CN106650344A - Block chain-based data storage method with third-party authentication - Google Patents

Abstract

The invention discloses a blockchain-based data storage method with third-party authentication, including: a data storage agent receives a service request data packet sent by a user, and the data packet contains a user ID and data to be stored; The user ID and data to be stored are encapsulated into an authentication request packet, and the authentication request packet is sent to a third-party certification body; the third-party certification body makes a trusted signature on the user ID and data to be stored, and sends the trusted signature to To the data storage agent; the data storage agent stores the user ID, the data to be stored, and the trusted signature of the third-party certification body in the blockchain. The present invention has the following advantages: two entities, a data storage agent and a third-party certification agency, are introduced, the data storage agency represents and stores data with a unified data structure, and the third-party certification agency signs all data credibly, which improves data storage. Credibility, efficiency, versatility and portability.

Description

A blockchain-based data storage method with third-party certification

technical field

The invention relates to the field of network information security, in particular to a blockchain-based data storage method with third-party authentication.

Background technique

At present, there are already some use cases of using blockchain to store data, such as recording the copyright information of music works, recording the circulation information of diamonds, etc. These use cases usually adopt a transaction-driven data storage method, that is, initiate a virtual currency (such as Bitcoin) transaction, embed the data to be stored into the transaction data structure, and store it in the blockchain in a distributed manner.

The above method uses the distributed characteristics of the blockchain to improve the reliability of data storage, and uses the non-modifiable characteristics of the blockchain to ensure that the data is not tampered with. However, the disadvantages of this method are also obvious: (1) All parties that store data in the blockchain store data in their own specified data format (such as copyright information), so it is difficult for all parties to agree on the meaning and validity of the stored data. Once there is a dispute between the parties due to the content of the stored data (such as copyright information, etc.), it is difficult for the legal agency to intervene in time and effectively identify the true meaning of the stored data, and then make an effective ruling; (2) Store data in the blockchain All parties need to invest a lot of computing power in data storage and retrieval; after blockchain bifurcation and pruning cause transactions to become invalid, transactions need to be issued repeatedly to ensure successful data storage, wasting a lot of computing power; (3) the current blockchain The blockchain technology is immature, and there is a lot of room for improvement in terms of security and efficiency; if the blockchain is upgraded, all parties need to modify their own data storage systems, and the workload is heavy.

Contents of the invention

The present invention aims to solve the above technical problems.

For this reason, an object of the present invention is to propose a data storage method based on blockchain with third-party authentication, which solves the problems of poor versatility, no authoritative party participation, and large resource overhead in existing blockchain data storage methods. In order to improve the credibility and versatility of data storage and reduce resource waste, it has the characteristics of high versatility, high reliability, high efficiency and high portability.

In order to achieve the above object, the embodiment of the present invention discloses a blockchain-based data storage method with third-party authentication, including the following steps: S1: The data storage agent receives the service request data packet sent by the user, and the service request The data packet includes a first timestamp, a message type, a user ID, a field of data to be stored, and a digital signature made by the user on the field; S2: the data storage agent stores the second timestamp, the message type, the Encapsulating the user ID and the data to be stored into corresponding fields of the authentication request packet, digitally signing the fields of the authentication request packet, and sending the signed authentication request packet to a third party certification authority, so that the third-party certification authority can verify the digital signature of the data storage agent, and after the verification is passed, the third certification authority will verify the second timestamp, the The user ID and the data to be stored are credibly signed, and the third timestamp, message type, the user ID, and the credible signature are encapsulated into the corresponding fields of the authentication result data packet, and the authentication The field of the result data packet is digitally signed, and the authentication result data packet after signature processing is sent to the data storage agent; S3: After the data storage agent receives the authentication result data packet, the first Four timestamps, the user ID, the data to be stored and the trusted signature are stored in the block chain.

In addition, the blockchain-based data storage method with third-party authentication according to the above-mentioned embodiments of the present invention may also have the following additional technical features:

Further, after step S3, it also includes: the data storage agent regularly scans the update situation of the block chain, so that the fourth time stamp, the user ID, the data to be stored and the trusted Redo the storage when the signature storage fails.

Further, before step S1, it also includes: after the data storage agent receives the service request data packet of the user, it estimates the type and amount of resources required to serve the user, and judges whether to accept it or not according to the usage of local resources. storing the data to be stored; feeding back receiving request information to the user after accepting and storing the data to be stored; feeding back rejection request information to the user after not accepting storing the data to be stored.

Further, the user ID is a network-wide unique ID assigned by the data storage agent after the user registers with the data storage agent.

