Data copy management method and system based on block chain

Abstract

The invention discloses a data copy management method and system based on a block chain, and belongs to the technical field of data copy management, and the method comprises the steps: slicing source data, creating data fragments, encrypting the data fragments, and distributing the data fragments to different storage nodes according to a data positioning algorithm; calculating a hash value of the data fragment, adding the hash value into metadata, and writing the metadata and the hash value into a block chain account book; according to the data copy management method and system based on the block chain, the problems of privacy disclosure, data loss and non-traceability of an original data copy system are broken through, the block chain technology is combined, the sliced metadata is chained, privacy protection, non-tampering and traceability of the data are achieved, and the data copy management method and system based on the national cryptographic algorithm and domestic software and hardware are provided. And complete autonomous controllability of the core module is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of data copy management, and specifically relates to a data copy management method and system based on blockchain. Background Art

[0002] At present, the digital economy has become a new engine of economic growth, and data, as a core production factor, has become a basic strategic resource. However, the accompanying data security risks are increasing day by day. Security incidents such as data loss, data leakage, and data abuse occur frequently, posing serious security risks to personal privacy, corporate trade secrets, and important national data. Data security has become the key to the healthy development of the digital economy.

[0003] Data security protection technology mainly uses backup, off-site replication and other technologies to ensure that multiple copies of data are stored in different data centers. When a disaster or paralysis occurs in one of the data centers, the data can be restored from the data copy in another data center. However, if multiple data centers are paralyzed at the same time, the data cannot be restored.

[0004] The current technical solutions of backup, off-site replication, and archiving to the cloud cannot guarantee that data will not be leaked. Once the off-site server is hacked, infected with a ransomware virus, or the login information on the cloud is leaked, the data will be destroyed and leaked.

[0005] The existing data copy system has the problem of privacy leakage. There is no mechanism to track and trace the use of data. At the same time, the data copy system has the problem of data loss. Although data can be stored in multiple copies, the multiple copies of the storage mechanism generally require all nodes to be in one data center. Once the data center is damaged due to fire, natural disasters, etc., the data in the other place will be lost. The data copy management system cannot realize the safe use of data in a supervised state. Therefore, it is necessary to develop a new blockchain-based data copy management method and system to solve the existing problems. Summary of the invention

[0006] The purpose of the present invention is to provide a data copy management method and system based on blockchain to solve the problem of poor security of data copy management.

[0007] To achieve the above purpose, the present invention provides the following technical solution: a data copy management method based on blockchain, comprising: The source data is sliced ​​to create data shards, and the data shards are encrypted, and the data shards are distributed to different storage nodes according to the Kademlia algorithm; the Kademlia algorithm is the national secret algorithm SM4; the national secret algorithm SM4 can be replaced with the AES256 algorithm as needed.

[0008] A hash value of the data shard is calculated, the hash value is added to metadata, and the metadata and hash value are written to the blockchain ledger.

[0009] Preferably, the method for creating data shards includes: Slice the source data into manageable chunks according to preset slice sizes.

[0010] Preferably, the preset slice size is 8K by default and can be configured to other values.

[0011] Preferably, the method for calculating the hash value of the data shard includes: performing hash calculation on the data shard according to the national encryption algorithm SM3 to generate a hash value.

[0012] Preferably, the data shards are hashed and calculated according to the national encryption algorithm SM3 to generate hash values, and only one copy of the data shards with duplicate hash values ​​is saved to achieve the purpose of deduplication.

[0013] Preferably, the data slice encryption method includes: encrypting the data slices by using the national secret algorithm SM4.

[0014] Preferably, the metadata includes information such as data operation type, operation time, storage node, hash value of corresponding shard, data shard location, etc.

[0015] Preferably, the verification record of the blockchain ledger storage data includes the operation on the data, storage time, storage node, and hash value of the corresponding data shard.

[0016] Preferably, the storage node uses a data dynamic classification and data desensitization method to implement a data classification supervision mechanism; the data dynamic classification method includes: controlling different access levels to the data according to the sensitivity level of the data, and the access control controls the user's access rights to the data according to the classification information of the data through a smart contract, and only authorizes the user to access sensitive data; The data desensitization method comprises: using a data classification algorithm to identify sensitive data, determining the data fields that need to be desensitized, and desensitizing the sensitive data according to a data desensitization strategy; The desensitization strategy includes: masking sensitive data.

[0017] The present invention further provides a data copy management system based on blockchain, comprising: The data shard creation module is used to slice the source data and create data shards; A data shard encryption module, used to encrypt data shards; The data shard distribution module is used to distribute data shards to different storage nodes according to the data location algorithm; A hash value calculation module, used to calculate the hash value of the data shard; A writing module is added to add the hash value to metadata, and the metadata and hash value are written to the blockchain ledger.

