WO2018032373A1 - 一种用于区块链的安全网络附加装置及方法 - Google Patents

一种用于区块链的安全网络附加装置及方法 Download PDF

Info

Publication number
WO2018032373A1
WO2018032373A1 PCT/CN2016/095577 CN2016095577W WO2018032373A1 WO 2018032373 A1 WO2018032373 A1 WO 2018032373A1 CN 2016095577 W CN2016095577 W CN 2016095577W WO 2018032373 A1 WO2018032373 A1 WO 2018032373A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
file
key
key body
digital signature
Prior art date
Application number
PCT/CN2016/095577
Other languages
English (en)
French (fr)
Inventor
张丛
Original Assignee
深圳市樊溪电子有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市樊溪电子有限公司 filed Critical 深圳市樊溪电子有限公司
Publication of WO2018032373A1 publication Critical patent/WO2018032373A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the invention relates to the security problem of a blockchain, in particular to a blockchain information security protection device, a security network attachment device and a method.
  • blockchain is a secure account book database, composed of data blocks, users can constantly update and upgrade here.
  • the platform looks for data.
  • the blockchain can speed up transaction processing, reduce costs, reduce middlemen, improve market insight, and increase business transparency.
  • Computing and storage are the two basic tasks of computer systems. With the explosive growth of information, storage components will experience direct storage based on single-server, to cluster-based grid storage based on LAN, and finally to WAN-based data grids.
  • Blockchain technology is the most extreme development at present. The intrinsic characteristics of this data storage medium include intelligent storage. The quality of storage service can guarantee service differentiation and performance guarantee for user applications.
  • Storage is object-oriented mass storage, and Network storage must be confidential and complete.
  • the existing Internet does not have a good or convenient way to ensure the confidentiality, integrity, availability, and data of the data stored in the blockchain and the data stored on the storage device. Non-repudiation and the reliability of the entire network storage system, especially the generation of trusted computing technology in blockchain in recent years, puts higher demands on network storage security.
  • It is an object of the present invention to provide a blockchain security network attachment device comprising: a key management system for providing a decryption key; a lock box mechanism for storing a key, which is stored in a unique trusted On the server, and provided to the user accessing the file; the certificate is used to manage the authorized user, the certificate contains the ID of the valid user, the public key of the user, and a hashed MAC that provides and verifies the digital signature of the user.
  • a key for preventing a replay attack
  • a storage device for storing a non-linear checksum of the original data and the encrypted result, by which the user can check whether the file is stored Modified, the user verifies the integrity of the write by verifying the metadata file of the analysis file key body and verifying the digital signature provided.
  • each file is given a symmetric key encryption, and a pointer to the key body is set inside the metadata of the file, and is stored in the metadata of the key body.
  • a pointer to the key body is set inside the metadata of the file, and is stored in the metadata of the key body.
  • the key body is composed of a tuple that is consistent with the original file of the legal user, and each tuple contains a user ID field, a symmetric key for accessing the security data, and a list of whether the user is allowed to write to the key body.
  • the key body is consistent with the permission to write to the original file, and is encrypted by the user's public key, and decrypted by the user's private key on the client.
  • the non-linear checksum is updated after the authorized user changes the file.
  • the add-on authorizes the owner of the file to implement a policy of aggressively revoking passwords or a policy of lazy revocation of keys.
  • the add-on device further comprises five independent digital signature schemes for the user to select, the five independent digital signature schemes being proposed by adjusting the security and performance ratio, and the author of the file can decide to verify the five independent
  • the granularity of the digital signature scheme the better the granularity, the higher the security.
  • the network attachment device of the present invention by encrypting the data and decrypting only the client to prevent any unauthorized users from accessing the data, it is possible to avoid threats to the system administrator and potential threats caused by physical capture of the disk.
  • FIG. 1 is a schematic structural diagram of a blockchain security network attachment apparatus according to an embodiment of the present invention.
