during use and can be used in various IT or DT fields.

[0030] Therefore, the present disclosure further discloses a blockchain-based trusted monitoring system, including:

[0031] Client, for users to log in to an application system;

[0032] The shield as described above, wherein the shield is coupled to the client;

[0033] And select the blockchain USB shield as the hardware entity shield of the shield;

[0034] The trusted monitoring system uses the blockchain technology and the shield to perform trusted monitoring on the user's operation of accessing the application system through the client.

[0035] Preferably, the system further comprises:

[0036] Blockchain service module;

[0037] U-Shield service module.

[0038] Preferably,

[0039] The blockchain service module includes CA authentication service, submission node, endorsement node, sorting node and accounting node.

[0040] Preferably,

[0041] The U-Shield service module is used to:

[0042] Provide registration services for blockchain U-Shield;

[0043] When performing important operations on the client, the current operation, user name and timestamp are sent to the blockchain U shield to encrypt and obtain the ciphertext, and then the hash value of the ciphertext is calculated, and the hash value is sent to the blockchain U shield for signing. Then the ciphertext, signature and blockchain U shield certificate are sent to the endorsement node to initiate a transaction proposal.

[0044] Preferably,

[0045] The CA authentication service provides registration services for the blockchain U shield and returns a trusted certificate for the blockchain; it assists the endorsement node in verifying whether the blockchain U shield has the right to be on the chain.

[0046] Preferably,

[0047] The endorsement node receives the transaction proposal initiated by the U-Shield service module, decrypts the certificate using the X509 parsing algorithm, obtains the client's public key, and then uses the client's public key to verify the client's signature and the client's authority. After the verification is passed, a simulated transaction is performed, and the simulated transaction result of the endorsement node is returned to the U-Shield service module.

[0048] Preferably,

[0049] When the return information of the endorsement node received by the U-Shield service module reaches a certain threshold, the transaction proposal, the simulation result of the endorsement node and the endorsement information are packaged and sent to the sorting node.

[0050] Preferably,

[0051] The sorting service sorts the information sent by the U-Shield service module and creates transaction blocks, which are broadcast to the accounting nodes;

[0052] After receiving the broadcasted transaction block, the accounting node verifies whether it meets the endorsement policy. If the verification is successful, the ledger is updated according to the transaction block.

[0053] Preferably,

[0054] The system also includes an application monitoring platform,

[0055] The application monitoring platform is used to access the ledger of the blockchain and read the information in the ledger. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of the structure of a shield in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0057] In order to make those skilled in the art understand the technical solutions disclosed in the present disclosure, the following will be combined with the embodiments and related drawings. Figure 1 , the technical solutions of various embodiments are described, and the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. The terms "first", "second", etc. used in the present disclosure are used to distinguish different objects, rather than to describe a specific order. In addition, "including" and "having" and any variations thereof are intended to cover and not exclude inclusion. For example, a process, or method, or system, or product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, systems, products or devices.

[0058] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present disclosure. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It will be understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0059] In one embodiment, the present disclosure discloses a blockchain-based shield, comprising:

[0060] Generate a key interface, which is used to be called by the first interface outside the shield, and generate a user public key and a user private key according to the user name and the first algorithm and store them in the key storage unit of the shield;

[0061] Exemplarily, the first interface is a U-shield service interface, including: interfaces provided by services corresponding to various services such as the bank's U-shield service and the U-shield service of online government offices; and the first algorithm can be the SM2 algorithm or other national secret algorithms (such as SM3, SM4) or any other non-standard or standard algorithms, etc.; more exemplary, the first algorithm can be a public and private key generation algorithm supported by a certain encryption chip itself, or a non-standard or standard public and private key algorithm generated by software, wherein, if an encryption chip is used, the interface of the encryption chip can be used as the key generation interface of the shield.

[0062] Among them, when the shield is registered to the blockchain, the user name is checked for duplication in advance by the CA server. When it is confirmed that there is no identical user name, the user name is used as the user name associated with the shield, and then the key generation interface is called by the first interface.

[0063] Thus, through the above embodiments, the present disclosure implements a blockchain-based shield, whose user name can be used as the user name associated with the shield via the blockchain and the CA server. This means that the shield can be further verified for its usage status via the blockchain. In addition, the key storage unit of the shield itself stores the user public key and the user private key generated according to the user name and the first algorithm, so that the shield can be used in a variety of secure interaction occasions. Considering that the user name is associated with the chain, a safe and reliable blockchain-based shield is finally implemented, and can be called by the first interface outside the shield. It can be understood that when the first interface is the corresponding interface of various Web Services, the shield can be used for various Web Services, thereby greatly improving the security of users using various Web Services.

