CN109033855A

CN109033855A - A kind of data transmission method based on block chain, device and storage medium

Info

Publication number: CN109033855A
Application number: CN201810790624.6A
Authority: CN
Inventors: 郭锐; 李茂材; 蔡弋戈; 张建俊; 秦青; 郑罗海; 卢吉光
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2018-07-18
Filing date: 2018-07-18
Publication date: 2018-12-18
Anticipated expiration: 2038-07-18
Also published as: CN109033855B

Abstract

The embodiment of the invention discloses a kind of data transmission method based on block chain, device and storage medium, the data to be transmitted of transmission node on the available block chain of the embodiment of the present invention, and determine the corresponding authorization node of the data to be transmitted；The data to be transmitted is divided into sensitive data and nonsensitive data according to preset strategy；The symmetric key of the sensitive data is generated, and the sensitive data is encrypted according to the symmetric key, obtains ciphertext data；The public key of the authorization node is obtained, and the symmetric key is encrypted according to the public key of the authorization node, symmetric key after being encrypted；Data are transmitted after generating encryption according to symmetric key after the ciphertext data, encryption and nonsensitive data；The authorization node is transferred to by the block chain by data are transmitted after the encryption.It is realized in the program and the sensitive data of block chain transmission is encrypted, reduce the risk of sensitive data leakage, improve the safety of data transmission.

Description

A kind of data transmission method based on block chain, device and storage medium

Technical field

The present invention relates to fields of communication technology, and in particular to a kind of data transmission method based on block chain, device and deposits Storage media.

Background technique

Block chain is the storage and computing technique of a kind of decentralization, and being superimposed data block sequentially in time Lasting not revisable record is generated, and will be included in each node for being stored in block chain network, so as to go to center The mode collective of change safeguards an authentic data library.

In the prior art, since block chain is substantially a distributed database, block chain data above It can be gone on network sharing to all nodes, thus other nodes can obtain data content, can effectively ensure that block chain Data sharing and the transparency in network.For example, when participant A want publication one transaction data be assigned to participant B and When participant C, if this transaction carries out on block chain, the every other node on block chain can all see this pen Transaction, this, which makes the transaction of transaction participant have no secret, to say, the account of a mechanism is also possible to by other nodes Mechanism tracking, to bring the risk of leaking data, causes the safety of transaction data lower.

Summary of the invention

The embodiment of the present invention provides a kind of data transmission method based on block chain, device and storage medium, it is intended to improve The safety of data transmission.

In order to solve the above technical problems, the embodiment of the present invention the following technical schemes are provided:

A kind of data transmission method based on block chain, comprising:

The data to be transmitted of transmission node on block chain is obtained, and determines the corresponding authorization node of the data to be transmitted；

The data to be transmitted is divided into sensitive data and nonsensitive data according to preset strategy；

The symmetric key of the sensitive data is generated, and the sensitive data is encrypted according to the symmetric key, Obtain ciphertext data；

The public key of the authorization node is obtained, and the symmetric key is added according to the public key of the authorization node It is close, symmetric key after being encrypted；

Data are transmitted after generating encryption according to symmetric key after the ciphertext data, encryption and nonsensitive data；

The authorization node is transferred to by the block chain by data are transmitted after the encryption.

A kind of data transmission device based on block chain, comprising:

Acquiring unit for obtaining the data to be transmitted of transmission node on block chain, and determines the data to be transmitted pair The authorization node answered；

Division unit, for the data to be transmitted to be divided into sensitive data and nonsensitive data according to preset strategy；

First encryption unit, for generating the symmetric key of the sensitive data, and according to the symmetric key to described Sensitive data is encrypted, and ciphertext data are obtained；

Second encryption unit, for obtaining the public key of the authorization node, and according to the public key of the authorization node to institute It states symmetric key to be encrypted, symmetric key after being encrypted；

Generation unit, for being passed after generating encryption according to symmetric key after the ciphertext data, encryption and nonsensitive data Transmission of data；

Transmission unit is transferred to the authorization node by the block chain for will transmit data after the encryption.

Optionally, the generation unit includes:

Subelement is set, for setting clear text field, and general for symmetric key after the encryption and nonsensitive data The ciphertext data are set as ciphertext field；

Subelement is generated, for transmitting data after generating encryption according to the clear text field and ciphertext field.

Optionally, the generation subelement is used for:

First identifier is set for the clear text field, and second identifier is set for the ciphertext field；

Data packet head is generated according to the first identifier and second identifier；

Data are transmitted after generating encryption according to the data packet head, clear text field and ciphertext field.

Optionally, the acquiring unit is used for:

The data to be transmitted of transmission node on block chain is obtained, and the data to be transmitted group is combined into multiple groups number to be transmitted According to；

Determine the corresponding authorization node of every group of data to be transmitted.

Optionally, the division unit is used for:

Data structure configuration information is obtained, every group of data to be transmitted is parsed according to the data structure configuration information；

Every group of data to be transmitted is divided into sensitive data and nonsensitive data with preset strategy based on analysis result.

Optionally, first encryption unit is used for:

The corresponding symmetric key of every group of sensitive data is generated according to preset algorithm, obtains symmetric key set；

Every group of sensitive data is encrypted respectively according to the symmetric key set, obtains ciphertext data.

Optionally, second encryption unit is used for:

Public key acquisition request is sent to each authorization node；

Receive the public key that each authorization node is returned based on public key acquisition request；

The corresponding symmetric key of each authorization node is encrypted respectively according to the public key of each authorization node, is added Symmetric key after close.

A kind of data transmission method based on block chain, comprising:

Data are transmitted after receiving the encryption that transmission node is sent by block chain；

Symmetric key and nonsensitive data after extracting ciphertext data, encryption after the encryption in transmission data, it is described Ciphertext data are to be encrypted to obtain to the sensitive data in data to be transmitted using the symmetric key that the transmission node generates, Symmetric key is to be encrypted to obtain to the symmetric key using the public key of authorization node after the encryption；

The private key in the authorization node with the public key match is obtained, according to the private key to symmetrical close after the encryption Key is decrypted, and obtains symmetric key；

The ciphertext data are decrypted according to the symmetric key, the sensitive data after being decrypted；

The data to be transmitted after decryption is generated according to the sensitive data and the nonsensitive data.

A kind of data transmission device based on block chain, comprising:

Receiving unit, for transmitting data after receiving the encryption that transmission node is sent by block chain；

Extraction unit, for extracting after ciphertext data, encryption symmetric key and non-in data from transmitting after the encryption Sensitive data, the ciphertext data are the symmetric key using transmission node generation to the sensitive data in data to be transmitted It is encrypted to obtain, symmetric key is encrypt to the symmetric key using the public key of authorization node after the encryption It arrives；

First decryption unit, for obtaining the private key in the authorization node with the public key match, according to the private key Symmetric key after the encryption is decrypted, symmetric key is obtained；

Second decryption unit, for the ciphertext data to be decrypted according to the symmetric key, after being decrypted Sensitive data；

Data generating unit, for generating the number to be transmitted after decryption according to the sensitive data and the nonsensitive data According to.

Optionally, the extraction unit is used for:

First identifier and second identifier are extracted from the data packet head for transmitting data after the encryption；

The clear text field transmitted after the encryption in data is determined according to the first identifier, and according to second mark Know the ciphertext field transmitted in data after determining the encryption；

Symmetric key and nonsensitive data after extracting encryption in the clear text field, are extracted from the ciphertext field Ciphertext data out.

Optionally, data generating unit is used for:

It obtains the sensitive data and the nonsensitive data is combined into the data structure configuration information of data to be transmitted；

After the sensitive data and the nonsensitive data are combined into decryption according to the data structure configuration information Data to be transmitted.

