CN108199866A - Social network system with strong secret protection - Google Patents

Abstract

The present invention provides a kind of social network system with strong secret protection, including：P2P network layers, api layer and APP application layers, the api layer are connected to P2P network layers and APP application layers；The P2P network layers establish the decentralization peer to peer connection of social network system；The api layer determines application interface and provides the service function of social network system；The APP application layers generate application interface, and the application interface of api layer is called to provide interface response and integration of user interaction functionality.The present invention is based on P2P to realize social network structure, while has the function of user information dispersion storage, network link encipherment protection and publication content strategy control etc..The present invention ensures the demand for security of privacy, integrality and availability in community network, under the premise of ensureing that community network user appropriateness is convenient, while protects not invaded for its privacy information, and accomplish the harmony of application and safety.

Description

Social Networking System with Strong Privacy Protection

technical field

The present invention relates to a social network system, in particular to a P2P network-based social network system with strong privacy protection.

Background technique

Entering the information age, online social networks have gradually become the main carrier of the Internet. Using social network software to communicate with others, obtain information and release information has become the mainstream way of life in modern society. In the field of social networks, due to the complex structure of online social networks, the large range of users and the characteristics of large data traffic, how to balance privacy and convenience is a dilemma.

Today's mainstream online social network systems usually adopt a centralized service model, making the server the core component of the entire architecture. Users' personal information data, chat records, and social dynamic data are forwarded and stored through the central server, which exposes user information to In front of the personnel who have access to the server, the centralized big data model provides more convenience for the attackers. Even if all the information of the user is not obtained, the relevant information of the user can be obtained through data mining and cross-comparison. Therefore, in the centralized The security of data centers and servers in the social network architecture has become the core of the security requirements in the entire architecture, and once it is invaded by an attacker, the loss and consequences of massive data loss caused by it are difficult to estimate.

Therefore, as users become more aware of personal information and privacy protection, distributed social networks are gradually beginning to take shape. The development of distributed social networks has been extensively explored by domestic networks, and the models and technologies formed include foreign PeerSon and Safbook, and domestic WebService. It can be divided into structured distributed social network, unstructured distributed social network and hybrid online social network. In the structured distributed social network, some nodes with high new computer performance, large storage space, and wide broadband frequency domain are set as super user nodes to maintain data forwarding and storage of other user nodes. The unstructured distributed social network cancels the concept of super user nodes, and all user nodes jointly maintain the storage and operation of social network data. The hybrid online social network combines the characteristics of centralized and distributed. When the centralized server has problems, it will switch to a distributed service method and establish a temporary distributed network.

In the distributed network, data transmission is not carried out through the central server, but point-to-point communication and data transmission are established between users, so that the user's personal information and private data will be distributed and stored in the social network, but this However, it is difficult to ensure the effective management of user behavior in the distributed network, and it is difficult to trace the information of user chats, and there is a lack of awareness of fine-grained access control.

Therefore, how to ensure the integrity, confidentiality, availability and non-repudiation of user data while ensuring the non-disclosure and privacy of user personal information through a distributed network is an urgent problem to be solved.

Contents of the invention

In view of the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a social network system with strong privacy protection, which provides fine-grained access control, Data integrity protection, network structure protection, and data non-repudiation protection improve user privacy protection and personal information security in distributed social network systems.

In order to achieve the above object, the present invention is achieved through the following technical solutions.

According to one aspect of the present invention, a social network system with strong privacy protection is provided, including: a P2P network layer, an API layer, and an APP application layer, and the API layer connects the P2P network layer and the APP application layer;

in:

The P2P network layer establishes a decentralized peer-to-peer connection of the social network system;

The API layer determines the application interface and provides the service function of the social network system;

The APP application layer generates an application interface through application development, and calls the application interface of the API layer to provide interface response and user interaction functions.

Preferably, the P2P network layer includes a data distributed storage module, an access control module, a network structure protection module and a routing algorithm module; wherein:

The data distributed storage module stores files and chat data in a decentralized network to form distributed stored files and chat data;

The access control module ensures the confidentiality and integrity of distributed stored files and chat data, fine-grained protection of user privacy, and ensures the trustworthiness of connected users;

The network structure protection module ensures the confidentiality of the user's node information, IP address information and data information used by the user, and ensures the transparency of the network connection structure to the user;

The routing algorithm module can efficiently and correctly establish connections between users, ensure the establishment of data download links, and ensure the availability of distributed storage data.

