Blockchain-based decentralized archive data security management method and system

Abstract

The application relates to the technical field of data security, in particular to a decentralized archive data security management method and system based on a block chain, which comprises the following steps: based on a Fabric alliance chain, constructing an archiving node, an access node, an approval node and a supervision node; when uploading archive data, the archiving node encrypts the archive data by using an encryption algorithm, and sends an encryption key to the supervision node, the encryption key being used for decrypting the archive data; when requesting to access the archive data, the access node sends an access request to the approval node; if there is access permission, the approval node sends a decryption request to the supervision node; and the approval node sends a download request to the archiving node. The archive encryption processing guarantees the confidentiality of data, even if the data in the database is read, the original information cannot be interpreted; the key hosting and operation record chaining of the supervision node ensure that the archive use process is auditable and tamper-proof.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a decentralized archive data security management method and system based on a block chain. BACKGROUND

[0002] With the development of e-government, smart personnel and professional credit system, more and more government agencies, enterprises and institutions, colleges and universities and human resource platforms begin to build personnel digital archive systems to collect and manage electronic information such as education, resume, title, assessment, rewards and punishments, and training of individuals. The security, integrity and credibility of these archive data are directly related to the fairness and compliance of key businesses such as cadre management, public servant employment and professional qualification assessment.

[0003] However, the existing archive system generally adopts a centralized architecture, that is, a database and a management background are deployed by a master control platform, and archive data are often stored in a traditional database. If a system administrator or a hacker has the database permission, he or she can directly modify the archive content. Once the archive is modified, it is difficult to restore the original version, and it is also impossible to prove when and who tampered with the information. SUMMARY

[0004] The present application aims to at least solve one of the problems in the prior art or related art.

[0005] To this end, the present application provides a decentralized archive data security management method based on a block chain, which realizes the full-process digitization and on-chain management of archive uploading, encryption, authorized access and supervision records through alliance chain technology and node division. The archive encryption processing ensures the confidentiality of the data, and even if the data in the database is read, the original information cannot be interpreted. The key management of the supervision node and the on-chain operation record ensure that the archive use process is auditable and tamper-proof. The permission judgment mechanism of the approval node improves the precision and security of access control. At the same time, each operation path is fixed through the block chain account book, ensuring that each data access and operation can be traced back, effectively improving the transparency, security and compliance of the archive system.

[0006] The present application also provides a decentralized archive data security management system based on a block chain, an electronic device and a storage medium comprising the above-mentioned decentralized archive data security management method based on a block chain.

[0007] According to the first aspect of the present application, a decentralized archive data security management method based on a block chain comprises:

[0008] Based on the Fabric alliance chain, a filing node, an access node, an approval node and a supervision node are constructed; the filing node is used for an archive unit to upload archive data, the access node is used for a requesting unit to initiate an access request for the archive data, the approval node is used for approving the access request, and the supervision node is used for recording operation records of uploading and accessing the archive data;

[0009] When the archive data is uploaded, the filing node encrypts the archive data by using an encryption algorithm, and sends an encryption key to the supervision node, the encryption key being used for decrypting the archive data;

[0010] When the archive data is accessed, the access node sends an access request to the approval node; the approval node judges whether there is an access right;

[0011] If there is an access right, the approval node sends a decryption request to the supervision node, the decryption request being used for requesting the encryption key of the archive data from the supervision node; the approval node sends a download request to the filing node, the download request being used for requesting a download address of the archive data from the filing node, the download address being used for downloading the archive data; and the approval node sends the encryption key and the download address of the archive data to the access node.

[0012] Optionally, the step of uploading the archive data comprises:

[0013] The archive data is divided into sub-blocks based on a preset segmentation template;

[0014] Each archive data sub-block after being divided is processed by using a hash algorithm to generate a digest fingerprint corresponding to each archive data sub-block, the digest fingerprint being used for verifying whether the data is tampered with;

[0015] Each archive data sub-block is encrypted by using an encryption algorithm, and an encryption key is sent to the supervision node;

[0016] The encrypted archive data sub-blocks are uploaded to a distributed storage system, and a storage address corresponding to each archive data sub-block is recorded as a download address;

[0017] An archive index item is constructed and registered to a block chain ledger; the archive index item at least comprises a main identifier of an archive, a sub-identifier of each archive data sub-block, a digest fingerprint and a download address.

