Distributed data storage and access control method based on block chain

Abstract

The invention discloses a distributed data storage and access control method based on a block chain, and relates to the technical field of data security. The method comprises the following steps: fragmenting user data, encrypting the fragmented user data by using an encryption algorithm, and storing the encrypted user data in a plurality of distributed nodes; taking the hash value and the storage position of the data fragment as metadata to be recorded in a block chain, and performing integrity verification through a smart contract; when a user accesses, user attributes are verified based on an attribute-based encryption technology, and an access control strategy is dynamically executed through an intelligent contract; and an erasure code technology is adopted to carry out redundancy storage so as to realize data recovery and fault tolerance. The method effectively solves the problems of single-point failure, privacy disclosure and inflexible access control in traditional centralized storage, has the beneficial effects of improving data security, guaranteeing integrity, realizing fine-grained dynamic access control and enhancing system reliability, and is suitable for data security management in cloud computing, Internet of Things and big data environments.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a distributed data storage and access control method based on blockchain. BACKGROUND

[0002] With the rapid development of cloud computing and big data technology, the demand for data storage and sharing is growing. However, the traditional centralized data storage method has inherent defects such as single point of failure risk, insufficient data privacy protection, and inflexible access control mechanism. Blockchain technology provides a new way to solve the above problems due to its characteristics of decentralization, non-tamperability and traceability. However, the existing blockchain technology solutions still need to be improved in terms of data storage efficiency, dynamic and fine-grained access control.

[0003] Therefore, there is an urgent need for a secure, efficient and flexible data management solution that combines distributed storage and advanced cryptography. SUMMARY

[0004] (I) Technical problems solved

[0005] In view of the deficiencies of the prior art, the present application provides a distributed data storage and access control method based on blockchain, which solves the problem of low efficiency of existing data storage and access.

[0006] (II) Technical solutions

[0007] To achieve the above purpose, the present application is realized by the following technical solutions:

[0008] A distributed data storage and access control method based on blockchain, comprising the following steps:

[0009] Step S1: Sharding user data into multiple data shards, and encrypting the data shards using an encryption algorithm, then storing the encrypted data shards in multiple distributed nodes, completing data sharding and encryption;

[0010] Step S2: Calculate the hash value of each data shard, and record the hash value and its storage location information as metadata on the blockchain, and automatically verify the integrity and traceability of the data through the smart contract on the blockchain;

[0011] Step S3: When a user initiates a data access request, verify the user attributes based on attribute-based encryption technology, and dynamically execute the access control strategy through the smart contract to decide whether to grant access rights;

[0012] Step S4: using erasure code technology to store the data fragments in a redundant manner, so that when part of the distributed nodes fail, the complete user data can be recovered using the remaining data fragments.

[0013] Preferably, in step S1, the data fragments are encrypted using a symmetric encryption algorithm, which is the AES algorithm.

[0014] Preferably, in step S2, the smart contract is used to automatically perform data integrity auditing to verify whether the data fragments stored in the distributed nodes are consistent with the hash values recorded on the blockchain.

[0015] Preferably, in step S3, the smart contract is used to receive update instructions for access policies and dynamically adjust the authorization logic for user access requests.

[0016] Preferably, the attribute-based encryption technology uses a ciphertext policy attribute-based encryption or a key policy attribute-based encryption scheme.

[0017] Preferably, in step S4, the erasure code technology uses Reed-Solomon encoding or its variants.

[0018] Preferably, the specific process of automatically verifying the integrity of data by the smart contract includes: the smart contract receives a verification request for a target data fragment; the smart contract initiates a challenge instruction to the distributed node storing the target data fragment; the distributed node calculates the current hash value of the target data fragment stored by it according to the challenge instruction and returns it to the smart contract; the smart contract compares the received current hash value with the original hash value of the data fragment recorded on the blockchain, and if they are consistent, the verification is passed; if they are not consistent, the verification fails, and the result is recorded on the blockchain.

