Document management system and method based on distributed control and blockchain

Abstract

The present application provides a document management system and method based on distributed control and blockchain, which relates to the field of document processing. The system stores the current personal version document and the current version document through a local version library. When submitted to the cloud service unit for storage, in order to ensure that the ciphertext with low information entropy is exploded, the encryption unit obtains the encryption key, encrypts the current version document, and obtains the target encrypted document. The cloud service unit processes the target encrypted document and the historical encrypted document to obtain the processing result of whether there is a historical encrypted document that is the same as the target encrypted document, and sends the processing result to the blockchain unit, which can improve the security of document storage and processing in the cloud. Due to the distributed storage and decentralization of the blockchain unit, it has the characteristics of open consensus, non-tamperability and traceability. The result verification is carried out in the form of a smart contract, so that the verification result has openness and accountability.

Description

Technical Field

[0001] The present application relates to the field of document processing, and specifically, to a document management system and method based on distributed control and blockchain. Background Art

[0002] In today's information age, file management is essential for individual and team work. However, traditional file management methods have many problems, such as network speed restrictions, storage space restrictions, and high membership fees of online disks, file size restrictions and inconvenient management of WeChat, etc. Moreover, this traditional file management method exposed on the public Internet has security risks such as theft, tampering, and interception. In addition, in daily work, a large number of files will be sent and received between users, resulting in repeated storage of the same file, affecting memory problems. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a document management system based on distributed control and blockchain, so as to solve the above-mentioned problems existing in the prior art and improve the security of cloud storage data.

[0004] In a first aspect, a document management system based on distributed control and blockchain is provided, which may include: a local version library, an encryption unit, a cloud service unit, and a blockchain unit;

[0005] The local version library is used to perform version identification on the current version document and determine the target version document when obtaining the save instruction for the current version document; and send the target version document to the encryption unit;

[0006] The encryption unit is used to encrypt the target version document according to the configured attribute encryption policy to obtain a target encrypted document, and send the target encrypted document to the cloud service unit;

[0007] The cloud service unit is used to adopt a detection strategy to process the similarity between the target encrypted document and the stored historical encrypted documents, obtain a processing result, and send the processing result to the blockchain unit;

[0008] The blockchain unit is used to store the processing result.

[0009] In a possible implementation, the local version library also includes a personal version library and a public version library;

[0010] The personal version library is used to record the personal modification operations of the corresponding personnel on the historical version document, and modify the historical version document according to the recorded personal modification operations to obtain the current personal version document; the historical version document is the previous version document of the current personal version document;

[0011] The public version library is used to record all personnel's modification operations on the historical version document, and modify the historical version document according to the recorded modification operations to obtain the current version document; the historical version document is the previous version document of the current version document.

[0012] In a possible implementation, the attribute encryption strategy includes:

[0013] Using the configured first hash algorithm, the target version document is calculated to obtain a target hash value;

[0014] Randomly select a first value in a pre-configured data set, calculate the target hash value, and obtain blinding information;

[0015] Using the configured target value as the index of the blinded information, performing exponential operation to obtain an operation result;

[0016] According to the first value, performing a deblinding operation on the calculation result to obtain a target private key;

[0017] The target version document is encrypted using the target private key to obtain a target encrypted document.

[0018] In a possible implementation, the encryption unit is further used to extract features from the target encrypted document to obtain feature ciphertext; and use a digital signature algorithm to sign the feature ciphertext to obtain an encrypted signature of the target encrypted document.

[0019] In a possible implementation, the encryption unit is further configured to use a configured first hash algorithm to calculate a target encrypted document including an encrypted signature to obtain a deduplication tag of the target encrypted document.

[0020] In a possible implementation, the detection strategy includes:

[0021] Using a duplication detection algorithm, calculating a first amount of data randomly obtained from the target encrypted document to obtain a first result;

[0022] and, calculating a second amount of data randomly obtained from the historical encrypted document to obtain a second result;

[0023] and, calculating a second amount of data randomly obtained from the target encrypted document to obtain a third result;

[0024] and, calculating a first amount of data randomly obtained from the historical encrypted document to obtain a fourth result;

[0025] Calculating the first result and the third result to obtain a target encrypted document processing value;

[0026] Calculating the second result and the fourth result to obtain a historical encrypted document processing value;

[0027] The target encrypted document processing value and the historical encrypted document processing value are sent to the blockchain unit.

[0028] In a possible implementation, the blockchain unit is further used to separately store the received target encrypted document processing value and the historical encrypted document processing value, and when the target encrypted document processing value and the historical encrypted document processing value are equal, it is judged that the processing result is that the target encrypted document is the same as the historical encrypted document.

