CN112235260B - Anonymous data storage method, device, equipment and storage medium - Google Patents
Anonymous data storage method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN112235260B CN112235260B CN202011027570.1A CN202011027570A CN112235260B CN 112235260 B CN112235260 B CN 112235260B CN 202011027570 A CN202011027570 A CN 202011027570A CN 112235260 B CN112235260 B CN 112235260B
- Authority
- CN
- China
- Prior art keywords
- data
- key
- holder
- anonymous
- ownership
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
- H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2471—Distributed queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Mathematical Physics (AREA)
- Probability & Statistics with Applications (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Fuzzy Systems (AREA)
- Storage Device Security (AREA)
Abstract
The embodiment of the application discloses an anonymous data storage method, an anonymous data storage device, anonymous data storage equipment and a storage medium. Responding to a data storage request of a data holder, and generating at least one key fragment and a holder identification ciphertext according to a holder identification; encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment; storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner; receiving a key fragment plaintext of at least one key manager in response to a data query request of a data querying party; generating a decryption key according to the key fragment plaintext; decrypting the holder identification ciphertext according to the decryption key to verify the data holder, ensuring the authenticity of each piece of anonymous data of the blockchain, ensuring that information in the anonymous data is not tamperable, and ensuring that the anonymous data has a way of identifying the data source.
Description
Technical Field
The embodiment of the application relates to the technical field of blockchains, in particular to an anonymous data storage method, device, equipment and storage medium.
Background
Blockchain technology, which has been moved into the general field of view by bitcoin, has been silently extended in recent years to numerous fields, and has developed a great potential for "blockchain +".
Blockchain products can be categorized into public chains, private chains, and federated chains. Public chain refers to blockchain that anyone can participate in after, is completely open-source, and is completely anonymous. The private chain means that the blockchain accounting authority is mastered by only a few members, the authority for participating in accounting is formulated by the inside of the institution, and the reading authority can be opened by the other side or can be limited to any extent. The alliance chain means that the authority of each node is completely equivalent, each node can realize the trusted exchange of data without complete mutual trust, each node of the alliance chain is generally organized by the entity organization corresponding to the node, and the nodes can join or exit the network after being authorized.
The existing public chains are not concerned with or encourage data anonymity, the typical representative is cryptocurrency, and the alliance chains are often based on mutual trust among alliance members, and have insufficient capability of supervising and managing the alliance members.
Disclosure of Invention
The application provides an anonymous data certification method, device, equipment and storage medium, so that each piece of anonymous data on a blockchain can be identified by a way.
In a first aspect, an embodiment of the present application provides an anonymous data storage method applied to a blockchain node, including:
responding to a data storage request of a data holder, and generating at least one key fragment and a holder identification ciphertext according to a holder identification;
encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment;
and storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner.
In a second aspect, embodiments of the present application further provide an anonymous data verification method applied to a blockchain node, including:
receiving a key fragment plaintext of at least one key manager in response to a data query request of a data querying party;
generating a decryption key according to the key fragment plaintext;
decrypting the holder identification ciphertext according to the decryption key to verify the data holder.
In a third aspect, embodiments of the present application further provide an anonymous data storage device configured at a blockchain node, including:
the key fragment generation module is used for responding to a data storage request of a data holder and generating at least one key fragment and a holder identification ciphertext according to the holder identification;
the key fragment ciphertext obtaining module is used for encrypting each key fragment through the key information of at least one key management party to obtain the key fragment ciphertext associated with each key fragment;
and the storage module is used for storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner.
In a fourth aspect, an embodiment of the present application further provides an anonymous data verification device configured at a blockchain node, including:
the key slicing plaintext obtaining module is used for responding to a data query request of a data query party and receiving the key slicing plaintext of at least one key management party;
the decryption key generation module is used for generating a decryption key according to the key fragment plaintext;
and the verification module is used for decrypting the holder identification ciphertext according to the decryption key so as to verify the data holder.
In a fifth aspect, embodiments of the present application further provide an electronic device, including:
one or more processors;
a memory for storing one or more programs;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement an anonymous data storage method as provided in the first aspect of the present application and/or an anonymous data verification method as provided in the second aspect.
In a sixth aspect, embodiments of the present application also provide a computer readable storage medium having stored thereon a computer program which when executed by a processor implements an anonymous data storage method as provided in the first aspect of the present application and/or an anonymous data verification method as provided in the second aspect.
Generating at least one key fragment and a holder identification ciphertext according to a holder identification by responding to a data storage request of a data holder; encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment; storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner; receiving a key fragment plaintext of at least one key manager by responding to a data query request of a data querying party; generating a decryption key according to the key fragment plaintext; decrypting the holder identification ciphertext according to the decryption key to verify the data holder; the technical scheme ensures the authenticity of each piece of anonymous data of the blockchain, the anonymous data cannot impersonate real-name data, the information in the anonymous data cannot be tampered, the anonymous data can be identified by a way to the source of the data, and the authority management for distinguishing the owner of the anonymous data is realized.
Drawings
FIG. 1 is a flow chart of a method of anonymous data storage in accordance with a first embodiment of the present application;
FIG. 2 is a flow chart of a method of anonymous data verification in a second embodiment of the present application;
FIG. 3A is a flow chart of a new member registration of a blockchain in a third embodiment of the present application;
FIG. 3B is a flow chart of a method of anonymous data storage in accordance with a third embodiment of the present application;
FIG. 3C is a flow chart of a method of anonymous data verification in a third embodiment of the present application;
FIG. 3D is a flow chart of a method of anonymous data verification in accordance with a third embodiment of the present application;
FIG. 3E is a flow chart of a method of anonymous data verification in a third embodiment of the present application;
FIG. 3F is a flow chart of a method of anonymous data verification in a third embodiment of the present application;
FIG. 4 is a schematic diagram of an anonymous data storage device according to a fourth embodiment of the present application;
fig. 5 is a schematic structural diagram of an anonymous data verification device in a fifth embodiment of the present application;
fig. 6 is a structural diagram of an electronic device in a sixth embodiment of the present application.
Detailed Description
The present application is described in further detail below with reference to the drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the application and not limiting thereof. It should be further noted that, for convenience of description, only some, but not all of the structures related to the present application are shown in the drawings.
Example 1
Fig. 1 is a flowchart of an anonymous data storage method according to an embodiment of the present application, where the method is applicable to a scenario in which a blockchain stores and verifies anonymous data, and may be performed by an anonymous data storage device, where the device is implemented by software and/or hardware, and is specifically configured in an electronic device, where the electronic device may be a computing device carrying blockchain nodes.
The anonymous data storage method as shown in fig. 1 is applied to a blockchain node and comprises the following steps:
s110, responding to a data storage request of a data holder, and generating at least one key fragment and a holder identification ciphertext according to the holder identification.
