WO2022193119A1 - Blockchain data protection method and system - Google Patents

Abstract

The present invention provides a blockchain data protection method and system. The method comprises: a blockchain node sends an encryption request or a decryption request; a root key unit updates a secondary key according to a root key in accordance with a preset period; a secondary key unit updates a communication key according to the current secondary key in accordance with preset time; and a communication key unit receives the encryption request or the decryption request, performs an encryption operation on the blockchain node according to the current communication key and the encryption request, and performs a decryption operation on the blockchain node according to the current communication key and the decryption request. In the present invention, blockchain data is subjected to encryption and protection on the basis of hierarchical key management, thereby achieving high security; a key is expanded into a root key, a secondary key, and a communication key, such that the security of the system is greatly improved, and a small required storage space and low maintenance cost are achieved.

Description

A blockchain data protection method and system technical field

The present invention relates to the field of blockchain, and in particular, to a method and system for protecting blockchain data.

Background technique

Since the release of Bitcoin in 2009, its underlying structure, blockchain, has received extensive attention. In the years of development, blockchain technology has been used only for digital currency to be used in financial settlement, and now it has expanded beyond the financial industry, covering all aspects of human social life, including judicial, medical, logistics, government affairs, military, etc. each field. The content on the blockchain has also expanded from only storing user amounts to various types of data, including text data, spatiotemporal data, and log data.

Due to the multi-party joint accounting feature of the blockchain, the user's data is public, so special means are needed to ensure the security of the user's data. The blockchain in the virtual currency stage adopts the method of user anonymity to ensure the privacy of the user, while the blockchain of the alliance chain and the complex data adopts the data encryption method on the chain to ensure the security of the data. The user encrypts the data with a symmetric cryptographic algorithm before submitting the data to the chain, and then decrypts the data when using the data on the chain.

But the problem with the current blockchain is that nodes only use one key for encryption and decryption operations. Once the key is leaked, all data on the chain will be leaked. And changing the key can only protect the data after that, and all the data before the leakage can no longer be protected, so the leakage of the key will cause great losses. At the same time, blockchain nodes need to communicate with other nodes in the blockchain, which will inevitably be exposed in the public network, which is easy to be attacked by attackers, and the risk of key leakage is high.

Therefore, there is a need for a data protection method for blockchain that can solve the above problems.

SUMMARY OF THE INVENTION

Based on the problems existing in the prior art, the present invention provides a block chain data protection method and system. The specific plans are as follows:

A blockchain data protection method, applied to a system including a root key unit, a secondary key unit and a communication key unit, the method includes a data protection mode:

The blockchain node sends an encryption request or a decryption request;

The root key unit updates the secondary key according to the root key according to a preset period;

The secondary key unit updates the communication key according to the current secondary key according to the preset time;

The communication key unit receives the encryption request or the decryption request, performs an encryption operation on the blockchain node according to the current communication key and the encryption request, and performs an encryption operation on the blockchain node according to the current communication key and the decryption request. Perform a decryption operation on the blockchain node.

In a specific embodiment, the method further includes a data recovery mode:

The blockchain node sends a data recovery request containing the communication key;

The communication key unit parses out the communication key according to the data recovery request, determines whether the communication key is correct, if not, generates a first key request, and if so, is the blockchain node perform decryption operations;

The secondary key unit parses out the secondary key according to the first key request, and judges whether the secondary key is correct; if not, generates a second key request; After the level key calculates the communication key, the decryption operation is performed;

The root key unit parses out the root key according to the second key request, and judges whether the root key is correct, and if so, calculates the secondary key and the communication key according to the root key. decryption operation.

