WO2022105505A1 - 应用于区块链***的数据处理方法及装置 - Google Patents

应用于区块链***的数据处理方法及装置 Download PDF

Info

Publication number
WO2022105505A1
WO2022105505A1 PCT/CN2021/124282 CN2021124282W WO2022105505A1 WO 2022105505 A1 WO2022105505 A1 WO 2022105505A1 CN 2021124282 W CN2021124282 W CN 2021124282W WO 2022105505 A1 WO2022105505 A1 WO 2022105505A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
node
access terminal
role
target data
Prior art date
Application number
PCT/CN2021/124282
Other languages
English (en)
French (fr)
Inventor
李茂材
蓝虎
王宗友
周开班
刘攀
朱耿良
时一防
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to EP21893654.0A priority Critical patent/EP4191430A4/en
Publication of WO2022105505A1 publication Critical patent/WO2022105505A1/zh
Priority to US17/955,422 priority patent/US20230014599A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms

Definitions

  • the present application relates to the field of blockchain technology, in particular, to data processing applied to blockchain systems.
  • the current common implementation method is to connect each institution that needs to share data separately to obtain data from the connected institution.
  • various institutions Due to the inconsistent equipment interface standards of different institutions and the inconsistent collaboration processes of different institutions, various institutions The efficiency of data sharing between them is very low.
  • the embodiments of the present application provide a data processing method and device, an electronic device, and a computer-readable storage medium applied to a blockchain system.
  • the embodiments of the present application use the blockchain technology to achieve different Data sharing between institutions can greatly improve the efficiency of data sharing between different institutions.
  • a data processing method applied to a blockchain system where the blockchain system includes a plurality of node devices, the plurality of node devices are respectively connected to at least one access terminal and Corresponding to a node role respectively, the access terminal has the authority of the node role corresponding to the connected node device, the method is executed by the node device in the blockchain system, and the method includes: responding to the access terminal to the block A request for writing target data in the chain, determining a target node role that has read permission for the target data, wherein the target access terminal is one of the access terminals connected to the node device; obtain the The encryption key corresponding to the target node role; the target data is encrypted according to the encryption key to obtain the ciphertext corresponding to the target data, and the ciphertext corresponding to the target data can be used by the target node role
  • the corresponding access terminal decrypts; and the ciphertext corresponding to the target data is stored on the blockchain.
  • a data processing apparatus applied to a blockchain system where the blockchain system includes a plurality of node devices, the plurality of node devices are respectively connected to at least one access terminal and Corresponding to a node role respectively, the access terminal has the authority of the node role corresponding to the connected node device, the device is configured on the node device in the blockchain system, and the device includes: a node role determination module, which configures In response to the request of the access terminal to write target data into the blockchain, determine the target node role that has read permission for the target data, wherein the target access terminal is the access terminal connected to the node device.
  • an access terminal configured to acquire an encryption key corresponding to the role of the target node; a data encryption module, configured to perform encryption processing on the target data according to the encryption key, and obtain the The ciphertext corresponding to the target data, the ciphertext corresponding to the target data can be decrypted by the access terminal corresponding to the target node role; the data storage module is configured to store the ciphertext corresponding to the target data to the blockchain superior.
  • a data processing method applied to a blockchain system where the blockchain system includes a plurality of node devices, the plurality of node devices are respectively connected to at least one access terminal and Corresponding to a node role respectively, the access terminal has the authority of the node role corresponding to the connected node device, the method is executed by the node device in the blockchain system, and the method includes: in response to the target access terminal reading request for target data, send the ciphertext corresponding to the target data stored in the blockchain to the target access terminal, so that the target access terminal can use the private key corresponding to the node role to which it belongs to, to the target access terminal.
  • the ciphertext corresponding to the data is decrypted to obtain the target data; wherein, the target access terminal is one of the access terminals connected to the node device, and the ciphertext corresponding to the target data is based on the encrypted password.
  • the encryption key is obtained by encrypting the target data, and the encryption key is an encryption key corresponding to the role of the target node that has read permission for the target data.
  • an electronic device including a processor and a memory, where computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the above aspects are implemented.
  • a computer-readable storage medium on which a computer program is stored, and the computer program is used to execute the data processing method applied to a blockchain system described in the above aspect.
  • a computer program product or computer program including computer instructions, and the computer instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the data processing method applied to the blockchain system described in the above aspects.
  • the node devices in the blockchain system can be specifically implemented as servers of different institutions, because each node device stores the full amount of block data, that is, on the blockchain The data of each institution is stored, so that each institution can obtain the data of other institutions from the blockchain, thus realizing standardized and generalized data sharing through blockchain technology, which can greatly improve the efficiency of data sharing. .
  • the data on the blockchain is only It can be acquired by other access terminals that have read permission to the data, that is, only institutions with read permission can obtain the data of other institutions from the blockchain, which not only improves the ability of sharing data between different institutions. efficiency, while ensuring the security of data sharing.
  • FIG. 1 is a schematic diagram of an implementation environment involved in an embodiment of the present application.
  • FIG. 2 is a flowchart of a data processing method applied to a blockchain system according to an exemplary embodiment of the present application
  • FIG. 3 is a flowchart of obtaining an encryption key corresponding to a target node role according to an exemplary embodiment of the present application
  • FIG. 4 is a flowchart of obtaining a role shared key corresponding to a target node role according to an exemplary embodiment of the present application
  • Fig. 5 is a flowchart of another data processing method applied to a blockchain system proposed on the basis of the embodiment shown in Fig. 2;
  • FIG. 6 is a block diagram of a data processing apparatus applied to a blockchain system according to an exemplary embodiment of the present application
  • FIG. 7 shows a schematic structural diagram of a computer system suitable for implementing the electronic device according to the embodiment of the present application.
  • FIG. 1 is a schematic diagram of an implementation environment involved in the present application, and the implementation environment is specifically a blockchain system.
  • the blockchain system 100 shown in FIG. 1 refers to a system for data sharing between node devices 10 and node devices 10 , and each node device 10 stores a complete blockchain 20 .
  • the blockchain 20 is composed of multiple blocks, each block includes a block header and a block body, and the block header stores information such as block height. It can be seen that the block data stored in each node device 10 is completely consistent.
  • Each node device 10 is respectively connected with at least one access terminal 30 , for example, the access terminal 30 may be connected to the node device through a wired or wireless network, so as to perform data interaction with the node device 10 .
  • Any access terminal 30 can write data into the blockchain 20, or read data stored in the blockchain 20, thereby realizing efficient sharing of block data.
  • the data stored on the blockchain 20 is usually large and complex.
  • the node device 10 is specifically implemented as different national departments (such as public security departments, civil affairs departments, taxation departments, industrial and commercial departments, Education sector, etc.) are respectively deployed in the servers in the blockchain system 100, so the blockchain 20 stores data of each country sector.
  • the access terminal 30 connected to the node device 10 is specifically implemented as a user access terminal belonging to a corresponding national department.
  • the blockchain system 100 Permissions are configured for the block data stored on the blockchain 20, for example, including read permission and/or write permission.
  • the tax department can read the user's children's education, parents' pension, mortgage and other data from the blockchain 20 when processing the user's personal tax deduction, but cannot modify these data.
  • the public security department can only modify the data of its own department stored in the blockchain 20, such as the user's household registration, criminal record, etc., but cannot modify the data of other national departments stored in the blockchain 20.
  • the blockchain system 100 shown in FIG. 1 can not only efficiently share data, but also ensure data security in the process of data sharing, and can satisfy any requirement for sharing efficiency and data security in the process of data sharing. It can also be used in scenarios with high requirements on sexuality, such as data sharing among various departments or branches of an enterprise, data sharing among multiple people, etc., which is not restricted here.
  • the access terminal 30 in the blockchain system 100 shown in FIG. 1 may be an electronic device such as a smart phone, tablet, laptop, computer, etc.
  • the node device 10 may be an independent physical server, or multiple
  • a server cluster or distributed system composed of physical servers can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network, content distribution network) and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms, and this is not restricted here.
  • FIG. 2 is a flowchart of a data processing method applied to a blockchain system according to an exemplary embodiment of the present application.
  • the blockchain system to which the method is applied may be the blockchain system 100 shown in FIG. 1 , and the method may be specifically executed by any node device 10 in the blockchain system 100 .
  • the method can also be applied to other blockchain systems, and the blockchain system includes multiple node devices, so that the method can be executed by any node device.
  • Each node device is connected to one or more access terminals, and each node device stores a complete blockchain, that is, each node device stores a full amount of block data, and the block data in the blockchain is configured have corresponding permissions.
  • the permissions of blockchain data can include read permissions and write permissions.
  • An access terminal with read permissions for block data can read the block data from the blockchain, and access terminals with read permissions for block data can read the block data from the blockchain.
  • Access terminals with write permissions can modify the block data stored on the blockchain.
  • each node device has its own corresponding node role
  • the access terminal connected to each node device has the authority of the node role corresponding to the node device, so as to realize the consistency management of the authority of multiple access terminals for block data based on the node role. That is to say, a node device is usually connected to multiple access terminals, and multiple access terminals usually have consistent data permissions for block data, so the access terminals connected to the same node device should have the same node role, specifically the connected The node role corresponding to the node device. If the foregoing example is used for illustration, the access terminals belonging to the same national department should have the same node role, specifically the node role corresponding to the national department.
  • node devices correspond to different node roles, but in practical applications, there may also be a situation where multiple node devices correspond to the same node role.
  • multiple node devices correspond to the same node role.
  • each node device belonging to the same national department should have the same node role, thus ensuring the ownership of the data.
  • Access terminals in the same national department have the same authority to block data, thereby ensuring the consistent management of block data by the blockchain system.
  • the data processing method applied to the blockchain system may include S110 to S170, which are described in detail as follows:
  • the target access terminal is connected to the node device that executes the data processing method applied to the blockchain system provided by the embodiment of the present application
  • the node device is any node device in the blockchain system
  • the target access terminal serves as the request Initiator, used to request to write target data into the blockchain.
  • the target access terminal requests to write target data into the blockchain, specifically, requests to add data to be stored in the blockchain, such as a request for a public security department to add a newborn's data to the blockchain.
  • User Info In other embodiments, the target access terminal requests to write the target data into the blockchain, specifically, requests to modify the block data stored in the blockchain, for example, the request of the civil affairs department to write certain data stored in the blockchain User's marital status is changed from unmarried to married.
  • the node device After the node device receives the request sent by the target access terminal, in response to the request of the target access terminal to write the target data into the blockchain, it obtains the target node role that has read permission for the target data, and then obtains the target node role according to the target node role.
  • the encryption key with which the data is encrypted That is to say, the target data in this embodiment will be stored on the blockchain in the form of cipher text, so as to ensure the security of the target data stored on the blockchain.
  • the target data requested by the target access terminal to be written into the blockchain contains key fields, and according to these key fields, the role of the target node with read permission to the target data can be obtained. That is to say, the target access terminal sets the information about the read permission of the target data in the key field, so that after the target data is stored in the blockchain, it can only be read permission to the target data. obtained from the access terminal.
  • the target access terminal can also set information about the write permission of the target data in the key field, so as to restrict the target data to be modified only by the access terminal with write permission for the target data after it is stored in the blockchain.
  • any access terminal that has the same role as the node to which the target access terminal belongs can have write permissions and read permissions of the target data.
  • access terminals belonging to the same national department can modify and read blocks. Own sector data stored on-chain. Therefore, in some embodiments, the target node role with read permission to the target data may include the node role to which the target access terminal belongs.
  • the node role to which the target access terminal itself belongs can also be obtained through key fields contained in the target data.
  • the target node role that has read permission for the target data can also be determined according to the node role to which the target access terminal itself belongs.
  • the node device pre-stores a mapping rule between node roles and block data permissions.
