On-chain and off-chain data security storage and query method and device

Abstract

The application provides an on-chain and off-chain data security storage and query method and device, the method comprising: receiving a unique identification ciphertext of target ciphertext data queried by a service node in a blockchain network according to a target keyword ciphertext in a ciphertext index table or a hot data index table, and decrypting to obtain the corresponding unique identification; if the unique identification ciphertext is queried in the hot data index table, the target ciphertext data is called from a database server according to the unique identification; the target ciphertext data is decrypted to obtain target plaintext data, and the target plaintext data is sent to the corresponding user node. The application can effectively reduce the storage space requirement of the blockchain in a collaborative manner of on-chain and off-chain, and effectively improve the security and reliability of data security processing; and by distinguishing the hot and cold areas of the index table on the chain and the mass data saved off-chain, the time required for data query and calling can be effectively reduced, and the efficiency of data storage, query and calling can be improved.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and in particular to methods and apparatus for secure storage and retrieval of on-chain and off-chain data. Background Technology

[0002] With the development of the times, the level of informatization in all industries is constantly improving, resulting in the generation of massive amounts of data. How to securely store this data while enabling convenient retrieval and querying by multiple users has always been an important research direction, leading to the emergence of public-key searchable encryption technology. Existing searchable encryption schemes mostly involve users using their private keys and keywords to generate a trapdoor from a trusted authorized institution, then transmitting the trapdoor to a cloud server, where the cloud server performs a search on the encrypted data and returns the data. This new scheme, however, involves users uploading the trapdoor to the blockchain. The blockchain smart contract uses the trapdoor to perform a search on the encrypted data and then returns the search results to a proxy server. Blockchain possesses characteristics such as resilience, tamper-proofness, traceability, and decentralization, facilitating data sharing among multiple users while ensuring data security. By combining searchable encryption technology with blockchain, multiple parties involved in the development and maintenance of equipment, including management departments, users, research institutes, and manufacturers, can participate in the updating and maintenance of equipment's technical status in a secure environment, enabling them to maximize regulatory efficiency and provide a reliable basis for exemption from liability and accountability for dereliction of duty, in scenarios where multiple users upload and retrieve data.

[0003] However, existing blockchain-based data security processing methods require a full search of the data stored in the blockchain before data can be retrieved, which increases storage space requirements and affects the efficiency of data query and retrieval. Summary of the Invention

[0004] In view of this, embodiments of this application provide a method and apparatus for secure storage and retrieval of on-chain and off-chain data, in order to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of this application provides a method for secure on-chain and off-chain data storage and retrieval, including:

[0006] The system receives the unique identifier ciphertext of the target ciphertext data from a service node in the blockchain network, which is retrieved from a preset ciphertext index table or a hot data index table based on the target keyword ciphertext. It then decrypts the unique identifier ciphertext of the target ciphertext data using a preset AES key to obtain the unique identifier of the target ciphertext data. The ciphertext index table stores the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each piece of cold data, and the hot data index table stores the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each piece of hot data.

[0007] If the unique identifier of the target encrypted data is found in the hot data index table, the target encrypted data is retrieved from the database server based on the unique identifier of the target encrypted data. The database server is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each hot data.

[0008] The target ciphertext data is decrypted using the AES key to obtain the target plaintext data, and then the target plaintext data is sent to the corresponding user node.

[0009] In some embodiments of this application, before decrypting the target ciphertext data based on the AES key to obtain the target plaintext data, the method further includes:

[0010] If the unique identifier of the target encrypted data is found in the encrypted index table, the target encrypted data is retrieved from the IPFS distributed storage system based on the unique identifier of the target encrypted data. The IPFS distributed storage system is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each of the cold data.

[0011] In some embodiments of this application, before receiving the unique identifier ciphertext of the target ciphertext data retrieved by the service node in the blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table, the method further includes:

[0012] The system receives and stores a public key, an AES key, and a cryptographic hash function sent by a trusted authorization authority. The trusted authorization authority pre-generates the AES key, the cryptographic hash function, the corresponding private key, and the public key, and sends the private key to the user node in the blockchain network.

[0013] Receive plaintext data and corresponding keywords sent by data owner nodes in the blockchain network;

[0014] The plaintext data is encrypted using the AES key to obtain the corresponding ciphertext data, and the keyword is encrypted using the public key to obtain the corresponding keyword ciphertext.

[0015] The ciphertext hash value corresponding to the ciphertext data is obtained based on the cryptographic hash function.

[0016] In some embodiments of this application, it also includes:

[0017] The encrypted data is sent to the IPFS distributed storage system so that the IPFS distributed storage system marks the encrypted data as cold data and generates a corresponding unique identifier, and sends the encrypted data hash value corresponding to the encrypted data to the blockchain network for storage;

[0018] Receive the unique identifier corresponding to the ciphertext data sent by the IPFS distributed storage system, and encrypt the unique identifier corresponding to the ciphertext data based on the AES key to obtain the corresponding unique identifier ciphertext;

[0019] The key ciphertext and the unique identifier ciphertext of the ciphertext data are sent to the blockchain network for storage, so that the smart contracts in the blockchain network update the ciphertext index table accordingly.

[0020] In some embodiments of this application, after retrieving the target encrypted data from the IPFS distributed storage system based on the unique identifier of the target encrypted data, the method further includes:

[0021] The target ciphertext data and its corresponding unique identifier are sent to the database server for storage. If the unique identifier ciphertext of the target ciphertext data is found in the ciphertext index table, the smart contract of the blockchain network updates the target keyword ciphertext and unique identifier ciphertext corresponding to the target ciphertext data to the hot data index table in advance, so that the target ciphertext data is marked as hot data instead of cold data.