  • the essence of a transaction is a relational data structure that contains information about the value transfer of the trading participants. These transaction information is called the accounting ledger.
  • the transaction needs to go through three creation, verification, and writing blockchains. The transaction must be digitally signed to ensure the legality of the transaction.
  • Block All transaction information is stored in the block, and a transaction information is a record, which is stored as a separate record in the blockchain.
  • the block consists of a block header and a data part.
  • the block header field contains various characteristics of the block itself, such as the previous block information, the merkle value, and the timestamp.
  • the block header hash value and block height are the two most important indicators for identifying the block.
  • the block primary identifier is its cryptographic hash value, a digital fingerprint obtained by performing a second hash calculation on the block header by the SHA algorithm.
  • the resulting 32-byte hash value is called the block hash value, or the block header hash value, and only the block header is used for calculation.
  • the block hash value can uniquely and unambiguously identify a block, and any node can independently obtain the block hash value by simply hashing the block header.
  • Blockchain A data structure in which blocks are chained in an orderly fashion.
  • the blockchain is like a vertical stack, the first block is the first block at the bottom of the stack, and then each block is placed in another area. Above the block. When a block is written to a blockchain, it will never change and is backed up to another blockchain server.
  • a blockchain security network attachment device and method can prevent a threat to a system administrator from accessing a disk by encrypting data and decrypting only the client to prevent any unauthorized user from accessing data. Potential threats caused by physical capture.
  • the decryption of the client depends on the decryption key provided by the key management system.
  • the confidentiality of the add-on device depends on the lock box mechanism that stores the key.
  • Each file has a symmetric key encryption. Inside the file's metadata, there is a pointer to the key body. Inside the key body's metadata, there is the file ID, the ID of the user who created the file, and the last modified file. User's signature.
  • the key body here is composed of a tuple that is consistent with the original file of the legitimate user. Each tuple has a user ID field, a symmetric key for accessing secure data, and a list of whether the user is allowed to write to the key body.
  • the key body is consistent with the permission to write to the original file and is encrypted by the user's public key, so it can be decrypted by the user's private key on the client, which prevents the intruder from trying to obtain the key of the encrypted data.
  • the blockchain security network attachment In addition to the key body, the blockchain security network attachment also manages the authorized user with a certificate containing the ID of the valid user, the user's public key, and a hashed MAC that provides and verifies the user's digital signature. The key, and a timestamp that the user performs the write operation, to prevent replay attacks.
  • the add-on stores a non-linear checksum of the original data and the encrypted result so that the user can verify that the file was modified while it was stored. This checksum is also updated when the authorized user changes the file.
  • the user verifies the integrity of the write by verifying the metadata file of the analysis file key body and by verifying the provided digital signature.
  • the lockbox key is stored on a unique trusted server and is provided to the user accessing the file, which becomes the target of the attacker's attack. Moreover, the add-on device does not have a specific policy of revoking the key, leaving the decision and execution of the aggressive revocation or lazy revocation key to the owner of the file.
  • Encryption and decryption operations are placed on the client side to avoid server-side bottlenecks.
  • Digital signatures are the most time-consuming part of an add-on. Although it is the safest way to sign a write for each block of data and perform a verification of each block of reads, this most secure method is not suitable for standard usage. Therefore, in order to solve the problem that the decryption speed is still very slow on a relatively fast client machine, the additional device provides the user with five independent digital signature schemes for the user to select, and proposes five by adjusting the security and performance ratio. Digital signature scheme. The author of the file can decide to verify the granularity of the digital signature, and the better the granularity, the more security can be improved, and vice versa.