A kind of storage medium, the storage medium are stored with a plurality of instruction, and described instruction is suitable for processor and is loaded, with Execute the step in any data transmission method provided in an embodiment of the present invention.

A kind of equipment, including memory and processor, the memory are stored with computer program, the computer program When being executed by the processor, so that the processor executes in any data transmission method provided in an embodiment of the present invention Step.

The data to be transmitted of transmission node on the available block chain of the embodiment of the present invention, and determine that data to be transmitted is corresponding Authorization node, data to be transmitted is then divided into sensitive data and nonsensitive data according to preset strategy, and generate quick Feel the symmetric key of data, and sensitive data is encrypted according to symmetric key, obtains ciphertext data, it is available at this time to award The public key of node is weighed, and symmetric key is encrypted according to the public key of authorization node, symmetric key after being encrypted, secondly root Transmission data are generated according to symmetric key after ciphertext data, encryption and nonsensitive data, finally transmission data can be passed through into block Chain is transferred to authorization node.It is realized in the program and the sensitive data transmitted by block chain is encrypted, so that only awarding Power node can read Sensitive data content, rather than authorization node can not read Sensitive data content, to reduce sensitive number According to the risk of leakage, the safety of data transmission is improved.

Detailed description of the invention

To describe the technical solutions in the embodiments of the present invention more clearly, make required in being described below to embodiment Attached drawing is briefly described, it should be apparent that, drawings in the following description are only some embodiments of the invention, for For those skilled in the art, without creative efforts, it can also be obtained according to these attached drawings other attached Figure.

Fig. 1 is the schematic diagram of a scenario of data transmission method provided in an embodiment of the present invention；

Fig. 2 is the flow diagram of data transmission method provided in an embodiment of the present invention；

Fig. 3 is the flow diagram of data transmission method provided in an embodiment of the present invention；

Fig. 4 is the flow diagram of data transmission method provided in an embodiment of the present invention；

Fig. 5 is the schematic diagram that assets provided in an embodiment of the present invention circulate in block chain；

Fig. 6 is the schematic diagram of the data structure of additional data provided in an embodiment of the present invention；

Fig. 7 is the structural schematic diagram of data transmission device provided in an embodiment of the present invention；

Fig. 8 is another structural schematic diagram of data transmission device provided in an embodiment of the present invention；

Fig. 9 is the structural schematic diagram of equipment provided in an embodiment of the present invention.

Specific embodiment

Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on Embodiment in the present invention, those skilled in the art's every other implementation obtained without creative efforts Example, shall fall within the protection scope of the present invention.

The embodiment of the present invention provides a kind of data transmission method based on block chain, device and storage medium.

Referring to Fig. 1, Fig. 1 is the schematic diagram of a scenario of data transmission method provided by the embodiment of the present invention, which is passed Transmission method can be applied to the data transmission device based on block chain, which specifically can integrate in the network equipment In such as terminal or server equipment, for example, when equipment is as transmission node, on available block chain transmission node to Data are transmitted, and determine the corresponding authorization node of data to be transmitted, which can be the equipment such as terminal or server.So Afterwards, data to be transmitted is divided into sensitive data and nonsensitive data according to preset strategy, for example, can match according to data structure Confidence breath every group of data to be transmitted of parsing, and be based on analysis result divided into every group of data to be transmitted according to preset strategy Sensitive data and nonsensitive data.Secondly, the symmetric key of sensitive data can be generated according to preset algorithm or at random, and according to Symmetric key encrypts sensitive data, obtains ciphertext data.Again, the public key of authorization node is obtained, for example, can be to awarding It weighs node and sends public key acquisition request, and receive the public key of authorization node return, it at this time can be according to the public key pair of authorization node Symmetric key is encrypted, symmetric key after being encrypted.Finally, can be according to symmetric key after ciphertext data, encryption and non- Sensitive data transmits data after generating encryption, for example, can set plaintext word for symmetric key after encryption and nonsensitive data Section, and ciphertext field is set by ciphertext data, data are transmitted after generating encryption according to clear text field and ciphertext field, at this time Authorization node, etc. can be transferred to by block chain by data are transmitted after encryption.

When equipment is as authorized node, data are transmitted after can receive the encryption that transmission node is sent by block chain, Then symmetric key and nonsensitive data after ciphertext data, encryption are extracted in data from transmitting after encryption, for example, can be from adding Symmetric key and nonsensitive data after encryption are extracted in the clear text field of transmission data after close, the close of data is transmitted after encryption Ciphertext data are extracted in text section.Secondly, the private key in authorization node with public key match is obtained, according to right after private key pair encryption Claim key to be decrypted, obtains symmetric key, and ciphertext data are decrypted according to symmetric key, it is quick after being decrypted Feel data.Finally, sensitive data and nonsensitive data can be combined into the number to be transmitted after decryption with data structure configuration information According to, etc..

It should be noted that the schematic diagram of a scenario of data transmission method shown in FIG. 1 is only an example, the present invention is real The scene for applying the data transmission method of example description is technical solution in order to more clearly illustrate the embodiment of the present invention, not structure In pairs in the restriction of technical solution provided in an embodiment of the present invention, those of ordinary skill in the art are it is found that with transmission side data The differentiation of method and the appearance of new business scene, technical solution provided in an embodiment of the present invention is for similar technical problem, equally It is applicable in.

It is described in detail separately below.

In the present embodiment, it will be described from the angle of data transmission device, which can specifically collect At in the equipment such as server or terminal.

A kind of data transmission method, comprising: obtain the data to be transmitted of transmission node on block chain, and determine number to be transmitted According to corresponding authorization node；Data to be transmitted is divided into sensitive data and nonsensitive data according to preset strategy；It generates sensitive The symmetric key of data, and sensitive data is encrypted according to symmetric key, obtain ciphertext data；Obtain the public affairs of authorization node Key, and symmetric key is encrypted according to the public key of authorization node, symmetric key after being encrypted；According to ciphertext data, add Symmetric key and nonsensitive data transmit data after generating encryption after close；Data will be transmitted after encryption to be transferred to and award by block chain Weigh node.

Referring to Fig. 2, Fig. 2 is the flow diagram for the data transmission method that one embodiment of the invention provides.The data pass Transmission method may include:

In step s101, the data to be transmitted of transmission node on block chain is obtained, and determines that data to be transmitted is corresponding Authorization node.

Wherein, transmission node is located on block chain, which is the server for needing to transmit data by block chain Or the equipment such as terminal, the transmission node can be data transmission device；Authorization node is located on block chain, which is to connect The equipment such as the server of data or terminal on block chain are received, which, which has permission, checks data to be transmitted.

Data transmission device can actively obtain data to be transmitted, ask alternatively, receiving the data acquisition that authorization node is sent It asks, and data to be transmitted is obtained based on data acquisition request, for example, data transmission device can be to be passed according to Transaction Information generation Transmission of data, or data to be transmitted etc. is obtained from the server of storing data, the data to be transmitted can be assets, account or The transaction data such as invoice, can also be the data of other types, and particular content is not construed as limiting here.

The corresponding authorization node of the data to be transmitted may include one or more, for example, if transmission node only licenses to Authorization node A checks data to be transmitted, then the corresponding authorization node of the data to be transmitted is only authorization node A；If transmission node It licenses to authorization node A, authorization node B and authorization node C and checks data to be transmitted, then the corresponding authorization section of the data to be transmitted Point is authorization node A, authorization node B and authorization node C.

In some embodiments, data transmission device obtains the data to be transmitted of transmission node on block chain, and determines The step of data to be transmitted corresponding authorization node may include: that data transmission device obtains the to be passed of transmission node on block chain Transmission of data, and data to be transmitted group is combined into multiple groups data to be transmitted；Determine the corresponding authorization node of every group of data to be transmitted.