In a specific embodiment, wherein, the "decryption operation after calculating the communication key according to the secondary key" specifically includes:

The secondary key unit calculates a communication key according to the secondary key;

setting the communication key as the current communication key;

The communication key unit performs the decryption operation for the blockchain node according to the communication key;

Wherein, the "decryption operation after calculating the secondary key and the communication key according to the root key" specifically includes:

The root key unit calculates a secondary key according to the second key request;

setting the secondary key as the current secondary key;

The secondary key unit calculates a communication key according to the secondary key;

setting the communication key as the current communication key;

The communication key unit performs the decryption operation for the blockchain node according to the communication key.

In a specific embodiment, the root key unit only accesses the secondary key unit when the secondary key is updated;

And/or the secondary key unit and the communication key unit are set on different servers.

In a specific embodiment, the root key unit includes a root key calculation module and a root key storage module;

The root key storage module stores all root keys, and records the number of secondary keys generated;

The root key calculation module calculates secondary keys according to the number of secondary keys, and each secondary key corresponds to a secondary key number.

In a specific embodiment, the secondary key unit includes a secondary key calculation module and a secondary key storage module;

The secondary key storage module only stores the current secondary key and its secondary key number, and records the number of communication keys generated according to the current secondary key. Cleared when the secondary key is updated;

The secondary key calculation module calculates a communication key according to the current secondary key and the number of the communication keys, each of the communication keys corresponds to a communication key number, and the communication key number is provided with The secondary key number.

In a specific embodiment, the communication key unit includes an encryption/decryption module and a communication key storage module;

The encryption and decryption module performs encryption operation or decryption operation on the blockchain node;

The communication key storage module only stores the current communication key and its communication key number.

In a specific embodiment, the secondary key unit includes a plurality of key subunits, the plurality of key subunits are connected in sequence, and layer-by-layer encryption is implemented by generating subkeys.

A blockchain data protection system, the system connects blockchain nodes, including,

Communication key unit: used to receive an encryption request or decryption request sent by a blockchain node, perform an encryption operation on the blockchain node according to the current communication key and the encryption request, and perform an encryption operation on the blockchain node according to the current communication key and the encryption request. Decrypt the blockchain node according to the decryption request;

Root key unit: used to update the secondary key according to the root key according to a preset period;

Secondary key unit: used to update the communication key according to the current secondary key according to the preset time.

In a specific embodiment,

The communication key unit further includes: receiving a data recovery request containing the communication key sent by the blockchain node, parsing the communication key according to the data recovery request, and determining the communication key. Whether the key is correct, if not, generate a first key request, if so, perform decryption operation for the blockchain node;

The secondary key unit further includes: for parsing out the secondary key according to the first key request, judging whether the secondary key is correct, if not, generating a second key request, if yes, Then perform a decryption operation after calculating the communication key according to the secondary key;

The root key unit further includes: for analyzing the root key according to the second key request, and judging whether the root key is correct, if so, calculating the secondary key and the root key according to the root key. The decryption operation is performed after the communication key.

In a specific embodiment, the root key unit includes,

Root key storage module: used to store all the root keys and record the number of secondary keys generated;

Root key calculation module: used to calculate the secondary key according to the quantity of the secondary key.

In a specific embodiment, the secondary key unit includes,

Secondary key storage module: used to store the current secondary key and its secondary key number, and record the number of generated communication keys;

Secondary key calculation module: used to calculate the communication key according to the number of the communication keys.

In a specific embodiment, the communication key unit includes,

Encryption and decryption module: used to encrypt or decrypt the blockchain node;

Communication key storage module: used to store the current communication key and its communication key number, where the communication key number includes the secondary key number.

Beneficial effects:

Aiming at the defects of the prior art, the present invention proposes a block chain data protection method and system, which encrypts and protects block chain data based on hierarchical key management, and has high security.

By providing key management and data encryption and decryption, the key is expanded into the root key, secondary key and communication key, which greatly improves the security.

By isolating the key from the blockchain network, in the event of a key leak, data leakage can be minimized, which solves the drawback of the prior art that all data on the chain will be leaked if the key is leaked.

The key is isolated from the blockchain network, reducing the possibility of being attacked by hackers and further ensuring data security.

