A confidential file authorization method, device, system, equipment and storage medium

Abstract

The present application relates to a method, device, system, equipment and storage medium for authorizing confidential files, wherein the method includes: obtaining a confidential file reading application sent by a client, the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from U-KEY; obtaining confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; after determining that the user certificate information and the user verification information match, obtaining the confidential file corresponding to the confidential file authorization information from the Interstellar File System according to the hash value of the confidential file; and sending the confidential file to the client. This method stores the user certificate information in U-KEY, the hash value of the confidential file in the blockchain, and the confidential file in the Interstellar File System, thereby improving the security of confidential files during the authorized viewing process and preventing confidential files from being illegally stolen.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a confidential file authorization method, device, system, equipment and storage medium. Background Art

[0002] The authorized access system for confidential documents has a wide range of application scenarios in the fields of distribution and access of confidential documents, authorized access to confidential archives, etc.

[0003] Traditionally, confidential files are stored in file servers, and authorization information is stored in databases. Confidential file authorization systems are often built by associating user IDs with authorization information. This poses risks such as confidential files being directly stolen, authorization information being intercepted, and users being unable to view confidential files. Summary of the invention

[0004] In order to solve the problem of how to ensure the security of confidential documents during the authorized viewing process, the present application provides a confidential document authorization method, device, system, equipment and storage medium.

[0005] In a first aspect, the present application provides a confidential file authorization method, which is applied to a server, and the method includes:

[0006] Obtaining a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from U-KEY;

[0007] Obtaining confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information;

[0008] After determining that the user certificate information matches the user verification information, obtaining the confidential file corresponding to the confidential file authorization information from the Interstellar File System according to the hash value of the confidential file;

[0009] Sending the confidential file to the client;

[0010] Optionally, the user certificate information includes first identification information; the first identification information is used to indicate the confidential file corresponding to the confidential file reading application;

[0011] Obtaining confidential file authorization information from the blockchain according to the confidential file reading application, including:

[0012] According to the confidential file reading application, target information carrying second identification information is obtained from the blockchain, and the target information is used as the confidential file authorization information; the second identification information is the same as the first identification information;

[0013] Optionally, obtaining the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file includes:

[0014] Obtaining a first encrypted file corresponding to the confidential file authorization information from the Interstellar File System;

[0015] Decrypting the first encrypted file according to the hash value of the confidential file to obtain the confidential file;

[0016] Optionally, sending the confidential file to the client includes:

[0017] Encrypting the confidential file according to the user certificate information to obtain a second encrypted file;

[0018] The second encrypted file is sent to the client.

[0019] In a second aspect, the present application provides a confidential file authorization method, which is applied to a client, and the method includes:

[0020] Obtaining an input confidential file reading request; obtaining user certificate information from U-KEY according to the confidential file reading request;

[0021] Generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; the confidential file reading application carries the user certificate information; so that the server obtains confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used for the server to obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file after determining that the user certificate information and the user verification information match;

[0022] Get the confidential file returned by the server.

[0023] In a third aspect, the present application provides a confidential file authorization device, which is applied to a server, and the device includes:

[0024] A first acquisition module is used to acquire a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is acquired by the client from U-KEY;

[0025] A second acquisition module is used to obtain confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information;

[0026] A third acquisition module is used to obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file after determining that the user certificate information and the user verification information match;

[0027] A sending module is used to send the confidential file to the client.

[0028] In a fourth aspect, the present application provides a confidential file authorization device, which is applied to a client, and the device includes:

[0029] The fourth acquisition module is used to acquire an input confidential file reading request; and acquire user certificate information from U-KEY according to the confidential file reading request;

[0030] A generation module, used to generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; the confidential file reading application carries the user certificate information; so that the server obtains confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used for the server to determine that the user certificate information and the user verification information match, and then obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file;

[0031] The return module is used to obtain the confidential files returned by the server.

