File encryption and decryption method, device and equipment based on block chain and digital envelope

Abstract

The invention discloses a file encryption and decryption method, device and equipment based on a block chain and a digital envelope, and relates to the technical field of block chains and information security. The method comprises the following steps: acquiring a symmetric key of a local end of a sender, encrypting data to be transmitted by using the symmetric key to obtain a ciphertext file, and calculating a ciphertext hash value of the ciphertext file; obtaining a first public key and a first public key hash value of at least one receiver in the block chain, the first public key being associated with a private key of a local end of the receiver, and using the first public key to perform asymmetric encryption on a symmetric key to obtain a key envelope; submitting the first public key hash value, the key envelope, the ciphertext hash value and a second public key hash value of the sender to a file management and access control smart contract of the block chain as a target transaction; and sending the ciphertext file to at least one receiver. By adopting the method provided by the invention, the key management process can be simplified, and the security of file transmission is greatly improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain and information security technology, and in particular to a file encryption and decryption method, device and equipment based on blockchain and digital envelope. Background Art

[0002] Under the wave of global digital transformation, data such as identity information, bank accounts and financial statements have become core assets of individuals and enterprises, but it also brings unprecedented security challenges. For example, hackers can steal files through malware and phishing.

[0003] At present, related technologies mainly use symmetric encryption to implement file encryption and decryption. That is, the sender uses an encryption key to encrypt the original data and sends the encryption key and the encrypted data to the receiver. The receiver can then use the encryption key to decrypt the encrypted data. However, the security of the key is difficult to guarantee during the transmission process, and there is a lack of identity authentication, which leads to high security risks. Summary of the Invention

[0004] In view of the above-mentioned defects or deficiencies in the relevant technology, it is desired to provide a file encryption and decryption method, device and equipment based on blockchain and digital envelope, which can simplify the key management process and improve the security of file transmission.

[0005] In a first aspect, the present application provides a file encryption and decryption method based on blockchain and digital envelope, the file encryption and decryption method being used by a sender, and the file encryption and decryption method comprising:

[0006] Obtaining the symmetric key of the sender's local terminal, and using the symmetric key to encrypt the data to be transmitted to obtain a ciphertext file, and then calculating the ciphertext hash value of the ciphertext file;

[0007] Obtaining a first public key and a first public key hash value of at least one recipient on the blockchain, where the first public key is associated with a private key on the recipient's local terminal, asymmetrically encrypting the symmetric key using the first public key to obtain a key envelope, and submitting the first public key hash value, the key envelope, the ciphertext hash value, and the second public key hash value of the sender as a target transaction to a file management and access control smart contract on the blockchain;

[0008] The encrypted file is sent to the at least one recipient.

[0009] Optionally, in some embodiments of the present application, obtaining the first public key and the first public key hash value of at least one recipient in the blockchain includes:

[0010] In response to at least one recipient identifier input by the sender in the operation interface, an identification hash value corresponding to each recipient identifier is calculated, and the first public key and first public key hash value associated with the identification hash value are queried from the identity and public key management smart contract of the blockchain.

[0011] Optionally, in some embodiments of the present application, the recipient identification includes the recipient's Internet Protocol address, the recipient's email address, and the recipient's mobile phone number.

[0012] Optionally, in some embodiments of the present application, the target transaction further includes access control rules, and the access control rules include file decryption permissions and access validity period.

[0013] In a second aspect, the present application provides a file encryption and decryption method based on blockchain and digital envelope, the file encryption and decryption method is used by a recipient, and the file encryption and decryption method includes:

[0014] Receive the ciphertext file sent by the sender;

[0015] Using the first public key hash value of the recipient and the second public key hash value of the sender to query the file management and access control smart contract of the blockchain to obtain the key envelope and the ciphertext hash value of the ciphertext file;

[0016] Verify the ciphertext file using the ciphertext hash value, and after successful verification, decrypt the key envelope using the recipient's local private key to obtain the symmetric key;

[0017] The symmetric key is used to decrypt the ciphertext file to obtain the data to be transmitted.