[0018] Optionally, the step of encrypting each archive data sub-block by using an encryption algorithm comprises:

[0019] Based on the security level of each archive data sub-block, the archiving node uses different levels of encryption algorithms to encrypt each archive data sub-block.

[0020] Optionally, the step of determining whether the access request is approved by the approval node comprises:

[0021] The approval node receives an access request from the access node, and the access request at least includes: a requester identity, time limit information, a main identifier of a requested archive, and a sub-identifier of an archive data sub-block.

[0022] Based on the main identifier of the requested archive and the sub-identifier of the archive data sub-block, an access right is obtained.

[0023] Based on the requester identity and the time limit information, it is determined whether the access right is met.

[0024] If yes, it is determined that the access right is met.

[0025] Optionally, the archiving node, the access node, and the approval node share a first channel; the archiving node and the supervision node share a second channel; and the approval node and the supervision node share a third channel.

[0026] Optionally, when the archive data is uploaded, the supervision node records an operation record of the uploading of the archive data to a blockchain ledger of the second channel.

[0027] Optionally, when the archive data is requested to be accessed, the supervision node records an operation record of the access of the archive data to a blockchain ledger of the third channel.

[0028] According to the second aspect of the present application, a decentralized archive data security management system based on a blockchain comprises:

[0029] A construction module is configured to construct an archiving node, an access node, an approval node, and a supervision node based on a Fabric consortium chain; the archiving node is configured to upload archive data by an archive unit, the access node is configured to initiate an access request for the archive data by a requesting unit, the approval node is configured to approve the access request, and the supervision node is configured to record operation records of the uploading and access of the archive data.

[0030] An uploading module is configured to, when the archive data is uploaded, encrypt the archive data by the archiving node using an encryption algorithm, and send an encryption key to the supervision node, the encryption key being used to decrypt the archive data.

[0031] A requesting module is configured to, when the archive data is requested to be accessed, send an access request to the approval node by the access node; the approval node is configured to determine whether the access right is met.

[0032] If there is access permission, the approval node sends a decryption request to the supervision node, the decryption request being used to request an encryption key of the archive data from the supervision node; the approval node sends a download request to the archiving node, the download request being used to request a download address of the archive data from the archiving node, the download address being used to download the archive data; and the approval node sends the encryption key and the download address of the archive data to the access node.

[0033] An electronic device according to a third aspect of the present application comprises:

[0034] The processor and the memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so as to execute the method of the first aspect.

[0035] A computer readable storage medium according to a fourth aspect of the present application is used to store a computer program, the computer program causing a computer to execute the method of the first aspect.

[0036] One of the above technical solutions has at least the following advantages or beneficial effects:

[0037] For the embodiment of the application, a kind of based on the decentralized archive data security management method based on block chain includes: based on Fabric alliance chain, build filing node, access node, approval node and supervision node;The filing node is used for the archive unit to upload archive data, the access node is used for requesting unit to initiate access request to the archive data, the approval node is used for approving access request, and the supervision node is used for recording the operation record of the uploading and access of the archive data;When uploading archive data, the filing node uses encryption algorithm to encrypt the archive data, and sends the encryption key to the supervision node, and the encryption key is used to decrypt the archive data;When requesting to access the archive data, the access node sends access request to the approval node;The approval node judges whether there is access authority;If there is access authority, the approval node sends decryption request to the supervision node, and the decryption request is used to request the encryption key of the archive data from the supervision node;The approval node sends download request to the filing node, and the download request is used to request the download address of the archive data from the filing node, and the download address is used to download the archive data;The approval node sends the encryption key and download address of the archive data to the access node.Through alliance chain technology and node division of labor, realize the full-process digitization and chain management of archive uploading, encryption, authorized access and supervision record. Archive encryption processing guarantees the confidentiality of data, even if the data in the database is read, the original information cannot be interpreted;The key hosting of the supervision node and the operation record on chain ensure that the archive use process is auditable and tamper-proof;The permission judgment mechanism of the approval node improves the precision and security of access control;At the same time, each operation path is fixed through blockchain account book, ensures that each data access and operation can be traced back, effectively improves the transparency, security and compliance of the archive system.