Wherein, every group of data to be transmitted can be completely different, and there may also be partly or entirely the same data, numbers The data to be transmitted group that can be will acquire according to transmitting device is combined into multiple groups data to be transmitted, and determines every group of number to be transmitted respectively According to corresponding authorization node, for example, it is different types of to be transmitted data to be transmitted can be divided into multiple groups according to data content Data, or the data to be transmitted of multiple groups different field can be divided into according to digital section；Etc..

For example, data to be transmitted is an invoice data, the associated authorization node of data invoice business has the tax bureau, enterprise of making out an invoice Industry and consumer etc. transmit the transmission node of invoice data as reimbursement enterprise etc., it is desirable to which these authorization nodes are for a certain invoice Data possess the decrypted rights of different stage, and other nodes cannot be decrypted.At this point it is possible to which reimbursement enterprise is arranged according to the tax Each authorization nodes such as office, the business and consumer that makes out an invoice check permission, and invoice data is divided into three groups of data, first group of number It is the tax bureau according to corresponding authorization node, the corresponding authorization node of second group of data is enterprise of making out an invoice, and third group data are corresponding Authorization node is consumer.

In another example data to be transmitted includes the different types of data such as data a, data b and data c, need to pass data a It is defeated by authorization node A, data b is transferred to authorization node B, data c is transferred to authorization node C, it at this time can will be to be transmitted Data group is combined into the multiple groups data to be transmitted such as data a, data b and data c, data a, data b and the corresponding authorization node of data c Respectively authorization node A, authorization node B and authorization node C.

Data Identification can also be arranged in data transmission device for every group of data to be transmitted, and obtains each authorization node pair The capability identification answered, and establish the mapping relations between each Data Identification and each capability identification, so as to it is subsequent can basis The mapping relations search some certain corresponding authorization node of group data, alternatively, searching the corresponding data of some authorization node, example Such as, can be according to corresponding capability identification in the Data Identification inquiry mapping relations of certain group data, it can be true according to capability identification Fixed corresponding authorization node.

In step s 102, data to be transmitted is divided into sensitive data and nonsensitive data according to preset strategy.

Wherein, sensitive data can be the data with the right of privacy, and the authorization node only on block chain with permission can To check the sensitive data；Nonsensitive data be can disclosed data, all nodes can check that this is non-quick on block chain Feel data.Preset strategy can carry out flexible setting according to actual needs, for example, can be corresponding to be transmitted according to authorization node Data to be transmitted is divided into sensitive data and nonsensitive data, Huo Zhegen by significance level or privacy degrees of data content etc. Data to be transmitted is divided into sensitive data and nonsensitive data according to the demand of transmission node or authorization node.

In some embodiments, data to be transmitted is divided into sensitive data and nonsensitive data according to preset strategy Step may include: to obtain data structure configuration information, parse every group of data to be transmitted according to data structure configuration information；It is based on Every group of data to be transmitted is divided into sensitive data and nonsensitive data by parsing result and preset strategy.

Wherein, data structure configuration information may include field, each order of the field, packet header and the packet tail of composition data Deng when there are one group of data to be transmitted, the data to be transmitted can be parsed according to data structure configuration information, is obtained to be transmitted Each composed structure of data etc., and based on analysis result and preset strategy by every group of data to be transmitted be divided into sensitive data and Nonsensitive data.When there are multiple groups data to be transmitted, every group of data to be transmitted can be parsed according to data structure configuration information； Every group of data to be transmitted is divided into sensitive data and nonsensitive data with preset strategy based on analysis result.For example, can incite somebody to action Certain fields in data to be transmitted are set as sensitive data, set nonsensitive data for certain fields.For example, number to be transmitted According to for a certain transaction data, nonsensitive data can be set by the title of both parties in transaction data, it will be in transaction data The amount of money and mode of doing business etc. be set as sensitive data.

In step s 103, the symmetric key of sensitive data is generated, and sensitive data is encrypted according to symmetric key, Obtain ciphertext data.

Data transmission device can generate sensitive data in local random generation symmetric key, or according to preset algorithm Symmetric key etc., which can carry out flexible setting according to actual needs, for example, can pass through data encryption standards (Data Encryption Standard, DES), international data encryption algorithm (International Data Encryption Algorithm, IDEA) or block encryption algorithm (Fast Data Encipherment Algorithm, FEAL) etc. generate pair Claim key.

In some embodiments, the symmetric key of sensitive data is generated, and sensitive data is carried out according to symmetric key The step of encrypting, obtaining ciphertext data may include: to generate the corresponding symmetric key of every group of sensitive data according to preset algorithm, obtain To symmetric key set；Every group of sensitive data is encrypted respectively according to symmetric key set, obtains ciphertext data.

For example, data transmission device can be determined first according to the group number of sensitive data when sensitive data includes multiple groups The number of required symmetric key obtains then according to preset algorithm generation and every group of one-to-one symmetric key of sensitive data To symmetric key set, every group of sensitive data is added respectively further according to each of symmetric key set symmetric key It is close, obtain ciphertext data.

Either, data transmission device can generate the symmetric key of predetermined number at random (predetermined number is greater than or waits In the group number of sensitive data), the symmetric key of predetermined number is then respectively allocated to by every group of sensitivity according to each Data Identification Data respectively encrypt every group of sensitive data according to the symmetric key after distribution, obtain ciphertext data.

In step S104, the public key of authorization node is obtained, and add to symmetric key according to the public key of authorization node It is close, symmetric key after being encrypted.

Data transmission device can send public key acquisition request to authorization node, receive authorization node and asked based on public key acquisition The public key of return is sought, either, data transmission device can receive the data acquisition request of authorization node transmission, the data acquisition The public key that authorization node is carried in request is then based on data acquisition request and obtains data to be transmitted.In authorized node Public key after, symmetric key can be encrypted according to the public key of authorization node, symmetric key after being encrypted.

In some embodiments, obtain the public key of authorization node, and according to the public key of authorization node to symmetric key into Row encryption, the step of symmetric key may include: to send public key acquisition request to each authorization node after being encrypted；It receives every The public key that a authorization node is returned based on public key acquisition request；According to the public key of each authorization node respectively to each authorization node Corresponding symmetric key is encrypted, symmetric key after being encrypted.

When data to be transmitted is multiple groups and authorization node includes multiple, public key can be sent to each authorization node and obtained Request is taken, and receives the public key that each authorization node is returned based on public key acquisition request.Obtaining the public key of each authorization node Afterwards, the corresponding symmetric key of each authorization node can be encrypted respectively according to the public key of each authorization node, is added Symmetric key after close.For example, the mapping relations between capability identification and the key identification of every group of symmetric key can be preset, The capability identification for identifying authorization node can be carried in public key acquisition request, after the public key for obtaining each authorization node, It is symmetrical according to the mapping relations between capability identification and key identification, can to determine that the public key needs of each authorization node encrypt Key obtains the corresponding relationship between the public key of each authorization node and each symmetric key, can be closed at this time according to the correspondence Public key of the system based on each authorization node respectively encrypts each symmetric key, symmetric key after being encrypted.To real Show and encryption is grouped to data to be transmitted, can control different authorization nodes and possess different permissions.

In step s105, number is transmitted after generating encryption according to symmetric key after ciphertext data, encryption and nonsensitive data According to.

Wherein, it is transmitted after encryption in data including symmetric key and nonsensitive data etc. after ciphertext data, encryption.

In some embodiments, it is passed after generating encryption according to symmetric key after ciphertext data, encryption and nonsensitive data The step of transmission of data may include: to set clear text field for symmetric key after encryption and nonsensitive data, and by ciphertext number According to being set as ciphertext field；Data are transmitted after generating encryption according to clear text field and ciphertext field.

