Distributed password management system and method based on block chain

Abstract

The invention belongs to the technical field of distributed key management. The invention provides a distributed password management system and method based on a block chain. The distributed password management system comprises a user side and a server side, the server side receives a key application request sent by a user side through a user side interface or an API interface, wherein the key application request specifies a key type and a purpose; an intelligent contract system in the server side receives and verifies an application request of the user side, confirms the identity and authority of the user side, calls a key management module after the identity and authority of the user side are confirmed, generates a key pair by using a secure random number generator and a strong encryption algorithm, and sends the key pair to the server side; a public key in the generated key pair is recorded on the block chain, and a private key in the key pair is encrypted and transmitted to the user side; according to the invention, through the block chain, a safe, transparent and efficient decentralized key management system is provided, and the security and manageability of the user key are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed key management, and in particular to a distributed password management system and method based on blockchain. Background Art

[0002] The statements in this section merely provide background art related to the present invention and do not necessarily constitute prior art.

[0003] Key management systems are mainly used to generate, distribute, store and manage encryption keys to ensure data security. Traditional key management systems usually adopt a centralized structure, with a central node responsible for key generation and distribution. However, this approach has the problem of single point failure and security risks. Some advanced key management systems adopt a distributed architecture and use multi-party computing and blockchain technology to improve security and reliability. These systems usually include functions such as key generation, key distribution, key storage, key backup and recovery, and key lifecycle management to ensure the security and effectiveness of encryption keys throughout their entire life cycle.

[0004] The existing key management systems have the following main disadvantages: (1) Centralized systems are prone to becoming single points of failure and attack targets, which increases the vulnerability of the entire system; (2) There is a risk of keys being intercepted or tampered with during the generation and distribution process, especially during transmission; (3) Key storage is not secure enough and is easily accessed by unauthorized personnel or leaked through various means; the key backup and recovery process is complex and cumbersome, which increases the difficulty of management and operating costs; (4) Imperfect key lifecycle management may result in expired keys not being replaced in a timely manner, exposing the system to potential security threats. Summary of the invention

[0005] In order to address the deficiencies of the prior art, the present invention provides a distributed password management system and method based on blockchain, which utilizes blockchain technology to realize decentralized key management, eliminating the risks of single point failure and centralized management; uses blockchain to record and verify user identity and public key information, ensuring the uniqueness and security of identity; automatically processes key generation, distribution, update and revocation through smart contracts, ensuring the security and efficiency of key management; the smart contract system manages data sharing permissions and dynamically adjusts access control; combines symmetric encryption and asymmetric encryption to ensure the security and encryption efficiency of data during transmission, uses the public key of a specific user to encrypt data and symmetric keys, and ensures that the data can only be decrypted and accessed by a specific user; all key operations are recorded on the blockchain to ensure the transparency, traceability and non-tamperability of the operations, and regular security audits are performed to ensure that the system complies with security policies and compliance requirements.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: In a first aspect, the present invention provides a distributed password management system based on blockchain.

[0007] A distributed password management system based on blockchain, including a user end and a server end; The server receives a key application request sent by the client through the client interface or API interface, wherein the key application request specifies the key type and purpose; The smart contract system in the server receives and verifies the application request from the client, confirms the identity and authority of the client, and after the identity and authority of the client are confirmed, the smart contract system calls the key management module, uses a secure random number generator and a strong encryption algorithm to generate a key pair, and the public key in the generated key pair is recorded on the blockchain, and the private key in the key pair is encrypted and transmitted to the client.

[0008] As a further limitation of the first aspect of the present invention, before receiving a key application request sent by a user terminal through a user terminal interface or an API interface, performing user terminal registration includes: Receiving identity information of a client, wherein the identity information includes a client name and a public key; The user's identity information is verified through the public key infrastructure, and a user identity certificate is generated and recorded on the blockchain.

[0009] As a further limitation of the first aspect of the present invention, the user terminal checks its key status and usage records through the user terminal interface or API interface, and all usage records are stored on the blockchain; If the key is leaked or no longer needed, the user submits a key revocation request through the smart contract system. The smart contract system verifies and revokes the key and updates the usage record on the blockchain. The user end encrypts the backup key in the distributed storage system, and when recovery is needed, the corresponding decryption key is used to restore the key.