[0029] In the second aspect, a document management method based on distributed control and blockchain is provided. The method is applied to a management system including a local version library, an encryption unit, a cloud service unit, and a blockchain unit, and may specifically include:

[0030] When the local version library obtains the instruction to save the current version document, it performs version identification on the current version document to determine the target version document; and sends the target version document to the encryption unit;

[0031] The encryption unit encrypts the target version document according to the configured attribute encryption policy to obtain a target encrypted document, and sends the target encrypted document to the cloud service unit;

[0032] The cloud service unit adopts a detection strategy to process the similarity between the target encrypted document and the stored historical encrypted document, obtains a processing result, and sends the processing result to the blockchain unit;

[0033] The blockchain unit stores the processing result.

[0034] In a third aspect, an electronic device is provided, the electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0035] Memory, used to store computer programs;

[0036] The processor is used to implement any method step described in the second aspect when executing the program stored in the memory.

[0037] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any method step described in the second aspect is implemented.

[0038] The present application provides a document management system based on distributed control and blockchain. The system stores the current personal version document and the current version document through a local version library. When submitted to the cloud service unit for storage, in order to ensure that the ciphertext with low information entropy is exploded, the encryption unit obtains the encryption key, encrypts the current version document, and obtains the target encrypted document. The cloud service unit processes the target encrypted document and the historical encrypted document to obtain the processing result of whether there is a historical encrypted document that is the same as the target encrypted document, and sends the processing result to the blockchain unit, which can improve the security of document storage and processing in the cloud. Due to the distributed storage and decentralization of the blockchain unit, it has the characteristics of open consensus, non-tamperability and traceability. The result verification is carried out in the form of smart contracts, so that the verification result has openness and accountability. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A schematic diagram of the structure of a document management system based on distributed control and blockchain provided in an embodiment of the present application;

[0041] Figure 2 A schematic diagram of the internal composition of a document management system based on distributed control and blockchain provided in an embodiment of the present application;

[0042] Figure 3 A timing diagram of the operation of the local version library, encryption unit, cloud service unit, and blockchain unit provided in the embodiment of the present application;

[0043] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] 1. For ease of understanding, the terms involved in the embodiments of the present application are explained below:

[0046] 1. Distributed Version Control System (DVCS): It is a software system used to track file changes and manage project versions. It is different from the traditional centralized version control system (Centralized Version Control System, CVCS). DVCS does not rely on a single central server to store all versions of files, but manages versions by synchronizing file changes between local and remote copies.

[0047] 2. Convergent Encryption: It is an encryption method whose core idea is that the same plaintext generates the same ciphertext when encrypted with the same key. This method is different from traditional encryption, which uses a unique key to generate different ciphertext for each plaintext, even if the plaintext is the same. In contrast, Convergent Encryption uses a simpler way to map the same plaintext to the same ciphertext.

[0048] 3. Zero-Knowledge Proof (ZKP): It is a cryptographic concept that refers to the ability of one party (the prover) to prove the authenticity of a statement to another party (the verifier) ​​without revealing any specific information about the content of the statement, i.e., zero knowledge. This means that the prover can prove that he knows a secret or satisfies a condition without revealing the specific content of the secret or condition to the verifier.

[0049] 4. Blockchain: It is a decentralized distributed database technology that uses "blocks" as the basic unit and forms a growing list of data (chain) through links. Each block contains transaction information, timestamp and hash value of the previous block, forming an unalterable, chronological data record. This chain structure enables data to be stored securely and reliably in the network, and eliminates the need for third-party intermediaries in traditional centralized systems.

[0050] With the rapid development of cloud computing and the widespread popularity of cloud network services, more and more people and enterprises are storing their files in the cloud. On the one hand, cloud computing has a huge amount of storage space, which can effectively alleviate the limited local storage space; on the other hand, users can view or forward their files anytime and anywhere through mobile terminals. However, while we are experiencing the convenience brought by the cloud, we are also facing some problems and hidden dangers:

[0051] First of all, for most workers, compared with personal configuration of private cloud resources, they prefer to use third-party cloud resource management platforms, such as Baidu Netdisk, Kingsoft Documents, Feishu, etc. Third-party platforms often have upload and download speed limits and storage space limits due to their own cost issues. In order to ensure long-term operation, they also make profits by allowing users to open memberships, purchase speed limit removal packages or additional storage space. For users, it is an additional expense, and they will also be bound by the third-party platform for a long time. Similarly, it is not conducive to file sharing between teams. Although various third-party platforms have launched the function of online document team collaborative editing, they have high network requirements and the operating experience is still far behind local editing.