There is no need to store historical keys, which can reduce the maintenance cost of the cryptographic system, reduce the storage space and avoid the possibility of leaking all encryption and decryption keys at one time.

Users can choose a password protection scheme according to the security level.

After the blockchain data is lost, each key unit can actively initiate a request to the upper-level key unit to achieve data recovery.

Users only need to input the current or historically used communication key to achieve data recovery, which is highly practical.

Modularize the blockchain data protection method to form a specific system, making it more practical.

The blockchain data protection system is transparent to the blockchain framework, only the traditional encryption service needs to be replaced without any changes to the blockchain framework.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the embodiments. It should be understood that the following drawings only show some embodiments of the present invention, and therefore do not It should be regarded as a limitation of the scope, and for those of ordinary skill in the art, other related drawings can also be obtained according to these drawings without any creative effort.

1 is a schematic diagram of a blockchain according to an embodiment of the present invention;

2 is a flowchart of a blockchain data protection method according to Embodiment 1 of the present invention;

3 is a diagram of another blockchain data protection method according to Embodiment 1 of the present invention;

4 is a flowchart of a blockchain data protection method according to Embodiment 2 of the present invention;

Fig. 5 is the data recovery mode flow chart of Embodiment 2 of the present invention;

FIG. 6 is a schematic diagram of the application of the blockchain data protection system according to Embodiment 3 of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

According to the characteristics of the block chain environment, the present invention proposes a block chain data protection method and system, and uses a hierarchical key management method to protect the block chain data.

A typical blockchain-based business system includes three parts: blockchain network, node and business system, as shown in Figure 1 of the specification. A blockchain network is a linked list composed of blocks that is jointly maintained by multiple nodes. Each block in the linked list has a hash pointer to the previous block, thus ensuring that the data on the blockchain cannot be tampered with. The blockchain node maintains a database locally, and the content stored in the database is the current state of the data on the blockchain. The blockchain system operates the database through transactions, and the transactions on the chain will modify the contents of the database. The data in the node's local database is stored in plaintext, but when the node submits the data to the blockchain, that is, when constructing a transaction, the data will be encrypted and submitted. After the consensus of the transaction blockchain network, the node decrypts the content of the transaction and updates the local database. The business system runs the unit provided by the user, selects the data to be saved on the chain, and submits it to the node. After the business system is accidentally damaged, the blockchain can restore the data on the chain of the business system, that is, the disaster recovery function of the blockchain.

It should be noted that the key in this application includes but is not limited to any data format that can provide an encryption function.

Example 1

This embodiment proposes a blockchain data protection method, which realizes the protection of blockchain data by providing multi-level keys and modifying the keys regularly. The specific process is such as accompanying drawing 2 of the description, and the specific scheme is as follows:

A block chain data protection method is applied to a system including a root key unit, a secondary key unit and a communication key unit. The method includes a data protection mode, and the specific steps of the data protection mode are:

The blockchain node sends an encryption request or a decryption request;

The root key unit updates the secondary key according to the root key according to a preset period;

The secondary key unit updates the communication key according to the current secondary key according to the preset time;

The communication key unit receives an encryption request or a decryption request, performs an encryption operation on the blockchain node according to the current communication key, and performs a decryption operation on the blockchain node according to the current communication key and the decryption request.

In this embodiment, the communication key unit is connected to the blockchain node, the blockchain node sends an encryption request or a decryption request, and the communication key unit performs an encryption operation or a decryption operation according to the request.

The encryption operation includes: the communication key unit encrypts the blockchain node according to the encryption request, and the user needs to provide the correct communication key to extract the data in the blockchain node. The decryption operation includes: the communication key unit unlocks the encrypted blockchain node according to the communication key provided by the blockchain node.

In this embodiment, the root key unit includes a root key storage module and a root key calculation module.