[0022] In some embodiments of this application, after sending the target plaintext data to the corresponding user node, the method further includes:

[0023] Receive the arbitration request sent by the user node for the target plaintext data;

[0024] The unique identifier ciphertext of the target ciphertext data corresponding to the target plaintext data, the target ciphertext data, and the cryptographic hash function are sent to each arbitration node in the arbitration node group in the blockchain network. Each arbitration node re-queries the unique identifier ciphertext of the target ciphertext data in a preset ciphertext index table or hot data index table based on the target keyword ciphertext, and uses it as the current re-examination unique identifier ciphertext. Each node obtains the ciphertext data hash value of the target ciphertext data according to the cryptographic hash function and uses it as the current re-examination ciphertext data hash value. Then, each node determines whether the re-examination unique identifier ciphertext is the same as the unique identifier ciphertext of the target ciphertext data, and whether the re-examination ciphertext data hash value is the same as the ciphertext data hash value of the target ciphertext data. Based on the corresponding determination results, each node generates a corresponding independent arbitration result.

[0025] Receive the independent arbitration results sent by each of the arbitration nodes;

[0026] Based on preset judgment rules, the independent arbitration results are summarized to obtain a target arbitration result used to indicate whether the target plaintext data is erroneous;

[0027] The target arbitration result corresponding to the target plaintext data is sent to the user node that made the arbitration request for the target plaintext data.

[0028] Another aspect of this application provides an on-chain and off-chain data secure storage and retrieval device, comprising:

[0029] The cold / hot data differentiation query module is used to receive the unique identifier ciphertext of the target ciphertext data retrieved by a service node in the blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table, and to decrypt the unique identifier ciphertext of the target ciphertext data based on a preset AES key to obtain the unique identifier of the target ciphertext data; wherein, the ciphertext index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each cold data, and the hot data index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each hot data;

[0030] The hot data retrieval module is used to retrieve the target ciphertext data from the database server based on the unique identifier of the target ciphertext data if the unique identifier of the target ciphertext data is found in the hot data index table. The database server is used to store the one-to-one correspondence between the unique identifier and the ciphertext data corresponding to each hot data.

[0031] The plaintext data transmission module is used to decrypt the target ciphertext data based on the AES key to obtain the target plaintext data, and then send the target plaintext data to the corresponding user node.

[0032] In some embodiments of this application, it also includes:

[0033] The cold data retrieval module is used to retrieve the target encrypted data from the IPFS distributed storage system based on the unique identifier of the target encrypted data if the unique identifier of the target encrypted data is found in the encrypted index table. The IPFS distributed storage system is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each of the cold data.

[0034] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the on-chain and off-chain data secure storage and query method.

[0035] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the described method for secure storage and retrieval of on-chain and off-chain data.

[0036] The on-chain and off-chain data security storage and retrieval method provided in this application receives the unique identifier ciphertext of target ciphertext data retrieved by a service node in the blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table. The unique identifier ciphertext is then decrypted using a preset AES key to obtain the unique identifier of the target ciphertext data. The ciphertext index table stores the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each cold data item, and the hot data index table stores the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each hot data item. If the unique identifier ciphertext of the target ciphertext data is found in the hot data index table, the target ciphertext data is retrieved from the database server based on the unique identifier. The database server stores the one-to-one correspondence between the unique identifiers and ciphertext data corresponding to each of the hot data items. Based on the AES key, the target ciphertext data is decrypted to obtain the target plaintext data, which is then sent to the corresponding user node. By storing only the keyword ciphertext on the blockchain and using smart contracts on the blockchain to complete the ciphertext search process, while the main body of the ciphertext data is encrypted using AES and stored off-chain, and by exchanging only ciphertext data with the off-chain data storage provider, the storage space requirements of the blockchain can be effectively reduced through on-chain and off-chain collaboration, and the security and reliability of data processing can be effectively improved. Simultaneously, by also differentiating between hot and cold data in the on-chain index table and the massive amounts of data stored off-chain, the time required for data query and retrieval can be effectively reduced, thereby improving the efficiency of data storage, query, and retrieval.

[0037] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0038] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0039] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings:

[0040] Figure 1 This is a schematic diagram of the first process of the on-chain and off-chain data security storage and query method in one embodiment of this application.

[0041] Figure 2 This is a schematic diagram of a second process for a secure on-chain and off-chain data storage and retrieval method according to an embodiment of this application.

[0042] Figure 3 This is a schematic diagram of the first structure of an on-chain and off-chain data security storage and query device in one embodiment of this application.

[0043] Figure 4 This is a schematic diagram of a second structure of the on-chain and off-chain data security storage and query device in one embodiment of this application.

[0044] Figure 5 This is a schematic diagram illustrating the interaction between entities in an on-chain and off-chain data security storage and query system provided in another embodiment of this application.

[0045] Figure 6 A flowchart illustrating the on-chain and off-chain secure storage and query methods provided for the application examples of this application.

[0046] Figure 7 This is a schematic diagram of the data storage process in the on-chain and off-chain secure storage and query method provided in the application example of this application;

[0047] Figure 8 This is a schematic diagram of the data query and arbitration process in the on-chain and off-chain secure storage and query method provided in the application example of this application. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0049] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the solution according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0050] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0051] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0052] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0053] In one or more embodiments of this application, the public-key searchable encryption scheme was first proposed in 2004, mainly to solve the mail routing problem of untrusted servers. Subsequently, public-key searchable encryption technology has developed rapidly and achieved many research results.

[0054] In one or more embodiments of this application, the target keyword ciphertext refers to the ciphertext of the keyword to be queried currently specified by the user node, which can also be called a query trapdoor, and can be written as T. W The query token can be written as "token"; the key ciphertext can be written as "W". C Both keywords and target keywords can be written as W; an identifier ciphertext can be written as I. c The unique identifier can be written as I; the target ciphertext data refers to the ciphertext data to be queried, and both the target ciphertext data and the ciphertext data can be written as C; the target plaintext data refers to the plaintext data to be queried, and both the target plaintext data and the plaintext data can be written as P; the cryptographic hash function can be written as H; the hash value of the ciphertext data can be written as h. C .

[0055] The following examples will provide a detailed description.

