Blockchain-based data storage methods for ransomware prevention

Abstract

This invention discloses a blockchain-based anti-ransomware data backup system and data storage method. The system includes multiple target systems, an authentication gateway, and a blockchain system. The target systems are business systems requiring data backup. The authentication gateway is an independent system that connects only to the target systems and the blockchain system, used for authenticating the identities of the target systems and distinguishing data from different users through data identifiers. The blockchain system provides data storage services. Deploying the target systems, authentication gateway, and blockchain system on different clouds ensures data security. The system provided by this invention, by adding an authentication gateway between the two systems, shields external connections to the blockchain system, effectively protecting the reliability of its data storage. Furthermore, the method provided by this invention, by encrypting and encoding the backup data, ensures that data from different target systems does not interfere with each other and also avoids data leakage from the blockchain system.

Description

Technical Field

[0001] This invention belongs to the field of blockchain and data storage technology, and in particular relates to a data storage method for anti-ransomware based on blockchain. Background Technology

[0002] Ransomware is a new type of cyberattack. Unlike other attacks, it exploits operating system vulnerabilities, allowing hackers to use the system's built-in cryptographic API to generate random encryption keys. These keys are then used to encrypt critical system data before deleting the original data. Therefore, as long as a system has vulnerabilities, this attack is possible, making it practically impossible to defend against. In recent years, numerous governments and enterprises both domestically and internationally have suffered significant losses from this type of attack. There are two main countermeasures against ransomware: the first is to patch the system promptly to fix vulnerabilities. However, the existence of unknown vulnerabilities, zero-day vulnerabilities, and systems that haven't been patched in time means this strategy cannot prevent all ransomware attacks. The second strategy is to back up system data regularly. However, local backups are also vulnerable to ransomware, while remote backups may face risks such as untimely data synchronization and the potential for denial-of-service attacks. Summary of the Invention

[0003] To address the shortcomings of the existing technologies, this invention provides a blockchain-based anti-ransomware data backup system and data storage method. This system, by adding an authentication gateway between the target system and the blockchain system, shields external connections to the blockchain system, effectively protecting the reliability of data storage in the blockchain system. Furthermore, this method, by encrypting and encoding the backup data, ensures that data from different target systems do not interfere with each other and avoids data leakage caused by the blockchain system.

[0004] The first objective of this invention is to provide a blockchain-based data backup system against ransomware.

[0005] The second objective of this invention is to provide a data storage method for anti-ransomware based on blockchain.

[0006] The first objective of this invention can be achieved by adopting the following technical solution:

[0007] A blockchain-based ransomware-resistant data backup system includes multiple target systems, an authentication gateway, and a blockchain system. This system performs real-time, reliable data backup of the target systems and combats denial-of-service attacks, thus achieving data protection against ransomware.

[0008] The target system is a business system that requires data backup;

[0009] The authentication gateway is an independent system that connects only to the target system and the blockchain system. It is used to authenticate the identity of the target system and distinguish the data of different users through data identifiers.

[0010] The blockchain system includes an upper-layer blockchain operation module and an underlying blockchain network, which consists of blockchain nodes and is used to implement data storage services.

[0011] Data security is achieved by deploying multiple target systems, authentication gateways, and blockchain systems on different clouds.

[0012] Furthermore, the authentication gateway is deployed using a load balancing approach, that is, Nginx or HAProxy is deployed at the gateway.

[0013] The second objective of this invention can be achieved by adopting the following technical solution:

[0014] A blockchain-based method for storing data against ransomware, the method comprising data backup and data recovery, wherein:

[0015] The data backup includes:

[0016] The target system prepares backup data;

[0017] The target system and the authentication gateway perform two-way authentication through a connection. If authentication fails, a "failure" message is returned, and the connection is terminated; otherwise:

[0018] Upload the backup data to the authentication gateway;

[0019] The authentication gateway forwards the backup data to the blockchain system;

[0020] The blockchain system writes the backup data to the local database. If the write is successful, then:

[0021] The blockchain network returns Bi and returns the result of this data backup to the authentication gateway. At the same time, the result and Bi are written to the local database, where Bi is the position of the backup data in the local database.

[0022] The authentication gateway writes the result to its local database and returns it to the target system, and the target system writes the result to its local database.

[0023] The data recovery includes:

[0024] The target system initiates a data recovery request to the authentication gateway;

[0025] If the authentication request originating from the authentication gateway is not a legitimate target system, or if the authentication gateway's local database does not contain the data backup result corresponding to the data recovery request, then "failure" is returned, and the current connection is terminated; otherwise:

[0026] The authentication gateway sends the data backup result corresponding to the data recovery request to the blockchain system;

[0027] The blockchain system checks whether the data backup result and Bi corresponding to the data recovery request exist in the local database. If they exist, the corresponding backup data is found based on Bi, and the corresponding backup data is returned to the authentication gateway.