[0038] The decentralized archive data security management system based on block chain, electronic equipment and storage medium provided by the embodiment of the application are provided with the above-mentioned decentralized archive data security management method based on block chain, since the decentralized archive data security management method based on block chain has the above-mentioned technical effects, the decentralized archive data security management system based on block chain, electronic equipment and storage medium provided with the decentralized archive data security management method based on block chain should also have corresponding technical effects. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the present application, the drawings needed in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0040] Figure 1A schematic diagram of a decentralized archive data security management method based on a block chain provided by an embodiment of the present application is shown in FIG. 1.

[0041] Figure 2 A schematic diagram of channel construction in a decentralized archive data security management method based on a block chain provided by an embodiment of the present application is shown in FIG. 2.

[0042] Figure 3 A flowchart of uploading archive data in a decentralized archive data security management method based on a block chain provided by an embodiment of the present application is shown in FIG. 3.

[0043] Figure 4 A schematic diagram of a decentralized archive data security management system based on a block chain provided by an embodiment of the present application is shown in FIG. 4.

[0044] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0045] The embodiments will be described in detail below with reference to the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following embodiments are not meant to represent all implementations consistent with the present application. Rather, they are merely examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0046] A decentralized archive data security management method and system based on a block chain according to some embodiments provided by the present application will be described below with reference to the accompanying drawings.

[0047] Referring to Figures 1 to 5 , a decentralized archive data security management method based on a block chain provided by a first aspect embodiment of the present application includes:

[0048] Based on a Fabric consortium chain, a filing node, an access node, an approval node, and a supervision node are constructed; the filing node is used for an archive unit to upload archive data, the access node is used for a requesting unit to initiate an access request for the archive data, the approval node is used for approving the access request, and the supervision node is used for recording operation records of uploading and accessing the archive data;

[0049] When the archive data is uploaded, the filing node uses an encryption algorithm to encrypt the archive data and sends an encryption key to the supervision node, the encryption key being used for decrypting the archive data;

[0050] When the archive data is requested to be accessed, the access node sends an access request to the approval node; the approval node judges whether there is access permission;

[0051] If there is access permission, the approval node sends a decryption request to the supervision node, the decryption request is used to request the encryption key of the archive data from the supervision node; the approval node sends a download request to the archiving node, the download request is used to request the download address of the archive data from the archiving node, the download address is used to download the archive data; the approval node sends the encryption key and the download address of the archive data to the access node.

[0052] Fabric consortium chain is a kind of permissioned blockchain based on Hyperledger Fabric architecture. Hyperledger Fabric is an open source blockchain project led by Linux Foundation, which belongs to the flagship project of Hyperledger consortium and is designed for enterprise-level applications. It supports pluggable architecture, privacy protection, strong identity management and other features. Its main characteristics are: multiple trusted organizations form a blockchain network, and all participants need to be authorized and authenticated to join and interact. In the Fabric consortium chain, the core components include Peer nodes, Orderer nodes, MSP modules, channels (Channel), etc. Among them, Peer nodes are used to save account books and run chain codes (smart contracts); Orderer nodes are responsible for transaction ordering and packaging into blocks; MSP modules manage organization member identity authentication and permission verification; the channel mechanism allows different organizations to establish isolated account books for specific businesses, thereby realizing data isolation and fine-grained controllable permissions.

