CN113449338B - Information encryption storage method and system based on blockchain - Google Patents

Abstract

The present invention discloses a method and system for information encryption storage based on blockchain, the method comprising: a first terminal receives login information and sends it to a cloud server for verification, if the verification is passed, the sensitive information input by the user is encrypted to obtain encrypted sensitive information and sent to the cloud server, the cloud server uploads the encrypted sensitive information to the blockchain network for segmented storage, a second terminal receives user login information and sends it to the cloud server for verification, if the verification is passed, an information acquisition request is generated and sent to the cloud server, the cloud server obtains the encrypted information corresponding to the information acquisition request and feeds it back to the second terminal, the second terminal decrypts the encrypted information according to the user login information to obtain decrypted sensitive information. The present invention belongs to the field of blockchain encryption technology, and can encrypt sensitive information and upload it to the blockchain network for segmented storage, thereby avoiding leakage of user sensitive information and improving the security of storing user sensitive information.

Description

Information encryption storage method and system based on blockchain

Technical Field

The present invention relates to the field of blockchain encryption technology, and belongs to an application scenario in which information is encrypted and stored based on a blockchain network in a smart city, and in particular to a blockchain-based information encryption storage method and system.

Background technique

With the development of information technology, more and more businesses can be handled online on the Internet. Handling businesses online on the Internet often involves the use of user sensitive information. In order to avoid information leakage in the process of obtaining user sensitive information, user sensitive information can be encrypted and stored through encryption methods. However, existing technical methods usually use parameter encryption and database storage, which makes user sensitive information easy to be leaked and the security of information storage is low. Therefore, the user sensitive information storage method in the existing technical method has the problem of low security.

Summary of the invention

The embodiments of the present invention provide a blockchain-based information encryption storage method and system, which aims to solve the problem of low security of user sensitive information storage methods in the prior art methods.

In a first aspect, an embodiment of the present invention provides a method for encrypting and storing information based on blockchain, which includes:

If the first terminal receives the login information input by the user, the first terminal sends the login information to the cloud server to obtain a verification result obtained by the cloud server verifying the login information;

If the verification result fed back by the cloud server received by the first terminal is that the verification is passed, the sensitive information input by the user is encrypted according to the preset encryption rule and the login information to obtain encrypted sensitive information and send it to the cloud server;

If the cloud server receives the encrypted sensitive information, it uploads the encrypted sensitive information to the blockchain network for segmented storage;

If the second terminal receives the user login information input by the user, the second terminal sends the user login information to the cloud server to obtain a verification result obtained by the cloud server verifying the user login information;

If the verification result fed back by the cloud server received by the second terminal is that the verification is passed, sending an information acquisition request corresponding to the user login information to the cloud server;

If the cloud server receives the information acquisition request, it obtains encrypted information matching the information acquisition request from the blockchain network and feeds it back to the second terminal;

If the second terminal receives the encrypted information fed back by the cloud server according to the information acquisition request, the encrypted information is decrypted according to the user login information to obtain the corresponding decrypted sensitive information.

In a second aspect, an embodiment of the present invention provides an information encryption storage system based on blockchain, which includes a first terminal, a second terminal and a blockchain network, wherein the first terminal and the second terminal are simultaneously connected to a cloud server in the blockchain network through a network to transmit data information;

The first terminal is used for:

If the login information input by the user is received, the login information is sent to the cloud server to obtain a verification result obtained by the cloud server verifying the login information;

If the verification result fed back by the cloud server is that the verification is passed, the sensitive information input by the user is encrypted according to the preset encryption rules and the login information to obtain encrypted sensitive information and send it to the cloud server;

The cloud server is used for:

If the encrypted sensitive information is received, uploading the encrypted sensitive information to the blockchain network for segmented storage;

If the information acquisition request is received, the encrypted information matching the information acquisition request is obtained from the blockchain network and fed back to the second terminal;

The second terminal is used for:

If user login information input by the user is received, the user login information is sent to the cloud server to obtain a verification result obtained by the cloud server verifying the user login information;

If the verification result fed back by the cloud server is that the verification is passed, sending an information acquisition request corresponding to the user login information to the cloud server;

If the encrypted information fed back by the cloud server according to the information acquisition request is received, the encrypted information is decrypted according to the user login information to obtain the corresponding decrypted sensitive information.

In the third aspect, an embodiment of the present invention further provides an information encryption storage system based on blockchain, which includes a first terminal, a second terminal and a blockchain network. The first terminal and the second terminal are simultaneously connected to a cloud server in the blockchain network through a network to transmit data information. The first terminal includes a first memory, a first processor and a first computer program stored in the first memory and executable on the first processor. The second terminal includes a second memory, a second processor and a second computer program stored in the second memory and executable on the second processor. The cloud server includes a third memory, a third processor and a third computer program stored in the third memory and executable on the third processor. The first processor executes the first computer program, the second processor executes the second computer program and the third processor executes the third computer program to jointly implement the information encryption storage method based on blockchain as described in the first aspect above.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a first computer program, a second computer program, or a third computer program, which, when the first computer program is executed by a first processor, the second computer program is executed by a second processor, and the third computer program is executed by a third processor, jointly implements the blockchain-based information encryption storage method as described in the first aspect above.