[0032] In a fifth aspect, the present application provides a confidential file authorization system, the system comprising a server, a client, a U-KEY, an interplanetary file system and a blockchain;

[0033] The server is used to obtain a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from the U-KEY; confidential file authorization information is obtained from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; after determining that the user certificate information and the user verification information match, the confidential file corresponding to the confidential file authorization information is obtained from the InterPlanetary File System according to the hash value of the confidential file; and the confidential file is sent to the client;

[0034] The client is used to obtain an input confidential file reading request; obtain user certificate information from the U-KEY according to the confidential file reading request; generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; and obtain the confidential file returned by the server.

[0035] In a sixth aspect, the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0036] Memory, used to store computer programs;

[0037] The processor is used to implement the steps of the confidential file authorization method described in any embodiment of the first aspect when executing the program stored in the memory.

[0038] In a seventh aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the confidential file authorization method as described in any one of the embodiments of the first aspect.

[0039] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art:

[0040] The method provided by the embodiment of the present application is applied to the server, including: obtaining a confidential file reading application sent by the client, the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from U-KEY; obtaining confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; after determining that the user certificate information and the user verification information match, obtaining the confidential file corresponding to the confidential file authorization information from the interstellar file system according to the hash value of the confidential file; and sending the confidential file to the client. In this method, the user certificate information is stored in U-KEY, the hash value of the confidential file is stored in the blockchain, and the confidential file is stored in the interstellar file system. The server obtains the confidential file authorization information from the blockchain according to the confidential file reading application sent by the client, and obtains the confidential file from the interstellar file system according to the hash value of the confidential file in the confidential file authorization information, thereby improving the security of the confidential file in the authorized viewing process and preventing the confidential file from being illegally stolen. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 A system architecture diagram of a confidential file authorization method provided for one embodiment of the present application;

[0044] Figure 2 A flowchart of a confidential file authorization method provided for an embodiment of the present application;

[0045] Figure 3 A flowchart of a confidential file authorization method provided in another embodiment of the present application;

[0046] Figure 4 A flowchart of a confidential file authorization method provided in another embodiment of the present application;

[0047] Figure 5 A schematic diagram of the structure of a confidential document authorization device provided in one embodiment of the present application;

[0048] Figure 6 A schematic diagram of the structure of a confidential document authorization device provided in another embodiment of the present application;

[0049] Figure 7 A schematic diagram of the structure of an electronic device provided in accordance with an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0051] The first embodiment of the present application provides a method for authorizing confidential files. The method can be applied to Figure 1The system architecture shown includes at least a server 101, a client 102, a U-KEY 103, an interplanetary file system 104 and a blockchain 105. The server 101 and the client 102, the interplanetary file system 104 and the blockchain 105 establish communication connections, and the client 102 establishes a connection with the U-KEY 103.

[0052] InterPlanetary File System (IPFS) is used to store confidential files. U-KEY, the full name of USB KEY, is a hardware storage device with a USB interface, which stores a single-chip microcomputer or a smart card chip. USB KEY has a certain storage space for storing user certificate information and user private keys. U-KEY can be connected to the client 102 only when in use to improve security. Blockchain 105 does not limit the type of blockchain, as long as it can support smart contracts.

[0053] The server 101 is used to obtain the confidential file reading application sent by the client 102. The confidential file reading application carries user certificate information. The user certificate information is obtained by the client 102 from the U-KEY 103. The confidential file authorization information is obtained from the blockchain 105 according to the confidential file reading application. The confidential file authorization information includes the user verification information and the hash value of the confidential file corresponding to the confidential file authorization information. After determining that the user certificate information and the user verification information match, the confidential file corresponding to the confidential file authorization information is obtained from the IPFS 104 according to the hash value of the confidential file, and the confidential file is sent to the client 102;

[0054] The client 102 is used to obtain an input confidential file reading request, obtain user certificate information from U-KEY103 according to the confidential file reading request, generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server 101 to obtain the confidential file returned by the server 101.

