Digital archive management method and system based on block chain technology

Abstract

The invention relates to the technical field of block chains, and discloses a digital archive management method and system based on the block chain technology, and the method comprises the steps: obtaining the archive data of a user; verifying the identity of the user according to the archive data; sending an information check number to the user passing the verification; when logging in, a user needs to input an information check number into the digital archive management system; the information checking number is uploaded to a local database for checking, if the checking succeeds, the user can enter the digital archive management system, and if the checking fails, the user cannot enter the digital archive management system, and the information checking number needs to be input again; by means of a multi-layer encryption mechanism, message authentication code verification, dynamic key derivation, data packet storage, information check number verification and the like, data security, integrity and authenticity in the digital archive management system are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a digital archive management method and system based on blockchain technology. Background Art

[0002] With the development of information technology, more and more individuals and organizations choose to store important archival data in cloud databases. However, in this case, how to ensure the security, integrity and authenticity of data has become an urgent problem to be solved. Traditional authentication methods often rely on a single password or verification code, which is vulnerable to attackers, especially when data may be tampered with or forged during transmission.

[0003] At present, common solutions on the market usually include using symmetric encryption algorithms (such as AES) to protect the confidentiality of data, and using asymmetric encryption algorithms (such as RSA) to ensure the security of data transmission. However, these solutions still have some shortcomings in practical applications, such as the lack of effective data integrity verification methods, and the inability to ensure the integrity and authenticity of data during transmission.

[0004] The existing digital archive management system has the following main problems in data storage and transmission: 1. Insufficient data integrity verification: Traditional encryption methods only focus on the confidentiality of data and lack effective means to verify the integrity of data during transmission; 2. Difficulty in verifying data authenticity: During data transmission, how to ensure the authenticity of the data source becomes a difficult problem, especially when the data is transmitted through multiple links; 3. High identity authentication complexity: Existing solutions often require users to remember complex passwords or verification codes, which increases the user's burden and may lead to a poor user experience. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a digital archive management method and system based on blockchain technology to verify the identity of the user according to the archive data.

[0006] The present invention provides a digital archive management method based on blockchain technology, comprising: S1, obtain user profile data; S2, verify the user's identity based on the profile data; S3, sending an information verification number to the user who has passed the verification; S4, when logging in, the user needs to enter the information verification number into the digital archive management system; S5, the information verification number is uploaded to the local database for verification. If the verification is successful, the user can enter the digital archive management system. If the verification fails, the user cannot enter and needs to enter the information verification number again.

[0007] Furthermore, the identity of the user is verified based on the archive data, specifically including the following steps: Step S21, copying the archive data of all users into two identical sets of data, one set of data is used for storage backup, and the other set of data is used for storage in the local database; Step S22, obtaining a symmetric key, and encrypting the two sets of data in step S21 according to the symmetric key and the symmetric encryption algorithm to generate encrypted archive data; Step S23, obtaining a public key and a private key, using the public key to encrypt the symmetric key in step S22 to generate an encryption key for securely transmitting the symmetric key in step S22; Step S24, obtaining additional encryption material, and generating a final encryption key according to the additional encryption material and the symmetric key; Step S25, transmitting the encryption key to the user; Step S26, the user decrypts the encryption key according to the private key to generate a recovery symmetric key; Step S27, decrypting the encrypted archive data according to the restored symmetric key to obtain the original data; Step S28, verify the integrity of the archive data based on the original data and the final encryption key. If the archive data is complete, execute step S3; if the archive data is incomplete, return to execute step S22.

[0008] Further, obtaining additional encryption material specifically includes the following steps: Step S241, obtaining the current time and converting the current time into a current timestamp; Step S242, generating a random number according to a random number generator; Step S243, concatenate the timestamp and the random number to generate a character string; Step S244: The hash function performs a hash operation on the character string to generate additional encryption material.

[0009] Further, the final encryption key is generated by combining the additional encryption material and the symmetric key using a key derivation function.