Being transmitted in data after encryption may include clear text field and ciphertext field, wherein clear text field is institute on block chain The field for having node that can check, symmetric key etc. after being encrypted in the field that can be checked if it exists, then it is right after encryption only to have checked Claim key, and can not check the content of symmetric key；Ciphertext field is that the authorization node on block chain with permission utilizes private key Deng the field that can check after decryption.Data transmission device can set plaintext word for symmetric key after encryption and nonsensitive data Section, which can also include other contents, and set ciphertext field for ciphertext data, which may be used also To include other contents, data are transmitted after then encrypting according to clear text field and the generations such as ciphertext field and/or other fields.

In some embodiments, the step of transmitting data after encrypting is generated according to clear text field and ciphertext field can wrap It includes: first identifier being set for clear text field, and second identifier is set for ciphertext field；It is raw according to first identifier and second identifier At data packet head；Data are transmitted after generating encryption according to data packet head, clear text field and ciphertext field.

Specifically, it distinguishes clear text field for convenience and ciphertext field transmits the position in data, Ke Yiwei after encryption First identifier is arranged in clear text field, and second identifier is arranged for ciphertext field, which is used for unique identification plaintext word Section, can be title or number of clear text field etc., which is used for unique identification ciphertext field, can be ciphertext field Title or number etc., the first identifier and second identifier can carry out flexible setting according to actual needs, and particular content is herein Place is not construed as limiting.Then first identifier and second identifier can be placed in the data packet head for transmitting data after encryption, i.e. root Data packet head is generated according to first identifier and second identifier, which can also include other content, at this time can be according to number Data are transmitted after generating encryption according to packet header, clear text field and ciphertext field.

In step s 106, data being transmitted after encryption, authorization node is transferred to by block chain.

After transmitting data after being encrypted, block chain can be uploaded to by data are transmitted after encryption, at this time authorization node Data are transmitted after encryption can be obtained from block chain.

After authorization node transmits data after being encrypted, can from after encryption transmit data in extract ciphertext data, Symmetric key and nonsensitive data etc. after encryption, for example, first can be extracted from the data packet head for transmitting data after encryption Mark and second identifier determine the clear text field transmitted in data after encrypting according to first identifier, and true according to second identifier Ciphertext field after fixed encryption in transmission data, symmetric key and nonsensitive data after extracting encryption in clear text field, from Ciphertext data are extracted in ciphertext field.Then, the private key in authorization node with public key match is obtained, after private key pair encryption Symmetric key is decrypted, and symmetric key is obtained, and ciphertext data are decrypted according to symmetric key, after being decrypted Sensitive data finally can generate the data to be transmitted after decryption according to sensitive data and nonsensitive data, for example, available Sensitive data and nonsensitive data are combined into the data structure configuration information of data to be transmitted, will according to data structure configuration information Sensitive data and nonsensitive data are combined into the data to be transmitted etc. after decryption.

It should be noted that can also include: the public affairs for obtaining transmission node during symmetric key after generating encryption Key, and symmetric key is encrypted according to the public key of transmission node, the encrypted secret key of transmission node is obtained, by ciphertext data Block chain is uploaded to the encrypted secret key of transmission node.It, can be from block when transmission node needs to read data to be transmitted The encrypted secret key that ciphertext data and transmission node are obtained on chain, obtains private key with public key match in transmission node, and according to The encrypted secret key is decrypted in the private key of transmission node, obtains symmetric key, at this time can be according to symmetric key to ciphertext Data are decrypted, and obtain being uploaded to the data to be transmitted before block chain.

It should be noted that transmission node can be used as authorization node during practical application, and execute authorization section The corresponding operation of point, authorization node can also be used as transmission node, and execute the corresponding operation of transmission node.

For example, transmission node can receive the object transmission data that authorization node is sent to transmission node by block chain, Symmetric key and target nonsensitive data after extracting target ciphertext data, target encryption in object transmission data, for example, from Third mark and the 4th mark are extracted in the data packet head of object transmission data；It is identified according to third and determines object transmission data In target clear text field, and according to the 4th identify determine object transmission data in target ciphertext field；In plain text from target Symmetric key and target nonsensitive data after target encrypts are extracted in field, extract target ciphertext from target ciphertext field Data.Then, the private key for obtaining transmission node is decrypted symmetric key after target encryption according to the private key of transmission node, Target symmetric key is obtained, and, target ciphertext data are decrypted according to target symmetric key, the target after being decrypted Sensitive data, at this point it is possible to according to data after target susceptibility data and the generation decryption of target nonsensitive data, for example, can obtain The data structure configuration information of data after taking target susceptibility data and target nonsensitive data to be combined into decryption, according to data structure Configuration information by target susceptibility data and target nonsensitive data be combined into decryption after data.

From the foregoing, it will be observed that on the available block chain of the embodiment of the present invention transmission node data to be transmitted, and determination it is to be passed The corresponding authorization node of transmission of data, is then divided into sensitive data and nonsensitive data for data to be transmitted according to preset strategy, And the symmetric key of sensitive data is generated, and encrypt to sensitive data according to symmetric key, ciphertext data are obtained, at this time The public key of available authorization node, and symmetric key is encrypted according to the public key of authorization node, it is symmetrical after being encrypted Secondly key generates transmission data according to symmetric key after ciphertext data, encryption and nonsensitive data, can will finally transmit number Authorization node is transferred to according to by block chain.It is realized in the program and the sensitive data transmitted by block chain is encrypted, Only authorization node is allowed to read Sensitive data content, rather than authorization node can not read Sensitive data content, to subtract The risk for having lacked sensitive data leakage improves the safety of data transmission.

A kind of data transmission method, comprising: transmit data after receiving the encryption that transmission node is sent by block chain；From adding Symmetric key and nonsensitive data after ciphertext data, encryption are extracted after close in transmission data, ciphertext data are to utilize transmission section The symmetric key that point generates is encrypted to obtain to the sensitive data in data to be transmitted, and symmetric key is to utilize authorization after encryption The public key of node is encrypted to obtain to symmetric key；Private key with public key match in authorization node is obtained, according to private key to adding Symmetric key is decrypted after close, obtains symmetric key；Ciphertext data are decrypted according to symmetric key, after being decrypted Sensitive data；The data to be transmitted after decryption is generated according to sensitive data and nonsensitive data.

Referring to Fig. 3, Fig. 3 is the flow diagram for the data transmission method that one embodiment of the invention provides.The data pass Transmission method may include:

In step s 201, data are transmitted after receiving the encryption that transmission node is sent by block chain.

Wherein, transmission node is located on block chain, which is the server for needing to transmit data by block chain Or the equipment such as terminal；Authorization node is located on block chain, which is the server or terminal for receiving data on block chain Etc. equipment, the authorization node transmit data after checking encryption by permission, which is data transmission device, data transmission Device transmits data after can receive the encryption that transmission node is sent by block chain.

In step S202, symmetric key and non-sensitive is extracted after ciphertext data, encryption in data from transmitting after encryption Data.

Since transmission data can be generated according to symmetric key after ciphertext data, encryption and nonsensitive data after encryption, because This, data transmission device can extract symmetric key and non-sensitive number after ciphertext data, encryption from transmitting after encryption in data According to.Wherein, ciphertext data are that the symmetric key generated using transmission node encrypts the sensitive data in data to be transmitted It obtains, symmetric key is to be encrypted to obtain to symmetric key using the public key of authorization node after encryption.

In some embodiments, symmetric key and non-is extracted after ciphertext data, encryption in data from transmitting after encryption The step of sensitive data may include: to extract first identifier and second identifier from the data packet head for transmitting data after encryption； The clear text field transmitted in data after encrypting is determined according to first identifier, and transmits data after determining encryption according to second identifier In ciphertext field；Symmetric key and nonsensitive data after extracting encryption in clear text field, extract from ciphertext field Ciphertext data.