[0053] In the embodiment, the filing node, the access node, the approval node and the supervision node are respectively deployed as Peer nodes of different organizations to build a distributed archive data management network with multi-channel support. The filing node is the Peer node of the archive unit, i.e., the archive provider, which is responsible for segmenting and encrypting the original archive data, uploading the encrypted data to the distributed storage system, and writing the generated summary fingerprint and index item to the blockchain ledger. The access node is the Peer node of the requesting unit, such as the employing unit, which initiates an archive access request to the approval node. The approval node is the Peer node of the approval department, which determines the access permission according to the chain code logic and, after approval, links the filing node and the supervision node to process the decryption key and the download address. The supervision node is the Peer node of the supervisory agency, which saves the encryption key and records the operation records of archive uploading and access, and writes them to the dedicated channel ledger. Through this distributed deployment, each functional node runs independently in logic, realizing a distributed governance system with clear responsibilities, mutually exclusive permissions and compliant processes on the chain. The architecture advantage of multi-organization and multi-channel of Fabric consortium chain is effectively utilized to realize the on-chain trusted division of archive data uploading, authorization, access and audit behavior, and to improve the data security, permission controllability and supervision visibility of the archive management system in a multi-organization environment, which is significantly superior to traditional centralized or bilateral docking architecture solutions.

[0054] In an illustrative embodiment, as shown in Figure 2 the filing node, the access node and the approval node share a first channel; the filing node and the supervision node share a second channel; and the approval node and the supervision node share a third channel.

[0055] In the Hyperledger Fabric consortium chain architecture, a channel is a core design for supporting private communication and data isolation. Each channel is an independent ledger space, and only Peer nodes that join the channel can read and write transaction data. In the embodiment, the first channel is used to realize the transmission of access requests initiated by the access node and the issuance of data access credentials (such as encryption keys and download addresses) by the approval node; the second channel is used for the filing node to send operation records of uploading behavior to the supervision node when uploading archives, and for the supervision node to record operation records in the blockchain ledger to realize traceability of the archive filing process; and the third channel is used for the approval node to apply for encryption keys for decryption from the supervision node after approval, and for the supervision node to record operation records of archive access to realize a supervision closed loop of the access process.

[0056] In an illustrative embodiment, as shown in Figure 3 the step of uploading archive data includes:

[0057] S110: segmenting the archive data into sub-blocks based on a preset segmentation template.

[0058] In the present embodiment, the archiving node logically divides the original archive file according to a system preset segmentation template, such as basic information, education experience, work experience, and reward and punishment record. The segmentation template can be dynamically configured according to different archive types, use scenarios, or access requirements to ensure that the sub-block granularity meets the principle of minimum accessible unit. Each sub-block is assigned a unique sub-identifier (Sub-ID) for subsequent index management and permission control. For example, the archive main identifier is A123456, and the segmentation generates sub-blocks: Sub-ID 001: basic information, Sub-ID 002: education experience, Sub-ID 003: work experience, Sub-ID 004: reward and punishment record, and the like.

[0059] S120: Each archive data sub-block after segmentation is processed using a hash algorithm to generate a digest fingerprint corresponding to each archive data sub-block, which is used to verify whether the data has been tampered with.

[0060] Each sub-block after segmentation is subjected to hash processing, such as using the SHA-256 algorithm, to generate a fixed-length digest value, referred to as a digest fingerprint. The digest fingerprint is written into the blockchain ledger as a unique identifier of the sub-block content, which is used to verify whether the content has been tampered with during storage and transmission. Hash processing is performed before the original data is encrypted to ensure that data authenticity verification is independent of the ciphertext state. For example: Sub-ID 001 hash value: 0x7f3ae..., Sub-ID 002 hash value: 0x9ad5b...

[0061] S130: Each archive data sub-block is encrypted using an encryption algorithm, and the encryption key is sent to the supervisory node.

[0062] In an illustrative embodiment, the step of encrypting each archive data sub-block using an encryption algorithm includes:

[0063] Based on the confidentiality level of each archive data sub-block, the archiving node encrypts each archive data sub-block using different levels of encryption algorithms.