[0010] As a further limitation of the first aspect of the present invention, the private key received by the user terminal is stored in a local security environment of the user terminal; The client uses the private key to encrypt and decrypt data. For encrypted data that needs to be shared, the client uses the public key of other clients to encrypt so that only the target client can decrypt the data. When the user accesses system resources or conducts transactions, the user uses digital signatures and public keys for identity authentication to ensure the legitimacy and security of the operation; The key lifecycle management module regularly checks the key status, and the smart contract system automatically notifies the user to update the key. The user submits an update request, and the system generates and distributes a new key.

[0011] As a further limitation of the first aspect of the present invention, the sharing of public keys between users includes: The user's public key has been recorded on the blockchain when registering. Any user who needs to share data with the user can obtain the user's public key by querying the blockchain.

[0012] As a further limitation of the first aspect of the present invention, data sharing between user terminals includes: Client A uses the public key of client B to encrypt the data to be shared to ensure that only client B can decrypt and access the data. Specifically, the method includes: using symmetric encryption SM4-GCM to protect the confidentiality and integrity of the data, and then using the public key of client B to encrypt the symmetric key to perform a hybrid encryption scheme to improve encryption efficiency and security; Client A sends the encrypted data and the encrypted symmetric key to client B.

[0013] As a further limitation of the first aspect of the present invention, after receiving the encrypted data, the user terminal B uses the user terminal B's own private key to decrypt the encrypted symmetric key; Client B uses the decrypted symmetric key to decrypt the data and obtain the original information.

[0014] As a further limitation of the first aspect of the present invention, a smart contract system is used to define and manage sharing permissions. The user end sets which users can access its shared data through the smart contract system. The smart contract system supports dynamic updating of sharing permissions so that the user end can add or revoke access permissions of other users at any time.

[0015] In the second aspect, the present invention provides a distributed password management method based on blockchain.

[0016] A distributed password management method based on blockchain, applied to a server, using the distributed password management system based on blockchain described in the first aspect of the present invention, includes the following process: The server receives a key application request sent by the client through the client interface or API interface, wherein the key application request specifies the key type and purpose; The smart contract system in the server receives and verifies the application request from the client, confirms the identity and authority of the client, and after the identity and authority of the client are confirmed, the smart contract system calls the key management module, uses a secure random number generator and a strong encryption algorithm to generate a key pair, and the public key in the generated key pair is recorded on the blockchain, and the private key in the key pair is encrypted and transmitted to the client.

[0017] As a further limitation of the second aspect of the present invention, before receiving a key application request sent by a user terminal through a user terminal interface or an API interface, performing user terminal registration includes: Receiving identity information of a client, wherein the identity information includes a client name and a public key; The user's identity information is verified through the public key infrastructure, and a user identity certificate is generated and recorded on the blockchain.

[0018] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention realizes decentralization and distributed storage. Due to the decentralized nature of blockchain, each node has a complete copy of the data. The system no longer relies on a single central server, eliminating the risk of single point failure. It improves system reliability and availability. Even if some nodes fail, the system can still operate normally, ensuring high availability.

[0019] 2. The data recorded in the blockchain cannot be tampered with. Each operation will generate a unique hash value to ensure the integrity and transparency of key operation records. Powerful encryption algorithms (such as SM2, SM4-GCM) are used to ensure the security of key transmission and storage, and digital signatures and hash functions are used to verify the legitimacy of operations.

[0020] 3. The smart contract system of the present invention automatically processes operations such as key generation, distribution, update and revocation, reduces human errors, ensures the efficiency and security of key management, and can dynamically adjust access control to ensure the security of data sharing by defining and managing data sharing permissions through smart contracts.

[0021] 4. The present invention utilizes a combination of public key infrastructure (PKI) and blockchain to ensure the uniqueness and security of user identities, record and verify public keys on the blockchain, and eliminate reliance on trust intermediaries; each client can manage keys without the need to trust each other, and ensure data integrity and consistency through the blockchain consensus mechanism.

