On-chain data security verification method and system

Abstract

The invention belongs to the technical field of security verification, and discloses an on-chain data security verification method and system. The method comprises the following steps: constructing a block chain network based on a cloud data center, and carrying out key generation and identity authentication on all nodes; encrypting and signing the real-time under-chain data based on the first node; based on an IFPS system, storing the encrypted real-time off-chain data, and generating a real-time on-chain data block; based on the block chain network, consensus is carried out on the real-time data transaction request, and link-up is carried out on the real-time on-chain data block; based on the second node, performing signature verification on the real-time signature data, and after the signature verification is passed, obtaining a real-time storage address; extracting the encrypted real-time off-chain data according to the real-time storage address, and decrypting the encrypted real-time off-chain data; and converting the real-time transaction record into a corresponding real-time transaction data block, and performing chaining. According to the invention, the problems of high cost, low efficiency and easy attack in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of security verification, and specifically relates to a method and system for security verification of data on a chain. Background Art

[0002] Blockchain technology is widely used in finance, supply chain, Internet of Things and other fields due to its decentralization, immutability and transparency. However, when blockchain technology processes off-chain data, how to ensure the authenticity and validity of off-chain data when it is referenced on the chain has become an urgent problem to be solved. At present, some solutions mainly rely on centralized third-party verification agencies, but this method has problems such as high cost, low efficiency and vulnerability to attacks. Summary of the invention

[0003] In order to solve the problems of high cost, low efficiency and vulnerability to attacks in the prior art, the present invention aims to provide a method and system for on-chain data security verification.

[0004] The technical solution adopted by the present invention is:

[0005] A method for verifying the security of data on a chain comprises the following steps:

[0006] Based on the cloud data center, a blockchain network is built to generate keys and authenticate identities for all nodes in the blockchain network, and obtain the public-private key pair and signature information of each node; the public-private key pair includes a public key and a private key;

[0007] Based on the first node, the real-time off-chain data is encrypted and signed according to the public key of the second node and the signature information of the first node to obtain the corresponding encrypted real-time off-chain data and real-time signature data;

[0008] Based on the IFPS system, generate the encrypted real-time off-chain data hash value and real-time storage address of the real-time off-chain data, convert the real-time off-chain data hash value and real-time storage address into real-time on-chain data blocks, and generate corresponding real-time data transaction requests;

[0009] Based on the blockchain network, consensus is reached on real-time data transaction requests. After consensus is successful, the real-time on-chain data blocks are linked to the chain, and the real-time off-chain data hash value and real-time signature data are sent to the second node;

[0010] Based on the second node, the real-time signature data is verified. After the signature verification is passed, the corresponding real-time on-chain data block is retrieved according to the hash value of the real-time off-chain data, and the real-time storage address in the real-time on-chain data block is obtained;

[0011] According to the real-time storage address, the corresponding encrypted real-time off-chain data is extracted in the IFPS system, and the encrypted real-time off-chain data is decrypted according to the private key of the second node to obtain the corresponding decrypted real-time off-chain data;

[0012] Generate a real-time transaction record for this transaction, execute the smart contract, convert the real-time transaction record into the corresponding real-time transaction data block, and use the blockchain network to link the real-time transaction data block to the chain.

[0013] Furthermore, a blockchain network is constructed based on a cloud data center. Based on a trusted institution, keys are generated and identities are authenticated for all nodes in the blockchain network to obtain the public and private key pairs and signature information of each node, including the following steps:

[0014] Based on the cloud data center, deploy smart contracts, IFPS system and several data servers to build a blockchain network consisting of several nodes; each node corresponds to a data server;

[0015] Based on the trusted institution, the public and private key pairs and signature information of each node are obtained by performing key generation and identity authentication on all nodes in the blockchain network;

[0016] The public key in the public-private key pair is published to the blockchain network, the private key and signature information in the public-private key pair are returned to the corresponding node, and the signature information of the node is recorded in the distributed ledger.

[0017] Furthermore, based on the IFPS system, a real-time off-chain data hash value and a real-time storage address of the encrypted real-time off-chain data are generated, and the real-time off-chain data hash value and the real-time storage address are converted into a real-time on-chain data block, and a corresponding real-time data transaction request is generated, including the following steps:

[0018] Based on the IFPS system, generate the real-time off-chain data hash value of the encrypted real-time off-chain data, store the encrypted real-time off-chain data, and obtain the corresponding real-time storage address;

[0019] Return the encrypted real-time off-chain data and real-time storage address to the blockchain network, and execute the smart contract to convert the real-time off-chain data hash value and real-time storage address into real-time on-chain data blocks;

[0020] Generate a real-time data transaction request corresponding to the real-time on-chain data block, and publish the real-time data transaction request to all nodes in the blockchain network.