The embodiment of the present invention provides a method and system for information encryption and storage based on blockchain. The first terminal receives login information and sends it to a cloud server for verification. If the verification is successful, the sensitive information input by the user is encrypted to obtain encrypted sensitive information and sent to the cloud server. The cloud server uploads the encrypted sensitive information to the blockchain network for segmented storage. The second terminal receives the user login information and sends it to the cloud server for verification. If the verification is successful, an information acquisition request is generated and sent to the cloud server. The cloud server obtains the encrypted information corresponding to the information acquisition request and feeds it back to the second terminal. The second terminal decrypts the encrypted information according to the user login information to obtain decrypted sensitive information. Through the above method, sensitive information can be encrypted and uploaded to the blockchain network for segmented storage, which prevents the user's sensitive information from being leaked and improves the security of storing user sensitive information.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

FIG1 is a schematic diagram of a flow chart of a blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG2 is a schematic diagram of an application scenario of a blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG3 is a schematic diagram of a sub-process of a blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG4 is a schematic diagram of another sub-process of the blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG5 is a schematic diagram of another sub-process of the blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG6 is a schematic diagram of another sub-process of the blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG7 is a schematic diagram of another sub-process of the information encryption storage method based on blockchain provided by an embodiment of the present invention;

FIG8 is a schematic diagram of another sub-process of the blockchain-based information encryption storage method provided by an embodiment of the present invention;

FIG9 is a schematic block diagram of a blockchain-based information encryption storage system provided by an embodiment of the present invention;

FIG10 is a schematic block diagram of a computer device provided in an embodiment of the present invention.

Detailed ways

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and/or combinations thereof.

It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

It should be further understood that the term "and/or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

Please refer to Figures 1 and 2. Figure 1 is a flow chart of the information encryption storage method based on blockchain provided by an embodiment of the present invention; Figure 2 is a schematic diagram of an application scenario of the information encryption storage method based on blockchain provided by an embodiment of the present invention; the information encryption storage method based on blockchain is applied to an information encryption storage system based on blockchain, the system includes a first terminal 10, a second terminal 20 and a blockchain network 30, the method is executed by application software installed in the first terminal 10, the second terminal 20 and the cloud server 31 of the blockchain network 30, the first terminal 10 and the second terminal 20 are simultaneously connected to the cloud server 31 in the blockchain network 30 through a network to transmit data information, The first terminal 10 is a terminal device for receiving login information and sensitive information and encrypting sensitive information, such as a desktop computer, a laptop computer, a tablet computer or a mobile phone; the second terminal 20 is a terminal device for receiving user login information and decrypting the received encrypted information, such as a desktop computer, a laptop computer, a tablet computer or a mobile phone, etc. The blockchain network 30 is a data processing network composed of multiple terminal devices and a cloud server 31 based on smart contracts in the Internet. The cloud server 31 is a server end that accesses the blockchain network and processes the information input by the first terminal 10 and the second terminal 20 to provide corresponding services, such as a server built by an enterprise or a government department. As shown in Figure 1, the method includes steps S110 to S170.

S110: If the first terminal receives the login information input by the user, the first terminal sends the login information to the cloud server to obtain a verification result obtained by the cloud server verifying the login information.

If the first terminal receives the login information input by the user, the login information is sent to the cloud server to obtain the verification result obtained by the cloud server verifying the login information. The user can input the login information to the first terminal, and the first terminal can send the login information input by the user to the cloud server for verification. Specifically, the cloud server stores the password information corresponding to each registered user, and can verify whether the login password in the login information is the same as the password information corresponding to the user stored in the cloud server, so as to verify whether the login information is verified. If the verification result of the login information is verification passed, the subsequent steps will be continued. If the verification result is verification failed, the cloud server can feedback the prompt information of verification failure to the first terminal.

S120: If the verification result fed back by the cloud server received by the first terminal is that the verification is passed, the sensitive information input by the user is encrypted according to the preset encryption rule and the login information to obtain encrypted sensitive information and send it to the cloud server.

If the verification result received by the first terminal is verification passed, the sensitive information input by the user is encrypted according to the preset encryption rules and the login information to obtain encrypted sensitive information and send it to the cloud server. If the verification result of the login information is verification passed, the first terminal can receive the sensitive information input by the user. The sensitive information can be the user's ID number, mobile phone number, address, bank card number and other information containing personal privacy. The sensitive information input by the user can be encrypted according to the encryption rules and login information to obtain the corresponding encrypted sensitive information. The encryption rules are the specific rules for encrypting sensitive information. The login information can be used as the secret key and the identification information corresponding to the user in the encrypted sensitive information.

In one embodiment, as shown in FIG. 3 , step S120 includes sub-steps S121 , S122 , S123 , and S124 .

S121. Split the sensitive information according to the dimension types included in the encryption rule to obtain split information corresponding to each dimension type.

The encryption rules include multiple dimension types. Sensitive information can be split according to the dimension type to obtain the split information corresponding to each dimension type. For example, the dimension type can be ID number, mobile phone number, address, bank card number, etc., then the information corresponding to each dimension type can be obtained from the sensitive information as the corresponding split information.

S122. Generate a dimension encryption key corresponding to each dimension type according to the login information and the dimension identifier of each dimension type.