The root key storage module stores all root keys, including currently used root keys and historical root keys, and is provided with a secondary key counter. The secondary key counter is used to record the number of secondary keys that have been generated. Each time a secondary key is generated, the secondary key counter increases by 1.

The root key calculation module calculates the next secondary key according to the value of the secondary key counter, and increments the secondary key counter by 1.

In particular, the root key unit can generate one or more secondary keys at a time, select one or more secondary keys as the current secondary key and send it to the secondary key unit.

The root key has the highest security level. The root key unit can be stored in separate hardware or offline machine, and the secondary key unit is only accessed when the secondary key is updated. Offline machines include servers that are not connected to the Internet or servers that are not connected to the blockchain network. Separate hardware storage includes, but is not limited to, hardware storage media, such as mobile hard disks. As the initial key, the root key has the highest level of security. Using separate hardware storage or offline machine storage can prevent hackers from obtaining the root key through network attacks, thereby protecting blockchain data. The user can update the root key through the root key unit at a preset period, or manually modify the root key.

It should be noted that the root key may be set manually, or may be randomly generated by the root key unit.

In this embodiment, the secondary key unit includes a secondary key storage module and a secondary key calculation module, and the secondary key unit needs to be configured on an independent machine, and not the same as the communication key unit on the server.

The secondary key storage module only stores the currently used secondary key, and is provided with a communication key counter. The key storage module will not store the secondary key used in history, but only the currently used secondary key and the number of the secondary key. The communication key counter counts the communication key generated by the current secondary key, and the communication key counter will be cleared when the secondary key is updated.

The secondary key calculation module calculates the next communication key according to the value of the communication key counter, and increments the communication key counter by 1. The secondary key calculation module can generate multiple communication keys according to a secondary key.

The secondary key unit is the second-level key unit, and its security is second only to the root key. The secondary key is the basis for the generation of communication keys, which further improves the security of the system. It should be noted that, since the number of secondary keys is uncertain, the secondary key unit only stores the currently used secondary keys, and the currently used secondary keys also include one or more secondary keys. In order to save storage costs and further improve the security of the system and prevent hackers from deciphering the current secondary key based on the historical secondary key, the secondary key storage module will not store the historically used secondary key, only Stores the currently used secondary key and the number of the secondary key. The secondary key unit generates one or more communication keys based on the secondary key.

The communication key unit includes a communication key storage module and an encryption and decryption module, and the communication key unit can be configured on a separate machine or on the same machine as the blockchain node.

The communication key storage module stores the currently used communication key and the serial number of the communication key. The same as the secondary key unit, this key storage module does not store historical communication keys, but only the currently used communication keys and their numbers. The serial number of the communication key includes the serial number of the secondary key and the serial number in the secondary key unit corresponding to the current communication key when it is generated.

The encryption and decryption module obtains the input encryption request or decryption request from the blockchain node, performs encryption or decryption operations according to the parameters, and returns it to the blockchain node.

In the data protection mode, that is, the environment in which the blockchain system is running normally, the communication key unit provides encryption operations and decryption operations to the blockchain nodes. The secondary key unit periodically initiates a key update request to the communication key module. The period for the root key unit to update the secondary key is determined by the user. At this time, all key updates are one-way, and the upper-level key unit initiates an update request to the next-level key unit. The next-level key unit cannot actively initiate a request to the upper-level. Realize that when a communication key is lost, only part of the data will be lost, and most of the data will remain safe.

In a specific implementation, the secondary key unit may be omitted as an intermediate device. Data encryption can be achieved through the root key unit and the communication key unit. The root key unit generates a communication key within a preset period according to the root key, and the communication key unit performs encryption and decryption operations according to the communication key. This embodiment is suitable for a blockchain environment with a low security level. The root key unit adopts a separate storage medium, and only accesses the communication key unit when the communication key is updated.