Preferably, any one or more of the following is also included:

-The chat data of the distributed storage includes the copy file of the chat record in the P2P network and the chat record file stored locally in the user, wherein:

The chat record copy file in the P2P network is distributed and stored on a certain number of nodes, and this part of the chat data is not controlled by the user itself;

The chat record files stored locally in the user are separated from the P2P network and can be changed or deleted;

- When the access control module ensures the confidentiality of files stored by users in a distributed manner, it uses symmetric key encryption to ensure the confidentiality of files, and at the same time uses asymmetric keys to perform identity verification before file transmission through protocols.

Preferably, the API layer includes the following functional modules:

User registration module, user verification module, user login and exit module, user search module, user connection module, instant messaging module, record verification module, blacklist module, distributed storage module, message publishing module;

in:

Described user registration module fills in and imports user data, establishes a new user and joins in the P2P network layer to become a new node, and informs other nodes of the establishment of the new node;

The user verification module verifies the user account password, and verifies the identity of the friend's request and the establishment of the connection, and issues a public key to the trusted user;

The user logs in and exits the module to operate the addition and deletion of online nodes in the P2P network layer, and check the online integrity of distributed storage information for nodes that are about to go offline to ensure the availability of distributed storage information; the distributed storage Information includes: distributed storage files and chat data;

The user search module, after user A selects user B for instant messaging, searches for user B iteratively in the P2P network, and establishes a link between the two after obtaining the address of user B;

The user connection module establishes a connection with user B after user A obtains the IP address and monitoring port information of user B;

The instant messaging module sends and receives messages after the user A and user B establish a communication link;

Described record verification module, after user A and user B set up connection, carry out Md5 code verification for user A and user B's previous chat record file stored in user's locality and the chat record copy file in P2P network, compare The integrity of its data and the non-repudiation of guaranteed chat records;

The blacklist module ensures that user A can prevent user B from attempting to establish a connection with user A;

The distributed storage module ensures that only authorized users can access and download locally stored distributed storage data, and ensures that files and chat data stored in other user machines are encrypted and complete;

The message publishing module performs message notification to selected objects within a set range, wherein the selected object has a specific public-private key pair, uses the public key to encrypt broadcast information, and only users who have obtained the corresponding private key can know the information. real content.

Preferably, any one or more of the following is also included:

-The user search module retains the non-offline friend IP address and port information of a certain time stamp during the online process, and the relevant information of the friend node in all processes has full transparency relative to the user itself, ensuring the privacy of the node information;

- the user connection module, the connection process is transparent to the user, the IP address and port information of the other node are not disclosed, the program background automatically responds and connects, and the user cannot see the relevant information;

-In the instant messaging module, the information sent and received in the TCP link is information encrypted by the receiver's public key, and the private key is used to decrypt the received information, so the content transmitted in the link ensures the confidentiality of the message.

Preferably, when user A and user B are connected and communicate instantly, at first in the record verification module, for user A and user B, the chat record file stored in the user's locality and the chat record copy file in the P2P network before this are carried out The Md5 code comparison check checks whether user A and user B have the behavior of changing or deleting chat records, and uses the record verification module to detect the integrity of the chat record files stored locally in the user and inform user A and user through the interface response B The correctness of the chat record files stored locally by the other party in the user.

Preferably, the APP application layer, wherein:

The form of application development includes ios APP, mobile phone APP on Android platform, windows application software, ubuntu application software and/or mac application software;

Application form includes interface operation and terminal input and output;

In the application development, function development and application are carried out by calling each function module of the API layer.

