CN115567326A - A blockchain-based data transaction method and device - Google Patents

Abstract

The invention provides a data transaction method and a device based on a block chain. The method fully utilizes symmetric encryption and asymmetric encryption to finish the transmission of the initial key and the private data for the identity authentication of the main body, thereby improving the safety performance. Meanwhile, by introducing verification for limiting decryption time, time-limited sharing of specified data can be realized. According to the data transaction method based on the block chain, a transmission encryption mechanism is constructed, and the method can be suitable for various block chain platforms on the basis of meeting the privacy requirements of special subjects so as to enhance the service expansion capability.

Description

A blockchain-based data transaction method and device

technical field

The present invention relates to the technical field of data communication, in particular to a blockchain-based data transaction method and device.

Background technique

Blockchain is essentially a distributed ledger technology, which stores and verifies transactions in a decentralized manner, and a large number of peer nodes jointly maintain its consistency, thus making the transaction data on the chain open and transparent. The transaction data in the blockchain is packaged and stored in the form of blocks, and the blocks are connected by hash values to ensure the immutability and traceability of the data on the chain. Since the blockchain eliminates the dependence on third parties to participate in verification and record transactions, it can be used as the basis of trust in existing application systems and play a role in fields such as finance, education, and medical care.

As the core of blockchain, cryptography technology is used to ensure the integrity, non-repudiation and non-tampering of transaction information. The underlying cryptographic algorithms of blockchain technology mainly include hash algorithms and asymmetric encryption algorithms. Use the hash algorithm to perform hash calculation on the previous block, and save the obtained fixed-length summary in the current block, so as to realize the integrity and non-tamperable modification of the blockchain. In the asymmetric encryption algorithm, the transaction initiator will use its own private key to digitally sign the transaction to ensure the integrity of the transaction transmission and the non-repudiation of the transaction sender.

Existing public blockchain platforms lack encryption algorithms to support enterprise-level applications, cannot meet the privacy needs of specific subjects, and cannot specify the subject's needs for private data security and time-limited sharing.

Contents of the invention

In view of this, the embodiments of the present invention provide a blockchain-based data transaction method and device, to eliminate or improve one or more defects in the prior art, and provide a blockchain-based encrypted transmission method , to meet the privacy transmission needs of specific subjects.

One aspect of the present invention provides a blockchain-based data transaction method, the method comprising the following steps:

The data provider generates an initial key based on symmetric encryption, and uses a preset key expansion algorithm to generate a round key based on the initial key;

The data provider uses the round key to encrypt private data to obtain a first ciphertext;

The data provider encodes and modulates the initial key according to preset covert transmission rules to obtain covert information;

The verification node in the blockchain network obtains the first public key and the corresponding first private key according to the system parameters, discloses the first public key, and stores the first private key locally;

The data provider generates the limited decryption time of the private data, encrypts the concealed information and the limited decryption time with the first public key to obtain a second ciphertext, and encrypts the private data with the first public key obtaining said third ciphertext from the first ciphertext;

The data provider applies for registration to the set certificate authority and obtains the first digital certificate and the first signature private key, and the data receiver applies for registration to the set certificate authority and obtains the second digital certificate and the second signature private key. signature private key;

The data provider uploads the second ciphertext and the third ciphertext to the block chain network in combination with the first digital certificate and the first signature private key, and the block chain network The bookkeeping node authenticates the first digital certificate and the first signature private key, and stores the second ciphertext and the third ciphertext on-chain after passing the authentication;

sending a data request to a verification node of the blockchain network by the data receiver in combination with the second digital certificate and the second signature private key;

The verification node of the blockchain network authenticates the second digital certificate and the second signature private key, and after the authentication is passed, queries the second ciphertext and the third ciphertext stored on the chain Decrypting the second ciphertext and the third ciphertext by using the first private key, recovering and obtaining the concealed information, the limited decryption time, and the first ciphertext;

The verification node of the blockchain network checks whether the timeout is currently overtime according to the limited decryption time, and if the timeout is not overtime, send the recovered hidden information and the first ciphertext to the data receiver ;

The data receiver demodulates and decodes the recovered concealed information according to the preset concealed transmission rules, recovers the initial key, and uses the preset key expansion algorithm to obtain the recovered initial key. The key regenerates the round key, and uses the regenerated round key to decrypt the recovered first ciphertext to obtain the private data.

