Multi-modal data link up-link and down-link collaborative storage method based on classification encryption

Abstract

The invention provides a multi-modal data link up-link and down-link collaborative storage method based on classified encryption, relates to the technical field of block chains and data storage, and has the core idea that a differentiated encryption (or hash) processing flow is automatically selected and executed according to the data type (mode) of to-be-stored data; according to the method, a block chain is established, processed data is stored in an optimal storage layer (on the chain or under the chain), and finally a verifiable, traceable, efficient and economical three-in-one storage system is constructed by recording key associated information on the block chain. According to the method, the storage pressure of the block chain body is remarkably relieved, meanwhile, 'tailoring 'type security protection is provided for different types of data, and verifiability, traceability and strong relevance of the whole distributed storage system are ensured.

Description

Technical Field

[0001] This invention relates to the field of blockchain and data storage technology, specifically to a multimodal on-chain and off-chain collaborative storage method for data based on classification encryption. Background Technology

[0002] Blockchain technology, due to its decentralized and immutable characteristics, is widely used in fields such as evidence storage and traceability. However, its data storage bottleneck is becoming increasingly prominent, with the "full-node redundant storage" model of blockchain making storage capacity a key bottleneck. Each node in the blockchain network needs to store the complete ledger history, causing the storage burden to increase dramatically with data growth, severely restricting scalability. Traditional expansion solutions, such as simply increasing block size or using off-chain state channels, often compromise on security, data availability, or universality. Existing technologies include some on-chain and off-chain combined storage solutions. For example, large files are stored on an off-chain system (such as IPFS), with only the file hash stored on-chain to ensure its immutability. However, these solutions typically adopt a "one-size-fits-all" approach, applying the same hash algorithm and storage strategy to all types of data, failing to fully consider the characteristics of the data itself and the differences in security requirements. For example, user passwords require crack-resistant hash algorithms, multimedia files require copyright identification and efficient storage, while critical text needs to be directly stored on-chain to ensure the highest level of traceability.

[0003] Existing capacity expansion solutions mainly suffer from two types of problems: Homogeneous solutions: Most on-chain and off-chain solutions use a single processing logic, such as hashing all large files and storing them in IPFS, while only storing the CID on-chain. This approach ignores the inherent security and business attribute differences of the data. For example, using the same storage strategy for user passwords, medical images, and contract texts is neither secure nor efficient.

[0004] Weak correlation: Existing solutions typically only establish simple hash pointing relationships between different storage layers (such as storing file hashes on the chain), lacking strong correlation verification mechanisms for data integrity, processing procedures, and cross-system consistency, thus forming storage silos. Summary of the Invention

[0005] To address the aforementioned technical issues, this invention provides a multimodal on-chain and off-chain collaborative storage method based on classification encryption. This method intelligently distinguishes data types and matches them with the optimal encryption algorithm and storage location for collaborative storage. This enables a novel solution for close association and unified verification across heterogeneous storage systems, achieving capacity expansion while meeting differentiated security and efficiency requirements.

[0006] To achieve the above technical objectives, the adopted technical solution is: a multimodal data chain on-chain and off-chain collaborative storage method based on classification encryption, comprising the following steps: S1. Identify and receive the raw data to be stored, classify it according to the type of raw data, and route it to the corresponding storage process. Data types include password data, image / video multimedia data, and text data. S2. For cryptographic data, use a cryptographic hash function resistant to side-channel attacks for encryption to generate ciphertext; for multimedia data such as images / videos, first add a digital watermark, then use a symmetric encryption algorithm for encryption to generate ciphertext and an authentication tag for integrity verification; for text data, proceed directly to the storage step. S3. Simultaneously store the ciphertext of cryptographic data in an off-chain relational database and on a consortium blockchain; store the ciphertext of multimedia data in a decentralized distributed file system, obtain a unique content identifier (CID), and store the CID and the authentication tag generated during the encryption process in the blockchain; store text data directly in the blockchain. S4. Create a record on the blockchain for each piece of original data. This record shall contain at least the unique identifier of the data, the type identifier, and its corresponding storage guidance information. The storage guidance information includes: for cryptographic data, an off-chain database index; for multimedia data, an IPFS Content Identifier (CID) and an authentication tag; for text data, its hash value. S5. When data needs to be obtained, first query the corresponding record from the blockchain, and obtain the ciphertext or plaintext from the corresponding storage layer according to the type identifier and storage guidance information. Then, use the authentication tag or hash value in the storage guidance to verify consistency and integrity.