[0018] The technical effects and advantages of the present invention are as follows: the data copy management method and system based on blockchain have broken through the problems of privacy leakage, data loss and non-traceability in the original data copy system. In combination with blockchain technology, the metadata after slicing is uploaded to the chain to achieve data privacy protection, non-tamperability and traceability. Based on the national secret algorithm and domestic software and hardware, the core module is fully autonomous and controllable; the data is sliced ​​and encrypted using the national secret algorithm, and based on slicing and national secret encryption technology, the data cannot be stolen and decrypted by unauthorized users; through a dedicated private protocol, the storage nodes, cloud hosts in the public cloud, servers of enterprises and institutions, and even personal PCs are physically completely isolated, and the geographically widely distributed nodes are linked together through a dedicated private protocol to form a unified data copy storage system. The data stored in the system can be configured with multiple copies, and the integrity and availability of the data can be guaranteed even if any half of the nodes are damaged or destroyed. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 This is a flow chart of the first embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Embodiment 1

[0022] The present invention provides Figure 1 , Figure 2 A data copy management method based on blockchain as shown in , comprises the following steps: 1) Slice the data, encrypt the data slices using the national secret algorithm, distribute the data slices to different storage nodes according to the Kademlia algorithm, and ensure sufficient redundant copies through multiple copies and erasure codes; the Kademlia algorithm is often used in the distributed hash table (DHT) protocol in peer-to-peer (P2P) networks, which provides an efficient and reliable data storage and retrieval mechanism for decentralized networks; multiple different storage nodes serve as a storage resource pool to form a cloud storage platform.

[0023] 2) Calculate the hash of the data shards through the national secret algorithm and add the hash to the metadata. The metadata includes the data operation type, operation time, storage node, hash value of the corresponding shard, data shard location and other information. Add the metadata to the blockchain to prevent information from being tampered with; 3) Based on slicing and national secret encryption technology, data cannot be stolen and decrypted by unauthorized users; based on continuous data protection technology, every moment of the data can be reproduced.

[0024] Create data shards, and slice the data captured from the user's production system and written to the data copy management system according to the size of 8K. The 8K describes the preset slice size, which is not limited to 4K, 8K, etc., and can also be any preset size; the slicing process refers to decomposing the data into manageable blocks. During the decomposition process, the data stream written to the data copy management system is sequentially divided into multiple shards of fixed length. These blocks can be distributed on multiple storage nodes.

[0025] The data fragments can be stored in different nodes in a dispersed manner. Even if a certain node is breached, the data is incomplete, thus ensuring the security of the data.

[0026] Each slice generates a hash value, and the shard data is hashed according to the national encryption algorithm SM3 to generate a hash value; only one copy of the data shard with repeated hash values ​​is saved to achieve the purpose of deduplication; Deduplication is performed based on the hash value of the shard; each shard generates a hash value. If the hash values ​​of two shards are the same, it means that the contents of the two data shards are exactly the same, and there is no need to send the data of the block to the storage node again for storage.

[0027] Data sharding is encrypted and stored. The national encryption algorithm SM4 is used to encrypt data shards, and the encrypted data is distributed to multiple storage nodes for storage according to the configured number of copies; The metadata and hash of the shard are written to the blockchain ledger. The shard metadata includes but is not limited to the size of the shard, encryption method, and offset in the original data. The blockchain uses the blockchain ledger to store data verification records, including data operations, storage time, storage nodes, and hash values ​​of corresponding shards. Since the blockchain ledger is based on blockchain technology, it is transparent, verifiable, traceable, and tamper-proof.

[0028] Based on the traceability and non-tamperability of blockchain, a multi-level data privacy protection model based on national secret algorithms, combined with cloud computing and distributed storage technologies, integrates identity authentication, multi-level data protection, intelligent channels and other technologies for different scenarios, levels and modes. We use national secret algorithms to build a data copy management system that is privacy-protected, secure, scalable, autonomous and trustworthy for multiple users and multiple applications.

[0029] The identity authentication refers to implementing multi-factor identity authentication based on the PKI system to ensure the authenticity and validity of the user's identity.

[0030] Multi-level data protection means that the user's data is transmitted to the data copy management system through intelligent channels through different levels of protection mechanisms such as scheduled capture and real-time synchronization.

[0031] The intelligent channel refers to the connection channel between the user production system and the data copy management system. The data transmission in this channel is encrypted, compressed, and deduplicated, and intelligent speed limiting and segmented transmission are achieved according to the load conditions of the sending and receiving ends.

[0032] Based on the hardware platform of domestic storage, the software platform of domestic operating system, and the national secret algorithm, with blockchain technology as the core, we build a complete set of cloud storage data security protection equipment with privacy protection, security, reliability, and elasticity. It includes a cloud storage platform with a privacy protection mechanism based on blockchain and a distributed data protection system based on the national secret algorithm.

