Multi-class database-oriented block chain monitoring data storage method and query auditing method

Abstract

The invention provides a block chain monitoring data evidence storage method and a query auditing method oriented to a multi-class database, a data uplink module monitors database operation and obtains a data change real event, and only performs uplink evidence storage on corresponding operation data of a to-be-uplink change event; and only the corresponding data of the database is modified without the need of the uplink data change event. The operation data related to the to-be-linked change event is uploaded to the block chain to be stored, so that the data on the block chain is the original data for eliminating high-risk data operation, and the integrity is relatively high. During auditing, whether the database query data is subjected to high-risk data operation or not can be quickly found by comparing the database query data with the chain query data, whether the high-risk data operation has problems or not can be analyzed according to the log file of the database, and then the operation user is verified through the asymmetric key pair of the user. Therefore, the database auditing efficiency is improved, and the reliability of database data is ensured.

Description

Technical Field

[0001] The present invention relates to a database and a blockchain, and in particular to a method for storing and auditing data in a database using a blockchain. Background Art

[0002] Database technology is already a relatively mature means of batch information management, but database security is also a major issue that the industry has always been concerned about. Since its application, database technology has always faced the risk of weak password cracking, privilege escalation, SQL injection, and even social engineering attacks. Therefore, databases are stretched in some information systems that have high security requirements and need to completely avoid human interference. Among them, data integrity will directly affect the company's key business decisions.

[0003] Blockchain technology is considered to be the most disruptive technological innovation since the invention of the Internet. It relies on cryptography and ingenious mathematical distributed algorithms. On the Internet where trust relationships cannot be established, it can enable participants to reach a consensus without the intervention of any third-party center, solving the problem of reliable transmission of trust and value at a very low cost.

[0004] Blockchain has the characteristics of timestamp and immutability, which can be used for data storage. The technical principle of blockchain storage is very simple. Before the user signs and sends the transaction, the user attaches the data to be stored (if the data volume is small and there is no need to worry about privacy issues, the text can be directly stored; if the data volume is large, the hash of the data is calculated) to the transaction, and then the signature is broadcast. After verifying the legitimacy of the transaction, the accounting node packs the transaction into a block and attaches the timestamp information to the block.

[0005] Digital signatures are composed of digital summaries and asymmetric encryption technology. First, the transaction information is shortened into a fixed-length string using digital summary technology, and then the summary is encrypted using asymmetric encryption technology to form a digital signature. The signature is encrypted using a private key, so it cannot be forged by others, and the signer cannot deny it. The public key information of the signer can be used for identity authentication.

[0006] The digital summary uses a hash function to convert information of any length into information of a fixed length. The hash function is a one-way generation system, and the input value cannot be reversed through the generated hash value. In addition, the hash function is a compression mapping, and the output is information of a fixed length.

[0007] This method will propose a systematic and effective solution to the current problems of complex blockchain evidence docking for data integrity, the inability to ensure the security of the transmission process, and the cumbersome data audit process. Summary of the invention

[0008] The purpose of the present invention is to provide a blockchain monitoring data notarization method and a query audit method for multiple types of databases. The data for operating the database is divided into on-chain operation data and off-chain operation data, and the on-chain operation data is notarized on the blockchain. During the audit, the off-chain operation data can be quickly found by comparing the on-chain data with the database data.

[0009] The present invention is achieved through the following technical solutions: The invention discloses a blockchain monitoring data notarization method for multiple types of databases, including a data on-chain module, which monitors the operations of various databases and obtains data change events, and divides the data change events into data change events that need to be on-chain and data change events that do not need to be on-chain. For change events that need to be on-chain, the data on-chain module obtains the corresponding operation data of the event and stores the operation data on-chain. For data change events that do not need to be on-chain, only the corresponding data of the database is modified.

[0010] Among them, the change events that need to be uploaded to the chain include at least new user creation events and / or new data creation events.

[0011] Among them, the change events that do not require chaining include at least user deletion events, data deletion events and / or data update events.