Wherein the data holder may be the holder of anonymous data; the holder identification is used for uniquely characterizing an anonymous data holder and can be information such as a member number, wherein the member number is a unique identification which is distributed to an application member by a blockchain manager when the application member registers and is formed by numbers and used as the member; the key fragments are used as a part of the keys, so that decryption of anonymous data can be realized in an auxiliary way, for example, decryption key back calculation is carried out through a set number of key fragments, and then corresponding encrypted data is decrypted through the decryption keys.
The data storage request may include data to be stored and/or a data identifier to be stored. The to-be-stored data identifier may be a storage address of the to-be-stored data outside the blockchain, or may also be a data digest obtained by hash calculation of the to-be-stored data.
When the data holder has the data storage requirement, sending a data storage request to a member node in the blockchain network; correspondingly, a member node in the blockchain network responds to a data storage request of an anonymous data holder, reads a certificate, acquires a holder identifier of the data holder, and runs an encryption algorithm according to the holder identifier to generate at least one key fragment and holder identifier ciphertext. The certificate contains a member number and is bound with a private key. The key sharding is used for decrypting the holder identification ciphertext and is managed by the alliance committee member.
The member node in the blockchain network is a member node in the blockchain network only after the member is applied to be successfully registered in the blockchain network. Specifically, the application member initiates a registration request to the blockchain manager, wherein the registration request includes basic information of the application member, and the basic information can be an asset size, a computing power, a storage capacity and the like of the application member, so that the blockchain manager can judge whether the application member is qualified and can join the blockchain. Correspondingly, the blockchain manager receives the basic information of the application member to judge, and if the application member can be added, a member number is allocated to the application member and used as the unique identifier of the member. A blockchain manager initiates a voting request to a coalition committee in a blockchain network; accordingly, the alliance committee member decides whether to apply for members to join the blockchain in response to the voting request, and sends the voting result to the blockchain manager. The blockchain manager receives the voting results of the alliance committee members, and when the voting results of a set number of the alliance committee members are received, the blockchain manager indicates that the application members have the qualification of joining the blockchain, at the moment, the blockchain manager adds the names and the member numbers of the application members into a member list, and indicates that the application members can join the blockchain network. Thus, the application member becomes a member node in the blockchain network.
Optionally, when the data holder has a data storage requirement, sending a data storage request to a member node in the blockchain network; correspondingly, a member node in the blockchain network responds to a data storage request of an anonymous data holder, reads a certificate and acquires a member number of the data holder; and encrypting the member numbers by using a threshold encryption algorithm through a secure storage key to obtain encrypted member numbers, namely the holder ciphertext and a plurality of key fragments. The key sharding is used for decrypting the encrypted member numbers and is managed by the alliance committee members. For example, 5 key fragments are generated, each of which is managed by 5 federation committee members, and when the encrypted member numbers are subsequently decrypted, a certain number of key fragments need to be acquired to decrypt. If the key fragments of the 3 alliance committee members are collected subsequently, decrypting by adopting the private keys of the alliance committee members to obtain 3 decrypted key fragments, namely key fragment plaintext, splicing the key fragment plaintext into a complete key, and decrypting the encrypted member numbers to obtain member number plaintext.
The certificate is a certificate generated by signing by a blockchain manager by using the public key of the blockchain manager according to the application information of the application member, and is also called an admission certificate, wherein the application information comprises a member name, a member number, the public key and other information. If the application member has the certificate, indicating that the application member is authorized to enter the blockchain network, and sending the certificate to the application member; accordingly, the application member needs to register on the blockchain website after receiving the certificate. The member name is named by the member with the application, and the public key is a public key in a public-private key pair generated by the member with the application, and can be used as an address of the member with the application to access the blockchain network. The certificate comprises a blockchain manager signature, and the certificate and the private key are in binding relation. After receiving the certificate, the application member initiates a query address registration transaction to the blockchain website, if the query address is registered, the request initiated by the subsequent application member can be responded by the member in the blockchain network, and if the query address is not registered, the member in the blockchain network can not respond to the request.
Alternatively, the secure storage key may be a variable length random key; to facilitate the determination of the number of decryption layers in the subsequent decryption, a secure storage key length table needs to be established, from which a specific value of the length of the random key is obtained. Alternatively, the secure storage key may be a fixed-length random key, which may be used to determine the number of layers that need to be decrypted during subsequent decryption.
It can be appreciated that by encrypting the holder identification with the secure storage key, it is ensured that the data record can only be anonymized once in each time without affecting other data records, and a reliable credential is provided for the verification of the blockchain.
And S120, encrypting each key fragment through the key information of at least one key management party to obtain the key fragment ciphertext associated with each key fragment.
Wherein, the key manager can be a member of the alliance committee that manages the key shards; the key information may be a public key of a federation committee member.
And encrypting the key fragments by member nodes in the blockchain network through public keys of members of the alliance committee to obtain encrypted key fragments, namely key fragment ciphertexts associated with each key fragment.
S130, storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner.
The anonymous data digest is information obtained by encrypting anonymous data to be uploaded. And encrypting the anonymous data to be uploaded by member nodes in the blockchain network by using a private key of a blockchain manager to obtain an anonymous data abstract.
And signing the key fragment ciphertext, the holder identification ciphertext and the anonymous data digest by member nodes in the blockchain network by using a private key of a blockchain manager, and storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data digest in an uplink.
According to the technical scheme of the embodiment, at least one key fragment and a holder identification ciphertext are generated according to the holder identification by responding to a data storage request of a data holder; encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment; and storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner. The technical method ensures the authenticity of each piece of anonymous data of the blockchain, the anonymous data cannot impersonate real-name data, the information in the anonymous data cannot be tampered, the anonymous data can be identified by a way to the source of the data, and the authority management for distinguishing the owner of the anonymous data is realized.
Based on the above technical solutions, before the key fragment ciphertext, the holder identification ciphertext, and the anonymous data digest are stored in the uplink, the method further includes:
signing the anonymous data abstract according to an external ownership key to obtain an external ownership identifier; and associating the external rights identification with the anonymous data abstract, and storing the anonymous data abstract in a uplink manner.
The external right secret key can be a random secret key of a certain held data record disclosed by a member node in the holding direction blockchain network of the anonymous data; the external ownership identifier may be an ownership identifier, which is used to characterize ownership of a piece of anonymous data by the data holder, so that the member node can verify ownership of the corresponding data.
The data provider has detail data, performs hash calculation on the detail data to obtain an anonymous data abstract, signs the anonymous data abstract by using an external ownership key of the data holder to obtain an external ownership identifier, associates the external ownership identifier with the anonymous data abstract, and stores the external ownership identifier and the anonymous data abstract on a blockchain.
It will be appreciated that the introduction of an external ownership key for a particular piece of data provides verification of ownership of that particular piece of data on the blockchain without exposing ownership information for other data.