[0064] According to the security level of each sub-block, the archiving node uses different encryption algorithms with different strengths, such as AES (AES, Advanced Encryption Standard), ECC (Elliptic Curve Cryptography), etc., to encrypt it. The encryption process should generate independent symmetric keys or use controlled asymmetric key pairs to ensure that the ciphertext of each sub-block cannot be recovered even if it is intercepted. The encryption key is not stored with the archive, but is sent to the regulatory node through the second channel, and is saved by the regulatory node, ensuring that data and keys are stored separately. For example: Sub-ID001 uses AES-128 encryption, and the key is sent to the regulatory node; Sub-ID 002 uses ECC encryption, and the key is sent to the regulatory node for storage.

[0065] S140: Upload the encrypted archive data sub-blocks to the distributed storage system and record the storage addresses corresponding to each archive data sub-block as the download address.

[0066] All encrypted archive data sub-blocks are uploaded to distributed object storage systems such as IPFS, Storj, Filecoin, etc. through the interface. The storage system returns a unique storage address, such as CID (Content Identifier), URL (Uniform Resource Locator), etc., as the download address for the archive data sub-block. The archiving node binds these download addresses with the corresponding sub-identifiers (Sub-ID) and digest fingerprints, which are used to locate the sub-block content in subsequent access requests. Since the data has been encrypted, the download address will not cause security risks even if it is leaked.

[0067] S150: Build an archive index item and register it to the blockchain ledger; the archive index item includes at least the main identifier of the archive, the sub-identifier of each archive data sub-block, the digest fingerprint and the download address.

[0068] The archiving node generates a unified archive index item according to the data structure of each archive, including the archive main identifier (used to uniquely identify the archive), the sub-identifier (used to identify the archive data sub-block), the digest fingerprint and the download address, etc., forming a structured index object. Call the chain code method to write the archive index item to the ledger of the first channel, realizing the on-chain right protection and traceable registration of the archive data. The archive index item serves as the basis for approval and download in the access process and can be called by a smart contract.

[0069] In an illustrative embodiment, the step of determining whether the approval node has access rights includes:

[0070] The approval node receives an access request from the access node, and the access request at least includes: a requester identity, time limit information, a main identifier of a requested profile, and a sub-identifier of a profile data sub-block;

[0071] Access permission is obtained based on the main identifier of the requested profile and the sub-identifier of the profile data sub-block.

[0072] It is judged whether the access permission is met based on the requester identity and the time limit information.

[0073] If yes, it is determined that there is access permission.

[0074] In this embodiment, the access node sends an access request to the approval node, and the access request can be encapsulated as a chain code call parameter or a chain off-line HTTP / SDK call interface, and at least includes: a requester identity, such as an organization identifier of an access initiating unit, a public key signature, a logged account, and the like; time limit information, such as an access start and end time window: 2025-07-01 00:00 to 2025-07-01 23:59; a main identifier of a requested profile, used to determine a profile to be accessed; and a sub-identifier, used to determine a profile data sub-block to be accessed, such as basic information, education experience, work record, and the like.

[0075] The approval node queries a permission rule set related to the main identifier of the requested profile and the sub-identifier of the profile data sub-block, obtains access permission, such as an authorized organization / role set. It is checked whether the requester identity is included in the authorized organization / role set, for example, an HR account can access the basic information, education experience, work record, and the like. An ordinary employee account can only access the basic information sub-block. At the same time, the time limit information in the access request is compared with an effective time period in the permission rule set, and if it is out of the time range, it is considered to have no permission.

[0076] If all conditions in the access permission are met, the approval node updates the access request state to authorized, and can trigger subsequent key extraction, address issuance, and the like. If any condition is not met, the approval node returns an access rejection state, and sends an access operation record to a supervision node.