In a specific implementation, the secondary key unit as an intermediate device includes a plurality of subunits. Layer-by-layer encryption is performed between multiple sub-units through the generated key. For example, the secondary key unit includes a first key unit, a second key unit, and a third key unit. The first key unit generates the first key according to the current secondary key, and the second key unit generates the first key according to the current secondary key. The first key generates the second key, and the third key unit generates the communication key according to the second key, as shown in FIG. 3 of the specification. This embodiment is suitable for a blockchain environment with a high security level, and an appropriate number of subunits can be selected for encryption according to the security level.

According to the characteristics of the blockchain environment, this embodiment proposes a blockchain data protection method, which provides key management and data encryption and decryption, and expands the key into a root key, a secondary key, and a communication key, two of which are The primary key is generated from the root key, and the communication key is generated from the secondary key. The root key has the highest level of security and can be isolated using separate hardware or stored on a separate machine, isolated from the Internet, with access to the secondary key unit only when in use. The secondary key is used to periodically generate the communication key, which is stored on a different machine from the machine where the communication key is stored, isolated from the external network, and only communicates with the machine that uses the communication key to encrypt and decrypt. The communication key can be stored on the blockchain node machine or other machines connected to the node machine, and the key management system provides the node with an encryption and decryption unit based on the communication key.

This embodiment isolates the key from the blockchain network. In the event of a key leak, data leakage is minimized, which solves the problem in the prior art that all data on the chain will be leaked if the key is leaked. And the key is isolated from the blockchain network, reducing the possibility of being attacked by hackers and further ensuring data security. There is no need to store historical keys, which can reduce the maintenance cost of the cryptographic system, reduce the storage space and avoid the possibility of leaking all encryption and decryption keys at one time. In addition, users can also choose an appropriate password protection scheme according to the security level of the blockchain data.

Example 2

On the basis of the blockchain data protection method in Embodiment 1, this embodiment adds a data recovery mode to further expand the functionality of the method. The process steps of the data recovery mode are as shown in Figure 4 of the description, and the specific scheme is as follows:

Data Recovery Mode:

The blockchain node sends a data recovery request containing the communication key;

The communication key unit parses out the communication key according to the data recovery request, determines whether the communication key is correct, if not, generates a first key request, and if so, performs decryption operation for the blockchain node;

The secondary key unit parses out the secondary key according to the first key request, and judges whether the secondary key is correct, if not, generates a second key request, and if so, performs the first decryption operation for the blockchain node ;

The root key unit performs a second decryption operation on the blockchain node according to the second key request key.

The flowchart of the data recovery mode is shown in Figure 5 of the specification.

The communication key unit receives the data recovery request from the blockchain node. The data recovery request is only for the data recovery mode, and the data recovery request contains the communication key. The communication key unit analyzes the communication key of the data recovery request, and determines whether the communication key is correct, that is, whether the communication key is the current communication key. If the judgment is yes, the communication key is correct, and the communication key unit decrypts the blockchain node, obtains the decrypted data stored in the blockchain node, and returns it to the blockchain node to achieve data recovery. If the judgment is negative, the communication key is incorrect, and the communication key unit generates a first key request to the secondary key unit.

The secondary key unit receives the second key request, derives the secondary key according to the communication key, and the secondary key unit judges whether the secondary key is the currently used secondary key. If the judgment result is yes, the secondary key is correct, and the secondary key unit performs the first decryption operation. The first decryption operation is: the secondary key unit calculates the communication key according to the secondary key, sets the communication key as the current communication key, and the communication key unit receives the new communication key at this time, If it is the same as the communication key in the data recovery request, the communication key unit decrypts the blockchain node, obtains the decrypted data stored in the blockchain node, and returns it to the blockchain node to achieve data recovery. If the judgment result is no, the secondary key is incorrect, and the secondary key unit generates a second key request to the root key unit.