  • the written data can only be legally obtained by the access terminals of node role B and node role C. Therefore, when the access terminal of node role A requests to write the target data into the blockchain, it can directly determine that it has read permission to the target data.
  • the target node roles are node role B and node role C.
  • the encryption key obtained in this embodiment is used to encrypt the target data to obtain the ciphertext corresponding to the target data.
  • the ciphertext corresponding to the target data is stored in the blockchain, only the access terminal with read permission to the target data can obtain the target data, thus realizing the reliable storage of the target data on the blockchain.
  • the encryption key used to encrypt the target data may be a symmetric key generated in the node device.
  • the node device also sends the generated symmetric key to the access terminal with the role of the target node, so that the access terminal corresponding to the role of the target node can successfully decrypt the ciphertext corresponding to the target data according to the received symmetric key, thereby obtaining the target data. .
  • the encryption key used for encrypting the target data is the shared public key corresponding to each target node role
  • the ciphertext obtained by encrypting the target data based on the shared public key can be used by the private key corresponding to each target node role. The key was successfully decrypted.
  • the access terminal with read permission to the target data can decrypt the ciphertext corresponding to the target data according to the private key corresponding to the node role to which it belongs, and then the target data can be successfully obtained.
  • target data For an access terminal that does not have the right to read the target data, it can still decrypt the ciphertext corresponding to the target data according to the private key corresponding to the node role to which it belongs, but it cannot be successfully decrypted. Storage on the blockchain is extremely reliable.
  • S150 Encrypt the target data according to the encryption key to obtain ciphertext corresponding to the target data, and the ciphertext corresponding to the target data can be decrypted by the access terminal corresponding to the target node role.
  • This embodiment performs encryption processing on the target data based on the encryption key obtained in S130, that is, the process of performing encryption operation on the target data according to the encryption key, thereby obtaining the ciphertext corresponding to the target data.
  • the encryption key used to encrypt the target data is determined according to the role of each target node that has read permission to the target data, the ciphertext corresponding to the target data can only be successfully decrypted by the access terminal corresponding to the target node role. This ensures that after the ciphertext corresponding to the target data is stored in the blockchain, it can only be obtained by the access terminal with read permission.
  • the block data stored in each node device should be completely consistent, and the ciphertext corresponding to the target data should also be consistently stored in the blockchain deployed by each node device.
  • the ciphertext corresponding to the target data can be consensused in the blockchain system, and the on-chain operation of the target data can be performed after the consensus is passed, so as to ensure that the blockchain stored in each node device is complete.
  • all or part of the node devices contained in the blockchain system can be used as consensus nodes to achieve consensus on the ciphertext corresponding to the target data.
  • each national department maintains its own data on the blockchain. For example, for a certain user, each All national departments maintain the data of certain fields of the user on the blockchain, thereby realizing data sharing between different national departments through the blockchain, which can greatly improve the efficiency of data sharing.
  • the technical solution provided by this embodiment realizes the security and reliability of the block data stored on the blockchain through the node roles corresponding to the node devices.
  • the data stored on the chain is set with permissions. If a user has 100 fields of data in the blockchain, the civil affairs department can only have read permissions for 40 fields and write permissions for 10 fields. , so as to achieve the consistency of the maintenance of block data by multiple departments, and also ensure that the block data is the minimum authorization, that is, the minimum authorization of the read permission and/or the write permission of the block data.
  • Fig. 3 is a flowchart of obtaining an encryption key corresponding to a role of a target node according to an exemplary embodiment of the present application.
  • the encryption key for obtaining the encryption key corresponding to the role of the target node in S130, it may include S210 to S230.
  • the encryption key includes a shared public key. The details are as follows:
  • the public key corresponding to each target node role should be associated with the private key of each target node role.
  • the ciphertext obtained by data encryption based on the public key corresponding to the role of the target node can be decrypted by the private key corresponding to the role of the target node to obtain the original data before encryption, and the signature obtained based on the private key corresponding to the role of the target node is The signature can be verified by the public key corresponding to the role of the target node.
  • node devices with different node roles in the blockchain system are pre-formed into a pair of private keys and public keys corresponding to their own node roles, and the generated private keys will be synchronized to each access terminal connected to itself.
  • the generated public key will be sent to the blockchain system.
  • the node device can send the generated public key to the authoritative device, so that the authoritative device configures the received public key in the authoritative certificate, and issues the authoritative certificate to each node device.
  • the authoritative device may specifically be a node device in the blockchain system, and the node device is authoritative, so that other node devices trust the authoritative certificate issued by the authoritative device.
  • each node device in the blockchain system can obtain the public keys corresponding to different node roles, so as to obtain the public keys corresponding to each target node role.
  • random numbers corresponding to each target node role may be generated in the node device respectively, and then public keys corresponding to each target node role may be generated according to the random numbers corresponding to each target node role.
  • the generation of the corresponding public key according to the random number is the process of performing an encryption operation on the random number, so that the operation result is used as the corresponding public key.
  • the random numbers corresponding to each target node role generated in the node device are different from each other, so the public keys corresponding to each target role node generated in the node device are also different from each other.
  • the node device needs to send the random number corresponding to each target node role to the corresponding node.
  • the access terminal of the role so that the access terminal generates the private key corresponding to the node role to which it belongs based on the received random number. Therefore, the access terminal with read permission to the target data will generate the private key corresponding to the node role to which it belongs according to the received random number, and the private key can successfully decrypt the ciphertext corresponding to the target data.
  • the shared public key in this embodiment should have the following characteristics: the ciphertext obtained by encrypting the target data based on the shared public key can be decrypted by the private key corresponding to each target node role.
  • the public key corresponding to the role is aggregated to generate a shared public key.
  • the so-called aggregation is the process of constructing the association relationship between the shared public key and the private key corresponding to each target node role according to the private key corresponding to each target node role.
  • the aggregation between the public keys corresponding to each target node role may be implemented by using a threshold signature (Threshhold Sig) algorithm.
  • a threshold signature is calculated for the public key corresponding to each target node role through a threshold signature algorithm, and at the same time, the threshold signature can be configured to be corresponding to at least n (0 ⁇ n ⁇ m, where m represents the total number of target node roles) target roles.
  • the private key is verified, and the configured threshold signature is obtained as the shared public key.
  • the value of n can be set to 1.
  • the public keys corresponding to the roles of each target node may be spliced to obtain a spliced sequence, and then an encoding operation is performed on the spliced sequence to obtain an encoded sequence, and in the process of decoding the encoded sequence, only Any piece of public key data contained in the spliced sequence needs to be decoded, that is, it is determined that the decoding of the encoded sequence is passed, so that the configured encoded sequence is obtained as a shared public key.
  • the ciphertext corresponding to the target data obtained by encrypting the target data with the shared public key obtained above can be decrypted by the private key corresponding to any target node role, but cannot be decrypted by the private key corresponding to any target node role.
  • the private keys corresponding to other node roles are decrypted, thus ensuring the security and reliability of the target data stored on the blockchain.
  • a digital envelope is also used to realize the storage of the target data on the blockchain.
  • this embodiment performs encryption processing on the target data according to the encryption key corresponding to the role of the target node, and stores the ciphertext corresponding to the encrypted target data on the blockchain
  • the encryption key is also encrypted to obtain the ciphertext corresponding to the encryption key (that is, the digital envelope is obtained), and the ciphertext corresponding to the encryption key and the ciphertext corresponding to the target data are jointly stored in the area on the blockchain.
  • the access terminal wants to read the target data from the blockchain, it first decrypts the ciphertext corresponding to the encryption key to obtain the encryption key, and then decrypts the ciphertext of the target data with the obtained encryption key. , so as to obtain the target data. It can be seen that this embodiment is equivalent to implementing two layers of encryption for the target data, and the access terminal also needs to perform two layers of decryption operations to obtain the target data, thereby further improving the security of the target data.
  • the encryption key used in this embodiment may be a symmetric key.
  • the encryption processing of the target data based on the encryption key that is, the process of encrypting the target data by using a symmetric encryption algorithm.
  • the encryption key may be encrypted according to the shared key corresponding to each target node role, so as to obtain the ciphertext corresponding to the encryption key.
  • the access terminal with read permission to the target data can decrypt the ciphertext corresponding to the encryption key according to the private key corresponding to the node role to which it belongs to obtain the encryption key. Therefore, based on the encryption method provided in this embodiment, it can be ensured that only the access terminal with the read permission to the target data can obtain the target data stored in the blockchain.
  • the encryption key may also be encrypted according to the role shared key corresponding to each target node role, so as to obtain the ciphertext corresponding to the encryption key.
  • the generation and use of the role shared key corresponding to each target node role can refer to S310 to S330, and the details are as follows:
  • S310 Aggregately generate a role shared key corresponding to the same target node role according to the user secret information configured in each access terminal corresponding to the same target node role.
  • the access terminals corresponding to different target node roles that have read permissions for the target data are regarded as a subset, and a key is allocated to each subset, that is, the role shared keys corresponding to different target node roles are obtained respectively. .
  • each access terminal in each subset is configured with user secret information
  • the user secret information can be any information, but each access terminal cannot learn the user secret information of other access terminals in the subset, and the user secrets corresponding to different users
  • the information also usually varies. Therefore, the role shared keys corresponding to different target node roles obtained in this embodiment are also different from each other.
  • S330 Perform encryption processing on the encryption key according to the key sequence formed by the role shared keys corresponding to the roles of each target node, to obtain a ciphertext corresponding to the encryption key.
  • Ki is used to represent the role shared key corresponding to the role of the target node
  • the key sequence composed of the role shared keys corresponding to each target node role can be expressed as "Ki1, Ki2, ..., Kim", where m represents the target node The total number of roles.
  • the session key is encrypted according to this key sequence, that is, the ciphertext in the form of "i1, i2, ..., im, EKi1(K), EKi2(K), ..., EKim(K)" can be obtained.
  • only the access terminal with the read permission for the target data can decrypt the ciphertext corresponding to the encryption key according to the user secret information configured by itself to obtain the encryption key. Therefore, based on the encryption method provided in this embodiment, it can also be ensured that only the access terminal with read permission for the target data can obtain the target data stored in the blockchain.
  • FIG. 5 is a flowchart of another data processing method applied to a blockchain system proposed on the basis of the embodiment shown in FIG. 2 .
  • the method before determining the target node role that has read permission to the target data in S110, the method further includes S410 to S430, which are described in detail as follows:
  • S410 Acquire the access terminal signature information contained in the target data.
  • the access terminal signature information is obtained by the target access terminal signing information according to its own private key, and is carried in the target data.
  • the node device receives the request from the target access terminal to write the target data into the blockchain, it obtains the access terminal signature information carried in the target data.
  • S430 Verify the signature information of the access terminal according to the public key corresponding to the node role to which the target access terminal belongs.
  • the node device obtains the access terminal signature information, and verifies the access terminal signature information according to the public key corresponding to the node role to which the target access terminal belongs. If the access terminal signature information passes the verification, it means that the target access terminal has the write authority of the target data, so S110 is executed. If the access terminal signature information fails to pass the verification, it means that the target access terminal does not have the permission to write the target data, and the node device rejects the request of the target access terminal to write the target data into the blockchain.
  • the public keys corresponding to different node roles can be stored in the node device.
  • the node device with different node roles in the blockchain system will pre-generate a pair of nodes corresponding to their own node roles.
  • the generated private key and public key are synchronized to each node device for storage. Therefore, in a possible implementation manner, for S430, the node device may determine the node role of the node device involved in the target data according to the key field in the target data, and then obtain the stored public key corresponding to the node role locally, Further, the signature information of the access terminal is verified according to the determined public key.
  • the technical solution of this embodiment further verifies whether the target access terminal has the write permission for the target data, which further ensures that the target data is stored in the blockchain.