[0055] In this system architecture, user certificate information is stored in U-KEY103, confidential file authorization information (including user verification information and the hash value of the confidential file corresponding to the confidential file authorization information) is stored in blockchain 105, and confidential files are stored in IPFS104. Client 102 applies to server 101 to read confidential files. At this time, client 102 needs to obtain user certificate information from U-KEY103 and submit it to server 101. After receiving the confidential file reading application sent by client 102, server 101 obtains the user verification information of the user's confidential file and the hash value of the confidential file from blockchain 105. After server 101 confirms the user verification information, it obtains the confidential file from IPFS104 through the hash value of the confidential file and returns the file to client 102. The advantages of U-KEY103, IPFS104 and blockchain 105 in secure storage of confidential files and non-interception of confidential information are fully utilized, which can greatly improve the security of authorized reading of confidential files and effectively enhance the security of confidential files and authorization processes.

[0056] Next, the confidential file authorization method is described in detail based on the system architecture. The confidential file authorization method can be applied to the server 101 of the system architecture, and can also be applied to the client 102 of the system architecture.

[0057] When applied to the server 101, such as Figure 2 , the confidential file authorization methods include:

[0058] Step 201, obtaining a confidential file reading application sent by a client, the confidential file reading application carries user certificate information, and the user certificate information is obtained by the client from U-KEY.

[0059] Step 202: Obtain confidential file authorization information from the blockchain according to the confidential file reading application. The confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information.

[0060] Step 203, after determining that the user certificate information and the user verification information match, obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file.

[0061] In one embodiment, a confidential file corresponding to confidential file authorization information is obtained from the Interplanetary File System based on a hash value of the confidential file, including: obtaining a first encrypted file corresponding to the confidential file authorization information from the Interplanetary File System, and decrypting the first encrypted file based on the hash value of the confidential file to obtain the confidential file.

[0062] In this embodiment, the confidential files stored in IPFS104 cannot be read directly and need to be decrypted by the hash value of the authorized file stored in the blockchain. The confidential files and the hash values ​​of the confidential files are stored in IPFS104 and blockchain 105 respectively, thereby improving the security of the confidential file authorization process.

[0063] It should be noted that the hash value of the confidential file in the authorization information is generated by IPFS104 when the confidential file is stored in IPFS104, and the generated hash value of the confidential file is stored in blockchain 105.

[0064] Step 204: Send the confidential file to the client.

[0065] In this embodiment, the server 101 obtains the confidential file authorization information from the blockchain 105 according to the confidential file reading application sent by the client 102, and obtains the confidential file from the IPFS 104 according to the hash value of the confidential file in the confidential file authorization information, so as to prevent the confidential file from being illegally stolen, thereby improving the security of the confidential file during the authorized viewing process.

[0066] In this embodiment, confidential files are stored through IPFS104. Only by obtaining the hash value of the confidential file can the file be read, and the hash value of the file is stored in the blockchain 105, which greatly increases the security of the confidential file itself. The user certificate information is stored in the physical U-KEY103, and the user verification information of the confidential file is associated with the user certificate information in the U-KEY103, reducing the risk of the user certificate being intercepted. The most core authorization information (user verification information and hash value of the confidential file) of the confidential file authorization is stored on the blockchain, ensuring the security of important information and effectively solving the core pain point of authorized access to confidential files.

[0067] When obtaining the authorization information of the confidential file from the blockchain according to the confidential file reading application, the confidential file authorization information can be obtained directly from the blockchain through the confidential file reading application, that is, as long as there is a confidential file reading application, the confidential file authorization information can be obtained from the blockchain. In this case, the confidential file authorization information can be the hash value of the confidential file encrypted with the user verification information, and the server can use the user certificate information to decrypt it to obtain the hash value of the confidential file. Even if the confidential file authorization information is illegally obtained during this process, it cannot be decrypted due to the lack of user certificate information, and the hash value of the confidential file can be guaranteed not to be leaked, thereby ensuring the security of the confidential file.