Based on the above technical solutions, before the generating at least one key fragment and the holder identification ciphertext according to the holder identification in response to the data storage request of the data holder, the method further includes:
verifying the validity of the certificate of the initiator of the data storage request according to the account key of the blockchain management node, and/or verifying the validity of the configuration file acquired on the chain; wherein, the configuration file comprises key information of each key manager; and if the verification is passed, executing a response operation of the data storage request of the data holder.
Optionally, other members in the blockchain network perform validity verification on the certificate of the initiator of the data storage request according to the account key of the blockchain management node, and/or perform validity verification on the configuration file acquired on the chain; the configuration file includes key information of each key manager, which may be a public key of a blockchain manager. Specifically, the blockchain manager signs the certificate according to the private key of the blockchain manager; other members in the blockchain network acquire the public key of the blockchain manager, determine the authenticity of the blockchain manager signature according to the public key of the blockchain manager, if the signature is correct, indicate that the certificate is legal, namely pass the verification, and execute the response operation of the data storage request of the data holder; if the signature is wrong, the certificate is illegal, namely the verification is not passed, and the response operation of the data storage request of the data holder is forbidden.
It can be understood that the authenticity of the data requesting party is ensured through the validity verification of the certificate and the configuration file, the attack of illegal members is avoided, and the safety of the blockchain is improved.
Based on the technical schemes, the method further comprises the following steps:
receiving an in-pair rights key of a data provider; and storing the pair of the in-right genus keys in a uplink mode in association with the anonymous data digest.
The internal right secret key is used for verifying whether anonymous data on the blockchain belongs to the data holder. Optionally, a fixed key is used to sign the anonymous data digest by an encryption algorithm to obtain an internal rights key; optionally, a non-fixed key may be used to sign the anonymous data digest by an encryption algorithm to obtain the rights-to-interior key. The data holder receives the in-pair equity key of the data provider, associates the in-pair equity key with the anonymous data, and stores in a profile of the data provider on the chain.
It should be noted that the encryption algorithm may be a symmetric encryption algorithm, such as an advanced encryption standard (Advanced Encryption Standard, AES) algorithm, or may be an asymmetric encryption algorithm, such as an elliptic curve encryption algorithm.
It can be appreciated that by introducing the in-right ownership key, a higher execution efficiency of subsequent verification of the ownership of anonymous data is ensured.
Example two
Fig. 2 is a flowchart of an anonymous data verification method provided in a second embodiment of the present application, where the method is applicable to a scenario in which a blockchain stores and verifies anonymous data, and the method may be performed by an anonymous data verification device, where the device is implemented by software and/or hardware, and is specifically configured in an electronic device, where the electronic device may be a computing device carrying a blockchain node.
The anonymous data verification method as shown in fig. 2 is applied to a blockchain node, and comprises the following steps:
s210, receiving a key fragment plaintext of at least one key manager in response to a data query request of a data querying party.
The data inquiry request can be a reverse anonymity transaction request of one data record initiated by the data inquirer, or can be an inquiry request of the data inquirer for one data record on the chain. The key manager may be a coalition committee member on the blockchain that owns the key shards; the key fragment plaintext refers to the decrypted key fragment.
The alliance committee responds to the data query request of the data querying party; if the member of the alliance committee needs to decrypt, decrypting the key fragments belonging to the member of the alliance committee by using the private key of the member of the alliance committee, and transmitting the decrypted key fragments, namely the key fragment plaintext, to a data inquiring party; accordingly, the data inquirer receives the key fragment plaintext of at least one coalition committee member.
S220, generating a decryption key according to the key fragment plaintext.
Optionally, if the number of the received key fragment plaintext is greater than a set threshold value, the decryption key is generated according to the key fragment plaintext. The set threshold value can be obtained according to the needs or experience of the person skilled in the art.
If the number of the received key fragment plaintext is larger than the set threshold value, the data inquiring party uses the key fragment plaintext to run a decryption algorithm to decrypt the holder identification ciphertext, and a decryption key of the holder identification ciphertext is obtained. The set threshold value can be obtained according to the needs or experience of the person skilled in the art.
S230, decrypting the holder identification ciphertext according to the decryption key so as to verify the data holder.
And the data inquiring party decrypts the holder identification ciphertext according to the decryption key so as to verify the data holder. The holder identifier is used for uniquely characterizing the anonymous data holder and can be information such as member numbers; the key fragment may be used to decrypt the holder identification ciphertext.
An optional way to decrypt the holder identification ciphertext according to the decryption key to authenticate the data holder may be: decrypting the holder identification ciphertext according to the decryption key to obtain a holder identification; the holder identification is looked up in the member list of the blockchain to verify the data holder.
When the application member is to be added into the blockchain for registration, the blockchain manager divides a unique member number for the application member, and the blockchain manager initiates a vote on the chain, and after the votes of the alliance committee on the blockchain pass, the blockchain manager writes the application member number into the member list.
Specifically, the data inquiring party decrypts the holder identification ciphertext according to the decryption key to obtain the holder identification, searches the holder identification in the member list of the blockchain, and if so, indicates that the holder of the anonymous data is found; if not, this data is interpreted as counterfeit or erroneous.
According to the technical scheme, a key fragment plaintext of at least one key manager is received by responding to a data query request of a data query party; generating a decryption key according to the key fragment plaintext; decrypting the holder identification ciphertext according to the decryption key to verify the data holder, ensuring the authenticity of each piece of anonymous data of the blockchain, ensuring that the anonymous data cannot impersonate real-name data, ensuring that information in the anonymous data cannot be tampered, ensuring that the anonymous data can identify the source of the data in a way, and realizing authority management for distinguishing the owner of the anonymous data.
An alternative way of authenticating the data holder on the basis of the above embodiments may be: acquiring an anonymous data abstract and an external ownership identifier on a chain; signing the anonymous data abstract according to an external rights key provided by a data holder to obtain a reference identifier; and verifying the ownership of the anonymous data by the data holder according to the reference identifier and the external ownership identifier.
The external ownership identifier can be an ownership identifier, which is used for representing ownership of a certain piece of anonymous data by a data holder; the external rights key can be a random key which can be used by the holder of anonymous data to hold a certain data record for the holder disclosed by other members; the signature can be the feature extraction of certain data or the encryption of the data by a private key; the reference identifier may be a feature obtained by extracting certain data, or may be a result obtained by encrypting the data.
Illustratively, the data holder obtains an anonymous data digest on the chain and an external ownership identification of the data holder on the chain; the data providing direction shows the external right secret key held by the member in the blockchain network; correspondingly, the data holder signs the anonymous data abstract according to the external rights key provided by the data holder to obtain a reference identifier; if the obtained reference identifier is the same as the external ownership identifier of the data holder on the chain, writing the holder identifier of the data holder into a blockchain member list, and changing anonymous data into real-name data to prove that the ownership of the anonymous data by the data holder is true; if the obtained reference identifier is different from the external right identifier of the data holder on the chain, the ownership of the anonymous data by the data holder cannot be proved.