Further, before step S1, it also includes: the data storage agent receiving the registration request packet sent by the user, the registration request packet including the fifth timestamp, message type and MAC address fields, and the user A digital signature for the field; the data storage agent verifies the user's digital signature on the registration request packet, and assigns a network-wide unique ID to the user after the verification is passed.

Further, the user ID is formed by concatenating a random binary string of preset digits and the user's MAC address.

Further, before the data storage agent generates the authentication request data packet, it further includes: the data storage agent verifies the digital signature of the user on the service request data packet, and generates the authentication request after the verification is passed. data pack.

Further, after the data storage agent receives the authentication result data packet, it further includes: the data storage agent verifies the digital signature of the third-party certification body on the authentication result data packet, so that after the verification is passed, the The data storage agent stores the fourth time stamp, the user ID, the data to be stored and the trusted signature in a block chain.

In the block chain-based data storage method with third-party authentication in the embodiment of the present invention, two entities, the data storage agent and the third-party authentication agency, are introduced. The data storage agent uses a unified data structure to represent and store data, ensuring that the area The consistency and versatility of the data stored in the blockchain; the third-party certification agency can be an authoritative government department or legal institution, and the data stored in the blockchain by the data storage agent has passed the third-party certification, which improves the security of information. Credibility, once a user has a dispute over data, a third party can intervene in time and make a ruling; the data storage agent provides users with reliable data storage and retrieval services, so that users do not have to pay attention to the details of blockchain storage and retrieval, and do not have to deal with storage Failures, blockchain upgrades, etc., can effectively reduce the consumption of computing power.

Additional aspects and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Description of drawings

The above and/or additional aspects and advantages of the present invention will become apparent and comprehensible from the description of the embodiments in conjunction with the following drawings, wherein:

Fig. 1 is the flow chart of the data storage method with third-party authentication based on the block chain of the embodiment of the present invention;

Fig. 2 is a schematic diagram of the data structure of a user's registration request packet according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of the data structure of the registration result message of the data storage agent according to an embodiment of the present invention;

Fig. 4 is a schematic diagram of the data structure of the user's service request data packet according to an embodiment of the present invention;

5 is a schematic diagram of the data structure of an authentication request packet of a data storage agent according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of the data structure of an authentication result data packet of a third-party authentication agency according to an embodiment of the present invention;

Fig. 7 is a schematic diagram of the system architecture of a blockchain-based data storage method with third-party authentication according to an embodiment of the present invention.

detailed description

Embodiments of the present invention are described in detail below, examples of which are shown in the drawings, wherein the same or similar reference numerals designate the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the figures are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

In the description of the present invention, it should be understood that the terms "first" and "second" are used for description purposes only, and should not be understood as indicating or implying relative importance.

These and other aspects of embodiments of the invention will become apparent with reference to the following description and drawings. In these descriptions and drawings, some specific implementations of the embodiments of the present invention are specifically disclosed to represent some ways of implementing the principles of the embodiments of the present invention, but it should be understood that the scope of the embodiments of the present invention is not limited by This restriction. On the contrary, the embodiments of the present invention include all changes, modifications and equivalents coming within the spirit and scope of the appended claims.

The present invention is described below in conjunction with accompanying drawing.

FIG. 1 is a flow chart of a blockchain-based data storage method with third-party authentication according to an embodiment of the present invention. As shown in Figure 1, the block chain-based data storage method with third-party authentication in the embodiment of the present invention includes the following steps:

S1: The data storage agent receives the service request data packet sent by the user, and the service request data packet includes fields such as time stamp, user ID, message type, data to be stored, and digital signature.

In one embodiment of the present invention, the user C_i fills the first timestamp Timestamp1, the message type Serv_Req, the user ID_ci, and the data S_i to be stored into the service request data packet, and digitally signs the service request data packet according to the following formula, Then send the signed service request data packet to the data storage agent P.

Signature_1＝Key_pri_ci(Hash(Timestamp1||Serv_Req||ID_ci||S_i))

Among them, Signature_1 represents the digital signature of the user C_i on the service request data packet; Hash() represents the fixed-length string generated by concatenating the field contents in brackets as the input of the hash algorithm; Key_pri_ci () indicates that the user C_i uses his own private key to encrypt the string output by the hash algorithm.

In one embodiment of the present invention, the user ID_ci is the unique ID assigned by the data storage agent P after the user C_i registers with the data storage agent P. In one embodiment of the present invention, the process of user C_i registering with data storage agent P and obtaining said user ID_ci includes:

The data storage agent P receives the registration request packet sent by the user C_i. The digital signature of the registration request data packet is generated by the user C_i according to the fifth timestamp Timestamp5, message type Reg_Req, and MAC address MAC_ci in the registration request data packet. Wherein, the fifth timestamp Timestamp5 is the system time when the user generates the digital signature.