[0021] Furthermore, based on the blockchain network, consensus is reached on the real-time data transaction request. After the consensus is successful, the real-time on-chain data block is linked to the chain, and the real-time off-chain data hash value and real-time signature data are sent to the second node, including the following steps:

[0022] Based on the blockchain network, the IPBFT consensus algorithm is used to reach consensus on real-time data transaction requests;

[0023] If the consensus is successful, proceed to the next step; otherwise, return the consensus failure information to the first node and end the method;

[0024] Allocate corresponding unique time slices to all nodes in the blockchain network, and publish real-time on-chain data blocks to all nodes in the blockchain network;

[0025] Within the time range of the unique time slice, the node that receives the data block on the real-time chain links the data block on the real-time chain to the chain, and returns the success information of linking to the first node;

[0026] Send the real-time off-chain data hash value and real-time signature data to the second node.

[0027] Furthermore, by combining the evaluation hierarchical mechanism, AP clustering algorithm and Raft algorithm, the PBFT consensus algorithm is improved to construct the IPBFT consensus algorithm.

[0028] Furthermore, based on the blockchain network, the IPBFT consensus algorithm is used to reach consensus on real-time data transaction requests, including the following steps:

[0029] Based on the blockchain network, an evaluation hierarchical mechanism is used to divide several nodes in the blockchain network into a classification consensus layer, a consensus confirmation layer, and a supervision layer;

[0030] Introduce a reputation mechanism and use the AP clustering algorithm to group several nodes in the classification consensus layer to obtain a leadership node group and corresponding consensus node groups; the leadership node group includes several leadership nodes, each leadership node corresponds to a consensus node group, and the consensus node group includes several consensus nodes;

[0031] The leader node that receives the real-time data transaction request is used as the master node, and the corresponding consensus node group is used as the master consensus node group;

[0032] Based on the master node and master consensus node group, the IPBFT consensus algorithm is used to conduct a two-stage IPBFT intra-group consensus;

[0033] After the two-stage IPBFT intra-group consensus is successful, the Raft algorithm is used among all consensus node groups to conduct inter-group Raft consensus based on the master node and leader node group.

[0034] Furthermore, based on the master node and the master consensus node group, the IPBFT consensus algorithm is used to perform a two-stage IPBFT intra-group consensus, including the following steps:

[0035] Based on the master node, use the IPBFT consensus algorithm to broadcast the pre-prepared message to other consensus nodes in the master consensus node group;

[0036] The consensus node based on the main consensus node group verifies the validity of the pre-prepared message. After the validity verification is passed, it enters the ready state and sends the ready message to other consensus nodes in the same main consensus node group;

[0037] After receiving a preset number of prepare messages, the validity of the prepare messages and the identity of the node are verified. After the validity and node identity verification are passed, the two-stage IPBFT group consensus is successful.

[0038] Furthermore, after the two-stage IPBFT intra-group consensus is successful, the Raft algorithm is used among all consensus node groups based on the master node and the leader node group to perform inter-group Raft consensus, including the following steps:

[0039] After the two-stage IPBFT group consensus is successful, the master node is used to generate a real-time consensus transaction message and send the real-time consensus transaction message to other leader nodes in the leader node group;

[0040] Based on the leader node, it receives the consensus transaction message of the two-stage IPBFT intra-group consensus and uses the Raft algorithm to perform inter-group Raft consensus;

[0041] Convert consensus transaction messages into log entries and broadcast the log entries to other consensus nodes in the consensus node group;

[0042] Based on other consensus nodes in the consensus node group, append the log entry to the local log and send a confirmation message to the supervision layer;

[0043] Based on the supervision layer, after receiving a preset number of confirmation messages, the corresponding leader node is reviewed. After the review is passed, the inter-group Raft consensus is successful.

[0044] Furthermore, based on the second node, the real-time signature data is signature verified. After the signature verification is passed, the corresponding real-time on-chain data block is retrieved according to the real-time off-chain data hash value, and the real-time storage address in the real-time on-chain data block is obtained, including the following steps:

[0045] Based on the second node, the distributed ledger is called to extract the signature information of the first node, and the smart contract is executed according to the signature information of the first node to perform signature verification on the real-time signature data;

[0046] If the signature verification passes, proceed to the next step; otherwise, return signature verification failure information to the second node and end the method;

[0047] According to the real-time off-chain data hash value, the corresponding real-time on-chain data block in the blockchain network, and the real-time off-chain data hash value received by the second node is compared and verified with the real-time on-chain data block in the real-time on-chain data block;

[0048] If the comparison and verification pass, the real-time storage address in the real-time chain data block is obtained, otherwise, the comparison and verification failure information is returned to the second node and the method ends.

[0049] An on-chain data security verification system is used to implement an on-chain data security verification method. The system includes a node identity authentication unit, an encryption signature unit, an off-chain data storage unit, a block chain unit, a signature verification unit, an off-chain data extraction unit, and a transaction data recording unit connected in sequence.

