[go: up one dir, main page]

WO2018032379A1 - Système de stockage sécurisé de fichiers de transactions à distance non sécurisé pour chaîne de blocs - Google Patents

Système de stockage sécurisé de fichiers de transactions à distance non sécurisé pour chaîne de blocs Download PDF

Info

Publication number
WO2018032379A1
WO2018032379A1 PCT/CN2016/095583 CN2016095583W WO2018032379A1 WO 2018032379 A1 WO2018032379 A1 WO 2018032379A1 CN 2016095583 W CN2016095583 W CN 2016095583W WO 2018032379 A1 WO2018032379 A1 WO 2018032379A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
transaction
key
user
storage system
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/095583
Other languages
English (en)
Chinese (zh)
Inventor
张丛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Fanxi Eelectronics Co Ltd
Original Assignee
Shenzhen Fanxi Eelectronics Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Fanxi Eelectronics Co Ltd filed Critical Shenzhen Fanxi Eelectronics Co Ltd
Publication of WO2018032379A1 publication Critical patent/WO2018032379A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data

Definitions

  • the invention relates to the transaction data security problem of a blockchain, in particular to a blockchain untrusted remote transaction file security storage system.
  • blockchain is a secure account book database, composed of data blocks, users can constantly update and upgrade here.
  • the platform looks for data.
  • the blockchain can speed up transaction processing, reduce costs, reduce middlemen, improve market insight, and increase business transparency.
  • Computing and storage are the two basic tasks of computer systems. With the explosive growth of information, storage components will experience direct storage based on single-server, to cluster-based grid storage based on LAN, and finally to WAN-based data grids.
  • Blockchain technology is the most extreme development at present. The intrinsic characteristics of this data storage medium include intelligent storage. The quality of storage service can guarantee service differentiation and performance guarantee for user applications.
  • Storage is object-oriented mass storage, and Network storage must be confidential and complete.
  • the existing Internet does not have a good or convenient way to ensure the confidentiality, integrity, availability, and data of the data stored in the blockchain and the data stored on the storage device. Non-repudiation and the reliability of the entire network storage system, especially the generation of trusted computing technology in blockchain in recent years, puts higher demands on network storage security.
  • the file accesses the system call and converts to a trusted transaction file access request in turn; (3) revokes the user key module, quickly revokes the user's key, removes the key block from the original transaction data file to revoke the user, and then generates The new block encryption key FEK and re-encrypt the file, and update the remaining block encryption key of each user with the new block encryption key FEK; (4)
  • the plaintext save module uses the plaintext save module to save the restored file system The necessary plaintext is repeated to perform an integrity check to encrypt all transaction data access and control information; (5) Timestamp module, in one use The specified interval, time stamping the new transaction file; (6) Multi-transaction file backup module, backing up the transaction file to multiple servers.
  • the public key sending module sends the user's public key to the file owner to add the user, a new read or write user, and the public key is used to encrypt the encryption key and attach it to the original transaction data of the transaction file.
  • the new user's key is attached to the original transaction data, and the user can access the transaction file.
  • an encryption master key MEK and a signature master key MSK are saved for each transaction file user, and each transaction file has a unique symmetric encryption key FEK and a signature key. FSK.
  • the symmetric encryption key FEK is provided to all users, and the signature key FSK is only provided to users who have "write” rights.
  • all transaction files are divided into two parts: the original transaction data file source-file and the transaction data file d-file.
  • the original transaction data file source-file includes: a block encryption master key MEK of the transaction file owner, a user's block encryption key FEK, and if there is a write right, a signature key FSK is also included, and a The file owner's signature master key MSK signed the original transaction data hash value block, text If the owner or user has a key stored in the original data of a file, then he can decrypt the file.
  • the file security storage system also uses the new version of the prompt guarantee principle to ensure that all of the user's transaction files are the latest version to prevent replay attacks.
  • the file secure storage system can use any file delivery mechanism that conforms to the delivery protocol.
  • the revocation user key module uses the active policy to revoke the key, and once the user is terminated, the corresponding transaction file cannot be accessed through the new transaction file guarantee.
  • the untrusted remote transaction file secure storage system for the blockchain although more expensive than the ordinary file security storage system, is slower, but the security factor is greatly improved.
