WO2018032374A1 - Encrypted storage system for block chain and method using same - Google Patents

Abstract

The present invention provides an encrypted storage system for a block chain, comprising: (1) a file group (S), used for reducing the amounts of key exchange between users, differentiating file reading and writing, effectively processing and revoking access rights of the users, and allowing an un-trusted server to authorize a write operation for a file; (2) an open file system, used for embedding an encrypted storage system prototype of the block chain and comprising an authentication database; and (3) a box locking device comprising a plurality of key distribution schemes. A user customizes safety strategies and authentication mechanisms for files of the user with by using one of a plurality of client-based key distribution schemes. Also disclosed is a method for using the encrypted storage system for a block chain. According to the present invention, the problem of possibly insufficient capacity of servers due to expensive cipher computation can be solved, files can be accessed when file owners are offline, and accordingly, when each file needs to be accessed, the trouble of contacting with the corresponding file owner can be prevented.

Description

Encrypted storage system for blockchain and using method thereof Technical field

The invention relates to the transaction data security problem of a blockchain, in particular to an encrypted storage system of a blockchain and a using method thereof.

Background technique

The emergence of Bitcoin in 2009 brought a subversive result - blockchain technology, blockchain is a secure account book database, composed of data blocks, users can constantly update and upgrade here. The platform looks for data. For financial institutions, the blockchain can speed up transaction processing, reduce costs, reduce middlemen, improve market insight, and increase business transparency.

Computing and storage are the two basic tasks of computer systems. With the explosive growth of information, storage components will experience direct storage based on single-server, to cluster-based grid storage based on LAN, and finally to WAN-based data grids. Blockchain technology is the most extreme development at present. The intrinsic characteristics of this data storage medium include intelligent storage. The quality of storage service can guarantee service differentiation and performance guarantee for user applications. Storage is object-oriented mass storage, and Network storage must be confidential and complete. The existing Internet does not have a good or convenient way to ensure the confidentiality, integrity, availability, and data of the data stored in the blockchain and the data stored on the storage device. Non-repudiation and the reliability of the entire network storage system, especially the generation of trusted computing technology in blockchain in recent years, puts higher demands on network storage security.

Summary of the invention

An object of the present invention is to provide an encrypted storage system for a blockchain, comprising: (1) a file group S, which is composed of files having the same access attribute and at different levels, for reducing key exchange between users. Volume, distinguish between file read and write, effectively handle the revocation of user access rights, let an untrusted server authorization file to write operations; (2) open file system, embedded in the blockchain encryption storage system prototype, including The right database, the authentication database of the open file system and the file group key of the encrypted storage system itself are formed in the same programming manner; (3) the lock box device includes multiple key distribution schemes, and the user uses more client-based One of the key distribution schemes to customize the security policy and authentication mechanism for its own files.

Preferably, the number of key exchanges and the number of key exchanges between the file owner and the user is reduced by the key rotation management key, but at the same time the obligation of the file owner to initially distribute the key is not released.

Preferably, the open file system defines the basic structure of the first level directory, so that the user can transparently access the file by using the same directory address anywhere. The access process is to input the "login user name" command, input After the correct password, you can get the token verification code. You can use the check command to check whether the token verification code is correctly obtained. If you modify the personal access password, use the keyword + username to change the keyword and transaction. Relevant, including the transaction information digest, must be used when the user leaves the open file system.

Preferably, the token verification code is time-sensitive and automatically expires after 24 hours from the login. If it is necessary to obtain a new token verification code, the login information needs to be entered again.

Preferably, all data encryption in the file group S is encrypted by a disk, and key management is performed by the client.

Preferably, the plurality of key distribution schemes are differentiated according to the ratio of security and performance ratio values, and the lock box device has multiple keys.

Preferably, the blockchain encryption storage system uses the public key cryptography as the security key of the access right.