Abstract

本发明提供了一种用于区块链安全网络附加装置，包括：密钥管理系统，用于提供的解密密钥；锁盒机构，用于存储密钥，被保存在唯一一个可信的服务器上，并且提供给访问文件的用户；证书，用于管理被授权用户；存储装置，用于存储原始数据和加密结果的非线性校验和，通过该存储装置用户可以检验文件在存储时是否被修改过，用户通过验证分析文件密钥体的元数据文件和通过检验提供的数字签名来验证写的完整性。通过本发明的网络附加装置及方法，通过加密数据，只在客户端解密来阻止任何未授权用户访问数据，能够避免威胁系统管理员的访问以及对磁盘的物理捕获所引起的潜在威胁。

Description

一种用于区块链的安全网络附加装置及方法 技术领域
本发明涉及区块链的安全问题，特别是一种区块链信息安全保护装置，安全网络附加装置及方法。
背景技术
2009年比特币的出现带来了一种颠覆性的成果--区块链技术，区块链是一个安全的帐簿类数据库，由一个个数据区块组成，使用者可以在这个不断更新升级的平台查找数据，对于金融机构来说，区块链能加快交易处理过程、降低成本、减少中间人、提高市场洞察力，增加业务透明度。
计算和存储是计算机系统的两大基本任务，随着信息的爆炸性增长，存储部件会经历基于单服务器的直连存储，到基于局域网的集群网格存储，最后发展到基于广域网的数据网格，区块链技术是目前发展的最末端，这种数据存储介质的本征特质包括智能化的存储，存储服务质量可以保证为用户应用提供服务区分和性能保证，存储是面向对象的海量存储，以及网络存储必须保证是机密完整和安全的，现有的互联网还没有很好的或者方便的办法保证区块链传输过程中的数据和保存在存储设备上的数据的保密性、完整性、可用性、不可抵赖性以及整个网络存储系统的可靠性能，尤其是近年来区块链可信计算技术的产生，对网络存储安全又提出更高的要求。
发明内容
本发明的目的在于提供一种用于区块链安全网络附加装置，包括：密钥管理系统，用于提供的解密密钥；锁盒机构，用于存储密钥，被保存在唯一一个可信的服务器上，并且提供给访问文件的用户；证书，用于管理被授权用户，所述证书中包含有效用户的ID、用户的公钥、一个提供并验证用户数字签名的哈希过的MAC密钥，以及一个用户执行写运算的时间戳，用于预防重放攻击；以及存储装置，用于存储原始数据和加密结果的非线性校验和，通过该存储装置用户可以检验文件在存储时是否被修改过，用户通过验证分析文件密钥体的元数据文件和通过检验提供的数字签名来验证写的完整性。
优选的，将网络附加装置置于区块链节点后，将每个文件赋予一个对称密钥加密，在文件的元数据内部设置一个指向密钥体的指针，在密钥体的元数据内部存储有文件的ID、创建文件的用户的ID，以及最后修改文件的用户的签名，所述签名经过自身用户或被授权的用户验证后，能向其他用户证明密钥体自身没有被改动。
优选的，密钥体是由一些与合法用户的原始文件一致的元组组成，每个元组包含一个用户ID域、访问安全数据的对称密钥以及一个是否允许用户向密钥体写的列表，所述密钥体与允许向原始文件进行写操作的权限一致，并且被用户的公钥加密，在客户端由用户的私钥解密。
优选的，非线性校验和在被授权用户更改文件后被更新。
优选的，附加装置授权所述文件的拥有者执行积极的吊销密码的策略或者懒惰吊销密钥的策略。
优选的，附加装置还包含五个独立的数字签名方案，供用户选择，所述五个独立的数字签名方案通过调整安全性和性能比例来提出，文件的创立者能够决定验证所述五个独立的数字签名方案的粒度，粒度越好，安全性越高。
通过本发明的网络附加装置，通过加密数据，只在客户端解密来阻止任何未授权用户访问数据，能够避免威胁系统管理员的访问以及对磁盘的物理捕获所引起的潜在威胁。
根据下文结合附图对本发明具体实施例的详细描述，本领域技术人员将会更加明了本发明的上述以及其他目的、优点和特征。
附图说明