[0064] In another embodiment,

[0065] The shield also includes a first hash value calculation unit and a first signature unit;

[0066] The first Hash value calculation unit is used to calculate a first Hash value according to the user name and the user public key;

[0067] The first signature unit is used to generate a first digital signature for the first hash value according to the user private key.

[0068] For the above embodiment, it provides a method of how to further utilize the hash technology of the blockchain to implement the first digital signature on the shield, thereby making the shield a product with more blockchain characteristics.

[0069] In another embodiment,

[0070] The shield also includes a first sending unit;

[0071] The first sending unit sends at least the user public key and the first digital signature to the CA server via the first interface.

[0072] It can be understood that this embodiment implements sending relevant signatures to the CA server through the first sending unit and the first interface. Exemplarily, the first interface is the U shield service interface. In this way, the shield docks with the CA server by docking with its first interface, and the first interface can be an interface for various Web Services or even various applications, which means that the shield can be widely used in various services and / or applications. It should be noted that the CA server can be a server independent of the blockchain, or it can be a CA server of the blockchain.

[0073] In another embodiment,

[0074] The shield also includes a certificate storage unit,

[0075] After the first interface verifies the first digital signature using the public key of the blockchain's CA server, the storage unit stores the user name and the user certificate generated by the blockchain's CA server.

[0076] For this embodiment, it is disclosed how the blockchain-based shield described above, as a new shield, generates and stores its user certificate.

[0077] In another embodiment,

[0078] The shield includes a national secret security chip module, and the national secret security chip includes a key generation function, and / or an encryption function, and / or a signature function.

[0079] It can be understood that when using the national secret security chip module, the blockchain-based shield can be implemented more quickly through various existing national secret security chip modules with higher integration.

[0080] In another embodiment,

[0081] The shield also includes a second sending unit;

[0082] When the shield is coupled to a data processing system outside of it, at a certain time or a certain period of time, the second sending unit sends at least the user name stored in the shield, the user's operation on the data processing system, and time information (such as a timestamp) to the blockchain via the first interface (such as the U-Shield service interface mentioned above as the first interface).

[0083] For this embodiment, it discloses how the shield interacts with the blockchain through the second sending unit when the shield is used for secure interaction with a data processing system, for example, how to upload relevant user information to the chain.

[0084] In another embodiment,

[0085] The second sending unit also sends the user's operation on the shield to the blockchain for on-chain.

[0086] It can be understood that this embodiment shows that the shield can chain the user's operations on the shield. For example, assuming that the shield includes an OK confirmation button, when the user presses the OK button once at a certain moment, this operation on the shield itself is also sent to the blockchain for chaining.

[0087] In another embodiment,

[0088] The shield also includes a second hash value calculation unit and a second signature unit;

[0089] The second hash value calculation unit is at least used to calculate a second hash value according to the user name stored in the shield, the user's operation on the data processing system, time information and the user public key;

[0090] The second signature unit is used to generate a second digital signature for the second hash value according to the user private key;

[0091] The second sending unit also sends the second digital signature to the blockchain for on-chain.

[0092] For the above embodiment, it provides a method of further utilizing the hash technology of the blockchain to implement the second digital signature on the shield, thereby making the shield a product with more blockchain characteristics and realizing the on-chain of the second digital signature.

[0093] In another embodiment,

[0094] The shield may be a hardware physical shield, but may also be a software digital shield;

[0095] When it is a software digital shield, the digital shield at least includes one or more interfaces to interact with systems or interfaces outside the digital shield.

[0096] It can be understood that, typically, the hardware physical shield can be various products with hardware interfaces, such as a hardware physical shield in the form of a USB flash drive, or a card-type one-card pass with a USB interface, or a hardware physical shield with a Bluetooth interface or an audio interface. However, it is more necessary to explain that the software digital shield can be a digital file in various formats, and its interface is implemented by adopting a digital interface for reading and writing files or other suitable API technologies, so that the software digital shield can interact with systems or interfaces outside the digital shield through access to such digital files. Obviously, the hardware physical shield generally has higher security than the software digital shield, but this does not prevent the present disclosure from adopting existing digital encryption technology or monitoring technology or other digital security technologies to improve the security of the software digital shield.