  • FIG. 1 is a schematic structural diagram of an untrusted remote transaction file secure storage system for a blockchain according to an embodiment of the present invention.
  • the essence of a transaction is a relational data structure that contains information about the value transfer of the trading participants. These transaction information is called the accounting ledger.
  • the transaction needs to go through three creation, verification, and writing blockchains. The transaction must be digitally signed to ensure the legality of the transaction.
  • Block All transaction information is stored in the block, and a transaction information is a record, which is stored as a separate record in the blockchain.
  • the block consists of a block header and a data part.
  • the block header field contains various characteristics of the block itself, such as the previous block information, the merkle value, and the timestamp.
  • the block header hash value and block height are the two most important indicators for identifying the block.
  • the block primary identifier is its cryptographic hash value, a digital fingerprint obtained by performing a second hash calculation on the block header by the SHA algorithm.
  • the resulting 32-byte hash value is called the block hash value, or the block header hash value, and only the block header is used for calculation.
  • the block hash value can uniquely and unambiguously identify a block, and any node can independently obtain the block hash value by simply hashing the block header.
  • Blockchain A data structure in which blocks are chained in an orderly fashion.
  • a blockchain is like a vertical stack, with the first block being the first block at the bottom of the stack, and each block is then placed on top of the other blocks.
  • a block When a block is written to a blockchain, it will never change and is backed up to another blockchain server.
  • the system includes a client.
  • the client loads the encryption module. All transaction files are encrypted by the encryption module before being sent to the server for storage. Therefore, neither the server nor the server administrator can access the plaintext.
  • the transaction data processing burden of the end is relatively light, so that it is not necessary to separately set a secure channel when transmitting the transaction file.
  • each transaction file has a unique symmetric encryption key FEK and a signature key FSK, wherein the symmetric encryption key FEK is provided to all users, and the signature key FSK is only provided to A user who has "write" power.
  • the original transaction data file source-file includes: the block encryption master key MEK of the transaction file owner, the user's block encryption key FEK, and if there is write power, it also contains a signature key FSK, and another file has The original transaction data hash value block signed by the signature master key MSK. If the file owner or user has a key stored in the original data of a file, then he can decrypt the file.
  • It also includes revoking the user key module so that the revocation user's key can be executed very quickly and efficiently, that is, removing the key block of the user to be revoked from the original transaction data file, and then generating a new block encryption key FEK and The file is re-encrypted and the remaining block encryption key for each user is updated with the new block encryption key FEK.
  • the user key module is revoked and the active policy is used to revoke the key. Once a user is denied access, the corresponding transaction file cannot be accessed through the new transaction file guarantee.
  • It also includes a plaintext save module that uses the plaintext save module to save the plaintext necessary to restore the file system to perform an integrity check, encrypting all transaction data access and control information, which facilitates the use of legacy file system standard backups.
  • the process that is, if the system must recover from a disaster, all necessary access information needs to be provided, and the system also uses the new version of the prompt guarantee principle to ensure that all of the user's transaction files are up-to-date to prevent replay attacks.
  • Including a multi-transaction file backup module because there is no change to the underlying transaction file system, an attacker can not resist DOS attacks if it deletes all files after the server is compromised.
  • the multi-transaction file backup module backs up the transaction files to multiple servers. This can limit the danger of such an attack.
  • the new read or write user in order to add a user, the new read or write user must send the file owner the owner's public key, thereby using the public key to encrypt the encryption key and attach the original transaction data to the transaction file.
  • the key delivery mechanism has no specific provisions in this file storage system, as long as it is a mechanism that conforms to the delivery protocol.
  • the untrusted remote transaction file secure storage system for the blockchain does not have to check whether the file is a new transaction file, and the first access needs to be properly saved after the original transaction data is transmitted to the user.
  • Ordinary file security storage systems have a large overhead, so the speed is 70% slower, but the security factor is greatly improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