[0077] If there is access permission, i.e. the approval node confirms that the identity of the requester, time limit information, etc. meet the permission rules, the approval node will enter the authorized execution phase to call the encryption key and download address, and return to the access node. The approval node sends a decryption request through the third channel, and the decryption request content includes the archive main identifier, sub-identifier, approval voucher, etc. The supervision node extracts the corresponding encryption key from the key record it saves after verifying the legality of the decryption request, and returns it to the approval node, while recording this access operation record to the blockchain ledger of the third channel. The approval node sends a download request to the archiving node through the first channel, and the archiving node extracts the download address of the corresponding encrypted sub-block from the on-chain archive index item after confirming the legality of the download request, and sends it to the approval node. The approval node encapsulates the received encryption key and download address into an access credential and forwards it to the access node through the first channel. The access node downloads the encrypted archive data accordingly and uses the encryption key to complete the decryption operation.

[0078] The embodiment realizes the decoupling of the functions of approval authorization, data address acquisition and key management, prevents any single node from independently completing authorization and data control operations, and improves the security and trust level of the overall system. By having the supervision node independently host the key, the archiving node centrally maintain the index, and the approval node only act as a coordinating intermediary, the compliance and controllability of the permission path are further strengthened. All requests, responses and key calling behaviors are registered in the blockchain ledger, making the entire access chain have pre-controllable, in-process verifiable and post-searchable full-process credibility, meeting the authorized access requirements of archive data under high security requirements.

[0079] In an illustrative embodiment, when the archive data is uploaded, the supervision node records the operation record of the uploading of the archive data to the blockchain ledger of the second channel.

[0080] In the present embodiment, after the archiving node completes the chunk encryption and distributed storage upload of the archive data, it sends the encryption key to the supervision node. The supervision node, as an independent Peer node deployed in the second channel, immediately writes the operation record of this upload behavior into the blockchain ledger of the second channel in the form of on-chain transaction after receiving the encryption key information. The upload operation record at least includes the archive main identifier, sub-identifier, upload agency identifier, upload timestamp, encryption algorithm type, key number and digest fingerprint, etc. The supervision node does not process plaintext archives, only records behavior metadata, and verifies and records through chain code contract, realizing the non-tamperability and traceability of the data upload process.

[0081] By recording the file uploading operation record to the second channel ledger by the supervision node, the file building behavior can be ensured to have non-repudiation and timestamp authority. Compared with the traditional system which relies on logs for post-recording, this mechanism realizes uploading and notarization at the same time, ensuring the complete record chain of the file life cycle. At the same time, the supervision node can query the file uploading details at any time through the blockchain ledger, improving the transparency and real-time of supervision and audit, and facilitating the superior authorities and industry organizations to complete compliance review without touching the original data. In addition, this record also constitutes the basis for subsequent file access authorization and key request, providing support for forming a complete traceability chain in the permission approval process.

[0082] In an illustrative embodiment, when requesting to access the file data, the supervision node records the operation record of the access of the file data to the blockchain ledger of the third channel.

[0083] In this embodiment, the access node initiates a file data access request to the approval node, the approval node submits a decryption request to the supervision node after completing the permission verification and authorization, and the supervision node immediately writes the operation record of the access behavior into the blockchain ledger of the third channel in the form of on-chain transaction after receiving the decryption request. The access operation record at least includes the file main identifier, the sub-identifier, the access organization ID, the access role, the approval unit identifier, the access time, the authorized time window, the operation type, the request purpose description and the like.

[0084] By recording the access operation record in the third channel by the supervision node, a trusted audit chain of file access behavior can be established without touching the original data. All access processes are automatically chained to prevent access logs from being deleted or modified, greatly improving the compliance and responsibility traceability of the system. At the same time, this mechanism has the ability to identify security risks such as unauthorized access and frequent abnormal calls in real time, providing on-chain behavior analysis basis for regulatory agencies. Since the supervision node only receives operation record information, it meets the compliance regulatory requirements of the minimum available disclosure, and also protects the privacy of the file content, especially suitable for high-sensitivity information environments such as personnel files and government data. This mechanism also forms a closed-loop tracking system with the uploading behavior record, providing strong technical support for transparent supervision and responsibility division of the entire life cycle of the file.