[0056] This application provides a method for secure storage and retrieval of on-chain and off-chain data, which can be implemented using an on-chain and off-chain data secure storage and retrieval device. Specifically, the hardware implementation of this on-chain and off-chain data secure storage and retrieval device can employ a proxy server. (See [link to relevant documentation]). Figure 1 The method for secure storage and retrieval of on-chain and off-chain data specifically includes the following:

[0057] Step 100: Receive the unique identifier ciphertext of the target ciphertext data retrieved by the service node in the blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table, and decrypt the unique identifier ciphertext of the target ciphertext data based on a preset AES key to obtain the unique identifier of the target ciphertext data; wherein, the ciphertext index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each cold data, and the hot data index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each hot data.

[0058] In one or more embodiments of this application, since different data are used to varying degrees, i.e., the frequency of being queried or updated is different, this application classifies frequently used (e.g., queried and called) data as hot data, enabling it to be retrieved and used more quickly. In a system containing massive amounts of data, distinguishing between cold and hot data can effectively save storage space and improve storage efficiency.

[0059] In one or more embodiments of this application, the main entities involved in the on-chain and off-chain data security storage and query method include: data owner (i.e., data owner node), user (i.e., user node), service provider (i.e., service node), arbitration node group composed of multiple arbitration nodes, proxy server, blockchain (or blockchain network), trusted authorization institution, IPFS distributed storage system and database server, etc.

[0060] In the blockchain network, the four identities of data owner, service provider, user, and arbitration node can transform into each other as needed, and provide services to each other.

[0061] Specifically, the data owner uploads the plaintext data that needs to be securely stored, along with its corresponding keywords, to the proxy server.

[0062] Users are the users and retrievers of data. With the help of a trusted authorized institution, users use their private keys and keywords to generate query trapdoors, issue query tokens, and upload them to the blockchain.

[0063] The service provider is a host with idle computing resources in the blockchain network. The service provider receives the retrieval token issued by the user, executes the smart contract to perform the retrieval operation, and returns the retrieval results to the proxy server.

[0064] Arbitration node groups are hosts with available computing resources in the blockchain network that voluntarily provide arbitration services to maintain the health of the blockchain network ecosystem.

[0065] In step 100, the service node obtains the query trapdoor T based on the retrieval token. WThe smart contract performs searches in both the encrypted index table and the hot data index table it maintains, based on the trapdoor. The search process calls the function Test(A). pub ,S,T w ), calculate S=[A,B] item by item, if(H2(e(T) W ,A))=B). If (H2(e(T)) W If A) = B) is true, then the service node will encrypt the unique identifier I corresponding to this index. c Send it to the proxy server. If the entire ciphertext index table has been searched, if(H2(e(T)) W If both A and B are false, the query fails, and the smart contract returns the query failure information to the proxy server.

[0066] Step 200: If the unique identifier of the target encrypted data is found in the hot data index table, then the target encrypted data is retrieved from the database server according to the unique identifier of the target encrypted data, wherein the database server is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each hot data.

[0067] In step 200, the proxy server will uniquely identify the ciphertext I c The data is decrypted into a unique identifier I. If this unique identifier can be found in the data index table, the ciphertext data C is directly obtained from the database server based on the unique identifier I. After decryption, the plaintext is transmitted to the user node.

[0068] In one or more embodiments of this application, hot data is stored in the database server. The database may be a relational database such as MySQL, and the IPFS unique identifier is used as the primary key. The proxy server can directly use the decrypted IPFS unique identifier to obtain the encrypted data from the database server.

[0069] Step 300: Decrypt the target ciphertext data based on the AES key to obtain the target plaintext data, and send the target plaintext data to the corresponding user node.

[0070] In one or more embodiments of this application, the blockchain network is a decentralized network composed of numerous nodes. This application focuses on the ledger function and smart contracts of the blockchain. The blockchain stores pairs of encrypted keywords and unique identifiers, as well as the hash value of the encrypted data. Each time the proxy server uploads an index and hash value, it is equivalent to a transaction. The blockchain generates a new block, completing the ledger entry. The encrypted index entries are used to improve retrieval efficiency and, together with the hash value, serve as the basis for future arbitration calculations, ensuring the immutability and traceability of the data. The smart contract maintains a encrypted index table containing all encrypted index entries uploaded to the blockchain. Each time a new block is generated, the smart contract updates the encrypted index table with the information. The hot data index table stores index entries of data used recently. After receiving the retrieval token uploaded by the user, the service provider executes the smart contract, simultaneously searching the encrypted index table and the hot data index table. The search ends when a successful search is found in either table, and the search result is returned to the proxy server.

[0071] As described above, the on-chain and off-chain data security storage and query method provided in this application embodiment saves only the encrypted keyword data on the blockchain and completes the encrypted search process using a smart contract on the blockchain. The encrypted data body is stored off-chain after being encrypted with AES. By exchanging only encrypted data with the off-chain data storage provider, the method can effectively reduce the storage space requirements of the blockchain and effectively improve the security and reliability of data security processing through on-chain and off-chain collaboration. At the same time, by distinguishing between hot and cold data in the on-chain index table and the massive amount of data stored off-chain, the time required for data query and retrieval can be effectively reduced, thereby improving the efficiency of data storage, query, and retrieval.

[0072] To further improve the effectiveness and reliability of on-chain and off-chain data retrieval, in a method for secure storage and retrieval of on-chain and off-chain data provided in this application embodiment, see [link to relevant documentation]. Figure 2 The method for secure storage and retrieval of on-chain and off-chain data also includes the following specific content between steps 100 and 300:

[0073] Step 210: If the unique identifier of the target encrypted data is found in the encrypted index table, then the target encrypted data is retrieved from the IPFS distributed storage system according to the unique identifier of the target encrypted data. The IPFS distributed storage system is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each of the cold data.

[0074] In step 210, if the unique identifier is obtained from the ciphertext index table, the proxy server retrieves the ciphertext data C from IPFS, decrypts it, and then sends the plaintext to the user.

[0075] In one or more embodiments of this application, IPFS, or InterPlanetary File System, is a content-addressed distributed file system. It generates a unique identifier based on the hash value of the stored files. Files in IPFS are indexed using this unique identifier, and the hash value is checked beforehand to ensure it has not already been stored. If it has, it is not stored again, saving storage space. It successfully combines distributed hash tables, the version control system Git, and self-certifying file systems, enabling long-term, decentralized storage of shared files. Using IPFS effectively enhances data reliability and disaster recovery capabilities. IPFS identifies files by generating independent hash values ​​based on file content, rather than by file location. Files with identical content are stored only once in the system, effectively saving storage space and improving storage efficiency. As a distributed storage system, IPFS has better resilience than centralized database systems. This system uses IPFS to store encrypted data, making it more secure and reliable while saving storage space.