  • Storage on the blockchain is reliable. For example, if the public security department requests to modify the data stored on the blockchain that the housing and construction department has write permission, after receiving the request from the public security department, the node device determines that the public security department does not have the permission to write the data, and rejects it The request of the public security department, so that the data on the blockchain will not be illegally tampered with, thereby ensuring the reliability of the block data stored on the blockchain.
  • the target access terminal if it wants to read the target data stored in the blockchain, it will initiate a request to read the target data stored in the blockchain.
  • the target access terminal may be any access terminal, and the target access terminal is not necessarily the requester for writing the target data stored on the blockchain.
  • the node device In response to the request of the target access terminal to read the target data stored in the blockchain, the node device sends the ciphertext corresponding to the target data stored in the blockchain to the target access terminal, so that the target access terminal can be based on its own node role.
  • the corresponding private key is used to decrypt the ciphertext corresponding to the target data to obtain the target data.
  • the access terminal connected to each node device has the authority of the node role corresponding to the node device, and the ciphertext corresponding to the target data is obtained by encrypting the target data according to the encryption key, and the encryption key is the target data.
  • the detailed process of obtaining the encryption key and the process of encrypting the target data refer to the foregoing embodiments, which will not be repeated here.
  • the node device If the target data is stored on the blockchain in the form of a digital envelope, that is, the blockchain stores not only the ciphertext corresponding to the target data, but also the ciphertext corresponding to the encryption key, the node device also needs to store the block
  • the ciphertext corresponding to the encryption key stored on the chain is sent to the target access terminal, so that the target access terminal decrypts the ciphertext corresponding to the encryption key according to the private key corresponding to the node role to which it belongs, and decrypts the encrypted The key decrypts the ciphertext corresponding to the target data.
  • the ciphertext corresponding to the encryption key is obtained by encrypting the encryption key according to the shared key corresponding to the role of the target node, and the shared key is generated by aggregation of the public keys corresponding to the roles of each target node.
  • the process please refer to the content described in detail in the foregoing embodiments, which will not be repeated here.
  • the node device can send the ciphertext corresponding to the target data and the ciphertext corresponding to the encryption key stored on the blockchain to the target access terminal in the form of broadcasting.
  • the target access terminal After the target access terminal receives the information broadcasted by the node device, it decrypts the ciphertext corresponding to the received encryption key according to the private key corresponding to the node role to which it belongs, and decrypts the encrypted data corresponding to the target data according to the decrypted encryption key.
  • the ciphertext is decrypted.
  • the private key corresponding to the node role to which the target access terminal itself belongs may include user secret information configured in the target access terminal;
  • the ciphertext corresponding to the encryption key is a key formed according to the role shared key corresponding to each target node role sequence, obtained by encrypting the encryption key;
  • the role shared key is generated by aggregation based on the user secret information configured in each access terminal corresponding to the role of the same target node.
  • the technical solution of the present application not only achieves the consistency of the maintenance of block data by multiple node roles, but also ensures that the block data is minimally authorized, so that multiple node roles can not only achieve high-level performance through the blockchain.
  • Efficient data sharing while ensuring the security and reliability of data on the blockchain, can meet any scenario with high requirements for sharing efficiency and data security in the data sharing process, for example, it can also be applied to various departments of the enterprise In scenarios such as data sharing among branches, data sharing among multiple people, etc., this place does not limit this.
  • FIG. 6 is a block diagram of a data processing apparatus applied to a blockchain system according to an exemplary embodiment of the present application.
  • the blockchain system includes a plurality of node devices, each node device is connected with at least one access terminal, and the access terminal has the authority of the node role corresponding to the connected node device, and the device is configured on the node device in the blockchain system.
  • the apparatus may include:
  • the node role determination module 510 is configured to, in response to the request of the target access terminal to write the target data into the blockchain, determine the role of the target node with read permission for the target data, wherein the target access terminal is the same as the node an access terminal in the access terminals connected to the device; the encryption key acquisition module 530 is configured to acquire the encryption key corresponding to the role of the target node; the data encryption module 550 is configured to encrypt the target data according to the encryption key, and obtain The ciphertext corresponding to the target data can be decrypted by the access terminal corresponding to the target node role; the data storage module 570 is configured to store the ciphertext corresponding to the target data on the blockchain.
  • the encryption key includes a shared public key; the encryption key obtaining module 530 includes:
  • the public key acquisition unit is configured to acquire the public key corresponding to each target node role;
  • the shared public key generation unit is configured to generate a shared public key according to the public key aggregation corresponding to each target node role, wherein the target data is encrypted based on the shared public key
  • the obtained ciphertext can be decrypted by the private key corresponding to each target node role.
  • the public key acquisition unit includes:
  • the random number generation subunit is configured to generate random numbers corresponding to each target node role in the node device respectively;
  • the public key generation subunit is configured to generate the public key corresponding to each target node role according to the random number corresponding to each target node role
  • the random number sending subunit is configured to send the random number corresponding to each target node role to the access terminal corresponding to the target node role, so that the access terminal generates the private key corresponding to the node role to which it belongs based on the received random number.
  • the encryption key includes a symmetric key; the encryption key obtaining module 530 includes:
  • the symmetric key generation unit is configured to generate the symmetric key in the node device; the symmetric key transmission unit is configured to send the symmetric key to the access terminal corresponding to the role of the target node, so that the access terminal corresponding to the role of the target node can The received symmetric key decrypts the ciphertext corresponding to the target data.
  • the apparatus further includes:
  • the first key encryption module is configured to encrypt the encryption key according to the shared key corresponding to each target node role to obtain the ciphertext corresponding to the encryption key; the data storage module is further configured to encrypt the encryption key corresponding to the encryption key.
  • the text and the cipher text corresponding to the target data are jointly stored on the blockchain.
  • the apparatus further includes:
  • the role shared key acquisition module is configured to aggregate and generate the role shared key corresponding to the same target node role according to the user secret information configured in each access terminal corresponding to the same target node role;
  • the second key encryption module is configured to be based on The key sequence formed by the role shared key corresponding to each target node role, encrypts the encryption key, and obtains the ciphertext corresponding to the encryption key;
  • the data storage module is also configured to store the ciphertext corresponding to the encryption key with The ciphertext corresponding to the target data is jointly stored on the blockchain.
  • the apparatus further includes:
  • a signature acquisition module configured to acquire the access terminal signature information contained in the target data
  • the signature verification module is configured to verify the access terminal signature information according to the public key corresponding to the node role to which the target access terminal belongs, and if the access terminal signature information passes the verification, triggering the node role determination module to execute the determination that the target data has a read Steps to take the role of the target node for permissions.
  • the signature verification module includes:
  • the field information acquisition unit is configured to determine the node role to which the target access terminal belongs according to the key fields contained in the target data;
  • the signature information verification unit is configured to search for the node role to which the target access terminal belongs from the locally stored public key list.
  • the corresponding public key is used to verify the signature information of the access terminal according to the found public key.
  • Embodiments of the present application also provide another data processing device applied to a blockchain system, the device comprising:
  • the first ciphertext sending module is configured to, in response to the request of the target access terminal to read the target data stored in the blockchain, send the ciphertext corresponding to the target data stored in the blockchain to the target access terminal, and the access terminal has all the information.
  • the target access terminal is one of the access terminals connected to the node device, and the ciphertext corresponding to the target data is obtained by encrypting the target data according to an encryption key, and the encryption key is the target data.
  • the encryption key corresponding to the role of the target node whose data has read permission.
  • the apparatus further includes:
  • the second ciphertext sending module is configured to send the ciphertext corresponding to the encryption key stored on the blockchain to the target access terminal, so that the target access terminal can send the corresponding encryption key to the target access terminal according to the private key corresponding to the node role to which it belongs.
  • the ciphertext is decrypted, and the ciphertext corresponding to the target data is decrypted according to the decrypted encryption key;
  • the ciphertext corresponding to the encryption key is obtained by encrypting the encryption key according to the shared key corresponding to the role of the target node, and the shared key is generated by aggregation of the public keys corresponding to the roles of each target node.
  • the first ciphertext sending module includes:
  • the data broadcasting unit is configured to broadcast the ciphertext corresponding to the target data stored on the blockchain and the ciphertext corresponding to the encryption key, so that the target access terminal can, according to the private key corresponding to the node role to which it belongs, broadcast the received
  • the ciphertext corresponding to the encryption key is decrypted, and the ciphertext corresponding to the target data is decrypted according to the decrypted encryption key.
  • the private key corresponding to the node role to which the target access terminal itself belongs includes the user secret information configured in the target access terminal;
  • the ciphertext corresponding to the encryption key is a key sequence composed of the role shared keys corresponding to each target node role , which is obtained by encrypting the encryption key;
  • the role shared key is aggregated and generated according to the user secret information configured in each access terminal corresponding to the role of the same target node.
  • Embodiments of the present application further provide an electronic device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the aforementioned application block is implemented The data processing method of the chain system.
  • FIG. 7 shows a schematic structural diagram of a computer system suitable for implementing the electronic device according to the embodiment of the present application. It should be noted that the computer system 1600 of the electronic device shown in FIG. 7 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present application.
  • the computer system 1600 includes a central processing unit (Central Processing Unit, CPU) 1601, which can be loaded into a random device according to a program stored in a read-only memory (Read-Only Memory, ROM) 1602 or from a storage part 1608
  • a program in a memory (Random Access Memory, RAM) 1603 is accessed to perform various appropriate actions and processes, such as performing the methods described in the above embodiments.
  • RAM Random Access Memory
  • various programs and data required for system operation are also stored.
  • the CPU 1601, the ROM 1602, and the RAM 1603 are connected to each other through a bus 1604.
  • An Input/Output (I/O) interface 1605 is also connected to the bus 1604 .
  • the following components are connected to the I/O interface 1605: an input section 1606 including a keyboard, a mouse, etc.; an output section 1607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc. ; a storage part 1608 including a hard disk and the like; and a communication part 1609 including a network interface card such as a LAN (Local Area Network) card, a modem, and the like.
  • the communication section 1609 performs communication processing via a network such as the Internet.
  • Drivers 1610 are also connected to I/O interface 1605 as needed.
  • a removable medium 1611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 1610 as needed so that a computer program read therefrom is installed into the storage section 1608 as needed.
  • embodiments of the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising a computer program for performing the method illustrated in the flowchart.
  • the computer program may be downloaded and installed from the network through the communication portion 1609, and/or installed from the removable medium 1611.
  • CPU central processing unit
  • the computer-readable medium shown in the embodiments of the present application may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two.
  • the computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Erasable Programmable Read Only Memory (EPROM), flash memory, optical fiber, portable Compact Disc Read-Only Memory (CD-ROM), optical storage device, magnetic storage device, or any suitable of the above The combination.
  • a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
  • a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • a computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device .
  • a computer program embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.
  • each block in the flowchart or block diagram may represent a module, program segment, or part of code, and the above-mentioned module, program segment, or part of code contains one or more executables for realizing the specified logical function. instruction.
  • the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.
  • the units involved in the embodiments of the present application may be implemented in software or hardware, and the described units may also be provided in a processor. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances.
  • Another aspect of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the aforementioned data processing method applied to a blockchain system.
  • the computer-readable storage medium may be included in the electronic device described in the above embodiments, or may exist alone without being assembled into the electronic device.
  • Another aspect of the present application also provides a computer program product or computer program comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the data processing method applied to the blockchain system provided in each of the foregoing embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Storage Device Security (AREA)