[0018] In a third aspect, the present application provides a file encryption and decryption device based on blockchain and digital envelope, wherein the file encryption and decryption device is used by a sender, and the file encryption and decryption device includes an encryption module, a submission module, and a sending module connected to each other;

[0019] The encryption module is used to obtain the symmetric key of the local end of the sender, and use the symmetric key to encrypt the data to be transmitted to obtain a ciphertext file, and then calculate the ciphertext hash value of the ciphertext file;

[0020] The submission module is configured to obtain a first public key and a first public key hash value of at least one recipient on the blockchain, wherein the first public key is associated with a private key of the recipient's local terminal, and after asymmetrically encrypting the symmetric key using the first public key to obtain a key envelope, submit the first public key hash value, the key envelope, the ciphertext hash value, and the second public key hash value of the sender as a target transaction to the file management and access control smart contract of the blockchain;

[0021] The sending module is used to send the ciphertext file to the at least one recipient.

[0022] Optionally, in some embodiments of the present application, the submission module is specifically used to respond to at least one recipient identifier input by the sender in the operation interface, calculate the identification hash value corresponding to each recipient identifier, and query the first public key and first public key hash value associated with the identification hash value from the identity and public key management smart contract of the blockchain.

[0023] Optionally, in some embodiments of the present application, the recipient identification includes the recipient's Internet Protocol address, the recipient's email address, and the recipient's mobile phone number.

[0024] Optionally, in some embodiments of the present application, the target transaction further includes access control rules, and the access control rules include file decryption permissions and access validity period.

[0025] In a fourth aspect, the present application provides a terminal device, characterized in that the terminal device includes a processor and a memory, and the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the file encryption and decryption method described in any one of the first aspect or the second aspect.

[0026] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0027] The embodiments of the present application provide a file encryption and decryption method, apparatus, and device based on blockchain and digital envelope. The first public key and first public key hash value of at least one recipient are stored through blockchain, which is decentralized and cannot be tampered with, simplifies the key management process, and is convenient for large-scale application. Therefore, the symmetric key for encrypting the data to be transmitted can be asymmetrically encrypted using the first public key to obtain a key envelope, and the first public key hash value, key envelope, ciphertext hash value, and the second public key hash value of the sender are submitted as a target transaction to the file management and access control smart contract of the blockchain, so that the recipient can use the private key of the local end of the recipient associated with the first public key to decrypt in sequence to obtain the data to be transmitted, thereby greatly improving the security of file transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 A flowchart of a file encryption and decryption method based on blockchain and digital envelope for a sender provided in an embodiment of the present application;

[0030] Figure 2 A flowchart of a file encryption and decryption method based on blockchain and digital envelope for a recipient provided in an embodiment of the present application;

[0031] Figure 3 A structural block diagram of a file encryption and decryption device based on blockchain and digital envelope for a sender provided in an embodiment of the present application;

[0032] Figure 4 A structural block diagram of a file encryption and decryption device based on blockchain and digital envelope for a recipient provided in an embodiment of the present application;

[0033] Figure 5 A structural block diagram of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0035] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0036] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of this application can be combined with each other. Figures 1 to 5 The file encryption and decryption method, device and equipment based on blockchain and digital envelope provided in the embodiments of the present application are elaborated in detail.

[0037] Please refer to Figure 1 , which is a file encryption and decryption method based on blockchain and digital envelope provided in an embodiment of the present application. The file encryption and decryption method is used by the sender and specifically includes the following steps:

[0038] S101, obtaining the symmetric key of the local end of the sender, and using the symmetric key to encrypt the data to be transmitted to obtain a ciphertext file, and then calculating the ciphertext hash value of the ciphertext file.

[0039] In some embodiments of the present application, the symmetric key can be generated in real time or periodically by a key generator on the local side of the sender. Real-time generation means that the symmetric key is different each time, while periodic generation means that a symmetric key is generated at a preset interval. The symmetric key remains unchanged during the preset interval. For example, the preset interval can be 1 minute, 30 minutes, and 1 hour, etc., which can save computing resources while taking security into account. Alternatively, the symmetric key can also be set by the user through the operation interface. The advantage of such a setting is that it meets diverse usage requirements, is more flexible, and is easy to remember. Furthermore, methods for encrypting data to be transmitted using symmetric keys include but are not limited to SM4-OFB algorithm and AES-OFB algorithm, and methods for calculating ciphertext hash values ​​include but are not limited to SHA-256, etc.