[0076] To further improve the security and reliability of on-chain and off-chain data secure storage and retrieval, this application provides a method for secure on-chain and off-chain data storage and retrieval, see [link to relevant documentation]. Figure 2 The method for secure storage and retrieval of on-chain and off-chain data specifically includes the following content before step 100:

[0077] Step 010: Receive and store the public key, AES key, and cryptographic hash function sent by the trusted authorization institution, wherein the trusted authorization institution pre-generates the AES key, cryptographic hash function, corresponding private key, and the public key, and sends the private key to the user node in the blockchain network.

[0078] In one or more embodiments of this application, the cryptographic hash function is a hash function used in cryptography. Inputting data into the cryptographic hash function yields a fixed-length output. The cryptographic hash function can accept any string as input, and it is computationally efficient, collision-resistant, and difficult to reverse engineer using the hash value. This application uses ciphertext data as input to the cryptographic hash function and stores the output hash value in a blockchain block as one of the bases for arbitration calculations.

[0079] In one or more embodiments of this application, a trusted authorization authority is responsible for generating public and private keys and a cryptographic hash function. The public key is distributed to a proxy server for data encryption; the private key is distributed to the user for generating a query trapdoor and retrieval token using keywords; and the cryptographic hash function is distributed to the proxy server and a group of arbitration nodes for arbitrating retrieval results. In this application, the trusted authorization authority is required to be completely trusted, and the channel between it and the user is also required to be secure.

[0080] Step 020: Receive plaintext data and corresponding keywords sent by the data owner node in the blockchain network.

[0081] Step 030: Encrypt the plaintext data based on the AES key to obtain the corresponding ciphertext data, and encrypt the keyword based on the public key to obtain the corresponding keyword ciphertext.

[0082] Step 040: Obtain the ciphertext data hash value corresponding to the ciphertext data based on the cryptographic hash function.

[0083] To further improve the effectiveness and reliability of distinguishing between hot and cold data during the secure storage and retrieval of on-chain and off-chain data, this application provides an embodiment of an on-chain and off-chain data secure storage and retrieval method, see [link to embodiment]. Figure 2 The method for secure storage and retrieval of on-chain and off-chain data specifically includes the following content after step 040 and before step 100:

[0084] Step 050: Send the encrypted data to the IPFS distributed storage system so that the IPFS distributed storage system marks the encrypted data as cold data and generates a corresponding unique identifier, and sends the encrypted data hash value corresponding to the encrypted data to the blockchain network for storage.

[0085] Step 060: Receive the unique identifier corresponding to the ciphertext data sent by the IPFS distributed storage system, and encrypt the unique identifier corresponding to the ciphertext data based on the AES key to obtain the corresponding unique identifier ciphertext.

[0086] Step 070: Send the keyword ciphertext and the unique identifier ciphertext of the ciphertext data to the blockchain network for storage, so that the smart contract in the blockchain network updates the ciphertext index table accordingly.

[0087] To further improve the effectiveness and reliability of distinguishing between hot and cold data during the secure storage and retrieval of on-chain and off-chain data, this application provides an embodiment of an on-chain and off-chain data secure storage and retrieval method, see [link to embodiment]. Figure 2 The method for secure storage and retrieval of on-chain and off-chain data further includes the following content after step 210:

[0088] Step 220: Send the target ciphertext data and the corresponding unique identifier to the database server for storage. If the unique identifier ciphertext of the target ciphertext data is found in the ciphertext index table, the smart contract of the blockchain network updates the target keyword ciphertext and unique identifier ciphertext corresponding to the target ciphertext data to the hot data index table in advance, so that the target ciphertext data is marked as hot data instead of cold data.

[0089] To further improve the security and effectiveness of on-chain and off-chain data security storage and retrieval processes, and to maintain the role of the entire blockchain network ecosystem, this application provides a method for on-chain and off-chain data security storage and retrieval, which effectively identifies potentially problematic nodes within the blockchain network. (See also...) Figure 2 The method for secure storage and retrieval of on-chain and off-chain data further includes the following content after step 300:

[0090] Step 400: Receive the arbitration request for the target plaintext data sent by the user node.

[0091] Step 500: Send the unique identifier ciphertext of the target ciphertext data corresponding to the target plaintext data, the target ciphertext data, and the cryptographic hash function to each arbitration node in the arbitration node group in the blockchain network. This allows each arbitration node to re-query the unique identifier ciphertext of the target ciphertext data from a preset ciphertext index table or hot data index table based on the target keyword ciphertext, using it as the current re-examination unique identifier ciphertext. Each node then obtains the ciphertext data hash value of the target ciphertext data based on the cryptographic hash function and uses it as the current re-examination ciphertext data hash value. Finally, each node determines whether the re-examination unique identifier ciphertext is the same as the unique identifier ciphertext of the target ciphertext data, and whether the re-examination ciphertext data hash value is the same as the ciphertext data hash value of the target ciphertext data. Based on the corresponding determination results, each node generates a corresponding independent arbitration result.

[0092] Step 600: Receive the independent arbitration results sent by each of the arbitration nodes.

[0093] Step 700: Summarize the independent arbitration results based on preset judgment rules to obtain a target arbitration result used to indicate whether the target plaintext data is erroneous.

[0094] Step 800: Send the target arbitration result corresponding to the target plaintext data to the user node that made the arbitration request for the target plaintext data.