[0007] The password hash function is the Argon2id variant password hash algorithm.

[0008] For multimedia data such as images and videos, digital watermarks are added using the DCT field.

[0009] The symmetric encryption algorithm described is AES-256-GCM encryption.

[0010] The beneficial effects of this invention are: 1. Storage Expansion: Through intelligent diversion, large-capacity multimedia data and high-frequency password verification data are transferred to specialized off-chain system storage, realizing substantial expansion of blockchain storage and greatly reducing the storage pressure on the blockchain itself.

[0011] 2. Enhanced Security: Abandoning a single encryption method, it automatically identifies three types of data—passwords, multimedia, and text—and routes them to independent heterogeneous processing channels, achieving "classified governance." For the different security needs of passwords, multimedia, and text, it matches the strongest or most suitable encryption and hashing algorithms in the industry. It provides anti-cracking hashes for password data; for multimedia data, it integrates digital watermarks and encryption, and achieves dual verification through authentication tags and IPFS CIDs, effectively protecting digital asset copyrights and ensuring data integrity. It first embeds a digital watermark (copyright protection), then encrypts it with AES-256-GCM (confidentiality + tag generation), and after IPFS storage, it associates the "CID + Tag" on the blockchain, forming a strong sequential closed loop; it provides direct evidence storage for core text, achieving precise allocation of security resources.

[0012] 3. Traceability and Linkage: All data "fingerprints" or "pointers" are anchored to the blockchain, forming a complete data lifecycle chain with the blockchain as the root of trust and cross-system collaboration, ensuring global traceability and auditability. The blockchain stores a standardized "data passport" (including type identifiers and heterogeneous storage guidelines). Retrieval requires first checking the blockchain, then obtaining the data according to the guidelines and completing unified verification, resulting in higher trust levels. This solution is particularly suitable for complex scenarios that need to simultaneously process sensitive credentials, copyrighted media assets, and important documents, such as digital rights management platforms, medical image archive systems, or cross-institutional audit and evidence storage platforms.

[0013] 4. Trust Boundary Expansion: Through the "three-in-one" model, the immutability of the blockchain is reliably transferred to external storage systems such as MySQL and IPFS, forming a verifiable and broader trust network. Attached Figure Description

[0014] Figure 1 This is a system architecture diagram of the present invention; Figure 2 A flowchart illustrating the process of categorized encryption and collaborative storage; Figure 3 A flowchart for the "watermark embedding-encryption-dual code anchoring" process of multimedia data. Detailed Implementation

[0015] The preferred embodiments of the invention are given below with reference to the accompanying drawings to illustrate the technical solution of the invention in detail. The corresponding drawings will be provided for detailed explanation of the invention. It should be particularly noted that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit or restrict the invention.

[0016] This invention provides an innovative method for intelligent data routing, differentiated processing, and collaborative storage based on data "genes" (types), using a multimodal on-chain and off-chain collaborative storage system based on categorized encryption. Its core idea is to automatically select and execute differentiated encryption (or hashing) processes based on the data type (modality) of the data to be stored, and store the processed data in the most suitable storage layer (on-chain or off-chain). Finally, by recording key correlation information on the blockchain, a verifiable, traceable, and highly efficient "three-in-one" storage system is constructed. The core objective of this invention is to significantly reduce the storage pressure on the blockchain itself while providing tailored security protection for different types of data, and ensuring the verifiability, traceability, and strong correlation of the entire distributed storage system.