It is still another object of the present invention to provide a method for using an encrypted storage system for a blockchain, comprising the steps of: (1) dividing a file in a blockchain into blocks, encrypting them in blocks, and placing block keys in blocks. In the lock box, a file group contains several files belonging to the same file owner and belonging to the same group of lock boxes. Have the same lock box key and signature key; (2) The owner of the file group immediately distributes the lock box key to the user after creating the lock box, and calculates a hash tree for each file, and signs and puts the root Enter the file header; (3) the encrypted storage system uses an asymmetric file verification key or uses the file signing key protocol to distinguish between read and write users, these keys are used to sign or verify the hash value of the file block content, thereby Provide proof of file integrity; (4) When requesting a file, the server will pass the encrypted lock box and the encrypted file block to the user, and then the user uses the lock box key to open the lock box and use the lock box The corresponding key decrypts the file block.

Preferably, the method further includes the following steps: for the unified file group, the file owner generates a new key by using the original lock box key, and when the user accesses the file, if the new lock box key is not available, the new key is obtained from the owner. If the lockbox key is not the latest user, you must calculate the original key yourself.

Preferably, the method further includes: the blockchain encryption storage system uses two types of keys, a file signature key and a file verification key, to distinguish between read and write permissions of the file, and when the user reads or writes the file, the file is used. The signature key and the file verification key verify the digital signature and the hash value of the file. If the verification fails, the user believes that the file was illegally modified.

The encrypted storage system of the present invention and the method of using the same, the key management right is placed on the client rather than a trusted server, which prevents the problem of insufficient server-side capacity caused by expensive cryptographic operations, and at the same time, relies on the file group. Limiting the number of keys, files with the same access attribute are protected by the same key in the same file group, making it possible to access files when the file owner is offline, thus avoiding the need to access each file. The trouble of contacting the file owner.

The above as well as other objects, advantages and features of the present invention will become apparent to those skilled in the <

DRAWINGS

Some specific embodiments of the present invention are described in detail below by way of example, and not limitation. The same reference numbers in the drawings identify the same or similar parts. Those skilled in the art should understand that the drawings are not necessarily drawn to scale. The objects and features of the present invention are considered as follows The description will be more apparent in conjunction with the drawings, in which:

FIG. 1 is a schematic structural diagram of a blockchain encryption storage system according to an embodiment of the present invention.

detailed description

Before proceeding with the description of the specific embodiments, in order to more clearly express the content discussed, first define some very important concepts.

Trading: The essence of a transaction is a relational data structure that contains information about the value transfer of the trading participants. These transaction information is called the accounting ledger. The transaction needs to go through three creation, verification, and writing blockchains. The transaction must be digitally signed to ensure the legality of the transaction.

Block: All transaction information is stored in the block, and a transaction information is a record, which is stored as a separate record in the blockchain. The block consists of a block header and a data part. The block header field contains various characteristics of the block itself, such as the previous block information, the merkle value, and the timestamp. The block header hash value and block height are the two most important indicators for identifying the block. The block primary identifier is its cryptographic hash value, a digital fingerprint obtained by performing a second hash calculation on the block header by the SHA algorithm. The resulting 32-byte hash value is called the block hash value, or the block header hash value, and only the block header is used for calculation. The block hash value can uniquely and unambiguously identify a block, and any node can independently obtain the block hash value by simply hashing the block header.

Blockchain: A data structure in which blocks are chained in an orderly fashion. A blockchain is like a vertical stack, with the first block being the first block at the bottom of the stack, and each block is then placed on top of the other blocks. When a block is written to a blockchain, it will never change and is backed up to another blockchain server.

Embodiment: Referring to FIG. 1, an encrypted storage system for a blockchain does not affect the secure data sharing of a blockchain node even if it does not trust the server. This embodiment uses cryptography to protect shared files. It is characterized by providing a single user with direct and extensible key management while maintaining direct control over the user accessing the data, and using the file group S in the encrypted storage system to reduce The amount of key exchange between users, distinguishes between file read and write, effectively handles the revocation of user access rights, and allows an untrusted server authorization file. For write operations, a file group is a strict collection of files with the same access attributes. Regardless of the hierarchy, managing keys by key rotation helps reduce the number and number of key exchanges between the file owner and the user, but At the same time, the obligation of the file owner to initially distribute the key is not removed.