Abstract

本申请的实施例揭示了一种应用于区块链***的数据处理方法及装置，该方法包括：响应于访问终端向区块链中写入目标数据的请求，确定对所述目标数据具有读取权限的目标节点角色，其中，各个节点设备连接的访问终端拥有节点设备对应的节点角色的权限；获取所述目标节点角色所对应的加密密钥；根据所述加密密钥对所述目标数据进行加密处理，得到所述目标数据对应的密文，所述目标数据对应的密文能够被所述目标节点角色对应的访问终端解密；将所述目标数据对应的密文存储至所述区块链上。本申请实施例的技术方案既能够极大地提升多个节点角色之间进行数据共享的效率，又能够确保进行数据共享的安全性。

Description

应用于区块链***的数据处理方法及装置
本申请要求于2020年11月20日提交中国专利局、申请号为202011306241.0、申请名称为“应用于区块链***的数据处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及区块链技术领域，具体而言，涉及应用于区块链***的数据处理。
背景技术
由于不同机构所管理的事务不一致，不同机构的数据通常被割裂存储在各个机构，但在某些场景下各个机构之间需要进行数据共享。
目前通用的实现方式是，将需要进行数据共享的各个机构分别连接，以从所连接的机构中获取数据，但由于不同机构的设备接口标准不一致、以及不同机构的协作流程不一致，导致各个机构之间进行数据共享的效率很低。
发明内容
为解决上述技术问题，本申请的实施例提供了一种应用于区块链***的数据处理方法及装置、电子设备、计算机可读存储介质，本申请的实施例采用区块链技术来实现不同机构之间的数据共享，能够在极大程度上提升不同机构之间进行数据共享的效率。
根据本申请实施例的一个方面，提供了一种应用于区块链***的数据处理方法，所述区块链***包括多个节点设备，所述多个节点设备分别与至少一个访问终端连接且分别对应一个节点角色，所述访问终端拥有所连接节点设备对应的节点角色的权限，所述方法由所述区块链***中的节点设备执行，所述方法包括：响应于访问终端向区块链中写入目标数据的请求，确定对所述目标数据具有读取权限的目标节点角色，其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端；获取所述目标节点角色所对应的加密密钥；根据所述加密密钥对所述目标数据进行加密处理，得到所述目标数据对应的密文，所述目标数据对应的密文能够被所述目标节点角色对应的访问终端解密；将所述目标数据对应的密文存储至所述区块链上。
根据本申请实施例的一个方面，提供了一种应用于区块链***的数据处理 装置，所述区块链***包括多个节点设备，所述多个节点设备分别与至少一个访问终端连接且分别对应一个节点角色，所述访问终端拥有所连接节点设备对应的节点角色的权限，所述装置配置在所述区块链***中的节点设备上，所述装置包括：节点角色确定模块，配置为响应于访问终端向区块链中写入目标数据的请求，确定对所述目标数据具有读取权限的目标节点角色，其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端；加密密钥获取模块，配置为获取所述目标节点角色所对应的加密密钥；数据加密模块，配置为根据所述加密密钥对所述目标数据进行加密处理，得到所述目标数据对应的密文，所述目标数据对应的密文能够被所述目标节点角色对应的访问终端解密；数据存储模块，配置为将所述目标数据对应的密文存储至所述区块链上。
根据本申请实施例的一个方面，提供了一种应用于区块链***的数据处理方法，所述区块链***包括多个节点设备，所述多个节点设备分别与至少一个访问终端连接且分别对应一个节点角色，所述访问终端拥有所连接节点设备对应的节点角色的权限，所述方法由所述区块链***中的节点设备执行，所述方法包括：响应于目标访问终端读取目标数据的请求，将区块链中存储的所述目标数据对应的密文发送至所述目标访问终端，以使所述目标访问终端根据自身所属的节点角色对应的私钥，对所述目标数据对应的密文进行解密，以得到所述目标数据；其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端，所述目标数据对应的密文是根据加密密钥对所述目标数据进行加密处理所得到的，所述加密密钥是对所述目标数据具有读取权限的目标节点角色对应的加密密钥。
根据本申请实施例的一个方面，提供了一种电子设备，包括处理器及存储器，所述存储器上存储有计算机可读指令，所述计算机可读指令被所述处理器执行时实现以上方面所述的应用于区块链***的数据处理方法。
根据本申请实施例的一个方面，提供了一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序用于执行以上方面所述的应用于区块链***的数据处理方法。
根据本申请实施例的一个方面，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机 可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行以上方面所述的应用于区块链***的数据处理方法。
在本申请的实施例所提供的技术方案中，区块链***中的节点设备可以具体实现为不同机构的服务器，由于各个节点设备中都存储有全量的区块数据，也即区块链上都存储有每个机构的数据，使得每个机构都可以从区块链上获取其它机构的数据，从而通过区块链技术实现了标准化和通用化的数据共享，能够极大地提升数据共享的效率。
并且，由于区块链上存储的区块数据通过节点角色向访问终端设置有读取权限，且各个节点设备连接的访问终端拥有节点设备对应的节点角色的权限，使得区块链上的数据只能够被对该数据具有读取权限的其它访问终端获取得到，也即，只有具有读取权限的机构才能从区块链上获取到其它机构的数据，既提升了不同机构之间进行共享数据的效率，又能够确保数据共享的安全性。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本申请。
附图说明
图1是本申请实施例涉及的一种实施环境的示意图；
图2是本申请的一示例性实施例示出的应用于区块链***的数据处理方法的流程图；
图3是本申请的示例性实施例示出的一种获取目标节点角色对应的加密密钥的流程图；
图4是本申请的示例性实施例示出的一种获取目标节点角色对应的角色共享密钥的流程图；
图5在图2所示的实施例的基础上而提出的另一种应用于区块链***的数据处理方法的流程图；
图6是本申请的一示例性实施例示出的一种应用于区块链***的数据处理装置的框图；
图7示出了一种适于用来实现本申请实施例的电子设备的计算机***的结构示意图。
具体实施方式
这里将详细地对示例性实施例执行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
附图中所示的方框图仅仅是功能实体，不一定必须与物理上独立的实体相对应。即，可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
附图中所示的流程图仅是示例性说明，不是必须包括所有的内容和操作/步骤，也不是必须按所描述的顺序执行。例如，有的操作/步骤还可以分解，而有的操作/步骤可以合并或部分合并，因此实际执行的顺序有可能根据实际情况改变。
还需要说明的是：在本申请中提及的“多个”是指两个或两个以上。“和/或”描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
请参阅图1，图1是本申请涉及的一种实施环境的示意图，该实施环境具体为一区块链***。
图1中示出的区块链***100是指用于进行节点设备10与节点设备10之间数据共享的***，每个节点设备10中都存储有完整的区块链20。如图1所示，区块链20由多个区块组成，每个区块中包括区块头和区块体，区块头中存储有区块高度等信息。可以看出，每个节点设备10中所存储的区块数据是完全一致的。
各个节点设备10分别连接有至少一个访问终端30，例如访问终端30可以通过有线或无线网络与节点设备相连接，从而与节点设备10进行数据交互。任意的访问终端30均可以向区块链20中写入数据，或者读取区块链20中存储的数据，由此实现区块数据的高效率共享。
区块链20上存储的数据通常是大量并且复杂的，在一个示例性的应用场景中，节点设备10被具体实现为是不同的国家部门(例如公安部门、民政部门、税务部门、工商部门、***门等)分别部署在区块链***100中的服务器，因此区块链20中存储有每个国家部门的数据。与节点设备10相连接的访问终端30则具体实现为是归属于相应国家部门的用户访问终端。
考虑到国家部门的数据通常具有极高的保密性，这些数据一旦被泄露，将带来严重后果，因此在不同的国家部门进行数据共享的过程中，为保证数据安全性，区块链***100对区块链20上存储的区块数据均配置了权限，例如包括读取权限和/或写入权限。例如，税务部门在处理用户的个税抵扣事务时，可以从区块链20中读取该用户的子女教育、父母养老、房贷等数据，但不能对这些数据进行修改。又例如，公安部门只能修改区块链20中存储的自身部门的数据，例如用户的户籍、犯罪记录等，但不能修改区块链20中存储的其它国家部门的数据。
由此可知，基于图1所示的区块链***100不仅能够高效率地进行数据共享，还能够确保数据共享过程中的数据安全性，能够满足任意对于数据共享过程中的共享效率以及数据安全性具有较高要求的场景，例如还可以应用在企业各部门或分支机构之间的数据共享、多人之间进行数据共享等场景中，本处不对此进行限制。
还需要说明的是，图1所示的区块链***100中的访问终端30可以是智能手机、平板、笔记本电脑、计算机等电子设备，节点设备10可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式***，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、CDN(Content Delivery Network，内容分发网络)以及大数据和人工智能平台等基础云计算服务的云服务器，本处也不对此进行限制。
图2是本申请的一示例性实施例示出的应用于区块链***的数据处理方法的流程图。
该方法所应用的区块链***可以是图1所示的区块链***100，并且该方法可以由区块链***100中任意的节点设备10具体执行。
而在另一些实施例中，该方法也可以应用于其它的区块链***，区块链***中包括多个节点设备，以通过任意的节点设备执行该方法。每个节点设备连接有一个或多个访问终端，并且各个节点设备中存储有完整的区块链，也即各个节点设备中存储了全量的区块数据，区块链中的区块数据均配置有相应权限。
需要说明的是，区块链据的权限可以包括读取权限和写入权限，对区块数据具有读取权限的访问终端可以从区块链中读取该区块数据，对区块数据具有写入权限的访问终端可以对存储在区块链上的该区块数据进行修改。
此外，各个节点设备具有各自对应的节点角色，并且各个节点设备连接的访问终端拥有节点设备对应的节点角色的权限，以基于节点角色实现多个访问终端对于区块数据的权限的一致性管理。也即是说，节点设备通常连接有多个访问终端，并且多个访问终端对于区块数据通常具有一致的数据权限，因此同一节点设备连接的访问终端应当具有相同的节点角色，具体为所连接节点设备对应的节点角色。若以前述示例进行说明，归属于同一国家部门的访问终端应当具有相同的节点角色，具体为该国家部门所对应的节点角色。
另外还需要说明的是，在一般情况下，不同的节点设备所对应节点角色各不相同，但是在实际应用中，也可能存在多个节点设备对应于同一节点角色的情况。例如，由于一个国家部门的数据具有数据量大以及数据复杂度高等特点，通常部署多个节点设备进行数据处理，因此归属于同一国家部门的各个节点设备应当具有相同的节点角色，由此保证归属于同一国家部门的访问终端对于区块数据具有相同的权限，进而能够保证区块链***对于区块数据的一致性管理。
如图2所示，在一示例性实施例中，该应用于区块链***的数据处理方法可以包括S110至S170，详细介绍如下：
S110，响应于目标访问终端向区块链中写入目标数据的请求，确定对目标数据具有读取权限的目标节点角色。
首先说明的是，目标访问终端与执行本申请实施例提供的应用于区块链***的数据处理方法的节点设备相连，该节点设备是区块链***中任意的节点设备，目标访问终端作为请求发起方，用于请求向区块链中写入目标数据。
在一些实施例中，目标访问终端请求向区块链中写入目标数据，具体是请求向区块链中新增待存储的数据，例如实现为公安部门请求在区块链上增加新 生儿的用户信息。而在另一些实施例中，目标访问终端请求向区块链中写入目标数据，具体是请求修改区块链中存储的区块数据，例如实现为民政部门请求将区块链上存储的某个用户的婚姻状态由未婚修改为已婚。
节点设备接收到目标访问终端发送的请求后，响应于目标访问终端向区块链中写入目标数据的请求，获取对目标数据具有读取权限的目标节点角色，进而根据目标节点角色获取对目标数据进行加密的加密密钥。也即是说，本实施例中的目标数据将是以密文形式存储在区块链上的，以保证目标数据在区块链上进行存储的安全性。
还需要说明的是，为保证区块数据的安全性，区块链上存储的重要数据都应当是以密文的形式进行存储的，并且只有具有权限的访问终端才能够对这些数据的密文成功解密，从而真正获取到这些数据。
在一些实施例中，目标访问终端所请求写入区块链的目标数据中含有关键字段，根据这些关键字段则可以得到对目标数据具有读取权限的目标节点角色。也即是说，目标访问终端在关键字段中设置有关于目标数据的读取权限的信息，以通过这些信息来约束目标数据存储至区块链后，只能被对于目标数据具有读取权限的访问终端获取得到。