[0052] Secondly, the duplication rate of cloud files (or data) is quite high. According to data reported by IDC, it is expected that by 2025, the data stored in the cloud will reach 60ZT (megabytes), of which about 50% is redundant data (i.e. duplicate data). This is a huge challenge for cloud service providers (hereinafter referred to as cloud service providers). Too much redundant data will also seriously reduce the utilization rate of cloud storage servers. In order to effectively save storage space and improve hardware utilization, many cloud service providers, such as Google, Amazon, and Dropbox, have adopted data deduplication technology. Data deduplication technology refers to the cloud storage server storing only one copy of the source data, and then sharing the source data with users with the same data. This approach can effectively save storage space and improve hardware utilization.

[0053] However, in an untrusted cloud computing environment, data deduplication faces serious security issues, such as data leakage. Since different users use different private keys to encrypt the data uploaded to the cloud, the resulting data ciphertexts are also different, which brings certain inconveniences to the deduplication process of the cloud server. In addition, the traditional challenge-response protocol is used to verify data ownership between cloud service providers and uploaders, which is also untrustworthy in the network environment. Cloud service providers may collude with uploaders to attack, ultimately leading to the leakage of user privacy data. Therefore, in a complex cloud computing environment, in order to effectively protect the privacy of data and improve the space utilization of cloud storage servers, it is urgent to find a safe and effective cloud data deduplication solution.

[0054] In the field of data security deduplication, many important achievements have emerged in the academic community. Innovative research continues to solve the problem of duplicate data storage and ensure the privacy and security of information. Initially, traditional encryption methods resulted in different encryption results for the same plaintext, which hindered the deduplication verification of cloud service providers. To address this problem, Douceur et al. proposed convergent encryption in 2002, using hash values ​​as encryption keys to ensure the same encryption results for the same plaintext, solving the deduplication verification problem. However, convergent encryption brings the risk that ciphertext is vulnerable to brute force attacks. Bellare et al. proved this problem in their studies in 2013 and 2015, and proposed a secure data deduplication scheme based on message lock encryption.

[0055] To solve the problem of ciphertext being vulnerable to attacks, scholars have proposed a variety of novel solutions. In 2013, Keelveedhi et al. proposed an encryption scheme based on a key server, which used an inadvertent pseudo-random protocol to generate data encryption keys, avoiding dictionary blasting attacks. In 2014, Li et al. proposed a data deduplication scheme based on reliable convergent key management to effectively manage keys and improve security. Duan et al. proposed a data deduplication scheme based on user assistance, which generates keys through users and replaces the role of key servers.

[0056] Subsequent research continues to explore new solutions and technologies. For example, Tang et al. proposed a cross-user deduplication solution based on re-encryption, which ensures data security deduplication through interaction between users and cloud services and avoids the introduction of third-party entities. Yuan et al. designed a data deduplication solution based on random tags, allowing users to dynamically manage data and improving flexibility. Stanek et al. designed data deduplication solutions with different access levels based on file popularity to meet the needs of different users.

[0057] In this field, Guo et al. proposed a random cross-user deduplication scheme in 2020, using the ElGamal key exchange encryption algorithm for data encryption, reducing the introduction of third-party servers and ensuring data security. These studies have not only made breakthroughs in protecting data privacy, but also explored ways to avoid introducing unfeasible third-party entities.

[0058] Even so, the idea of ​​third-party entity verification is feasible, but in reality there are still unreliable factors.

[0059] In daily work, especially when dealing with large files such as preliminary design plans or feasibility study reports, we often save multiple versions to ensure that key information is not missed. However, doing so also increases the difficulty of distinguishing between versions. In fact, different versions may only have very small differences in content, but they take up additional storage space. What's more complicated is that in teamwork, some content needs to be filled in by other colleagues. The traditional way is to pass the file to the other party for editing, and then modify and merge it after it is completed, which seriously affects the efficiency of team collaboration. Although many software now support real-time shared editing functions, network latency issues have become a major challenge for large files.

[0060] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0061] Figure 1 A schematic diagram of the structure of a document management system based on distributed control and blockchain provided in an embodiment of the present application. Figure 1 As shown, the system may include: a local version library, an encryption unit, a cloud service unit, and a blockchain unit;

[0062] It should be noted that this system is a distributed version control system (GIT).

[0063] First, a configuration management environment is needed, including enterprise-level configuration management environment and project-level configuration management environment.

[0064] Specifically, 1. Enterprise-level configuration management environment:

[0065] It is crucial to establish software configuration management specifications in an enterprise or team. This includes establishing unified basic specifications, such as change control process, version control process, defect tracking process, and branch strategy. Although unified specifications exist, the enterprise's unified configuration management specifications need to be appropriately adjusted or replanned according to the specific situation in response to the special needs of different projects.

[0066] 2. Project-level configuration management environment:

[0067] (1) Identify and mark configuration items

[0068] Software configuration items are products that need to be controlled in a project, and are mainly divided into two categories: basic configuration items and integrated configuration items. Basic configuration items include basic work units created during project development, such as source code, database design, test plan, etc. Integrated configuration items are a combination of one or more basic configuration items or integrated configuration items, such as requirement specifications, design specifications, user manuals, etc.