[0095] From a software perspective, this application also provides an apparatus for performing all or part of the on-chain and off-chain data secure storage and query method, see [link to relevant documentation]. Figure 3 The on-chain and off-chain data security storage and query device specifically includes the following components:

[0096] The cold / hot data differentiation query module 1 is used to receive the unique identifier ciphertext of the target ciphertext data retrieved by a service node in the blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table, and to decrypt the unique identifier ciphertext of the target ciphertext data based on a preset AES key to obtain the unique identifier of the target ciphertext data; wherein, the ciphertext index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each cold data, and the hot data index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each hot data;

[0097] The hot data retrieval module 2 is used to retrieve the target encrypted data from the database server based on the unique identifier of the target encrypted data if the unique identifier of the target encrypted data is found in the hot data index table. The database server is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each hot data.

[0098] Plaintext data transmission module 3 is used to decrypt the target ciphertext data based on the AES key to obtain the target plaintext data, and then send the target plaintext data to the corresponding user node.

[0099] To further improve the effectiveness and reliability of on-chain and off-chain data retrieval, an on-chain and off-chain data secure storage and retrieval device is provided in this application embodiment, see [link to relevant documentation]. Figure 4 The on-chain and off-chain data security storage and query device also specifically includes the following:

[0100] The cold data retrieval module 4 is used to retrieve the target ciphertext data from the IPFS distributed storage system based on the unique identifier of the target ciphertext data if the unique identifier of the target ciphertext data is found in the ciphertext index table. The IPFS distributed storage system is used to store the one-to-one correspondence between the unique identifier and the ciphertext data corresponding to each of the cold data.

[0101] The embodiments of the on-chain and off-chain data secure storage and query device provided in this application can be used to execute the processing flow of the embodiments of the on-chain and off-chain data secure storage and query method in the above embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the embodiments of the on-chain and off-chain data secure storage and query method.

[0102] The on-chain and off-chain data security storage and query device can perform the on-chain and off-chain data security storage and query functions on a server, such as a proxy server, or it can be completed on a client device. The choice depends on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations in this regard. If all operations are completed on the client device, the client device may further include a processor for the specific processing of on-chain and off-chain data security storage and query.

[0103] During the storage phase, the proxy server receives data and keywords uploaded from the data owner, encrypts them using a public key, stores the encrypted data body in the IPFS distributed storage system, encrypts the obtained unique identifier, calculates the hash value of the ciphertext data using a cryptographic hash function, and uploads the hash value, unique identifier ciphertext, and keyword ciphertext together to the blockchain. During the query phase, the proxy server decrypts the unique identifier ciphertext returned from the blockchain, retrieves the ciphertext data body from the IPFS distributed storage system based on the unique identifier, decrypts it, and returns the plaintext to the user. If a user requests a query, the proxy server transmits the ciphertext data to the arbitration node group, receives the arbitration results from each arbitration node, and returns the aggregated result to the user.

[0104] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0105] The server and the client device can communicate using any suitable network protocol, including those not yet developed as of the date of this application. Such network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Furthermore, such network protocols may also include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer Protocol) protocols used on top of the aforementioned protocols.

[0106] As can be seen from the above description, the on-chain and off-chain data security storage and query device provided in this application embodiment can effectively reduce the storage space requirements of the blockchain through on-chain and off-chain collaboration, and effectively improve the security and reliability of data security processing; and by distinguishing between hot and cold data in the on-chain index table and the massive amount of data stored off-chain, the time required for data query and retrieval can be effectively reduced, thereby improving the efficiency of data storage, query and retrieval.

[0107] Based on the above-mentioned on-chain and off-chain data secure storage and retrieval devices and / or methods, see [link to relevant documentation]. Figure 5 This application also provides an on-chain and off-chain data secure storage and query system. The embodiments of the on-chain and off-chain data secure storage and query system provided in this application can be used to execute the processing flow of the embodiments of the on-chain and off-chain data secure storage and query methods and / or devices in the above embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the embodiments of the on-chain and off-chain data secure storage and query methods and / or devices described above.

[0108] To further illustrate this solution, this application also provides a specific application example of an on-chain and off-chain data security storage and query method. Specifically, it involves a method for on-chain and off-chain data security storage and query, which relates to technical fields such as blockchain, searchable encryption, distributed storage, hot and cold data differentiation, and encrypted hash functions. By utilizing searchable encryption technology, blockchain, hot and cold data technology, and the IPFS distributed storage system, a data security storage and query solution with encrypted search, tamper-proof, traceable, damage-resistant, and high storage efficiency is constructed, providing an effective solution for issues such as supervision, security, efficiency, and accountability in equipment development and management.

[0109] This application example involves on-chain and off-chain secure storage and retrieval technologies. Data owners upload and encrypt data, and users retrieve and use the data. (See also...) Figure 6 The application examples of this application include the following steps:

[0110] S10, System Initialization Phase: Blockchain initialization, proxy server and trusted authorization institution initialization, each node in the blockchain initialization, setting security parameters, generating public and private keys and AES keys, generating cryptographic hash function H, and distributing keys and cryptographic hash functions;

[0111] S20, Plaintext Data Upload Stage: The data owner uploads the data body and its keywords to the proxy server. The proxy server encrypts the data body and keywords and calculates the hash value of the encrypted data body.

[0112] S30, Data Security Storage Phase: See [link] Figure 7The proxy server stores the encrypted data C into IPFS and obtains its unique identifier I. The proxy server then performs symmetric encryption on the IPFS identifier to obtain I. c Then, with the keyword ciphertext W C Uploaded in pairs to the blockchain, and simultaneously using ciphertext C to call the cryptographic hash function H to calculate the ciphertext hash value h. C and h C Uploaded to the blockchain, the blockchain forms a new block.

[0113] S40, User Data Retrieval Stage: See [link / details] Figure 7 Users interact with trusted authorized agencies to generate query traps T. W The trapdoor generates a query token and uploads it to the blockchain. A service provider receives the token, executes a smart contract to perform a retrieval, and returns the retrieval results.

[0114] S50, User obtains plaintext data stage: See [link] Figure 8 The proxy server decrypts the unique identifier ciphertext I into...

[0115] If the unique identifier is found in the data index table, the ciphertext data C is directly obtained from the database server based on the unique identifier I, decrypted, and then sent to the user in plaintext. If the unique identifier is found in the ciphertext index table, the proxy server obtains the ciphertext data C from IPFS, decrypts, and then sends the plaintext to the user.