Compared with the prior art, the present invention has the following beneficial effects:

The social network system with strong privacy protection provided by the present invention can break away from the traditional social network system of centralized central server and data center, greatly reduce the risk of exposure of personal information and private data, and ensure that unauthorized users cannot know or tamper with the distribution The content of the file is stored in a format to ensure the non-repudiation of chat data storage, and to strengthen the effective management of users in the distributed social network and the transparency of the network structure. The details are as follows:

1. Break away from the traditional centralized social network system

The existing mainstream social networking software is based on the architecture of a centralized central server, which forwards and stores user data through the central server, stores big data user information in the data center, and manages and forwards all user interaction information by the central server. This method focuses the attacker's target on the data center and central server, and data mining and data analysis in the era of big data can maximize the use of user personal information. Therefore, choosing a distributed social network system to disperse user information and data in the network can greatly reduce the risk of data exposure.

2. Fine-grained access control

The files stored by users in a distributed manner are subject to permission control for other users, and only authorized users can access or download them. The chat record files are distributed and encrypted and stored so that others cannot see them, but the system will perform Md5 code calculations to compare with the local chat record files. Establish a friend mechanism, and prohibit the establishment of connections for users in the blacklist.

3. Transparency of network structure

The information of the user node is not released to the public, and the other node information obtained in all connection operations is invisible to the user, and the network connection structure information is transparent to the user.

Description of drawings

Other characteristics, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

Figure 1 is a block diagram of the system design;

Figure 2 is a schematic diagram of the routing mechanism;

Figure 3 is a login interface diagram;

Fig. 4 is the instant messaging interface diagram;

Figure 5 is a notification diagram of chat data comparison.

Detailed ways

The following is a detailed description of the embodiments of the present invention: this embodiment is implemented on the premise of the technical solution of the present invention, and provides detailed implementation methods and specific operation processes. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these all belong to the protection scope of the present invention.

Example

This embodiment provides a social network system with strong privacy protection, including: a P2P network layer, an API layer, and an APP application layer, and the API layer is connected to the P2P network layer and the APP application layer;

in:

The P2P network layer establishes a decentralized peer-to-peer connection of the social network system, including a data distributed storage module, an access control module, a network structure protection module and a routing algorithm module;

The API layer determines the application interface and provides social network system service functions, including a user registration module, a user verification module, a user login and exit module, a user search module, a user connection module, an instant messaging module, a record verification module, a blacklist module, Distributed storage module, message publishing module;

The APP application layer generates an application interface through application development, and calls an API interface to provide interface response and user interaction functions.

Further, the P2P network layer includes a data distributed storage module, an access control module, a network structure protection module and a routing algorithm module, wherein:

The data distributed storage module stores files and chat data in a distributed network to form distributed stored files and chat data. In this example, the realization of the distributed network adopts the distributed hash table (DHT) technology, and adopts the Kademlia protocol to realize, and uses key-value pairs to access various data;

The access control module ensures the confidentiality and integrity of distributed stored files and chat data, fine-grained protection of user privacy, and ensures the trustworthiness of connected users. In this example, when a user node accesses the DHT network, it first needs to perform identity verification. Identity verification is performed using an encrypted private key, and each user's ID uses the hash value of the corresponding public key. For some private data, it is encrypted with the public key and stored on the DHT network. Only users with the corresponding private key can obtain and decrypt the original text;

The network structure protection module ensures the confidentiality of user-related information such as user node information and IP address information, and ensures the transparency of the network connection structure for users. In this example, the P2P network is set up on the public Internet network, and NodeID is used to represent each node, and the relationship between nodes can be logically described by a binary tree, which is decoupled from the network structure of the Internet;

The routing algorithm module can efficiently and correctly establish connections between users, ensure the establishment of data download links, and ensure the availability of distributed storage data. In this example, the aforementioned logical structure of the P2P network is a binary tree structure. When routing, the binary tree is split, starting from the root node, and the subtrees that do not contain itself are split one by one. For each node, after subtree splitting, n subtrees will be obtained, and for each subtree, K nodes are selected as representative nodes of the subtree, and their information is recorded. When performing routing, recursive query can be performed according to the recorded nodes to obtain the routing information of each node.

Further, the API layer includes a user registration module, a user verification module, a user login and exit module, a user search module, a user connection module, an instant messaging module, a record verification module, a blacklist module, a distributed storage module, and a message release module, in:

The user registration module fills in and imports user data, establishes a new user and joins it in the P2P network layer as a new node, and informs other nodes of the establishment of the node. In this example, the joining of the underlying network node is completed by the interface provided by the P2P network. The main work is the association between the network node and the user account, and it is necessary to record the relevant account information corresponding to the identity ID in the network;

The user authentication module verifies the user account password, verifies the identity of the friend's request and the establishment of the connection, and issues the public key to the trusted user. In this example, for the identity verification of the main user, each key distributed during registration represents a user, and the private key is encrypted using the AES symmetric encryption algorithm, and the user's identity is verified by providing the decryption password of the private key, and to join the network;

The user logs in and exits the module to operate the addition and deletion of online nodes in the P2P network, and check the online integrity of distributed storage information for nodes that are about to go offline, so as to ensure the availability of distributed storage information. In this example, to join the DHT network, you need to connect to any node already in the network, and you need to provide a permanently open and fixed BOOTSTRAP node to provide access to the network. After connecting to the BOOTSTARP node, you can join according to the Kademlia protocol network;

The user search module, after user A selects user B for communication, iteratively searches for user B in the P2P network, and obtains relevant information of user B. In this example, user information is stored in the DHT network, and the corresponding user information can be searched through the key-value pairs in the DHT network;

The user connection module establishes a connection with user B after user A obtains user B's IP address and monitoring port information. In this example, user A and user B are completed through the DHT network as an intermediary, and the connection between the two users is completed through the unique key-value pair corresponding to each user in the DHT network;

The instant messaging module sends and receives messages after user A and user B establish a communication link. In this example, the communication between user A and user B is completed through the entire DHT network as an intermediary. Each user has a unique key-value pair to receive information transmitted by other users. The transmitted information includes Data such as the sender's identity and message content. To complete the communication between users in this way;

Described record verification module, after user A and user B set up connection, carry out Md5 code check for the chat record local file of user A and user B before the chat record copy file of distributed storage in the network, compare its data Integrity and guaranteed non-repudiation of chat transcripts. In this example, the content of the chat information is encrypted by the key generated by the message receiver and stored on the node corresponding to the key value. When the two parties compare the chat records, the copy of the chat records stored on the corresponding node and Comparing the Md5 codes between the chat record files of the message sender and the message receiver, it can be inferred whether there is any tampering of the content of the chat message on both sides of the user, so that the non-repudiation of the chat data can be achieved;

The blacklist module ensures that user A can prevent user B from attempting to establish a connection with user A. In this example, a blacklist module with filtering function is added before the user search module. If the searched user is in the blacklist of the searched user, the actual search module will not be called directly, but directly return end;

The message release module performs message notification to a certain range of selected objects, wherein the object has a specific public-private key pair, uses the public key to encrypt broadcast information, and only users who have obtained the corresponding private key can know the true content of the information. In this example, a group of public-private key pairs identifies a group of user groups, and the messages and dynamics they publish to each other are mutually visible, while users outside this group cannot decrypt or see the information .

Further, the application development form may include ios APP, Android platform mobile APP, windows application software, ubuntu application software, mac application software. Application form can include interface operation and terminal input and output. In application development, function development and application are carried out by calling various functions of the API layer.

This embodiment will be further described below in conjunction with the accompanying drawings.

As shown in FIG. 1 , the novel social network system with strong privacy protection provided by this embodiment includes a three-layer design, which are P2P network layer, API layer and application layer. Among them, from the bottom right to the top in the figure is the hierarchical progression from the underlying architecture to the APP application, and the API layer is the connection of the three layers.

Perform user login operation through interface operation, call user verification API, and access P2P network through the interface provided by DHT after verifying that the decryption private key is correct. First establish a connection with the preset BOOTSTRAP node, then randomly generate a hash value as NodeID, send a query request to the BOOTSTRAP node, and establish its own routing table.

After logging in, the user exists as a node of the P2P network. At this time, some operations provided by the application can be performed, such as text communication with another user who is a friend. When sending a message, the API is first called for user verification. Verify the user's identity and friend relationship (these information are stored in the DHT network). After the verification is passed, call the API of instant messaging, and use the content storage function provided by the underlying DHT network to send the text content and sender's identity Content such as identification and time stamp is recorded on the key-value pair of the target user in the DHT network, and the target user is always monitoring the content changes on his own key-value pair. For new records, the sender, sending content and sending After the time is parsed, it is presented on the UI of the program.