[0069] (2) Establish a configuration library

[0070] The configuration repository is the core of the configuration management environment and is established and maintained using configuration management tools. Its main function is to store software configuration items, modification requests, change records, etc., and provide version control for files in the repository. Assigning different access rights to different personnel (developers, testers, configuration managers, project managers, etc.) is an important function of the configuration repository. Usually, the configuration repository stores each change of the configuration item in an incremental manner to save space and effectively manage versions.

[0071] Secondly, the process of using a version control system can include:

[0072] (1) There are many cloud websites that integrate Git, such as GitHub, Gitee, Gitlab, etc. They also have security certificates. They can also be deployed on private clouds, which is more flexible and easier to operate. This article takes Gitlab as an example. Each team member registers a Gitlab account and generates his or her own SSH Key.

[0073] (2) The team leader can create a repository (public version library) in Gitlab for the entire team to use.

[0074] (3) Team members use the git clone command to clone remote repository projects to local machines. They can use a variety of network protocols, such as SSH, https, etc. Research shows that the SSH protocol has the fastest transmission speed.

[0075] (4) When modifying project files, operations are only allowed on personal branches (personal version libraries). Use gitcommit to save the changes to the local staging area. For files that are not in the staging area, use `git add` to add them to the staging area.

[0076] (5) Use git push to push the files in the local staging area to the remote repository (cloud service unit). If other team members have new commits on the remote branch, you need to use `git pull` to merge the updated version of the remote repository with the local repository. This process includes two steps: obtaining the updated version from the remote repository and then merging it into the local repository. If a conflict occurs during the merge process, you need to resolve the conflict first and submit it locally.

[0077] (6) Personal work should not be carried out directly on the main branch. When it is necessary to merge each person's project, merge the branches and release a more stable version.

[0078] The above operations are performed through Git commands, and can also be implemented through visual software to improve efficiency.

[0079] The distributed version control system, combined with Figure 2 As shown, it can be divided into four phase layers, including control layer, business layer, data layer and operation layer.

[0080] Control layer: The control layer is the bottom layer of the system, which summarizes the specific methods required by different modules, such as user module, file upload module, file encryption module, etc.

[0081] Business layer: The business layer provides the services required by the system and summarizes the service methods of the entire system, which can be easily called by the control layer.

[0082] Data layer: The data layer provides some methods to perform database operations. The business layer can call the data layer.

[0083] Operation layer: The operation layer is the highest layer of the system. It subdivides database operations into single operations so that they can be reused when upper-layer applications create new modules.

[0084] Furthermore, conflicts are the most common problem in team collaboration, so in system function design, it is necessary to decouple functions and implement different functions in different files. Git will prompt that a merge conflict has occurred. At this time, the team users of the files that have conflicts can manually resolve the conflicts as needed. In the collaborative process, good working habits should also be cultivated. If multiple members must modify a file at the same time, each member should update the file regularly, and other members should also synchronize the latest files in time before modifying the files.

[0085] Generally, version control is divided into two types: centralized and distributed. In the centralized version control mode, there is a machine as the central server. In team collaboration, it can be simply understood as jointly editing online documents. Therefore, team members must always stay connected to the server. If the network or server fails, team members cannot submit updates and cannot work with others. If the server's disk is damaged and not backed up in advance, it is likely that some data will be lost forever. Even if each team member's snapshot is obtained, it is difficult to restore the original database. This is not the case with distributed systems. This application uses a distributed system to manage documents: there is no "central server", and everyone's computer is a complete version library. Therefore, when working, even if the network is interrupted, the team's collaboration will not be completely terminated. At the same time, the security of a distributed version control system is much higher than that of a centralized one, because each computer has a complete version library, so even if a computer fails, it will not cause file loss.

[0086] The local version library can be used to save the current version of the document, and can also save and record the previous revision records of the current version of the document; when obtaining the save instruction for the current version of the document, the current version of the document is version-identified to determine the target version of the document. Version tracing is achieved based on the version identification of the document.

[0087] Local version library, specifically including personal version library and public version library.

[0088] The personal version library is used to record the personal modification operations of the corresponding personnel on the historical version documents. According to the recorded personal modification operations, the historical version documents are modified to obtain the current personal version documents; the historical version documents are the previous versions of the current personal version documents. Among them, the personal version library can also be understood as a temporary storage area, that is, an area where the corresponding personnel temporarily store their personal modification operations, and the current personal version documents are not submitted to the public version library for storage.