Each dimension type also corresponds to a dimension identifier. The corresponding dimension encryption key can be generated according to the login information and the dimension identifier of each dimension type. Specifically, the login information includes a login password. Each dimension type corresponds to a dimension identifier. The dimension identifiers are all English letters. For example, the dimension identifier corresponding to the "ID number" is "SFZH". The login password can be combined with each dimension identifier and converted into hexadecimal based on ASCII encoding to obtain the dimension encryption key corresponding to each dimension type. The obtained dimension encryption key is 16 bytes (128 bits) or 32 bytes (256 bits).

S123. Encrypt the split information corresponding to the corresponding dimension type according to the encryption rule and each dimension encryption key to obtain the encrypted split information corresponding to each dimension type.

Each dimensional encryption key corresponds to a dimensional type, and each dimensional type corresponds to a piece of split information. The split information of the dimensional type corresponding to each dimensional encryption key can be encrypted separately according to the encryption rules and each dimensional encryption key to obtain the encrypted split information corresponding to each dimensional type.

In one embodiment, as shown in FIG. 4 , step S123 includes sub-steps S1231 , S1232 , and S1233 .

S1231. Perform encoding conversion on each of the split information according to the encoding conversion information in the encryption rule to obtain a corresponding encoding string.

Specifically, the split information can be encoded and converted respectively according to the encoding conversion information in the encryption rule. Specifically, the character type of each split information can be determined. If the character type of the split information is numbers, letters, or a combination of numbers and letters, the hexadecimal encoding conversion can be performed through the basic conversion code in the encoding conversion information to obtain the corresponding encoding string. The basic conversion code can be ASCII encoding. If the character type of the split information is Chinese characters, the hexadecimal encoding conversion can be performed through the Chinese character conversion code in the encoding conversion information to obtain the corresponding encoding string. The Chinese character conversion code can be GB2312 encoding.

S1232. Perform key expansion according to the dimensional encryption key corresponding to each of the dimensional types to obtain an encryption key array corresponding to each of the dimensional encryption keys.

Since the encoded string needs to be encrypted multiple times during the encryption process, the dimensional encryption key of each dimensional type can be expanded to obtain the corresponding encryption key array. In each round of encryption, the corresponding key value can be obtained from the encryption key array for encryption. Specifically, each dimensional encryption key can be split, such as splitting a 16-byte (128-bit) dimensional encryption key into four segments, each of which contains 4 bytes (32 bits), namely W[0], W[1], W[2], and W[3]. By looping through formulas (1) and (2), W[j] is obtained in turn, j=4, 5...43, and the 44 key segments corresponding to each dimensional type are combined into the corresponding encryption key array.

Where g is the XOR operation of the mapping result after S-box mapping each byte in the secret key segment and a 32-bit constant (RC[j/4], 0, 0, 0), where RC is a one-dimensional array, RC = {00, 01, 02, 04, 08, 10, 20, 40, 80, 1B, 36}, It is the XOR operator identifier.

S1233. Encrypt the encoded character string corresponding to each of the encryption key arrays according to each of the encryption key arrays to obtain encrypted split information corresponding to each of the encoded character strings.

The encoded string of each dimension type is the plaintext. Before the plaintext is added with the round key, the plaintext can be split into 16-byte plaintext segments (if the encoded string is not larger than 16 bytes, it is not split; if it is larger, it is split), and each plaintext segment is converted into a corresponding 4×4 matrix. After that, each round key addition is an XOR operation with the encryption key array of the corresponding dimension type. Specifically, each byte in the matrix is mapped with an S-box, which is a preset 16×16 array. The S-box mapping process can be expressed by formula (3):

S(2 ⁸ )＝S[2 ⁴ ][2 ⁴ ] (3);

Wherein, a2 ⁸ is the original byte a for S-box mapping, and the original byte a is represented by an 8-bit binary number. S[2 ⁴ ][2 ⁴ ] represents the specific operation of obtaining the value of the corresponding position in the S-box according to the original byte a. The first 2 ⁴ of S[2 ⁴ ][2 ⁴ ] represents the first 4 binary digits of the original byte a, and the second 2 ⁴ represents the last 4 binary digits of the original byte a. For example, the process of S-box mapping the original byte 13 can be expressed as: S(13)=S[1][3].

After performing S-box mapping on each byte in the 4×4 matrix, the mapped matrix is subjected to row shift and column confusion processing to obtain the final processed encryption matrix. By combining one or more encryption matrices corresponding to the same coded string, the encrypted split information corresponding to each coded string can be obtained.

S124. Combine the encrypted split information and the login information to obtain encrypted sensitive information corresponding to the sensitive information.

Specifically, the encrypted split information and login information can be combined, and the combined information contains identification information corresponding to the login information. The identification information can be used to uniquely identify the combined information, and the combined information is sent to the cloud server as encrypted sensitive information corresponding to the sensitive information.

In one embodiment, as shown in FIG. 5 , step S124 includes sub-steps S1241 and S1242 .

S1241. Sign the user identification information in the login information according to the signature rule in the encryption rule to obtain corresponding identification signature information.

Specifically, the user identification information in the login information can be signed according to the signature rules. The user identification information is the identification information in the login information that uniquely corresponds to the user, and the user identification information cannot be changed once generated. The user identification information can be composed of numbers, letters, or a combination of numbers and letters. Specifically, the signature can be implemented based on a hash operation (Hash), such as the Secure Hash Algorithm 256 (SHA256).