Specifically, a digital signature is generated according to the following formula:

Signature_5=Key_pri_ci(Hash(Timestamp5||Reg_Req||MAC_ci)).

Among them, Signature_5 represents the digital signature of user C_i on the registration request packet; Hash() represents the fixed-length string generated by concatenating the field contents in brackets as the input of the hash algorithm; Key_pri_ci() Indicates that user C_i uses his own private key to encrypt the string output by the hash algorithm.

After receiving the registration request packet sent by user C_i, the data storage agent P decrypts and verifies the user's digital signature Signature_2 according to the public key of user C_i, and assigns the unique ID of the entire network to user C_i after the verification is passed.

In one embodiment of the present invention, the data storage agent P assigns an ID to the user C_i according to the following formula according to the random binary string of preset digits and the MAC address of the user C_i:

ID_ci=(Random_80||MAC_ci)

Among them, Random_80 is an 80-bit random binary string, and P concatenates Random_80 and the MAC address MAC_ci of user C_i to generate ID_ci, which is used as the user ID assigned to user C_i. It should be noted that the length of the random binary string in this embodiment is not limited to a fixed length, and the 80 bits used are only used as an example for illustration, and corresponding adjustments can be made as required in actual use.

In one embodiment of the present invention, after the user C_i obtains the user ID, the following steps are also included before step S1:

The data storage agent P receives the service request data packet of the user C_i. Assume that the data storage agent P has m kinds of resources, the number of each resource is R_x, and the total amount of each resource is R_x_total, where x=1,...,m; assuming that the data storage agent is serving The number of users is n, and the user IDs are C_y, where y=1,...,n.

The data storage agent P first estimates the type and amount of resources required to serve user C_i, and judges whether to accept the service request of user C_i to store the data to be stored according to the usage of local resources;

Specifically, the data storage agent P estimates the total amount of resource R_x required to serve the user C_i, and the calculation formula is:

Among them, R_x_y represents the amount of R_x resources that data storage agent P consumes to serve customer C_y, and E(R_x_i) is the estimated value of the amount of R_x resources that data storage agent P needs to use to serve user C_i.

The data storage agent P calculates whether the local resources can meet the needs of the user C_i, and the calculation method is:

F=F(1)∩F(2)∩...∩F(m-1)∩F(m)

Among them, R_x_res represents the amount of R_x resources that the data storage agent P needs to reserve in order to ensure normal operation; F(x) is a Boolean variable, if the available amount of resource R_x meets the needs of user C_i, then F(x) is true, otherwise it is false . F is a Boolean variable, F is true if and only if all F(x) are true. If F is true, it means that the amount of available resources of the data storage agent P meets the needs of the user C_i, so the data storage agent P accepts the service request of the user C_i to store the data to be stored, and feeds back the request information to the user C_i; otherwise, the user C_i is rejected to store the data to be stored. For the service request of storing data, the rejection request information is fed back to user C_i.

S2: The data storage agent encapsulates the second timestamp, message type, user ID and data to be stored into the corresponding fields of the authentication request packet, digitally signs the above fields with its own private key, and signs the processed authentication request The data packet is sent to a third-party certification agency; the third-party certification agency uses the public key of the data storage agent to decrypt and verify the digital signature. After the verification is passed, the third certification agency uses its own private key to verify the timestamp, The user ID and the data to be stored are trusted to sign, and the time stamp, message type, user ID and trusted signature are encapsulated into the corresponding fields of the authentication result data packet, and the above fields are digitally signed with their own private key, and the signature The processed authentication result data packet is sent to the data storage agent.

Specifically, the data storage agent P uses the public key of the user C_i to decrypt and verify the digital signature of the user C_i on the service request packet, and after the verification is passed, the second timestamp Timestamp2, the message type Auth_Req, the user ID_ci, the pending The storage data S_i is embedded in the authentication request packet, and the authentication request packet is digitally signed according to the following formula

Signature_2=Key_pri_p(Hash(Timestamp2||Auth_Req||ID_ci||S_i))

Among them, Signature_2 is the digital signature of the data storage agent P on the authentication request packet; Hash() indicates that the string formed by splicing the contents of the fields in the brackets is used as the input of the hash algorithm to generate a fixed-length string; Key_pri_p () indicates that the data storage agent P uses its own private key to encrypt the string output by the hash algorithm.