[0089] The public version library is used to record all personnel's modification operations on historical version documents. According to the recorded modification operations, the historical version documents are modified to obtain the current version documents; the historical version documents are the previous version documents of the current version documents. The public version library can also be understood as a workspace. When relevant personnel submit the current personal version documents in their own temporary storage area to the public version library, they can comment on each current personal version document (or trigger a save instruction), which will replace the historical version documents and record the changes that have occurred in this submission through modification operations to form the target version document. It also helps version tracing.

[0090] In this method, for multi-person collaboration, in order to facilitate team members' local work without affecting each other, the concept of personal version library is introduced. Each team member can use his or her own personal version library independently, and the documents between each personal version library are independent. But at the same time, they can be merged into the public version library to save everyone's changes.

[0091] If the target version document is sent directly to the cloud service unit, the content of the document will be completely exposed in the cloud service unit. Therefore, before sending the target version document to the cloud service unit, the encryption unit encrypts the target version document according to the pre-configured attribute encryption strategy (convergent encryption) to obtain the target encrypted document with a deduplication label. After that, the target encrypted document with the deduplication label is sent to the cloud service unit.

[0092] Specific, combined Figure 3 As shown, the encryption unit may include a key module and a user encryption module; the attribute encryption strategy may specifically include:

[0093] The user encryption module uses the configured first hash algorithm to calculate the target version document to obtain the target hash value;

[0094] The user encryption module randomly selects the first value in the pre-configured data set, calculates the target hash value, obtains blinded information, and sends the blinded information to the key module;

[0095] The key module uses the configured target value as the exponent of the blinded information, performs exponential operation, obtains the operation result, and sends the operation result to the user encryption module;

[0096] The user encryption module performs a deblinding operation on the calculation result according to the first value to obtain a target private key;

[0097] The user encryption module uses the target private key to encrypt the target version document to obtain the target encrypted document.

[0098] For example: pre-configure the security parameter K to generate linear multiplication cyclic groups G1 and G2 with a large prime number p, define g as the generator of G1, and map the operation e: G1×G1→G2. Define three hash functions, H1:{0,1}*→Zp*, H2:{0,1}*→G1, H3:G2→Zp*. The corresponding hash functions have their own functions.

[0099] The specific process of encrypting the target version document can be:

[0100] 1. The user encryption module uses the first hash algorithm H2 to process the target version document to obtain the target hash value h.

[0101] h=H2(m)

[0102] 2. The user encryption module randomly selects the first value u from the value set Zp*. Calculate the target hash value h to obtain the blinded information b_m.

[0103] b_m=h u

[0104] 3. The key module uses the configured target value x as the exponent of the blinded information b_m, performs exponential operation, and obtains the operation result b_m_k, which can be understood as the key.

[0105] b_m_k=(b_m) x =(h u ) x

[0106] 4. The key module uses the first value u to de-blind the operation result b_m_k to obtain the target private key ck.

[0107] ck=(b_m_k) -u =(h ux ) -u =h x

[0108] 5. The user encryption module uses the target private key to encrypt the target version document to obtain the target encrypted document.

[0109] C=E ck (m)

[0110] Among them, E ck The algorithm used to encrypt the target version document using the target ck.

[0111] Afterwards, when the target version document is a relatively large document file, its corresponding encrypted target encrypted document is also a relatively large ciphertext file; it is necessary to perform feature extraction on the target encrypted document to obtain feature ciphertext, and the user encryption module uses a digital signature algorithm to sign the feature ciphertext to obtain a target encrypted document with an encrypted signature t.

[0112] t=Sig ssk (C||f name )

[0113] Among them, Sig ssk is the RSA signature algorithm, f name The unique identifier of the file ID file, || is string concatenation, that is, C||f name =Cf name .

[0114] Afterwards, the user encryption module uses the configured first hash algorithm to calculate the target encrypted document with the encryption signature t to obtain the deduplication label dep of the target encrypted document.

[0115] dep=H1(C)

[0116] It should be noted that the target encrypted document at this time is a target encrypted document with an encrypted signature t.

[0117] Finally, because documents need to be shared and collaborated, cloud service units can be used to upload local version libraries and synchronize file information with other members. In a distributed version control system, not every version of a file is stored, but key version information is recorded, and the actual space occupied is only the size of one file. This also achieves the effect of deduplication. However, on cloud resources managed at the enterprise level, even files of the same version will be duplicated. At this time, it is necessary to perform deduplication operations on the cloud service unit. That is, to query whether there are documents with the same deduplication tags in the cloud service unit;

[0118] If not, it indicates that the cloud service unit has not uploaded a document with the deduplication tag. At this time, the cloud service unit stores the target encrypted document.

[0119] If so, the corresponding files will be deduplicated and verified. Under the premise of ensuring data security, zero-knowledge proof will be used to generate two data labels during the deduplication verification process.