[0050] The beneficial effects of the present invention are:

[0051] The present invention discloses a method and system for secure verification of data on a chain, which utilizes blockchain technology to construct a decentralized network, reduces dependence on centralized third-party verification agencies, and further reduces cost investment; combines asymmetric encryption algorithms and digital identity authentication technologies to ensure confidentiality and integrity of data, and improves the security level of the blockchain network; combines the Byzantine fault tolerance characteristics of the PBFT algorithm and the efficient consistency of the Raft algorithm, and proposes an IPBFT consensus algorithm, which reduces the communication complexity of the system and improves consensus efficiency; off-chain data is converted into on-chain data through hash values, and is stored and securely verified on the blockchain; the recipient can retrieve on-chain data blocks by querying the blockchain, and verify the authenticity and validity of the off-chain data, and this method ensures the security and reliability of off-chain data when it is referenced on the chain.

[0052] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flowchart of the on-chain data security verification method of the present invention.

[0054] Figure 2 It is a structural block diagram of the on-chain data security verification system of the present invention. DETAILED DESCRIPTION

[0055] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

[0056] Embodiment 1:

[0057] like Figure 1 As shown, this embodiment provides a method for chain data security verification, including the following steps:

[0058] S1: Based on the cloud data center, a blockchain network is built, and keys are generated and identity authenticated for all nodes in the blockchain network to obtain the public and private key pairs and signature information of each node, including the following steps:

[0059] S1-1: Based on the cloud data center, deploy smart contracts, Inter Planetary File System (IPFS) and several data servers to build a blockchain network consisting of several nodes; each node corresponds to a data server;

[0060] S1-2: Based on the trusted institution, the public-private key pair and signature information of each node are obtained by performing key generation and identity authentication on all nodes in the blockchain network; the public-private key pair includes a public key and a private key;

[0061] The steps include:

[0062] S1-2-1: Based on the cloud data center, collect the attribute information and entity IDs of all nodes in the blockchain network, and send some attribute information and some entity IDs to the trusted institution;

[0063] S1-2-2: Based on the trusted institution and the attribute information of the node, an asymmetric encryption algorithm is used to generate keys to obtain the public parameter GP, the master key MSK and the initial key PK;

[0064] The formula is:

[0065] GP={g,g1,g a ,e(g,g) a ,H1,H2,H3,H4,H5,H6}

[0066] PK={g,g1,g a ,e(g,g) a ,H u}

[0067] MSK = {g a ,a}

[0068] Where GP is the public parameter; MSK is the master key; PK is the initial key; a is the integer domain Z p Random numbers; H1, H2, H3, H4, H5, H6, H u All are target hash functions; g, g1, g a are all random numbers that are generators of the cyclic group G; e(g,g) a is a bilinear map of random numbers g;

[0069] S1-2-3: Based on the public parameter GP, the master key MSK, the initial key PK and the node attribute information Vu , generate the corresponding node's public-private key pair, the public-private key pair includes the private key SK u and public key PK u , the formula is:

[0070] SK u = {MSK,V u ,K=g a g ab ,L u =g b ,(K=H3(V u ) b )}

[0071]

[0072] In the formula, SK u is the private key of node u; b is the integer domain Z p Random number; L u , K is the private key parameter of node u; H3 is the target hash function of the public parameter GP; u is the node indicator; MSK is the master key; PK is the initial key; PK u is the public key of node u; g b , g a , g ab is the random number of the generator of the cyclic group G; V u is the attribute information of node u;

[0073] S1-2-4: Perform identity authentication based on the private key in the public-private key pair and the corresponding entity ID to obtain the signature information of the corresponding node;

[0074] The formula is:

[0075]

[0076] Where k′ is a random number; K u Registration parameter of node u; KID u is the registration ID of node u; KID u and the corresponding K u The signature information {K u ,KID u}; H1 is the target hash function; ID u SK is the entity ID of node u; u is the private key of node u; is the prime order; P is the base point of the prime domain;

[0077] S1-3: Publish the public key in the public-private key pair to the blockchain network, return the private key and signature information in the public-private key pair to the corresponding node, and record the signature information of the node in the distributed ledger;

[0078] S2: Based on the first node, according to the public key of the second node and the signature information of the first node, the real-time off-chain data is encrypted and signed to obtain the corresponding encrypted real-time off-chain data and real-time signature data, including the following steps:

[0079] S2-1: Based on the first node as the data provider, receive the real-time off-chain data uploaded by the user and verify the legitimacy of the real-time off-chain data;

[0080] S2-2: If the legality verification passes, proceed to the next step; otherwise, return legality verification failure information to the first node and end the method;

[0081] S2-3: Encrypt the real-time off-chain data according to the public key of the second node as the data receiver, obtain the corresponding encrypted real-time off-chain data, and send the encrypted real-time off-chain data to the IFPS system;

[0082] The formula is:

[0083] M u2 =E(PK u2 ,m u1 )

[0084] Where M u2 is the encrypted real-time off-chain data; E(*) is the asymmetric encryption function; m u1 PK is the real-time service data received by the first node; u2 is the public key of the second node; u1 and u2 are the indicators of the first node and the second node;

[0085] S2-4: According to the signature information of the first node, the encrypted real-time off-chain data is signed to obtain corresponding real-time signature data;

[0086] The formula is:

[0087]