In some embodiments, the data provider generates an initial key based on symmetric encryption, and before using a preset key expansion algorithm to generate a round key based on the initial key, it also includes:

The data provider and the data receiver jointly determine and initialize the covert transmission rules, and determine the code table and modulation symbol table for covert transmission.

In some embodiments, in the preset key expansion algorithm, the initial key expression is:

The system parameter expression is:

The fixed parameter expression is:

The formula for calculating the round key is:

，其中

是非线性变换，

是线性变换。Among them, the reversible transformation

,in

is a nonlinear transformation,

is a linear transformation.

In some embodiments, the verification node in the blockchain network obtains the first public key and the corresponding first private key according to the system parameters, and the first public key and the first private key adopt SM2 elliptic curve public key encryption algorithm.

In some embodiments, the initial key based on symmetric encryption is generated by the data provider, and before using the preset key expansion algorithm to generate the round key according to the initial key, it also includes: distinguishing the data to be transmitted by the data provider If the data to be transmitted is ordinary data or private data, it will be sent directly to the blockchain network for storage on the chain.

In some embodiments, the limited decryption time is preset according to the business type of the private data, and the limited decryption time can be directly marked with a timestamp, or the private data can be uploaded by setting the decryption period in combination with the data provider. The timestamp of the data is constrained.

In some embodiments, the first digital certificate and the first signature private key are authenticated by the accounting node of the blockchain network, and after the authentication is passed, the second ciphertext and the third After the ciphertext is stored on the chain, it also includes: using the SM3 algorithm to calculate hash values for the second ciphertext and the third ciphertext, and storing them on the chain.

In some embodiments, the method employs a BCCSP cryptographic module to provide key generation, message signing and verification, hashing, and encryption and decryption.

On the other hand, the present invention also provides a block chain-based data transaction device, including a processor and a memory, wherein computer instructions are stored in the memory, and the processor is used to execute the computer instructions stored in the memory, The apparatus implements the steps of the above method when said computer instructions are executed by a processor.

On the other hand, the present invention also provides a computer-readable storage medium on which a computer program is stored, which is characterized in that, when the program is executed by a processor, the steps of the above method are realized.

The beneficial effects of the present invention are at least:

In the blockchain-based data transaction method and device of the present invention, based on the preset key expansion algorithm, the round key is generated according to the initial key to encrypt the private data and store it on the chain, and the preset concealed transmission rules are used between the data provider and the The initial key is encrypted and transmitted between the data receivers, and the data receiver regenerates the round key according to the initial key based on the preset key expansion algorithm and decrypts it to obtain the private data. Make full use of symmetric encryption and asymmetric encryption to complete subject identity authentication, mention initial key and private data transmission, and improve security performance. At the same time, by introducing a verification that limits the decryption time, time-limited sharing of specified data can be achieved.

Further, by constructing a transmission encryption mechanism through the blockchain-based data transaction method described in the present invention, it can adapt to various blockchain platforms on the basis of meeting the privacy requirements of special subjects, so as to enhance business expansion capabilities.

Additional advantages, objects, and features of the present invention will be set forth in part in the following description, and will be partly apparent to those of ordinary skill in the art after studying the following text, or can be learned from the practice of the present invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and appended drawings.

It will be understood by those skilled in the art that the objects and advantages that can be achieved by the present invention are not limited to the above specific ones, and the above and other objects that can be achieved by the present invention will be more clearly understood from the following detailed description.

Description of drawings

The drawings described here are used to provide further understanding of the present invention, constitute a part of the application, and do not limit the present invention. In the attached picture:

Fig. 1 is a diagram of the national secret blockchain network system implementing the blockchain-based data transaction method according to an embodiment of the present invention.

Fig. 2 is a flow chart of the blockchain-based data transaction method according to an embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with the embodiments and accompanying drawings. Here, the exemplary embodiments and descriptions of the present invention are used to explain the present invention, but not to limit the present invention.

Here, it should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only the structures and/or processing steps closely related to the solution according to the present invention are shown in the drawings, and the related Other details are not relevant to the invention.

It should be emphasized that the term "comprising/comprising" when used herein refers to the presence of a feature, element, step or component, but does not exclude the presence or addition of one or more other features, elements, steps or components.

Here, it should also be noted that, unless otherwise specified, the term "connection" herein may refer not only to a direct connection, but also to an indirect connection with an intermediate.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

In order to meet the special privacy needs of medical, taxation, government and bidding agencies, adapt to different types of blockchain platforms, and facilitate business expansion. By building a new encrypted transmission mechanism, the national secret algorithm can be introduced and combined with the existing blockchain platform for business deployment.

For example, Hyperledger Fabric is an enterprise-level open source licensed blockchain platform hosted by the Linux Foundation, and it is currently a representative platform for alliance chains in the blockchain field. The architecture of the Fabric platform is highly modular, so each module can be upgraded independently to improve scalability. The Fabric platform consists of three parts: Fabric network, Fabric-CA and Fabric-SDK. The complete Fabric platform transaction process can be obtained through interactive connection between each part.

First, the Fabric-SDK application client will apply for registration to the certificate authority Fabric-CA to obtain an identity certificate. Clients can then submit transaction proposals to endorsers in the Fabric blockchain network. When the client collects enough endorsement results, it will package them and initiate a transaction to the ordering node. The ordering node uses the PBFT consensus algorithm (Practical Byzantine Fault Tolerant Algorithm) to package all transactions and generate blocks. Finally, the ordering node uses the Gossip protocol to broadcast the block to all peer nodes, and each peer node will update the distributed ledger after verifying that the transaction in the block is correct. The Fabric platform provides calling interfaces such as client SDK and chaincode API, and provides services such as identity management and account management to Fabric applications. In every transaction link involved in the Fabric blockchain network transaction process, there are digital signatures and signature verification operations to ensure the ownership of the client's private key and the non-repudiation of the transaction. The functions of transaction signature and verification are provided by the underlying security and cryptographic services. This service includes BCCSP components, which provide services such as key generation, message signature and verification, hash algorithm, and encryption and decryption for Fabric.

The Hyperledger Fabric platform lacks an effective encryption algorithm, which cannot meet the needs of specific entities at the enterprise level, and ensures the security and time-limited sharing of private data on the chain. In order to build a national secret blockchain security sharing model, the application of the Fabric platform in domestic enterprises , a new encryption algorithm system can be constructed.

Specifically, one aspect of the present invention provides a blockchain-based data transaction method, the method including the following steps S101~S111:

Step S101: The data provider generates an initial key based on symmetric encryption, and uses a preset key expansion algorithm to generate a round key based on the initial key.

Step S102: The data provider uses the round key to encrypt the private data to obtain the first ciphertext.

Step S103: The data provider encodes and modulates the initial key according to the preset covert transmission rules to obtain covert information.

Step S104: The verification node in the blockchain network obtains the first public key and the corresponding first private key according to the system parameters, discloses the first public key, and stores the first private key locally.

Step S105: The data provider generates a limited decryption time for the private data, uses the first public key to encrypt the concealed information and the limited decryption time to obtain a second ciphertext, and uses the first public key to encrypt the first ciphertext to obtain a third ciphertext.

Step S106: The data provider applies for registration with the set certificate authority and obtains the first digital certificate and the first signature private key, and the data receiver applies for registration with the set certificate authority and obtains the second digital certificate and the second signature private key.

Step S107: The data provider uploads the second ciphertext and the third ciphertext to the blockchain network in combination with the first digital certificate and the first signature private key, and the accounting node of the blockchain network checks the first digital certificate and the second ciphertext A signature private key is used for authentication, and after the authentication is passed, the second ciphertext and the third ciphertext are stored on the chain.

Step S108: The data receiver sends a data request to the verification node of the blockchain network in combination with the second digital certificate and the second signature private key.

Step S109: The verification node of the blockchain network authenticates the second digital certificate and the second signature private key. After the authentication is passed, query the second ciphertext and the third ciphertext stored on the chain, and decrypt it through the first private key The second ciphertext and the third ciphertext are recovered to obtain the hidden information, limit the decryption time and the first ciphertext.

Step S110: The verification node of the blockchain network checks whether the decryption time limit is currently timed out, and if it is not timed out, send the recovered concealed information and the first ciphertext to the data receiver.

Step S111: The data receiver demodulates and decodes the recovered covert information according to the preset covert transmission rules, recovers the initial key, and uses the preset key expansion algorithm to regenerate the round key based on the recovered initial key, using The regenerated round key decrypts the recovered first ciphertext to obtain private data.

In some embodiments, before step S101, that is, before the data provider generates the initial key based on symmetric encryption, and uses the preset key expansion algorithm to generate the round key according to the initial key, it also includes: the data provider and the data The receiver jointly determines and initializes the covert transmission rules, and determines the code table and modulation symbol table for covert transmission. The covert transmission rules are agreed and set between the data provider and the data receiver, and are specially used to transmit the initial key. Encoding and modulation are performed on the data provider side through the agreed rules, and decoding and demodulation are performed on the data receiver side through the agreed rules to realize the encrypted transmission of the initial key.

In some embodiments, in step S101, in the preset key expansion algorithm, the initial key can be expressed as:

The system parameter expression is:

The fixed parameter expression is:

The round key calculation formula is:

，其中

是非线性变换，

是线性变换。Among them, the reversible transformation

,in

is a nonlinear transformation,

is a linear transformation.

，轮密钥

；可逆变换

，其中

是非线性变换，

是线性变换。则加密算法的运算过程是：In step S102, use the round key to encrypt the private data to obtain the first ciphertext, and the known plaintext input is

, the round key

; reversible transformation

,in

is a nonlinear transformation,

is a linear transformation. Then the operation process of the encryption algorithm is:

，密文输出

。将加密算法的运算过程记为:

。

, the ciphertext output

. The operation process of the encryption algorithm is recorded as:

.

和调制符号表

。In step S103, the preset covert transmission rules mainly include the agreed code table

and modulation symbol table

.

In some embodiments, in step S104, the verification node in the blockchain network obtains the first public key and the corresponding first private key according to the system parameters, the first public key and the first private key adopt SM2 elliptic curve Obtained by public key cryptography algorithm.

In some embodiments, the initial key based on symmetric encryption is generated by the data provider, and before using the preset key expansion algorithm to generate the round key according to the initial key, it also includes: the data provider distinguishes whether the data to be transmitted is ordinary Data or private data, if the data to be transmitted is ordinary data, it is directly sent to the blockchain network for storage on the chain.

Differentiate between ordinary data and private data, and set different processing methods for different data. Ordinary data does not need privacy protection and can be stored and transmitted directly on the chain, while private data is stored on the chain and received by the data using the above steps S101~S111 acquired.

In step S105, the limited decryption time is a limit set on the readable time of private data. For sensitive data or data with a specific time limit, the limited decryption time is artificially set for constraint management to realize time-limited sharing.

Specifically, in some embodiments, the limited decryption time is preset according to the business type of the private data, and the limited decryption time can be directly marked with a timestamp, or can be constrained by setting the decryption period combined with the timestamp of the private data uploaded by the data provider.

In step S106, a third-party certification body provides digital certificates and signatures to data providers and data receivers. For example, the Fabric-CA in Hyperledger Fabric is used to apply for registration and obtain identity certificates.

In some embodiments, in step S107, the first digital certificate and the first signature private key are authenticated by the accounting node of the blockchain network, and after the authentication is passed, the second ciphertext and the third ciphertext are stored on the chain , and also includes: calculating the hash value using the SM3 algorithm for the second ciphertext and the third ciphertext, and storing them on the chain.

In steps S108~S111, the data receiver queries the required privacy data on the blockchain according to actual needs, and gradually decrypts the original privacy data in the reverse order of the encryption process.

In some embodiments, the method employs a BCCSP cryptographic module to provide key generation, message signing and verification, hashing, and encryption and decryption.

On the other hand, the present invention also provides a block chain-based data transaction device, including a processor and a memory, wherein computer instructions are stored in the memory, and the processor is used to execute the computer instructions stored in the memory, The apparatus implements the steps of the above method when said computer instructions are executed by a processor.

On the other hand, the present invention also provides a computer-readable storage medium on which a computer program is stored, which is characterized in that, when the program is executed by a processor, the steps of the above method are realized.

Below in conjunction with specific embodiment the present invention is described:

In order to realize the safe sharing of transaction data under the national secret blockchain platform, as shown in Figure 1, the present invention provides a data transaction method based on blockchain. The system model of this method mainly includes three types of entities: data provider, national secret blockchain network and data receiver. Among them, the data provider refers to the medical, taxation, government and bidding institutions that provide data to the demand side; the national secret blockchain network refers to the Fabric blockchain platform that uses the national secret algorithm to replace the underlying cryptographic algorithm of the Fabric platform; the data receiving A party refers to a party that needs data to realize various business applications, including using user data for medical research, rating users' credit, obtaining users' personal information to complete various businesses, bidding for projects, etc.

This embodiment provides a blockchain-based data transaction method, as shown in Figure 2, including the following steps:

和调制符号表

。Step 1. Initialize the covert transmission rules, and generate the processing rules for messages during covert transmission. Data providers and data receivers initialize the processing rules for messages when generating covert transmissions in advance, including encoding tables

and modulation symbol table

.

。Step 2. Data provider generates initial key for SM4 symmetric encryption distribution. The data provider generates the initial key required by the SM4 symmetric encryption algorithm

.

；利用轮密钥

加密用户

，得到密文

，即

。Step 3. The data provider generates a round key based on the initial key to encrypt the private data. The data provider generates a round key based on the initial key generated in step 2

; use the round key

encrypted user

, get the ciphertext

,Right now

.

进行编码与调制，得到隐蔽信息

，即：

。Step 4. The data provider encodes and modulates the initial key to generate covert information. According to the message processing rules agreed with the data receiver, the data provider assigns the initial key

Coding and modulation to obtain hidden information

,which is:

.

，并对

进行广播公开，

本地存储。Step 5. The verification node in the blockchain network obtains the public-private key pair of the SM2 algorithm according to the system parameters. The verification node in the blockchain network obtains the public-private key pair of the SM2 algorithm according to the system parameters

, and for

to broadcast publicly,

local storage.

，然后利用验证节点的公钥

分别对数据

和

进行加密，得到密文

和

。即：Step 6. The data provider uses the validator's public key to encrypt the hidden information and data expiration time. The data provider generates a time limit to decrypt private data

, and then use the public key of the verification node

Separate data

and

Encrypt to get the ciphertext

and

. which is:

。

.

。

.

、

和签名私钥

。Step 7. The SDK clients corresponding to the data provider and data receiver apply to the certificate authority for registration respectively. User registration: The SDK clients corresponding to the data provider and data receiver apply to the certificate authority for registration and obtain a digital certificate

,

and signing private key

.

，将加密后的密文

和

上传到区块链中。具体的交易形式如下：Step 8. The data provider initiates a transaction to upload encrypted data. The data provider client initiates a transaction

, the encrypted ciphertext

and

uploaded to the blockchain. The specific transaction form is as follows:

。

.

对交易

的签名进行验证，验证通过则将交易利用SM3哈希后加入区块，验证失败则拒绝将交易上传到区块链中。Before uploading the blockchain, each accounting node uses the public key of the data provider client

pair transaction

If the verification is passed, the transaction will be added to the block using SM3 hash, and if the verification fails, the transaction will not be uploaded to the blockchain.

时，其客户端向验证节点客户端发起数据请求。Step 9. The data receiver initiates a data request to the verification node. The data receiver needs the private data uploaded by the data provider

, its client initiates a data request to the verification node client.

，查询区块链中的数据

和

，即：

，具体的交易形式如下：Step 10. The verification node client initiates a transaction query data. After the verification node client receives the request, it initiates a transaction

, to query the data in the blockchain

and

,which is:

, the specific transaction form is as follows:

。

.

和

：Step 11. The verification node decrypts the relevant data and verifies whether the time has expired. The verification node uses the private key to decrypt respectively

and

:

。

.

。

.

。发起交易

，上传

和

，具体的交易形式如下：After decryption, the verification node judges whether the current time is exceeded. If the current time is exceeded, the verification node client will return to the data requester

. Initiate a transaction

, upload

and

, the specific transaction form is as follows:

。

.

和

，即：

，具体的交易形式如下：Step 12. The data receiver initiates a transaction and queries relevant data. The verification node client initiates data query information to the data receiver, and then the data receiver initiates a transaction to query the data in the blockchain

and

,which is:

, the specific transaction form is as follows:

。

.

，即：

。Step 13. The data receiver uses the processing rules to recover the logarithm concealed information. The data receiver demodulates and decodes the concealed information according to the message processing rules agreed with the data provider, and obtains the initial symmetric key

,which is:

.

生成轮密钥

；利用轮密钥

解密用户密文隐私数据

，得到解密文

，即

。至此，数据提供者与数据接收者的隐私数据共享过程完成。Step 14. The data receiver generates a round key based on the recovered initial symmetric key and decrypts the data. According to the receiver based on the recovered initial symmetric key

Generate round key

; use the round key

Decrypt user ciphertext private data

, get the decrypted text

,Right now

. So far, the private data sharing process between the data provider and the data receiver is completed.

In order to describe the technical solution of the present invention more clearly, the specific implementation of the present invention will be described in detail with reference to the accompanying drawings, in which Figure 1 is the privacy protection system model of the national secret blockchain, and Figure 2 is the transaction data privacy protection based on the national secret algorithm method flow.

This embodiment first constructs a transaction data privacy and security sharing model under the national secret blockchain, and then provides a blockchain transaction data privacy protection method that supports the national secret algorithm system. In this embodiment, the data to be uploaded to the chain is divided into ordinary data and private data, and the transaction sender needs to encrypt the private data. In this embodiment, a symmetric encryption algorithm is used to encrypt the private data, so as to ensure that only the transaction receiver can obtain the private data. At the same time, the symmetric key shared by both parties to the transaction is transmitted through the blockchain covert channel, effectively ensuring the security of the symmetric key. Moreover, this embodiment uses the SM2 public key encryption algorithm to verify the validity period of the data, which is applicable to scenarios such as bidding and file downloading.

The parameters involved in this embodiment are as follows in Table 1:

Table 1 is the parameter meaning involved in the present embodiment

This embodiment first gives the transaction data privacy and security sharing model under the national secret blockchain, which mainly includes three types of entities: data provider, national secret blockchain network and data receiver:

Data providers are medical, taxation, government and bidding agencies that provide data to the demand side; data providers divide the data into common data and private data, and encrypt the private data before uploading to the blockchain network.

The national secret block chain network refers to the Fabric block chain platform that uses the encryption algorithm in the present invention to replace the underlying cryptographic algorithm of the Fabric platform; after the data provider is registered, it is added to different organizations in the network as a peer node; There is a verification node in the block chain network. The main function of this node is to verify the correctness of the signature verification transaction and whether the ciphertext data uploaded to the block chain by the data provider is within the validity period; peer nodes can initiate transactions and call smart contracts to achieve related The upload of ciphertext data and the encrypted sharing of data ensure the security, integrity and timeliness of transaction data. The data receiver refers to the party that needs data to realize various business applications, including using user data for medical research, user credit rating, obtaining user personal information to complete various businesses and project bidding, etc.; Request a transaction to obtain ciphertext data, and the client can decrypt and obtain the data.

In this embodiment, user data is divided into common data and private data, and the data provider decides the type of data by itself. Ordinary data can be directly uploaded to the chain without posing a threat to user privacy. Private data is encrypted by the user's symmetric encryption algorithm to ensure its security on the chain. Using the blockchain covert channel to transmit the symmetric key used by both parties to the transaction can ensure the concealment, non-tamperability and anti-interference of the symmetric key. In addition, this paper uses SM2 encryption algorithm to verify the validity of time privacy data. That is, the data is only allowed to be decrypted within the specified time, and once the time is exceeded, the data cannot be decrypted to ensure the timeliness of the data.

The blockchain transaction data privacy protection method that supports the national secret algorithm system proposed in this embodiment is shown in Figure 2, and its specific implementation process is as follows:

和调制符号表

。Step a. Initialization of covert transmission rules: the data provider and data receiver initialize in advance the processing rules for messages when generating covert transmission, including the encoding table

and modulation symbol table

.

。Step b. Key generation: The data provider generates the initial key required by the SM4 symmetric encryption algorithm

.

；利用轮密钥

加密用户

，得到密文

，即

。Step c. Encryption: The data provider generates a round key based on the initial key

; use the round key

encrypted user

, get the ciphertext

,Right now

.

进行编码与调制，得到隐蔽信息

，即：

。Step d. Generate concealed information: The data provider performs the initial key encryption according to the message processing rules agreed with the data receiver.

Coding and modulation to obtain hidden information

,which is:

.

，并对

进行广播公开，

本地存储。Step e. Public-private key pair generation: the verification node in the blockchain network obtains the public-private key pair of the SM2 algorithm according to the system parameters

, and for

to broadcast publicly,

local storage.

，然后利用验证节点的公钥

分别对数据

和

进行加密，得到密文

和

。即：Step f. Encrypted data: The data provider generates a time limit to decrypt the private data

, and then use the public key of the verification node

Separate data

and

Encrypt to get the ciphertext

and

. which is:

。

.

。

.

、

和签名私钥

。Step g. User registration: The SDK clients corresponding to the data provider and data receiver apply to the certificate authority for registration and obtain a digital certificate

,

and signing private key

.

，将加密后的密文

和

上传到区块链中。具体的交易形式如下：Step h. Data on-chain: the data provider client initiates a transaction

, the encrypted ciphertext

and

uploaded to the blockchain. The specific transaction form is as follows:

。

.

对交易

的签名进行验证，验证通过则将交易利用SM3哈希后加入区块，验证失败则拒绝将交易上传到区块链中。Before uploading the blockchain, each accounting node uses the public key of the data provider client

pair transaction

If the verification is passed, the transaction will be added to the block using SM3 hash, and if the verification fails, the transaction will not be uploaded to the blockchain.

时，其客户端向验证节点客户端发起数据请求；Step i. Data request: the data receiver needs the private data uploaded by the data provider

, its client initiates a data request to the verification node client;

，查询区块链中的数据

和

，即：

，具体的交易形式如下：Step j. Verification node data query: After receiving the request, the verification node client initiates a transaction

, to query the data in the blockchain

and

,which is:

, the specific transaction form is as follows:

。

.

和

：Step k. Time verification: the verification node uses the private key to decrypt respectively

and

:

。

.

。

.

。否则发起交易

，上传

和

，具体的交易形式如下：After decryption, the verification node judges whether the current time is exceeded. If the current time is exceeded, the verification node client will return to the data requester

. Otherwise initiate a transaction

, upload

and

, the specific transaction form is as follows:

。

.

和

，即：

。具体的交易形式如下：Step l. Data receiver data query: the verification node client initiates data query information to the data receiver, and then the data receiver initiates a transaction to query the data in the blockchain

and

,which is:

. The specific transaction form is as follows:

。

.

，即：

。Step m. Key recovery: The data receiver demodulates and decodes the concealed information according to the message processing rules agreed with the data provider to obtain the initial symmetric key

,which is:

.

生成轮密钥

；利用轮密钥

解密用户密文隐私数据

，得到解密文

，即

。至此，数据提供者与数据接收者的隐私数据共享过程完成。Step n. Decryption: The data receiver decrypts the data according to the original symmetric key at the recovery site

Generate round key

; use the round key

Decrypt user ciphertext private data

, get the decrypted text

,Right now

. So far, the private data sharing process between the data provider and the data receiver is completed.

In summary, the blockchain-based data transaction method and device of the present invention, based on the preset key expansion algorithm, generates a round key based on the initial key to encrypt private data and store it on the chain. The initial key is encrypted and transmitted between the data provider and the data receiver, and the data receiver regenerates the round key according to the initial key based on the preset key expansion algorithm and decrypts it to obtain the private data. Make full use of symmetric encryption and asymmetric encryption to complete subject identity authentication, mention initial key and private data transmission, and improve security performance. At the same time, by introducing a verification that limits the decryption time, time-limited sharing of specified data can be achieved.

Further, by constructing a transmission encryption mechanism through the blockchain-based data transaction method described in the present invention, it can adapt to various blockchain platforms on the basis of meeting the privacy requirements of special subjects, so as to enhance business expansion capabilities.

Corresponding to the above method, the present invention also provides a block chain-based data transaction device/system, the device/system includes computer equipment, the computer equipment includes a processor and a memory, and computer instructions are stored in the memory , the processor is configured to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the device/system implements the steps of the aforementioned method.

An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned method for deploying an edge computing server can be implemented. The computer readable storage medium may be a tangible storage medium such as random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

Those of ordinary skill in the art should understand that each exemplary component, system and method described in conjunction with the embodiments disclosed herein can be implemented by hardware, software or a combination of the two. Whether it is implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention. When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, or the like. When implemented in software, the elements of the invention are the programs or code segments employed to perform the required tasks. Programs or code segments can be stored in machine-readable media, or transmitted over transmission media or communication links by data signals carried in carrier waves.

It is to be understood that the invention is not limited to the specific arrangements and processes described above and shown in the drawings. For conciseness, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the sequence of steps after understanding the spirit of the present invention.