[0068] Of course, in one embodiment, in order to improve the security of the authorization information, a verification step may be added. For example, the user certificate information may include first identification information, and the first identification information is used to indicate the confidential file corresponding to the confidential file reading application.

[0069] In this embodiment, obtaining confidential file authorization information from the blockchain based on a confidential file reading application includes: obtaining target information carrying second identification information from the blockchain based on the confidential file reading application, and using the target information as confidential file authorization information, wherein the second identification information is the same as the first identification information.

[0070] In this embodiment, confidential file authorization information can be obtained from the blockchain based on the identification information. When the first identification information of the confidential file reading information is the same as the second identification information of the target information, the target information is obtained from the blockchain. The target information is the confidential file authorization information, which can prevent the confidential file authorization information from being mistakenly sent to other addresses, thereby improving the security of the confidential file authorization information.

[0071] In one embodiment, the confidential file is sent to the client, which can be sent directly to the client, or the confidential file can be encrypted and then sent to the client, so as to further improve the security of the confidential file authorization process. For example, the confidential file can be encrypted according to the user certificate information to obtain a second encrypted file, and the second encrypted file can be sent to the client.

[0072] In this embodiment, since the client has the user certificate information when applying for reading the confidential file, the user certificate information can be directly used to decrypt the received second encrypted file to obtain the confidential file.

[0073] In one embodiment, the confidential file authorization method, such as Figure 3 ,include:

[0074] Step 301, application for reading confidential documents;

[0075] Step 302, returning user certificate information;

[0076] Step 303, submitting user certificate information;

[0077] Step 304, returning the confidential file authorization information (verification information and hash value);

[0078] Step 305, returning the confidential file;

[0079] Step 306, returning the confidential file.

[0080] In this embodiment, U-KEY is responsible for storing user certificate information and providing user authorization credentials; the client is responsible for obtaining the user certificate in U-KEY and submitting an application for reading confidential files.

[0081] The client 102 submits an application for reading a confidential file to the server 101. The server 101 determines whether the application for reading a confidential file carries user certificate information. If the user certificate information does not exist, a prompt message is returned requiring the client 102 to provide the user certificate information. The client 102 obtains the user certificate information from the U-KEY 103 and submits the user certificate information to the server 101. The server 101 verifies the application for reading a confidential file and obtains the confidential file authorization information from the blockchain 105. The authorization information includes the verification information and the hash value of the confidential file. The server 101 obtains the confidential file from the IPFS 104 according to the hash value of the confidential file and returns the confidential file to the client 102.

[0082] Since the user certificate is stored on U-KEY 103, the confidential files are stored on IPFS 104, and the hash values ​​of the confidential files are stored on blockchain 105, the security of the confidential files and the authorization process is effectively enhanced.

[0083] When applied to the client, such as Figure 4 , the confidential file authorization methods include:

[0084] Step 401, obtaining an input confidential file reading request; obtaining user certificate information from U-KEY according to the confidential file reading request.

[0085] Step 402, generate a confidential file reading application based on the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; the confidential file reading application carries the user certificate information; so that the server obtains the confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes the user verification information and the hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used for the server to determine that the user certificate information and the user verification information match, and then obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file.

[0086] Step 403, obtaining the confidential file returned by the server.

[0087] This method stores user certificate information in U-KEY, the hash value of confidential files in the blockchain, and the confidential files in the Interstellar File System. The client obtains the confidential files by sending a confidential file reading application to the server, thereby improving the security of confidential files during the authorized viewing process and preventing confidential files from being illegally stolen.

[0088] Based on the same technical concept, the second embodiment of the present application provides a confidential file authorization device, such as Figure 5 , applied to the server, the device comprises:

[0089] The first acquisition module 501 is used to acquire a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is acquired by the client from U-KEY;

[0090] A second acquisition module 502 is used to obtain confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information;

[0091] A third acquisition module 503 is used to obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file after determining that the user certificate information matches the user verification information;

[0092] The sending module 504 is used to send the confidential file to the client.