The root key unit receives the second key request, derives the root key according to the secondary key, and the root key unit determines whether the root key is a used or currently used root key. If the judgment result is yes, the root key is correct, and the root key unit performs the second decryption operation. The second decryption operation includes: the root key unit calculates the secondary key according to the root key, and stores the secondary key as the current secondary key. When the new secondary key received by the secondary key unit is consistent with the secondary key in the first key request, the secondary key unit performs the first decryption operation. If the judgment structure is negative, the root key is incorrect, the root key unit refuses to provide the key, and data recovery fails.

Since the secondary key unit and the communication key unit only store the currently used key, when the key is lost, it is only necessary to input the used communication key, and the root key unit can gradually deduce the key according to the key. the corresponding root key.

In the data recovery mode, that is, due to the loss of blockchain data due to an accident, each key unit can actively initiate a request to the upper-level key unit. It is recommended that the system be offline for data recovery. After receiving the decryption request, the communication key unit judges the key information, requests the key from the secondary key unit, the secondary key unit judges the parent key of the key, and requests the key from the root key unit. After the root key unit receives the key request unit, it calculates the key according to the number and returns it to the secondary key unit, and the secondary key unit calculates the communication key according to the received secondary key and key number, It is sent to the communication key unit, which uses the key to decrypt the data, and finally returns it to the blockchain node. After executing this process once, the key system returns the decrypted data to the blockchain node, and the blockchain node uses the decrypted data to update the local database and business system database for data recovery. Data recovery is complete until all data on the blockchain is updated to the local database and business database.

On the basis of Embodiment 1, this embodiment adds a data recovery mode to further expand the functionality of the method. After the blockchain data is lost, each key unit can actively initiate a request to the upper-level key unit to achieve data recovery. Users only need to input the current or historically used communication key to achieve data recovery, which is highly practical.

Example 3

On the basis of Embodiment 2, this embodiment systematizes a blockchain data protection method proposed in Embodiment 2 to form a blockchain data protection system. The schematic diagram of each module is shown in Figure 4 of the description. The specific plans are as follows:

A blockchain data protection system, data protection mode and data recovery mode.

In the data protection mode, the system includes a communication key unit, a root key unit and a secondary key unit. Specifically include:

Communication key unit: used to receive the encryption request or decryption request sent by the blockchain node, encrypt the blockchain node according to the current communication key, and decrypt the blockchain node according to the current communication key and decryption request. operate;

Root key unit: used to update the current secondary key according to the root key according to a preset period;

Secondary key unit: used to update the current communication key according to the current secondary key according to the preset time;

In the data recovery mode, the system includes a communication key unit, a root key unit and a secondary key unit. Specifically include:

Communication key unit: used to receive a data recovery request containing a communication key sent by the blockchain node, parse out the communication key according to the data recovery request, determine whether the communication key is correct, if not, generate a first key request, If so, decrypt it for the blockchain node;

Secondary key unit: used to parse out the secondary key according to the first key request, and determine whether the secondary key is correct; if not, generate a second key request; if so, perform the second key request for the blockchain node A decryption operation; the secondary key unit may include multiple key sub-units to further improve the security of the system.

Root key unit: used to parse out the root key according to the second key request, determine whether the root key is correct, and if so, perform a second decryption operation.

The first decryption operation includes: the secondary key unit calculates the communication key according to the secondary key; the communication key is set as the current communication key; the communication key unit decrypts the blockchain node according to the communication key operate;

The second decryption operation includes: the root key unit calculates the secondary key according to the second key request; sets the secondary key as the current secondary key; and executes the first decryption operation.

Specifically, the root key unit includes a root key storage module and a root key calculation module.

Root key storage module: used to store all root keys and record the number of secondary keys generated; the root key storage module stores all root keys and is provided with a secondary key counter. The secondary key counter is used to record the number of secondary keys that have been generated. Each time a secondary key is generated, the counter increases by 1.

Root key calculation module: used to calculate the secondary key according to the number of secondary keys. The root key calculation module calculates the next secondary key according to the value of the secondary key counter, and increments the secondary key counter by 1.