[0116] S60, Query Result Verification and Arbitration Stage: See [link / reference] Figure 8 If the user has no objection to the plaintext P obtained from the query, the entire retrieval process ends. If the user has an objection, the user submits a challenge request to the proxy server. The proxy server sends the ciphertext obtained from the query to multiple arbitration nodes, which calculate whether the retrieval result is correct and return the result to the proxy server. The proxy server then returns the result to the user. If the retrieval result is indeed incorrect, the user reissues the retrieval token to retrieve the data.

[0117] The following is a detailed explanation of steps S10 to S60:

[0118] (1) S10 specifically includes the following steps:

[0119] S101. Blockchain Initialization: Initialize each node in the blockchain, deploy smart contracts, automatically build ciphertext index tables and hot data index tables, and create corresponding functions for keyword ciphertext retrieval without manual intervention.

[0120] S102. Server initialization: Proxy server initialization, database server initialization, trusted authorization agency initialization.

[0121] S103. Initialize security parameters, generate public and private keys, generate an encrypted hash function H, and distribute it: Call the public key to search for the function KeyGen(s) in the encryption scheme, set the security parameter s, and determine the size p of groups G1 and G2. Select a random number α∈Z. p * Using the generator g of G1, public key A pub =[g,h=g α ], generate private key A priv =α. Public key A pub Distribute to the proxy server, and send private key A priv Distribute to users. Generate an AES key and distribute it to the proxy server. The authorizing authority generates a cryptographic hash function and distributes it to the proxy server.

[0122] (2) S20 specifically includes the following steps:

[0123] S201, Data Upload: The user uploads the data subject P and its corresponding keyword W to the proxy server.

[0124] S202, Data Encryption: The proxy server encrypts the plaintext data subject P into ciphertext data C using an AES key, and then calls the function PEKS(A) on the corresponding key W. pub Encryption with W yields the ciphertext containing the keyword W. C First, calculate t = e(H1(P), h r )∈G2, where r is a random number and r∈Z P * The key ciphertext W can be calculated by continuing the calculation. C =[g r ,H2(t)].

[0125] S203. Calculate the hash value: Calculate the hash value h by calling the cryptographic hash function H on the ciphertext data C. C .

[0126] (3) S30 specifically includes the following steps:

[0127] S301. Data Storage: The proxy server stores the encrypted ciphertext data C in the IPFS distributed storage system and obtains its unique identifier I.

[0128] S302, Data Upload to Blockchain: The proxy server encrypts the unique identifier using an AES key. c Then, with the keyword ciphertext W C Upload the encrypted data to the blockchain in pairs, and simultaneously send the hash value h of the encrypted data. C Uploaded to the blockchain.

[0129] S303, Blockchain Update: The blockchain generates a new block, completing the accounting. Each blockchain block contains three data items: the key ciphertext W. C Unique Identifier Ciphertext I c ciphertext data hash value h C The key ciphertext W C and unique identifier ciphertext I c This will form a ciphertext index entry in the smart contract, with the ciphertext data hash value h. C This will serve as the basis for future arbitration decisions. Keyword ciphertext W C With unique identifier ciphertext I c A new index is formed by pairing data items, and the smart contract updates the ciphertext index table with the index entries from the latest block. Each time a data owner stores data into the system, a new block is created, and the ciphertext index table is updated.

[0130] (4) S40 specifically includes the following steps:

[0131] S401, Trapdoor and Token Generation: With the assistance of a trusted authorized authority, the user uses private key A priv The query trap T is created by combining the keyword W to be queried. W The calculation process is as follows: call the function Trapdoor(A priv ,W), output T W =H1(W) α ∈G1, and then generate a retrieval token from the trapdoor and upload it to the blockchain network.

[0132] S402, Service Provider Receives Token: A host with available computing resources in the blockchain network, i.e., the service provider (and service node), receives the retrieval token and broadcasts to the blockchain network that the retrieval task has been accepted. Within the entire blockchain network, users and service providers can switch roles.

[0133] S403, Service provider executes smart contract retrieval: Service provider obtains query trap T based on retrieval token. W The smart contract uses the trapdoor to perform a search in its maintained ciphertext index table and hot data index table. The search process calls the function Test(A). pub ,S,T w ), calculate S=[A,B] item by item, if(H2(e(T) W ,A))=B).

[0134] S404, Search successful: If (H2(e(T) W If A)) = B) is true, then the unique identifier I corresponding to this index is encrypted. cThe data is sent to the proxy server. If the search is successful in the hot data table, the search is completed and the result is returned to the proxy server; if the search is successful in the encrypted index table, the entry in that table is updated in the hot data index table and the result is returned to the proxy server.

[0135] S405, Search Failure: If the entire encrypted index table has been searched, if(H2(e(T)) W If both A and B are false, the query fails, and the smart contract returns the query failure information to the proxy server.

[0136] (5) S50 specifically includes the following steps:

[0137] S501, Decrypt Cipher: The proxy server will receive the unique ciphertext I. c Perform AES decryption to obtain the plaintext IPFS unique identifier I.

[0138] S502. Retrieve encrypted data from the database server: If the unique identifier is encrypted I c If the data is found in the self-heating data index table, it means that the requested data is hot data, and the proxy server directly obtains the encrypted data C from the database server.

[0139] S503. Obtain encrypted data from IPFS and save hot data: If the unique identifier is encrypted I c If the data is retrieved from the ciphertext index table, it indicates that the requested data is cold data. The proxy server retrieves the ciphertext data C from IPFS and simultaneously transmits this ciphertext data C and its corresponding identifier I to the database server. In the database server, a data item is constructed using the unique identifier I as the primary key. The blockchain smart contract has updated the keyword ciphertext and unique identifier ciphertext corresponding to this ciphertext data to the hot data index table, and this part of the ciphertext data is thus marked as hot data instead of cold data.

[0140] S504, Query Failed: The smart contract failed to retrieve the corresponding keyword, and the proxy server returned the query failure result to the user.

[0141] (6) S60 specifically includes the following steps:

[0142] S601. User has no objection to the search results: If the user is satisfied with the search results, the search process ends.