[0093] The device stores user certificate information in U-KEY, the hash value of the confidential file in the blockchain, and the confidential file in the interplanetary file system. The server obtains the confidential file authorization information from the blockchain according to the confidential file reading application sent by the client, and obtains the confidential file from the interplanetary file system according to the hash value of the confidential file in the confidential file authorization information, thereby improving the security of the confidential file during the authorized viewing process and preventing the confidential file from being illegally stolen.

[0094] Applied to the client, such as Figure 6 , the device comprises:

[0095] The fourth acquisition module 601 is used to acquire an input confidential file reading request; and acquire user certificate information from the U-KEY according to the confidential file reading request;

[0096] A generating module 602 is used to generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; the confidential file reading application carries the user certificate information; so that the server obtains confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used by the server to obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file after determining that the user certificate information and the user verification information match;

[0097] The return module 603 is used to obtain the confidential file returned by the server.

[0098] The device stores user certificate information in U-KEY, the hash value of confidential files in the blockchain, and the confidential files in the Interstellar File System. The client obtains the confidential files by sending a confidential file reading application to the server, thereby improving the security of confidential files during the authorized viewing process and preventing confidential files from being illegally stolen.

[0099] like Figure 7 As shown, the third embodiment of the present application provides an electronic device, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0100] Memory 113, used for storing computer programs;

[0101] In one embodiment, the processor 111 is used to implement the confidential file authorization method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 113. The method can be applied to the server or the client.

[0102] When applied to the server, the methods include:

[0103] Obtaining a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from U-KEY;

[0104] Obtaining confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information;

[0105] After determining that the user certificate information matches the user verification information, obtaining the confidential file corresponding to the confidential file authorization information from the Interstellar File System according to the hash value of the confidential file;

[0106] Send the confidential file to the client.

[0107] When applied to the client, the methods include:

[0108] Obtaining an input confidential file reading request; obtaining user certificate information from U-KEY according to the confidential file reading request;

[0109] Generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; the confidential file reading application carries the user certificate information; so that the server obtains confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used for the server to obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file after determining that the user certificate information and the user verification information match;

[0110] Get the confidential file returned by the server.

[0111] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0112] The communication interface is used for communication between the above terminal and other devices.

[0113] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0114] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0115] The fourth embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the confidential file authorization method provided in any of the aforementioned method embodiments are implemented.

[0116] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0117] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0118] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. In the description, the use of suffixes such as "module", "component" or "unit" used to represent elements is only to facilitate the description of the present invention and has no specific meaning in itself. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0119] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A confidential file authorization method, characterized in that: Applied to the server, the method includes: Obtaining a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from U-KEY; Obtaining confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; After determining that the user certificate information matches the user verification information, obtaining the confidential file corresponding to the confidential file authorization information from the Interstellar File System according to the hash value of the confidential file; Sending the confidential file to the client; The user certificate information includes first identification information; the first identification information is used to indicate the confidential file corresponding to the confidential file reading application; Obtaining confidential file authorization information from the blockchain according to the confidential file reading application, including: According to the confidential file reading application, target information carrying second identification information is obtained from the blockchain, and the target information is used as the confidential file authorization information; the second identification information is the same as the first identification information; Wherein, obtaining the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file includes: Obtaining a first encrypted file corresponding to the confidential file authorization information from the Interstellar File System; Decrypting the first encrypted file according to the hash value of the confidential file to obtain the confidential file; The step of sending the confidential file to the client includes: Encrypting the confidential file according to the user certificate information to obtain a second encrypted file; The second encrypted file is sent to the client.

2. A confidential file authorization method, characterized in that: Applied to a client, the method comprises: Obtaining an input confidential file reading request; obtaining user certificate information from U-KEY according to the confidential file reading request; Generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; wherein the user certificate information includes first identification information; the first identification information is used to indicate the confidential file corresponding to the confidential file reading application; the confidential file reading application carries the user certificate information; so that the server obtains confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used for the server to determine that the user certificate information and the user verification information match, and then obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file; Get the confidential file returned by the server.