[0012] This also includes generating an asymmetric key pair for the users of the database; for change events that need to be uploaded to the chain, the data upload module obtains the operation data from the database and signs the operation data with the private key in the asymmetric key pair to form the uploaded data, and the uploaded data is stored on the chain.

[0013] Among them, there is also a contract conversion module, which creates a smart contract file for the operation data table corresponding to the change event that needs to be uploaded to the chain. The table name and unique primary key in the data table are used as the corresponding creation parameters in the smart contract file. The field name and field content in the data table are spliced ​​into a JSON string as the chain storage parameter in the smart contract file. The contract conversion module deploys the smart contract file on the chain.

[0014] The smart contract file parameters also include signature content signed using the private key in the corresponding user's asymmetric key pair and the public key in the asymmetric key pair.

[0015] A method for querying and auditing blockchain evidence data for multiple types of databases. The user inputs a query instruction, and the database responds to the corresponding database query data according to the query instruction. At the same time, it queries the data on the blockchain and responds to the corresponding on-chain query data, and compares the database query data with the on-chain query data by signature hash; if the hash value of the database query data is consistent with the hash value of the on-chain query data, the returned database integrity is correct, otherwise the returned database integrity data is damaged.

[0016] A method for querying and auditing blockchain evidence data for multiple types of databases, characterized in that: a user inputs a query instruction, the database responds to the corresponding database query data according to the query instruction, and simultaneously queries the data on the blockchain and responds to the corresponding on-chain query data, and performs a signature hash comparison between the database query data and the on-chain query data; if the hash value of the database query data is consistent with the hash value of the on-chain query data, the database integrity is returned, otherwise the returned database integrity data is damaged; in the case of correct data integrity, the signature content in the on-chain query data is verified using the user's corresponding public key, and if the verification passes, the audit result and user signature information are fed back.

[0017] A method for traversal audit of blockchain evidence data for multiple types of databases, wherein the user inputs a traversal database query instruction, traverses the data table corresponding to the traversal database query instruction in the database and obtains the traversal query data table, and simultaneously traverses the on-chain data on the blockchain to obtain the on-chain traversal query data table, and performs a signature hash comparison between the database traversal query data table and the on-chain traversal query data table; if the hash values ​​of the database traversal query data table and the on-chain traversal query data table are consistent, then the database integrity is returned to be correct, otherwise the complete database data is returned to be damaged; in the case where the data integrity is correct, the signature content in the on-chain query data is verified using the user's corresponding public key, and if the verification passes, the audit result and user signature information are fed back.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: database operations, such as adding data / users, deleting data / users, updating data / users, etc., considering that some situations with high data security requirements, some of the above data operations are not allowed or need to be monitored to prevent the database from being arbitrarily tampered with and difficult to audit the database, etc. For this reason, the present invention divides the database operations into events that need to be changed on the chain (non-high-risk operations made on the database) and events that do not need to be changed on the chain (high-risk operations made on the database), and uploads the operation data involved in the events that need to be changed on the chain to the blockchain for storage, so as to ensure that the data on the blockchain is relatively original data that excludes high-risk data operations, and its integrity is high. During the audit, by obtaining the database query data and the query data on the chain through the query method for comparison, it is possible to quickly find out whether the database query data has undergone high-risk data operations, and whether there are problems with the high-risk data operations can be analyzed according to the log file of the database, thereby improving the efficiency of database auditing and ensuring the reliability of database data. In addition, the system also verifies the user's operation through the asymmetric key associated with the user so that the identity of the operating user can be clearly identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, further description is given below in conjunction with the accompanying drawings.

[0020] Figure 1 It is a system structure diagram of the present invention; Figure 2 It is the workflow diagram of the data monitoring module; Figure 3 It is the workflow diagram of user registration and deletion in the user management module; Figure 4 It is the workflow diagram of user login status monitoring in the user management module; Figure 5 It is the workflow diagram of the contract conversion module; Figure 6 It is the workflow diagram of the primary key query submodule in the query audit module; Figure 7 It is the workflow diagram of the on-chain comparison submodule in the query audit module; Figure 8 It is the workflow diagram of the one-key audit submodule in the query audit module. DETAILED DESCRIPTION

[0021] Reference Figure 1 The system involved in the blockchain monitoring data notarization method and query audit method for multiple types of databases includes the following modules: data monitoring module, contract conversion module, user management module, data chain module and query audit module.