[0120] The user encryption module uses a duplicate detection algorithm to calculate a first amount of data randomly obtained from a target encrypted document with a deduplication tag to obtain a first result;

[0121] The cloud service unit calculates a second amount of data randomly obtained from the historical encrypted document to obtain a second result; it should be noted that the historical encrypted document is also a document with a deduplication tag.

[0122] The user encryption module calculates a second amount of data randomly obtained from the target encrypted document to obtain a third result;

[0123] The cloud service unit calculates the first amount of data randomly obtained from the historical encrypted document to obtain a fourth result;

[0124] The user encryption module calculates the first result and the third result to obtain a target encrypted document processing value;

[0125] The cloud service unit calculates the second result and the fourth result to obtain a historical encrypted document processing value;

[0126] The target encrypted document processing value and the historical encrypted document processing value are sent to the blockchain unit.

[0127] Specifically, assume that C1 is the target encrypted document and C2 is the historical encrypted document (C1 and C2 may be the same or different).

[0128] The user encryption module randomly obtains a first amount of data {i}i∈[1,n] in C1.

[0129] and, using a second hash algorithm H2 to calculate the first amount of data to obtain a first index a;

[0130] a=H2(data(i))i∈[i,n]

[0131] And, using a as the exponent of the generator g, perform exponential operation to obtain the first result p a .

[0132] p a =g a

[0133] Similarly, the cloud service unit randomly obtains a second amount of data {j}j∈[1,s] in C2.

[0134] and, using a second hash algorithm H2 to calculate a second amount of data to obtain a second index b;

[0135] b=H2(data(j))j∈[1,s]

[0136] And, using b as the exponent of the generator g, perform exponential operation to obtain the second result p b .

[0137] p b =g b

[0138] Afterwards, the user encryption module randomly obtains a second amount of data {j'}j′∈[1,s] in C1.

[0139] and, using a second hash algorithm H2 to calculate the second amount of data to obtain a third index b';

[0140] b′=H2(data(j′))j′∈[1,s]

[0141] And, using b′ as the exponent of the generator g, perform exponential operation to obtain the third result p v ′.

[0142] p b' =g b'

[0143] Likewise, the cloud service unit randomly obtains a first amount of data {i'}i′∈[1,n] in C2.

[0144] and, using a second hash algorithm H2 to calculate the first amount of data to obtain a fourth index a';

[0145] a′=H2(data(i′)),i′∈[1,n]

[0146] And, using a′ as the exponent of the generator g, perform exponential operation to obtain the fourth result p a ′.

[0147] p a' =g a'

[0148] Afterwards, the user encryption module calculates the first result and the third result to obtain the target encrypted document processing value p z .

[0149] p z =p a *p b′ =g a *g b′ =g ab′

[0150] The cloud service unit calculates the second result and the fourth result to obtain the historical encrypted document processing value p z′ .

[0151] p z′ =p a′ *p b =g a′ *g b =g a′b

[0152] Finally, the target encrypted document processing value and the historical encrypted document processing value are sent to the blockchain unit.

[0153] Calculate p z and p z′ The process can be understood as a zero-knowledge proof, that is, a zero-knowledge proof is a way for the "prover" to convince the "verifier" that the statement about certain secret information is true without revealing the secret itself. In this system, when the client and the cloud server check for duplicates, verification is performed on the premise of not revealing the plaintext and ciphertext of the file.

[0154] The blockchain unit is also used to store the received target encrypted document processing value and the historical encrypted document processing value respectively, that is, to store the processing result of processing the similarity between the target encrypted document and the historical encrypted document, and the processing result can be understood as the similarity matching relationship between the target encrypted document and the historical encrypted document. When the target encrypted document processing value and the historical encrypted document processing value are equal, it is judged that the processing result is the same as the target encrypted document and the historical encrypted document.

[0155] That is to say, the blockchain unit receives pz' and pz respectively, and then executes the deployed smart contract to verify whether the two are equal. If the verification is successful, a new block will be added to the blockchain unit to store the corresponding pz' and pz. So far, the deduplication verification of the blockchain unit has been completed. Then, the cloud service unit will no longer store this file additionally. Among them, smart contracts can be understood as automated contracts of blockchain, which are designed to automatically execute, control or record transactions or events of contractual agreements when specific conditions are met. Smart contracts are verified and executed through distributed nodes in the blockchain network, without the need for intermediaries, and achieve decentralization and automation.

[0156] When a user wants to download a file from a cloud service unit, the server will search for the corresponding file in the cloud service unit, thereby interacting with the cloud service unit to complete the download.

[0157] In some embodiments, if the cloud service unit receives the target encrypted document for the first time, the cloud service unit will directly receive the document and store the corresponding deduplication tag. The method for determining whether it is the first time to receive is to check whether there is a deduplication tag of the target encrypted document in the stored historical deduplication tags. When the same deduplication tags exist, it means that it is not the first time to receive the target encrypted document, and the target encrypted document needs to be compared with the historical encrypted documents to determine whether there is a historical encrypted document that is the same as the target encrypted document.