After the third-party certification authority A receives the certification request packet, it first uses the public key of the data storage agent P to decrypt and verify the digital signature Signature_2. If the verification is passed, proceed to the following steps:

The third-party authentication agency A performs a trusted signature Signature_Auth according to the second timestamp Timestamp2, user ID_ci, and data S_i to be stored in the authentication request packet.

Signature_Auth=Key_pri_a(Hash(Timestamp2||ID_ci||S_i))

Among them, Signature_Auth is the trusted signature made by the third-party certification authority A; Hash() indicates that the string of fields in brackets is spliced as the input of the hash algorithm to generate a fixed-length string; Key_pri_a( ) indicates that the third-party certification authority A uses its own private key to encrypt the string output by the hash algorithm.

Third-party certification agency A encapsulates the third timestamp Timestamp3, message type Auth_Res, user ID_ci, and trusted signature Signature_Auth into the authentication result data packet, and digitally signs Signature_3 on the above fields with its own private key, and sends it to the data storage agent P:

Signature_3=Key_pri_a(Hash(Timestamp3||Auth_Res||ID_ci||Signature_Auth)).

Among them, Signature_3 is the digital signature made by the third party A for the authentication result data packet; Hash() means that the string formed by splicing the contents of the fields in the brackets is used as the input of the hash algorithm to generate a fixed-length string; Key_pri_a() indicates that the third-party certification authority A uses its own private key to encrypt the string output by the hash algorithm.

S3: After the data storage agent receives the authentication result packet, it first decrypts and verifies the digital signature using the public key of the third-party agency A. If the verification is passed, the fourth time stamp, user ID, data to be stored and trusted signature are stored in the block chain.

In one embodiment of the present invention, the data storage agent P uses the public key of the third party A to decrypt and verify the digital signature Signature_4 of the third party A on the authentication result data packet. If the verification is passed, the communication interface of the blockchain is called, and the first Four timestamp Timestamp4, user ID_ci, data to be stored S_i and third-party trusted signature Signature_Auth are stored in the blockchain.

In one embodiment of the present invention, after step S3, it also includes:

The data storage agent P regularly scans the update of the blockchain to re-store Timestamp4, ID_ci, S_i and Signature_Auth when the storage fails.

In order for those skilled in the art to further understand the present invention, the following examples will be described in detail.

Fig. 2 shows the message structure of the registration request packet sent to the data storage agent P when the user C_i applies for registration. Among them, the Timestamp field has 128 bits, the message type MsgType field has 64 bits, the MAC address MAC field has 64 bits, and the digital signature Signature field has 1024 bits. The Timestamp Timestamp field is expanded to 128 bits by filling in the Unix system timestamp and filling the high bits with 0; the MAC field is expanded to 64 bits based on the host’s 48-bit MAC address; the Signature field is for Timestamp, MsgType, Digital signature made by MAC and Signature fields. The provisions of the timestamp Timestamp field, user ID field, and digital signature Signature field of each data packet in the following are the same as the registration request data packet.

Fig. 3 shows the message structure of the registration result data packet returned by the data storage agent P to the user C_i. Among them, the Timestamp field has 128 bits, the message type MsgType field has 64 bits, the user ID field has 128 bits, and the digital signature Signature field has 1024 bits.

Fig. 4 shows the message structure of the service request data packet sent by the user C_i to the data storage agent P. Among them, the Timestamp field has 128 bits, the message type MsgType field has 64 bits, the user ID field has 128 bits, and the digital signature Signature field has 1024 bits. The length of the Data field of the data to be stored is variable, and the longest does not exceed 3776 bits.

FIG. 5 shows the message structure of the authentication request packet sent by the data storage proxy P to the third party A. It should be noted that although the structure of this message is the same as the structure of the message structure in Figure 4, each field is refilled by P, instead of directly forwarding the message sent by user C_i.

FIG. 6 shows the message structure of the authentication result packet sent by the third-party authentication agency A to the data storage agent P. The Timestamp field has 128 bits, the message type MsgType field has 64 bits, the user ID field has 128 bits, the trusted signature Signature_Auth field of A has 1024 bits, and the Signature field of A's digital signature for this data packet has 1024 bits.

Figure 7 shows the system architecture composed of entities such as users, data storage agents, and third parties. It should be pointed out that the blockchain is not part of the present invention, and the blockchain is drawn here to illustrate the relationship between entities.