[0022] The data monitoring module opens the binary log file of the database, such as the BINLOG parameter of Mysql, and monitors the update changes of the corresponding data table in combination with the program, and will give early warning prompts for deletion and update. The data monitoring module can perform corresponding processing according to the data structure of different types of databases so that the system can be connected with the corresponding type of database interface.

[0023] The contract conversion module includes a table management submodule and a contract submodule. The table management module is used to identify and obtain the table name, primary key and other field names of the corresponding database table. The contract module automatically creates the corresponding contract and deploys the contract according to the recognition result of the above table management module, and returns the blockchain contract address. The contract conversion module can process the data formats of various databases, so as to splice the field names and field contents in the data table that needs to be chained in the database into a JSON string as a parameter in the smart contract file to solve the problem that too many fields cannot be passed into the contract. Then the contract conversion module deploys the smart contract file on the chain.

[0024] The user management module includes a user management submodule and a user monitoring and warning submodule. The user management submodule can be used to register and delete users. After registering a common database user, the user should use the same user name to apply for user registration in the system. The user management module will generate user public and private key information based on the elliptic curve digital encryption algorithm (ECDSA). The user monitoring and warning submodule will monitor the login status of the database user. If the login status changes, the monitoring and warning module will also change the user signature identity in the system. If the user login identity of the database is an unregistered user, an early warning prompt will be issued, and the default user will be used for data signing.

[0025] The data chain module analyzes the fields of the monitored incremental data and makes them correspond to the primary key fields of the data table on the blockchain. It then performs signature encryption processing, adds the field SignatureHash to save the encrypted ciphertext, and adds the field UserAddress to save the user's public key address. After the data is processed, the corresponding smart contract address is called to encapsulate the transaction and store it on the chain.

[0026] The query audit module includes a primary key query submodule, an on-chain comparison submodule, and a one-key audit submodule. The primary key query submodule queries the database through the unique primary key passed in, and feeds back the database query results, and directly queries the blockchain data, and feeds back the blockchain data query results. The verification function compares the database data with the on-chain data by hashing to determine the data integrity. After the integrity is confirmed, the public and private keys in the user library are used for signature verification to determine the signature identity of the data.

[0027] The present invention can solve the following problems: Solve the problem that too many fields cannot be passed into the contract. The total number of input parameters and return values ​​of its function cannot exceed 16, otherwise an error of pushing the stack too deep will occur.

[0028] To solve the problem of troublesome development of evidence contracts, the contract consists of a data layer and an operation layer, which reduces code reuse and reduces the weight of contract code. After identifying the table name, primary key and other field names of the data table, a new evidence contract can be generated for automatic deployment.

[0029] Solve the data transmission security and problems, directly monitor and obtain data from the database, avoid some security issues of secondary data exchange, and to a certain extent prevent human modification of data during transmission, and prevent data loss caused by network fluctuations during data exchange.

[0030] Solve the problem of cumbersome system interface docking and system burden. Directly monitor the database and store evidence, without too many evidence data interface docking, and without adding more interfaces due to the increase of evidence storage scenarios. At the same time, the monitoring technology will not cause performance burden and operation risk to the database.

[0031] It solves the problems of difficult data backtracking, unclear operating subjects and data integrity verification, while providing a convenient one-click batch audit function to reduce data exchange risks and improve audit efficiency.

[0032] The following is a detailed description of the workflow of each of the above modules.

[0033] The workflow of the data monitoring module includes the following steps, refer to Figure 2 : Step 1: Enable the update log of the target database. For example, for MySQL, you need to enable the BINLOG binary log file. Step 2: After the database obtains the database connection type, connection address, port, user name, password, database name, and database table name passed in by the user, it obtains data changes by monitoring the update log of the target database; Step 3: After monitoring the data changes in the target data table, obtain the incremental data and splice it into a JSON string, obtain the current user login status from the user management subsystem, and call the private key in the private key library to perform private key signature processing on the incremental content. According to the data table name, obtain the corresponding contract address, and call the blockchain link interface to complete data storage; Step 4: If the user deletes or updates the database, the relevant operation data will not be recorded on the blockchain. The system will give a warning but will not prevent the user from modifying the database.

[0034] The workflow of the contract conversion module includes the following steps, refer to Figure 5 : Step 1: The user sends the database connection type, connection address, port, user name, password, database name and database table name to the data monitoring module. The table name can be passed as a string array and multiple names can be passed in. All table names cannot be repeated. The length of any table name cannot exceed 48 characters, and the table must contain a unique primary key. Step 2: The table management submodule of the contract conversion module will check whether the conditions of step 1 above are met, and obtain all the field names and field types in the table. At the same time, the contract submodule will check whether the table name already exists on the blockchain; Step 3: When the conditions for creating a table are met, the contract submodule will create a new smart contract file based on the table name and unique primary key. The common fields will be concatenated into a JSON string and placed in a parameter to be passed to the blockchain for storage. In addition, there is a SignatureHash field for users to save data signature content and a UserAddress field for saving user public keys. Step 4: The contract submodule deploys the contract file to the corresponding blockchain according to the user's permissions. If the deployment fails, an alert will be issued to the manual process. If the deployment is successful, the contract file will be converted again into a program file that can call the contract based on ABI and BIN.

[0035] The workflow in the user management module includes the following steps, refer to Figure 3 and Figure 4 : Step 1: The user management submodule will keep monitoring the user login status of the database. Once the database switches the operating user, the user management submodule will verify the user's identity. If the database operating user has not completed registration in the user management subsystem, it will be regarded as an unknown user and an early warning prompt will be issued; Step 2: If the current user is an unknown user, in order to ensure the integrity of the chain, the default account private key of the user management submodule is used for signing. The default account does not point to any identity object; Step 3: The database switches users. If the user management submodule also saves user information, the user signature identity will be changed so that the data chain module can call the corresponding user private key for signing.

[0036] The workflow of the primary key query submodule in the query audit module includes the following steps, refer to Figure 6 : Step 1: The user transfers the database name, table name and data primary key to be queried to the query audit module; Step 2: The query audit module will connect to the corresponding database based on the configured monitoring information, execute the query statement through the primary key, and obtain the query results from multiple databases and blockchains; Step 3: The results of the database query will be compared with the data on the chain for integrity. If the integrity is incorrect, it will prompt that the database data integrity is damaged and feedback will be given of the untampered data on the blockchain; Step 4: After the integrity is confirmed, the query audit module will perform signature verification based on the public key information in the data. If the verification is incorrect, other user public keys will be used for signature verification. After the comparison is completed, the verification result and the identity of the signer will be fed back to the auditor.

[0037] The workflow of the on-chain comparison submodule in the query audit module includes the following steps, refer to Figure 7 : Step 1: The user transfers the data table name, data primary key and database data to be audited to the query audit module; Step 2: The query audit module queries the on-chain data through the primary key and compares the integrity with the data input by the user. If the integrity is incorrect, it will prompt that the database data integrity is damaged and feedback the untampered data on the blockchain; Step 3: After the integrity is confirmed, the query audit module will perform signature verification based on the public key information in the data. If the verification is incorrect, other user public keys will be used for signature verification. After the comparison is completed, the verification result and the identity of the signer will be fed back to the auditor.

[0038] The workflow of the one-key audit submodule in the query audit module includes the following steps, refer to Figure 8 : Step 1: The user transfers the database and table name to be audited to the query audit module; Step 2: The query audit module uses streaming query to traverse the table to obtain data, and queries the on-chain data based on the primary key and saves it; Step 3: After the query is completed, audit verification is performed to distinguish between data with integrity errors and normal data; Step 4: After the verification is completed, two types of data are returned. The data with integrity errors will include on-chain data and database data, as well as signature information of on-chain data, etc. If the audit is normal, the audit results and signature identity information will be fed back to the user.