[0158] After duplication occurs, the user end connected to the local service unit needs to authenticate data ownership with the cloud service unit using zero-knowledge proof, but this process involves two steps, one for the cloud service unit and one for the user end.

[0159] In this method, firstly, by using encryption means, the document information uploaded to the cloud service unit can be kept confidential, thereby avoiding the complete exposure of the document to the cloud service unit; secondly, the corresponding algorithm can be used to compare the encrypted documents to determine whether there are identical documents, thereby achieving the purpose of deduplication.

[0160] The present application provides a document management system based on distributed control and blockchain. The system stores the current personal version document and the current version document through a local version library. When submitted to the cloud service unit for storage, in order to ensure that the ciphertext with low information entropy is exploded, the encryption unit obtains the encryption key, encrypts the current version document, and obtains the target encrypted document. The cloud service unit processes the target encrypted document and the historical encrypted document to obtain the processing result of whether there is a historical encrypted document that is the same as the target encrypted document, and sends the processing result to the blockchain unit, which can improve the security of document storage and processing in the cloud. Due to the distributed storage and decentralization of the blockchain unit, it has the characteristics of open consensus, non-tamperability and traceability. The result verification is carried out in the form of smart contracts, so that the verification result has openness and accountability.

[0161] Corresponding to the above system, the embodiment of the present application also provides a document management method based on distributed control and blockchain, the method comprising:

[0162] Step S210: When the local version library obtains the instruction to save the current version document, it performs version identification on the current version document to determine the target version document; and sends the target version document to the encryption unit;

[0163] Step S220: the encryption unit encrypts the target version document according to the configured attribute encryption policy to obtain a target encrypted document, and sends the target encrypted document to the cloud service unit;

[0164] Step S230: The cloud service unit adopts a detection strategy to process the similarity between the target encrypted document and the stored historical encrypted document, obtains a processing result, and sends the processing result to the blockchain unit;

[0165] Step S240: The blockchain unit stores the processing result.

[0166] Each step of a document management method based on distributed control and blockchain provided in the above embodiment of the present application can be implemented by the above units. Therefore, the specific working process and beneficial effects of each step in a document management method based on distributed control and blockchain provided in the embodiment of the present application will not be repeated here.

[0167] The present application also provides an electronic device, such as Figure 4 As shown, it includes a processor 510 , a communication interface 520 , a memory 530 and a communication bus 540 , wherein the processor 510 , the communication interface 520 , and the memory 530 communicate with each other via the communication bus 540 .

[0168] Memory 530, for storing computer programs;

[0169] The processor 510 is used to execute the program stored in the memory 530 to implement the following steps:

[0170] When the local version library obtains the instruction to save the current version document, it performs version identification on the current version document to determine the target version document; and sends the target version document to the encryption unit;

[0171] The encryption unit encrypts the target version document according to the configured attribute encryption policy to obtain a target encrypted document, and sends the target encrypted document to the cloud service unit;

[0172] The cloud service unit adopts a detection strategy to process the similarity between the target encrypted document and the stored historical encrypted document, obtains a processing result, and sends the processing result to the blockchain unit;

[0173] The blockchain unit stores the processing result.

[0174] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0175] The communication interface is used for communication between the above electronic device and other devices.

[0176] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0177] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0178] Since the implementation methods and beneficial effects of the various components of the electronic device in the above-mentioned embodiments for solving the problems can be achieved by referring to the various steps of a document management method based on distributed control and blockchain, the specific working process and beneficial effects of the electronic device provided in the embodiments of the present application will not be repeated here.

[0179] In another embodiment provided in the present application, a computer-readable storage medium is also provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes a document management method based on distributed control and blockchain as described in any of the above embodiments.

[0180] In another embodiment provided in the present application, a computer program product comprising instructions is also provided. When the computer program product is run on a computer, the computer executes a document management method based on distributed control and blockchain as described in any one of the above embodiments.

[0181] Those skilled in the art will appreciate that the embodiments in the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt a complete hardware embodiment, a complete software embodiment, or a form of an embodiment combining software and hardware. Moreover, the present application may adopt a form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0182] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic creative concepts. Therefore, the present application embodiments are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application embodiments.

[0186] Obviously, those skilled in the art can make various changes and modifications to the embodiments in the present application without departing from the spirit and scope of the embodiments in the present application. Thus, if these modifications and variations of the embodiments in the present application are within the scope of the embodiments in the present application and their equivalents, the embodiments in the present application are also intended to include these modifications and variations.