目标访问终端也可以在关键字段中设置关于目标数据的写入权限的信息，以约束目标数据存储至区块链后只能被对于目标数据具有写入权限的访问终端进行修改。
通常而言，对于与目标访问终端所属的节点角色相同的任意访问终端，都可以具有目标数据的写入权限和读取权限，例如隶属于同一国家部门的访问终端都可以修改和读取区块链上存储的自身部门的数据。因此，在一些实施例中，对目标数据具有读取权限的目标节点角色可以包括目标访问终端所属的节点角色。其中，目标访问终端自身所属的节点角色也可以通过目标数据所含有的关键字段获取得到。
在另一些实施例中，例如在某些区块数据权限规范化管理的应用场景中，也可以根据目标访问终端自身所属的节点角色来确定对目标数据具有读取权限的目标节点角色。
例如，在区块数据权限规范化管理的应用场景中，节点设备中预先存储有 节点角色与区块数据权限之间的映射规则，例如，该映射规则规定了节点角色A的访问终端向区块链写入的数据只能被节点角色B以及节点角色C的访问终端合法获取，因此当节点角色A的访问终端请求向区块链中写入目标数据后，可以直接确定对目标数据具有读取权限的目标节点角色为节点角色B以及节点角色C。
S130，获取目标节点角色所对应的加密密钥。
如前所述，本实施例所获取的加密密钥是用于对目标数据进行加密处理，以到目标数据对应的密文。将目标数据对应的密文存储至区块链后，只有对目标数据具有读取权限的访问终端才能够获取到该目标数据，由此实现目标数据在区块链上的可靠存储。
为保证目标数据在区块链上存储的可靠性，在一些实施例中，对目标数据进行加密处理的加密密钥可以是节点设备中生成的对称密钥。节点设备还将生成的对称密钥发送至具备目标节点角色的访问终端，以使目标节点角色对应的访问终端能够根据接收到的对称密钥对目标数据对应的密文成功解密，从而得到目标数据。
对于不具有目标数据的读取权限的访问终端而言，由于其并未接收到节点设备发送的对称密钥，因此无法对目标数据对应的密文进行解密。由此可知，即使目标数据的密文可能被任意的访问终端获取得到，但只有对目标数据具有读取权限的访问终端才能完成对密文的解密获得目标数据，从而使得目标数据在区块链上的存储具有极高的可靠性和安全性。
在另一些实施例中，对目标数据进行加密处理的加密密钥具体为各个目标节点角色对应的共享公钥，基于共享公钥对目标数据加密得到的密文能够被各个目标节点角色对应的私钥成功解密。
由此，目标数据对应的密文存储至区块链后，对目标数据具有读取权限的访问终端根据自身所属的节点角色对应的私钥对目标数据对应的密文进行解密，即可成功获得目标数据。对于不具有目标数据的读取权限的访问终端而言，其仍可以根据自身所属的节点角色对应的私钥对目标数据对应的密文进行解密处理，但无法成功解密，从而能够保证目标数据在区块链上的存储具有极高的可靠性。
S150，根据加密密钥对目标数据进行加密处理，得到目标数据对应的密文，目标数据对应的密文能够被目标节点角色对应的访问终端解密。
本实施例基于S130获取得到的加密密钥对目标数据进行加密处理，也即是根据该加密密钥对进行目标数据进行加密运算的过程，由此得到目标数据对应的密文。
由于对目标数据进行加密处理所使用的加密密钥是根据对目标数据具有读取权限的各个目标节点角色确定得到的，目标数据对应的密文只能够被目标节点角色对应的访问终端成功解密，进而保证目标数据对应的密文存储至区块链中之后，只能被对其具有读取权限的访问终端获取得到。
S170，将目标数据对应的密文存储至区块链上。
考虑到在区块链***中，各个节点设备中存储的区块数据应当是完全一致的，目标数据对应的密文也应当一致性地存储于各个节点设备所部署的区块链中，为此，可以将目标数据对应的密文在区块链***进行共识，并在共识通过后执行目标数据的上链操作，从而确保各个节点设备中存储的区块链都是完整的。例如，可以将区块链***中含有的全部或者部分节点设备作为共识节点，对目标数据对应的密文进行共识。
可以看出，在实施例提供的技术方案中，若以节点设备实现为不同国家部门的服务器为例，各个国家部门都在区块链上维护各自的数据，例如对于某一个用户而言，各个国家部门都在区块链上维护该用户的某几个字段的数据，由此通过区块链实现不同国家部门之间的数据共享，能够极大地提升数据共享的效率。
同时，本实施例提供的技术方案通过节点设备对应的节点角色来实现区块链上存储的区块数据的安全性和可靠性，仍以节点设备实现为不同国家部门的服务器为例，区块链上存储的数据设置有权限，若某个用户在区块链中具有100个字段的数据，民政部门只能对其中的40个字段具有读取权限，对其中的10个字段具有写入权限，由此实现多部门对于区块数据进行维护的一致性，同时还确保区块数据是最小授权的，也即区块数据的读取权限和/或者写入权限的最小授权。
图3是本申请的示例性实施例示出的一种获取目标节点角色对应的加密密 钥的流程图。如图3所示，针对前述S130的获取目标节点角色对应的加密密钥，可以包括S210至S230，在此实施例中，加密密钥包括共享公钥。详细介绍如下：
S210，获取各个目标节点角色对应的公钥。
首先需要说明的是，在本实施例中，各个目标节点角色对应的公钥应当与各个目标节点角色的私钥相关联。例如，基于目标节点角色对应的公钥进行数据加密得到的密文，可以通过目标节点角色对应的私钥解密，以得到加密前的原始数据，基于目标节点角色对应的私钥所得到的签名则可以通过目标节点角色对应的公钥进行验签。
在一些实施例中，区块链***中具备不同节点角色的节点设备预先生会成一对与自身所属节点角色对应的私钥和公钥，所生成私钥会同步到与自身连接的各个访问终端中存储，所生成的公钥会发送到区块链***中。例如，节点设备可以将生成的公钥发送到权威设备中，使得权威设备将接收到的公钥配置在权威证书中，并将权威证书颁发给各个节点设备。
需要理解的是，权威设备具体可以是区块链***中的节点设备，该节点设备具有权威性，从而使得其它的节点设备信任权威设备所颁发的权威证书。由此，区块链***中的各个节点设备都可以获知到不同节点角色对应的公钥，从而能够获得各个目标节点角色对应的公钥。
而在另一些实施例中，可以在节点设备中分别生成各个目标节点角色对应的随机数，进而根据各个目标节点角色对应的随机数生成各个目标节点角色对应的公钥。其中，根据随机数生成相应的公钥也即是对随机数进行加密运算的过程，以将运算结果作为相应公钥。
需要说明的是，由于随机数所具有的随机性，节点设备中生成各个目标节点角色对应的随机数互不相同，因此节点设备中生成各个目标角色节点对应的公钥也互不相同。
此外，为保证对目标数据具有读取权限的访问终端基于自身所属节点角色对应的私钥能够对目标数据的密文成功解密，节点设备需要将各个目标节点角色对应的随机数发送至具备相应节点角色的访问终端，以使访问终端基于接收到的随机数生成自身所属的节点角色对应的私钥。由此，对目标数据具有读取权限的访问终端都将根据接收到的随机数生成自身所属的节点角色对应的私 钥，该私钥能够对目标数据对应的密文进行成功解密。
S230，根据各个目标节点角色对应的公钥聚合生成共享公钥。
如前所述，本实施例的共享公钥应当具有如此特性：基于共享公钥对目标数据加密得到的密文能够被各个目标节点角色对应的私钥解密，因此本实施例需根据各个目标节点角色对应的公钥聚合生成共享公钥。所谓的聚合，也即是根据各个目标节点角色对应的私钥，来构建共享公钥与各个目标节点角色对应的私钥之间的关联关系的过程。
在一些实施例中，各个目标节点角色对应的公钥之间的聚合可以采用阈值签名(Threshhold Sig)算法实现。具体的，通过阈值签名算法对各个目标节点角色对应的公钥计算阈值签名，同时配置该阈值签名可以被至少n(0<n<m，其中m表示目标节点角色的总量)个目标角色对应的私钥进行验证，由此配置好的阈值签名获取为共享公钥。在本实施例中，为实现目标节点角色对应的任意访问终端都能够成功解密区块链上存储的目标数据对应的密文，可以设置n的取值为1。
在另一些实施例中，可以将各个目标节点角色对应的公钥进行拼接，以得到拼接序列，然后对该拼接序列进行编码运算，得到编码序列，同时配置在对编码序列进行解码过程中，只需解码得到拼接序列中含有的任意一段公钥数据，即确定编码序列的解码通过，从而将配置好的编码序列获取为共享公钥。
由此可知，采用以上获取的共享公钥对目标数据进行加密处理所得到的目标数据对应的密文，即可以被任一目标节点角色对应的私钥进行解密，但无法被目标节点角色以外的其它节点角色对应的私钥解密，由此保证了目标数据在区块链上存储的安全性及可靠性。
在本申请的其它实施例中，为进一步提升目标数据在区块链上进行存储的安全性，还采用数字信封的方式实现目标数据在区块链上的存储。
在一种可能的实现方式中，针对S170，本实施例在一方面根据目标节点角色对应的加密密钥对目标数据进行加密处理，将加密得到的目标数据对应的密文存储在区块链上，在另一方面还对该加密密钥进行加密处理，得到加密密钥对应的密文(即得到数字信封)，并将加密密钥对应的密文与目标数据对应的密文共同存储于区块链上。
如果访问终端想要从区块链中读取目标数据，则首先对加密密钥对应的密文进行解密处理，得到加密密钥，然后所得到的加密密钥对目标数据的密文进行解密处理，从而得到目标数据。可以看出，本实施例相当于对目标数据实现了两层加密，访问终端也需相应进行两层解密操作才能得到目标数据，由此进一步提升了目标数据的安全性。
需要说明的是，为实现访问终端根据对加密密钥对应的密文解密得到的加密密钥，能够对目标数据的密文进行成功的解密，本实施例采用的加密密钥可以是对称密钥，基于加密密钥对目标数据的加密处理，也即是采用对称加密算法对目标数据进行加密运算的过程。
在一些实施例中，可以根据各个目标节点角色对应的共享密钥对加密密钥进行加密，以得到加密密钥对应的密文。在此情况下，只有对目标数据具有读取权限的访问终端才能够根据自身所属节点角色对应的私钥，来对加密密钥对应的密文进行解密，以得到加密密钥。因此，基于本实施例提供的加密方式，能够保证只有对目标数据具有读取权限的访问终端才能够获取到区块链中存储的目标数据。
在另外的实施例中，还可以根据各个目标节点角色对应的角色共享密钥对加密密钥进行加密，以得到加密密钥对应的密文。如图4所示，各个目标节点角色对应的角色共享密钥的生成和使用可以参见S310至S330，详细介绍如下：
S310，根据同一目标节点角色对应的各个访问终端中配置的用户秘密信息，聚合生成同一目标节点角色对应的角色共享密钥。
本实施例是将对目标数据具有读取权限的不同目标节点角色对应的访问终端作为一个子集，并为每个子集分配一个密钥，即得到不同的目标节点角色分别对应的角色共享密钥。
具体来说，每个子集中的各个访问终端配置有用户秘密信息，用户秘密信息可以是任意的信息，但是每个访问终端无法获知子集中其它访问终端的用户秘密信息，并且不同用户对应的用户秘密信息通常也各不相同。因此，本实施例所得到不同的目标节点角色分别对应的角色共享密钥也各不相同。
S330，根据由各个目标节点角色对应的角色共享密钥构成的密钥序列，对加密密钥进行加密处理，得到加密密钥对应的密文。
若用Ki表示目标节点角色对应的角色共享密钥，由各个目标节点角色对应的角色共享密钥构成的密钥序列则可以表示为“Ki1，Ki2，……，Kim”，其中m表示目标节点角色的总量。根据此密钥序列对会话密钥进行加密，即可以得到形如“i1，i2，……，im，EKi1(K)，EKi2(K)，……，EKim(K)”的密文。
在本实施例中，只有对目标数据具有读取权限的访问终端才能够根据自身配置的用户秘密信息来对加密密钥对应的密文进行解密，以得到加密密钥。因此，基于本实施例提供的加密方式，也能够保证只有对目标数据具有读取权限的访问终端才能够获取到区块链中存储的目标数据。
图5是在图2所示的实施例的基础上而提出的另一种应用于区块链***的数据处理方法的流程图。如图5所示，在S110中确定对目标数据具有读取权限的目标节点角色之前，该方法还包括S410至S430，详细介绍如下：
S410，获取目标数据中含有的访问终端签名信息。
在本实施例中，访问终端签名信息是目标访问终端根据自身的私钥进行信息签名所得到的，并携带在目标数据中。当节点设备接收到目标访问终端向区块链中写入目标数据的请求后，则获取目标数据中携带的访问终端签名信息。
S430，根据目标访问终端所属的节点角色对应的公钥，对访问终端签名信息进行验证。
节点设备获取到访问终端签名信息，根据目标访问终端所属的节点角色对应的公钥，对访问终端签名信息进行验证。若访问终端签名信息通过验证，则表示目标访问终端具有目标数据的写入权限，从而执行S110。若访问终端签名信息未通过验证，则表示目标访问终端不具有目标数据的写入权限，节点设备则拒绝目标访问终端向区块链中写入目标数据的请求。
需要说明的是，节点设备中可以存储有不同节点角色对应的公钥，例如前述实施例中描述的，区块链***中具备不同节点角色的节点设备会预先生成一对与自身所属节点角色对应的私钥和公钥，所生成的公钥同步到各个节点设备中存储。因此，在一种可能的实现方式中，针对S430，节点设备可以根据目标数据中的关键字段确定目标数据所涉及节点设备的节点角色，然后从本地获取存储的该节点角色对应的公钥，进而根据确定的公钥对访问终端签名信息进行验证。
因此，本实施例的技术方案在接收到目标访问终端向区块链中写入目标数据的请求后，进一步对目标访问终端是否具有对于目标数据的写入权限进行验证，进一步保证了目标数据在区块链上的存储是可靠的。例如，如果公安部门请求修改区块链上存储的住建部门具有写入权限的数据，节点设备在接收到公安部门发起的请求后，判断公安部门并不具有该数据的写入权限，则拒绝公安部门的请求，从而实现了区块链上数据的不会被非法篡改，进而保证了区块链上存储的区块数据的可靠性。
在其它的实施例中，若目标访问终端想要读取区块链中存储的目标数据，则会发起读取区块链中存储的目标数据的请求。该目标访问终端可以是任意的访问终端，并且，该目标访问终端不一定是区块链上所存储的目标数据的写入请求方。