[0019] Preferably, dynamically updating and executing access policies by the smart contract includes: the permission administrator sends an access policy update instruction to the smart contract, which contains new access control policy rules; the smart contract verifies the identity and operation permission of the permission administrator; if the verification is passed, the smart contract updates the access policy state stored in it using the new access control policy rules; when a subsequent user initiates a data access request, the smart contract will verify the user attributes based on the updated access policy state and execute the authorization logic

[0020] (Three) beneficial effects

[0021] The present application provides a distributed data storage and access control method based on blockchain. It has the following beneficial effects:

[0022] First, by sharding and distributing data across different nodes, the risk of obtaining complete data through a compromised single node is reduced. Each data shard is encrypted using a high-strength encryption algorithm, making it difficult to decrypt and recover even if a shard is illegally obtained, thus improving data security. Adopting a distributed storage model, data is no longer centrally stored on a single server, which helps reduce the possibility of data leaks or service interruptions due to attacks, downtime, or mismanagement of the central server, enhancing system robustness.

[0023] Second, the hash value of each data shard is stored on the blockchain, establishing a trusted digital fingerprint for data evidence. Through automated verification processes via smart contracts, data users or auditors can remotely verify the integrity and tamper-proofing of data without accessing the original data, making the audit process more transparent. Data storage and verification events are recorded on the blockchain, forming an audit log, which helps to pinpoint the time and stage of events when data problems are discovered, providing technical support for secure traceability.

[0024] Third, employing attribute-based encryption technology, the access control policy is based on user attributes, enabling fine-grained access permission division and adapting to the complex permission management needs of modern enterprises or organizations. The access control logic is managed by smart contracts; permission administrators can update policy rules through authorization transactions. New policies take effect on subsequent access requests without requiring key redistribution, improving the flexibility of access control.

[0025] Fourth, by introducing data redundancy through erasure coding technology, within the preset fault tolerance threshold, node failure or data loss will not lead to data unavailability. The system can use the remaining shards to reconstruct the data, which helps to ensure business continuity and improve the service availability of the system.

[0026] Fifth, smart contracts automate processes such as data verification and access authorization, reducing inefficiencies and errors that may result from manual intervention. The entire system operates based on preset rules, lowering the trust costs of multi-party collaboration. The existence proof of data and access authorization are maintained by the blockchain network, reducing reliance on traditional certificate authorities or centralized identity providers and helping to mitigate the risk of relying on a single trusted institution. Attached Figure Description

[0027] Figure 1 This is the overall system architecture and flowchart of the present invention;

[0028] Figure 2 This is a flowchart illustrating the data fragmentation and encryption process of the present invention.

[0029] Figure 3 This is a schematic diagram illustrating the implementation of dynamic access control in this invention;

[0030] Figure 4This is a flowchart illustrating the smart contract data integrity verification process of this invention.

[0031] Figure 5 This is a flowchart illustrating the smart contract dynamic update access decision process of this invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Please see Figures 1-5 The present invention provides a technical solution:

[0034] A blockchain-based distributed data storage and access control method includes the following steps: First, step S1 is executed: a user uploads a data file. The system divides the file into K data blocks. Subsequently, the system encrypts each data block using the AES-256 encryption algorithm and a generated random key, generating K encrypted data fragments. Finally, these encrypted fragments are distributed and stored on multiple (e.g., N, N>K) distributed storage nodes in the network.

[0035] Next, step S2 is executed: the system calculates the SHA-256 hash value of each encrypted data fragment. These hash values, along with the corresponding fragment's storage node address information, are uploaded to the blockchain network as transaction data, where they are recorded and stored by a smart contract. At this point, the data's metadata is permanently and immutably stored.

[0036] When it is necessary to verify the integrity of a data shard (e.g., shard X), the verification process is as follows:

[0037] The validator initiates a verification request for shard X to the smart contract. The smart contract challenges the node storing shard X. The node reads the current data of shard X, calculates its hash value H_current, and sends it back to the smart contract. The smart contract retrieves the original hash value H_original of shard X recorded on the chain. The smart contract compares H_current and H_original. If they match, it records "verification successful"; if they do not match, it records "verification failed" and may trigger an alert or data recovery process.