Since transmission data may include data packet head, clear text field and ciphertext field etc. after encryption, which can To include symmetric key and nonsensitive data after encryption, which may include ciphertext data, which can set It is equipped with first identifier and second identifier has can be set in ciphertext field, the first identifier and second identifier can be set in adding The data packet head of transmission data after close, therefore, data transmission device can be extracted from the data packet head for transmitting data after encryption First identifier and second identifier out determine the clear text field transmitted in data after encrypting according to first identifier, and according to second The ciphertext field in data is transmitted after the determining encryption of mark.Wherein, which is used for unique identification clear text field, can be Title or number of clear text field etc., the second identifier be used for unique identification ciphertext field, can be ciphertext field title or Number etc., the first identifier and second identifier can carry out flexible setting according to actual needs, and particular content does not limit here It is fixed.At this time can from extracted in clear text field encryption after symmetric key and nonsensitive data, extracted from ciphertext field close Literary data.

In step S203, the private key in authorization node with public key match is obtained, according to symmetric key after private key pair encryption It is decrypted, obtains symmetric key.

Since symmetric key is that the symmetric key generated according to the public key of authorization node to transmission node adds after encryption It is close to obtain, thus in available authorization node with the private key of public key match, and according to the private key pair encryption of authorization node after Symmetric key is decrypted, and obtains symmetric key.

In step S204, ciphertext data are decrypted according to symmetric key, the sensitive data after being decrypted.

Since ciphertext data are to be encrypted using symmetric key to sensitive data, obtain it is symmetrical close After key, ciphertext data can be decrypted according to symmetric key, the sensitive data after being decrypted.

In step S205, the data to be transmitted after decryption is generated according to sensitive data and nonsensitive data.

Wherein, sensitive data is the data with the right of privacy, and the authorization node only on block chain with permission can be looked into See the sensitive data；Nonsensitive data be can disclosed data, all nodes can check the non-sensitive number on block chain According to.It, can be according to sensitive data and nonsensitive data since data to be transmitted includes sensitive data and nonsensitive data etc. Data to be transmitted after generating decryption.

In some embodiments, generating the step of transmitting data after decryption according to sensitive data and nonsensitive data can be with It include: the data structure configuration information that acquisition sensitive data and nonsensitive data are combined into data to be transmitted；According to data structure Sensitive data and nonsensitive data are combined into the data to be transmitted after decryption by configuration information.

Wherein, data structure configuration information may include field, each order of the field, packet header and the packet tail of composition data Deng, since sensitive data and nonsensitive data are divided according to data structure configuration information, it is available Data structure configuration information, and according to data structure configuration information by sensitive data and nonsensitive data be combined into decryption after to Transmit data.

From the foregoing, it will be observed that the embodiment of the present invention transmits data after can receive the encryption that transmission node is sent by block chain, And symmetric key and nonsensitive data after extracting ciphertext data, encryption after encryption in transmission data, then obtain authorization section It with the private key of public key match in point, is decrypted according to symmetric key after private key pair encryption, obtains symmetric key, and according to right Key pair ciphertext data are claimed to be decrypted, the sensitive data after being decrypted at this time can be according to sensitive data and non-sensitive number According to the data to be transmitted generated after decrypting.It is realized in the program and the sensitive data transmitted by block chain is decrypted, made Must only have authorization node can read Sensitive data content, rather than authorization node can not read Sensitive data content, to reduce The risk of sensitive data leakage, improves the safety of data transmission.

Citing, is described in further detail by the method according to described in above-described embodiment below.

The present embodiment transmits data and authorization node pair after sending encryption to authorization node by block chain with transmission node For transmission data are decrypted after the encryption received, wherein transmission node is located on block chain, which is to need It transmits equipment, the authorization nodes such as server or the terminal of data by block chain to be located on block chain, which is to receive The equipment such as the server of data or terminal on block chain.

Referring to Fig. 4, Fig. 4 is another flow diagram of data transmission method provided in an embodiment of the present invention.This method Process may include:

S301, transmission node obtain data to be transmitted, and determine the corresponding authorization node of data to be transmitted.

Transmission node can actively obtain data to be transmitted, alternatively, the data acquisition request that authorization node is sent is received, and Data to be transmitted is obtained based on data acquisition request, for example, transmission node can generate data to be transmitted according to Transaction Information, or Person obtains data to be transmitted etc. from the server of storing data, which can be the friendship such as assets, account or invoice Easy data, can also be the data of other types, and particular content is not construed as limiting here.

The corresponding authorization node of the data to be transmitted may include one or more, for example, as shown in figure 5, assets are in area During block chain circulates, data to be transmitted is an asset data, and role A can be used as transmission node, role B (and/or other Role) it can be used as authorization node, role A can be with issuing asset, and generates additional data (transmitting data after encrypting) transmission Role B is given, during additional data transmission, small change data or other assets circulations can also be added according to actual needs Data etc..Certainly, role B can also be used as transmission node, and role A can also be used as authorization node, and role B generates additional data And it is transferred to role A.When authorization node includes multiple, each role, can be with for a certain asset data as authorization node Possess the decrypted rights of different stage, the corresponding role of transmission node can check permission according to each authorization node, will be to Transmission data group is combined into multiple groups data to be transmitted, and determines the corresponding authorization node of every group of data to be transmitted.

Data to be transmitted is divided into sensitive data according to preset strategy and data structure configuration information by S302, transmission node And nonsensitive data.

Wherein, sensitive data is the data with the right of privacy, and the authorization node only on block chain with permission can be looked into See the sensitive data；Nonsensitive data be can disclosed data, all nodes can check the non-sensitive number on block chain According to.Preset strategy can carry out flexible setting according to actual needs, for example, can be according to the corresponding data to be transmitted of authorization node Data to be transmitted is divided into sensitive data and nonsensitive data by significance level or privacy degrees of content etc., or according to biography Data to be transmitted is divided into sensitive data and nonsensitive data by the demand of defeated node or authorization node.

For example, the available data structure configuration information of transmission node, parses to be transmitted according to data structure configuration information Every group of data to be transmitted is divided into sensitive data and nonsensitive data with preset strategy based on analysis result by data.Wherein, number It may include field, each order of the field, packet header and the packet tail etc. of composition data according to structure configuration information, for example, can incite somebody to action Certain fields in data to be transmitted are set as sensitive data, set nonsensitive data for certain fields.For example, number to be transmitted According to for a certain transaction data, nonsensitive data can be set by the title of both parties in transaction data, it will be in transaction data The amount of money and mode of doing business etc. be set as sensitive data.

S303, transmission node generate the symmetric key of sensitive data, and are encrypted according to symmetric key to sensitive data, Obtain ciphertext data.

Transmission node can generate the symmetrical of sensitive data in local random generation symmetric key, or according to preset algorithm Key etc., the preset algorithm can carry out flexible setting according to actual needs, then be carried out according to symmetric key to sensitive data Encryption, obtains ciphertext data.

S304, transmission node obtain the public key of authorization node, and are added according to the public key of authorization node to symmetric key It is close, symmetric key after being encrypted.

Transmission node can send public key acquisition request to authorization node, receive authorization node and returned based on public key acquisition request The public key returned, either, transmission node can receive the data acquisition request of authorization node transmission, take in the data acquisition request Public key with authorization node is then based on data acquisition request and obtains data to be transmitted.After the public key of authorized node, Symmetric key can be encrypted according to the public key of authorization node, symmetric key after being encrypted.

Symmetric key after encryption and nonsensitive data are set clear text field by S305, transmission node, and by ciphertext number According to ciphertext field is set as, data are transmitted after generating encryption according to clear text field and ciphertext field.

Being transmitted in data after encryption may include clear text field and ciphertext field, wherein clear text field is institute on block chain The field for having node that can check, symmetric key etc. after being encrypted in the field that can be checked if it exists, then it is right after encryption only to have checked Claim key, and can not check the content of symmetric key after encryption；Ciphertext field is the authorization node benefit on block chain with permission With the field that can be checked after the decryption such as private key.