[0039] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any modifications, equivalent substitutions and improvements made within the concept of the present invention should be included in the patent protection scope of the present invention.

Claims

1. A blockchain monitoring data storage method for multiple types of databases, characterized by: It includes a data chain module, which monitors the operations of various databases and obtains data change events, and divides data change events into data change events that need to be chained and data change events that do not need to be chained; For change events that need to be uploaded to the chain, the data upload module obtains the corresponding operation data of the event and stores the operation data on the chain; There is no need to upload data change events to the chain, only the corresponding data in the database needs to be modified.

2. The blockchain monitoring data storage method for multiple databases according to claim 1 is characterized in that: The change events that need to be uploaded to the chain include at least new user creation events and / or new data creation events.

3. The blockchain monitoring data storage method for multiple databases according to claim 1 is characterized in that: The change events that do not require chaining include at least user deletion events, data deletion events and / or data update events.

4. The blockchain monitoring data storage method for multiple databases according to claim 1 is characterized in that: It also includes generating an asymmetric key pair for the users of the database; for change events that need to be uploaded to the chain, the data upload module obtains the operation data from the database and signs the operation data with the private key in the asymmetric key pair to form the uploaded data, and the uploaded data is stored on the chain.

5. The blockchain monitoring data storage method for multiple types of databases according to claim 4 is characterized in that: There is also a contract conversion module, which creates a smart contract file for the operation data table corresponding to the change event that needs to be uploaded to the chain. The table name and unique primary key in the data table are used as the corresponding creation parameters in the smart contract file. The field name and field content in the data table are spliced ​​into a JSON string as the chain storage parameter in the smart contract file. The contract conversion module deploys the smart contract file on the chain.

6. The blockchain monitoring data storage method for multiple databases according to claim 5 is characterized in that: The smart contract file parameters also include signature content signed using the private key in the corresponding user's asymmetric key pair and the public key in the asymmetric key pair.

7. A method for querying and auditing blockchain evidence data for multiple databases as described in any one of claims 4, 5 or 6, characterized in that: The user inputs the query instruction, and the database responds to the corresponding database query data according to the query instruction, and at the same time queries the data on the blockchain and responds to the corresponding on-chain query data, and compares the signature hash of the database query data with the on-chain query data; if the hash value of the database query data is consistent with the hash value of the on-chain query data, the returned database integrity is correct, otherwise the returned database integrity data is damaged.

8. The method for querying and auditing blockchain evidence data for multiple databases according to claim 7 is characterized in that: The user inputs the query instruction, and the database responds to the corresponding database query data according to the query instruction, and at the same time queries the data on the blockchain and responds to the corresponding on-chain query data, and compares the signature hash of the database query data with the on-chain query data; if the hash value of the database query data is consistent with the hash value of the on-chain query data, the returned database integrity is correct, otherwise the returned database integrity data is damaged; in the case of correct data integrity, the signature content in the on-chain query data is verified using the user's corresponding public key, and if the verification passes, the audit results and user signature information are fed back.

9. The method for querying and auditing blockchain evidence data for multiple types of databases according to claim 7 is characterized in that: The user inputs a traversal database query instruction, traverses the data table corresponding to the traversal database query instruction in the database and obtains the traversal query data table, and simultaneously traverses the on-chain data on the blockchain to obtain the on-chain traversal query data table, and compares the signature hash of the database traversal query data table with the on-chain traversal query data table; if the hash value of the database traversal query data table is consistent with the hash value of the on-chain traversal query data table, the returned database integrity is correct, otherwise the returned database complete data is damaged; in the case of correct data integrity, the signature content in the on-chain query data is verified using the user's corresponding public key, and if the verification passes, the audit results and user signature information are fed back.

Images