[0028] The authentication gateway returns the corresponding backup data to the target system, which then decodes it to restore the original backup data.

[0029] Furthermore, the backup data includes a data identifier and a data body, wherein:

[0030] The data identifier includes the user's identity identifier and backup time in the target system;

[0031] The data body is the encoded data of the data to be backed up in the target system.

[0032] Furthermore, the encoded data is obtained by encrypting the data to be backed up in the target system and then encoding the encrypted data.

[0033] Furthermore, before encrypting the data to be backed up in the target system, the data to be backed up is preprocessed to obtain preprocessed data to be backed up.

[0034] Further, the data to be backed up is preprocessed to obtain preprocessed data to be backed up, including:

[0035] If the data to be backed up consists of multiple fields, the hexadecimal character "0000FFFF" is used as a separator, and the fields are merged and connected. "0000FFFF" is then added to the end to form a string, which is the preprocessed data to be backed up.

[0036] If the data to be backed up is a file, its binary encoding, including the EOF terminator, is treated as a string, which is the preprocessed data to be backed up.

[0037] Further, let the preprocessed data to be backed up be a string M with a length of L;

[0038] The encoded data is data obtained by encrypting the data to be backed up in the target system and then encoding the encrypted data, including:

[0039] Generate a 256-bit random string R based on string M;

[0040] The public key pk of the business system is used to encrypt R using a public-key encryption algorithm in the public-private key pair (pk, sk) to obtain ciphertext C0;

[0041] Using a pseudo-random generator with R as the seed, generate an L-bit pseudo-random string S;

[0042] Let C1 = S XOR M;

[0043] Using R as the key, the message authentication code generated for CO, C1, and L is C2;

[0044] C = C0||C1||C2‖L, where C is the encoded data, i.e. the data body, and || is the string concatenation operator.

[0045] Furthermore, the public key encryption algorithm is the national standard SM2 encryption algorithm, and the message authentication code adopts a hash-based message authentication code algorithm.

[0046] Furthermore, the target system decodes the data to restore the original backup data, including:

[0047] If C does not satisfy the format C=C0||C1||C2‖L, then return "failure" and end decoding; otherwise:

[0048] Using its own sk, decrypt C0 to obtain the string R;

[0049] If string R is not a 256-bit string, return "failure" and end decoding; otherwise:

[0050] Let L1 be the bit length of C1;

[0051] The verification algorithm uses a message authentication code, with string R as the private key. If C2 is not a message authentication code of C0, C1, or L1, or L... L1, then returns "failure" and ends decoding; otherwise:

[0052] Use string R as seed and a random number generator to generate L1 bits of random number S1;

[0053] M1 = S1 XOR C1, where M1 is the original backup data.

[0054] The present invention has the following advantages over the prior art:

[0055] 1. The system provided by this invention, by adding an authentication gateway between the target system and the blockchain system, shields external connections to the blockchain system, thereby avoiding denial-of-service attacks and effectively protecting the reliability of data storage in the blockchain system.

[0056] 2. The authentication gateway in this invention is deployed using a load balancing method, which can effectively protect the blockchain system from external attacks even when a denial-of-service attack occurs.

[0057] 3. The method provided by this invention, by encrypting and encoding the backup data, can ensure that the data of different target systems do not interfere with each other and avoid data leakage caused by the blockchain system; at the same time, by leveraging the characteristics of remote backup and blockchain storage with multiple points of consistency, it can simultaneously avoid system vulnerabilities and the problem of backup data being eroded by ransomware, thus having the advantage of high security. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0059] Figure 1 This is a schematic diagram of the structural framework of a blockchain-based anti-ransomware data backup system according to an embodiment of the present invention.

[0060] Figure 2 This is a flowchart illustrating a blockchain-based anti-ransomware data storage method according to an embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It should be understood that the specific embodiments described are merely used to explain this application and are not intended to limit this application.

[0062] Example:

[0063] like Figure 1As shown, this embodiment provides a blockchain-based anti-ransomware data backup system. This system is based on a multi-cloud environment and includes multiple target systems, an authentication gateway, and a blockchain system. It is used to achieve data protection against ransomware, enabling real-time and reliable data backup of target systems and resisting denial-of-service attacks. Specifically:

[0064] The target system is a business system that requires data backup;

[0065] The authentication gateway is an independent system that only connects to the target system and the blockchain system (in practice, VPN and other technical means can be used to ensure this). It is used to authenticate the identity of the target system and to distinguish the data of different users through data identifiers. The authentication gateway is deployed in a load-balanced manner, that is, Nginx or HAProxy is deployed at the gateway. If Nginx is deployed at the gateway, a weighted round-robin method is used to determine the order in which data is sent to each node of the blockchain system.