Create an open file system, embed the above-mentioned blockchain encryption storage system prototype in the file system, so that users can conveniently and efficiently share files distributed in the LAN or WAN, and provide users with higher authentication through the authentication database. Security, the authentication database of the open file system and the file group key of the encrypted storage system itself are in the same programming mode, that is, the lock box solution, which is compatible with the encryption method, improves security and scalability, and is open-ended. The file system specifies the basic structure of the first-level directory, enabling users to transparently access their files using the same directory address from anywhere. The process of entering is to enter the "login user name" command, and after entering the correct password, The token verification code can be obtained. The user can check again whether the token verification code is correctly obtained by using the check command. If the personal access password is modified, the command of "keyword + user name" must be used to change the keyword, including the transaction information. Abstract, when the user leaves the open file system The logout command must be used. In addition, for security reasons, the token verification code is time-sensitive. It automatically expires 24 hours after login. If you need to obtain a new token verification code, you need to type the login information again to prevent system phishing.

The primary goal of the lockbox approach is to provide highly scalable key management while giving file owners direct control over authorized access. All data encryption uses disk encryption, and key management is performed by the client to alleviate server-side stress. The user uses one of a plurality of client-based key distribution schemes to customize security policies and authentication mechanisms for their own files, where each allocation scheme is differentiated according to the ratio of security and performance ratios, and the lock box scheme has Multiple keys. When used, the file is divided into blocks and encrypted in blocks. The block key is placed in the lock box. A file group contains several files belonging to the same file owner. The lock boxes belonging to the same group have the same lock box key and The signature key, the owner of the file group distributes the lock box key to the user once the lock box is created, and computes a hash tree for each file, signs the root and places it in the file header. The blockchain encryption storage system uses asymmetric file verification keys or uses a file signing key protocol to distinguish between read and write users. These keys are used to sign Or verify the hash value of the contents of the file block to provide proof of the integrity of the file.

When requesting a file, the server passes the encrypted lock box and the encrypted file block to the user, who then uses the lock box key to open the lock box and decrypt the file block using the corresponding key in the lock box.

In an encrypted storage system, the increase in keys and the use of file groups are complicated by key revocation schemes. Key revocation can cause a large number of file re-encryption and key management issues when a large number of files are encrypted using the same key associated with access rights in the file system. Therefore, the blockchain encryption storage system of this embodiment uses the public key cryptography as the security key of the access right, and prevents the problem that the re-encryption box key management is overburdened.

For a unified file group, the file owner uses the original lock box key to generate a new key. When the user accesses the file, if the new lock box key is not available, the new key is obtained from the owner. If the lock box key is not up to date The user needs to calculate the original key by himself. Of course, the user needs to know enough information to calculate the original key. Only the owner of the file can generate the new key in order, and the user can use the current key to generate the previous key. , only produces the immediate, can not produce all.

The blockchain encryption storage system of this embodiment does not trust the file server, and therefore does not rely on the server to distinguish the read and write permissions of the file, but uses two types of keys: a file signature key and a file verification key. The read and write permissions of the file are differentiated. When the user reads or writes the file, these keys are used to verify the digital signature and the hash value of the file. If the verification fails, the user believes that the file has been illegally modified.

The measurement results using the embodiment show that the security and scalability of the encrypted storage system are strong compared with the blockchain of all network communication systems, and the time-to-case ratio of the cryptographic operation is tested for reading and writing of a single file. Ordinary encrypted storage systems are 40% faster. Putting key management rights on the client instead of a trusted server prevents the problem of insufficient server-side capacity caused by expensive cryptographic operations. It mainly relies on file groups to limit the number of keys. Files with the same access attribute are protected by the same key in the same file group, which makes it possible to access files when the file owner is offline, thus avoiding access. Each file needs to be contacted by the owner of the file.