Transmission node can set clear text field for symmetric key after encryption and nonsensitive data, which may be used also To include other contents, and by ciphertext data ciphertext field is set, which can also include other contents, Then data are transmitted after encrypting according to clear text field and the generations such as ciphertext field and/or other fields.In plain text in order to facilitate differentiation Field and ciphertext field transmit the position in data after encryption, first identifier can be arranged for clear text field, and be ciphertext Second identifier is arranged in field, which is used for unique identification clear text field, can be title or number of clear text field etc., The second identifier is used for unique identification ciphertext field, can be title or number of ciphertext field etc., the first identifier and second Mark can carry out flexible setting according to actual needs, and particular content is not construed as limiting here.Then according to first identifier and Two marks generate data packet head, which can also include other content；According to data packet head, clear text field and ciphertext word Data are transmitted after Duan Shengcheng encryption.

For example, each role is pre-generated respectively right as shown in figure 5, role A, B...., related to a certain assets The asymmetric public key and private key answered for example, can use rsa Encryption Algorithm generates corresponding public key and private key, or utilize ecc Encryption Algorithm generates corresponding public key and private key.When role A (i.e. transmission node) issuing asset, a symmetric key is generated at random Aes_key, for example, can use aes Encryption Algorithm or des Encryption Algorithm etc. generates symmetric key.Assets flow in block chain When turning, each transaction can have an additional data, which is that data are transmitted after encrypting, additional data a part It is ciphertext data, another part is clear data, for example, as shown in fig. 6, the public key encryption using each participation role is symmetrical Key aes_key, there are at the plaintext of additional data for obtained ciphertext data.Such as the public key A.rsa_ using role A Pubkey encrypted symmetric key aes_key, obtained ciphertext data are keyA=rsa_encryption (aes_key, A.rsa_ Pubkey), using the public key B.rsa_pubkey encrypted symmetric key aes_key of role B, obtained ciphertext data are keyB= Rsa_encryption (aes_key, B.rsa_pubkey), etc..Sensitive data in the transaction data of the assets then passes through Symmetric key aes_key carries out encrypting storing, and obtaining ciphertext data is aes_encryption (data, aes_key).Thus The role's (i.e. authorization node) having permission is realized, the data on block chain could be decrypted.The process of decryption is: each role can Symmetric key aes_key is obtained to use the private key of oneself to decrypt corresponding field, is then handed over using symmetric key aes_key decryption Sensitive data in easy data, and the transaction data cannot be decrypted without relative role (i.e. unauthorized node).Additionally, due to symmetrical Key aes_key is randomly generated, if be leaked, also only influences whether some assets on block chain, other assets not by It influences.By carrying out sectional encryption to transaction data, then it can control different role and possess different permissions.

S306, transmission node will transmit data and be transferred to authorization node by block chain after encryption.

S307, authorization node transmit data after receiving the encryption that transmission node is sent by block chain.

After transmission node transmits data after being encrypted, block chain can be uploaded to by data are transmitted after encryption, at this time Authorization node transmits data after can obtaining encryption from block chain.

S308, the authorization node symmetric key and non-sensitive after extracting encryption in the clear text field for transmitting data after encryption Data, and ciphertext data are extracted from the ciphertext field for transmitting data after encryption.

After authorization node transmits data after being encrypted, due to encryption after transmission data can according to ciphertext data, plus Symmetric key and nonsensitive data generate after close, and therefore, authorization node can extract ciphertext number from transmitting in data after encryption According to, encryption after symmetric key and nonsensitive data.

For example, transmission data may include data packet head, clear text field and ciphertext field etc. after encryption, which can To include symmetric key and nonsensitive data after encryption, which may include ciphertext data, which can set It is equipped with first identifier and second identifier has can be set in ciphertext field, the first identifier and second identifier can be set in adding The data packet head of transmission data after close, therefore, authorization node can extract the from the data packet head for transmitting data after encryption One mark and second identifier determine the clear text field transmitted in data after encrypting according to first identifier, and according to second identifier Determine the ciphertext field transmitted in data after encrypting.Wherein, which is used for unique identification clear text field, can be in plain text Title or number of field etc., the second identifier are used for unique identification ciphertext field, can be the title or number of ciphertext field Deng the first identifier and second identifier can carry out flexible setting according to actual needs, and particular content is not construed as limiting here.This When can from extracted in clear text field encryption after symmetric key and nonsensitive data, ciphertext number is extracted from ciphertext field According to.

S309, authorization node obtain the private key of public key match, are decrypted, are obtained according to symmetric key after private key pair encryption Symmetric key.

Since symmetric key is that the symmetric key generated according to the public key of authorization node to transmission node adds after encryption It is close to obtain, therefore private key in the available authorization node of authorization node with public key match, and according to the private key of authorization node Symmetric key after encryption is decrypted, symmetric key is obtained.

S310, authorization node are decrypted ciphertext data according to symmetric key, the sensitive data after being decrypted.

Since ciphertext data are to be encrypted using symmetric key to sensitive data, obtain it is symmetrical close After key, authorization node can be decrypted ciphertext data according to symmetric key, the sensitive data after being decrypted.

After sensitive data and nonsensitive data are combined into decryption according to data structure configuration information by S311, authorization node Data to be transmitted.

It, can be according to sensitive data and non-sensitive since data to be transmitted includes sensitive data and nonsensitive data etc. Data generate the data to be transmitted after decryption.For example, the available sensitive data of authorization node and nonsensitive data be combined into Transmit the data structure configuration information of data；Sensitive data and nonsensitive data are combined into solution according to data structure configuration information Data to be transmitted after close.Wherein, data structure configuration information may include the field of composition data, each order of the field, Packet header and packet tail etc., since sensitive data and nonsensitive data are divided according to data structure configuration information, because This, available data structure configuration information, and combined sensitive data and nonsensitive data according to data structure configuration information At the data to be transmitted after decryption, authorization node can read the data to be transmitted at this time.

Data to be transmitted can be divided into sensitive data and nonsensitive data by transmission node of the embodiment of the present invention, and be utilized Symmetric key encrypts sensitive data, obtains ciphertext data, and carry out to symmetric key using the public key of authorization node Encryption, symmetric key after being encrypted then will be according to the biography of symmetric key after ciphertext data, encryption and nonsensitive data generation Transmission of data is transferred to authorization node by block chain.At this point, authorization node can extract ciphertext from transmitting in data after encryption Symmetric key and nonsensitive data after data, encryption are decrypted using symmetric key after the private key pair encryption of authorization node, are obtained Ciphertext data are decrypted to symmetric key, and according to symmetric key, the sensitive data after being decrypted then can root The data to be transmitted after decryption is generated according to sensitive data and nonsensitive data.It is realized in the program to being transmitted by block chain Sensitive data is encrypted, and only authorization node is allowed to read Sensitive data content, rather than authorization node can not read it is quick Feel data content, to reduce the risk of sensitive data leakage, improves the safety of data transmission.And it realizes in area Light-weighted encryption and decryption technology in the service of block chain, and possess the attribute of rights management, point expanded as decentralization can be facilitated Grade rights management, and distributed encryption and decryption do not depend on the service of centralization deployment, will not become performance bottleneck, furthermore with non- Symmetric cryptosystem allows the related all information of encryption to circulate on block chain.

For convenient for better implementation data transmission method provided in an embodiment of the present invention, the embodiment of the present invention also provides one kind Device based on above-mentioned data transmission method.Wherein the meaning of noun is identical with above-mentioned data transmission method, and specific implementation is thin Section can be with reference to the explanation in embodiment of the method.