[0033] Specifically, we adopt domestic storage hardware platforms and domestic chips, such as Feiteng, Loongson, and Kunpeng, and integrate hardware encryption modules with national secret algorithms. We use domestic operating systems such as Kylin to strengthen the system kernel and improve the security of the operating system. We adopt domestic blockchain platforms and use SM2, SM3, and SM4 national secret algorithms for encryption, signing, and hashing. We manage data access rights by writing smart contracts, audit system operation logs, use homomorphic encryption, realize the calculation and indexing of encrypted data, ensure the privacy protection of data during use, and store data in shards to ensure high availability and reliability of data.

[0034] Construct alliance chain / private chain based on blockchain technology, save the sliced ​​metadata in the blockchain ledger, encrypt and save the data slices to the cloud storage platform, realize data privacy protection, non-tamperability and traceability, and break through key technologies such as dynamic data classification and data desensitization to realize data classification supervision mechanism based on smart contracts.

[0035] Specifically, dynamic data classification refers to controlling different access levels to data based on the sensitivity level of the data. The access control controls the user's access rights to the data based on the data classification information through smart contracts to ensure that only authorized users can access sensitive data.

[0036] The data desensitization uses a data classification algorithm to identify sensitive data, determine the data fields that need to be desensitized, and desensitize the sensitive data according to the data desensitization strategy.

[0037] Desensitizing methods include masking sensitive data, such as replacing part of the digits of the ID number, encrypting sensitive data to ensure the security of data during storage and transmission, and generalizing sensitive data, such as converting specific ages into age groups.

[0038] Embodiment 2

[0039] The present invention further provides a data copy management system based on blockchain, comprising: The data shard creation module is used to slice the source data and create data shards; A data shard encryption module, used to encrypt data shards; The data shard distribution module is used to distribute data shards to different storage nodes according to the data location algorithm; A hash value calculation module, used to calculate the hash value of the data shard; A writing module is added to add the hash value to metadata, and the metadata and hash value are written to the blockchain ledger.

[0040] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data copy management method based on blockchain, characterized in that: include: Slice the source data, create data shards, encrypt the data shards using the national encryption algorithm SM4, and distribute the data shards to different storage nodes according to the Kademlia algorithm; A hash value of the data shard is calculated, the hash value is added to metadata, and the metadata and hash value are written to the blockchain ledger.

2. According to a blockchain-based data copy management method according to claim 1, it is characterized in that: The method for creating data shards comprises: Slice the source data into manageable chunks according to preset slice sizes.

3. According to a blockchain-based data copy management method according to claim 1, it is characterized in that: The preset slice size is 4K or 8K.

4. The blockchain-based data copy management method according to any one of claims 1 to 3, characterized in that: The method for calculating the hash value of the data shard includes: performing hash calculation on the data shard according to the national encryption algorithm SM3 to generate a hash value.

5. According to claim 4, a data copy management method based on blockchain is characterized in that: The data shards are hashed and calculated according to the national encryption algorithm SM3 to generate hash values, and only one copy of the data shards with repeated hash values ​​is saved.

6. The blockchain-based data copy management method according to any one of claims 1 to 3, characterized in that: The data slice encryption method includes: encrypting the data slices by using the national secret algorithm SM4.

7. The data copy management method based on blockchain according to claim 1 is characterized in that: The metadata includes information such as the data operation type, operation time, storage node, hash value of the corresponding shard, data shard location, etc.

8. The data copy management method based on blockchain according to claim 1 is characterized in that: The verification record of the blockchain account book storage data includes the operation on the data, storage time, storage node, and hash value of the corresponding data shard.

9. The method for managing data copies based on blockchain according to claim 1, characterized in that: The storage node uses dynamic data classification and data desensitization methods to implement a data classification supervision mechanism; the dynamic data classification method includes: controlling different access levels of data according to the sensitivity level of the data, and the access control controls the user's access rights to the data according to the classification information of the data through smart contracts, and only authorizes users to access sensitive data; The data desensitization method comprises: using a data classification algorithm to identify sensitive data, determining the data fields that need to be desensitized, and desensitizing the sensitive data according to a data desensitization strategy; The desensitization strategy includes: masking sensitive data.

10. A data copy management system based on blockchain, characterized by: include: The data shard creation module is used to slice the source data and create data shards; A data shard encryption module, used to encrypt data shards; The data shard distribution module is used to distribute data shards to different storage nodes according to the data location algorithm; A hash value calculation module, used to calculate the hash value of the data shard; A writing module is added to add the hash value to metadata, and the metadata and hash value are written to the blockchain ledger.

Images