3. A confidential document authorization device, characterized in that: Applied to the server, the device comprises: A first acquisition module is used to acquire a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is acquired by the client from U-KEY; A second acquisition module is used to acquire confidential file authorization information from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; wherein the user certificate information includes first identification information; the first identification information is used to indicate the confidential file corresponding to the confidential file reading application; acquiring confidential file authorization information from the blockchain according to the confidential file reading application includes: acquiring target information carrying second identification information from the blockchain according to the confidential file reading application, and using the target information as the confidential file authorization information; the second identification information is the same as the first identification information; A third acquisition module is used for obtaining the confidential file corresponding to the confidential file authorization information from the interplanetary file system according to the hash value of the confidential file after determining that the user certificate information matches the user verification information; wherein obtaining the confidential file corresponding to the confidential file authorization information from the interplanetary file system according to the hash value of the confidential file includes: obtaining a first encrypted file corresponding to the confidential file authorization information from the interplanetary file system; decrypting the first encrypted file according to the hash value of the confidential file to obtain the confidential file; A sending module is used to send the confidential file to the client; wherein, sending the confidential file to the client includes: encrypting the confidential file according to the user certificate information to obtain a second encrypted file; and sending the second encrypted file to the client.

4. A confidential document authorization device, characterized in that: Applied to a client, the device comprises: The fourth acquisition module is used to acquire an input confidential file reading request; and acquire user certificate information from U-KEY according to the confidential file reading request; A generation module, used to generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; wherein the user certificate information includes first identification information; the first identification information is used to indicate the confidential file corresponding to the confidential file reading application; the confidential file reading application carries the user certificate information; so that the server obtains confidential file authorization information from the blockchain based on the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; the user certificate information is used for the server to determine that the user certificate information and the user verification information match, and then obtain the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file; The return module is used to obtain the confidential files returned by the server.

5. A confidential document authorization system, characterized in that: The system includes a server, a client, U-KEY, an interplanetary file system and a blockchain; The server is used to obtain a confidential file reading application sent by a client, wherein the confidential file reading application carries user certificate information; the user certificate information is obtained by the client from the U-KEY; confidential file authorization information is obtained from the blockchain according to the confidential file reading application; the confidential file authorization information includes user verification information and a hash value of the confidential file corresponding to the confidential file authorization information; After determining that the user certificate information matches the user verification information, obtaining the confidential file corresponding to the confidential file authorization information from the InterPlanetary File System according to the hash value of the confidential file; Sending the confidential file to the client; wherein the user certificate information includes first identification information; the first identification information is used to indicate the confidential file corresponding to the confidential file reading application; obtaining confidential file authorization information from the blockchain according to the confidential file reading application, including: obtaining target information carrying second identification information from the blockchain according to the confidential file reading application, and using the target information as the confidential file authorization information; the second identification information is the same as the first identification information; wherein, obtaining the confidential file corresponding to the confidential file authorization information from the interplanetary file system according to the hash value of the confidential file, including: obtaining the first encrypted file corresponding to the confidential file authorization information from the interplanetary file system; decrypting the first encrypted file according to the hash value of the confidential file to obtain the confidential file; wherein sending the confidential file to the client includes: encrypting the confidential file according to the user certificate information to obtain a second encrypted file; and sending the second encrypted file to the client; The client is used to obtain an input confidential file reading request; obtain user certificate information from the U-KEY according to the confidential file reading request; generate a confidential file reading application according to the user certificate information and the confidential file reading request, and send the confidential file reading application to the server; and obtain the confidential file returned by the server.

6. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the steps of the confidential file authorization method described in claim 1 or 2 when executing the program stored in the memory.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the confidential document authorization method as claimed in claim 1 or 2 are implemented.

Images