[0010] Furthermore, step S28 verifies the integrity of the archive data based on the original data and the final encryption key, specifically including the following steps: Step S281, generating a message authentication code based on the original data and the final encryption key; Step S282, transmitting the message authentication code and encrypted archive data to the user; Step S283, after receiving the message authentication code and the encrypted archive data, the user recalculates the message authentication code based on the received message authentication code and the original data; Step S284, compare whether the information authentication code recalculated in step S283 is consistent with the information authentication code in step S281. If the information authentication code recalculated in step S283 is consistent with the information authentication code in step S281, it means that the file data is complete and the verification is successful; if the information authentication code recalculated in step S283 is inconsistent with the information authentication code in step S281, it means that the file data is missing, which means that the file data is incomplete and the verification fails.

[0011] A digital archive management system based on blockchain technology, including the following modules: File data acquisition module: used to obtain user's file data; Identity verification module: connected to the archive data acquisition module, used to verify the user's identity based on the archive data; Sending module: connected with the identity authentication module, used to send information verification number to the user who has passed the verification; Input module: connected to the sending module, used when the user logs in and needs to enter the information verification number into the digital archive management system; Upload verification module: connected to the input module, used to upload the information verification number to the local database for verification. If the verification is successful, the user can enter the digital archive management system. If the verification fails, the user cannot enter and needs to enter the information verification number again.

[0012] The embodiments of the present invention have the following technical effects: The present invention significantly improves the data security, integrity and authenticity in the digital archive management system through multi-layer encryption mechanism, message authentication code verification, dynamic key derivation, data group storage and information verification number verification. At the same time, the solution also simplifies the user identity verification process, improves the reliability and ease of use of the system, and ensures the security and credibility of data throughout the life cycle. These beneficial effects together constitute a comprehensive and efficient user identity verification method that is suitable for the security requirements of modern digital archive management systems.

[0013] By using symmetric encryption algorithms and asymmetric encryption algorithms, the security of user profile data during storage and transmission is ensured. Symmetric encryption provides efficient data encryption capabilities, while asymmetric encryption ensures the secure transmission of symmetric keys, making it impossible to easily decrypt even if the data is intercepted during transmission.

[0014] The integrity of data during transmission is ensured by generating and verifying message authentication codes. The generated message authentication codes can not only detect whether the data has been tampered with, but also verify the authenticity of the data source. Even if the data is tampered with during transmission, it can be discovered and processed in time at the receiving end, thus avoiding potential security risks.

[0015] By combining timestamp, salt value and key derivation function to generate dynamic symmetric keys, it not only improves the security of the key, but also enables each encryption operation to use a different key, further enhancing the data protection effect. The use of dynamic keys reduces the risk of key cracking and also reduces the complexity of key management. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is a flow chart of a digital archive management method based on blockchain technology provided by an embodiment of the present invention; Figure 2 It is a structural diagram of a digital archive management method based on blockchain technology provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0019] Figure 1 This is a schematic diagram of the structure of a digital archive management method based on blockchain technology provided by an embodiment of the present invention. Figure 1 , including: S1, obtain the user's profile data.

[0020] The file data mainly includes user registration information, personal file information and authorization information. These data will be uploaded to the cloud database during registration, and the cloud database address information will be stored in the blockchain node.

[0021] S2, verify the user's identity based on the profile data.

[0022] Step S21, copying the archive data of all users into two identical sets of data, one set of data is used for storage backup, and the other set of data is used for storage in the local database.

[0023] Specifically, firstly, the above two groups of data are grouped according to the user age groups corresponding to the data to form multiple data groups, the data in the data groups are labeled in sequence to generate data numbers, multiple data groups are labeled to generate data group numbers, and the two data groups with the same data group numbers are used for storage backup and stored in the local database respectively.

[0024] Step S22, obtaining a symmetric key, and encrypting the two sets of data in step S21 according to the symmetric key and the symmetric encryption algorithm to generate encrypted archive data.

[0025] First, a secure pseudo-random number generator (CSPRNG) is used to generate a sufficiently long random number as a symmetric key. The length of the symmetric key is 128 bits, 192 bits, or 256 bits (the length of the symmetric key obtained in this application depends on the required encryption strength. If the required encryption strength is strong, a 256-bit random number will be generated as a symmetric key; if the required encryption strength is weak, a 128-bit random number will be generated as a symmetric key; if the required encryption strength is moderate, a 192-bit random number will be generated as a symmetric key). Preferably, this embodiment generates a 256-bit random number as a symmetric key.

[0026] Then, a secure pseudo-random number generator (CSPRNG) is used to generate a random number of a fixed length as the salt value. Preferably, in this embodiment, a 192-bit random number is used as the salt value.

[0027] Finally, get the current timestamp. Specifically, converting the current time point into the current timestamp usually involves converting a specific time point into a reference time point. The default reference time point of the operating system is January 1, 1970, 00:00:00. Get the current time point and use Python to convert the current time point into the current timestamp based on the reference time point.

[0028] According to the symmetric key K init , the current timestamp T, the salt value S, and the key derivation function HKDF are used to generate the dynamic symmetric key K: .

[0029] Encrypt archive data using the generated symmetric key and symmetric encryption algorithm: ; E represents encrypted archive data, AES-GCM represents the symmetric encryption algorithm, and D represents the data to be encrypted.

[0030] Step S23, obtaining a public key and a private key, using the public key to encrypt the symmetric key in step S22 to generate an encryption key for securely transmitting the symmetric key in step S22.

[0031] Use an asymmetric encryption algorithm to generate a pair of public key P and private key Q. The public key is used for encryption and the private key is used for decryption. Use the public key to encrypt the symmetric key to generate the encryption key K enc : , RAS-Encrypt represents the RAS encryption algorithm.

[0032] Step S24, obtaining additional encryption material, and generating a final encryption key according to the additional encryption material and the symmetric key, specifically includes: Step S241, obtaining the current time and converting the current time into a current timestamp.

[0033] Step S242, generating a random number R' according to a random number generator; Step S243, concatenate the timestamp T and the random number R' to generate a character string; Step S244: perform a hash operation on the character string using a hash function to generate additional encryption material M.

[0034] ; H stands for hash function.

[0035] The final encryption key is generated by combining the additional encryption material and the symmetric key using a key derivation function.

[0036] Combine the generated additional key material M with the symmetric key K init Combined, a key derivation function is used to generate the final encryption key : .

[0037] Step S25: transmitting the encryption key to the user.

[0038] Step S26: The user decrypts the encryption key according to the private key to generate a recovery symmetric key.

[0039] Decrypt the final encrypted key using the private key Q , generate the recovery symmetric key K´: ; Representative use Algorithm to perform decryption operations.

[0040] Step S27, decrypt the encrypted archive data according to the restored symmetric key to obtain the original data.

[0041] Decrypt archive data D using the recovered symmetric key K´ and the symmetric encryption algorithm: ; F is the original data, Representative use Algorithm to perform decryption operations.

[0042] Step S28, verify the integrity of the archive data based on the original data and the final encryption key. If the archive data is complete, execute step S3; if the archive data is incomplete, return to execute step S22.

[0043] Step S281: Generate a message authentication code based on the original data and the final encryption key : ; Represents the algorithm for generating a message authentication code.

[0044] Step S282, transmitting the message authentication code and encrypted archive data to the user; Step S283, after receiving the message authentication code and the encrypted archive data, the user recalculates the message authentication code based on the received message authentication code and the original data: ; represents the recalculated message authentication code, Represents the algorithm for generating a message authentication code.