[0022] 5. All key operations of the present invention are recorded on the blockchain to form an unalterable audit log, ensuring the transparency and traceability of the operation, supporting system administrators or third-party organizations to conduct regular audits of the logs to ensure that system operations comply with security policies and compliance requirements.

[0023] 6. The present invention uses hybrid encryption technology, combined with symmetric encryption and asymmetric encryption technology, to improve the efficiency and security of data encryption and transmission, and uses public key encryption technology to ensure that only authorized users can decrypt and access shared data.

[0024] 7. The present invention stores key shards on multiple nodes and combines them with a distributed file system (such as IPFS). Even if some nodes fail, the key data can still be restored and redundant backup can be performed on multiple nodes to ensure high availability and recovery capabilities of the data.

[0025] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0027] Figure 1 A schematic diagram of a distributed password management system based on blockchain provided by the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0029] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0030] This implementation proposes a distributed password management based on blockchain. The following is a brief introduction to the technical terms and related concepts involved in this solution, including: Blockchain is a decentralized distributed ledger technology that combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies to record transactions and information through ever-growing data blocks to ensure data security and transparency.

[0031] The basic principles of blockchain, including: (1) Data grouping and packaging. "Block" means that data is grouped and packaged into data blocks one by one. "Chain" means that each block is linked together through a hash value to form a chain structure that continues to expand. (2) Transaction verification: Once a transaction is broadcast, nodes in the blockchain network begin to verify the validity of the transaction, such as proof of work (PoW) or proof of stake (PoS), to ensure that there is no double payment or other fraud in the transaction; (3) Transaction packaging and on-chain recording: Transaction information is packaged into a data block, namely a "block". This block will be added to the end of the blockchain, becoming part of the blockchain, and synchronizing the latest blockchain to other network nodes; (4) Consensus is reached. Each node in the blockchain has its own copy and maintains the integrity of the entire blockchain. Through the consensus algorithm, the nodes reach an agreement to ensure that all nodes have the same blockchain data.

[0032] In this implementation, a decentralized key management system is implemented using blockchain technology. Figure 1 As shown, it includes the user end (for key application / view management operations), API interface, server end (connecting the blockchain network and identity management module, the blockchain network includes multiple nodes, and the identity management module performs identity authentication and identity records), smart contract system (including identity management contract and access control contract), key management module (including key generation module and key distribution module), data encryption and sharing module, security audit, and generation of audit logs. This implementation method has the following advantages: decentralization, eliminating single point failures, and improving system reliability; security, unalterable blockchain records and powerful encryption technology ensure data security; automated management, smart contracts automatically handle key management operations to improve efficiency; identity authentication: PKI combined with blockchain to ensure the uniqueness and security of identity; transparency and traceability, blockchain records all operations to ensure transparency and traceability; efficient key sharing, hybrid encryption technology ensures the security and efficiency of data sharing; distributed storage, improves data redundancy and recovery capabilities; through these technical advantages, the decentralized key management system based on blockchain is significantly superior to the traditional key management system in terms of security, reliability, management efficiency and data transparency.

[0033] The above-mentioned decentralized key management system mainly includes the following key parts: (1) Blockchain network.

[0034] Nodes: Computers participating in the blockchain network. Each node stores a complete copy of the blockchain data and participates in the consensus mechanism. Consensus Mechanism: It is used to ensure that all nodes reach a consensus on the state of the blockchain. Consensus algorithms such as PoW (Proof of Work) and PoS (Proof of Stake) can be used.

[0035] (2) Key generation and distribution.

[0036] Key Generation Module: responsible for generating encryption keys. It can use random number generators and strong encryption algorithms such as SM2, ECC, etc. Key Distribution Module: securely distributes keys through the blockchain network, using public key encryption technology to ensure that only authorized recipients can obtain keys.

[0037] (3) Smart contract system.