节点设备响应于目标访问终端读取区块链中存储的目标数据的请求，将区块链中存储的目标数据对应的密文发送至目标访问终端，以使目标访问终端根据自身所属的节点角色对应的私钥，对目标数据对应的密文进行解密，以得到目标数据。
需要说明的是，各个节点设备连接的访问终端拥有节点设备对应的节点角色的权限，目标数据对应的密文是根据加密密钥对目标数据进行加密处理所得到的，加密密钥则是目标数据具有读取权限的目标节点角色对应的加密密钥，详细的加密密钥的获取过程以及对目标数据进行加密的过程请参见前述实施例，本处不再对此进行赘述。
如果目标数据是以数字信封的形式存储在区块链上，也即区块链上不仅存储了目标数据对应的密文，还存储了加密密钥对应的密文，节点设备还需将区块链上存储的加密密钥对应的密文发送至目标访问终端，以使目标访问终端根据自身所属的节点角色对应的私钥，对加密密钥对应的密文进行解密，并根据解密得到的加密密钥对所述目标数据对应的密文进行解密。
其中，加密密钥对应的密文是根据对目标节点角色对应的共享密钥对加密密钥进行加密处理所得到的，共享密钥是根据各个目标节点角色对应的公钥聚合生成的，详细的过程请参见前述实施例中详细描述的内容，本处也不进行赘述。
此外，节点设备可以通过广播的形式，将区块链上存储的目标数据对应的密文以及加密密钥对应的密文发送至目标访问终端。目标访问终端接收到节点设备广播的信息后，根据自身所属的节点角色对应的私钥，对接收到的加密密钥对应的密文进行解密，并根据解密得到的加密密钥对目标数据对应的密文进行解密。
其中，目标访问终端自身所属的节点角色对应的私钥可以包括目标访问终端中配置的用户秘密信息；加密密钥对应的密文是根据由各个目标节点角色对应的角色共享密钥构成的密钥序列，对加密密钥进行加密处理所得到的；角色共享密钥是根据同一目标节点角色对应的各个访问终端中配置的用户秘密信息聚合生成的。详细的过程也请参见前述实施例中详细描述的内容，本处不进行赘述。
由上可知，本申请的技术方案不仅实现了多个节点角色对于区块数据进行维护的一致性，同时还确保区块数据是最小授权的，使得多个节点角色不仅可以通过区块链实现高效率的数据共享，同时能够保证区块链上数据的安全性和可靠性，能够满足任意对于数据共享过程中的共享效率以及数据安全性具有较高要求的场景，例如还可以应用在企业各部门或分支机构之间的数据共享、多人之间进行数据共享等场景中，本处不对此进行限制。
图6是本申请的一示例性实施例示出的一种应用于区块链***的数据处理装置的框图。该区块链***包括多个节点设备，各个节点设备连接有至少一个访问终端，访问终端拥有所连接节点设备对应的节点角色的权限，该装置配置在区块链***中的节点设备上。如图6所示，该装置可以包括：
节点角色确定模块510，配置为响应于目标访问终端向区块链中写入目标数据的请求，确定对目标数据具有读取权限的目标节点角色，其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端；加密密钥获取模块530，配置为获取目标节点角色所对应的加密密钥；数据加密模块550，配置为根据加密密钥对目标数据进行加密处理，得到目标数据对应的密文，目标数据对应的密文能够被目标节点角色对应的访问终端解密；数据存储模块570，配置为将目标数据对应的密文存储至区块链上。
在另一示例性实施例中，加密密钥包括共享公钥；加密密钥获取模块530 包括：
公钥获取单元，配置为获取各个目标节点角色对应的公钥；共享公钥生成单元，配置为根据各个目标节点角色对应的公钥聚合生成共享公钥，其中，基于共享公钥对目标数据加密得到的密文能够被各个目标节点角色对应的私钥解密。
在另一示例性实施例中，公钥获取单元包括：
随机数生成子单元，配置为在节点设备中分别生成各个目标节点角色对应的随机数；公钥生成子单元，配置为根据各个目标节点角色对应的随机数，生成各个目标节点角色对应的公钥；随机数发送子单元，配置为将各个目标节点角色对应的随机数发送至目标节点角色对应的访问终端，以使访问终端基于接收到的随机数生成自身所属的节点角色对应的私钥。
在另一示例性实施例中，加密密钥包括对称密钥；加密密钥获取模块530包括：
对称密钥生成单元，配置为在节点设备中生成对称密钥；对称密钥发送单元，配置为将对称密钥发送至目标节点角色对应的访问终端，以使目标节点角色对应的访问终端能够根据接收到的对称密钥对目标数据对应的密文解密。
在另一示例性实施例中，该装置还包括：
第一密钥加密模块，配置为根据各个目标节点角色对应的共享密钥对加密密钥进行加密，得到加密密钥对应的密文；所述数据存储模块还配置为将加密密钥对应的密文与目标数据对应的密文共同存储于区块链上。
在另一示例性实施例中，该装置还包括：
角色共享密钥获取模块，配置为根据同一目标节点角色对应的各个访问终端中配置的用户秘密信息，聚合生成同一目标节点角色对应的角色共享密钥；第二密钥加密模块，配置为根据由各个目标节点角色对应的角色共享密钥构成的密钥序列，对加密密钥进行加密处理，得到加密密钥对应的密文；所述数据存储模块还配置为将加密密钥对应的密文与目标数据对应的密文共同存储至区块链上。
在另一示例性实施例中，该装置还包括：
签名获取模块，配置为获取目标数据中含有的访问终端签名信息；
签名验证模块，配置为根据目标访问终端所属的节点角色对应的公钥，对访问终端签名信息进行验证，若访问终端签名信息通过验证，则触发所述节点角色确定模块执行确定对目标数据具有读取权限的目标节点角色的步骤。
在另一示例性实施例中，签名验证模块包括：
字段信息获取单元，配置为根据目标数据中含有的关键字段，确定目标访问终端所属的节点角色；签名信息验证单元，配置为从本地存储的公钥列表中查找目标访问终端所属的节点角色所对应的公钥，根据查找到的公钥对访问终端签名信息进行验证。
本申请的实施例还提供了另一种应用于区块链***的数据处理装置，该装置包括：
第一密文发送模块，配置为响应于目标访问终端读取区块链中存储的目标数据的请求，将区块链中存储的目标数据对应的密文发送至目标访问终端，访问终端拥有所连接节点设备对应的节点角色的权限，以使目标访问终端根据自身所属的节点角色对应的私钥，对目标数据对应的密文进行解密，以得到目标数据；
其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端，，目标数据对应的密文是根据加密密钥对目标数据进行加密处理所得到的，加密密钥是目标数据具有读取权限的目标节点角色对应的加密密钥。
在另一示例性实施例中，该装置还包括：
第二密文发送模块，配置为将区块链上存储的加密密钥对应的密文发送至目标访问终端，以使目标访问终端根据自身所属的节点角色对应的私钥，对加密密钥对应的密文进行解密，并根据解密得到的加密密钥对目标数据对应的密文进行解密；
其中，加密密钥对应的密文是根据对目标节点角色对应的共享密钥对加密密钥进行加密处理所得到的，共享密钥是根据各个目标节点角色对应的公钥聚合生成的。
在另一示例性实施例中，第一密文发送模块包括：
数据广播单元，配置为将区块链上存储的目标数据对应的密文以及加密密钥对应的密文进行广播，以使目标访问终端根据自身所属的节点角色对应的私 钥，对接收到的加密密钥对应的密文进行解密，并根据解密得到的加密密钥对目标数据对应的密文进行解密。
其中，目标访问终端自身所属的节点角色对应的私钥包括目标访问终端中配置的用户秘密信息；加密密钥对应的密文是根据由各个目标节点角色对应的角色共享密钥构成的密钥序列，对加密密钥进行加密处理所得到的；角色共享密钥是根据同一目标节点角色对应的各个访问终端中配置的用户秘密信息聚合生成的。
需要说明的是，上述实施例所提供的装置与上述实施例所提供的方法属于同一构思，其中各个模块和单元执行操作的具体方式已经在方法实施例中进行了详细描述，此处不再赘述。
本申请的实施例还提供了一种电子设备，包括处理器和存储器，其中，存储器上存储有计算机可读指令，该计算机可读指令被处理器执行时实现如前所述的应用于区块链***的数据处理方法。
图7示出了一种适于用来实现本申请实施例的电子设备的计算机***的结构示意图。需要说明的是，图7示出的电子设备的计算机***1600仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。
如图7所示，计算机***1600包括中央处理单元(Central Processing Unit，CPU)1601，其可以根据存储在只读存储器(Read-Only Memory，ROM)1602中的程序或者从储存部分1608加载到随机访问存储器(Random Access Memory，RAM)1603中的程序而执行各种适当的动作和处理，例如执行上述实施例中所述的方法。在RAM 1603中，还存储有***操作所需的各种程序和数据。CPU 1601、ROM 1602以及RAM 1603通过总线1604彼此相连。输入/输出(Input/Output，I/O)接口1605也连接至总线1604。
以下部件连接至I/O接口1605：包括键盘、鼠标等的输入部分1606；包括诸如阴极射线管(Cathode Ray Tube，CRT)、液晶显示器(Liquid Crystal Display，LCD)等以及扬声器等的输出部分1607；包括硬盘等的储存部分1608；以及包括诸如LAN(Local Area Network，局域网)卡、调制解调器等的网络接口卡的通信部分1609。通信部分1609经由诸如因特网的网络执行通信处理。驱动器1610也根据需要连接至I/O接口1605。可拆卸介质1611，诸如磁盘、光盘、磁 光盘、半导体存储器等等，根据需要安装在驱动器1610上，以便于从其上读出的计算机程序根据需要被安装入储存部分1608。
特别地，根据本申请的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本申请的实施例包括一种计算机程序产品，其包括承载在计算机可读介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的计算机程序。在这样的实施例中，该计算机程序可以通过通信部分1609从网络上被下载和安装，和/或从可拆卸介质1611被安装。在该计算机程序被中央处理单元(CPU)1601执行时，执行本申请的***中限定的各种功能。
需要说明的是，本申请实施例所示的计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质或者是上述两者的任意组合。计算机可读存储介质例如可以是电、磁、光、电磁、红外线、或半导体的***、装置或器件，或者任意以上的组合。计算机可读存储介质的更具体的例子可以包括但不限于：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(Erasable Programmable Read Only Memory，EPROM)、闪存、光纤、便携式紧凑磁盘只读存储器(Compact Disc Read-Only Memory，CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。在本申请中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行***、装置或者器件使用或者与其结合使用。而在本申请中，计算机可读的信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了计算机可读的计算机程序。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。计算机可读的信号介质还可以是计算机可读存储介质以外的任何计算机可读介质，该计算机可读介质可以发送、传播或者传输用于由指令执行***、装置或者器件使用或者与其结合使用的程序。计算机可读介质上包含的计算机程序可以用任何适当的介质传输，包括但不限于：无线、有线等等，或者上述的任意合适的组合。
附图中的流程图和框图，图示了按照本申请各种实施例的***、方法和计算机程序产品的可能实现的体系架构、功能和操作。其中，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，上述模块、程序段、 或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图或流程图中的每个方框、以及框图或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的***来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本申请实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现，所描述的单元也可以设置在处理器中。其中，这些单元的名称在某种情况下并不构成对该单元本身的限定。
本申请的另一方面还提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现如前所述的应用于区块链***的数据处理方法。该计算机可读存储介质可以是上述实施例中描述的电子设备中所包含的，也可以是单独存在，而未装配入该电子设备中。
本申请的另一方面还提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述各个实施例中提供的应用于区块链***的数据处理方法。
上述内容，仅为本申请的较佳示例性实施例，并非用于限制本申请的实施方案，本领域普通技术人员根据本申请的主要构思和精神，可以十分方便地进行相应的变通或修改，故本申请的保护范围应以权利要求书所要求的保护范围为准。

Claims (16)

  1. 一种应用于区块链***的数据处理方法，所述区块链***包括多个节点设备，所述多个节点设备分别与至少一个访问终端连接且分别对应一个节点角色，所述访问终端拥有所连接节点设备对应的节点角色的权限，所述方法由所述区块链***中的节点设备执行，所述方法包括：
    响应于目标访问终端向区块链中写入目标数据的请求，确定对所述目标数据具有读取权限的目标节点角色，其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端；
    获取所述目标节点角色所对应的加密密钥；
    根据所述加密密钥对所述目标数据进行加密处理，得到所述目标数据对应的密文，所述目标数据对应的密文能够被所述目标节点角色对应的访问终端解密；
    将所述目标数据对应的密文存储至所述区块链上。
  2. 根据权利要求1所述的方法，所述加密密钥包括共享公钥；所述获取所述目标节点角色所对应的加密密钥，包括：
    获取各个目标节点角色对应的公钥；
    根据所述各个目标节点角色对应的公钥聚合生成所述共享公钥，其中，基于所述共享公钥对所述目标数据加密得到的密文能够被所述各个目标节点角色对应的私钥解密。
  3. 根据权利要求2所述的方法，所述获取各个目标节点角色对应的公钥，包括：
    在所述节点设备中分别生成所述各个目标节点角色对应的随机数；
    根据所述各个目标节点角色对应的随机数，生成所述各个目标节点角色对应的公钥；
    所述方法还包括：
    将所述各个目标节点角色对应的随机数发送至目标节点角色的访问终端，以使所述访问终端基于接收到的随机数生成自身所属的节点角色对应的私钥。
  4. 根据权利要求1所述的方法，所述加密密钥包括对称密钥；所述获取所述目标节点角色所对应的加密密钥，包括：
    在所述节点设备中生成所述对称密钥；
    所述方法还包括：
    将所述对称密钥发送至所述目标节点角色对应的访问终端，以使所述目标节点角色对应的访问终端能够根据接收到的对称密钥对所述目标数据对应的密文解密。
  5. 根据权利要求1所述的方法，所述方法还包括：
    根据各个目标节点角色对应的共享密钥对所述加密密钥进行加密，得到所述加密密钥对应的密文；
    所述将所述目标数据对应的密文存储至所述区块链上，包括：
    将所述加密密钥对应的密文与所述目标数据对应的密文共同存储于所述区块链上。
  6. 根据权利要求1所述的方法，所述方法还包括：
    根据同一目标节点角色对应的各个访问终端中配置的用户秘密信息，聚合生成所述同一目标节点角色对应的角色共享密钥；
    根据由各个目标节点角色对应的角色共享密钥构成的密钥序列，对所述加密密钥进行加密处理，得到所述加密密钥对应的密文；
    所述将所述目标数据对应的密文存储至所述区块链上，包括：
    将所述加密密钥对应的密文与所述目标数据对应的密文共同存储至所述区块链上。
  7. 根据权利要求1所述的方法，所述方法还包括：
    获取所述目标数据中含有的访问终端签名信息；
    根据所述目标访问终端所属的节点角色对应的公钥，对所述访问终端签名信息进行验证；
    若所述访问终端签名信息通过所述验证，则执行所述确定对所述目标数据具有读取权限的目标节点角色的步骤。
  8. 根据权利要求7所述的方法，所述根据所述目标访问终端所属的节点角色对应的公钥，对所述访问终端签名信息进行验证，包括：
    根据所述目标数据中含有的关键字段，确定所述目标访问终端所属的节点角色；
    从本地存储的公钥列表中查找所述目标访问终端所属的节点角色所对应的公钥，根据查找到的公钥对所述访问终端签名信息进行验证。
  9. 一种应用于区块链***的数据处理方法，所述区块链***包括多个节点设备，所述多个节点设备分别与至少一个访问终端连接且分别对应一个节点角色，所述访问终端拥有所连接节点设备对应的节点角色的权限，所述方法由所述区块链***中的节点设备执行，所述方法包括：
    响应于目标访问终端读取目标数据的请求，将区块链中存储的所述目标数据对应的密文发送至所述目标访问终端，以使所述目标访问终端根据自身所属的节点角色对应的私钥，对所述目标数据对应的密文进行解密，以得到所述目标数据；
    其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端，所述目标数据对应的密文是根据加密密钥对所述目标数据进行加密处理所得到的，所述加密密钥是对所述目标数据具有读取权限的目标节点角色对应的加密密钥。
  10. 根据权利要求9所述的方法，所述方法还包括：
    将所述区块链上存储的加密密钥对应的密文发送至所述目标访问终端，以使所述目标访问终端根据自身所属的节点角色对应的私钥，对所述加密密钥对应的密文进行解密，并根据解密得到的加密密钥对所述目标数据对应的密文进行解密；
    其中，所述加密密钥对应的密文是根据对所述目标节点角色对应的共享密钥对所述加密密钥进行加密处理所得到的，所述共享密钥是根据各个目标节点角色对应的公钥聚合生成的。
  11. 根据权利要求9所述的方法，所述将区块链上存储的所述目标数据对应的密文发送至所述目标访问终端，包括：
    将所述区块链上存储的所述目标数据对应的密文以及所述加密密钥对应的密文进行广播，以使所述目标访问终端根据自身所属的节点角色对应的私钥，对接收到的所述加密密钥对应的密文进行解密，并根据解密得到的加密密钥对所述目标数据对应的密文进行解密。
  12. 根据权利要求11所述的方法，所述目标访问终端自身所属的节点角 色对应的私钥包括所述目标访问终端中配置的用户秘密信息；所述加密密钥对应的密文是根据由各个目标节点角色对应的角色共享密钥构成的密钥序列，对所述加密密钥进行加密处理所得到的；所述角色共享密钥是根据同一目标节点角色对应的各个访问终端中配置的用户秘密信息聚合生成的。
  13. 一种应用于区块链***的数据处理装置，所述区块链***包括多个节点设备，所述多个节点设备分别与至少一个访问终端连接且分别对应一个节点角色，所述访问终端拥有所连接节点设备对应的节点角色的权限，所述装置配置在所述区块链***中的节点设备上，所述装置包括：
    节点角色确定模块，配置为响应于目标访问终端向区块链中写入目标数据的请求，确定对所述目标数据具有读取权限的目标节点角色，其中，所述目标访问终端为与所述节点设备连接的访问终端中的一个访问终端；
    加密密钥获取模块，配置为获取所述目标节点角色所对应的加密密钥；
    数据加密模块，配置为根据所述加密密钥对所述目标数据进行加密处理，得到所述目标数据对应的密文，所述目标数据对应的密文能够被所述目标节点角色对应的访问终端解密；
    数据存储模块，配置为将所述目标数据对应的密文存储至所述区块链上。
  14. 一种电子设备，包括：
    存储器，存储有计算机可读指令；
    处理器，读取存储器存储的计算机可读指令，以执行权利要求1-12中的任一项所述的方法。
  15. 一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序用于执行权利要求1-12中的任一项所述的方法。
  16. 一种包括指令的计算机程序产品，当其在计算机上运行时，使得所述计算机执行权利要求1-12中的任一项所述的方法。
PCT/CN2021/124282 2020-11-20 2021-10-18 应用于区块链***的数据处理方法及装置 WO2022105505A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21893654.0A EP4191430A4 (en) 2020-11-20 2021-10-18 DATA PROCESSING METHOD AND DEVICE FOR A BLOCKCHAIN SYSTEM
US17/955,422 US20230014599A1 (en) 2020-11-20 2022-09-28 Data processing method and apparatus for blockchain system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011306241.0 2020-11-20
CN202011306241.0A CN112131316B (zh) 2020-11-20 2020-11-20 应用于区块链***的数据处理方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/955,422 Continuation US20230014599A1 (en) 2020-11-20 2022-09-28 Data processing method and apparatus for blockchain system