[0017] A multimodal data chain on-chain and off-chain collaborative storage method based on classification encryption is proposed. Its main steps are as follows.

[0018] S1. Data Classification and Routing Steps: Identify and receive the raw data to be stored, and route it to the corresponding processing flow according to its data type. The data types include at least: password data, image / video multimedia data, and text data.

[0019] S2. Differentiated Encryption Processing Steps: For cryptographic data, a side-channel resistant cryptographic hash function (such as Argon2) is used for encryption to generate ciphertext. For multimedia data such as images / videos, a digital watermark is first added, followed by encryption using a symmetric encryption algorithm (such as AES-256-GCM) to generate ciphertext and an authentication tag for integrity verification. For text data, it can proceed directly to the storage step.

[0020] S3. Collaborative Storage Steps: Storing encrypted cryptographic data simultaneously in an off-chain relational database (e.g., MySQL) and a consortium blockchain (e.g., Fabric). Storing encrypted multimedia data in a decentralized distributed file system (e.g., IPFS) to obtain a unique Content Identifier (CID). Storing the CID and the authentication tag generated during the encryption process into the blockchain. Storing textual data directly into the blockchain.

[0021] S4. Linking to the blockchain: On the blockchain, create a record for each piece of original data. This record must contain at least the data's unique identifier, type identifier, and corresponding storage guidance information. The storage guidance information includes: for cryptographic data, an off-chain database index; for multimedia data, an IPFS Content Identifier (CID) and an authentication tag; and for text data, its hash value.

[0022] S5. Data retrieval and verification steps: When data needs to be obtained, first query the corresponding record from the blockchain, and obtain the ciphertext or plaintext from the corresponding storage layer according to the type identifier and storage guide. Then, use the association code (such as authentication tag, hash value) in the storage guide to verify consistency and integrity.

[0023] 1. System Architecture The overall architecture of this invention is as follows Figure 1 The system comprises several components: a client for submitting raw data and initiating search requests; a routing decision engine implementing the core module of innovation point one, with built-in type recognition algorithms and routing rules; a differentiated processing cluster including a cryptography module (integrating the Argon2 algorithm), a multimedia processing module (integrating a digital watermarking submodule and an AES-256-GCM encryption submodule), and a text processing module; a heterogeneous storage layer including a MySQL database and an IPFS distributed file network; and a blockchain network (such as the Fabric consortium blockchain) serving as a global index and trust anchor. A global verification interface provides a unified search entry point, implementing the verification logic of innovation point three.

[0024] The classification encryption and collaborative storage workflow of this invention is as follows: Figure 2 The multimedia data "watermark embedding-encryption-dual code anchoring" processing flow of this invention is as follows: Figure 3 .

[0025] 2. Core Algorithm (1) Argon2 algorithm parameter configuration and security considerations For cryptographic data, the Argon2id variant, derived from the winning Argon2 algorithm of the Cryptographic Hash Contest (PHC), is used for cryptographic hashing. This variant possesses resistance to side-channel attacks and GPU cracking capabilities. The specific parameters are configured as follows after security considerations: The number of iterations is set to 3; the memory overhead is set to 64 MiB, which is a core parameter for resisting attacks from dedicated hardware (ASIC / FPGA), making large-scale parallel cracking economically infeasible; the parallelism is set to 4 to fully utilize the parallel capabilities of modern consumer-grade CPUs; the hash length output is fixed at 32 bytes (256 bits); a cryptographic random salt value of at least 16 bytes is generated for each password and stored together with the hash result to completely resist rainbow table attacks.

[0026] (2) Specific algorithm for digital watermark embedding (DCT domain embedding) For multimedia data, a robust watermark is embedded in the Discrete Cosine Transform (DCT) domain. Taking an RGB image as an example, the steps are as follows: A. Preprocessing: Convert copyright information (such as "XX patent") into a binary bit stream and use BCH encoding for error correction to generate the sequence W to be embedded.