[0038] Then, step S3 is executed: User A attempts to access the aforementioned data file. Their client sends a request to the access control smart contract, submitting their attribute certificate. The smart contract's preset access policy is "Position: Manager AND Department: Finance Department". The smart contract automatically verifies that User A's attributes meet the policy and generates an authorization token, returning it to User A. User A can use this token to download encrypted data fragments from the distributed nodes and decrypt them using their private key to reconstruct the original file.

[0039] When the access policy needs to be changed, the adjustment process is as follows: An account with administrator privileges sends a transaction to the smart contract, calling the policy update function in the contract. The new policy rule is "Position: Director OR (Position: Manager AND Department: Finance)". The smart contract verifies that the transaction indeed originates from the administrator's address. After successful verification, the smart contract updates the policy rule in its state variables to the new rule. Subsequently, when user B (Position: Director) initiates an access request, the smart contract verifies based on the new policy. Since the user's attributes meet the "Position: Director" condition, authorization is granted.

[0040] Finally, step S4 is executed: During the storage phase, the system uses Reed-Solomon erasure coding technology to encode the K data fragments into M redundant fragments, for a total of K+M fragments, which are distributed and stored across the nodes. Assume the original K=4, M=2, and there are a total of 6 fragments. If any two of the 6 nodes fail, resulting in data loss, the system can use the remaining 4 valid fragments to completely recover the original 4 data fragments, thus ensuring data availability.

[0041] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0042] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A blockchain-based distributed data storage and access control method, characterized in that, The method comprises the following steps: Step S1: Sharding user data into multiple data shards and encrypting the data shards using an encryption algorithm, and then storing the encrypted data shards in multiple distributed nodes, completing data sharding and encryption; Step S2: Calculating the hash value of each data shard and recording the hash value and its storage location information as metadata on a blockchain, and automatically verifying the integrity and traceability of the data through a smart contract on the blockchain; Step S3: When a user initiates a data access request, verifying the user attributes based on attribute-based encryption technology, and dynamically executing access control policies through the smart contract to determine whether to grant access rights; : Step S4: Using erasure coding technology to redundantly encode and store the data shards, so that in the event of failure of part of the distributed nodes, the complete user data can be recovered using the remaining data shards. 2.The method of claim 1, wherein, In step S1, the data shards are encrypted using a symmetric encryption algorithm, which is the AES algorithm. 3.The method of claim 1, wherein, In step S2, the smart contract is used to automatically perform data integrity auditing to verify whether the data shards stored in the distributed nodes are consistent with their recorded hash values on the blockchain. 4.The method of claim 1, wherein, In step S3, the smart contract is used to receive update instructions for access policies and dynamically adjust the authorization logic for user access requests. 5.The method of claim 1, wherein, The attribute-based encryption technology uses a ciphertext policy attribute-based encryption or a key policy attribute-based encryption scheme. 6.The method of claim 1, wherein, In step S4, the erasure coding technology uses Reed-Solomon encoding or its variants. 7.The method of claim 3, wherein, The specific process of automatically verifying the integrity of the data through the smart contract includes: the smart contract receives a verification request for a target data shard; the smart contract initiates a challenge instruction to the distributed node storing the target data shard; the distributed node calculates the current hash value of the target data shard stored therein according to the challenge instruction and returns it to the smart contract; the smart contract compares the received current hash value with the original hash value of the data shard recorded on the blockchain, and if they are consistent, the verification is passed; if they are not consistent, the verification fails, and the result is recorded on the blockchain. 8.The method of claim 4, wherein, Dynamically updating and executing access policies through a smart contract includes: a permission administrator sends an access policy update instruction to the smart contract, which contains new access control policy rules; the smart contract verifies the identity and operation permission of the permission administrator; if the verification is passed, the smart contract updates the access policy state stored in it using the new access control policy rules; when a subsequent user initiates a data access request, the smart contract will verify the user attributes based on the updated access policy state and execute the authorization logic.

Images