Although the invention has been described with reference to specific illustrative embodiments, it is not subject to these The definition of the embodiments is only limited by the appended claims. It will be appreciated by those skilled in the art that the embodiments of the invention can be modified and modified without departing from the scope and spirit of the invention.

Claims (10)

An encrypted storage system for a blockchain, comprising: (1) The file group (S) consists of files with the same access attributes and at different levels. It is used to reduce the amount of key exchange between users, distinguish between file read and write, and effectively handle the revocation of user access rights. Trusted server authorization file to write; (2) an open file system for embedding an encrypted storage system prototype of a blockchain, which includes an authentication database, the authentication database of the open file system and the file group key of the encrypted storage system itself are in the same programming manner form; (3) A lock box device, comprising a plurality of key distribution schemes, wherein the user uses one of a plurality of key distribution schemes based on the client to customize a security policy and an authentication mechanism for the own file. An encrypted storage system for a blockchain according to claim 1, wherein the key exchange number and the number of key exchanges between the file owner and the user are reduced by the key rotation management key, but are not released at the same time. The obligation of the file owner to initially distribute the key. An encrypted storage system for a blockchain according to claim 2, wherein said open file system defines a basic structure of the first level directory, enabling a user to use the same directory anywhere. The address transparently accesses the file. The process of entering is to enter the “login user name” command. After entering the correct password, the token verification code can be obtained. The user can check the correct verification code by using the check command. If the personal access password is modified, the command is changed with the keyword "user name". The keyword is related to the transaction, including the transaction information digest. When the user leaves the open file system, the logout command must be used. An encrypted storage system for a blockchain according to claim 3, wherein said token verification code is time-sensitive, automatically expires 24 hours after login, and if a new token verification code is required, You need to type in the login information again. The encrypted storage system for a blockchain according to claim 1, wherein all data encryption in the file group (S) is encrypted by a disk, and key management is performed by the client. An encrypted storage system for a blockchain according to claim 1, wherein said plurality of key distribution schemes are differentiated according to ratio values of security and performance, and said lock box The device has multiple keys. The encrypted storage system for a blockchain according to claim 1, wherein the blockchain encryption storage system uses a public key cryptography as a security key for access rights. A method of using an encrypted storage system for a blockchain according to any of the preceding claims, comprising the steps of: (1) Divide the files in the blockchain into blocks, encrypt them in block units, place the block keys in the lock box, and a file group contains several files belonging to the same file owner. The lock boxes belonging to the same group have the same Lock key and signature key; (2) The owner of the file group immediately distributes the lock box key to the user after creating the lock box, and calculates a hash tree for each file, signs the root and puts it into the file header; (3) The encrypted storage system uses asymmetric file verification keys or uses the file signing key protocol to distinguish between read and write users. These keys are used to sign or verify the hash value of the file block contents, thus providing information about file integrity. Proof of (4) When requesting a file, the server will pass the encrypted lock box and the encrypted file block to the user, and then the user opens the lock box using the lock box key and decrypts the file block using the corresponding key in the lock box. A method for using an encrypted storage system for a blockchain according to claim 8, further comprising the step of: for a unified file group, the file owner generates a new key by using the original lock box key. When the user accesses the file, if there is no new lock box key, the new key is obtained from the owner. If the lock box key is not the latest user, the original key is calculated by itself. The method for using an encrypted storage system for a blockchain according to claim 8, further comprising: said blockchain encryption storage system uses two types of file signature keys and file verification keys. The key is used to distinguish between the read and write permissions of the file. When the user reads or writes the file, the file signature key and the file verification key are used to verify the hash value of the digital signature and the file. If the verification fails, the user considers The file was illegally modified.

Images