Referring to Fig. 7, Fig. 7 is the structural schematic diagram of data transmission device provided in an embodiment of the present invention, the wherein data Transmitting device may include acquiring unit 401, division unit 402, the first encryption unit 403, the second encryption unit 404, generate Unit 405 and transmission unit 406 etc..

Wherein, acquiring unit 401 for obtaining the data to be transmitted of transmission node on block chain, and determine number to be transmitted According to corresponding authorization node.

In some embodiments, acquiring unit 401 specifically can be used for: transmission node is to be transmitted on acquisition block chain Data, and data to be transmitted group is combined into multiple groups data to be transmitted；Determine the corresponding authorization node of every group of data to be transmitted.

Division unit 402, for data to be transmitted to be divided into sensitive data and nonsensitive data according to preset strategy.

In some embodiments, division unit 402 specifically can be used for: data structure configuration information be obtained, according to number Every group of data to be transmitted is parsed according to structure configuration information；Every group of data to be transmitted is divided into preset strategy based on analysis result Sensitive data and nonsensitive data.

First encryption unit 403, for generating the symmetric key of sensitive data, and according to symmetric key to sensitive data into Row encryption, obtains ciphertext data.

In some embodiments, the first encryption unit 403 specifically can be used for: generate every group of sensitivity according to preset algorithm The corresponding symmetric key of data, obtains symmetric key set；Every group of sensitive data is added respectively according to symmetric key set It is close, obtain ciphertext data.

Second encryption unit 404, for obtaining the public key of authorization node, and according to the public key of authorization node to symmetric key It is encrypted, symmetric key after being encrypted.

In some embodiments, the second encryption unit specifically can be used for: send public key acquisition to each authorization node Request；Receive the public key that each authorization node is returned based on public key acquisition request；Public key according to each authorization node is right respectively The corresponding symmetric key of each authorization node is encrypted, symmetric key after being encrypted.

Generation unit 405, for being transmitted after generating encryption according to symmetric key after ciphertext data, encryption and nonsensitive data Data.

In some embodiments, generation unit 405 may include: setting subelement, for symmetric key after encrypting It is set as clear text field with nonsensitive data, and sets ciphertext field for ciphertext data；Subelement is generated, for according to bright Text section and ciphertext field transmit data after generating encryption.

In some embodiments, generating subelement specifically can be used for: first identifier, Yi Jiwei is arranged for clear text field Second identifier is arranged in ciphertext field；Data packet head is generated according to first identifier and second identifier；According to data packet head, clear text field Data are transmitted after generating encryption with ciphertext field.

Transmission unit 406 is transferred to authorization node by block chain for transmitting data after encrypting.

From the foregoing, it will be observed that on the available block chain of acquiring unit of the embodiment of the present invention 401 transmission node data to be transmitted, And determine the corresponding authorization node of data to be transmitted, then data to be transmitted is divided by division unit 402 according to preset strategy Sensitive data and nonsensitive data and the first encryption unit 403 generate the symmetric key of sensitive data, and according to symmetric key Sensitive data is encrypted, ciphertext data are obtained, at this time the public key of the available authorization node of the second encryption unit 404, and Symmetric key is encrypted according to the public key of authorization node, symmetric key after being encrypted, secondly generation unit 405 is according to close Symmetric key and nonsensitive data generate transmission data after literary data, encryption, and last transmission unit 406 can lead to transmission data It crosses block chain and is transferred to authorization node.It is realized in the program and the sensitive data transmitted by block chain is encrypted, so that Only authorization node can read Sensitive data content, rather than authorization node can not read Sensitive data content, to reduce The risk of sensitive data leakage, improves the safety of data transmission.

Referring to Fig. 8, Fig. 8 is the structural schematic diagram of data transmission device provided in an embodiment of the present invention, the wherein data Transmitting device may include receiving unit 501, extraction unit 502, the first decryption unit 503, the second decryption unit 504 and data Generation unit 505 etc..

Receiving unit 501, for transmitting data after receiving the encryption that transmission node is sent by block chain.

Extraction unit 502, for symmetric key and Fei Min after extracting ciphertext data, encryption after encryption in transmission data Feel data.

Wherein, ciphertext data are that the symmetric key generated using transmission node carries out the sensitive data in data to be transmitted Encryption obtains, and symmetric key is to be encrypted to obtain to symmetric key using the public key of authorization node after encryption.

In some embodiments, extraction unit 502 specifically can be used for: from the data packet head for transmitting data after encryption Extract first identifier and second identifier；According to the clear text field transmitted after the determining encryption of first identifier in data, and according to The ciphertext field in data is transmitted after the determining encryption of second identifier；Symmetric key and Fei Min after extracting encryption in clear text field Feel data, ciphertext data are extracted from ciphertext field.

First decryption unit 503, for obtaining the private key in authorization node with public key match, according to right after private key pair encryption Claim key to be decrypted, obtains symmetric key.

Second decryption unit 504, for ciphertext data to be decrypted according to symmetric key, the sensitive number after being decrypted According to.

Data generating unit 505, for generating the data to be transmitted after decryption according to sensitive data and nonsensitive data.

In some embodiments, data generating unit 505 specifically can be used for: obtain sensitive data and nonsensitive data It is combined into the data structure configuration information of data to be transmitted；According to data structure configuration information by sensitive data and nonsensitive data Data to be transmitted after being combined into decryption.

From the foregoing, it will be observed that receiving unit of the embodiment of the present invention 501 can receive the encryption that transmission node is sent by block chain After transmit data, and by extraction unit 502 from transmitted after encryption ciphertext data, encryption are extracted in data after symmetric key and non- Sensitive data, then the first decryption unit 503 obtains the private key in authorization node with public key match, according to right after private key pair encryption Claim key to be decrypted, obtains symmetric key and the second decryption unit 504 and ciphertext data are solved according to symmetric key Close, the sensitive data after being decrypted, data generating unit 505 can generate solution according to sensitive data and nonsensitive data at this time Data to be transmitted after close.It is realized in the program and the sensitive data transmitted by block chain is decrypted, so that only awarding Power node can read Sensitive data content, rather than authorization node can not read Sensitive data content, to reduce sensitive number According to the risk of leakage, the safety of data transmission is improved.

The embodiment of the present invention also provides a kind of equipment, which can be the equipment such as server or terminal, which can be with It is transmission node either authorization node.As shown in figure 9, it illustrates the structures of server involved in the embodiment of the present invention to show It is intended to, specifically:

The server may include one or processor 601, one or more meters of more than one processing core The components such as memory 602, power supply 603 and the input unit 604 of calculation machine readable storage medium storing program for executing.Those skilled in the art can manage It solves, server architecture shown in Fig. 9 does not constitute the restriction to server, may include than illustrating more or fewer portions Part perhaps combines certain components or different component layouts.Wherein:

Processor 601 is the control centre of the server, utilizes each of various interfaces and the entire server of connection Part by running or execute the software program and/or module that are stored in memory 602, and calls and is stored in memory Data in 602, the various functions and processing data of execute server, to carry out integral monitoring to server.Optionally, locate Managing device 601 may include one or more processing cores；Preferably, processor 601 can integrate application processor and modulatedemodulate is mediated Manage device, wherein the main processing operation system of application processor, user interface and application program etc., modem processor is main Processing wireless communication.It is understood that above-mentioned modem processor can not also be integrated into processor 601.

Memory 602 can be used for storing software program and module, and processor 601 is stored in memory 602 by operation Software program and module, thereby executing various function application and data processing.Memory 602 can mainly include storage journey Sequence area and storage data area, wherein storing program area can the (ratio of application program needed for storage program area, at least one function Such as sound-playing function, image player function) etc.；Storage data area, which can be stored, uses created data according to server Deng.In addition, memory 602 may include high-speed random access memory, it can also include nonvolatile memory, for example, at least One disk memory, flush memory device or other volatile solid-state parts.Correspondingly, memory 602 can also include Memory Controller, to provide access of the processor 601 to memory 602.