The modules are described in detail below.

a. Distributed storage module

The data distributed storage module is used to store files and chat data in a decentralized distributed network. The realization of the distributed network adopts the technology of distributed hash table (DHT), and adopts the Kademlia protocol to realize, and uses keys for various data -value pairs are accessed.

When saving data, when a node gets newly added data (K/V), it will first calculate the "distance" between itself and the key of the new data; then calculate the other nodes it knows and the key the distance. If it is calculated that the distance between itself and the key is the smallest, then the data will be kept here, otherwise, the data will be forwarded to the node with the smallest distance. Another node that receives the data also uses the above process for processing (recursive processing).

When acquiring data, when a node receives a query data request (key), it will first calculate the "distance" between itself and the key; then calculate the distance between other nodes it knows and the key. If the calculation shows that the distance between you and the key is the smallest, then you can find out whether there is a value corresponding to the key here. If there is, it will return value, if not, it will report an error. Otherwise, forward the data to the node with the smallest distance. Another node that receives the data also uses the above process for processing (recursive processing).

b. Routing algorithm module

The logical structure of the DHT network is a binary tree structure. When a node is building a routing table, it starts from the root node and splits the subtrees that do not contain itself layer by layer to obtain n subtrees; for each subtree, if you know each A node in the subtree can use these n nodes for recursive routing, so that the entire binary tree can be reached.

Since the distributed network may face the problem of frequent nodes going online and offline, recording only one node in each subtree obviously cannot meet the robustness requirements, so k nodes are recorded for each subtree. It should be noted that the number of nodes in some subtrees may be less than k, so the number of nodes recorded for this subtree may not reach k.

c. (fine-grained) access control module

For data stored in the DHT network, fine-grained access control is required. The access control module is used to ensure the confidentiality and integrity of distributed storage files and chat data, fine-grained protection of user privacy, and ensure the trustworthiness of connected users. When a user node accesses the DHT network, it must first perform identity verification. Identity verification is performed using an encrypted private key, and each user's ID uses the hash value of the corresponding public key. For some private data, it is encrypted with the public key and stored on the DHT network. Only users with the corresponding private key can obtain and decrypt the original text; The keys are encrypted and stored under the corresponding key.

The new social network system with strong privacy protection provided by the present invention can break away from the traditional social network system of centralized central server and data center, greatly reduce the risk of exposure of personal information and private data, and ensure that unauthorized users cannot know or tamper with distribution The content of the file is stored in a format, which ensures the non-repudiation of chat data storage, and strengthens the effective management of users in the distributed social network and the transparency of the network structure. The specific advantages are as follows:

a. Break away from the traditional centralized social network system

The existing mainstream social networking software is based on the architecture of a centralized central server, which forwards and stores user data through the central server, stores big data user information in the data center, and manages and forwards all user interaction information by the central server. This method focuses the attacker's target on the data center and central server, and data mining and data analysis in the era of big data can maximize the use of user personal information. Therefore, choosing a distributed social network system to disperse user information and data in the network can greatly reduce the risk of data exposure.

b. Fine-grained access control

The files stored by users in a distributed manner are subject to permission control for other users, and only authorized users can access or download them. The chat record files are distributed and encrypted and stored so that others cannot see them, but the system will perform Md5 code calculations to compare with the local chat record files. Establish a friend mechanism, and prohibit the establishment of connections for users in the blacklist.

c. Network structure transparency

The information of the user node is not released to the public, and the other node information obtained in all connection operations is invisible to the user, and the network connection structure information is transparent to the user.

Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention.

Claims (7)

1. A social network system with strong privacy protection, is characterized in that, comprises: P2P network layer, API layer and APP application layer, described API layer is connected P2P network layer and APP application layer; in: The P2P network layer establishes a decentralized peer-to-peer connection of the social network system; The API layer determines the application interface and provides the service function of the social network system; The APP application layer generates an application interface through application development, and calls the application interface of the API layer to provide interface response and user interaction functions. 2. The social network system with strong privacy protection according to claim 1, wherein the P2P network layer comprises: a data distributed storage module, an access control module, a network structure protection module and a routing algorithm module; wherein: The data distributed storage module stores files and chat data in a decentralized network to form distributed stored files and chat data; The access control module ensures the confidentiality and integrity of distributed stored files and chat data, fine-grained protection of user privacy, and ensures the trustworthiness of connected users; The network structure protection module ensures the confidentiality of the user's node information, IP address information and data information used by the user, and ensures the transparency of the network connection structure to the user; The routing algorithm module establishes connections between users, ensures the establishment of data download links, and ensures the availability of distributed storage data. 3. The social network system with strong privacy protection according to claim 2, further comprising any one or more of the following: -The chat data of the distributed storage includes the copy file of the chat record in the P2P network and the chat record file stored locally in the user, wherein: The chat record copy file in the P2P network is distributed and stored on a certain number of nodes, and this part of the chat data is not controlled by the user itself; The chat record files stored locally in the user are separated from the P2P network and can be changed or deleted; - When the access control module ensures the confidentiality of files stored by users in a distributed manner, it uses symmetric key encryption to ensure the confidentiality of files, and at the same time uses asymmetric keys to perform identity verification before file transmission through protocols. 4. the social network system with strong privacy protection according to claim 3, is characterized in that, described API layer comprises following function module: User registration module, user verification module, user login and exit module, user search module, user connection module, instant messaging module, record verification module, blacklist module, distributed storage module, message release module; in: Described user registration module fills in and imports user data, establishes a new user and joins in the P2P network layer to become a new node, and informs other nodes of the establishment of the new node; The user verification module verifies the user account password, and verifies the identity of the friend's request and the establishment of the connection, and issues a public key to the trusted user; The user logs in and exits the module to operate the addition and deletion of online nodes in the P2P network layer, and check the online integrity of distributed storage information for nodes that are about to go offline to ensure the availability of distributed storage information; the distributed storage Information includes: distributed storage files and chat data; The user search module, after user A selects user B for instant messaging, searches for user B iteratively in the P2P network, and establishes a link between the two after obtaining the address of user B; The user connection module establishes a connection with user B after user A obtains the IP address and monitoring port information of user B; The instant messaging module sends and receives messages after the user A and user B establish a communication link; Described record verification module, after user A and user B set up connection, carry out Md5 code verification for user A and user B's previous chat record file stored in user's locality and the chat record copy file in P2P network, compare The integrity of its data and the non-repudiation of guaranteed chat records; The blacklist module ensures that user A can prevent user B from attempting to establish a connection with user A; The distributed storage module ensures that only authorized users can access and download locally stored distributed storage data, and ensures that files and chat data stored in other user machines are encrypted and complete; The message publishing module performs message notification to selected objects within a set range, wherein the selected object has a specific public-private key pair, uses the public key to encrypt broadcast information, and only users who have obtained the corresponding private key can know the information. real content. 5. The social network system with strong privacy protection according to claim 4, further comprising any one or more of the following: -The user search module retains the non-offline friend IP address and port information of a certain time stamp during the online process, and the relevant information of the friend node in all processes has full transparency relative to the user itself, ensuring the privacy of the node information; - the user connection module, the connection process is transparent to the user, the IP address and port information of the other node are not disclosed, the program background automatically responds and connects, and the user cannot see the relevant information; -In the instant messaging module, the information sent and received in the TCP link is information encrypted by the receiver's public key, and the private key is used to decrypt the received information, so the content transmitted in the link ensures the confidentiality of the message. 6. The social network system with strong privacy protection according to claim 4, characterized in that, when user A and user B are connected and instant messaged by the record verification module, at first for user A and user B before this The chat record file stored locally in the user and the copy file of the chat record in the P2P network are compared and verified with the Md5 code, and whether there is any behavior of changing or deleting the chat record between user A and user B is checked, and stored in the user's local area through detection The integrity of the chat record file and notify user A and user B of the correctness of the chat record file stored locally by the other party through the interface response. 7. The social network system with strong privacy protection according to claim 1, characterized in that, the APP application layer, wherein: The form of application development includes ios APP, mobile phone APP on Android platform, windows application software, ubuntu application software and/or mac application software; Application form includes interface operation and terminal input and output; In the application development, function development and application are carried out by calling each function module of the API layer.