[0143] S602. If a user disagrees with the search results: If a user believes that the search results are incorrect, they can submit an inquiry to the proxy server and request result arbitration.

[0144] S603. Each arbitration node makes a judgment: The proxy server sends the unique identifier ciphertext I of the retrieval result to the online arbitration node. cThe ciphertext data C and the cryptographic hash function H. Each arbitration node re-executes the retrieval operation on the ciphertext index table and the hot data table, and the result is I. c ', the result I c 'The unique identifier ciphertext I sent from the proxy server' c In comparison, if I c =I c If the result is ', it indicates that the service provider's retrieval results are correct; each arbitration node uses the cryptographic hash function H to calculate the hash value h of the ciphertext data. C Simultaneously, it retrieves data from blockchain blocks and matches the data hash value h stored in the blockchain block. C Check if h exists C =h C If I are present at the same time c =I c 'and h C =h C ', and I c 'and h C If the unique identifier and hash value match within the same blockchain block, the service provider's retrieval result is correct; otherwise, the result is incorrect. All nodes participating in the arbitration in the blockchain network send the calculation result to the proxy server.

[0145] S604. Proxy Server Aggregates Arbitration Results: The proxy server collects all arbitration results. When the proportion of correct votes among the total number of arbitration nodes exceeds a certain preset value (e.g., two-thirds), the service provider's retrieval result is considered correct, and the arbitration result is returned to the user. Otherwise, the service provider's retrieval result is considered problematic, and the arbitration result is returned to the user, who can then issue a new retrieval token to execute the retrieval task. This arbitration result can also be understood by the administrators of the entire blockchain network, who can then consider whether the service provider offering incorrect retrieval results has been attacked, thereby maintaining the ecological health of the entire blockchain network.

[0146] In summary, the on-chain and off-chain data security storage and retrieval method provided in this application example has the following advantages:

[0147] 1. This application example designs an on-chain and off-chain data security storage and query scheme, which combines the traditional searchable encryption scheme for storing and retrieving data using cloud services with the blockchain and IPFS distributed storage system to achieve data retrieval in an encrypted state, as well as the resistance to destruction, traceability, and immutability of stored records. It also improves data storage efficiency, saves storage space, and achieves data security storage and query by combining on-chain and off-chain methods.

[0148] 2. The algorithm in the searchable encryption scheme of this application example is based on Reference 1 [Dan Boneh, Giovanni DiCrescenzo, Rafail Ostrovsky, Giuseppe Persiano, Public Key Encryption with Keyword Search, In: International Conference on the Theory and Applications of Cryptographic Techniques, Advances in Cryptology-EUROCRYPT 2004]. Based on this, the encrypted keyword is stored on the blockchain, and the encrypted search process is completed using a smart contract on the blockchain. The encrypted data body is encrypted using AES and stored in a distributed storage system. Furthermore, the proxy server and the IPFS distributed storage system only exchange encrypted data, further improving data security and reliability.

[0149] 3. This application example distinguishes the massive amounts of data that may be stored in the system into hot data and cold data. Hot data refers to data used recently, and its index is stored in the smart contract hot data index table. This data is then extracted from IPFS and stored in the database server. When performing a cryptographic search, the blockchain simultaneously searches both the ciphertext index table storing all indexes and the hot data index table storing the hot data index. The search ends if either is found. Utilizing the locality of user-used data and the hot data index table effectively reduces data retrieval time. Simultaneously, with hot data stored in the database server, the proxy server can directly retrieve ciphertext data from it, reducing ciphertext data extraction time and thus improving the overall system's storage and query efficiency.

[0150] 4. In the application example of this application, when a user needs to perform a search operation, the user issues a search token to the blockchain network. Hosts with idle computing resources in the blockchain network accept the token and broadcast that the search task has been accepted in the network. Other idle hosts will no longer accept the search task. This mechanism does not require all idle hosts in the blockchain network to perform the search operation, effectively saving computing resources in the network.

[0151] 5. This application example introduces an arbitration node group into the blockchain network. Arbitration nodes are hosts with idle computing resources in the blockchain network. Users, service providers, and arbitration nodes can interchange as needed within the blockchain network. When a user believes the search results are incorrect, they can raise an objection and request arbitration from the arbitration node group. If the voting percentage of the arbitration node group exceeds a certain number, the service provider's search results are considered correct. In this way, even if a few malicious nodes exist in the blockchain network, they will not affect the arbitration result. On the other hand, if the arbitration result determines that the service provider's search results are indeed incorrect, the user reissues a search token to execute the search task. Simultaneously, the arbitration result is known to the system administrator, allowing them to determine whether the previous service provider has been attacked and turned into a malicious node. Furthermore, the arbitration calculation process performed by the arbitration node in this application example consists of three parts. It not only determines whether the service provider's search results are correct but also whether the user who made the search request is maliciously damaging the service provider's reputation. That is, if a user actually received correct search results but claims they are incorrect, this behavior will also be detected during the arbitration node's calculation process and thus known to the system administrator. Therefore, the arbitration node group can also play a role in maintaining the entire blockchain network ecosystem, and can effectively discover nodes in the blockchain network that may have problems, whether they are user nodes or service nodes.

[0152] This application also provides an electronic device, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the on-chain and off-chain data security storage and query method mentioned in the above embodiments. The processor and the memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and the memory via wired or wireless means.

[0153] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0154] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the on-chain and off-chain data secure storage and query method in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby realizing the on-chain and off-chain data secure storage and query method in the above method embodiments.

[0155] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0156] The one or more modules are stored in the memory, and when executed by the processor, the on-chain and off-chain data security storage and query method in the embodiment is executed.

[0157] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0158] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0159] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0160] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned on-chain and off-chain data secure storage and retrieval method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0161] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0162] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0163] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0164] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for secure storage and retrieval of on-chain and off-chain data, characterized in that, include: The system receives the unique identifier ciphertext of the target ciphertext data from a service node in the blockchain network, which is retrieved from a preset ciphertext index table or a hot data index table based on the target keyword ciphertext. It then decrypts the unique identifier ciphertext of the target ciphertext data using a preset AES key to obtain the unique identifier of the target ciphertext data. The ciphertext index table stores the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each piece of cold data, and the hot data index table stores the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each piece of hot data. If the unique identifier of the target encrypted data is found in the hot data index table, the target encrypted data is retrieved from the database server based on the unique identifier of the target encrypted data. The database server is used to store the one-to-one correspondence between the unique identifier and the encrypted data corresponding to each hot data. If the unique identifier of the target ciphertext data is found in the ciphertext index table, then the unique identifier of the target ciphertext data is used to... IPFS The target encrypted data is retrieved in the distributed storage system, wherein the IPFS distributed storage system is used to store the one-to-one correspondence between the unique identifiers corresponding to each of the cold data and the encrypted data; The target ciphertext data and the corresponding unique identifier are sent to the database server for storage. If the unique identifier ciphertext of the target ciphertext data is found in the ciphertext index table, the smart contract of the blockchain network updates the target keyword ciphertext and unique identifier ciphertext corresponding to the target ciphertext data to the hot data index table in advance, so that the target ciphertext data is marked as hot data from cold data. The target ciphertext data is decrypted using the AES key to obtain the target plaintext data, and then the target plaintext data is sent to the corresponding user node.

2. The method for secure storage and retrieval of on-chain and off-chain data according to claim 1, characterized in that, Before the unique identifier ciphertext of the target ciphertext data retrieved by the service node in the receiving blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table, the following is also included: The system receives and stores a public key, an AES key, and a cryptographic hash function sent by a trusted authorization authority. The trusted authorization authority pre-generates the AES key, the cryptographic hash function, the corresponding private key, and the public key, and sends the private key to the user node in the blockchain network. Receive plaintext data and corresponding keywords sent by data owner nodes in the blockchain network; The plaintext data is encrypted using the AES key to obtain the corresponding ciphertext data, and the keyword is encrypted using the public key to obtain the corresponding keyword ciphertext. The ciphertext hash value corresponding to the ciphertext data is obtained based on the cryptographic hash function.

3. The method for secure storage and retrieval of on-chain and off-chain data according to claim 2, characterized in that, Also includes: Send the encrypted data to IPFS Distributed storage systems enable this IPFS The distributed storage system marks the encrypted data as cold data and generates a corresponding unique identifier, and sends the encrypted data hash value corresponding to the encrypted data to the blockchain network for storage; Receive the IPFS The distributed storage system sends a unique identifier corresponding to the encrypted data, and encrypts the unique identifier corresponding to the encrypted data based on the AES key to obtain the corresponding unique identifier ciphertext; The key ciphertext and the unique identifier ciphertext of the ciphertext data are sent to the blockchain network for storage, so that the smart contracts in the blockchain network update the ciphertext index table accordingly.

4. The method for secure storage and retrieval of on-chain and off-chain data according to claim 3, characterized in that, After sending the target plaintext data to the corresponding user node, the method further includes: Receive the arbitration request sent by the user node for the target plaintext data; The unique identifier ciphertext of the target ciphertext data corresponding to the target plaintext data, the target ciphertext data, and the cryptographic hash function are sent to each arbitration node in the arbitration node group in the blockchain network. Each arbitration node re-queries the unique identifier ciphertext of the target ciphertext data in a preset ciphertext index table or hot data index table based on the target keyword ciphertext, and uses it as the current re-examination unique identifier ciphertext. Each node obtains the ciphertext data hash value of the target ciphertext data according to the cryptographic hash function and uses it as the current re-examination ciphertext data hash value. Then, each node determines whether the re-examination unique identifier ciphertext is the same as the unique identifier ciphertext of the target ciphertext data, and whether the re-examination ciphertext data hash value is the same as the ciphertext data hash value of the target ciphertext data. Based on the corresponding determination results, each node generates a corresponding independent arbitration result. Receive the independent arbitration results sent by each of the arbitration nodes; Based on preset judgment rules, the independent arbitration results are summarized to obtain a target arbitration result used to indicate whether the target plaintext data is erroneous; The target arbitration result corresponding to the target plaintext data is sent to the user node that made the arbitration request for the target plaintext data.

5. A device for secure storage and retrieval of on-chain and off-chain data, characterized in that, include: The cold / hot data differentiation query module is used to receive the unique identifier ciphertext of the target ciphertext data retrieved by a service node in the blockchain network based on the target keyword ciphertext in a preset ciphertext index table or hot data index table, and to decrypt the unique identifier ciphertext of the target ciphertext data based on a preset AES key to obtain the unique identifier of the target ciphertext data; wherein, the ciphertext index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each cold data, and the hot data index table is used to store the one-to-one correspondence between the keyword ciphertext and the unique identifier ciphertext corresponding to each hot data; The hot data retrieval module is used to retrieve the target ciphertext data from the database server based on the unique identifier of the target ciphertext data if the unique identifier of the target ciphertext data is found in the hot data index table. The database server is used to store the one-to-one correspondence between the unique identifier and the ciphertext data corresponding to each hot data. The cold data retrieval module is used to retrieve data based on the unique identifier of the target ciphertext if the unique identifier of the target ciphertext is found in the ciphertext index table. IPFS The target encrypted data is retrieved in the distributed storage system, wherein the IPFS distributed storage system is used to store the one-to-one correspondence between the unique identifiers corresponding to each of the cold data and the encrypted data; The plaintext data transmission module is used to decrypt the target ciphertext data based on the AES key to obtain the target plaintext data, and then send the target plaintext data to the corresponding user node; The device is further configured to perform the following: based on the unique identifier of the target ciphertext data... IPFS After retrieving the target encrypted data in the distributed storage system, the target encrypted data and the corresponding unique identifier are sent to the database server for storage. If the unique identifier of the target encrypted data is found in the encrypted index table, the smart contract of the blockchain network updates the target keyword encrypted data and the unique identifier encrypted data in advance to the hot data index table, so that the target encrypted data is marked as hot data instead of cold data.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the on-chain and off-chain data secure storage and query method as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the on-chain and off-chain data secure storage and retrieval method as described in any one of claims 1 to 4.

Images