In this embodiment, Hash (user identification information) = identification signature information, for example, Hash (ID = "0715443286317579") = 0x57F319BD30A72E9F3C63E8F10A7B29C6, that is, after performing a hash operation on the user identification information, a summary information will be obtained, and the summary information is the corresponding identification signature information. For messages of any length (calculated in bits), SHA256 (Secure Hash Algorithm 256) will generate a 32-byte length data, and SHA256 always treats the message as a bit string. When receiving data information, the summary information corresponding to the data information can be used to verify whether the data information has changed, that is, to verify its integrity.

S1242. Combine the identification signature information with each encrypted split information of the sensitive information, and use the encrypted combination information corresponding to each encrypted split information obtained after the combination as the encrypted sensitive information.

Combine the identification signature information with each encrypted split information of each encrypted sensitive information respectively. The identification signature information can be combined with one encrypted split information to obtain the corresponding encrypted combination information. The encrypted combination information corresponding to each encrypted split information can be combined to obtain the corresponding encrypted sensitive information. The first terminal can then send the obtained encrypted sensitive information to the cloud server.

S130. If the cloud server receives the encrypted sensitive information, the encrypted sensitive information is uploaded to the blockchain network for segmented storage.

If the cloud server receives the encrypted sensitive information, it uploads the encrypted sensitive information to the blockchain network for segmented storage. After the cloud server receives the encrypted sensitive information sent by the first terminal, it can store the encrypted sensitive information. In this embodiment, the encrypted sensitive information is uploaded to the blockchain network for storage. The blockchain network is used to perform distributed storage of the encrypted sensitive information, which can prevent the encrypted sensitive information from being tampered with, thereby greatly improving the security and reliability of the storage of the encrypted sensitive information.

In one embodiment, as shown in FIG. 6 , step S130 includes sub-steps S131 and S132 .

S131. Obtain blockchain node information corresponding to each encrypted combination information in a pre-stored node database according to the dimension type corresponding to each encrypted combination information in the encrypted information.

The node database is a database configured in the cloud server for storing blockchain node information. The node database contains node information corresponding to each dimension type. The blockchain network contains multiple storage channels, each storage channel corresponds to a dimension type, and each storage channel can store information of a corresponding dimension type. The encrypted sensitive information contains multiple encrypted combination information, each encrypted combination information corresponds to a dimension type. According to the dimension type corresponding to each encrypted combination information, the node information corresponding to the corresponding dimension type can be obtained from the node database as the blockchain node information corresponding to each encrypted combination information.

S132. According to the blockchain node information, each encrypted combination of information is uploaded to the blockchain node corresponding to the corresponding blockchain node information for storage.

According to the blockchain node information corresponding to each encrypted combination information, the blockchain node information includes the network address of the corresponding blockchain node. Then, each encrypted combination information can be uploaded to the blockchain node corresponding to the corresponding blockchain node information for storage, thereby achieving the purpose of distributed storage of each encrypted combination information. Since the encrypted sensitive information is split into multiple encrypted combination information for distributed storage, this storage process is also segmented storage of the encrypted sensitive information.

S140: If the second terminal receives the user login information input by the user, the second terminal sends the user login information to the cloud server to obtain a verification result obtained by the cloud server verifying the user login information.

If the second terminal receives the user login information input by the user, the user login information is sent to the cloud server to obtain the verification result obtained by the cloud server verifying the user login information. The second terminal can also receive the user login information input by the user, so the second terminal can send the user login information input by the user to the cloud server for verification. Specifically, the process of verifying the user login information is the same as the process of verifying the login information received by the first terminal. If the verification result of the user login information is verification passed, the subsequent steps are continued. If the verification result is verification failed, the cloud server can feedback a prompt message of verification failure to the second terminal.

S150: If the verification result fed back by the cloud server received by the second terminal is that the verification is passed, send an information acquisition request corresponding to the user login information to the cloud server.

If the verification result fed back by the cloud server received by the second terminal is that the verification is passed, an information acquisition request corresponding to the user login information is sent to the cloud server. If the verification result of the user login information is that the verification is passed, the second terminal can generate a corresponding information acquisition request based on the user login information and send it to the cloud server.

In one embodiment, as shown in FIG. 7 , step S150 includes sub-steps S151 and S152 .

S151. Sign the user identification information in the user login information according to the signature rule to obtain corresponding user identification signature information.

Specifically, the user identification information included in the user login information can be signed according to the signature rule, and the specific process of signing the user identification information of the user login information is the same as the process of signing the user identification information of the login information. After the user identification information in the user login information is signed by the same method, the corresponding user identification signature information can be obtained.

S152: Generate a corresponding information acquisition request according to the user identification signature information and send it to the cloud server.

A corresponding information acquisition request can be generated based on the user identification signature information, and the generated information acquisition request can include user identification signature information, timestamp, terminal network address information, etc. The timestamp is the specific time information for generating the information acquisition request, and the terminal network address information is the network address (IP address) corresponding to the second terminal.

S160. If the cloud server receives the information acquisition request, it obtains encrypted information matching the information acquisition request from the blockchain network and feeds it back to the second terminal.

If the cloud server receives the information acquisition request, it obtains the encrypted information matching the information acquisition request from the blockchain network and feeds it back to the second terminal. After receiving the information acquisition request, the cloud server can determine whether the information acquisition request meets the corresponding acquisition conditions. If the information acquisition request meets the acquisition conditions, the step of obtaining the encrypted information matching the information acquisition request from the blockchain network and feeding it back to the second terminal is executed; if the information acquisition request does not meet the acquisition conditions, a prompt message indicating that the information acquisition failed is fed back to the second terminal.

Specifically, the acquisition conditions may include a preset time and a network address blacklist; judging whether the information acquisition request satisfies the preset acquisition conditions includes: judging whether the timestamp of the information acquisition request exceeds the preset time; judging whether the terminal network address information of the information acquisition request is not included in the network address blacklist; if the timestamp does not exceed the preset time and the terminal network address information is not included in the network address blacklist, judging whether the information acquisition request satisfies the acquisition conditions.

First, it can be judged whether the timestamp exceeds the preset time, and then it can be judged whether the terminal network address information is legal address information. If the preset time can be 2 minutes, it can be judged whether the timestamp is a time point within 2 minutes before the current time. If the timestamp is a time point within 2 minutes before the current time, it is judged that the timestamp does not exceed the preset time. Otherwise, it is judged that the timestamp exceeds the preset time. If the network address blacklist can be configured in the acquisition condition, it is verified whether the terminal network address information in the information acquisition request is not included in the network address blacklist to determine whether the terminal network address information is legal address information. If it is judged that the timestamp does not exceed the preset time and the terminal network address information is legal address information, it can be judged that the information acquisition request meets the acquisition condition, and the encrypted information matching the user identification signature information can be obtained from the blockchain network according to the user identification signature information in the information acquisition request, and the encrypted information is sent to the corresponding terminal according to the terminal network address information in the information acquisition request. If it is judged that the timestamp exceeds the preset time or the terminal network address information is not legal address information, it can be judged that the information acquisition request does not meet the acquisition condition, and at this time, a prompt message of information acquisition failure can be fed back to the second terminal.

S170: If the second terminal receives the encrypted information fed back by the cloud server according to the information acquisition request, the encrypted information is decrypted according to the user login information to obtain corresponding decrypted sensitive information.

If the second terminal receives the encrypted information fed back by the cloud server according to the information acquisition request, the encrypted information is decrypted according to the user login information to obtain the corresponding decrypted sensitive information. After the second terminal receives the encrypted information, it can decrypt the encrypted information according to the user login information input by the user into the second terminal to obtain the corresponding decrypted sensitive information.

In one embodiment, as shown in FIG. 8 , step S170 includes sub-steps S171 , S172 , and S173 .

S171. Generate a dimension decryption key corresponding to each dimension type according to the user login information and the dimension identifier of each dimension type.

The user login information includes the corresponding user login password. The user login password can be combined with the dimension identifier of each dimension type to generate a dimension decryption key corresponding to each dimension type. The specific process of obtaining the dimension decryption key is the same as the specific process of obtaining the dimension encryption key, which will not be repeated here.

S172. Decrypt the encrypted segment information corresponding to the corresponding dimensional type in the encrypted information according to the encryption rule and each dimensional decryption key to obtain decrypted information corresponding to each dimensional type.

The encrypted information can be decrypted according to the encryption rules and the dimensional decryption key of each dimensional type to obtain the decrypted information corresponding to each dimensional type. Specifically, the key expansion can be performed according to the dimensional decryption key corresponding to each dimensional type to obtain the decryption key array corresponding to each dimensional decryption key. The process of obtaining the decryption key array is the same as the process of obtaining the encryption key array, which will not be described in detail here. After that, the encrypted segment information of each dimensional type can be decrypted separately based on the decryption key array corresponding to each dimensional type. The decryption process is the inverse operation process of the encryption process, which will not be described in detail again. After decrypting each encrypted information segment separately, the decrypted string corresponding to each encrypted information segment can be obtained. The decrypted string can be converted to the code, and the decrypted string represented in hexadecimal can be restored to the specific decrypted information.

S173. Combine the decrypted information corresponding to each dimension type to obtain the decrypted sensitive information.

By combining the decrypted information obtained from each dimension type, the decrypted sensitive information can be obtained, and the decrypted sensitive information contains complete sensitive information of a user.

The technical method in this application can be applied to scenarios such as smart government affairs/smart urban management/smart communities/smart security/smart logistics/smart medical care/smart education/smart environmental protection/smart transportation that involve encrypted storage of information based on blockchain networks, thereby promoting the construction of smart cities.

In the information encryption storage method based on blockchain provided in the embodiment of the present invention, the first terminal receives the login information and sends it to the cloud server for verification. If the verification is successful, the sensitive information input by the user is encrypted to obtain the encrypted sensitive information and sent to the cloud server. The cloud server uploads the encrypted sensitive information to the blockchain network for segmented storage. The second terminal receives the user login information and sends it to the cloud server for verification. If the verification is successful, an information acquisition request is generated and sent to the cloud server. The cloud server obtains the encrypted information corresponding to the information acquisition request and feeds it back to the second terminal. The second terminal decrypts the encrypted information according to the user login information to obtain the decrypted sensitive information. Through the above method, sensitive information can be encrypted and uploaded to the blockchain network for segmented storage, which prevents the user's sensitive information from being leaked and improves the security of storing user sensitive information.

An embodiment of the present invention also provides a blockchain-based information encryption storage system, which is used to execute any embodiment of the aforementioned blockchain-based information encryption storage method. Specifically, please refer to Figure 9, which is a schematic block diagram of the blockchain-based information encryption storage system provided by an embodiment of the present invention.

As shown in FIG9 , the information encryption storage system 100 based on blockchain includes a first terminal 10, a second terminal 20 and a blockchain network 30. The first terminal 10 and the second terminal 20 are simultaneously connected to the cloud server 31 in the blockchain network 30 through a network to transmit data information. Among them, the first terminal 10 includes: a login information verification unit 11, which is used to send the login information to the cloud server to obtain the verification result obtained by the cloud server for verifying the login information if the login information input by the user is received; a sensitive information encryption unit 12, which is used to encrypt the sensitive information input by the user according to the preset encryption rules and the login information to obtain encrypted sensitive information and send it to the cloud server if the verification result fed back by the cloud server is that the verification is passed; the cloud server 31 includes: an information storage unit 311, which is used to upload the encrypted sensitive information to the blockchain network for segmented storage if the encrypted sensitive information is received; an encrypted information feedback unit 312, which is used to obtain the encrypted sensitive information from the blockchain if the information acquisition request is received. The second terminal 20 comprises: a user login information verification unit 21, which is used to send the user login information to the cloud server to obtain the verification result obtained by the cloud server for verifying the user login information if the user login information input by the user is received; an information acquisition request sending unit 22, which is used to send the information acquisition request corresponding to the user login information to the cloud server if the verification result fed back by the cloud server is that the verification is passed; an encrypted information decryption unit 23, which is used to decrypt the encrypted information according to the user login information to obtain the corresponding decrypted sensitive information if the encrypted information fed back by the cloud server according to the information acquisition request is received.

In one embodiment, the sensitive information encryption unit 12 includes sub-units: a split information acquisition unit, which is used to split the sensitive information according to the dimension type included in the encryption rule to obtain split information corresponding to each dimension type; a dimension encryption key acquisition unit, which is used to generate a dimension encryption key corresponding to each dimension type according to the login information and the dimension identifier of each dimension type; an encrypted split information acquisition unit, which is used to encrypt the split information corresponding to the corresponding dimension type according to the encryption rule and each dimension encryption key to obtain encrypted split information corresponding to each dimension type; an encrypted sensitive information acquisition unit, which is used to combine the encrypted split information with the login information to obtain encrypted sensitive information corresponding to the sensitive information.

In one embodiment, the encrypted split information acquisition unit includes sub-units: a coding string acquisition unit, which is used to perform coding conversion on each of the split information according to the coding conversion information in the encryption rule to obtain a corresponding coding string; an encryption key array acquisition unit, which is used to perform key expansion according to the dimensional encryption key corresponding to each of the dimensional types to obtain an encryption key array corresponding to each of the dimensional encryption keys; an encryption processing unit, which is used to perform encryption processing on the coding strings corresponding to each of the encryption key arrays according to each of the encryption key arrays to obtain encrypted split information corresponding to each of the coding strings.

In one embodiment, the encrypted sensitive information acquisition unit includes sub-units: an identification signature information acquisition unit, which is used to sign the user identification information in the login information according to the signature rule in the encryption rule to obtain corresponding identification signature information; an information combination unit, which is used to combine the identification signature information with each encrypted split information of the sensitive information, and use the encrypted combination information corresponding to each encrypted split information obtained after the combination as the encrypted sensitive information.

In one embodiment, the information storage unit 311 includes sub-units: a blockchain node information acquisition unit, which is used to acquire the blockchain node information corresponding to each encrypted combination information in a pre-stored node database according to the dimension type corresponding to each encrypted combination information in the encrypted information; an encrypted combination information uploading unit, which is used to upload each encrypted combination information to the blockchain node corresponding to the corresponding blockchain node information for storage according to the blockchain node information.

In one embodiment, the information acquisition request sending unit 22 includes sub-units: a user identification signature information acquisition unit, which is used to sign the user identification information in the user login information according to the signature rule to obtain the corresponding user identification signature information; a request sending unit, which is used to generate a corresponding information acquisition request according to the user identification signature information and send it to the cloud server.

In one embodiment, the encrypted information decryption unit 23 includes sub-units: a dimension decryption key acquisition unit, which is used to generate a dimension decryption key corresponding to each dimension type according to the user login information and the dimension identifier of each dimension type; a decryption information acquisition unit, which is used to decrypt the encrypted segment information corresponding to the corresponding dimension type in the encrypted information according to the encryption rule and each dimension decryption key, and obtain decrypted information corresponding to each dimension type; a decryption information combination unit, which is used to combine the decrypted information corresponding to each dimension type to obtain the decrypted sensitive information.

The blockchain-based information encryption storage system provided in the embodiment of the present invention applies the above-mentioned blockchain-based information encryption storage method. The first terminal receives the login information and sends it to the cloud server for verification. If the verification is successful, the sensitive information input by the user is encrypted to obtain the encrypted sensitive information and sent to the cloud server. The cloud server uploads the encrypted sensitive information to the blockchain network for segmented storage. The second terminal receives the user login information and sends it to the cloud server for verification. If the verification is successful, an information acquisition request is generated and sent to the cloud server. The cloud server obtains the encrypted information corresponding to the information acquisition request and feeds it back to the second terminal. The second terminal decrypts the encrypted information according to the user login information to obtain the decrypted sensitive information. Through the above method, sensitive information can be encrypted and uploaded to the blockchain network for segmented storage, which prevents the user's sensitive information from being leaked and improves the security of storing user sensitive information.

The above-mentioned blockchain-based information encryption storage system can be implemented in the form of a computer program, which can be run on a computer device as shown in FIG10 .

Please refer to Figure 10, which is a schematic block diagram of a computer device provided in an embodiment of the present invention. The computer device may be a first terminal 10 for executing a blockchain-based information encryption storage method to implement encrypted storage of information based on a blockchain network, a second terminal 20 for executing a blockchain-based information encryption storage method to implement encrypted storage of information based on a blockchain network, or a cloud server 31 for executing a blockchain-based information encryption storage method to implement encrypted storage of information based on a blockchain network.

10 , the computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

The storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 can execute the information encryption storage method based on blockchain, wherein the storage medium 503 can be a volatile storage medium or a non-volatile storage medium.

The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the information encryption storage method based on the blockchain.

The network interface 505 is used for network communication, such as providing data information transmission, etc. Those skilled in the art can understand that the structure shown in FIG10 is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device 500 to which the solution of the present invention is applied. The specific computer device 500 may include more or less components than those shown in the figure, or combine some components, or have a different arrangement of components.

The processor 502 is used to run a computer program 5032 stored in the memory to implement the corresponding functions in the above-mentioned blockchain-based information encryption storage method.

Those skilled in the art will appreciate that the embodiment of the computer device shown in FIG10 does not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structure and function of the memory and the processor are consistent with the embodiment shown in FIG10, and will not be described in detail here.

It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium. The computer-readable storage medium stores a first computer program, a second computer program, or a third computer program, and when the first computer program is executed by a first processor, the second computer program is executed by a second processor, and the third computer program is executed by a third processor, the above-mentioned blockchain-based information encryption storage method is jointly implemented.

Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the above-described equipment, devices and units can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. Those of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

In the several embodiments provided by the present invention, it should be understood that the disclosed equipment, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. Units with the same function may also be combined into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a computer-readable storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a magnetic disk or an optical disk.

The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or substitutions within the technical scope disclosed by the present invention, and these modifications or substitutions should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims (8)

1. A blockchain-based information encryption storage method, characterized in that the method is applied to a blockchain-based information encryption storage system, the system comprising a first terminal, a second terminal and a blockchain network, the first terminal and the second terminal are simultaneously connected to a cloud server in the blockchain network through a network to transmit data information, the method comprising: If the first terminal receives the login information input by the user, the first terminal sends the login information to the cloud server to obtain a verification result obtained by the cloud server verifying the login information; If the verification result fed back by the cloud server received by the first terminal is that the verification is passed, the sensitive information input by the user is encrypted according to the preset encryption rule and the login information to obtain encrypted sensitive information and send it to the cloud server; If the cloud server receives the encrypted sensitive information, it uploads the encrypted sensitive information to the blockchain network for segmented storage; If the second terminal receives the user login information input by the user, the second terminal sends the user login information to the cloud server to obtain a verification result obtained by the cloud server verifying the user login information; If the verification result fed back by the cloud server received by the second terminal is that the verification is passed, sending an information acquisition request corresponding to the user login information to the cloud server; If the cloud server receives the information acquisition request, it obtains encrypted information matching the information acquisition request from the blockchain network and feeds it back to the second terminal; If the second terminal receives the encrypted information fed back by the cloud server according to the information acquisition request, the encrypted information is decrypted according to the user login information to obtain the corresponding decrypted sensitive information; wherein, The step of encrypting the sensitive information input by the user according to the preset encryption rule and the login information to obtain the encrypted sensitive information and sending the encrypted sensitive information to the cloud server includes: Splitting the sensitive information according to the dimension types included in the encryption rule to obtain split information corresponding to each dimension type; Generate a dimension encryption key corresponding to each dimension type according to the login information and the dimension identifier of each dimension type; According to the encryption rule and each dimension encryption key, the split information corresponding to the corresponding dimension type is encrypted respectively to obtain the encrypted split information corresponding to each dimension type; The encrypted split information and the login information are combined to obtain encrypted sensitive information corresponding to the sensitive information; wherein, The encryption process is performed on the split information corresponding to the corresponding dimension type according to the encryption rule and each dimension encryption key to obtain the encrypted split information corresponding to each dimension type, including: Performing encoding conversion on each of the split information according to the encoding conversion information in the encryption rule to obtain a corresponding encoding string; Perform key expansion according to the dimension encryption key corresponding to each dimension type to obtain an encryption key array corresponding to each dimension encryption key; According to each of the encryption key arrays, the coded character string corresponding to each of the encryption key arrays is encrypted to obtain the encrypted split information corresponding to each of the coded character strings. 2. The method for encrypted information storage based on blockchain according to claim 1, characterized in that the step of combining the encrypted split information with the login information to obtain encrypted sensitive information corresponding to the sensitive information comprises: Signing the user identification information in the login information according to the signature rule in the encryption rule to obtain corresponding identification signature information; The identification signature information is combined with each encrypted split information of the sensitive information, and the encrypted combination information corresponding to each encrypted split information obtained after the combination is used as the encrypted sensitive information. 3. The method for encrypted information storage based on blockchain according to claim 1, characterized in that uploading the encrypted sensitive information to the blockchain network for segmented storage comprises: According to the dimension type corresponding to each of the encrypted combination information in the encrypted information, obtain the blockchain node information corresponding to each of the encrypted combination information in the pre-stored node database; According to the blockchain node information, each of the encrypted combination information is uploaded to the blockchain node corresponding to the corresponding blockchain node information for storage. 4. The method for encrypted information storage based on blockchain according to claim 2, characterized in that the sending of the information acquisition request corresponding to the user login information to the cloud server comprises: Signing the user identification information in the user login information according to the signature rule to obtain corresponding user identification signature information; A corresponding information acquisition request is generated according to the user identification signature information and sent to the cloud server. 5. The method for encrypted information storage based on blockchain according to claim 1, characterized in that the decrypting of the encrypted information according to the user login information to obtain the corresponding decrypted sensitive information comprises: Generate a dimension decryption key corresponding to each dimension type according to the user login information and the dimension identifier of each dimension type; Decrypt the encrypted segment information corresponding to the corresponding dimension type in the encrypted information according to the encryption rule and each dimension decryption key to obtain decrypted information corresponding to each dimension type; The decrypted information corresponding to each dimension type is combined to obtain the decrypted sensitive information. 6. The method for encrypted information storage based on blockchain according to claim 1, characterized in that before obtaining the encrypted information matching the information acquisition request from the blockchain network and feeding it back to the second terminal, it also includes: Determining whether the information acquisition request meets a preset acquisition condition; If the information acquisition request satisfies the acquisition condition, the step of acquiring encrypted information matching the information acquisition request from the blockchain network and feeding it back to the second terminal is performed; If the information acquisition request does not meet the acquisition condition, a prompt message indicating that the information acquisition failed is fed back to the second terminal. 7. The method for encrypted information storage based on blockchain according to claim 6, wherein the acquisition condition includes a preset time and a network address blacklist, and the step of determining whether the information acquisition request satisfies the preset acquisition condition includes: Determine whether the timestamp of the information acquisition request exceeds the preset time; Determining whether the terminal network address information of the information acquisition request is not included in the network address blacklist; If the timestamp does not exceed the preset time and the terminal network address information is not included in the network address blacklist, it is determined whether the information acquisition request satisfies the acquisition condition. 8. An information encryption storage system based on blockchain, characterized in that the system includes a first terminal, a second terminal and a blockchain network, and the first terminal and the second terminal are simultaneously connected to a cloud server in the blockchain network through a network to transmit data information; The first terminal is used for: If the login information input by the user is received, the login information is sent to the cloud server to obtain a verification result obtained by the cloud server verifying the login information; If the verification result fed back by the cloud server is that the verification is passed, the sensitive information input by the user is encrypted according to the preset encryption rules and the login information to obtain encrypted sensitive information and send it to the cloud server; The cloud server is used for: If the encrypted sensitive information is received, uploading the encrypted sensitive information to the blockchain network for segmented storage; If the information acquisition request is received, the encrypted information matching the information acquisition request is obtained from the blockchain network and fed back to the second terminal; The second terminal is used for: If user login information input by the user is received, the user login information is sent to the cloud server to obtain a verification result obtained by the cloud server verifying the user login information; If the verification result fed back by the cloud server is that the verification is passed, sending an information acquisition request corresponding to the user login information to the cloud server; If the encrypted information fed back by the cloud server according to the information acquisition request is received, the encrypted information is decrypted according to the user login information to obtain the corresponding decrypted sensitive information; wherein, The step of encrypting the sensitive information input by the user according to the preset encryption rule and the login information to obtain the encrypted sensitive information and sending the encrypted sensitive information to the cloud server includes: Splitting the sensitive information according to the dimension types included in the encryption rule to obtain split information corresponding to each dimension type; Generate a dimension encryption key corresponding to each dimension type according to the login information and the dimension identifier of each dimension type; According to the encryption rule and each dimension encryption key, the split information corresponding to the corresponding dimension type is encrypted respectively to obtain the encrypted split information corresponding to each dimension type; The encrypted split information and the login information are combined to obtain encrypted sensitive information corresponding to the sensitive information; wherein, The encryption process is performed on the split information corresponding to the corresponding dimension type according to the encryption rule and each dimension encryption key to obtain the encrypted split information corresponding to each dimension type, including: Performing encoding conversion on each of the split information according to the encoding conversion information in the encryption rule to obtain a corresponding encoding string; Perform key expansion according to the dimension encryption key corresponding to each dimension type to obtain an encryption key array corresponding to each dimension encryption key; According to each of the encryption key arrays, the coded character string corresponding to each of the encryption key arrays is encrypted to obtain the encrypted split information corresponding to each of the coded character strings.