[0038] Key Management Smart Contracts: Automated management of key generation, distribution, storage, update, and destruction; Access Control Smart Contracts: Define and enforce access control policies to ensure that only authorized users can access and operate keys.

[0039] (4) Key storage.

[0040] Decentralized Storage System: Combine blockchain and distributed file system (IPFS) to store keys or key fragments, ensuring data redundancy and high availability; Encrypted Storage: Key data is encrypted before storage and can only be accessed by users who hold the correct decryption key.

[0041] (5) Identity authentication and authorization.

[0042] Identity Management Module: manages user identity and authentication information and uses public key infrastructure (PKI) for identity authentication; Multisignature Mechanism: Important operations require multiple authorized users to sign together to increase security.

[0043] (6) Key lifecycle management.

[0044] Key Lifecycle Management Module: manages the entire lifecycle of keys, including generation, activation, update, revocation, and destruction; Automated Renewal and Revocation: Smart contracts periodically check the status of keys and automatically renew or revoke keys that are expired or no longer needed.

[0045] (7) Auditing and logging.

[0046] Audit Log Module: records detailed logs of all key operations and stores them on the blockchain to ensure that they cannot be tampered with and are traceable; Security Audit Module: Regularly audit key management operations to ensure compliance with security policies and compliance requirements.

[0047] (8) User interface.

[0048] User Interface: Provides a friendly interface for users to perform key management operations, including key generation, distribution, update, log viewing and other functions; API Interface: Provides a standardized interface for external systems to facilitate integration and calling of key management services.

[0049] Through the collaborative work of the above parts, the decentralized key management system based on blockchain technology can provide key management services with high security, reliability and transparency, and solve many shortcomings of traditional key management systems.

[0050] In this implementation, user registration and key application include the following process: 1) User registration and identity verification.

[0051] User registration: Users register in the system and submit identity information, such as user name and public key; Identity verification: The system verifies the user's identity through the public key infrastructure (PKI), generates a user identity certificate, and records it on the blockchain; Identity record: The user's identity information and public key create a record on the blockchain to ensure the uniqueness and verifiability of the identity.

[0052] 2) Key application.

[0053] Key application request: The user submits a key application request through the user interface (UI) or API interface, specifying the key type and purpose; Smart contract processing: The key management smart contract receives and verifies the user's application request, confirms the user's identity and permissions; Key generation: The smart contract calls the key generation module and uses a secure random number generator and a strong encryption algorithm to generate a key pair (public key and private key); Key distribution: The generated key pair is securely distributed to users through the blockchain network. The public key is recorded on the blockchain, and the private key is transmitted to the user through encryption.

[0054] 3) Key usage.

[0055] Key storage: After the user receives the key, the private key is stored in the user's local secure environment, such as a hardware security module (HSM) or an encrypted digital wallet; Data encryption / decryption: Users use private keys to encrypt and decrypt data. For encrypted data that needs to be shared, users use other users' public keys to encrypt data to ensure that only the target user can decrypt the data; Identity authentication: When users access system resources or conduct transactions, they use digital signatures and public keys to authenticate their identities to ensure the legality and security of the operations; Key update: The key lifecycle management module regularly checks the key status, and the smart contract automatically notifies the user to update the key. The user submits an update request, and the system generates and distributes a new key.

[0056] 4) Key management.

[0057] Key viewing: Users can view their key status and usage records through the UI or API interface. All operations are recorded on the blockchain to ensure transparency and traceability. Key revocation: If the key is leaked or no longer needed, the user can submit a key revocation request through the smart contract. After verification, the system will revoke the key and update the blockchain record. Key backup and recovery: Users can back up keys in a distributed storage system and use encryption to ensure security. When recovery is needed, use the correct decryption key to restore.

[0058] 5) Auditing and logging.

[0059] Operation records: All key application, generation, distribution, use, update and revocation operations are recorded on the blockchain, forming an unalterable audit log; Security Audit: System administrators or third-party auditors can regularly review log records on the blockchain to ensure that all operations meet security and compliance requirements.

[0060] Specifically, it can be summarized as the following brief process: S1.1: Registration, user registration and identity verification; S1.2: Apply for a key, submit a key application request, and the smart contract generates and distributes the key; S1.3: Using keys, users store and use keys in a local secure environment for encryption, decryption, and identity authentication operations; S1.4: Manage keys. Users can check key status and submit renewal or revocation requests, which are automatically processed by the system. S1.5: Audit, the system records all operation logs and supports regular audits and security checks.

[0061] Through the above process, blockchain technology can provide a secure, transparent and efficient decentralized key management system to ensure the security and manageability of user keys.

[0062] Sharing keys is an important function in a decentralized key management system, especially when data needs to be securely transmitted between multiple users. The following are the detailed steps for sharing keys: A) Public key sharing.

[0063] Public key release: The user's public key has been recorded on the blockchain when registering. Anyone who needs to share data with the user can obtain the user's public key by querying the blockchain; Public key query: When user A needs to share data with user B, user A queries user B's public key through the blockchain.

[0064] B) Data encryption and sharing.

[0065] Data encryption: User A uses user B's public key to encrypt the data to be shared, ensuring that only user B can decrypt and access the data. This solution uses symmetric encryption (SM4-GCM) to protect the confidentiality and integrity of the data, and then uses user B's public key to encrypt the symmetric key to form a hybrid encryption solution to improve encryption efficiency and security. Data transmission: User A sends the encrypted data and the encrypted symmetric key to user B.

[0066] C) Data decryption and access.

[0067] Key decryption: After receiving the encrypted data, user B uses his own private key to decrypt the encrypted symmetric key; Data decryption: User B uses the decrypted symmetric key to decrypt the data and obtain the original information.

[0068] D) Smart contract management.

[0069] Permission control: Use smart contracts to define and manage sharing permissions. Users can use smart contracts to set which users can access their shared data. Dynamic Update: Smart contracts support dynamic updates of sharing permissions, and users can add or revoke other users’ access rights at any time.

[0070] Specifically, it can be summarized as the following brief process: S2.1: Public key sharing, user A queries user B’s public key through the blockchain; S2.2: Data encryption: User A uses the public key of User B to encrypt data and generate an encrypted data packet; S2.3: Data transmission, user A sends the encrypted data packet to user B; S2.4: Key decryption: User B uses his private key to decrypt the encrypted symmetric key; S2.5: Data decryption: User B uses the decrypted symmetric key to decrypt the data and obtain the original information. S2.6: Permission management, setting and managing sharing permissions through smart contracts to ensure dynamic adjustment of data access control.

[0071] Through the above steps and methods, blockchain technology can provide a secure and efficient decentralized key sharing mechanism to ensure the secure transmission and access of data between users.

[0072] The present invention innovatively proposes a decentralized architecture, which distributes the storage of public keys and key operation records through the blockchain network, eliminates the risks of single point failure and centralized management, and ensures that all nodes reach an agreement on the blockchain status through a consensus mechanism to prevent tampering and falsification of records.

[0073] The present invention innovatively proposes an identity authentication and management strategy, uses public and private keys to authenticate users, ensures the uniqueness and security of user identities, records and manages user identity information and public keys through smart contracts, and provides an access control interface; the present invention generates key pairs through a key generation module using a strong encryption algorithm to ensure the randomness and security of keys, and uses a blockchain network to securely distribute keys through a key distribution module to ensure that only authorized users can obtain keys; the present invention uses hybrid encryption when encrypting and sharing data, combining symmetric encryption (such as AES) and asymmetric encryption (such as RSA) to improve encryption efficiency and security; user A uses user B's public key to encrypt data and symmetric keys to ensure that only user B can decrypt and access data; the present invention defines and manages data sharing permissions through permission control smart contracts to ensure that only authorized users can access shared data, and smart contracts automatically handle key generation, distribution, update and revocation operations; the present invention generates an audit log that cannot be tampered with, and all key operations are recorded on the blockchain to ensure transparency and traceability of operations. System administrators or third-party organizations can review logs to ensure that operations meet security and compliance requirements.

[0074] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A distributed password management system based on blockchain, characterized in that: Including the user side and the server side; The server receives a key application request sent by the client through the client interface or API interface, wherein the key application request specifies the key type and purpose; The smart contract system in the server receives and verifies the application request from the client, confirms the identity and authority of the client, and after the identity and authority of the client are confirmed, the smart contract system calls the key management module, uses a secure random number generator and a strong encryption algorithm to generate a key pair, and the public key in the generated key pair is recorded on the blockchain, and the private key in the key pair is encrypted and transmitted to the client.

2. The distributed password management system based on blockchain as claimed in claim 1, characterized in that: Before receiving a key application request sent by a client through a client interface or an API interface, perform client registration, including: Receiving identity information of a client, wherein the identity information includes a client name and a public key; The user's identity information is verified through the public key infrastructure, and a user identity certificate is generated and recorded on the blockchain.

3. The distributed password management system based on blockchain as claimed in claim 1, characterized in that: The user can view his / her key status and usage records through the user interface or API interface, and all usage records are stored on the blockchain; If the key is leaked or no longer needed, the user submits a key revocation request through the smart contract system. The smart contract system verifies and revokes the key and updates the usage record on the blockchain. The user end encrypts the backup key in the distributed storage system, and when recovery is needed, the corresponding decryption key is used to restore the key.

4. The distributed password management system based on blockchain as claimed in claim 1, characterized in that: The private key received by the client is stored in the client's local secure environment; The client uses the private key to encrypt and decrypt data. For encrypted data that needs to be shared, the client uses the public key of other clients to encrypt so that only the target client can decrypt the data. When the user accesses system resources or conducts transactions, the user uses digital signatures and public keys for identity authentication to ensure the legitimacy and security of the operation; The key lifecycle management module regularly checks the key status, and the smart contract system automatically notifies the user to update the key. The user submits an update request, and the system generates and distributes a new key.

5. The distributed password management system based on blockchain as claimed in claim 4, characterized in that: The sharing of public keys between users includes: the user's public key has been recorded on the blockchain when registering, and any user who needs to share data with the user obtains the user's public key by querying the blockchain.

6. The distributed password management system based on blockchain as claimed in claim 5, characterized in that: Data sharing between user terminals includes: user terminal A uses the public key of user terminal B to encrypt the data to be shared to ensure that only user terminal B can decrypt and access the data; specifically, it includes: using symmetric encryption SM4-GCM to protect the confidentiality and integrity of the data, and then using the public key of user terminal B to encrypt the symmetric key to perform a hybrid encryption scheme to improve encryption efficiency and security; user terminal A sends the encrypted data and the encrypted symmetric key to user terminal B.

7. The distributed password management system based on blockchain as claimed in claim 6, characterized in that: After receiving the encrypted data, client B uses its own private key to decrypt the encrypted symmetric key; client B uses the decrypted symmetric key to decrypt the data and obtain the original information.

8. The distributed password management system based on blockchain according to any one of claims 1 to 6, characterized in that: Sharing permissions are defined and managed using the smart contract system. The user side uses the smart contract system to set which users can access their shared data. The smart contract system supports dynamic updates of sharing permissions so that the user side can add or revoke access permissions of other users at any time.

9. A distributed password management method based on blockchain, characterized in that: Applied to the server, using the distributed password management system based on blockchain as described in any one of claims 1 to 8, The process includes: The server receives a key application request sent by the client through the client interface or API interface, wherein the key application request specifies the key type and purpose; The smart contract system in the server receives and verifies the application request from the client, confirms the identity and authority of the client, and after the identity and authority of the client are confirmed, the smart contract system calls the key management module, uses a secure random number generator and a strong encryption algorithm to generate a key pair, and the public key in the generated key pair is recorded on the blockchain, and the private key in the key pair is encrypted and transmitted to the client.

10. The distributed password management method based on blockchain as claimed in claim 9, characterized in that: Before receiving a key application request sent by a client through a client interface or an API interface, the client is registered, including: receiving the identity information of the client, the identity information including the client name and the public key; verifying the identity information of the client through a public key infrastructure, generating a client identity certificate, and recording it on the blockchain.

Images