Specifically, the secondary key unit includes a secondary key storage module and a secondary key calculation module.

Secondary key storage module: used to store the currently used secondary key and its secondary key number, and record the number of generated communication keys; the secondary key storage module only stores the currently used secondary key, And set a communication key counter. The key storage module will not store the secondary key used in history, but only the currently used secondary key and the number of the secondary key. The communication key counter is the number of communication keys generated by the current secondary key, and the communication key counter will be cleared when the secondary key is updated.

Secondary key calculation module: used to calculate the communication key according to the number of communication keys. The secondary key calculation module calculates the next communication key according to the value of the communication key counter, and increments the communication key counter by 1.

Specifically, the communication key unit includes an encryption/decryption module and a communication key storage module.

Encryption and decryption module: used to encrypt or decrypt blockchain nodes;

Communication key storage module: used to store the currently used communication key and its communication key number, the communication key number including the secondary key number.

The blockchain data protection system proposed in this embodiment is transparent to the blockchain framework, only the traditional encryption service needs to be replaced without any changes to the blockchain framework, and the application to the blockchain is shown in Figure 6 of the specification. .

Aiming at the prior art, the present invention proposes a block chain data protection method and system, which encrypts and protects block chain data based on hierarchical key management, and has high security. By providing key management and data encryption and decryption, the key is expanded into the root key, secondary key and communication key, which greatly improves the security. By isolating the key from the blockchain network, in the event of a key leak, data leakage can be minimized, which solves the drawback of the prior art that all data on the chain will be leaked if the key is leaked. And the key is isolated from the blockchain network, reducing the possibility of being attacked by hackers and further ensuring data security. There is no need to store historical keys, which can reduce the maintenance cost of the cryptographic system and avoid the possibility of leaking all encryption and decryption keys at one time. Users can choose a password protection scheme according to the security level. After the blockchain data is lost, each key unit can actively initiate a request to the upper-level key unit to achieve data recovery. Users only need to input the current or historically used communication key to achieve data recovery, which is highly practical. Modularize the blockchain data protection method to form a specific system, making it more practical. The blockchain data protection system is transparent to the blockchain framework, only the traditional encryption service needs to be replaced without any changes to the blockchain framework.

Those of ordinary skill in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general-purpose computing device, and they can be centralized on a single computing device, or distributed on a network composed of multiple computing devices. Optionally, they may be implemented in program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be fabricated separately into individual integrated circuit modules, or a plurality of modules of them Or the steps are made into a single integrated circuit module to realize. As such, the present invention is not limited to any specific combination of hardware and software.

Note that the above are only preferred embodiments of the present invention and applied technical principles. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and can also include more other equivalent embodiments without departing from the concept of the present invention. The scope is determined by the scope of the appended claims.

The above disclosures are only a few specific implementation scenarios of the present invention, however, the present invention is not limited thereto, and any changes that can be conceived by those skilled in the art should fall within the protection scope of the present invention.

Claims (13)