It can be understood that the ownership verification of the anonymous data by the data holder is performed by the obtained reference identifier and the external ownership identifier, so that the data holder can publicly generate the external ownership key of the external ownership identifier and prove the ownership of the anonymous data to other blockchain members, thereby realizing the conversion from the anonymous data to real name data, introducing the external ownership key to a specific piece of data, and providing the verification of the ownership of the specific piece of data on the blockchain without exposing the ownership of other data.
Each black list data record on the blockchain does not store details of the black list information, but has detail data of anonymous data generated based on the details. The requesting party can request the data record on the chain, and needs to verify whether the data obtained by the requesting party is from the holder of the data record on the chain, for example, the user A obtains the data of the user B from the blockchain, the user A sends the data to the blockchain whole network, inquires about who the data belongs to, the user C tells the user A that the user C is the user C, and the user A needs to judge whether the user C and the user B are the same user.
Thus, another alternative way of verifying the data holder may be: transmitting an owner verification request of target anonymous data to a blockchain network, and receiving detail data of the target anonymous data fed back by a data provider; carrying out hash calculation on detail data of the target anonymous data to obtain a reference abstract; and verifying the authenticity of the holder according to the reference abstract and the anonymous data abstract of the target anonymous data acquired from the chain.
The owner verification request of the target anonymous data can be a request for inquiring one data record on a chain through broadcasting; the detail data of the target anonymous data may be detail information of the anonymous data.
Optionally, the request in the blockchain network sends an owner verification request of the target anonymous data to the blockchain network; the provider in the blockchain network judges whether the provider is a request for the owner of the anonymous data of the provider, if so, the detail data of the target anonymous data is sent to the requester in the blockchain network; accordingly, a requestor in a blockchain network receives detail data of target anonymous data of a data provider. A requester in a block chain network runs a specific hash algorithm, performs hash calculation on detail data of target anonymous data to obtain a reference abstract, wherein the specific hash algorithm is the same as that when the anonymous data abstract is obtained; and verifying the authenticity of the holder according to the reference abstract and the anonymous data abstract of the anonymous data acquired from the blockchain, if the reference abstract is matched with the anonymous data abstract of the anonymous data acquired from the blockchain, the holder of the anonymous data is true, and if the reference abstract is not matched with the anonymous data abstract of the anonymous data acquired from the blockchain, the detail data of the target anonymous data fed back by the received data provider is forged or wrong, and further the process is started.
The declaration process may be a process in which members of the blockchain network challenge the data quality, propose the blockchain alliance committee, and the blockchain alliance committee arbitrates the data quality.
It can be understood that the holder of the target anonymous data is verified through the reference abstract obtained through calculation, so that the authenticity of the received data can be verified by the requester on the premise of anonymity of the data provider.
After responding to the request of the data requesting party, the requesting party, i.e. the data provider, needs to determine whether the target anonymous data on the chain belongs to itself or not, as in the above example, the data is to be proved to belong to itself by C.
Thus, another alternative way of authenticating the data holder may be: responding to an owner verification request of a data verifier for target anonymous data, and acquiring an anonymous data abstract of the target anonymous data in a chain; and searching a local database according to the anonymous data abstract of the target anonymous data so as to verify the ownership of the target anonymous data.
A data responder in the blockchain network responds to an owner verification request of a data verifier for the target anonymous data, and acquires an anonymous data summary of the target anonymous data from the blockchain; and searching a local database according to the anonymous data abstract to verify the ownership of the target anonymous data.
Optionally, the data respondent in the blockchain network responds to the owner verification request of the data verifier for the target anonymous data, and acquires an anonymous data digest of the target anonymous data from the blockchain; encrypting the anonymous data abstract of the target anonymous data according to the internal right secret key to obtain a data searching identifier; and searching a local database according to the data searching identification so as to verify the ownership of the target anonymous data.
The internal right secret key is used for verifying whether anonymous data on the blockchain belong to the data holder. Optionally, a fixed key is used to sign the anonymous data digest by an encryption algorithm to obtain an internal rights key; optionally, a non-fixed key may be used to sign the anonymous data digest by an encryption algorithm to obtain the rights-to-interior key. The encryption algorithm may be a symmetric encryption algorithm, such as an AES algorithm, or an asymmetric encryption algorithm, such as an elliptic curve encryption algorithm.
It should be noted that the in-pair rights key may be obtained from the local keystore as the in-pair rights key. The local keystore refers to a key set owned by a member node on the blockchain.
Illustratively, a data responder in the blockchain network responds to an owner verification request of the data verifier for the target anonymous data and obtains an anonymous data digest of the target anonymous data from the blockchain; operating a designated encryption algorithm, and encrypting the target anonymous data abstract by using the internal right secret key to obtain a data searching identifier; according to the data searching identification, searching in a local database, if the data searching identification is in the local database, the target anonymous data is indicated to belong to the target anonymous data, and if the data searching identification is not in the local database, the anonymous data is indicated to not belong to the target anonymous data.
By introducing the internal rights key, the self ownership of the target anonymous book is verified, so that the blockchain member can efficiently judge whether the data on the blockchain belongs to the self so as to respond.
Example III
On the basis of the above examples, a preferred embodiment is provided. Fig. 3A is a flowchart of a new member registration of a blockchain provided in the third embodiment of the present application.
A flow chart of blockchain new member registration as shown in fig. 3A, comprising:
s310, registration is started;
s311, the application member sends out an application to the blockchain manager;
S312, the block chain manager allocates a member number for the application member and initiates a vote on the chain whether to allow the application member to join;
s313, voting by alliance committee members on the blockchain;
s314, the block chain manager receives the voting result of the alliance committee member, judges whether the voting is passed or not, if not, executes S315, and if so, executes S316.
S315, registration fails, and S319 is executed.
S316, successful registration;
s317, the blockchain manager writes the name, the number of the member, the public key and other information into the certificate, and sends the certificate to the application member;
other information may be, among other things, the asset size, computing power, storage capacity, etc. of the application member.
S318, the application member uses the certificate to verify through the authentication module, and registers the inquiry address on the chain;
the authentication module is common to each member in the blockchain network and is used for verifying the validity of the certificate and the configuration file.
S319, finishing registration.
Through the registration of the federation, the newly joined member obtains a certificate from the blockchain administrator that can operate on the chain while binding its identity with the certificate. Wherein the identity may be a holder identity, a private key, etc.