[0027] B. Blocking and Transformation: Convert the image to the YCbCr color space, extract its luminance component (Y), and divide it into 8×8 pixel blocks. Perform a two-dimensional DCT transformation on each block.

[0028] C. Coefficient Selection and Embedding: Select the mid-frequency coefficients in each DCT block (e.g., near coordinates (4,5) and (5,4)) as the embedding positions. The embedding rule adopts the additive rule: C'_i = C_i + α * wi, where C_i is the original mid-frequency coefficient, α is the intensity factor (0.01-0.05) adapted according to the human visual system model, and wi is the watermark position.

[0029] D. Inverse Transformation and Synthesis: Perform inverse DCT transformation on the embedded DCT block to obtain the watermarked Y component, then merge it with the Cb and Cr components and convert it back to RGB space to obtain the final watermarked image.

[0030] (3) AES-256-GCM encryption and hierarchical key management scheme Multimedia data with embedded watermarks is encrypted using AES-256-GCM. This mode provides both confidentiality and integrity (generating a 128-bit authentication tag). To ensure key security, this invention employs a layered scheme combining smart contract-based key metadata management with secure hardware isolation.

[0031] ①Key generation and storage A unique AES-256 key K_data is generated for each user or session by the client or a trusted key management service (KMS). K_data itself is not stored directly on the blockchain or application server. In cloud deployments, K_data should be protected by a hardware security module (HSM) and persisted only in cryptographic form E(K_wrap, K_data), where K_wrap is the master wrapper key within the HSM.

[0032] ② Key association on-chain Store a key descriptor structure on the blockchain: { key_id:“UUID-1234”, owner:“0xUserA”, data_cid:“QmXYZ...”, kms_location:“KMS-A-HSM”, wrapped_key_hash:“0xhash...”}. This descriptor is associated with the blockchain “passport” of the corresponding data via data_cid or key_id.

[0033] ③Key usage and access control When an authorized user decrypts, they must first obtain the data "passport" and "key descriptor" from the blockchain. Then, they submit an access request to the designated KMS / HSM. After verifying permissions, the KMS uses K_wrap within its security boundary to decrypt K_data and complete the decryption operation. The key materials never leave the security boundary of the HSM.

[0034] 3. Examples (1) Data submission and intelligent routing The user submits a piece of data (such as a video file "demo.mp4"). The routing decision engine identifies its MIME type or file header, classifies it as "multimedia data", and routes it to the multimedia processing channel.

[0035] (2) Differentiated processing and storage Scenario A (Password "123456"): Recognized as "password", routed to the password channel. A hash value is generated using the Argon2id algorithm with the above parameters (iterations = 3, memory overhead = 64MB). This hash value and salt value are simultaneously stored in the MySQL user_credentials table and the Fabric smart contract state.

[0036] Scenario B (video "demo.mp4"): Identified as "Multimedia", routed to the multimedia channel. First, following the DCT field watermark embedding process described above, the author ID "0xUserA" is embedded in the video. Then, using the key Key_B generated by KMS, the video is encrypted in AES-256-GCM mode, yielding the ciphertext Cipher_B and the authentication tag Tag_B. Cipher_B is uploaded to IPFS to obtain the CID QmXYZ... Finally, the following is recorded on Fabric: {Type: Video, Association Pair: (CID: QmXYZ..., Tag: Tag_B), Key Descriptor ID: "UUID-1234"}.

[0037] Scenario C (Contract Text): Recognized as "text", its SHA-256 hash value is directly stored as the transaction payload in the new block.

[0038] (3) Data retrieval and global validation Take the video "demo.mp4" as an example.

[0039] ① Users query through the global verification interface. The interface first queries Fabric to obtain the "passport" of the data: {Type: Video, Association Pair: (CID: QmXYZ..., Tag: Tag_B), Key Descriptor ID: "UUID-1234"}.

[0040] ② Obtain the ciphertext Cipher_B from IPFS based on the CID.