[0097] In another embodiment, see Figure 1 The blockchain-based shield described in this disclosure is a consortium chain hardware U shield based on a national secret algorithm, including:

[0098] MCU main control chip module, universal serial bus USB, national secret security chip module, Bluetooth module, screen display module, button and battery module;

[0099] The MCU main control chip module is used as the main control unit to connect the national secret security chip module, Bluetooth module, screen, buttons, and universal serial bus USB, and to parse the data sent by the channel (for example, through the universal serial bus USB, Bluetooth, etc.) and hand it over to a dedicated module for processing;

[0100] The national secret security chip module includes a corresponding processing unit and a storage unit, which are used to implement at least data storage function, key generation and management function, and encryption function;

[0101] Universal Serial Bus (USB) or Bluetooth module, used to receive / send interactive data between the external system or external interface of the shield and the U shield;

[0102] The screen display module is used to cooperate with the MCU main control chip module and the national secret security chip module to display the operation information from the user (such as account, transaction amount, etc.);

[0103] Buttons are used to cooperate with the MCU main control chip module and the national secret security chip module to implement user interaction functions (such as power on and off, confirmation, cancellation, page turning, entering digital PIN code, etc.);

[0104] The battery module is used to supply power to the USB shield.

[0105] It can be understood that this embodiment discloses a method of implementing the blockchain-based shield through the example of a specific hardware U shield.

[0106] Furthermore, in another embodiment,

[0107] When the blockchain-based shield described in the present disclosure is implemented as a digital shield, in addition to the content related to the digital shield described above, the data processing capability of the digital shield can utilize the processing capability of the CPU or other processor of the device or equipment or computer or data processing system or cloud server where the digital shield is located, or the processing capability of the external system that calls the digital shield itself; and the storage capability required by the digital shield can utilize the storage capability of the device or equipment or computer or data processing system or cloud server where the digital shield is located, or the storage capability of the external system that calls the digital shield itself; as for the interactive interface required by the digital shield, it can be implemented by accessing the I / O read and write of digital files; if it is necessary to display such an interactive process, it can be implemented by any display device that can receive the necessary information flow or data flow (for example, each other's operation information) generated in the interaction between the digital shield and the external system (or external interface), and when display is not required, the information flow or data flow generated in the interaction can also be saved as a file of a certain format (for example, a log file of the operation).

[0108] Through the blockchain-based shield disclosed in the above-mentioned embodiments, especially how to realize a shield that can be called by an external system or external interface, the present disclosure significantly improves the security of digital or physical shields during use and can be used in various IT or DT fields.

[0109] Therefore, in another embodiment, the present disclosure further discloses a blockchain-based trusted monitoring system, comprising:

[0110] The trusted monitoring system based on blockchain includes:

[0111] Client, for users to log in to an application system;

[0112] The shield as described above, wherein the shield is coupled to the client;

[0113] The trusted monitoring system uses the blockchain technology and the shield to perform trusted monitoring on the user's operation of accessing the application system through the client.

[0114] For this embodiment, the shield described above is used to implement trusted monitoring of monitored objects, including users and their operations.

[0115] Exemplarily, a blockchain USB shield is preferably used as the hardware entity shield of the shield;

[0116] Preferably, the system further comprises:

[0117] Blockchain service module;

[0118] U-Shield service module.

[0119] Preferably,

[0120] The blockchain service module includes CA authentication service, submission node, endorsement node, sorting node and accounting node.

[0121] Preferably,

[0122] The U-Shield service module is used to:

[0123] Provide registration services for blockchain U-Shield;

[0124] When performing important operations on the client, the current operation, user name and timestamp are sent to the blockchain U shield to encrypt and obtain the ciphertext, and then the hash value of the ciphertext is calculated, and the hash value is sent to the blockchain U shield for signing. Then the ciphertext, signature and blockchain U shield certificate are sent to the endorsement node to initiate a transaction proposal.

[0125] Preferably,

[0126] The CA authentication service provides registration services for the blockchain U shield and returns a trusted certificate for the blockchain; it assists the endorsement node in verifying whether the blockchain U shield has the right to be on the chain.

[0127] Preferably,

[0128] The endorsement node receives the transaction proposal initiated by the U-Shield service module, decrypts the certificate using the X509 parsing algorithm, obtains the client's public key, and then uses the client's public key to verify the client's signature and the client's authority. After the verification is passed, a simulated transaction is performed, and the simulated transaction result of the endorsement node is returned to the U-Shield service module.

[0129] Preferably,

[0130] When the return information of the endorsement node received by the U-Shield service module reaches a certain threshold, the transaction proposal, the simulation result of the endorsement node and the endorsement information are packaged and sent to the sorting node.

[0131] Preferably,

[0132] The sorting service sorts the information sent by the U-Shield service module and creates transaction blocks, which are broadcast to the accounting nodes;

[0133] After receiving the broadcasted transaction block, the accounting node verifies whether it meets the endorsement policy. If the verification is successful, the ledger is updated according to the transaction block.

[0134] Preferably,

[0135] The system also includes an application monitoring platform,

[0136] The application monitoring platform is used to access the ledger of the blockchain and read the information in the ledger.

[0137] It can be understood that the application monitoring platform can be accessed and reviewed by authorized persons to read user operations recorded in the account book.

[0138] Those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions, modules, and units involved are not necessarily required for the present invention.