Un système de stockage sécurisé de fichiers de transactions à distance non sécurisé pour une chaîne de blocs comprend : (1) un client, pour charger un module de chiffrement et achever le chiffrement et la transmission de tous les fichiers de transaction; (2) un programme logiciel fantôme, pour capturer tous les appels de système d'accès à un fichier de transaction et convertir séquentiellement les appels en demandes d'accès de fichier de transaction de confiance; (3) un module de révocation de clé d'utilisateur, pour révoquer rapidement une clé d'un utilisateur; (4) un module de stockage de texte brut, pour effectuer un contrôle d'intégrité; (5) un module d'horodatage, pour ajouter un horodatage à un nouveau fichier de transaction; (6) un module de sauvegarde de fichier multi-transaction, pour limiter un endommagement à partir d'une attaque de DOS qui ne peut pas être évitée en raison du fait qu'un système de fichier de transaction sous-jacent n'est pas modifié; et (7) un module d'envoi de clé publique utilisé pour ajouter un utilisateur. Au moyen du système de stockage sécurisé de fichier, bien que les surdébits soient supérieurs à ceux d'un système de stockage sécurisé de fichier normal et que la vitesse soit inférieure, le coefficient de sécurité est considérablement amélioré.
PCT/CN2016/095583 2016-08-13 2016-08-16 Système de stockage sécurisé de fichiers de transactions à distance non sécurisé pour chaîne de blocs Ceased WO2018032379A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610665556.1A CN106131048B (zh) 2016-08-13 2016-08-13 一种用于区块链的非信任远程交易文件安全存储系统
CN201610665556.1 2016-08-13

Publications (1)

Publication Number Publication Date
WO2018032379A1 true WO2018032379A1 (fr) 2018-02-22

Family

ID=57259108

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/095583 Ceased WO2018032379A1 (fr) 2016-08-13 2016-08-16 Système de stockage sécurisé de fichiers de transactions à distance non sécurisé pour chaîne de blocs

Country Status (2)

Country Link
CN (1) CN106131048B (fr)
WO (1) WO2018032379A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108898419A (zh) * 2018-05-31 2018-11-27 中国联合网络通信集团有限公司 奖励信息处理方法、装置及区块链节点
CN109831479A (zh) * 2018-12-20 2019-05-31 深圳智乾区块链科技有限公司 区块链的数据处理方法和系统
CN114444132A (zh) * 2022-01-18 2022-05-06 昆明易云电力技术有限公司 一种基于区块链的电力碳排放存证系统
US12008144B2 (en) 2017-03-22 2024-06-11 Siemens Aktiengesellschaft Method and apparatus for tamper-proof storage of information in respect of object-related measures

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107944255B (zh) * 2016-10-13 2020-08-04 深圳市图灵奇点智能科技有限公司 一种面向区块链的密钥管理方法
CN107070660B (zh) * 2017-03-03 2020-03-17 上海唯链信息科技有限公司 一种区块链加密射频芯片的存储设计方法
CN107066561A (zh) * 2017-03-30 2017-08-18 中国联合网络通信集团有限公司 数据管理方法及平台
CN107067720B (zh) * 2017-04-01 2020-10-27 成都信息工程大学 一种基于区块链的城市实时交通系统及方法
CN107094145B (zh) * 2017-05-02 2019-09-17 北京汇通金财信息科技有限公司 基于区块链的数据处理方法、服务器及系统
CN108881120B (zh) * 2017-05-12 2020-12-04 创新先进技术有限公司 一种基于区块链的数据处理方法及设备
EP3435270B1 (fr) * 2017-07-27 2020-09-23 Siemens Aktiengesellschaft Dispositif et procédé de fonctionnement protégé par cryptographie d'une machine virtuelle
CN108768994B (zh) * 2018-05-22 2021-07-27 北京小米移动软件有限公司 数据匹配方法、装置及计算机可读存储介质
CN108846289A (zh) * 2018-06-08 2018-11-20 北京京东尚科信息技术有限公司 选举信息处理方法和处理系统及选举系统和存储介质
CN109063498A (zh) * 2018-07-27 2018-12-21 深圳市新名泽科技有限公司 数字资产存储方法、装置、恢复方法及装置
CN109039649B (zh) * 2018-08-03 2021-08-06 北京大学深圳研究生院 一种ccn中基于区块链的密钥管理方法、装置及存储介质
CN109344630B (zh) * 2018-09-18 2021-07-02 百度在线网络技术（北京）有限公司 区块生成方法、装置、设备和存储介质
CN110933042B (zh) * 2019-11-06 2021-09-14 福建福链科技有限公司 一种适用于联盟链的数据安全信使方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1658550A (zh) * 2004-04-16 2005-08-24 威盛电子股份有限公司 用于执行密码操作的装置和方法
CN102014133A (zh) * 2010-11-26 2011-04-13 清华大学 在云存储环境下一种安全存储系统的实现方法
CN104580487A (zh) * 2015-01-20 2015-04-29 成都信升斯科技有限公司 一种海量数据存储系统及处理方法
CN104601579A (zh) * 2015-01-20 2015-05-06 成都市酷岳科技有限公司 一种保障信息安全的计算机系统及其方法
CN105812126A (zh) * 2016-05-19 2016-07-27 齐鲁工业大学 健康区块链数据加密密钥的轻量级备份与高效恢复方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10230526B2 (en) * 2014-12-31 2019-03-12 William Manning Out-of-band validation of domain name system records