[0066] A blockchain system consists of an upper-layer blockchain operation module and an underlying blockchain network. The blockchain network is composed of blockchain nodes. The blockchain system is used to implement data storage services and distinguishes the data of different users through data identifiers.

[0067] To achieve the goal of data security, multiple target systems, authentication gateways, and blockchain systems are deployed on different clouds.

[0068] This embodiment also provides a blockchain-based anti-ransomware data storage method, implemented based on the above system. This method includes two stages: data backup and data recovery, as detailed below. Figure 2 As shown, where:

[0069] Data backup phase:

[0070] (1) The target system prepares backup data: The backup data consists of a data identifier (id) and a data body (Data), denoted as...<id,Data> The `id` field contains user identification, backup time, and other data, while the `Data` body is the encoded data of the target system backup. The data encoding method is as follows:

[0071] (1-1) Pretreatment:

[0072] (a) If the data consists of multiple fields, use the specific hexadecimal distinguishing character "O000FFFF" as the delimiter, merge and connect them, and fill in "O000FFFF" at the end to process them as a single string.

[0073] (b) If the data is a file, it is treated as a string with its binary encoding (including the EOF terminator).

[0074] (1-2) Encoding:

[0075] (a) Let the input string be M and its length be L; generate a 256-bit random string R.

[0076] (b) Use a separate public-private key pair (pk, sk). Encrypt R using the business system's public key pk to obtain ciphertext C0. Without loss of generality, the public-key encryption algorithm can be the Chinese national standard SM2 encryption algorithm.

[0077] (c) Using a pseudo-random generator, with R as the seed, generate an L-bit pseudo-random string S.

[0078] (d) Let C1 = S XOR M, where “XOR” is the “bit-by-bit XOR” operation.

[0079] (e) Let C2 be the message authentication code generated using R as the key for CO, C1, and L. Without loss of generality, the message authentication code can be generated using the HMAC algorithm (Hash Message Authentication Code Algorithm).

[0080] (f) The encoded data is C=C0||C1||C2‖L; where “||” is a string concatenation.

[0081] (2) After the target system and the authentication gateway perform two-way authentication, the backup data C is uploaded. The authentication method follows the network authentication method (such as TLS, VPN, IPSec, etc.). If the authentication fails, "failure" is returned and the connection is terminated; otherwise, step (3) is continued.

[0082] (3) The target system forwards the backup data to the blockchain system.

[0083] (4) The blockchain system writes the backup data to the local database. If successful, the blockchain network returns Bi, where Bi is the record position (block height) of the data in the blockchain network.

[0084] (5) The blockchain system will back up the data this time.<Suc,id> Return to the authentication gateway and<Suc,id,Bi> Write to the local database.

[0085] (6) The authentication gateway will back up the data this time.<Suc,id> Return to the target system and<Suc,id> Write to the local database.

[0086] Data recovery phase:

[0087] (7) Target system initiates data recovery request ID.

[0088] (8) The authentication gateway's authentication request is initiated by a legitimate target system, and this system has been successfully backed up previously, meaning that the system exists in the local database.<Suc,id> Data. If either of the above two points is not met, return "failure" and terminate the current connection; otherwise, continue to step (9).

[0089] (9) The authentication gateway will<Suc,id> Send to the blockchain system.

[0090] (10) The blockchain system checks the existence of the local database.<Suc,id,Bi> The data is then retrieved based on the id found by Bi, and the corresponding data (Data) is then...<id,Data> Returned to the authentication gateway.

[0091] (11) The authentication gateway will<id,Data> The data is returned to the target system. The target system first decodes the Data to restore the original backup data M. The decoding process is as follows:

[0092] (11-1) If C does not satisfy the format C=C0||C1||C2||L, return "failure" and end; otherwise, continue to execute step (11-2).

[0093] (11-2) Using its own sk, decrypt C0 to obtain the string R;

[0094] If string R is not a 256-bit string, return "failure" and end; otherwise, continue to step (11-3).

[0095] (11-3) Using the message authentication code verification algorithm, with string R as private key, check whether C2 is the message authentication code of C0, C1, L1, and L=L1, where L1 is the bit length of C1. If the above two conditions are not met, return "failure" and end; otherwise, continue to execute step (11-4).

[0096] (11-4) Using string R as seed, generate an L1-bit random number S1 using a random number generator, where L1 is the bit length of C1. Let M1 = S1 XOR C1, and output M1.

[0097] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware, and the corresponding program can be stored in a computer-readable storage medium.