[0139] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0140] In several embodiments provided in the present disclosure, it should be understood that the disclosed shield can be implemented as a corresponding functional unit, a processor or even a system, wherein the various parts of the system can be located in one place or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional unit can be integrated into a processing unit, or each unit can exist separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present disclosure is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a smart phone, a personal digital assistant, a wearable device, a laptop, a tablet computer) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage media include: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, magnetic disk or CD-ROM and other media that can store program code, and are not limited to different interfaces or transmission methods such as USB, Bluetooth or audio.

[0141] As described above, the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A blockchain-based shield for a trusted monitoring system, characterized by: The blockchain-based shield includes: Generate a key interface, which is used to be called by the first interface outside the shield, and generate a user public key and a user private key according to the user name and the first algorithm and store them in the key storage unit of the shield; When the shield is registered to the blockchain, the user name is checked for duplicates by the CA server in advance. When it is confirmed that there is no identical user name, the user name is used as the user name associated with the shield, and then the key generation interface is called by the first interface; The trusted monitoring system comprises: Client, for users to log in to the application system; The blockchain-based shield is coupled to the client, and a blockchain USB shield is selected as the hardware entity shield of the shield; Wherein, the trusted monitoring system uses the blockchain technology and the shield to perform trusted monitoring on the operation of the user accessing the application system through the client; Wherein, the trusted monitoring system further includes: Blockchain service module; U-Shield service module; The blockchain service module includes CA authentication service, submission node, endorsement node, sorting node and accounting node; The U-shield service module is used to provide registration services for the blockchain U-shield; When operating on the client, the current operation, user name and timestamp are sent to the blockchain U shield to encrypt and obtain the ciphertext, and then the hash value of the ciphertext is calculated, and the hash value is sent to the blockchain U shield for signing, and then the ciphertext, signature and blockchain U shield certificate are sent to the endorsement node to initiate a transaction proposal; The CA authentication service provides registration services for the blockchain U shield and returns a trusted certificate for the blockchain; it assists the endorsement node in verifying whether the blockchain U shield has the right to be on the chain; The endorsement node receives the transaction proposal initiated by the U-Shield service module, decrypts the certificate using the X509 parsing algorithm, obtains the client's public key, and then uses the client's public key to verify the client's signature and the client's authority. After the verification is passed, a simulated transaction is performed, and the simulated transaction result of the endorsement node is returned to the U-Shield service module; When the return information of the endorsement node received by the U-Shield service module reaches a certain threshold, the transaction proposal, the simulation result of the endorsement node and the endorsement information are packaged and sent to the sorting node; The sorting service sorts the information sent by the U-Shield service module and creates transaction blocks, which are broadcast to the accounting nodes; After receiving the broadcasted transaction block, the accounting node verifies whether the transaction block meets the endorsement policy. If the verification is successful, the ledger is updated according to the transaction block. The trusted monitoring system also includes an application monitoring platform, The application monitoring platform is used to access the ledger of the blockchain and read the information in the ledger; in, The shield also includes a first hash value calculation unit and a first signature unit; The first Hash value calculation unit is used to calculate a first Hash value according to the user name and the user public key; The first signature unit is used to generate a first digital signature for the first hash value according to the user private key; in, The shield also includes a first sending unit; The first sending unit sends at least the user public key and the first digital signature to the CA server via the first interface; in, The shield also includes a certificate storage unit; When the first interface passes the first digital signature by using the public key of the CA server for signature verification, the storage unit stores the user name and the user certificate generated by the CA server; in, The shield also includes a second sending unit; When the shield is coupled to an external data processing system, at a certain time or a certain period of time, the second sending unit sends at least the user name, the user's operation on the data processing system, and the time information stored in the shield to the blockchain via the first interface for on-chain; in, The second sending unit also sends the user's operation on the blockchain U shield to the blockchain for on-chain; in, The shield also includes a second hash value calculation unit and a second signature unit; The second hash value calculation unit is at least used to calculate a second hash value according to the user name stored in the shield, the user's operation on the data processing system, time information and the user public key; The second signature unit is used to generate a second digital signature for the second hash value according to the user private key; The second sending unit further sends the second digital signature to the blockchain for on-chain; in, The user name is used as the user associated with the shield via the blockchain and the CA server; the shield subsequently verifies the use of the shield via the blockchain; the key storage unit of the shield itself stores the user public key and the user private key generated according to the user name and the first algorithm, so that the shield can be used in a variety of secure interaction occasions; The user name is associated with the chain, realizing a safe and reliable blockchain-based shield, and can be called by the first interface outside the shield. When the first interface is the corresponding interface of various Web Services, the shield is used for various Web Services, thereby greatly improving the security of users using various Web Services.

Images