[0088] In the formula, r' is a random number; is the prime order; P is the base point of the prime domain; H2 is the target hash function; K u1 is the signature information of the first node {K u1 ,KID u1}Registration parameters of the first node in; KID y1 is the signature information of the first node {K u1 ,KID u1}Registration ID of the first node in u1 is the entity ID of the first node; the real-time signature data is {ID u1 ,Mu1 ,γ'={K u1 ,R u1 ,B u1}}; R u ,B u ,γ' are the signature parameters of the first node;

[0089] S3: Based on the IFPS system, generate the encrypted real-time off-chain data hash value and real-time storage address of the real-time off-chain data, convert the real-time off-chain data hash value and real-time storage address into real-time on-chain data blocks, and generate the corresponding real-time data transaction request, including the following steps:

[0090] S3-1: Based on the IFPS system, generate the real-time off-chain data hash value of the encrypted real-time off-chain data, store the encrypted real-time off-chain data, and obtain the corresponding real-time storage address;

[0091] S3-2: Return the encrypted real-time off-chain data and real-time storage address to the blockchain network, and execute the smart contract to convert the real-time off-chain data hash value and real-time storage address into real-time on-chain data blocks;

[0092] S3-3: Generate a real-time data transaction request corresponding to the real-time on-chain data block, and publish the real-time data transaction request to all nodes in the blockchain network;

[0093] S4: Based on the blockchain network, consensus is reached on the real-time data transaction request. After the consensus is successful, the real-time on-chain data block is linked to the chain, and the real-time off-chain data hash value and real-time signature data are sent to the second node, including the following steps:

[0094] S4-1: Based on the blockchain network, use the Improved Practical Byzantine Fault Tolerance (IPBFT) consensus algorithm to reach consensus on real-time data transaction requests;

[0095] By combining the evaluation hierarchical mechanism, the Affinity-Propagation (AP) clustering algorithm and the Raft algorithm, the Practical Byzantine Fault Tolerance (IPBFT) consensus algorithm is improved to construct the IPBFT consensus algorithm, which includes the following steps:

[0096] S4-1-1: Based on the blockchain network, use the evaluation stratification mechanism to divide several nodes in the blockchain network into classification consensus layer, consensus confirmation layer and supervision layer; each layer cooperates to improve consensus efficiency and ensure consensus accuracy;

[0097] The hierarchical mechanism divides nodes into the classification consensus layer, consensus confirmation layer, and supervision layer. If the leadership node and the supervision node are Byzantine nodes, they are likely to fail to fulfill their obligations, resulting in the interruption of the consensus process. In order to make the elected nodes as reliable as possible, an evaluation system is introduced into the hierarchical mechanism. According to the behavior status of the node in a round of consensus, each node is scored for consensus credit. In the initial state, the score value of each node is 0. When a round of consensus ends, the score value of each node will be adjusted.

[0098] For all nodes, if the node correctly participates in the consensus this round, but did not correctly participate in the consensus in the previous round, the Score value increases by 1; if the node correctly participates in the consensus this round and has participated in the consensus for n consecutive rounds, the Score value increases according to the Fibonacci sequence.

[0099] All nodes in the consensus confirmation layer, the supervision layer, and the leading nodes in the classification consensus layer are key nodes, and the remaining nodes are ordinary nodes. For nodes that cannot stably and continuously participate in consensus, the probability of them becoming key nodes should be reduced to ensure the activity of the system. For nodes that do not correctly participate in consensus, if the node is a key node, the Score value is directly reduced to 0. If the node is an ordinary node, it is determined whether the node is a Byzantine node. If the node is determined to be a Byzantine node, the Score value is directly set to 0. If the node fails to correctly participate in the consensus due to network reasons and is not determined to be a Byzantine node in this round, the Score value is reduced by 1.

[0100] S4-1-2: Introduce the reputation mechanism and use the AP clustering algorithm to group several nodes in the classification consensus layer to obtain the leadership node group and the corresponding consensus node groups, including the following steps:

[0101] S4-1-2-1: Use the AP clustering algorithm to initialize several nodes in the blockchain and obtain M initial cluster centers, where M is the total number of cluster centers;

[0102] S4-1-2-2: Introduce a reward and punishment mechanism, obtain the reputation values ​​of several nodes in the blockchain network, sort the nodes in descending order according to the reputation values, and set bias parameters for the first M nodes;

[0103] The bias parameter indicates the tendency of a data point to be selected as a cluster center, and has an important influence on which class representatives will be the final cluster centers. When the bias parameter value is larger, the data point is more likely to be the final cluster center, which weakens the influence of the AP clustering algorithm on the initial nodes.