After the member registration is applied successfully, transaction needs to be carried out, and anonymous data is uploaded to the blockchain. The blockchain only receives the information that the signature can pass through, namely the transaction, the transaction to be registered in the blockchain must pass through an authentication module, wherein the signature verification is to verify the signature and check the validity. FIG. 3B presents a flow chart of an anonymous data storage method, comprising:
s320, starting uploading;
s321, the authentication module checks whether the certificate and the configuration file are legal, if yes, S322 is executed, and if not, S323 is executed;
the configuration file comprises information such as key information of a key manager.
S322, the verification fails, and S328 is executed.
S323, the authentication module reads the certificate information and the configuration file to obtain a member number;
s324, running a threshold encryption algorithm, encrypting the member numbers to obtain a plurality of decryption key fragments, and encrypting the key fragments by using the public keys of the alliance committee members in the configuration file to obtain key fragment ciphertexts;
s325, information to be uploaded, the encrypted member number, the key fragment ciphertext and other information are assembled, and the private key of a blockchain manager is used for signing to obtain message information;
S326, the message information is sent to a chain;
s327, verifying the validity of the message information by each node on the block chain, verifying by using a public key matched with the authentication module disclosed by a block chain manager, judging whether the message information passes the verification, if so, executing S322, and if not, executing S328;
s328, the message is registered to the chain, and the uploading process ends.
Through the flow, the member numbers in each piece of data uploaded to the blockchain can be guaranteed to represent real members, anonymous data cannot impersonate real-name data, and meanwhile, mark information hidden in the anonymous data cannot be tampered. Under this premise, the verification of anonymous data may include at least one of the following verification scenarios:
illustratively, the verification scenario may be used for the blockchain federation committee to force decryption of anonymous data, as shown in the flowchart of fig. 3C, a method of anonymous data verification, comprising:
s330, the inquirer initiates a reverse anonymity transaction for one data record;
s331, the alliance committee members respectively determine whether decryption is required, if yes, S332 is executed, and if not, S336 is executed.
S332, decrypting the key fragment ciphertext belonging to the member of the alliance committee agreeing to decrypt to obtain a key fragment plaintext, and registering the key fragment plaintext on a chain;
S333, collecting a key fragment plaintext, if the key fragment plaintext reaches a set threshold value, executing S335 if the key fragment plaintext reaches the set threshold value, and executing S334 if the key fragment plaintext does not reach the set threshold value;
the node for collecting the key slice plaintext may be a blockchain manager node or a conventional blockchain member node.
S334, whether the selection is finished or not, if yes, executing S336; otherwise, execution returns to S333.
S335, running a decryption algorithm to obtain a complete decryption key before slicing, decrypting the encrypted member numbers by using the decryption key, and comparing the member lists to obtain anonymous data provider information;
s336, ending the anonymity.
Illustratively, the verification scenario may be used for the holder of anonymous data to prove itself to other members of ownership of anonymous data, and fig. 3D presents a flow chart of a method of anonymous data verification, comprising:
s340, the data holder selects a certain data record to carry out anonymization;
s341, locally inquiring a random key corresponding to the data record;
s342, initiating an anonymization alliance contract, and displaying the held random key to other members of the alliance;
wherein the random key is one of the foreign rights keys.
S343, alliance contracts adopt the same algorithm at each node of the blockchain to obtain a reference identifier by using anonymous data abstract and random key;
S344, judging whether the reference mark is equal to an external random address in the data record, if so, executing S345, and if not, executing S346;
s345, the alliance contract writes the member number into the blockchain data record, and anonymous data is changed into real-name data;
s346, the anonymization initiator cannot prove ownership of the anonymized data, and anonymization fails.
Illustratively, the verification scenario may be used by the requestor to determine whether the received data is from a genuine anonymous data holder, as shown in a flow chart of an anonymous data verification method of fig. 3E, comprising:
s350, the requester performs detail query on a certain data record broadcast message on the blockchain to acquire an anonymous data abstract of the data record;
s351, receiving detail data of target anonymous data of a provider;
s352, the requester runs the same hash algorithm according to the detail data of the target anonymous data to obtain a reference abstract;
s353, judging whether the reference abstract is consistent with the anonymous data abstract in the data record, if so, executing S354, otherwise, executing S355;
s354, judging that the detail data of the received target anonymous data is matched with the data record on the requested chain;
S355, judging that the detail data of the received target anonymous data is not matched with the data record on the requested chain, and executing S356;
s356, starting a complaint flow;
s357, ending.
Illustratively, the verification scenario may be used for the data holder to determine whether the anonymous data is self, as shown in a flowchart of an anonymous data verification method in fig. 3F, including:
s360, the alliance member receives the detail data request of the anonymous data record and acquires the anonymous data abstract and the internal ownership key of the request data record;
s361, executing a specified symmetric encryption algorithm by taking the anonymous data abstract and the fixed secret key as parameters to obtain a hash encryption result;
s362, judging whether the obtained hash encryption result is equal to the internal random address of the request data record, if so, executing S363, and if not, executing S364;
wherein the internal random address is one of the internal right keys.
S363, judging that the anonymous data belongs to the user, and responding to the detail request;
s364, judging that the anonymous data does not belong to the user, and not responding to the detail request;
s365, ending.
Example IV
Fig. 4 is a schematic structural diagram of an anonymous data storage device provided in a fourth embodiment of the present application, where the embodiment of the present application is applicable to a scenario in which a blockchain stores and verifies anonymous data, and the device is implemented in software and/or hardware, and is specifically configured in an electronic device, where the electronic device may be a computing device carrying blockchain nodes.
The anonymous data storage device, as shown in fig. 4, is configured at a blockchain node, and includes: a key fragment generation module 410, a key fragment ciphertext acquisition module 420, and a storage module 430, wherein,
a key fragment generation module 410, configured to generate at least one key fragment and a holder identification ciphertext according to a holder identification in response to a data storage request of a data holder;
the key fragment ciphertext obtaining module 420 is configured to encrypt each key fragment according to key information of at least one key manager, so as to obtain a key fragment ciphertext associated with each key fragment;
and a storage module 430, configured to store the key fragment ciphertext, the holder identification ciphertext, and the anonymous data digest in a uplink manner.
Further, the key fragment generation module 410 is specifically configured to encrypt the holder identifier by using a threshold encryption algorithm through a secure storage key, and generate at least one key fragment and a holder identifier ciphertext.
Wherein the secure storage key is a fixed length random key.
Further, the device also comprises an external ownership identification storage module, and the external ownership identification storage module comprises: an external ownership identification obtaining unit and an external ownership identification storage unit, wherein,
The external ownership identifier obtaining unit is used for signing the anonymous data abstract according to the external ownership key to obtain an external ownership identifier;
and the external ownership identification storage unit is used for associating the external ownership identification with the anonymous data abstract and storing the anonymous data abstract in a uplink manner.