[0040] S102, obtaining a first public key and a first public key hash value of at least one recipient on the blockchain, wherein the first public key is associated with a private key of the recipient's local terminal, and after asymmetric encryption of the symmetric key using the first public key to obtain a key envelope, the first public key hash value, the key envelope, the ciphertext hash value, and the second public key hash value of the sender are submitted as a target transaction to the file management and access control smart contract of the blockchain.

[0041] In some embodiments of the present application, when obtaining the first public key and first public key hash value of at least one recipient on the blockchain, the sender may respond to at least one recipient identifier input on the operation interface, calculate the identification hash value corresponding to each recipient identifier, and query the first public key and first public key hash value associated with the identification hash value from the identity and public key management smart contract of the blockchain. For example, the recipient identifier includes but is not limited to the recipient's Internet Protocol (IP) address, the recipient's email address, and the recipient's mobile phone number. Furthermore, the target transaction may also include access control rules, which include file decryption permissions and access validity periods, thereby ensuring that only recipients that meet the requirements can decrypt the ciphertext file.

[0042] It should be noted that since the roles of the sender and receiver are interchangeable in different scenarios, both the sender and the receiver can use an asymmetric algorithm to generate an asymmetric key pair locally after successful registration, such as an SM2 key pair. The private key can then be stored locally, and the public key, public key hash value, and identification hash value can be submitted to the identity and public key management smart contract pre-deployed on the blockchain through a transaction. The identity and public key management smart contract is responsible for managing and recording the identity information submitted by all users, and forming a decentralized and transparent public key infrastructure.

[0043] S103: Send the encrypted file to at least one recipient.

[0044] In some embodiments of the present application, the video can be sent to at least one recipient via email, a network disk, and the same application (APP), so that the recipient can download it through these channels.

[0045] As another aspect, please refer to Figure 2 , which is a file encryption and decryption method based on blockchain and digital envelope provided in an embodiment of the present application. The file encryption and decryption method is used by the recipient and specifically includes the following steps:

[0046] S201, receiving a ciphertext file sent by a sender.

[0047] S202, using the first public key hash value of the recipient and the second public key hash value of the sender to query and obtain the key envelope and ciphertext hash value of the ciphertext file in the file management and access control smart contract of the blockchain.

[0048] In some embodiments of the present application, the recipient can input the sender's identifier in the operation interface and calculate the identifier hash value corresponding to the sender's identifier, and then query the second public key hash value associated with the identifier hash value corresponding to the sender's identifier from the identity and public key management smart contract of the blockchain. For example, the sending identifier includes but is not limited to the sender's Internet Protocol address, the sender's email address, and the sender's mobile phone number, etc., which facilitates and accurately searches for the key envelope and ciphertext hash value of the ciphertext file and improves processing efficiency.

[0049] In some embodiments of the present application, before the identity and public key management smart contract returns information, it can also verify whether the recipient has the authority to decrypt the ciphertext file and whether the access validity period meets the requirements based on the access control rules in the target transaction. For example, if the time of querying the file management and access control smart contract exceeds the time set for the access validity period, the key envelope and ciphertext hash value of the ciphertext file will not be returned, and a prompt will be given that the access validity period has expired, which is clear at a glance, allowing the recipient to quickly know the reason.

[0050] S203, using the ciphertext hash value to verify the ciphertext file, and after successful verification, decrypting the key envelope using the private key of the local recipient to obtain the symmetric key.

[0051] In some embodiments of the present application, verifying the ciphertext file through the ciphertext hash value can ensure that the downloaded ciphertext file is complete and has no errors or tampering.

[0052] S204: Decrypt the encrypted file using the symmetric key to obtain the data to be transmitted.

[0053] It should be noted that, for the description of the same steps and contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0054] The file encryption and decryption method based on blockchain and digital envelope provided in the embodiment of the present application stores the first public key and the first public key hash value of at least one recipient through blockchain, which is decentralized and cannot be tampered with, simplifies the key management process, and is convenient for large-scale application. Therefore, the symmetric key for encrypting the data to be transmitted can be asymmetrically encrypted using the first public key to obtain a key envelope, and the first public key hash value, the key envelope, the ciphertext hash value and the second public key hash value of the sender are submitted as a target transaction to the file management and access control smart contract of the blockchain, so that the recipient can use the private key of the local end of the recipient associated with the first public key to decrypt in sequence to obtain the data to be transmitted, thereby greatly improving the security of file transmission.