A blockchain data protection method, characterized in that it is applied to a system including a root key unit, a secondary key unit and a communication key unit, and the method includes a data protection mode: The blockchain node sends an encryption request or a decryption request; The root key unit updates the secondary key according to the root key according to a preset period; The secondary key unit updates the communication key according to the current secondary key according to the preset time; The communication key unit receives the encryption request or the decryption request, performs an encryption operation on the blockchain node according to the current communication key and the encryption request, and performs an encryption operation on the blockchain node according to the current communication key and the decryption request. Perform a decryption operation on the blockchain node. The method of claim 1, wherein the method further comprises a data recovery mode: The blockchain node sends a data recovery request containing the communication key; The communication key unit parses out the communication key according to the data recovery request, determines whether the communication key is correct, if not, generates a first key request, and if so, is the blockchain node perform decryption operations; The secondary key unit parses out the secondary key according to the first key request, and judges whether the secondary key is correct; if not, generates a second key request; After the level key calculates the communication key, the decryption operation is performed; The root key unit parses out the root key according to the second key request, and judges whether the root key is correct, and if so, calculates the secondary key and the communication key according to the root key. decryption operation. The method according to claim 2, wherein the "decryption operation after calculating the communication key according to the secondary key" specifically comprises: The secondary key unit calculates a communication key according to the secondary key; setting the communication key as the current communication key; The communication key unit performs the decryption operation for the blockchain node according to the communication key; Wherein, the "decryption operation after calculating the secondary key and the communication key according to the root key" specifically includes: The root key unit calculates a secondary key according to the second key request; setting the secondary key as the current secondary key; The secondary key unit calculates a communication key according to the secondary key; setting the communication key as the current communication key; The communication key unit performs the decryption operation for the blockchain node according to the communication key. The method according to claim 2, wherein the root key unit accesses the secondary key unit only when the secondary key is updated; And/or the secondary key unit and the communication key unit are set on different servers. The method according to claim 2, wherein the root key unit comprises a root key calculation module and a root key storage module; The root key storage module stores all root keys, and records the number of secondary keys generated; The root key calculation module calculates secondary keys according to the number of secondary keys, and each secondary key corresponds to a secondary key number. The method according to claim 5, wherein the secondary key unit comprises a secondary key calculation module and a secondary key storage module; The secondary key storage module only stores the current secondary key and its secondary key number, and records the number of communication keys generated according to the current secondary key. Cleared when the secondary key is updated; The secondary key calculation module calculates a communication key according to the current secondary key and the number of the communication keys, each of the communication keys corresponds to a communication key number, and the communication key number is provided with The secondary key number. The method according to claim 6, wherein the communication key unit comprises an encryption/decryption module and a communication key storage module; The encryption and decryption module performs encryption operation or decryption operation on the blockchain node; The communication key storage module only stores the current communication key and its communication key number. The method according to claim 2, wherein the secondary key unit includes a plurality of key sub-units, and the plurality of the key sub-units are connected in sequence, and layer-by-layer encryption is implemented by generating sub-keys . A blockchain data protection system, characterized in that the system is connected to a blockchain node, including, Communication key unit: used to receive an encryption request or decryption request sent by a blockchain node, perform an encryption operation on the blockchain node according to the current communication key and the encryption request, and perform an encryption operation on the blockchain node according to the current communication key and the encryption request. Decrypt the blockchain node according to the decryption request; Root key unit: used to update the secondary key according to the root key according to a preset period; Secondary key unit: used to update the communication key according to the current secondary key according to the preset time. The system of claim 9, wherein: The communication key unit further includes: receiving a data recovery request containing the communication key sent by the blockchain node, parsing the communication key according to the data recovery request, and determining the communication key. Whether the key is correct, if not, generate a first key request, if so, perform decryption operation for the blockchain node; The secondary key unit further includes: for parsing out the secondary key according to the first key request, judging whether the secondary key is correct, if not, generating a second key request, if yes, Then perform a decryption operation after calculating the communication key according to the secondary key; The root key unit further includes: for analyzing the root key according to the second key request, and judging whether the root key is correct, if so, calculating the secondary key and the root key according to the root key. The decryption operation is performed after the communication key. The system of claim 10, wherein the root key unit comprises: Root key storage module: used to store all the root keys and record the number of secondary keys generated; Root key calculation module: used to calculate the secondary key according to the quantity of the secondary key. The system of claim 11, wherein the secondary key unit comprises: Secondary key storage module: used to store the current secondary key and its secondary key number, and record the number of generated communication keys; Secondary key calculation module: used to calculate the communication key according to the number of the communication keys. The system of claim 12, wherein the communication key unit comprises: Encryption and decryption module: used to encrypt or decrypt the blockchain node; Communication key storage module: used to store the current communication key and its communication key number, where the communication key number includes the secondary key number.

Images