Further, the device also comprises an internal right secret key storage module, wherein the internal right secret key storage module comprises an internal right secret key receiving unit and an internal right secret key storage unit,
an internal right secret key receiving unit for receiving an internal right secret key of the data provider;
and the pair internal right secret key storage unit is used for storing the pair internal right secret key and the anonymous data abstract in a linking and uplink way.
Further, the apparatus further comprises:
the validity verification module is used for verifying the validity of the certificate of the initiator holder of the data storage request according to the account key of the blockchain management node and/or verifying the validity of the configuration file acquired from the chain; wherein, the configuration file comprises key information of each key manager; and if the verification is passed, executing a response operation of the data storage request of the data holder.
The anonymous data storage device can execute the anonymous data storage method provided by any embodiment of the application, and has the corresponding functional module and beneficial effects of executing the anonymous data storage method.
Example five
Fig. 5 is a schematic structural diagram of an anonymous data verification device provided in a fifth embodiment of the present application, where the device is implemented in software and/or hardware and is specifically configured in an electronic device, and the electronic device may be a computing device carrying a blockchain node.
The anonymous data verification device shown in fig. 5, configured at a blockchain node, comprises: a key fragment plaintext obtaining module 510, a decryption key generating module 520, and a verification module 530, wherein,
a key-sliced plaintext obtaining module 510, configured to receive a key-sliced plaintext of at least one key manager in response to a data query request from a data querying party;
a decryption key generation module 520, configured to generate a decryption key according to the key fragment plaintext;
and the verification module 530 is configured to decrypt the holder identification ciphertext according to the decryption key, so as to verify the data holder.
Further, the decryption key generation module 520 includes a decryption key generation unit, where the decryption key generation unit is configured to generate the decryption key according to the key sliced plaintext if the received key sliced plaintext is greater than a set threshold value.
Further, the verification module 530 includes a holder identification obtaining unit and a data holder verification unit, wherein,
the holder identification obtaining unit is used for decrypting the holder identification ciphertext according to the decryption key to obtain a holder identification;
and the data holder verification unit is used for searching the holder identification in the member list of the blockchain so as to verify the data holder.
Further, the apparatus further comprises: an anonymous data abstract and external ownership identification obtaining module and a reference identification obtaining module, wherein,
the anonymous data abstract and external ownership identification obtaining module is used for obtaining the anonymous data abstract and the external ownership identification on a chain;
the reference identifier obtaining module is used for signing the anonymous data abstract according to the external rights key provided by the data holder to obtain a reference identifier;
the verification module 530 is further configured to verify ownership of anonymous data by the data holder according to the reference identifier and the external ownership identifier.
Further, the apparatus further comprises: a detail data receiving module and a reference abstract obtaining module, wherein,
the detail data receiving module is used for sending an owner verification request of the target anonymous data to the blockchain network and receiving detail data of the target anonymous data fed back by the data provider;
The reference abstract obtaining module is used for carrying out hash calculation on the detail data of the target anonymous data to obtain a reference abstract;
the verification module 530 is further configured to verify the authenticity of the holder according to the reference digest and the anonymous data digest of the target anonymous data acquired on the chain.
Further, the apparatus further comprises:
the anonymous data digest acquisition module is used for responding to an owner verification request of a data verifier for target anonymous data and acquiring an anonymous data digest of the target anonymous data on a chain;
the verification module 530 is further configured to search a local database according to the anonymous data digest of the target anonymous data, so as to verify self-ownership of the target anonymous data.
Optionally, the verification module 530 includes: a data search identification obtaining unit and a self ownership verification unit, wherein,
the data searching identification obtaining unit is used for encrypting the anonymous data abstract of the target anonymous data according to the internal right secret key to obtain a data searching identification;
and the self ownership verification unit is used for searching the local database according to the data searching identification so as to verify the self ownership of the target anonymous data.
Further, the apparatus further comprises:
and the in-pair rights key acquisition module is used for acquiring a key from the local key store as an in-pair rights key.
The anonymous data verification device can execute the anonymous data verification method provided by any embodiment of the application, and has the corresponding functional module and beneficial effects of executing the anonymous data verification method.
Example six
Fig. 6 is a structural diagram of an electronic device in a sixth embodiment of the present application. The electronic device as shown in fig. 6 includes: input device 610, output device 620, processor 630, and storage device 640.
Wherein, the input device 610 is configured to receive a key fragment plaintext of at least one key manager; and is also configured to receive an in-pair rights key for the data provider;
an output device 620, configured to store the key fragment ciphertext, the holder identification ciphertext, and the anonymous data digest in a uplink;
one or more processors 630;
a storage 640 for storing one or more programs.
In fig. 6, for example, a processor 630 is shown, and the input device 610 of the electronic device may be connected to the output device 620, the processor 630, and the storage device 640 by a bus or other means, and the processor 630 and the storage device 640 are also connected by a bus or other means, for example, in fig. 6.
In this embodiment, the processor 630 in the electronic device may control the input device 610 to receive the key fragment plaintext of at least one key manager; also receiving an in-pair rights key for the data provider; processor 630 may also be controlled to generate at least one key fragment and holder identification ciphertext from the holder identification in response to a data storage request by the data holder; encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment; generating a decryption key according to the key fragment plaintext; decrypting the holder identification ciphertext according to the decryption key to verify the data holder; the output device 620 may also be controlled to store the key fragment ciphertext, the holder identification ciphertext, and the anonymous data digest in a uplink.
The storage 640 in the electronic device is used as a computer readable storage medium, and may be used to store one or more programs, such as a software program, a computer executable program, and a module, where program instructions/modules corresponding to an anonymous data storage method (e.g., the key fragmentation generation module 410, the key fragmentation ciphertext acquisition module 420, and the storage module 430 shown in fig. 4) and/or program instructions/modules corresponding to an anonymous data verification method (e.g., the key fragmentation plaintext obtaining module 510, the decryption key generation module 520, and the verification module 530 shown in fig. 5) are used in the embodiments of the present application. The processor 630 executes various functional applications of the electronic device and data processing by running software programs, instructions and modules stored in the storage 640, i.e., implements the anonymous data storage method and/or anonymous data authentication method in the above-described method embodiments.
The storage 640 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, at least one application program required for a function; the storage data area may store data, etc. (e.g., key fragments, key fragment plaintext and ciphertext, holder identification ciphertext, secure storage keys, external and internal rights keys, etc. as in the embodiments described above). In addition, the storage 640 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device. In some examples, the storage 640 may further include memory located remotely from the processor 630, which may be connected to the electronic device through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
Example seven
An embodiment of the present application provides a computer readable storage medium having stored thereon a computer program which, when executed by an anonymous data storage device, implements an anonymous data storage method provided by an embodiment of the present application, including: responding to a data storage request of a data holder, and generating at least one key fragment and a holder identification ciphertext according to a holder identification; encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment; and storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner.