[0104] The formula for the reward and punishment mechanism is:

[0105]

[0106] In the formula, ε is the number of times the node participates in data security verification; e is a natural constant; the reward value formula is based on a Sigmoid function, which is a special form of the Logistic function and a commonly used s-type activation function in neural networks. The output range of this function's value domain is 0 to 1, which can normalize the output variable. When a node participates in consensus, the reward value obtained by the node will experience a period of slow growth. As the number of verifications increases, the final reward value obtained by the node will gradually tend to be constant. The Sigmoid function maps the reward value obtained by the node within a certain range, which can prevent the node from obtaining too large a reward value and generating a "super node";

[0107]

[0108] In the formula, bad i is the number of data security verification failures; B is the penalty trigger threshold; when the node fails data security verification multiple times, the system will automatically determine that the node is a Byzantine node and will not be allowed to participate in the consensus process, quickly eliminating malicious master nodes in the network to prevent malicious master nodes from affecting the reliability and security of the system, effectively ensuring the honesty of the consensus node;

[0109] The formula for reputation is:

[0110]

[0111] In the formula, C i is the current reputation value of each node; i is the node indicator; is the initial reputation value of each node; α1 is the weight of the reward mechanism; R(i) is the single reward value of the node; α2 is the weight of the penalty mechanism; P(i) is the single penalty value of the node; the node reputation value will be updated after completing a consensus cycle;

[0112] S4-1-2-3: Update the attraction information and belonging information of all nodes, and update M cluster centers according to the attraction information and belonging information;

[0113] The formula for attractiveness information is:

[0114]

[0115] In the formula, r t+1 (i, k) is the degree to which node k is suitable as the cluster center of node i at iteration number t+1, that is, the attraction information of node k to node i; a t (i, j) is the suitability of node i to select node j as its cluster center at iteration number t; r t(i, j) is the degree to which node j is suitable as the cluster center of node i at iteration number t; s(i, k) is the similarity of node k as the cluster center of node i; i, j and k are all node indicators;

[0116] The formula for attribution information is:

[0117]

[0118] In the formula, r t+1 (k, k) is the degree to which node k is suitable as a cluster center when the number of iterations is t+1; ∑ j≠i,k max{r t+1 (j,k),0} is the degree to which node k is suitable to be a cluster center other than node i at the iteration number t+1; a t+1 (i, k) is the suitability of node i to select node k as its cluster center at iteration number t+1, that is, the belonging information of node k to node i;

[0119] S4-1-2-4: Group the nodes according to the similarity between the updated cluster center and the nodes to obtain M consensus node groups;

[0120] S4-1-2-5: The cluster centers corresponding to the M consensus node groups are used as the leader nodes to obtain the leader node group, and the other nodes in the consensus node group are used as consensus nodes;

[0121] S4-1-2-6: Introduce the iterative attenuation coefficient, iteratively update according to the node's attraction information and belonging information, and obtain the final M clustering centers in the blockchain network;

[0122] The iterative update formula of attractiveness information and belonging information is:

[0123] r' t+1 (i,k)=λ*r t (i,k)+(1-λ)*r t+1 (i,k)

[0124] a' t+1 (i,k)=λ*a t (i,k)+(1-λ)*a t+1 (i,k)

[0125] In the formula, r' t+1 (i,k), a' t+1 (i, k) is the updated attraction information and updated belonging information of node k to node i at iteration number t+1; λ is the iteration attenuation coefficient; r t (i,k),r t+1(i, k) is the attraction information of node k to node i at iterations t and t+1; a t (i,k), a t+1 (i, k) is the ownership information of node k to node i at iterations t and t+1;

[0126] The judgment formula of cluster center is:

[0127] k=argmax{a(i,k)+r(i,k)}

[0128] In the formula, i and k are both node indicators; if i = k, then node i is the cluster center of node k; if i ≠ k, then node k is the cluster center of node i;

[0129] S4-1-2-7: Update the consensus node group according to the number of nodes in the consensus node group; determine the number of nodes in the consensus node group. When it is greater than the maximum number of nodes that the consensus node group can accommodate, the newly applied node is divided into the smallest consensus node group other than the cluster center point; when the number of nodes is less than 4, update the attraction and belongingness values ​​of each point, and repeat this process continuously to make all consensus node groups meet Byzantine fault tolerance;

[0130] S4-1-2-8: If the number of iterations exceeds the iteration threshold or the cluster center does not change, output the final leader node group and the corresponding final consensus node groups;

[0131] The leader node group includes a plurality of leader nodes, each leader node corresponds to a consensus node group, and the consensus node group includes a plurality of consensus nodes;

[0132] S4-1-3: The leader node that receives the real-time data transaction request is used as the master node, and the corresponding consensus node group is used as the master consensus node group;

[0133] S4-1-4: Based on the master node and master consensus node group, use the IPBFT consensus algorithm to perform a two-stage IPBFT group consensus, including the following steps:

[0134] S4-1-4-1: Based on the master node, use the IPBFT consensus algorithm to broadcast the pre-prepared message to other consensus nodes in the master consensus node group;

[0135] S4-1-4-2: Based on the consensus node of the main consensus node group, verify the validity of the pre-prepare message. After the validity verification is passed, enter the preparation state and send the preparation message to other consensus nodes in the same main consensus node group;

[0136] S4-1-4-3: After receiving the preset number of prepare messages, verify the validity of the prepare messages and the node identity. After the validity and node identity verification are passed, the two-stage IPBFT group consensus succeeds;

[0137] The two-stage IPBFT intra-group consensus simplifies the three stages of the traditional PBFT consensus into two stages to reduce communication overhead and improve performance;

[0138] S4-1-5: After the two-stage IPBFT intra-group consensus is successful, the Raft algorithm is used among all consensus node groups based on the master node and the leader node group to perform inter-group Raft consensus, including the following steps:

[0139] S4-1-5-1: After the two-stage IPBFT group consensus succeeds, the master node is used to generate a real-time consensus transaction message, and the real-time consensus transaction message is sent to other leader nodes in the leader node group;

[0140] S4-1-5-2: Based on the leader node, it receives the consensus transaction message of the two-stage IPBFT intra-group consensus, and uses the Raft algorithm to perform inter-group Raft consensus;

[0141] S4-1-5-3: Convert the consensus transaction message into a log entry and broadcast the log entry to other consensus nodes in the consensus node group;

[0142] S4-1-5-4: Append the log entry to the local log based on other consensus nodes in the consensus node group and send a confirmation message to the supervisory layer;

[0143] S4-1-5-5: Based on the supervision layer, after receiving the preset number of confirmation messages, the corresponding leader node is reviewed. After the review is passed, the inter-group Raft consensus is successful;

[0144] S4-2: If the consensus is successful, proceed to the next step; otherwise, return the consensus failure information to the first node and end the method;

[0145] S4-3: Allocate corresponding unique time slices to all nodes in the blockchain network, and publish real-time on-chain data blocks to all nodes in the blockchain network;

[0146] S4-4: Within the time range of the unique time slice, the node that receives the data block on the real-time chain links the data block on the real-time chain to the chain, and returns the link success information to the first node;

[0147] S4-5: Send the real-time off-chain data hash value and real-time signature data to the second node;

[0148] S5: Based on the second node, the real-time signature data is verified. After the signature verification is passed, the corresponding real-time on-chain data block is retrieved according to the real-time off-chain data hash value, and the real-time storage address in the real-time on-chain data block is obtained, including the following steps:

[0149] S5-1: Based on the second node, call the distributed ledger, extract the signature information of the first node, and execute the smart contract according to the signature information of the first node to perform signature verification on the real-time signature data;

[0150] The formula is:

[0151] β u1 B u1 P=β u1 H2(R u1 ,M u2 ,ID u1 ,K u1 )R u1 +β u1 K u1 +β u1 H1(ID u1 ,K u1 )

[0152] In the formula, β u1 is the signature verification parameter of the first node; if the left formula is equal to the right formula, the signature verification is successful;

[0153] S5-2: If the signature verification passes, proceed to the next step; otherwise, return signature verification failure information to the second node and end the method;

[0154] S5-3: According to the real-time off-chain data hash value, the corresponding real-time on-chain data block in the blockchain network, and the real-time off-chain data hash value received by the second node is compared and verified with the real-time on-chain data block in the real-time on-chain data block;

[0155] S5-4: If the comparison and verification pass, obtain the real-time storage address in the real-time chain data block, otherwise, return the comparison and verification failure information to the second node and end the method;

[0156] S6: extract the corresponding encrypted real-time off-chain data in the IFPS system according to the real-time storage address, and decrypt the encrypted real-time off-chain data according to the private key of the second node to obtain the corresponding decrypted real-time off-chain data;

[0157] The formula is:

[0158] m' u2 =E - (SK u2 ,M u2 )

[0159] In the formula, m' u2 It is the real-time business data after decryption; E - (*) is an asymmetric decryption function; M u2 It is encrypted real-time off-chain data; SK u2 is the private key of the second node; u1 and u2 are the indicators of the first node and the second node;

[0160] S7: Generate a real-time transaction record for this transaction, execute the smart contract, convert the real-time transaction record into the corresponding real-time transaction data block, and use the blockchain network to link the real-time transaction data block to the chain.

[0161] Embodiment 2:

[0162] like Figure 2 As shown, this embodiment provides an on-chain data security verification system for implementing an on-chain data security verification method. The system includes a node identity authentication unit, an encryption signature unit, an off-chain data storage unit, a block chain unit, a signature verification unit, an off-chain data extraction unit, and a transaction data recording unit connected in sequence.

[0163] A node identity authentication unit is used to build a blockchain network, generate keys and authenticate identities for all nodes in the blockchain network, and obtain a public-private key pair and signature information for each node; the public-private key pair includes a public key and a private key;

[0164] An encryption and signature unit, used to encrypt and sign the real-time off-chain data according to the public key of the second node and the signature information of the first node, and obtain the corresponding encrypted real-time off-chain data and real-time signature data;

[0165] The off-chain data storage unit is used to generate a real-time off-chain data hash value and a real-time storage address for the encrypted real-time off-chain data, and convert the real-time off-chain data hash value and the real-time storage address into a real-time on-chain data block, and generate a corresponding real-time data transaction request;

[0166] The block chain unit is used to reach a consensus on the real-time data transaction request. After the consensus is successful, the real-time on-chain data block is linked to the chain, and the real-time off-chain data hash value and real-time signature data are sent to the second node;

[0167] The signature verification unit is used to perform signature verification on the real-time signature data. After the signature verification is passed, the corresponding real-time on-chain data block is retrieved according to the hash value of the real-time off-chain data, and the real-time storage address in the real-time on-chain data block is obtained;

[0168] The off-chain data extraction unit is used to extract the corresponding encrypted real-time off-chain data in the IFPS system according to the real-time storage address, and decrypt the encrypted real-time off-chain data according to the private key of the second node to obtain the corresponding decrypted real-time off-chain data;

[0169] The transaction data recording unit is used to generate the real-time transaction record of the transaction, execute the smart contract, convert the real-time transaction record into the corresponding real-time transaction data block, and use the blockchain network to link the real-time transaction data block to the chain.

[0170] The present invention discloses a method and system for secure verification of data on a chain, which utilizes blockchain technology to construct a decentralized network, reduces dependence on centralized third-party verification agencies, and further reduces cost investment; combines asymmetric encryption algorithms and digital identity authentication technologies to ensure confidentiality and integrity of data, and improves the security level of the blockchain network; combines the Byzantine fault tolerance characteristics of the PBFT algorithm and the efficient consistency of the Raft algorithm, and proposes an IPBFT consensus algorithm, which reduces the communication complexity of the system and improves consensus efficiency; off-chain data is converted into on-chain data through hash values, and is stored and securely verified on the blockchain; the recipient can retrieve on-chain data blocks by querying the blockchain, and verify the authenticity and validity of the off-chain data, and this method ensures the security and reliability of off-chain data when it is referenced on the chain.

[0171] The present invention is not limited to the above optional implementations, and anyone can derive other various forms of products under the enlightenment of the present invention. The above specific implementations should not be understood as limiting the scope of protection of the present invention. The scope of protection of the present invention should be based on the definition in the claims, and the description can be used to interpret the claims.

Claims

1. A method for verifying data security on a chain, characterized by: The steps include: Based on the cloud data center, a blockchain network is constructed, and keys are generated and identities are authenticated for all nodes in the blockchain network to obtain the public-private key pair and signature information of each node; the public-private key pair includes a public key and a private key; Based on the first node, the real-time off-chain data is encrypted and signed according to the public key of the second node and the signature information of the first node to obtain the corresponding encrypted real-time off-chain data and real-time signature data; Based on the IFPS system, generate the encrypted real-time off-chain data hash value and real-time storage address of the real-time off-chain data, convert the real-time off-chain data hash value and real-time storage address into real-time on-chain data blocks, and generate corresponding real-time data transaction requests; Based on the blockchain network, consensus is reached on real-time data transaction requests. After consensus is successful, the real-time on-chain data blocks are linked to the chain, and the real-time off-chain data hash value and real-time signature data are sent to the second node; Based on the second node, the real-time signature data is verified. After the signature verification is passed, the corresponding real-time on-chain data block is retrieved according to the hash value of the real-time off-chain data, and the real-time storage address in the real-time on-chain data block is obtained; According to the real-time storage address, the corresponding encrypted real-time off-chain data is extracted in the IFPS system, and the encrypted real-time off-chain data is decrypted according to the private key of the second node to obtain the corresponding decrypted real-time off-chain data; Generate a real-time transaction record for this transaction, execute the smart contract, convert the real-time transaction record into the corresponding real-time transaction data block, and use the blockchain network to link the real-time transaction data block to the chain.

2. According to claim 1, a method for verifying the security of on-chain data is characterized in that: Based on the cloud data center, a blockchain network is built. Based on a trusted institution, keys are generated and identities are authenticated for all nodes in the blockchain network to obtain the public and private key pairs and signature information of each node, including the following steps: Based on the cloud data center, deploy smart contracts, IFPS system and several data servers to build a blockchain network consisting of several nodes; each of the nodes corresponds to a data server; Based on the trusted institution, the public and private key pairs and signature information of each node are obtained by performing key generation and identity authentication on all nodes in the blockchain network; The public key in the public-private key pair is published to the blockchain network, the private key and signature information in the public-private key pair are returned to the corresponding node, and the signature information of the node is recorded in the distributed ledger.

3. According to claim 1, a method for verifying the security of on-chain data is characterized in that: Based on the IFPS system, the real-time off-chain data hash value and real-time storage address of the encrypted real-time off-chain data are generated, and the real-time off-chain data hash value and real-time storage address are converted into real-time on-chain data blocks to generate corresponding real-time data transaction requests, including the following steps: Based on the IFPS system, generate the real-time off-chain data hash value of the encrypted real-time off-chain data, store the encrypted real-time off-chain data, and obtain the corresponding real-time storage address; Return the encrypted real-time off-chain data and real-time storage address to the blockchain network, and execute the smart contract to convert the real-time off-chain data hash value and real-time storage address into real-time on-chain data blocks; Generate a real-time data transaction request corresponding to the real-time on-chain data block, and publish the real-time data transaction request to all nodes in the blockchain network.