[0045] Step S284, compare whether the information authentication code recalculated in step S283 is consistent with the information authentication code in step S281. If the information authentication code recalculated in step S283 is consistent with the information authentication code in step S281, it means that the file data is complete and the verification is successful; if the information authentication code recalculated in step S283 is inconsistent with the information authentication code in step S281, it means that the file data is missing, which means that the file data is incomplete and the verification fails.

[0046] If the data is tampered with during transmission, the generated MAC will be different, and the user can find out whether the data has been modified by comparison.

[0047] Since MAC is generated by encrypting the final encryption key with the public key corresponding to the private key, only the party with the private key can verify the validity of MAC, thus ensuring the authenticity of the data source.

[0048] S3, sends the information verification number to the user who has passed the verification.

[0049] The information verification number includes a data number and a data group number, which correspond to the data number and the data group number in step S21 respectively. The information verification number is sent by email.

[0050] For users who fail verification, the system should not send a message verification number. This is because if the data is tampered with during transmission, the recalculated message authentication code will be inconsistent with the received message authentication code, resulting in verification failure. In this case, the system should refuse to send the message verification number and prompt the user to re-obtain the correct data.

[0051] S4. When logging in, the user needs to enter the information verification number into the digital archive management system.

[0052] S5, the information verification number is uploaded to the local database for verification. If the verification is successful, the user can enter the digital archive management system. If the verification fails, the user cannot enter and needs to enter the information verification number again.

[0053] In step S5, the user needs to enter an information verification number to verify his identity. First, the user will enter the information verification number on the provided interface. Then, the system will upload the input information verification number to the local database for verification. Specifically, the system will connect to the local database and query whether there is a record that matches the input information verification number. If there is a matching record in the database, it means that the information verification number is correct and the verification is successful. At this time, the user can smoothly enter the digital archive management system. On the contrary, if no matching record is found in the database, it means that the information verification number is wrong and the verification fails. At this time, the user will not be able to enter the system and will be prompted to re-enter the information verification number. In order to prevent malicious attempts, the system can also set a certain number of retry limits. When the user enters the wrong information verification number for multiple consecutive times, the system will no longer allow him to continue trying until certain conditions are met (such as waiting for a period of time or contacting the administrator) before retrying.

[0054] This embodiment also provides a digital archive management system based on blockchain technology, which is used to execute the above-mentioned digital archive management method based on blockchain technology, including the following modules: File data acquisition module: used to obtain user's file data; Identity verification module: connected to the archive data acquisition module, used to verify the user's identity based on the archive data; Sending module: connected with the identity authentication module, used to send information verification number to the user who has passed the verification; Input module: connected to the sending module, used when the user logs in and needs to enter the information verification number into the digital archive management system; Upload verification module: connected to the input module, used to upload the information verification number to the local database for verification. If the verification is successful, the user can enter the digital archive management system. If the verification fails, the user cannot enter and needs to enter again.

[0055] This embodiment also provides an electronic device, which includes one or more processors and a memory.

[0056] The processor may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0057] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor may run the program instructions to implement a digital archive management method based on blockchain technology and / or other desired functions of any embodiment of the present application described above. Various contents such as initial external parameters, thresholds, etc. may also be stored in the computer-readable storage medium.

[0058] In one example, the electronic device may further include: an input device and an output device, and these components are interconnected through a bus system and / or other forms of connection mechanisms (not shown). The input device may include, for example, a keyboard, a mouse, etc. The output device may output various information to the outside, including early warning information, braking force, etc. The output device may include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, etc.

[0059] In addition, the electronic device may further include any other appropriate components according to specific application scenarios.

[0060] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of a digital archive management method based on blockchain technology provided in any embodiment of the present application.

[0061] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0062] In addition, an embodiment of the present application may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of a digital archive management method based on blockchain technology provided in any embodiment of the present application.

[0063] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0064] It should be noted that the terms used in the present invention are only for describing specific embodiments, rather than limiting the scope of the present application. As shown in the present specification, unless the context clearly indicates an exception, the words "one", "a", "a kind of" and / or "the" do not specifically refer to the singular, but may also include the plural. The terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method or device. In the absence of more restrictions, the elements defined by the sentence "include one..." do not exclude the presence of other identical elements in the process, method or device including the elements.