[0098] It should be noted that although the method operations of the above embodiments are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the order of execution of the described steps may be changed. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0099] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope disclosed in the present invention, based on the technical solution and inventive concept of the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A data storage method for ransomware protection based on blockchain, comprising a data backup system for ransomware protection based on blockchain. The system includes multiple target systems, an authentication gateway, and a blockchain system, used for real-time and reliable data backup of the target systems and to combat denial-of-service attacks, thus achieving data protection against ransomware. The target systems are business systems requiring data backup. The authentication gateway is an independent system that connects only to the target systems and the blockchain system, used for authenticating the identity of the target systems and distinguishing data from different users through data identifiers. The blockchain system includes an upper-layer blockchain operation module and an underlying blockchain network, composed of blockchain nodes, used to implement data storage services. Data security is achieved by deploying multiple target systems, the authentication gateway, and the blockchain system on different clouds. Its characteristics are as follows: The method includes data backup and data recovery, wherein: The data backup includes: The target system prepares backup data; The target system and the authentication gateway perform two-way authentication through a connection. If authentication fails, a "failure" message is returned, and the connection is terminated; otherwise: Upload the backup data to the authentication gateway; The authentication gateway forwards the backup data to the blockchain system; The blockchain system writes the backup data to the local database. If the write is successful, then: The blockchain network returns Bi and returns the result of this data backup to the authentication gateway. At the same time, the result and Bi are written to the local database, where Bi is the position of the backup data in the local database. The authentication gateway writes the result to its local database and returns it to the target system, and the target system writes the result to its local database. The data recovery includes: The target system initiates a data recovery request to the authentication gateway; If the authentication request originating from the authentication gateway is not a legitimate target system, or if the authentication gateway's local database does not contain the data backup result corresponding to the data recovery request, then "failure" is returned, and the current connection is terminated; otherwise: The authentication gateway sends the data backup result corresponding to the data recovery request to the blockchain system; The blockchain system checks whether the data backup result and Bi corresponding to the data recovery request exist in the local database. If they exist, the corresponding backup data is found based on Bi, and the corresponding backup data is returned to the authentication gateway. The authentication gateway returns the corresponding backup data to the target system, which then decodes it to restore the original backup data.

2. The data storage method according to claim 1, characterized in that, The authentication gateway is deployed using a load balancing approach, that is, Nginx or HAProxy is deployed at the gateway.

3. The data storage method according to claim 1, characterized in that, The backup data includes a data identifier and a data body, wherein: The data identifier includes the user's identity identifier and backup time in the target system; The data body is the encoded data of the data to be backed up in the target system.

4. The data storage method according to claim 3, characterized in that, The encoded data is obtained by encrypting the data to be backed up in the target system and then encoding the encrypted data.

5. The data storage method according to claim 4, characterized in that, Before encrypting the data to be backed up in the target system, the data to be backed up is preprocessed to obtain preprocessed data to be backed up.

6. The data storage method according to claim 5, characterized in that, The preprocessing of the data to be backed up to obtain preprocessed data to be backed up includes: If the data to be backed up consists of multiple fields, the hexadecimal character "0000FFFF" is used as a separator, and the fields are merged and connected. "0000FFFF" is then added to the end to form a string, which is the preprocessed data to be backed up. If the data to be backed up is a file, its binary encoding, including the EOF terminator, is treated as a string, which is the preprocessed data to be backed up.

7. The data storage method according to claim 5, characterized in that, Let the preprocessed data to be backed up be a string M with a length of L; The encoded data is data obtained by encrypting the data to be backed up in the target system and then encoding the encrypted data, including: Generate a 256-bit random string R based on string M; The public key pk of the business system is used to encrypt R using a public-key encryption algorithm in the public-private key pair (pk, sk) to obtain ciphertext C0; Using a pseudo-random generator with R as the seed, generate an L-bit pseudo-random string S; Let C1 = S XOR M; Using R as the key, the message authentication code generated for CO, C1, and L is C2; C = C0||C1||C2‖L, where C is the encoded data, i.e. the data body, and || is the string concatenation operator.

8. The data storage method according to claim 7, characterized in that, The public key encryption algorithm is the national standard SM2 encryption algorithm, and the message authentication code adopts a hash-based message authentication code algorithm.

9. The data storage method according to claim 7, characterized in that, The target system decodes the data and restores the original backup data, including: If C does not satisfy the format C=C0||C1||C2‖L, then return "failure" and end decoding; otherwise: Using its own sk, decrypt C0 to obtain the string R; If string R is not a 256-bit string, return "failure" and end decoding; otherwise: Let L1 be the bit length of C1; The verification algorithm uses a message authentication code, with string R as the private key. If C2 is not a message authentication code of C0, C1, or L1, or L... L1, then returns "failure" and ends decoding; otherwise: Use string R as seed and a random number generator to generate L1 bits of random number S1; M1 = S1 XOR C1, where M1 is the original backup data.

Images