The embodiment of the application also provides another computer readable storage medium, on which a computer program is stored, which when executed by the anonymous data verification device, implements the anonymous data verification method provided by the application implementation, and includes: receiving a key fragment plaintext of at least one key manager in response to a data query request of a data querying party; generating a decryption key according to the key fragment plaintext; decrypting the holder identification ciphertext according to the decryption key to verify the data holder.
Note that the above is only a preferred embodiment of the present application and the technical principle applied. Those skilled in the art will appreciate that the present application is not limited to the particular embodiments described herein, but is capable of numerous obvious changes, rearrangements and substitutions as will now become apparent to those skilled in the art without departing from the scope of the present application. Therefore, while the present application has been described in connection with the above embodiments, the present application is not limited to the above embodiments, but may include many other equivalent embodiments without departing from the spirit of the present application, the scope of which is defined by the scope of the appended claims.
Claims (16)
1. An anonymous data storage method applied to a blockchain node, comprising:
responding to a data storage request of a data holder, and generating at least one key fragment and a holder identification ciphertext according to a holder identification; wherein the data holder is a holder of anonymous data; the data storage request comprises data to be stored and/or a data identifier to be stored; the to-be-stored data identifier is a storage address of the to-be-stored data outside the blockchain node, or a data abstract obtained by hash calculation of the to-be-stored data;
encrypting each key fragment through key information of at least one key management party to obtain a key fragment ciphertext associated with each key fragment; wherein the key manager is a member of the federation committee that manages key shards; the key information is a public key of the federation committee member;
storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner;
wherein, before the step of storing the key fragment ciphertext, the holder identification ciphertext, and the anonymous data digest in the uplink, the method further comprises:
Signing the anonymous data abstract according to an external ownership key to obtain an external ownership identifier; wherein the external rights key is a random key of a held data record disclosed by a member node in the data holding direction blockchain network; the external ownership identifier is an ownership identifier and is used for characterizing the ownership of the anonymous data by the data holder so as to verify the ownership of the corresponding data by the member node;
and associating the external rights identification with the anonymous data abstract, and storing the anonymous data abstract in a uplink manner.
2. The method of claim 1, wherein generating at least one key fragment and a holder identification ciphertext from the holder identification comprises:
and encrypting the holder identification through a safe storage key by adopting a threshold encryption algorithm to generate at least one key fragment and holder identification ciphertext.
3. The method of claim 2, wherein the secure storage key is a fixed length random key.
4. The method according to claim 1, wherein the method further comprises:
receiving an in-pair rights key of a data provider;
And storing the pair of the in-right genus keys in a uplink mode in association with the anonymous data digest.
5. The method of claim 1, wherein prior to generating the at least one key fragment and holder identification ciphertext from the holder identification in response to the data storage request of the data holder, the method further comprises:
verifying the validity of the certificate of the initiator of the data storage request according to the account key of the blockchain management node, and/or verifying the validity of the configuration file acquired on the chain; wherein, the configuration file comprises key information of each key manager;
and if the verification is passed, executing a response operation of the data storage request of the data holder.
6. An anonymous data verification method applied to a blockchain node, comprising the following steps:
receiving a key fragment plaintext of at least one key manager in response to a data query request of a data querying party; the data query request is a reverse anonymous transaction request of one data record initiated by the data query party or a query request of the data query party for one data record on the blockchain node; the key management party is a member of the alliance committee for managing key fragments; the key fragment plaintext is the decrypted key fragment;
Generating a decryption key according to the key fragment plaintext;
decrypting the holder identification ciphertext according to the decryption key to verify the data holder;
acquiring an anonymous data abstract and an external ownership identifier on a chain; the external ownership identifier is an ownership identifier and is used for characterizing the ownership of anonymous data by the data holder so as to verify the ownership of corresponding data by the member node;
signing the anonymous data abstract according to an external rights key provided by a data holder to obtain a reference identifier; wherein the external rights key is a random key of a held data record disclosed by a member node in the data holding direction blockchain network;
and verifying the ownership of the anonymous data by the data holder according to the reference identifier and the external ownership identifier.
7. The method of claim 6, wherein generating a decryption key from the key sliced plaintext comprises:
and if the received key fragment plaintext is larger than a set threshold value, generating the decryption key according to the key fragment plaintext.
8. The method of claim 6, wherein decrypting the holder identification ciphertext from the decryption key to authenticate the data holder comprises:
Decrypting the holder identification ciphertext according to the decryption key to obtain a holder identification;
the holder identification is looked up in the member list of the blockchain to verify the data holder.
9. The method of claim 6, wherein the method further comprises:
transmitting an owner verification request of target anonymous data to a blockchain network, and receiving detail data of the target anonymous data fed back by a data provider;
carrying out hash calculation on detail data of the target anonymous data to obtain a reference abstract;
and verifying the authenticity of the holder according to the reference abstract and the anonymous data abstract of the target anonymous data acquired from the chain.
10. The method of claim 6, wherein the method further comprises:
responding to an owner verification request of a data verifier for target anonymous data, and acquiring an anonymous data abstract of the target anonymous data in a chain;
and searching a local database according to the anonymous data abstract of the target anonymous data so as to verify the ownership of the target anonymous data.
11. The method of claim 10, wherein the looking up a local database from the anonymous data digest of the target anonymous data to verify ownership of the target anonymous data, comprises:
Encrypting the anonymous data abstract of the target anonymous data according to the internal right secret key to obtain a data searching identifier;
and searching a local database according to the data searching identification so as to verify the ownership of the target anonymous data.
12. The method of claim 11, wherein the method further comprises:
the key is obtained from the local keystore as an in-pair rights key.
13. An anonymous data storage device configured at a blockchain node, comprising:
the key fragment generation module is used for responding to a data storage request of a data holder and generating at least one key fragment and a holder identification ciphertext according to the holder identification; wherein the data holder is a holder of anonymous data; the data storage request comprises data to be stored and/or a data identifier to be stored; the to-be-stored data identifier is a storage address of the to-be-stored data outside the blockchain node, or a data abstract obtained by hash calculation of the to-be-stored data;
the key fragment ciphertext obtaining module is used for encrypting each key fragment through the key information of at least one key management party to obtain the key fragment ciphertext associated with each key fragment; wherein the key manager is a member of the federation committee that manages key shards; the key information is a public key of the federation committee member;
The storage module is used for storing the key fragment ciphertext, the holder identification ciphertext and the anonymous data abstract in a uplink manner;
an external ownership identification storage module comprising:
the external ownership identifier obtaining unit is used for signing the anonymous data abstract according to the external ownership key to obtain an external ownership identifier; wherein the external rights key is a random key of a held data record disclosed by a member node in the data holding direction blockchain network; the external ownership identifier is an ownership identifier and is used for characterizing the ownership of the anonymous data by the data holder so as to verify the ownership of the corresponding data by the member node;
and the external ownership identification storage unit is used for associating the external ownership identification with the anonymous data abstract and storing the anonymous data abstract in a uplink manner.