[0085] As shown in Figure 4 The second aspect embodiment of the present application provides a decentralized file data security management system based on a blockchain, which comprises:

[0086] The construction module is configured to construct a filing node, an access node, an approval node and a supervision node based on a Fabric alliance chain; the filing node is configured to upload archive data by an archive unit, the access node is configured to initiate an access request for the archive data by a requesting unit, the approval node is configured to approve the access request, and the supervision node is configured to record operation records of uploading and accessing the archive data;

[0087] The uploading module is configured to, when the archive data is uploaded, encrypt the archive data by the filing node using an encryption algorithm, and send an encryption key to the supervision node, the encryption key being used to decrypt the archive data.

[0088] The requesting module is configured to, when the archive data is accessed, send an access request to the approval node by the access node; and the approval node is configured to determine whether there is an access right.

[0089] If there is the access right, the approval node is configured to send a decryption request to the supervision node, the decryption request being used to request the encryption key of the archive data from the supervision node; send a download request to the filing node, the download request being used to request a download address of the archive data from the filing node, the download address being used to download the archive data; and send the encryption key and the download address of the archive data to the access node.

[0090] As shown in Figure 5 The third aspect of the present application provides an electronic device, which comprises:

[0091] The memory is configured to store a computer program and transmit the program code to the processor. In other words, the processor can call and run the computer program from the memory to implement the method in the embodiments of the present application.

[0092] For example, the processor can be configured to execute the above-mentioned method embodiments according to the instructions in the computer program.

[0093] In some embodiments of the present application, the processor can include but is not limited to:

[0094] A general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0095] In some embodiments of the present application, the memory includes, but is not limited to:

[0096] volatile memory and / or non-volatile memory. The non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM can be used, such as a Static RAM (SRAM), a Dynamic RAM (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synch link DRAM (SLDRAM), and a Direct Rambus RAM (DR RAM).

[0097] In some embodiments of the present application, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the method provided by the present application. The one or more modules can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the controller.

[0098] The electronic device can further include:

[0099] The transceiver can be connected to the processor or the memory.

[0100] The processor can control the transceiver to communicate with other devices, specifically, can send data or data to other devices, or receive data or data sent by other devices. The transceiver can include a transmitter and a receiver. The transceiver can further include an antenna, and the number of antennas can be one or more.

[0101] It should be understood that the various components within the electronic device are connected by a bus system, which includes, in addition to a data bus, a power bus, a control bus, and a state signal bus.

[0102] The fourth aspect of the present application further provides a computer storage medium, which stores a computer program. The computer program is executed by a computer, so that the computer can execute the method of the method embodiment described above. Alternatively, one embodiment of the present application further provides a computer program product containing instructions. The instructions are executed by a computer, so that the computer executes the method of the method embodiment described above.

[0103] When implemented by using software, the computer program product can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the flow or function according to the embodiments of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available medium can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), an optical medium (for example, digital video disc (DVD)), or a semiconductor medium (for example, solid state disk (SSD)) and the like.

[0104] Those skilled in the art can realize that the modules and algorithm steps of the examples described in conjunction with the embodiments applied herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0105] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiment is merely illustrative. For example, the division of the modules is merely logical function division, and there can be another division manner in actual implementation. For example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different modules can be indirect couplings or communication connections through some interfaces, devices or modules, and can be in electrical, mechanical or other forms.