In the present invention, features described and/or exemplified for one embodiment can be used in the same or similar manner in one or more other embodiments, and/or can be combined with features of other embodiments or replace other Features of the implementation.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, various modifications and changes may be made to the embodiments of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. A blockchain-based data transaction method, characterized in that the method comprises the following steps: The data provider generates an initial key based on symmetric encryption, and uses a preset key expansion algorithm to generate a round key based on the initial key; The data provider uses the round key to encrypt private data to obtain a first ciphertext; The data provider encodes and modulates the initial key according to preset covert transmission rules to obtain covert information; The verification node in the blockchain network obtains the first public key and the corresponding first private key according to the system parameters, discloses the first public key, and stores the first private key locally; The data provider generates the limited decryption time of the private data, encrypts the concealed information and the limited decryption time with the first public key to obtain a second ciphertext, and encrypts the private data with the first public key obtaining said third ciphertext from the first ciphertext; The data provider applies for registration to the set certificate authority and obtains the first digital certificate and the first signature private key, and the data receiver applies for registration to the set certificate authority and obtains the second digital certificate and the second signature private key. signature private key; The data provider uploads the second ciphertext and the third ciphertext to the block chain network in combination with the first digital certificate and the first signature private key, and the block chain network The bookkeeping node authenticates the first digital certificate and the first signature private key, and stores the second ciphertext and the third ciphertext on-chain after passing the authentication; sending a data request to a verification node of the blockchain network by the data receiver in combination with the second digital certificate and the second signature private key; The verification node of the blockchain network authenticates the second digital certificate and the second signature private key, and after the authentication is passed, queries the second ciphertext and the third ciphertext stored on the chain Decrypting the second ciphertext and the third ciphertext by using the first private key, recovering and obtaining the concealed information, the limited decryption time, and the first ciphertext; The verification node of the blockchain network checks whether the timeout is currently overtime according to the limited decryption time, and if the timeout is not overtime, send the recovered hidden information and the first ciphertext to the data receiver ; The data receiver demodulates and decodes the recovered concealed information according to the preset concealed transmission rules, recovers the initial key, and uses the preset key expansion algorithm to obtain the recovered initial key. The key regenerates the round key, and uses the regenerated round key to decrypt the recovered first ciphertext to obtain the private data. 2. The data transaction method based on block chain according to claim 1, characterized in that, the initial key based on symmetric encryption is generated by the data provider, and the preset key expansion algorithm is used to generate the round key according to the initial key. Before the key, also include: The data provider and the data receiver jointly determine and initialize the covert transmission rules, and determine the code table and modulation symbol table for covert transmission. 3. The blockchain-based data transaction method according to claim 1, wherein, in the preset key expansion algorithm, the initial key expression is:

The system parameter expression is:

The fixed parameter expression is:

The formula for calculating the round key is:

Among them, the reversible transformation

,in

is a nonlinear transformation,

is a linear transformation. 4. The data transaction method based on block chain according to claim 1, wherein the verification node in the block chain network obtains the first public key and the corresponding first private key according to the system parameters, said The first public key and the first private key are obtained using the SM2 elliptic curve public key cryptographic algorithm. 5. The data transaction method based on blockchain according to claim 1, characterized in that, the initial key based on symmetric encryption is generated by the data provider, and the preset key expansion algorithm is used to generate the round key according to the initial key Before the key, also include: The data provider distinguishes whether the data to be transmitted is ordinary data or private data, and if the data to be transmitted is ordinary data, it is directly sent to the blockchain network for on-chain storage. 6. The blockchain-based data transaction method according to claim 1, wherein the limited decryption time is preset according to the business type of the private data, and the limited decryption time can be directly marked with a timestamp, It may also be constrained by setting a decryption time limit combined with the time stamp when the data provider uploads the private data. 7. The blockchain-based data transaction method according to claim 1, wherein the first digital certificate and the first signature private key are authenticated by an accounting node of the blockchain network After the authentication is passed, after the second ciphertext and the third ciphertext are stored on the chain, it also includes: The SM3 algorithm is used to calculate hash values for the second ciphertext and the third ciphertext, and store them on the chain. 8. The data transaction method based on block chain according to claim 1, characterized in that, the method adopts BCCSP cryptographic module to provide key generation, message signature and verification, hash algorithm and encryption and decryption. 9. A block chain-based data transaction device, comprising a processor and a memory, wherein computer instructions are stored in the memory, and the processor is used to execute the computer instructions stored in the memory, when the When the computer instructions are executed by the processor, the device implements the steps of the method according to any one of claims 1 to 8. 10. A computer-readable storage medium, on which a computer program is stored, wherein, when the program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are realized.

Images