Publications (1)

Publication Number Publication Date
WO2022105505A1 true WO2022105505A1 (zh) 2022-05-27

Family

ID=73852436

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/124282 WO2022105505A1 (zh) 2020-11-20 2021-10-18 应用于区块链***的数据处理方法及装置

Country Status (4)

Country Link
US (1) US20230014599A1 (zh)
EP (1) EP4191430A4 (zh)
CN (1) CN112131316B (zh)
WO (1) WO2022105505A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115174188A (zh) * 2022-06-29 2022-10-11 蚂蚁区块链科技(上海)有限公司 一种消息传输方法、装置、电子设备和存储介质
CN115604030A (zh) * 2022-11-30 2023-01-13 北京邮电大学（Cn） 数据共享方法、装置、电子设备和存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112131316B (zh) * 2020-11-20 2021-02-12 腾讯科技（深圳）有限公司 应用于区块链***的数据处理方法及装置
CN112328712B (zh) * 2021-01-04 2021-05-18 清华四川能源互联网研究院 基于图数据库的权限管理方法、装置和电子设备
WO2022183371A1 (zh) * 2021-03-02 2022-09-09 深圳大学 一种物联网设备的固件更新方法、装置、***及存储介质
CN113099417B (zh) * 2021-03-23 2023-06-30 千寻位置网络（浙江）有限公司 差分数据播发方法、装置、电子设备及计算机存储介质
CN113259124A (zh) * 2021-06-08 2021-08-13 清华大学 一种区块链数据写入、访问方法及装置
CN114547704B (zh) * 2022-04-28 2022-08-02 恒生电子股份有限公司 基于分布式账本的数据处理方法以及装置
CN115297118B (zh) * 2022-10-09 2023-01-31 北京航空航天大学杭州创新研究院 一种基于区块链的数据共享方法及数据共享***
CN116232769B (zh) * 2023-05-08 2023-07-18 北京金商祺科技有限公司 一种安全互动方法及平台

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200162238A1 (en) * 2018-11-20 2020-05-21 International Business Machines Corporation User access control in blockchain
CN111274599A (zh) * 2020-02-17 2020-06-12 深圳壹账通智能科技有限公司 一种基于区块链的数据共享方法及相关装置
CN111371790A (zh) * 2020-03-05 2020-07-03 中国工商银行股份有限公司 基于联盟链的数据加密发送方法、相关方法、装置和***
CN111625869A (zh) * 2020-04-23 2020-09-04 腾讯科技（深圳）有限公司 数据处理方法及数据处理装置
CN112131316A (zh) * 2020-11-20 2020-12-25 腾讯科技（深圳）有限公司 应用于区块链***的数据处理方法及装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9985964B2 (en) * 2016-03-28 2018-05-29 Black Gold Coin, Inc. Systems and methods for providing block chain-based multifactor personal identity verification
JP7269944B2 (ja) * 2018-01-17 2023-05-09 ティーゼロ・アイピー，エルエルシー トランザクションアドレスを生成するためにｎ個のうちｍ個の鍵を使用するマルチ承認システム
CN108334595B (zh) * 2018-01-31 2020-08-04 泰康保险集团股份有限公司 数据共享方法及装置
US10404454B1 (en) * 2018-04-25 2019-09-03 Blockchain Asics Llc Cryptographic ASIC for derivative key hierarchy
WO2020002415A1 (en) * 2018-06-27 2020-01-02 Newbanking Aps Securely managing authenticated user-data items
SG11202109273QA (en) * 2019-02-25 2021-09-29 Oocl Infotech Holdings Ltd Zero trust communication system for freight shipping organizations, and methods of use
CN110717191A (zh) * 2019-10-24 2020-01-21 兰州理工大学 基于可搜索属性加密的区块链数据隐私保护访问控制方法
CN111245837B (zh) * 2020-01-13 2021-08-10 电子科技大学 一种基于区块链的车联网数据共享细粒度访问控制方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200162238A1 (en) * 2018-11-20 2020-05-21 International Business Machines Corporation User access control in blockchain
CN111274599A (zh) * 2020-02-17 2020-06-12 深圳壹账通智能科技有限公司 一种基于区块链的数据共享方法及相关装置
CN111371790A (zh) * 2020-03-05 2020-07-03 中国工商银行股份有限公司 基于联盟链的数据加密发送方法、相关方法、装置和***
CN111625869A (zh) * 2020-04-23 2020-09-04 腾讯科技（深圳）有限公司 数据处理方法及数据处理装置
CN112131316A (zh) * 2020-11-20 2020-12-25 腾讯科技（深圳）有限公司 应用于区块链***的数据处理方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4191430A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115174188A (zh) * 2022-06-29 2022-10-11 蚂蚁区块链科技(上海)有限公司 一种消息传输方法、装置、电子设备和存储介质
CN115604030A (zh) * 2022-11-30 2023-01-13 北京邮电大学（Cn） 数据共享方法、装置、电子设备和存储介质
CN115604030B (zh) * 2022-11-30 2023-05-02 北京邮电大学 数据共享方法、装置、电子设备和存储介质

Also Published As

Publication number Publication date
CN112131316A (zh) 2020-12-25
EP4191430A1 (en) 2023-06-07
CN112131316B (zh) 2021-02-12
US20230014599A1 (en) 2023-01-19
EP4191430A4 (en) 2024-01-03

Similar Documents

Publication Publication Date Title
WO2022105505A1 (zh) 应用于区块链***的数据处理方法及装置
US20190394175A1 (en) Systems and methods for permissioned blockchain infrastructure with fine-grained access control and confidentiality-preserving publish/subscribe messaging
CN110417750B (zh) 基于区块链技术的文件读取和存储的方法、终端设备和存储介质
US8379857B1 (en) Secure key distribution for private communication in an unsecured communication channel
US11196561B2 (en) Authorized data sharing using smart contracts
US11829502B2 (en) Data sharing via distributed ledgers
US10237246B1 (en) Secure message search
US20120054491A1 (en) Re-authentication in client-server communications
Premkamal et al. Enhanced attribute based access control with secure deduplication for big data storage in cloud
WO2018165835A1 (zh) 云密文访问控制方法及***
CN110445840B (zh) 一种基于区块链技术的文件存储和读取的方法
US11546159B2 (en) Long-lasting refresh tokens in self-contained format
Ma et al. A new private information encryption method in internet of things under cloud computing environment
Chidambaram et al. Enhancing the security of customer data in cloud environments using a novel digital fingerprinting technique
Qinlong et al. Improving security and efciency for encrypted data sharing in online social networks
Liu et al. Efficient decentralized access control for secure data sharing in cloud computing
CN112800462A (zh) 一种云计算环境下机密信息的存储方法
US20230245111A1 (en) Systems and methods for requesting secure, encrypted communications across distributed computer networks for authorizing use of cryptography-based digital repositories in order to perform blockchain operations in decentralized applications
Wang et al. Attribute‐Based User Revocable Data Integrity Audit for Internet‐of‐Things Devices in Cloud Storage
Xie et al. Assured Deletion: A Scheme Based on Strong Nonseparability
Sakthivel et al. Advanced set containment deep learned Rabin certificateless signcryption for secured transmission with big data in cloud
Zhou et al. A novel privacy protection scheme for internet of things based on blockchain and privacy set intersection technique
CN115051839B (zh) 一种基于kp-abe的dds访问控制和加解密***及方法
CN112865968B (zh) 数据密文托管方法、***、计算机设备及存储介质
US20230421540A1 (en) Systems and methods for generating secure, encrypted communications using multi-party computations in order to perform blockchain operations in decentralized applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21893654

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021893654

Country of ref document: EP

Effective date: 20230302

NENP Non-entry into the national phase

Ref country code: DE