Claims

1. A document management system based on distributed control and blockchain, characterized in that: The system includes: a local version library, an encryption unit, a cloud service unit and a blockchain unit; The local version library is used to perform version identification on the current version document and determine the target version document when obtaining the save instruction for the current version document; and send the target version document to the encryption unit; The encryption unit is used to encrypt the target version document according to the configured attribute encryption policy to obtain a target encrypted document, and send the target encrypted document to the cloud service unit; The cloud service unit is used to adopt a detection strategy to process the similarity between the target encrypted document and the stored historical encrypted documents, obtain a processing result, and send the processing result to the blockchain unit; The blockchain unit is used to store the processing result; The attribute encryption strategy includes: Using the configured first hash algorithm, the target version document is calculated to obtain a target hash value; Randomly select a first value in a pre-configured data set, calculate the target hash value, and obtain blinding information; Using the configured target value as the index of the blinded information, performing exponential operation to obtain an operation result; According to the first value, performing a deblinding operation on the calculation result to obtain a target private key; Using the target private key, encrypting the target version document to obtain a target encrypted document; The encryption unit is further used to extract features from the target encrypted document to obtain feature ciphertext; and to sign the feature ciphertext using a digital signature algorithm to obtain an encrypted signature of the target encrypted document; The detection strategy includes: Using a duplication detection algorithm, calculating a first amount of data randomly obtained from the target encrypted document to obtain a first result; and, calculating a second amount of data randomly obtained from the historical encrypted document to obtain a second result; and, calculating a second amount of data randomly obtained from the target encrypted document to obtain a third result; and, calculating a first amount of data randomly obtained from the historical encrypted document to obtain a fourth result; Calculating the first result and the third result to obtain a target encrypted document processing value; Calculating the second result and the fourth result to obtain a historical encrypted document processing value; The target encrypted document processing value and the historical encrypted document processing value are sent to the blockchain unit.

2. The system according to claim 1, characterized in that The local version library also includes a personal version library and a public version library; The personal version library is used to record the personal modification operations of the corresponding personnel on the historical version document, and modify the historical version document according to the recorded personal modification operations to obtain the current personal version document; the historical version document is the previous version document of the current personal version document; The public version library is used to record all personnel's modification operations on the historical version document, and modify the historical version document according to the recorded modification operations to obtain the current version document; the historical version document is the previous version document of the current version document.

3. The system according to claim 1, characterized in that The encryption unit is further configured to use a configured first hash algorithm to calculate a target encrypted document including an encrypted signature to obtain a deduplication tag of the target encrypted document.

4. The system according to claim 3, characterized in that The blockchain unit is also used to store the received target encrypted document processing value and the historical encrypted document processing value respectively. When the target encrypted document processing value and the historical encrypted document processing value are equal, it is judged that the processing result is that the target encrypted document is the same as the historical encrypted document.

5. A document management method based on distributed control and blockchain, characterized in that: Applied to a management system including a local version library, an encryption unit, a cloud service unit, and a blockchain unit, the method includes: When the local version library obtains the instruction to save the current version document, it performs version identification on the current version document to determine the target version document; and sends the target version document to the encryption unit; The encryption unit encrypts the target version document according to the configured attribute encryption policy to obtain a target encrypted document, and sends the target encrypted document to the cloud service unit; The cloud service unit adopts a detection strategy to process the similarity between the target encrypted document and the stored historical encrypted document, obtains a processing result, and sends the processing result to the blockchain unit; The blockchain unit stores the processing result; The attribute encryption strategy includes: Using the configured first hash algorithm, the target version document is calculated to obtain a target hash value; Randomly select a first value in a pre-configured data set, calculate the target hash value, and obtain blinding information; Using the configured target value as the index of the blinded information, performing exponential operation to obtain an operation result; According to the first value, performing a deblinding operation on the calculation result to obtain a target private key; Using the target private key, encrypting the target version document to obtain a target encrypted document; The method further includes: the encryption unit extracting features from the target encrypted document to obtain feature ciphertext; using a digital signature algorithm to sign the feature ciphertext to obtain an encrypted signature of the target encrypted document; The detection strategy includes: Using a duplication detection algorithm, calculating a first amount of data randomly obtained from the target encrypted document to obtain a first result; and, calculating a second amount of data randomly obtained from the historical encrypted document to obtain a second result; and, calculating a second amount of data randomly obtained from the target encrypted document to obtain a third result; and, calculating a first amount of data randomly obtained from the historical encrypted document to obtain a fourth result; Calculating the first result and the third result to obtain a target encrypted document processing value; Calculating the second result and the fourth result to obtain a historical encrypted document processing value; The target encrypted document processing value and the historical encrypted document processing value are sent to the blockchain unit.

6. An electronic device, characterized in that: The electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; The processor is used to implement the method steps described in claim 5 when executing the program stored in the memory.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in claim 5 are implemented.

Images