[0065] It should also be noted that the orientations or positional relationships indicated by the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. are based on the orientations or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. Unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", etc. should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. A digital archive management method based on blockchain technology, characterized in that: include: S1, obtain user profile data; S2, verify the user's identity based on the profile data; S3, sending an information verification number to the user who has passed the verification; S4, when logging in, the user needs to enter the information verification number into the digital archive management system; S5, the information verification number is uploaded to the local database for verification. If the verification is successful, the user can enter the digital archive management system. If the verification fails, the user cannot enter and needs to enter the information verification number again.

2. According to claim 1, a digital archive management method based on blockchain technology is characterized in that: Verify the user's identity based on the profile data, including the following steps: Step S21, copying the archive data of all users into two identical sets of data, one set of data is used for storage backup, and the other set of data is used for storage in the local database; Step S22, obtaining a symmetric key, and encrypting the two sets of data in step S21 according to the symmetric key and the symmetric encryption algorithm to generate encrypted archive data; Step S23, obtaining a public key and a private key, using the public key to encrypt the symmetric key in step S22 to generate an encryption key for securely transmitting the symmetric key in step S22; Step S24, obtaining additional encryption material, and generating a final encryption key according to the additional encryption material and the symmetric key; Step S25, transmitting the encryption key to the user; Step S26, the user decrypts the encryption key according to the private key to generate a recovery symmetric key; Step S27, decrypting the encrypted archive data according to the restored symmetric key to obtain the original data; Step S28, verify the integrity of the archive data based on the original data and the final encryption key. If the archive data is complete, execute step S3; if the archive data is incomplete, return to execute step S22.

3. According to claim 2, a digital archive management method based on blockchain technology is characterized in that: The obtaining of the additional encryption material specifically includes the following steps: Step S241, obtaining the current time and converting the current time into a current timestamp; Step S242, generating a random number according to a random number generator; Step S243, concatenate the timestamp and the random number to generate a character string; Step S244: perform a hash operation on the character string using a hash function to generate additional encryption material.

4. According to claim 2, a digital archive management method based on blockchain technology is characterized in that: The final encryption key is generated by combining the additional encryption material and the symmetric key using a key derivation function.

5. According to a digital archive management method based on blockchain technology according to claim 2, it is characterized in that: The step S28 verifies the integrity of the archive data based on the original data and the final encryption key, and specifically includes the following steps: Step S281, generating a message authentication code based on the original data and the final encryption key; Step S282, transmitting the message authentication code and encrypted archive data to the user; Step S283, after receiving the message authentication code and the encrypted archive data, the user recalculates the message authentication code based on the received message authentication code and the original data; Step S284, compare whether the information authentication code recalculated in step S283 is consistent with the information authentication code in step S281. If the information authentication code recalculated in step S283 is consistent with the information authentication code in step S281, it means that the file data is complete and the verification is successful; if the information authentication code recalculated in step S283 is inconsistent with the information authentication code in step S281, it means that the file data is missing, which means that the file data is incomplete and the verification fails.

6. A digital archive management system based on blockchain technology, used to implement a digital archive management method based on blockchain technology as described in any one of claims 1 to 5, characterized in that: Includes the following modules: File data acquisition module: used to obtain user's file data; Identity verification module: connected to the archive data acquisition module, used to verify the user's identity based on the archive data; Sending module: connected with the identity authentication module, used to send information verification number to the user who has passed the verification; Input module: connected to the sending module, used when the user logs in and needs to enter the information verification number into the digital archive management system; Upload verification module: connected to the input module, used to upload the information verification number to the local database for verification. If the verification is successful, the user can enter the digital archive management system. If the verification fails, the user cannot enter and needs to enter the information verification number again.

Images