[0055] Based on the above embodiments, the present application provides a file encryption and decryption device based on blockchain and digital envelope. The file encryption and decryption device 100 is used by the sender. The file encryption and decryption device 100 can realize Figure 1 Please refer to the file encryption and decryption method of the corresponding embodiment. Figure 3 , the file encryption and decryption device 100 includes an encryption module 101, a submission module 102 and a sending module 103 connected to each other;

[0056] The encryption module 101 is used to obtain the symmetric key of the local sender, and use the symmetric key to encrypt the data to be transmitted to obtain a ciphertext file, and then calculate the ciphertext hash value of the ciphertext file;

[0057] The submission module 102 is configured to obtain a first public key and a first public key hash value of at least one recipient on the blockchain, wherein the first public key is associated with a local private key of the recipient, and after asymmetric encryption of the symmetric key using the first public key to obtain a key envelope, submit the first public key hash value, the key envelope, the ciphertext hash value, and the second public key hash value of the sender as a target transaction to the file management and access control smart contract of the blockchain;

[0058] The sending module 103 is configured to send the encrypted file to at least one recipient.

[0059] Optionally, in some embodiments of the present application, the submission module 102 is specifically used to respond to at least one recipient identifier input by the sender in the operation interface, calculate the identification hash value corresponding to each recipient identifier, and query the first public key and the first public key hash value associated with the identification hash value from the identity and public key management smart contract of the blockchain.

[0060] Optionally, in some embodiments of the present application, the recipient identification includes the recipient's Internet Protocol address, the recipient's email address, and the recipient's mobile phone number.

[0061] Optionally, in some embodiments of the present application, the target transaction further includes access control rules, and the access control rules include file decryption permissions and access validity period.

[0062] As another aspect, please refer to Figure 4 , which is a file encryption and decryption device based on blockchain and digital envelope provided by the embodiment of the present application. The file encryption and decryption device 200 is used by the recipient. The file encryption and decryption device 200 can realize Figure 2 The file encryption and decryption method of the corresponding embodiment, the file encryption and decryption device 200 includes a receiving module 201, a query module 202, a first decryption module 203 and a second decryption module 204 connected to each other;

[0063] The receiving module 201 is used to receive the ciphertext file sent by the sender;

[0064] The query module 202 is configured to query the file management and access control smart contract of the blockchain using the first public key hash value of the recipient and the second public key hash value of the sender to obtain the key envelope and the ciphertext hash value of the ciphertext file;

[0065] The first decryption module 203 is used to verify the ciphertext file using the ciphertext hash value, and after successful verification, decrypt the key envelope using the private key of the local recipient to obtain the symmetric key;

[0066] The second decryption module 204 is used to decrypt the ciphertext file using the symmetric key to obtain the data to be transmitted.

[0067] It should be noted that, for the description of the same steps and contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0068] The file encryption and decryption device based on blockchain and digital envelope provided in the embodiment of the present application stores the first public key and the first public key hash value of at least one recipient through the blockchain, is decentralized and cannot be tampered with, simplifies the key management process, and is convenient for large-scale application. Therefore, the symmetric key for encrypting the data to be transmitted can be asymmetrically encrypted using the first public key to obtain a key envelope, and the first public key hash value, the key envelope, the ciphertext hash value and the second public key hash value of the sender are submitted as a target transaction to the file management and access control smart contract of the blockchain, so that the recipient can use the private key of the local end of the recipient associated with the first public key to decrypt in sequence to obtain the data to be transmitted, thereby greatly improving the security of file transmission.

[0069] Based on the above embodiments, this application embodiment provides a terminal device. Figure 5The terminal device 300 may include a processor 301 and a memory 302. The memory 302 stores at least one instruction, at least one program, code set or instruction set, which is loaded and executed by the processor 301 to implement Figure 1 or Figure 2 The steps of the file encryption and decryption method of the corresponding embodiment.

[0070] As another aspect, the present invention provides a computer-readable storage medium for storing program code for executing the aforementioned Figure 1 or Figure 2 Any implementation method of the file encryption and decryption method of the corresponding embodiment.