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1658550A (zh) * 2004-04-16 2005-08-24 威盛电子股份有限公司 用于执行密码操作的装置和方法
CN102014133A (zh) * 2010-11-26 2011-04-13 清华大学 在云存储环境下一种安全存储系统的实现方法
CN104580487A (zh) * 2015-01-20 2015-04-29 成都信升斯科技有限公司 一种海量数据存储系统及处理方法
CN104601579A (zh) * 2015-01-20 2015-05-06 成都市酷岳科技有限公司 一种保障信息安全的计算机系统及其方法
CN105812126A (zh) * 2016-05-19 2016-07-27 齐鲁工业大学 健康区块链数据加密密钥的轻量级备份与高效恢复方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12008144B2 (en) 2017-03-22 2024-06-11 Siemens Aktiengesellschaft Method and apparatus for tamper-proof storage of information in respect of object-related measures
CN108898419A (zh) * 2018-05-31 2018-11-27 中国联合网络通信集团有限公司 奖励信息处理方法、装置及区块链节点
CN109831479A (zh) * 2018-12-20 2019-05-31 深圳智乾区块链科技有限公司 区块链的数据处理方法和系统
CN114444132A (zh) * 2022-01-18 2022-05-06 昆明易云电力技术有限公司 一种基于区块链的电力碳排放存证系统

Also Published As

Publication number Publication date
CN106131048A (zh) 2016-11-16
CN106131048B (zh) 2020-05-19

Similar Documents

Publication Publication Date Title
WO2018032379A1 (fr) Système de stockage sécurisé de fichiers de transactions à distance non sécurisé pour chaîne de blocs
CN115242555B (zh) 一种可监管的跨链隐私数据共享方法及装置
US10917234B2 (en) Blockchain for on-chain management of off-chain storage
US11777712B2 (en) Information management in a database
Li et al. A hybrid cloud approach for secure authorized deduplication
CN108076057B (zh) 一种基于区块链的数据保全系统及方法
CN102394894B (zh) 一种基于云计算的网络虚拟磁盘文件安全管理方法
CN106330452B (zh) 一种用于区块链的安全网络附加装置及方法
US20200322128A1 (en) Zero-knowledge proof for blockchain endorsement
US20190230072A1 (en) Securing files using per-file key encryption
US11893577B2 (en) Cryptographic key storage system and method
Miller et al. Strong security for distributed file systems
US9160535B2 (en) Truly anonymous cloud key broker
WO2018032377A1 (fr) Système de stockage de fichiers de sécurité en lecture seule pour chaîne de blocs, et procédé associé
WO2018032374A1 (fr) Système de mémorisation chiffrée pour chaîne de blocs, et procédé utilisant ce système
CN110519049A (zh) 一种基于可信执行环境的云端数据保护系统
JP2013524352A (ja) 移動中のデータをセキュア化するためのシステムおよび方法
US11494508B2 (en) Secrets as a service
WO2018032375A1 (fr) Système de stockage survivant et procédé de chaîne de blocs
WO2023078055A1 (fr) Procédé et système de partage sécurisé de données entre une première zone et une seconde zone
US20240048380A1 (en) Cryptography-as-a-Service
US20250363237A1 (en) Virtualization for privacy control
WO2018032378A1 (fr) Système de stockage de fichiers chiffrés commandé par programme pour chaîne de blocs, et procédé associé
US20240048532A1 (en) Data exchange protection and governance system
WO2017020720A1 (fr) Procédé et dispositif pour obtenir un accès à des données

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16913139

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16913139

Country of ref document: EP

Kind code of ref document: A1