4. According to claim 1, a method for verifying the security of on-chain data is characterized in that: Based on the blockchain network, consensus is reached on the real-time data transaction request. After the consensus is successful, the real-time on-chain data block is linked to the chain, and the real-time off-chain data hash value and real-time signature data are sent to the second node, including the following steps: Based on the blockchain network, the IPBFT consensus algorithm is used to reach consensus on real-time data transaction requests; If the consensus is successful, proceed to the next step; otherwise, return the consensus failure information to the first node and end the method; Allocate corresponding unique time slices to all nodes in the blockchain network, and publish real-time on-chain data blocks to all nodes in the blockchain network; Within the time range of the unique time slice, the node that receives the data block on the real-time chain links the data block on the real-time chain to the chain, and returns the success information of linking to the first node; Send the real-time off-chain data hash value and real-time signature data to the second node.

5. According to claim 4, a method for verifying the security of on-chain data is characterized in that: By combining the evaluation hierarchical mechanism, AP clustering algorithm and Raft algorithm, the PBFT consensus algorithm is improved to construct the IPBFT consensus algorithm.

6. According to claim 5, a method for verifying the security of on-chain data is characterized in that: Based on the blockchain network, the IPBFT consensus algorithm is used to reach consensus on real-time data transaction requests, including the following steps: Based on the blockchain network, an evaluation hierarchical mechanism is used to divide several nodes in the blockchain network into a classification consensus layer, a consensus confirmation layer, and a supervision layer; Introduce a reputation mechanism and use the AP clustering algorithm to group several nodes in the classification consensus layer to obtain a leadership node group and corresponding consensus node groups; the leadership node group includes several leadership nodes, each leadership node corresponds to a consensus node group, and the consensus node group includes several consensus nodes; The leader node that receives the real-time data transaction request is used as the master node, and the corresponding consensus node group is used as the master consensus node group; Based on the master node and master consensus node group, the IPBFT consensus algorithm is used to conduct a two-stage IPBFT intra-group consensus; After the two-stage IPBFT intra-group consensus is successful, the Raft algorithm is used among all consensus node groups to conduct inter-group Raft consensus based on the master node and leader node group.

7. The method for on-chain data security verification according to claim 6 is characterized in that: Based on the master node and master consensus node group, the IPBFT consensus algorithm is used to perform a two-stage IPBFT group consensus, including the following steps: Based on the master node, use the IPBFT consensus algorithm to broadcast the pre-prepared message to other consensus nodes in the master consensus node group; The consensus node based on the main consensus node group verifies the validity of the pre-prepared message. After the validity verification is passed, it enters the ready state and sends the ready message to other consensus nodes in the same main consensus node group; After receiving a preset number of prepare messages, the validity of the prepare messages and the identity of the node are verified. After the validity and node identity verification are passed, the two-stage IPBFT group consensus is successful.

8. According to claim 7, a method for verifying the security of on-chain data is characterized in that: After the two-stage IPBFT intra-group consensus is successful, the Raft algorithm is used among all consensus node groups based on the master node and the leader node group to perform inter-group Raft consensus, including the following steps: After the two-stage IPBFT group consensus is successful, the master node is used to generate a real-time consensus transaction message and send the real-time consensus transaction message to other leader nodes in the leader node group; Based on the leader node, it receives the consensus transaction message of the two-stage IPBFT intra-group consensus and uses the Raft algorithm to perform inter-group Raft consensus; Convert consensus transaction messages into log entries and broadcast the log entries to other consensus nodes in the consensus node group; Based on other consensus nodes in the consensus node group, append the log entry to the local log and send a confirmation message to the supervision layer; Based on the supervision layer, after receiving a preset number of confirmation messages, the corresponding leader node is reviewed. After the review is passed, the inter-group Raft consensus is successful.

9. A method for on-chain data security verification according to claim 2, characterized in that: Based on the second node, the real-time signature data is verified. After the signature verification is passed, the corresponding real-time on-chain data block is retrieved according to the real-time off-chain data hash value, and the real-time storage address in the real-time on-chain data block is obtained, including the following steps: Based on the second node, the distributed ledger is called to extract the signature information of the first node, and the smart contract is executed according to the signature information of the first node to perform signature verification on the real-time signature data; If the signature verification passes, proceed to the next step; otherwise, return signature verification failure information to the second node and end the method; According to the real-time off-chain data hash value, the corresponding real-time on-chain data block in the blockchain network, and the real-time off-chain data hash value received by the second node is compared and verified with the real-time on-chain data block in the real-time on-chain data block; If the comparison and verification pass, the real-time storage address in the real-time chain data block is obtained, otherwise, the comparison and verification failure information is returned to the second node and the method ends.

10. An on-chain data security verification system, used to implement the on-chain data security verification method according to any one of claims 1 to 9, characterized in that: The system includes a node identity authentication unit, an encryption signature unit, an off-chain data storage unit, a block chain unit, a signature verification unit, an off-chain data extraction unit and a transaction data recording unit connected in sequence.

Images