[0071] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0072] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. On the other hand, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms. The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0073] In addition, the functional modules in the various embodiments of the present application may be integrated into a single processing unit, or each module may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated units may be implemented in the form of hardware or in the form of software functional units. If the integrated units are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium.

[0074] Based on this understanding, the technical solution of the present application, or the portion that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the file encryption and decryption methods of each embodiment of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0075] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0076] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only intended to help understand the method and core concept of this application. At the same time, for those skilled in the art, based on the concept of this application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A file encryption and decryption method based on blockchain and digital envelope, characterized in that: The file encryption and decryption method is used by the sender, and the file encryption and decryption method includes: Obtaining the symmetric key of the sender's local terminal, and using the symmetric key to encrypt the data to be transmitted to obtain a ciphertext file, and then calculating the ciphertext hash value of the ciphertext file; Obtaining a first public key and a first public key hash value of at least one recipient on the blockchain, where the first public key is associated with a private key on the recipient's local terminal, asymmetrically encrypting the symmetric key using the first public key to obtain a key envelope, and submitting the first public key hash value, the key envelope, the ciphertext hash value, and the second public key hash value of the sender as a target transaction to a file management and access control smart contract on the blockchain; The encrypted file is sent to the at least one recipient.

2. The file encryption and decryption method according to claim 1, characterized in that: The obtaining of the first public key and the first public key hash value of at least one recipient in the blockchain includes: In response to at least one recipient identifier input by the sender in the operation interface, an identification hash value corresponding to each recipient identifier is calculated, and the first public key and first public key hash value associated with the identification hash value are queried from the identity and public key management smart contract of the blockchain.

3. The file encryption and decryption method according to claim 2, characterized in that: The recipient identification includes the recipient's Internet Protocol address, the recipient's email address and the recipient's mobile phone number.

4. The file encryption and decryption method according to any one of claims 1 to 3, characterized in that: The target transaction further includes access control rules, and the access control rules include file decryption authority and access validity period.

5. A file encryption and decryption method based on blockchain and digital envelope, characterized in that: The file encryption and decryption method is used by a receiving party, and the file encryption and decryption method includes: Receive the ciphertext file sent by the sender; Using the first public key hash value of the recipient and the second public key hash value of the sender to query the file management and access control smart contract of the blockchain to obtain the key envelope and the ciphertext hash value of the ciphertext file; Verify the ciphertext file using the ciphertext hash value, and after successful verification, decrypt the key envelope using the recipient's local private key to obtain the symmetric key; The ciphertext file is decrypted using the symmetric key to obtain the data to be transmitted.

6. A file encryption and decryption device based on blockchain and digital envelope, characterized in that: The file encryption and decryption device is used by the sender, and the file encryption and decryption device includes an encryption module, a submission module and a sending module that are connected to each other; The encryption module is used to obtain the symmetric key of the local end of the sender, and use the symmetric key to encrypt the data to be transmitted to obtain a ciphertext file, and then calculate the ciphertext hash value of the ciphertext file; The submission module is configured to obtain a first public key and a first public key hash value of at least one recipient on the blockchain, wherein the first public key is associated with a private key of the recipient's local terminal, and after asymmetrically encrypting the symmetric key using the first public key to obtain a key envelope, submit the first public key hash value, the key envelope, the ciphertext hash value, and the second public key hash value of the sender as a target transaction to the file management and access control smart contract of the blockchain; The sending module is used to send the ciphertext file to the at least one recipient.

7. The file encryption and decryption device according to claim 6, characterized in that: The submission module is specifically used to respond to at least one recipient identifier input by the sender in the operation interface, calculate the identification hash value corresponding to each recipient identifier, and query the first public key and first public key hash value associated with the identification hash value from the identity and public key management smart contract of the blockchain.

8. The file encryption and decryption device according to claim 7, characterized in that: The recipient identification includes the recipient's Internet Protocol address, the recipient's email address and the recipient's mobile phone number.

9. The file encryption and decryption device according to any one of claims 6 to 8, characterized in that: The target transaction further includes access control rules, and the access control rules include file decryption authority and access validity period.

10. A terminal device, characterized in that: The terminal device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the file encryption and decryption method described in any one of claims 1 to 4 or claim 5.

Images