[0041] ③ The system submits a decryption request (with Tag_B as verification evidence) to the designated KMS / HSM based on the key descriptor ID. After internal authorization verification, the KMS decrypts Cipher_B using the corresponding K_data. The AES-256-GCM algorithm will automatically complete the integrity verification using Tag_B. After successful verification, the KMS outputs the decrypted original video with watermark.

[0042] ④ The client can further extract the watermark information "0xUserA" to complete the copyright verification.

[0043] The invention is not a simple combination of existing technologies, but rather a creative solution to the industry pain points of balancing security and efficiency in blockchain storage expansion and the difficulty in unified management of multimodal data through an innovative dynamic routing decision mechanism, anti-cracking hash hardening for cryptographic data, strong order technology closed loop for multimedia data, and a unified verification model across systems.

[0044] Specifically, this invention enables precise security for three major data types.

[0045] 1. For cryptographic data: The Argon2id anti-side-channel attack algorithm is adopted and high memory overhead (such as 64MiB) is configured to build a strong defense against GPU / ASIC hardware cracking, realizing a fundamental improvement in cryptographic storage from "ordinary encryption" to "proactive defense hardening".

[0046] 2. For multimedia data: By using a strong sequential closed loop of "digital watermarking followed by encryption" and a "CID+Tag dual-code anchoring" mechanism, while achieving efficient storage, copyright protection, content confidentiality and integrity verification are integrated into one, solving the security and ownership problems of multimedia data during expansion.

[0047] 3. For the global system: Through the "three-in-one" verification model with blockchain as the unified root of trust, the above-mentioned differentiated security processing results are reliably anchored and linked, ensuring the global consistency and auditability of the entire hybrid storage system.

[0048] In summary, this invention provides a systematic solution for “classification-based policy implementation and collaborative governance” based on the inherent security characteristics of data.

[0049] The above are merely preferred embodiments of the present invention and are not intended to limit or restrict the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection declared by the present invention.

Claims

1. A multimodal data chain on-chain and off-chain collaborative storage method based on classification encryption, characterized in that, Includes the following steps: S1. Identify and receive the raw data to be stored, classify it according to the type of raw data, and route it to the corresponding storage process. Data types include password data, image / video multimedia data, and text data. S2. For cryptographic data, use a cryptographic hash function that resists side-channel attacks to encrypt the data and generate ciphertext; for multimedia data such as images / videos, first add a digital watermark, then use a symmetric encryption algorithm to encrypt the data and generate ciphertext and an authentication tag for integrity verification. For text-based data, proceed directly to the storage step; S3. Simultaneously store the ciphertext of cryptographic data in an off-chain relational database and on a consortium blockchain; store the ciphertext of multimedia data in a decentralized distributed file system, obtain a unique content identifier (CID), and store the content identifier (CID) and the authentication tag generated during the encryption process in the blockchain. Storing text-based data directly into the blockchain; S4. Create a record on the blockchain for each piece of original data. The record shall contain at least the unique identifier of the data, the type identifier, and its corresponding storage instructions. The storage guidance information includes: for cryptographic data, an off-chain database index; for multimedia data, an IPFS Content Identifier (CID) and an authentication tag. For text-type data, use its hash value; S5. When data needs to be obtained, first query the corresponding record from the blockchain, and obtain the ciphertext or plaintext from the corresponding storage layer according to the type identifier and storage guidance information. Then, use the authentication tag or hash value in the storage guidance to verify consistency and integrity.

2. The multimodal data chain on-chain and off-chain collaborative storage method based on classification encryption as described in claim 1, characterized in that: The password hash function is the Argon2id variant password hash algorithm.

3. The multimodal data chain on-chain and off-chain collaborative storage method based on classification encryption as described in claim 1, characterized in that: For multimedia data such as images and videos, digital watermarks are added using the DCT field.

4. The multimodal data chain on-chain and off-chain collaborative storage method based on classification encryption as described in claim 1, characterized in that: The symmetric encryption algorithm mentioned is AES-256-GCM encryption.

Images