[0106] It should be noted that the terms "first", "second", "third", "fourth", etc. (if any) in the description, claims, and drawings of the present application are used to distinguish between similar objects, and do not necessarily have to describe a particular sequential or chronological order. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in other than the order illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, processes, methods, systems, products, or devices that include a series of steps or units do not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0107] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "exemplary embodiment", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the skilled person in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0108] Although the embodiments of the present application have been shown and described above, it should be understood that the above-described embodiments are exemplary and should not be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A blockchain-based decentralized archive data security management method, characterized in that, The application relates to a file management system based on a Fabric alliance chain. The system comprises a file building node, an access node, an approval node and a supervision node. The file building node is used for uploading file data by a file unit, the access node is used for initiating an access request for the file data by a request unit, the approval node is used for approving the access request, and the supervision node is used for recording operation records of uploading and accessing the file data. The file building node, the access node and the approval node share a first channel. The file building node and the supervision node share a second channel. The approval node and the supervision node share a third channel. When the file data is uploaded, the file building node encrypts the file data by using an encryption algorithm, sends an encryption key to the supervision node, and uses the encryption key to decrypt the file data; meanwhile, the supervision node records operation records of uploading the file data to a block chain ledger of the second channel. When the file data is accessed, the access node sends an access request to the approval node. The approval node judges whether there is an access permission; meanwhile, the supervision node records operation records of accessing the file data to a block chain ledger of the third channel. If there is an access permission, the approval node sends a decryption request to the supervision node, and the decryption request is used for requesting the encryption key of the file data from the supervision node. The approval node sends a download request to the file building node, and the download request is used for requesting a download address of the file data from the file building node, and the download address is used for downloading the file data. The approval node sends the encryption key and the download address of the file data to the access node. 2.The blockchain-based decentralized archive data security management method of claim 1, wherein, The step of uploading the file data comprises the following steps. The file data is divided into sub-blocks based on a preset segmentation template. Hash algorithm is used to process each file data sub-block after segmentation, and a digest fingerprint corresponding to each file data sub-block is generated, which is used to verify whether the data is tampered with. Each file data sub-block is encrypted by using an encryption algorithm, and an encryption key is sent to the supervision node. The encrypted file data sub-blocks are uploaded to a distributed storage system, and a storage address corresponding to each file data sub-block is recorded as a download address. An archive index item is constructed and registered to a block chain ledger; the archive index item at least comprises a main identifier of an archive, a sub-identifier of each file data sub-block, a digest fingerprint and a download address. 3.The blockchain-based decentralized archive data security management method of claim 2, wherein, The step of encrypting each file data sub-block by using an encryption algorithm comprises the following steps. Based on the security level of each file data sub-block, the file building node encrypts each file data sub-block by using different levels of encryption algorithms. 4.The blockchain-based decentralized archive data security management method of claim 2, wherein, The step of judging whether there is an access permission by the approval node comprises the following steps. The approval node receives an access request from the access node, and the access request at least comprises a requester identity, time limit information, a main identifier of a requested archive and a sub-identifier of a file data sub-block. An access permission is obtained based on the main identifier of the requested archive and the sub-identifier of the file data sub-block. Whether the access permission is met is judged based on the requester identity and the time limit information. If yes, it is determined that there is access permission. 5.A blockchain-based decentralized archival data security management system, characterized in that, The method comprises the following steps: The construction module is configured to construct a filing node, an access node, an approval node and a supervision node based on a Fabric alliance chain; The filing node is configured to upload archive data by an archive unit, the access node is configured to request a unit to initiate an access request for the archive data, the approval node is configured to approve the access request, and the supervision node is configured to record operation records of uploading and accessing the archive data; The filing node, the access node and the approval node share a first channel; The filing node and the supervision node share a second channel; The approval node and the supervision node share a third channel; The uploading module is configured to, when uploading the archive data, encrypt the archive data by the filing node using an encryption algorithm, and send an encryption key to the supervision node, the encryption key being used to decrypt the archive data; meanwhile, the supervision node records operation records of uploading the archive data to a blockchain ledger of the second channel; The request module is configured to, when requesting to access the archive data, send an access request to the approval node by the access node; The approval node determines whether there is access permission; meanwhile, the supervision node records operation records of accessing the archive data to a blockchain ledger of the third channel; If there is access permission, the approval node sends a decryption request to the supervision node, the decryption request being used to request the encryption key of the archive data from the supervision node; The approval node sends a download request to the filing node, the download request being used to request a download address of the archive data from the filing node, the download address being used to download the archive data; The approval node sends the encryption key and the download address of the archive data to the access node.

6. An electronic device, comprising: The method comprises the following steps: The processor and the memory are configured to store a computer program, and the processor is configured to call and run the computer program stored in the memory to execute the method of any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer program is configured to enable a computer to execute the method of any one of claims 1-4.

Images