Server further includes the power supply 603 powered to all parts, it is preferred that power supply 603 can pass through power management system It unites logically contiguous with processor 601, to realize the function such as management charging, electric discharge and power managed by power-supply management system Energy.Power supply 603 can also include one or more direct current or AC power source, recharging system, power failure monitor electricity The random components such as road, power adapter or inverter, power supply status indicator.

The server may also include input unit 604, which can be used for receiving the number or character letter of input Breath, and generation keyboard related with user setting and function control, mouse, operating stick, optics or trackball signal are defeated Enter.

Although being not shown, server can also be including display unit etc., and details are not described herein.Specifically in the present embodiment, Processor 601 in server can according to following instruction, by the process of one or more application program is corresponding can It executes file to be loaded into memory 602, and runs the application program of storage in the memory 602 by processor 601, thus Realize data transmission method provided in an embodiment of the present invention, as follows:

(1) when equipment is transmission node, processor 601 can run the application program of storage in the memory 602, from And realize various functions, it is as follows:

The data to be transmitted of transmission node on block chain is obtained, and determines the corresponding authorization node of data to be transmitted；According to Data to be transmitted is divided into sensitive data and nonsensitive data by preset strategy；The symmetric key of generation sensitive data, and according to Symmetric key encrypts sensitive data, obtains ciphertext data；The public key of authorization node is obtained, and according to the public affairs of authorization node Key encrypts symmetric key, symmetric key after being encrypted；According to symmetric key after ciphertext data, encryption and non-sensitive number Data are transmitted after encrypting according to generation；Authorization node is transferred to by block chain by data are transmitted after encryption.

(2) when equipment is authorization node, processor 601 can run the application program of storage in the memory 602, from And realize various functions, it is as follows:

Data are transmitted after receiving the encryption that transmission node is sent by block chain；It is close from being extracted in transmission data after encryption Symmetric key and nonsensitive data after literary data, encryption, ciphertext data are the symmetric key that is generated using transmission node to be passed Sensitive data in transmission of data is encrypted to obtain, after encryption symmetric key be using authorization node public key to symmetric key into Row encryption obtains；The private key in authorization node with public key match is obtained, is decrypted, is obtained according to symmetric key after private key pair encryption To symmetric key；Ciphertext data are decrypted according to symmetric key, the sensitive data after being decrypted；According to sensitive data and Nonsensitive data generates the data to be transmitted after decryption.

In the above-described embodiments, it all emphasizes particularly on different fields to the description of each embodiment, there is no the portion being described in detail in some embodiment Point, it may refer to the detailed description above with respect to data transmission method, details are not described herein again.

It will appreciated by the skilled person that all or part of the steps in the various methods of above-described embodiment can be with It is completed by instructing, or relevant hardware is controlled by instruction to complete, which can store computer-readable deposits in one In storage media, and is loaded and executed by processor.

For this purpose, the embodiment of the present invention provides a kind of storage medium, wherein being stored with a plurality of instruction, which can be processed Device is loaded, to execute the step in any data transmission method provided by the embodiment of the present invention.For example, the instruction can To execute following steps:

In another example the instruction can execute following steps:

The specific implementation of above each operation can be found in the embodiment of front, and details are not described herein.

Wherein, which may include: read-only memory (ROM, Read Only Memory), random access memory Body (RAM, Random Access Memory), disk or CD etc..

By the instruction stored in the storage medium, any data provided by the embodiment of the present invention can be executed and passed Step in transmission method, it is thereby achieved that achieved by any data transmission method provided by the embodiment of the present invention Beneficial effect is detailed in the embodiment of front, and details are not described herein.

It is provided for the embodiments of the invention a kind of data transmission method based on block chain, device and storage medium above It is described in detail, used herein a specific example illustrates the principle and implementation of the invention, the above reality The explanation for applying example is merely used to help understand method and its core concept of the invention；Meanwhile for those skilled in the art, According to the thought of the present invention, there will be changes in the specific implementation manner and application range, in conclusion in this specification Appearance should not be construed as limiting the invention.

Claims

1. a kind of data transmission method based on block chain characterized by comprising

The symmetric key of the sensitive data is generated, and the sensitive data is encrypted according to the symmetric key, is obtained Ciphertext data；

The public key of the authorization node is obtained, and the symmetric key is encrypted according to the public key of the authorization node, is obtained Symmetric key after to encryption；

2. data transmission method according to claim 1, which is characterized in that it is described according to the ciphertext data, encryption after The step of transmission data, includes: after symmetric key and nonsensitive data generation encryption

Clear text field is set by symmetric key after the encryption and nonsensitive data, and sets close for the ciphertext data Text section；

Data are transmitted after generating encryption according to the clear text field and ciphertext field.

3. data transmission method according to claim 2, which is characterized in that described according to the clear text field and ciphertext word The step of transmission data, includes: after Duan Shengcheng encryption

4. data transmission method according to any one of claims 1 to 3, which is characterized in that the acquisition block chain uploads The data to be transmitted of defeated node, and the step of determining the data to be transmitted corresponding authorization node includes:

The data to be transmitted of transmission node on block chain is obtained, and the data to be transmitted group is combined into multiple groups data to be transmitted；

5. data transmission method according to claim 4, which is characterized in that it is described will be described to be transmitted according to preset strategy Data are divided into the step of sensitive data and nonsensitive data and include:

6. a kind of data transmission device based on block chain characterized by comprising

Acquiring unit for obtaining the data to be transmitted of transmission node on block chain, and determines that the data to be transmitted is corresponding Authorization node；

First encryption unit, for generating the symmetric key of the sensitive data, and according to the symmetric key to the sensitivity Data are encrypted, and ciphertext data are obtained；

Second encryption unit, for obtaining the public key of the authorization node, and according to the public key of the authorization node to described right Key is claimed to be encrypted, symmetric key after being encrypted；

Generation unit, for transmitting number after generating encryption according to symmetric key after the ciphertext data, encryption and nonsensitive data According to；

7. a kind of data transmission method based on block chain characterized by comprising

Symmetric key and nonsensitive data after extracting ciphertext data, encryption after the encryption in transmission data, the ciphertext Data are to be encrypted to obtain to the sensitive data in data to be transmitted using the symmetric key that the transmission node generates, described Symmetric key is to be encrypted to obtain to the symmetric key using the public key of authorization node after encryption；

Obtain the private key in the authorization node with the public key match, according to the private key to symmetric key after the encryption into Row decryption, obtains symmetric key；

8. a kind of data transmission device based on block chain characterized by comprising

Extraction unit, for extracting after ciphertext data, encryption symmetric key and non-sensitive in data from transmitting after the encryption Data, the ciphertext data are that the symmetric key generated using the transmission node carries out the sensitive data in data to be transmitted Encryption obtains, and symmetric key is to be encrypted to obtain to the symmetric key using the public key of authorization node after the encryption；

First decryption unit, for obtaining the private key in the authorization node with the public key match, according to the private key to institute Symmetric key is decrypted after stating encryption, obtains symmetric key；

Second decryption unit, for the ciphertext data to be decrypted according to the symmetric key, the sensitivity after being decrypted Data；

Data generating unit, for generating the data to be transmitted after decryption according to the sensitive data and the nonsensitive data.

9. a kind of storage medium, which is characterized in that the storage medium is stored with a plurality of instruction, described instruction be suitable for processor into Row load requires step or perform claim in 1 to 5 described in any item data transmission methods to require 7 institutes with perform claim The step in data transmission method stated.

10. a kind of equipment, including memory and processor, which is characterized in that the memory is stored with computer program, described When computer program is executed by the processor, so that the processor executes the number as described in any one of claims 1 to 5 According to the step in data transmission method described in the step or perform claim requirement 7 in transmission method.