后文将参照附图以示例性而非限制性的方式详细描述本发明的一些具体实施例。附图中相同的附图标记标示了相同或类似的部件或部分。本领域技术人员应该理解，这些附图未必是按比例绘制的。本发明的目标及特征考虑到如下结合附图的描述将更加明显，附图中：
图1为根据本发明实施例的区块链安全网络附加装置的结构示意图。
具体实施方式
在进行具体实施方式的说明之前，为了更为清楚的表达所论述的内容，首先定义一些非常重要的概念。
交易：交易的实质是个关系数据结构，这个数据结构中包含交易参与者价值转移的相关信息。这些交易信息被称为记账总账簿。交易需经过三个创建、验证、写入区块链。交易必须经过数字签名，保证交易的合法性。
区块：所有的交易信息存放于区块中，一条交易信息就是一条记录，作为一个独立的记录存放于区块链中。区块由区块头部和数据部分组成，区块头字段包含区块本身的各种特性，例如前一区块信息，merkle值及时间戳等。其中区块头哈希值和区块高度是标识区块最主要的两个指标。区块主标识符是它的加密哈希值，一个通过SHA算法对区块头进行二次哈希计算而得到的数字指纹。产生的32字节哈希值被称为区块哈希值，或者区块头哈希值，只有区块头被用于计算。区块哈希值可以唯一、明确地标识一个区块，并且任何节点通过简单地对区块头进行哈希计算都可以独立地获取该区块哈希值。
区块链：由区块按照链式结构有序链接起来的数据结构。区块链就像一个垂直的堆栈，第一个区块作为栈底的首区块，随后每个区块都被放置在其他区 块之上。当区块写入区块链后将永远不会改变，并且备份到其他的区块链服务器上。
实施例：参见图1，一种用于区块链安全网络附加装置及方法，通过加密数据，只在客户端解密来阻止任何未授权用户访问数据，能够避免威胁系统管理员的访问以及对磁盘的物理捕获所引起的潜在威胁。客户端的解密依赖于密钥管理系统提供的解密密钥。其中该附加装置的机密性依赖于存储密钥的锁盒机构。每个文件都有一个对称密钥加密，在文件的元数据内部有一个指针指向密钥体，在密钥体的元数据内部有文件的ID、创建文件的用户的ID，以及最后修改文件的用户的签名。这个签名能向其他用户证明密钥体自身没有被改动(当然任何被授权的用户能够验证这个签名)。这里的密钥体是由一些与合法用户的原始文件一致的元组组成，每个元组有一个用户ID域、访问安全数据的对称密钥以及一个是否允许用户向密钥体写的列表，该密钥体与允许向原始文件进行写操作的权限一致，并且被用户的公钥加密，所以能在客户端由用户的私钥解密，这就阻止了入侵者试图得到加密数据的密钥。
除了密钥体以外，该区块链安全网络附加装置还通过一个证书来管理被授权用户，证书中包含有效用户的ID、用户的公钥、一个提供并验证用户数字签名的哈希过的MAC密钥，以及一个用户执行写运算的时间戳，用于预防重放攻击。
为了提供更高的完整性，该附加装置存储了原始数据和加密结果的非线性校验和，这样用户就可以检验文件在存储时是否被修改过。这个校验和在被授权用户更改文件时也得到更新。用户通过验证分析文件密钥体的元数据文件和通过检验提供的数字签名来验证写的完整性。
锁盒密钥被保存在唯一一个可信的服务器上，并且提供给访问文件的用户，它成为攻击者攻击的目标。并且，该附加装置没有一个具体的吊销密钥的策略，把采取积极的吊销或者懒惰吊销密钥的决定和执行留给了文件的拥有者。
加密和解密运算放在客户端进行避免了服务器端的瓶颈问题，众所周知， 数字签名是附加装置最费时的部分，虽然对每一个数据块的写进行签名，并且对每一个数据块的读实行验证时最安全的方法，但是这种最安全的方法不适合标准的用法，因此该附加装置为了解决在相对较快的客户端机器上解密速度还是很慢的问题，附加装置上为用户提供五个独立的数字签名方案使用户选择，通过调整安全性和性能比例来提出五个数字签名方案。文件的创立者能够决定验证数字签名的粒度，越是好的粒度越能提高安全性，反之亦然。
虽然本发明已经参考特定的说明性实施例进行了描述，但是不会受到这些实施例的限定而仅仅受到附加权利要求的限定。本领域技术人员应当理解可以在不偏离本发明的保护范围和精神的情况下对本发明的实施例能够进行改动和修改。

Claims (10)

  1. 一种用于区块链安全网络附加装置，其特征在于包括：
    密钥管理系统，用于提供的解密密钥；
    锁盒机构，用于存储密钥，被保存在唯一一个可信的服务器上，并且提供给访问文件的用户；
    证书，用于管理被授权用户，所述证书中包含有效用户的ID、用户的公钥、一个提供并验证用户数字签名的哈希过的MAC密钥，以及一个用户执行写运算的时间戳，用于预防重放攻击；
    存储装置，用于存储原始数据和加密结果的非线性校验和，通过该存储装置用户可以检验文件在存储时是否被修改过，用户通过验证分析文件密钥体的元数据文件和通过检验提供的数字签名来验证写的完整性。
  2. 根据权利要求1所述的一种用于区块链安全网络附加装置，其特征在于：将所述网络附加装置置于区块链节点后，将每个文件赋予一个对称密钥加密，在文件的元数据内部设置一个指向密钥体的指针，在密钥体的元数据内部存储有文件的ID、创建文件的用户的ID，以及最后修改文件的用户的签名，所述签名经过自身用户或被授权的用户验证后，能向其他用户证明密钥体自身没有被改动。
  3. 根据权利要求2所述的一种用于区块链安全网络附加装置，其特征在于：所述，所述密钥体是由一些与合法用户的原始文件一致的元组组成，每个元组包含一个用户ID域、访问安全数据的对称密钥以及一个是否允许用户向密钥体写的列表，所述密钥体与允许向原始文件进行写操作的权限一致，并且被用户的公钥加密，在客户端由用户的私钥解密。
  4. 根据权利要求1所述的一种用于区块链安全网络附加装置，其特征在于：所述非线性校验和在被授权用户更改文件后被更新。
  5. 根据权利要求1所述的一种用于区块链安全网络附加装置，其特征在于： 所述附加装置授权所述文件的拥有者执行积极的吊销密码的策略或者懒惰吊销密钥的策略。
  6. 根据权利要求1所述的一种用于区块链安全网络附加装置，其特征在于：所述附加装置还包含五个独立的数字签名方案，供用户选择，所述五个独立的数字签名方案通过调整安全性和性能比例来提出，文件的创立者能够决定验证所述五个独立的数字签名方案的粒度，粒度越好，安全性越高。
  7. 一种用于区块链安全网络附加方法，其特征在于：包括如下步骤：
    S1密钥管理系统，用于提供的解密密钥；
    S2锁盒机构，用于存储密钥，被保存在唯一一个可信的服务器上，并且提供给访问文件的用户；
    S3证书，用于管理被授权用户，所述证书中包含有效用户的ID、用户的公钥、一个提供并验证用户数字签名的哈希过的MAC密钥，以及一个用户执行写运算的时间戳，用于预防重放攻击；
    S4存储装置，用于存储原始数据和加密结果的非线性校验和，通过该存储装置用户可以检验文件在存储时是否被修改过，用户通过验证分析文件密钥体的元数据文件和通过检验提供的数字签名来验证写的完整性。
  8. 根据权利要求7所述的一种用于区块链安全网络附加装置，其特征在于：将所述网络附加方法置于区块链节点后，将每个文件赋予一个对称密钥加密，在文件的元数据内部设置一个指向密钥体的指针，在密钥体的元数据内部存储有文件的ID、创建文件的用户的ID，以及最后修改文件的用户的签名，所述签名经过自身用户或被授权的用户验证后，能向其他用户证明密钥体自身没有被改动。
  9. 根据权利要求8所述的一种用于区块链安全网络附加装置，其特征在于：所述密钥体是由一些与合法用户的原始文件一致的元组组成，每个元组包含一个用户ID域、访问安全数据的对称密钥以及一个是否允许用户向密钥体写的列表，所述密钥体与允许向原始文件进行写操作的权限一致，并且被用户的公钥 加密，在客户端由用户的私钥解密；所述非线性校验和在被授权用户更改文件后被更新；所述附加方法授权所述文件的拥有者执行积极的吊销密码的策略或者懒惰吊销密钥的策略。
  10. 根据权利要求7所述的一种用于区块链安全网络附加装置，其特征在于：所述附加方法还包含五个独立的数字签名方案，供用户选择，所述五个独立的数字签名方案通过调整安全性和性能比例来提出，文件的创立者能够决定验证所述五个独立的数字签名方案的粒度，粒度越好，安全性越高。
PCT/CN2016/095577 2016-08-13 2016-08-16 一种用于区块链的安全网络附加装置及方法 WO2018032373A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610669575.1A CN106330452B (zh) 2016-08-13 2016-08-13 一种用于区块链的安全网络附加装置及方法
CN201610669575.1 2016-08-13

Publications (1)

Publication Number Publication Date
WO2018032373A1 true WO2018032373A1 (zh) 2018-02-22

Family

ID=57740363

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/095577 WO2018032373A1 (zh) 2016-08-13 2016-08-16 一种用于区块链的安全网络附加装置及方法

Country Status (2)

Country Link
CN (1) CN106330452B (zh)
WO (1) WO2018032373A1 (zh)

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110532806A (zh) * 2019-07-26 2019-12-03 深圳壹账通智能科技有限公司 标书管理方法、系统及计算机可读存储介质
WO2019137563A3 (en) * 2019-04-26 2020-03-12 Alibaba Group Holding Limited Anti-replay attack authentication protocol
CN110914851A (zh) * 2019-03-27 2020-03-24 阿里巴巴集团控股有限公司 提高区块链网络与外部数据源之间的通信的完整性
CN111711619A (zh) * 2020-06-04 2020-09-25 江苏荣泽信息科技股份有限公司 一种基于区块链的网络安全连接系统
US20200358620A1 (en) * 2019-05-10 2020-11-12 Samsung Electronics Co., Ltd. Method of operating memory system with replay attack countermeasure and memory system performing the same
CN112333631A (zh) * 2020-03-11 2021-02-05 徐苗 基于区块链的wifi接入位置信号共识系统
CN112383611A (zh) * 2020-11-11 2021-02-19 上海保险交易所股份有限公司 基于区块链的文件存证方法、系统及服务器
CN112688964A (zh) * 2021-01-28 2021-04-20 国网江苏省电力有限公司宿迁供电分公司 一种低成本物联网络安全防护方法及终端设备
CN114900307A (zh) * 2021-03-29 2022-08-12 万加合一数字科技集团有限公司 一种基于区块链的盾及其可信监测系统
US11526612B2 (en) 2020-09-22 2022-12-13 International Business Machines Corporation Computer file metadata segmentation security system
US11693948B2 (en) 2020-08-04 2023-07-04 International Business Machines Corporation Verifiable labels for mandatory access control

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10467586B2 (en) * 2017-03-23 2019-11-05 International Business Machines Corporation Blockchain ledgers of material spectral signatures for supply chain integrity management
CN107016611A (zh) * 2017-03-29 2017-08-04 杭州秘猿科技有限公司 一种基于区块链的交易超时控制方法
US10320574B2 (en) * 2017-05-05 2019-06-11 International Business Machines Corporation Blockchain for open scientific research
EP3613171B1 (en) * 2017-05-30 2021-06-30 Siemens Aktiengesellschaft Industrial network using a blockchain for access control, and access control method
WO2019098873A1 (en) * 2017-11-16 2019-05-23 Accenture Global Solutions Limited Blockchain operation stack for rewritable blockchain
CN108023732B (zh) * 2017-12-15 2020-02-14 北京深思数盾科技股份有限公司 一种数据保护方法、装置、设备和存储介质
WO2019127265A1 (zh) * 2017-12-28 2019-07-04 深圳前海达闼云端智能科技有限公司 基于区块链智能合约的数据写入方法、装置及存储介质
CN108718341B (zh) * 2018-05-30 2021-06-01 北京阿尔山区块链联盟科技有限公司 数据的共享和搜索的方法
CN110753019A (zh) * 2018-07-24 2020-02-04 林哲民 区块链档案验证系统
CN108900533B (zh) * 2018-08-01 2021-04-20 南京荣链科技有限公司 一种共享数据隐私保护方法、系统、终端及介质
CN109241357A (zh) * 2018-08-08 2019-01-18 深圳市金泽智联信息技术有限公司 链式结构模型及其构建方法、系统和终端设备
CN108959971A (zh) * 2018-08-09 2018-12-07 佛山市苔藓云链科技有限公司 一种通过区块链维护互联网个人可识别信息的方法
CN109547461A (zh) * 2018-12-13 2019-03-29 如般量子科技有限公司 基于p2p对称密钥池的抗量子计算区块链保密交易系统和方法
CN110266659B (zh) * 2019-05-31 2020-09-25 联想(北京)有限公司 一种数据处理方法和设备
CN110417750B (zh) * 2019-07-09 2020-07-03 北京健网未来科技有限公司 基于区块链技术的文件读取和存储的方法、终端设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1444835A (zh) * 2000-08-03 2003-09-24 奥林奇私人通讯服务有限公司 移动通信网络中的验证
CN101763469A (zh) * 2008-12-24 2010-06-30 盛大计算机（上海）有限公司 数字版权管理系统及其实现方法
CN102014133A (zh) * 2010-11-26 2011-04-13 清华大学 在云存储环境下一种安全存储系统的实现方法
CN104217327A (zh) * 2014-09-25 2014-12-17 山东中孚信息产业股份有限公司 一种金融ic卡互联网终端及其交易方法
CN105701372A (zh) * 2015-12-18 2016-06-22 布比（北京）网络技术有限公司 一种区块链身份构建及验证方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130311348A1 (en) * 2012-03-09 2013-11-21 Gideon Samid Fitting digital currency into modern transactional ecosystems
CN104601579A (zh) * 2015-01-20 2015-05-06 成都市酷岳科技有限公司 一种保障信息安全的计算机系统及其方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1444835A (zh) * 2000-08-03 2003-09-24 奥林奇私人通讯服务有限公司 移动通信网络中的验证
CN101763469A (zh) * 2008-12-24 2010-06-30 盛大计算机（上海）有限公司 数字版权管理系统及其实现方法
CN102014133A (zh) * 2010-11-26 2011-04-13 清华大学 在云存储环境下一种安全存储系统的实现方法
CN104217327A (zh) * 2014-09-25 2014-12-17 山东中孚信息产业股份有限公司 一种金融ic卡互联网终端及其交易方法
CN105701372A (zh) * 2015-12-18 2016-06-22 布比（北京）网络技术有限公司 一种区块链身份构建及验证方法

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110914851A (zh) * 2019-03-27 2020-03-24 阿里巴巴集团控股有限公司 提高区块链网络与外部数据源之间的通信的完整性
CN110914851B (zh) * 2019-03-27 2024-02-06 创新先进技术有限公司 提高区块链网络与外部数据源之间的通信的完整性
WO2019137563A3 (en) * 2019-04-26 2020-03-12 Alibaba Group Holding Limited Anti-replay attack authentication protocol
US10785035B1 (en) 2019-04-26 2020-09-22 Alibaba Group Holding Limited Anti-replay attack authentication protocol
US11552801B2 (en) * 2019-05-10 2023-01-10 Samsung Electronics Co., Ltd. Method of operating memory system with replay attack countermeasure and memory system performing the same
US20200358620A1 (en) * 2019-05-10 2020-11-12 Samsung Electronics Co., Ltd. Method of operating memory system with replay attack countermeasure and memory system performing the same
CN110532806A (zh) * 2019-07-26 2019-12-03 深圳壹账通智能科技有限公司 标书管理方法、系统及计算机可读存储介质
CN112333631A (zh) * 2020-03-11 2021-02-05 徐苗 基于区块链的wifi接入位置信号共识系统
CN112333631B (zh) * 2020-03-11 2022-07-19 金网络(北京)电子商务有限公司 基于区块链的wifi接入位置信号共识系统
CN111711619A (zh) * 2020-06-04 2020-09-25 江苏荣泽信息科技股份有限公司 一种基于区块链的网络安全连接系统
US11693948B2 (en) 2020-08-04 2023-07-04 International Business Machines Corporation Verifiable labels for mandatory access control
US11526612B2 (en) 2020-09-22 2022-12-13 International Business Machines Corporation Computer file metadata segmentation security system
CN112383611A (zh) * 2020-11-11 2021-02-19 上海保险交易所股份有限公司 基于区块链的文件存证方法、系统及服务器
CN112688964A (zh) * 2021-01-28 2021-04-20 国网江苏省电力有限公司宿迁供电分公司 一种低成本物联网络安全防护方法及终端设备
CN114900307A (zh) * 2021-03-29 2022-08-12 万加合一数字科技集团有限公司 一种基于区块链的盾及其可信监测系统

Also Published As

Publication number Publication date
CN106330452A (zh) 2017-01-11
CN106330452B (zh) 2020-02-18

Similar Documents

Publication Publication Date Title
WO2018032373A1 (zh) 一种用于区块链的安全网络附加装置及方法
WO2018032374A1 (zh) 一种用于区块链的加密存储系统及其使用方法
WO2018032377A1 (zh) 一种用于区块链的只读安全文件存储系统及其方法
US11630910B2 (en) Integration of a block chain, managing group authority and access in an enterprise environment
CN111130757B (zh) 一种基于区块链的多云cp-abe访问控制方法
US8364984B2 (en) Portable secure data files
US8799651B2 (en) Method and system for encrypted file access
CN106131048B (zh) 一种用于区块链的非信任远程交易文件安全存储系统
US9672333B2 (en) Trusted storage
RU2500075C2 (ru) Создание и проверка достоверности документов, защищенных криптографически
CN104601579A (zh) 一种保障信息安全的计算机系统及其方法
CN104580487A (zh) 一种海量数据存储系统及处理方法
US8307217B2 (en) Trusted storage
US11256662B2 (en) Distributed ledger system
Shu et al. Shield: A stackable secure storage system for file sharing in public storage
US8499357B1 (en) Signing a library file to verify a callback function
Naor et al. Toward securing untrusted storage without public-key operations
US8756433B2 (en) Associating policy with unencrypted digital content
Shu et al. Secure storage system and key technologies
Payne A cryptographic access control architecture secure against privileged attackers
Lin et al. Approach of tamper detection for sensitive data based on negotiable hash algorithm
CN117677946A (zh) 用于改进基于分布式分类账的查询记录系统中的研究者隐私的系统和方法
Thorpe et al. Formal Hash Compression Provenance Techniques For The Preservation Of The Virtual Machine Log Auditor Environment
Rong et al. Effective storage security in incompletely trusted environment
Yang et al. Privacy-Preserving Accountable Cloud Storage

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16913133

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16913133

Country of ref document: EP

Kind code of ref document: A1