Although the present invention stores data in the blockchain, it does not make special assumptions about the specific type, existence mode, data storage mode, and communication interface of the blockchain. The data storage agent provides a unified communication interface for users upwards, and realizes storage and retrieval functions downwards according to the specific conditions of the blockchain. The system architecture proposed by the present invention can be implemented based on any blockchain, and can effectively complete all functions. The third-party certification agency is a recognized and authoritative government regulatory agency or authoritative legal agency, which can authenticate the data according to the privacy policy and user needs, indicating that the third party approves the data stored by the user.

The block chain-based data storage method with third-party authentication in the embodiment of the present invention introduces two entities, the data storage agent and the third-party authentication structure. The data storage agent provides users with reliable data storage services, so that users do not have to pay attention to Storing details saves computing power and improves network work efficiency; all data is stored in a unified format and has been certified by a third-party certification body, so the data stored in the blockchain can be recognized by all parties. The present invention solves the drawbacks of the current method of storing data using the block chain, has high versatility, high reliability, high efficiency, and high portability, and is also of great significance for saving computing power and improving network work efficiency.

In addition, other components and functions of the blockchain-based third-party-certified data storage method in the embodiment of the present invention are known to those skilled in the art, and will not be repeated in order to reduce redundancy.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

Although the embodiments of the present invention have been shown and described, those skilled in the art can understand that various changes, modifications, substitutions and modifications can be made to these embodiments without departing from the principle and spirit of the present invention. The scope of the invention is defined by the claims and their equivalents.

Claims (8)

1. a kind of date storage method for having a Third Party Authentication based on block chain, it is characterised in that comprise the following steps：

S1：The requests of packets of data that data storage agent receive user sends, when the requests of packets of data includes first Between stamp, type of message, ID and data to be stored field and user digital signature that the field is done；

S2：The data storage agent is encapsulated into the second timestamp, type of message, the ID and the data to be stored In the respective field of certification request packet, digital signature is done to the field of the certification request packet, and will signature The certification request packet after process is sent to Third Party Authentication mechanism,

So that the Third Party Authentication mechanism verifies to the digital signature of the data storage agent, by institute after being verified Second timestamp, the ID during the 3rd certification authority is stated to the certification request packet, the number to be stored According to doing trusted signature, and the 3rd timestamp, type of message, the ID, the trusted signature are encapsulated into into the certification knot In the respective field of fruit packet, digital signature is done to the field of the authentication result packet, and after signature is processed The authentication result packet be sent to the data storage agent；

S3：The data storage agent is received after the authentication result packet, by the 4th timestamp, ID, described Data to be stored and the trusted signature are stored in block chain.

2. the date storage method for having a Third Party Authentication based on block chain according to claim 1, it is characterised in that Also include after step S3：

The update status of block chain described in the data storage agent periodic scanning, so as in the 4th timestamp, the use Storage is re-started during the storage failure of family ID, the data to be stored and the trusted signature.

3. the date storage method for having a Third Party Authentication based on block chain according to claim 1, it is characterised in that step Rapid S1 also includes：

The data storage agent is received after the requests of packets of data of the user, estimates the money needed for the service user Source category and stock number, and judged whether to receive the storage data to be stored according to local resource service condition；

After receiving the storage data to be stored, to the user feedback solicited message is received；Do not receive storage described to be stored After data, to the user feedback solicited message is refused.

4. the date storage method for having a Third Party Authentication based on block chain according to claim 1, it is characterised in that institute Stating ID is after the user is registered to the data storage agent, and the whole network distributed by the data storage agent is only One ID.

5. the date storage method for having a Third Party Authentication based on block chain according to claim 4, it is characterised in that Also include before step S1：

The data storage agent receives the registration request packet that the user sends, and the registration request packet includes the The field of five timestamps, type of message and MAC Address, and the digital signature that the user is done to the field；

The data storage agent verifies digital signature of the user to the registration request packet, and after being verified Distribute the whole network unique ID to the user.

6. the date storage method for having a Third Party Authentication based on block chain according to claim 5, it is characterised in that institute State ID to be spliced according to the random binary word string of presetting digit capacity and the MAC Address of the user.

7. the date storage method for having a Third Party Authentication based on block chain according to claim 5 or 6, its feature exists In also including before the data storage agent generates the certification request packet：

The data storage agent verifies digital signature of the user to the requests of packets of data, and after being verified Generate the certification request packet.

8. the date storage method for having a Third Party Authentication based on block chain according to claim 1, it is characterised in that The data storage agent is received also to be included after the authentication result packet：

The data storage agent verifies digital signature of the Third Party Authentication mechanism to the authentication result packet, so as to The data storage agent is by the 4th timestamp, the ID, data to be stored and described after being verified Trusted signature is stored in block chain.