14. An anonymous data authentication device configured at a blockchain node, comprising:
the key slicing plaintext obtaining module is used for responding to a data query request of a data query party and receiving the key slicing plaintext of at least one key management party; the data query request is a reverse anonymous transaction request of one data record initiated by the data query party or a query request of the data query party for one data record on the blockchain node; the key management party is a member of the alliance committee for managing key fragments; the key fragment plaintext is the decrypted key fragment;
The decryption key generation module is used for generating a decryption key according to the key fragment plaintext;
the verification module is used for decrypting the holder identification ciphertext according to the decryption key so as to verify the data holder;
the anonymous data abstract and external ownership identification obtaining module is used for obtaining the anonymous data abstract and the external ownership identification on a chain; the external ownership identifier is an ownership identifier and is used for characterizing the ownership of anonymous data by the data holder so as to verify the ownership of corresponding data by the member node;
the reference identifier obtaining module is used for signing the anonymous data abstract according to the external rights key provided by the data holder to obtain a reference identifier; wherein the external rights key is a random key of a held data record disclosed by a member node in the data holding direction blockchain network;
and the verification module is also used for verifying the ownership of the anonymous data by the data holder according to the reference identifier and the external ownership identifier.
15. An electronic device, comprising:
one or more processors;
A memory for storing one or more programs;
when executed by the one or more processors, causes the one or more processors to implement an anonymous data storage method as defined in any one of claims 1-5 and/or an anonymous data verification method as defined in any one of claims 6-12.
16. A computer readable storage medium having stored thereon a computer program, characterized in that the program when executed by a processor implements an anonymous data storage method according to any of claims 1-5 and/or an anonymous data verification method according to any of claims 6-12.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011027570.1A CN112235260B (en) | 2020-09-25 | 2020-09-25 | Anonymous data storage method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011027570.1A CN112235260B (en) | 2020-09-25 | 2020-09-25 | Anonymous data storage method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112235260A CN112235260A (en) | 2021-01-15 |
| CN112235260B true CN112235260B (en) | 2023-05-16 |
Family
ID=74107786
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011027570.1A Active CN112235260B (en) | 2020-09-25 | 2020-09-25 | Anonymous data storage method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112235260B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112818405A (en) * | 2021-03-01 | 2021-05-18 | 北京苏博云科可信空间数据技术有限公司 | Data processing method and device of block chain and readable storage medium |
| CN113079020B (en) * | 2021-03-30 | 2022-05-06 | 桂林电子科技大学 | Multi-chain forensics method of alliance chain based on threshold signature decision system |
| WO2023198036A1 (en) * | 2022-04-11 | 2023-10-19 | 华为技术有限公司 | Key generation method and apparatus, and device |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11171791B2 (en) * | 2019-01-15 | 2021-11-09 | 0Chain, LLC | Systems and methods of aggregate signing of digital signatures on multiple messages simultaneously using key splitting |
| US11240025B2 (en) * | 2018-11-09 | 2022-02-01 | Ares Technologies, Inc. | Systems and methods for distributed key storage |
| CN110969431B (en) * | 2019-11-27 | 2024-04-19 | 北京贵泽系统技术有限公司 | Secure hosting method, device and system for private key of blockchain digital coin |
| CN111008855B (en) * | 2019-12-10 | 2024-02-13 | 上海信联信息发展股份有限公司 | Retrospective data access control method based on improved proxy re-encryption |
| CN111211905A (en) * | 2019-12-17 | 2020-05-29 | 航天信息股份有限公司 | Identity management method for Fabric alliance chain members based on certificate-free authentication |
| CN111245597B (en) * | 2020-01-17 | 2023-09-15 | 众安信息技术服务有限公司 | Key management method, system and equipment |
| CN111159306B (en) * | 2020-04-02 | 2020-10-30 | 支付宝(杭州)信息技术有限公司 | Information publishing method and device based on block chain and computer equipment |
-
2020
- 2020-09-25 CN CN202011027570.1A patent/CN112235260B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN112235260A (en) | 2021-01-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| AU2021206913B2 (en) | Systems and methods for distributed data sharing with asynchronous third-party attestation | |
| CN111914027B (en) | Block chain transaction keyword searchable encryption method and system | |
| CN107231351B (en) | Electronic certificate management method and related equipment | |
| CN109067801B (en) | Identity authentication method, identity authentication device and computer readable medium | |
| CN112235260B (en) | Anonymous data storage method, device, equipment and storage medium | |
| Guo et al. | Outsourced dynamic provable data possession with batch update for secure cloud storage | |
| CN112487778A (en) | Multi-user online signing system and method | |
| CN110392038B (en) | Multi-key searchable encryption method capable of being verified in multi-user scene | |
| JP6688823B2 (en) | A method for managing and inspecting data from various identity domains organized into structured sets | |
| CN111753014B (en) | Identity authentication method and device based on block chain | |
| CN111212084A (en) | Attribute encryption access control method facing edge calculation | |
| CN112261082B (en) | Passive DNS data sharing method and system based on block chain and safe multi-party computation | |
| Li et al. | Efficient message authentication with revocation transparency using blockchain for vehicular networks | |
| CN114205136A (en) | Traffic data resource sharing method and system based on block chain technology | |
| Bhargav-Spantzel et al. | Multifactor identity verification using aggregated proof of knowledge | |
| CN114465817A (en) | Digital certificate system and method based on TEE (text exchange engine) prediction machine cluster and block chain | |
| Wu et al. | Secure public data auditing scheme for cloud storage in smart city | |
| Gowda et al. | BPCPR-FC: blockchain-based privacy preservation with confidentiality using proxy reencryption and ring signature in fog computing environments | |
| WO2022016842A1 (en) | Method for concealing user information in decentralized identity system, and computer-readable medium | |
| CN114021164A (en) | Block chain-based credit investigation system privacy protection method | |
| CN116506118A (en) | Identity privacy protection method in PKI certificate transparentization service | |
| Zhang et al. | Traceable dynamic public auditing with identity privacy preserving for cloud storage | |
| Divya et al. | A COMBINED DATA STORAGE WITH ENCRYPTION AND KEYWORD BASED DATA RETRIEVAL USING SCDS-TM MODEL IN CLOUD | |
| Tu et al. | A blockchain implementation of an attendance management system | |
| Verslype et al. | Petanon: A privacy-preserving e-petition system based on idemix |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20220914 Address after: 25 Financial Street, Xicheng District, Beijing 100033 Applicant after: CHINA CONSTRUCTION BANK Corp. Address before: 12 / F, 15 / F, 99 Yincheng Road, China (Shanghai) pilot Free Trade Zone, Pudong New Area, Shanghai, 200120 Applicant before: Jianxin Financial Science and Technology Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |