CN117040766A

CN117040766A - Block chain-based data processing method, device, equipment and readable storage medium

Info

Publication number: CN117040766A
Application number: CN202311291602.2A
Authority: CN
Inventors: 刘区城; 梁军; 王宗友; 刘汉卿; 时一防; 黄杨峻; 朱耿良; 聂凯轩; 廖志勇
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2023-10-08
Filing date: 2023-10-08
Publication date: 2023-11-10
Anticipated expiration: 2043-10-08
Also published as: CN117040766B

Abstract

The application discloses a data processing method, a device, equipment and a readable storage medium based on a blockchain, wherein the method comprises the following steps: performing blind signature processing on the received blind transaction data by adopting a signature key of the main object to obtain blind signature information; verifying the validity of the blind signature information; when the validity of the blind signature information is determined, adopting at least two approval signature keys of the approval objects to carry out multiple signature approval on the blind transaction data; at least two approval objects have approval authorities of blinded transaction data, and a subordinate relationship exists between a main object and each of the at least two approval objects; and when the multi-signature approval result of the blind transaction data is determined to be an approval passing result, invoking a resource management contract related to the main object to perform uplink processing on the blind transaction data. By adopting the method and the device, the privacy and the safety of the transaction data in the blockchain can be simultaneously improved.

Description

Block chain-based data processing method, device, equipment and readable storage medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a data processing method, apparatus, device and readable storage medium based on a blockchain.

Background

The block chain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like, and is mainly used for sorting data according to time sequence, encrypting the data into an account book, preventing the account book from being tampered and forged, and simultaneously verifying, storing and updating the data.

Because of their tamper resistance, data consistency, and other characteristics, blockchains are widely used, and more enterprises or institutions employ blockchains to store related transaction data. However, due to the public transparency of the blockchain, the related data stored in the blockchain can be referred by each member in the enterprise, which is unfavorable for protecting the transaction privacy among different members in the enterprise, so that the related transaction data of different members have the risk of being maliciously revealed, i.e. the transaction data in the enterprise has a certain potential safety hazard. Therefore, a scheme is needed to improve the security and privacy of the transaction data while the transaction data inside the enterprise is well stored on the blockchain.

Disclosure of Invention

The embodiment of the application provides a data processing method, device and equipment based on a blockchain and a readable storage medium, which can simultaneously improve the privacy and safety of transaction data in the blockchain.

In one aspect, an embodiment of the present application provides a data processing method based on a blockchain, including:

performing blind signature processing on the received blind transaction data by adopting a signature key of the main object to obtain blind signature information; the blinded transaction data is obtained by blinding the original transaction data;

verifying the validity of the blind signature information;

when the validity of the blind signature information is determined, adopting at least two approval signature keys of the approval objects to carry out multiple signature approval on the blind transaction data; at least two approval objects have approval authorities of blinded transaction data, and a subordinate relationship exists between a main object and each of the at least two approval objects;

and when the multi-signature approval result of the blind transaction data is determined to be an approval passing result, invoking a resource management contract related to the main object to perform uplink processing on the blind transaction data.

In one aspect, an embodiment of the present application provides a data processing apparatus based on a blockchain, including:

the blind signature module is used for carrying out blind signature processing on the received blind transaction data by adopting a signature key of the main object to obtain blind signature information; the blinded transaction data is obtained by blinding the original transaction data;

The verification module is used for verifying the validity of the blind signature information;

the multi-signature module is used for carrying out multi-signature approval on the blind transaction data by adopting approval signature keys of at least two approval objects when the validity of the blind signature information is determined; at least two approval objects have approval authorities of blinded transaction data, and a subordinate relationship exists between a main object and each of the at least two approval objects;

and the contract calling module is used for calling a resource management contract related to the main object to carry out uplink processing on the blind transaction data when the multi-signature approval result of the blind transaction data is determined to be an approval passing result.

In one embodiment, before the blind signature module performs blind signature processing on the received blind transaction data by adopting the signature key of the main object to obtain blind signature information, the blockchain-based data processing device further includes:

a registration request receiving module for receiving a key registration request for a main object; the key registration request is used for requesting to register an associated key of the main object; the association key of the master object comprises a signing key address of the master object, signing key addresses of one or more slave objects and signing key addresses of at least two approval objects; each of the one or more slave objects refers to an object that is subordinate to the master object;

And the key registration module is used for registering the signing key of the master object, the signing key addresses of one or more slave objects and the signing key addresses of at least two approved objects into a key management system related to the master object based on the key registration request.

In one embodiment, the blind signature module performs blind signature processing on the received blind transaction data by adopting a signature key of the main object, so as to obtain a specific mode of blind signature information, and the specific mode comprises the following steps:

receiving blinded transaction data sent by a first slave object; the blind transaction data carries transaction signature information; the transaction signature information is obtained by signing the blinded transaction data based on a first key to be verified of the first slave object; the first slave object refers to any slave object subordinate to the master object;

determining a signature key address of a first slave object registered in a key management system related to a master object as a first signature verification key of transaction signature information;

performing signature verification processing on the transaction signature information through the first signature verification key to obtain a first signature verification result;

and when the first signature verification result is determined to be a signature verification passing result, determining that the first key to be verified is a legal signature key of the first slave object, calling a blind signature component, and carrying out blind signature processing on the received blind transaction data by adopting the signature key of the master object in the blind signature component to obtain blind signature information.

In one embodiment, the specific way for the verification module to verify the validity of the blind signature information comprises:

calling a multiple signature component, and acquiring a registered signature key address of the main object from a key management system related to the main object through the multiple signature component;

determining a signing key address of the main object as a second signing key of the blind signing information;

performing signature verification processing on the blind signature information through the second signature verification key to obtain a second signature verification result;

when the second signature verification result is determined to be a signature verification passing result, determining that the blind signature information is effective;

and when the second signature verification result is determined to be a signature verification failure result, determining that the blind signature information has invalidity.

In one embodiment, the blinded transaction data is sent by the first slave object; the first slave object refers to any slave object subordinate to the master object;

the multiple signature module adopts the approval signature keys of at least two approval objects to carry out multiple signature approval on the blind transaction data, and the specific mode comprises the following steps:

invoking a multiple signature component, and acquiring at least two approval objects with approval authorities of blind transaction data through the multiple signature component; at least two approval objects are all subordinate to the first slave object;

Transmitting the blinded transaction data to at least two approval objects, so that the at least two approval objects adopt at least two approval signing keys to carry out multiple signature approval on the blinded transaction data; one of the at least two approval objects is provided with one of the at least two approval signing keys.

In one embodiment, after the multiple signature module sends the blinded transaction data to the at least two approval objects, the blockchain-based data processing device further includes:

the signature information receiving module is used for receiving multiple signature information returned by at least two approval objects; the multiple signature information comprises N approval signature information; at least two approval objects including approval object S _i The N approval signature information comprises an approval object S _i Corresponding approval signature information S _i Approval of signature information S _i Is based on approval object S _i The second key to be verified is obtained after the blind transaction data is signed; i. n is a positive integer;

an approval signature verification module for verifying approval signature information S _i Validity verification is carried out to obtain approval signature information S _i A validity verification result of (2);

the multiple signature verification module is used for determining the validity of the multiple signature information based on the N validity verification results if the validity verification result of each approval signature information in the N approval signature information is determined;

And the approval result determining module is used for determining the multi-signature approval result of the transaction data according to the number of the approval signature information contained in the N approval signature information and the number of the approval objects contained in the at least two approval objects when the validity of the multi-signature information is determined.

In one embodiment, the approval signature verification module verifies the approval signature information S _i Validity verification is carried out to obtain approval signature information S _i The specific mode of the validity verification result of the (c) comprises the following steps:

approval object S registered in key management system related to main object _i Is determined as approval signature information S _i A third signing key of (2);

approval of signature information S by means of a third signing verification key pair _i Performing label verification processing to obtain a third label verification result;

when the third signature verification result is determined to be the signature verification passing result, determining the second key to be verified as the approval object S _i Legal signature key of (2) to determine approval signature information S _i The validity verification result of (a) is a valid signature result;

when the third signature verification result is determined to be the signature verification failure result, determining the second key to be verified as the approval object S _i Is used for determining approval signature information S _i The validity verification result of (a) is an invalid signature result.

In one embodiment, the specific manner in which the multiple signature verification module determines the validity of the multiple signature information based on the N validity verification results includes:

counting a first number of valid signature results contained in the N validity verification results;

counting the second number of the validity verification results contained in the N validity verification results;

comparing the first number with the second number;

if the first number is determined to be the same as the second number, determining that the multi-signature information is valid;

if the first number is different from the second number, the multiple signature information is determined to be invalid.

In one embodiment, the approval result determining module determines a specific manner of the multi-signature approval result of the transaction data according to the number of approval signature information contained in the N pieces of approval signature information and the number of approval objects contained in the at least two approval objects, including:

determining the number of the approval signature information contained in the N approval signature information as a third number;

determining the number of the approval objects contained in the at least two approval objects as a fourth number;

determining a first number ratio between the third number and the fourth number;

If the first quantity ratio is greater than the ratio threshold, determining that the multi-signature approval result of the transaction data is an approval passing result;

if the first quantity ratio is smaller than the ratio threshold, determining that the multi-signature approval result of the transaction data is an approval failure result.

In one embodiment, after the contract invoking module invokes the resource management contract associated with the master object to uplink the blinded transaction data, the blockchain-based data processing device further includes:

a reference request receiving module, configured to receive a reference request for original transaction data sent by a second slave object; the consulting request is used for requesting to consult the original transaction data;

the request sending module is used for sending the consulting request to at least two examination and approval objects;

the permission determining module is used for determining the reference permission of the second slave object on the original transaction data according to voting information returned by at least two approved objects;

and the notification sending module is used for sending a review permission notification to the second slave object when the second slave object is determined to have the review right of the original transaction data, so that the second slave object can review the original transaction data from the blockchain based on the review permission notification.

In one embodiment, the permission determining module determines a specific mode of the reference permission of the second slave object with respect to the original transaction data according to the voting information returned by at least two approved objects, including:

counting the passing number of voting passing information in voting information returned by at least two examination and approval objects;

counting the total number of the approval objects contained in the at least two approval objects;

determining a second number ratio between the number of passes and the total number;

if the second quantity ratio is determined to be larger than the ratio threshold, determining that the second slave object has the reference authority of the original transaction data;

if the second quantity ratio is smaller than the ratio threshold, the second slave object is determined to have no reference authority of the original transaction data.

In one embodiment, the blinded transaction data is obtained by blinding the original transaction data based on a blinded encryption key;

the notification sending module sends a specific mode of allowing to consult the notification to the second slave object when determining that the second slave object has the consulting authority of the original transaction data, and the specific mode comprises the following steps:

generating a key inquiry request when the second slave object is determined to have the reference right of the original transaction data; the key inquiry request is used for requesting to acquire a blinded decryption key of the blinded transaction data;

Sending the key inquiry request to a target approval object in at least two approval objects; the target approval object refers to any one of at least two approval objects;

receiving a blinded decryption key of blinded transaction data returned by the target approval object, generating a notification of allowing reference containing the blinded decryption key, and sending the notification of allowing reference to the second slave object; the blind decryption key is used for decrypting the blind transaction data acquired from the blockchain by the second slave object to obtain the original transaction data.

In one aspect, an embodiment of the present application provides a computer device, including: a processor and a memory;

the memory stores a computer program that, when executed by the processor, causes the processor to perform the methods of embodiments of the present application.

In one aspect, embodiments of the present application provide a computer-readable storage medium storing a computer program, the computer program comprising program instructions that, when executed by a processor, perform a method according to embodiments of the present application.

In one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program stored in a computer readable storage medium. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program to cause the computer device to perform a method provided in an aspect of an embodiment of the present application.

In the embodiment of the application, a scheme of a resource management contract for a main object is provided, and the scheme protects the security and privacy of different transaction data in the main object in a multi-dimensional way through blind signature and multiple signatures. Specifically, for the original transaction data in the main object, after blinding processing can be performed on the original transaction data to obtain blinded transaction data, blind signature processing is performed on the received blinded transaction data by using a signature key of the main object layer to obtain blind signature information; further, after verifying the validity of the blind signature information, at least two approval objects (each approval object has approval authority of the blind transaction data and each approval object has a subordinate relationship with the main object) may be adopted to perform multiple signature approval on the blind transaction data, and after determining that the multiple signature approval result is an approval passing result, the resource management contract related to the main object is called to perform uplink processing on the blind transaction data. It should be understood that by performing blind processing on the original transaction data and then performing blind signature processing on the blind transaction data based on the signature key of the main object, the specific content of the original transaction data in the main object can be known only by the transaction initiator, other non-transaction initiators in the main object can not know the specific content of the original transaction data, and only the blind transaction data of the original transaction data can be determined to be approved by the signature of the main object, so that the privacy of the original transaction data can be well protected, the risk of malicious leakage of the original transaction data is reduced, and then the security of the original transaction data can be improved; in addition, for the blind transaction data approved by the signature of the main object, the blind transaction data can be subjected to multiple signature approval by an approval object with approval authority, and the blind transaction data can be subjected to multiple signature approval to be uplink, so that the reliability of the blind transaction data can be further improved through multiple signature approval. In summary, the application can improve the security and privacy of transaction data in the business of storing related transaction data in the main object based on the blockchain.

Drawings

In order to more clearly illustrate the embodiments of the application or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a diagram of a network architecture according to an embodiment of the present application;

FIG. 2 is a schematic diagram of multiple signature approval of transaction data according to an embodiment of the present application;

FIG. 3 is a flowchart of a block chain based data processing method according to an embodiment of the present application;

FIG. 4 is a schematic diagram of a system architecture according to an embodiment of the present application;

FIG. 5 is a schematic flow chart of a method for obtaining multiple signature approval results by multiple signature approval of transaction data according to an embodiment of the present application;

FIG. 6 is a flow chart of a system logic interaction provided by an embodiment of the present application;

FIG. 7 is a schematic diagram of a block chain based data processing apparatus according to an embodiment of the present application;

fig. 8 is a schematic structural diagram of a computer device according to an embodiment of the present application.

Detailed Description

The following description of the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

The method provided by the embodiment of the application relates to related technologies of blockchain and the like, and for convenience of understanding, the blockchain and the related technologies thereof are preferentially described below:

1. blockchain: in a narrow sense, the blockchain is a chain data structure taking a block as a basic unit, and the block uses a digital abstract to verify the transaction history acquired before, so that the blockchain is suitable for the requirements of tamper resistance and expandability in a distributed accounting scene; in a broad sense, blockchain also refers to distributed accounting techniques implemented by blockchain structures, including distributed consensus, privacy and security protection, point-to-point communication techniques, network protocols, smart contracts, and the like. The goal of the blockchain is to implement a distributed data logging ledger that allows only additions and not deletions. The basic structure of the ledger floor is a linear linked list. The linked list is formed by serially connecting blocks, the Hash value of the preceding block is recorded in the following blocks, and whether each block (and the transaction in the block) is legal or not can be rapidly checked by calculating the Hash value. If a node in the network proposes to add a new block, a consensus acknowledgement must be made for the block via a consensus mechanism.

2. Blockchain nodes: the blockchain network distinguishes nodes as consensus nodes (which may also be referred to as core nodes), data nodes, or light nodes. Wherein, the consensus node is responsible for the consensus service of the whole block chain network; the data node or the light node is responsible for synchronizing the account information of the consensus node, i.e. synchronizing the latest block data. Whether a consensus node or a data node (or a light node), its internal architecture includes network communication components, since the blockchain network is essentially a point-to-point network, it is necessary to communicate with other nodes in the blockchain network through the relevant components. Resources and services in the blockchain network are distributed on each node, and information transmission and service realization are directly carried out between the nodes without intervention of an intermediate link or a centralized server (third party).

3. Public key (public key) and private key (private key): the public key and the private key are a key pair (namely a public key and a private key) obtained through an algorithm, the public key is a public part of the key pair, and the private key is a non-public part. Public keys are commonly used to encrypt data, verify digital signatures, and the like. By means of this algorithm it is ensured that the resulting key pair is unique, and when using this key pair, if one of the keys is used to encrypt a piece of data, it must be decrypted with the other key, e.g. the public key is used to encrypt the data, and if the private key is used, it must be decrypted with the public key, otherwise the decryption will not succeed.

4. Hash value: also called information characteristic value or eigenvalue, hash value is generated by converting input data of arbitrary length into a password by hash algorithm and performing fixed output, and original input data cannot be retrieved by decrypting the hash value, which is a one-way encryption function. In the blockchain, each block (except the initial block) contains the hash value of the successor block, which is referred to as the parent block of the current block. Hash value is the potential core foundation and most important aspect in blockchain technology, which preserves the authenticity of the recorded and viewed data, as well as the integrity of the blockchain as a whole.

5. Smart Contract: is a computer protocol that aims to propagate, verify or execute contracts in an informative manner. In a blockchain system, a smart contract (abbreviated as contract) is a code that can be understood and executed by each node of the blockchain, and can execute any logic and obtain a result. In practice, smart contracts are managed and tried through transactions on the blockchain. Each transaction corresponds to a remote procedure call (Remote Procedure Call, RPC) request to the blockchain system. If the smart contract is said to be equivalent to an executable program, the blockchain is said to be equivalent to an operating system that provides a runtime environment. The blockchain may contain multiple contracts, distinguished by contract account numbers (IDs), identification numbers, or names. For example, the intelligent contracts may include governance committee contracts that are primarily used to manage consensus nodes, which may include recording node states of consensus nodes, dynamically joining consensus nodes, eliminating abnormal consensus nodes, and so forth.

Referring to fig. 1, fig. 1 is a network architecture diagram according to an embodiment of the present application. As shown in fig. 1, the network architecture may include a cluster of end devices 10 and a blockchain network, which may include a cluster of core nodes (consensus nodes) 1000, data nodes, or light nodes 100. The core node cluster 1000 may include at least two core nodes and the data node cluster 100 may include at least two data nodes. As shown in fig. 1, the core node cluster 1000 may include a core node 1000a, core nodes 1000b, …, and a core node 1000n, the data node cluster 100 may include a data node 100a, a data node 100b, …, and a data node 100n, and the terminal device cluster 10 may include a terminal device 10a, a terminal device 10b, …, and a terminal device 10n.

As shown in fig. 1, the terminal device 10a, the terminal devices 10b, …, and the terminal device 10n may respectively perform network connection with the data node 100a, the data nodes 100b, …, and the data node 100n, so that the terminal device may perform data interaction with the data node through the network connection; the data node 100a, the data nodes 100b, … and the data node 100n can respectively perform network connection with the core node 1000a, the core nodes 1000b, … and the core node 1000n, so that the data node can perform data interaction with the core node through the network connection; the data nodes 100a, 100b, … and 100n are connected to each other so that data interaction can be performed between the data nodes, and the core nodes 1000a, 1000b, … and 1000n are connected to each other so that data interaction can be performed between the core nodes.

Taking the terminal device 10a, the data node 100a and the core node 1000a as an example, the data node 100a may receive a transaction service request (the transaction service request carries an ID or a name of an intelligent contract) sent by the terminal device 10a, and then the data node 100a may send the transaction service request to the core node 1000a through the data node cluster 100; the core node 1000a may run the smart contract, execute the transaction service through the smart contract, obtain an execution result, store the execution result in a memory pool (e.g., a transaction pool), and generate a new block according to the execution result; the core node 1000a may then send the newly generated blocks to other core nodes in the blockchain network according to the node identifiers of the other core nodes (i.e. consensus nodes) in the blockchain network, and the other core nodes check (i.e. perform consensus) the newly generated blocks, and after checking, add the newly generated blocks to the blockchain in which they are stored (i.e. store the execution result into the blockchain after the consensus passes). Each core node in the blockchain network has a node identifier corresponding to the core node, and each core node in the blockchain network can store node identifiers of other core nodes in the blockchain network, so that the generated blocks can be broadcast to other core nodes in the blockchain network according to the node identifiers of other core nodes later, and data stored on all core nodes in the blockchain network are consistent.

The terminal device shown in fig. 1 may be a desktop terminal or a mobile terminal used by a business party generating transaction information, and may be an intelligent terminal carrying a data processing function, such as a smart phone, a tablet computer, a notebook computer, a desktop computer, an intelligent television, an intelligent sound box, a desktop computer, an intelligent watch, and an intelligent vehicle-mounted terminal, but is not limited thereto. After the user authorization, the transaction information (transaction data) generated by the terminal equipment can be transmitted to the consensus node through the data node or the light node, and the consensus node can record the transaction information (transaction data) generated by the terminal equipment on the blockchain. Any data node in the data node cluster 100 may be implemented by an independent server or a server cluster formed by a plurality of servers, and any core node in the core node cluster 1000 may be implemented by an independent server or a server cluster formed by a plurality of servers.

It is understood that the transaction service of the terminal device can be understood as transaction data, and the main form of storing the transaction data for the blockchain is as follows: the transaction data is transmitted to the consensus node in the form of relay baton, the consensus node performs transaction verification on the received transaction data, the received transaction data can be added into a own transaction pool after the transaction verification is passed, the consensus node can broadcast the transaction data to other consensus nodes of the blockchain after the transaction data is added into the own transaction pool, the other consensus nodes can verify the transaction data, then the transaction data is verified, and the transaction data can be added into the own transaction pool after the verification is passed. Further, for each consensus node, upon receiving the out-of-block signal (the out-of-block signal may be an out-of-block signal sent by a specified timer or an out-of-block signal sent by a transaction pool), the consensus node may obtain a batch of transaction data from the transaction pool to perform a packed out-of-block (i.e., a packed transaction data generation block), and for the generated block, broadcast to each consensus node is required, so that all the consensus nodes perform a consensus check on the newly generated block, and after passing through the consensus of each consensus node, the block may be added to the blockchain.

It should be appreciated that, because the blockchain has characteristics of openness, transparency, data consistency, and the like, the blockchain has been applied in a plurality of fields, for example, in fields of finance, medical treatment, insurance, and the like, related financial enterprises (such as banks), medical enterprises (such as medical institutions), and insurance enterprises all use intelligent contracts in the blockchain to manage resource services of the enterprises (the resource services herein may refer to funds transaction services generated in the enterprises), that is, the enterprises create an intelligent contract in the blockchain for managing the resource services of the enterprises, so that transaction data (such as resource export transactions, resource receiving transactions, resource mortgage transactions, and the like) in related resource transaction services generated in the enterprises can be stored, updated, and the like through the intelligent contract on the blockchain, and the resource management contract can also be understood as wallet contracts of the enterprises. However, by storing transaction data in the resource transaction service through the blockchain, each transaction data in the enterprise becomes public and transparent, which may risk the data being maliciously obtained and leaked in some scenes where high protection of data privacy and security is required. For example, for different transaction data generated by different departments in an enterprise, there may be a privacy requirement inside the departments, that is, the transaction data generated inside the departments may be known only to members inside the departments to refer, and members of other departments cannot refer to the transaction data. The transaction data among the departments may become public and transparent by means of the blockchain for storing the transaction data of each department in a public manner, and the transaction data which should be emphasized for privacy protection becomes known content, which may possibly cause malicious leakage of the transaction data, and is unfavorable for protecting the privacy and the security of the transaction data.

Based on this, the present application proposes a resource management contract (where the resource management contract may be a wallet contract of a pointer to the main object, which may specifically refer to an intelligent contract for managing resources (such as virtual diamond, virtual gold, etc.) in the main object) for a main object (where the main object may refer to any object having an organization form, for example, the main object may refer to an enterprise having an organization form, a group (such as a learning group having a multi-person organization form, an assessment group, etc.), a department (such as an electrical department having a multi-person organization form, a mechanical department, etc.), and by using the scheme provided by the present application, security and privacy of transaction data on which the resource management contract is up-link may be improved. Specifically, for a certain slave object (may refer to a certain object belonging to the master object, taking the master object as an example, the slave object may refer to transaction data (such as resource transaction data) generated in a certain department, a certain group or a certain team in the enterprise, etc.), if the slave object desires to highly protect the privacy of the transaction data, the slave object may perform blinding processing on the initiated resource transaction data (where blinding processing may refer to encryption processing on the resource transaction data), obtain the blinded transaction data, and then submit the blinded transaction data to an object device (which may refer to a computer device, which may refer to a terminal device or a server device) corresponding to the master object layer, through which the object device corresponding to the master object may obtain a signature key of the master object (for example, a private key of the master object), and perform blind signature processing on the received blinded transaction data by using the signature key of the master object, thereby obtaining blind signature information. It should be appreciated that, before the object device of the master object performs the blind signature processing on the blind transaction data, it needs to determine whether the blind transaction data is initiated by an object in the master object (specifically, it may be verified whether the slave object submitting the blind transaction data is an object in the master object, that is, whether the slave object is subordinate to the master object.

That is, after the slave object performs blind processing on the initiated original transaction data, the blind signature manner is performed on the blind transaction data by the master object, so that any object except the slave object initiating the transaction cannot acquire the transaction content of the original transaction data, and other slave objects in the master object cannot acquire the specific initiating object of the blind transaction data, thereby well protecting the privacy of the transaction initiating object, reducing the possibility that the original transaction data is maliciously acquired and leaked, and improving the privacy protection capability of the original transaction data.

Further, the blind signature information can be verified, at least two approval objects with approval authority in the slave objects can be obtained when the validity of the blind signature information is determined (each approval object can refer to an object with subordinate relation with the slave objects, for example, a master object is taken as an enterprise, the slave objects can refer to departments, groups or teams, the approval object here can refer to a member with approval authority in the departments, groups or teams), multiple signature approval can be performed on blind transaction data through approval signature keys (such as private keys of the approval objects) of the at least two approval objects, so that a multiple signature approval result can be obtained, and when the multiple signature approval result is an approval passing result, a resource management contract related to the master object can be called to perform uplink processing on the blind transaction data (that is, the blind transaction data is added into a blockchain).

It should be understood that multiple signature approval herein may refer to that multiple approval objects sign and approve the same transaction data (such as blind transaction data), that is, multiple approval objects have the signature right and approval right of the same transaction data, after all of the approval objects exceeding a threshold number of the multiple approval objects sign and approve and pass, it is determined that the transaction data can be executed (i.e., the multiple signature result of the transaction data is an approval passing result), and then the approval right of the transaction data can be dispersed through the multiple signature approval, so that the approval of the transaction data becomes more fair and reliable, and thus, the transaction data (such as blind transaction data) added to the chain can be promoted to have reliability.

For the convenience of understanding the specific process of multiple signature approval, please refer to fig. 2, fig. 2 is a schematic diagram of multiple signature approval for transaction data according to an embodiment of the present application. Wherein, multiple signatures refer to that a plurality of objects (such as users, institutions or program scripts) sign one transaction data at the same time, which can be simply understood as: the transaction data initiated by a plurality of persons to an account has signature rights and payment rights, if an account address can only be signed and paid by a private key, the expression form is 1/1; the multiple signature may be expressed in m/n (i.e., a total of n private keys may be used to sign an account, and when there are m signatures in the transaction data initiated by the account, the transaction data may be paid for.

The multiple signature shown in fig. 2 may refer to multiple signature with a representation form of 2/3, that is, the multiple signature system includes 3 objects, all of which can be used as approval objects and have the signature right (approval right) for the same transaction data, the multiple signature system corresponds to a slave object in the present application, the 3 approval objects in the slave object have the signature right (approval right) for the transaction data in the slave object, and then each approval object in the multiple signature system performs signature approval on the transaction data initiated by the object a1 (which may refer to a member in the slave object) after submitting to the multiple signature system. For example, as shown in fig. 2, assuming that the approval object b1 and the approval object b2 both perform signature approval on the transaction data, in the multi-signature system, there are 2 approval objects that perform signature approval, and the ratio is 2/3, and the transaction data can be executed.

It can be understood that in the application, a blind signature technology and a multiple signature technology are introduced in a resource management contract (wallet contract), and a signature key of a main object layer can be adopted to carry out blind signature on blind transaction data subjected to blind processing in the main object by the blind signature technology, so that for the main object layer, the original transaction data corresponding to the blind transaction data can be known to be submitted by a certain object in the main object, but for other objects in the main object, the specific submitted object of the original transaction data cannot be determined, and meanwhile, the specific content of the original transaction data cannot be acquired by other objects, thereby the privacy of the transaction data can be well protected; in addition, for the blind transaction data, multiple signature approval is performed on the blind transaction data by a plurality of approval objects, so that the reliability of the transaction data can be improved.

It will be appreciated that the terminal device of the present application may have a target application (i.e., an application client) installed therein, and that when the application client is running in the terminal device, data interaction may be performed with other blockchain nodes in the blockchain network shown in fig. 1. The application client may include, among other things, a multimedia client (e.g., a video client), an entertainment client (e.g., a game client), an educational client, a live client, etc. application client. The application client may be a stand-alone client, or may be an embedded sub-client integrated into a certain client (e.g., an educational client, a multimedia client, etc.), which is not limited herein. The block chain node in the present application may refer to a server, which may interact with a terminal device through an application in the terminal device (e.g., the server may receive service data (e.g., transaction data generated by a user) of the application in the terminal device, and the server may process and uplink the service data). The server may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, basic cloud computing services such as big data and artificial intelligence platforms.

It will be appreciated that the method provided by the embodiments of the present application may be performed by a computer device, including but not limited to a terminal device or a server (e.g., a service server). The blockchain node in the embodiments of the present application may be a computer device.

It should be noted that, in the specific embodiment of the present application, the related data related to the user information, the user data (such as the transaction information and the transaction data initiated by the user) and the like are all obtained by the user being manually authorized (i.e. by the user's consent). That is, when the above embodiments of the present application are applied to specific products or technologies, the methods and related functions provided by the embodiments of the present application are operated under the permission or agreement of the user (the functions provided by the embodiments of the present application may be actively started by the user), and the collection, use and processing of the related data need to comply with the relevant laws and regulations and standards of the relevant territories and regions.

For ease of understanding, the data processing method provided by the embodiment of the present application will be described in detail below with reference to the accompanying drawings. Referring to fig. 3, fig. 3 is a flowchart of a data processing method based on a blockchain according to an embodiment of the present application. The process may be performed by a computer device, which may be a terminal device as shown in fig. 1, or may refer to a server. As shown in fig. 3, the flow may include at least the following steps S101 to S104:

Step S101, blind signature processing is carried out on received blind transaction data by adopting a signature key of a main object, so as to obtain blind signature information; the blinded transaction data is obtained by blinding the original transaction data.

In the present application, a master object may refer to any object in an organization form, for example, a master object may refer to an enterprise in an organization form, a group (e.g., a study group in a multi-person organization form, an assessment group, etc.), a department (e.g., an electrical department in a multi-person organization form, a mechanical department, etc.), etc., and a signature key of a master object may refer to a key that can be used to characterize the identity of the master object, which key may be used to sign related transaction data (e.g., resource export transaction data, resource receipt transaction data, resource mortgage transaction data, etc.) within the master object, so the key may also be referred to as a signature key of the master object.

Specifically, the method and the device can utilize the characteristics of the public key and the private key in the blockchain to determine the signature key of the main object as the private key of the main object, so that the identity of the main object can be authenticated through the signature key address of the main object. Specifically, based on the characteristics of the blockchain, the private key can generate a public key through an encryption algorithm, the data encrypted by the private key can be decrypted through the public key, and the data encrypted by the public key can be decrypted through the private key. In this case, since the string used to characterize the public key is long, the first multi-bit (e.g., the first 20 bits) string of the public key is typically selected as the address of the public key, i.e., one public key can be mapped to an address, which can be called a signing key address. And based on the above, the private key is a non-public part, and the public key may refer to a public part, then the signature key address in the present application may also be used as a public content.

That is, in the present application, a master object, a slave object belonging to the master object (a slave object may refer to a certain object belonging to the master object, taking the master object as an example, a certain department, a group or a team in the enterprise, a slave object belonging to the slave object (a certain department in the slave object as an example, a certain member in the department, the object may refer to) may all have a public key and a private key, while the present application may construct a key management system for the master object, where a signature key address of the master object, a signature key address of the slave object, and signature key addresses of respective approval objects in the slave object may all be registered, so that identity authentication may be performed on different objects based on the respective signature key addresses registered in the key management system later. For example, the identity of the master object may be authenticated by the signature key address of the master object in the key management system, the identity of the slave object may be authenticated by the signature key address of the slave object in the key management system (whether the slave object belongs to the master object may be ensured by the identity authentication of the slave object), and the signature key address of the different approval objects may be authenticated by the key management system. The approval object herein may refer to an object having approval authority of transaction data from the object, for example, for a group in an enterprise from the object, any resource transaction generated in the group needs to be approved by two group owners and two subgroup owners, and then the object having approval authority in the group may be the four members, and the four members may be all used as the approval objects in the group. In other words, each slave object includes a different approval object, and the approval object refers to an object (member) having approval authority of transaction data in the slave object.

Based on the above, the present application needs to register the signing key address related to the main object in the key management system of the main object, so that each signing key address registered in the key management system can be used to verify the identity of different objects in the following process, so as to ensure that the transaction data generated in the following process are all the transaction data initiated inside the main object. That is, the present application should also perform the step of registering the key associated with the master object before blind signature processing is performed on the received blind transaction data using the trusted signing key of the master object to obtain blind signature information. Specifically, the key management system may be disposed in an object device corresponding to the master object, and then a certain object (such as a certain object with management authority of the master object) in the master object may send a key registration request for the master object to the key management system, where the key registration request may include an association key of the master object, where the association key of the master object may include a signature key address of the master object, a signature key address of one or more slave objects (each of the one or more slave objects refers to an object subordinate to the master object), and a signature key address of at least two approval objects, where the at least two approval objects may refer to an approval object in each slave object, that is, when performing key registration, the signature key address of each slave object may be registered, or the signature key address of each approval object in the slave objects may be registered. That is, at least two of the approval objects may refer to the approval object included in a certain slave object, or may refer to all of the approval objects included in all of the slave objects.

After receiving the key registration request for the master object, the key management system may register the signing key address of the master object, the signing key addresses of one or more slave objects, and the signing key addresses of at least two approval objects in the key management system related to the master object based on the key registration request. Thus, it is possible to search, by each signing key address registered in the key management system, which of the slave objects belong to the master object and which of the approval objects belong to the slave objects under the master object.

It may be appreciated that after registering the related key of the master object in the key management system, different slave objects in the master object may submit transaction data (such as resource transaction data) to the master object, and in order to promote the privacy of the submitted transaction data, the slave object submitting the transaction data may perform blinding processing on the transaction data (blinding processing may be understood as encryption processing, so that the transaction data is transmitted from plaintext to ciphertext), where the transaction data of the slave object that is not subjected to blinding processing may be referred to as original transaction data, the transaction data of the slave object that is subjected to blinding processing may be referred to as blinded transaction data, and the submitted slave object to the master object may be referred to as blinded transaction data, so that the original transaction data may not be plaintext to be transmitted. In addition, in order to improve the transmission security of the transaction data, for the blinded transaction data after the blinding processing, before the blinded transaction data is sent to the main object, the signature of the blinded transaction data can be signed based on the private key of the slave object sending the transaction data, and after the blind signature data is received by the main object, the signature can be checked by the signature key address of the slave object registered in the key management system to verify the identity of the slave object (verify whether the slave object belongs to the slave object), after the verification is passed, the signature key (such as the private key) of the main object can be adopted to sign the blinded transaction data, so as to obtain blind signature information.

Specifically, taking a slave object sending blind transaction data as a first slave object as an example, a specific implementation manner of performing blind signature processing on received blind transaction data by adopting a signature key of a master object to obtain blind signature information may be: the method may include receiving blinded transaction data transmitted by a first slave object; the above mentioned knowledge that the blind transaction data may carry transaction signature information, where the transaction signature information is obtained by signing the blind transaction data based on a first key to be verified of the first slave object (that is, a key for signing the blind transaction data, which may be referred to as a first verification key in the present application); the first slave object refers to any slave object subordinate to the master object; further, a signing key address of a first slave object registered in a key management system related to the master object may be determined as a first signing key of transaction signing information; the transaction signature information can be subjected to signature verification processing through the first signature verification key, so that a first signature verification result can be obtained; when the first signature verification result is determined to be a signature verification passing result, the first key to be verified can be determined to be a legal signature key of the first slave object (for example, the first key to be verified can be determined to be a private key of the first slave object), a blind signature component can be invoked, and the signature key of the master object (such as the private key of the master object) can be adopted in the blind signature component to perform blind signature processing on the received blind transaction data, so that blind signature information can be obtained.

Step S102, verifying validity of the blind signature information.

In the application, blind transaction data submitted by a first slave object is subjected to blind signature processing at a master object layer and then is required to be sent to at least two examination and approval objects in the first slave object, and the at least two examination and approval objects perform blind elimination processing and then perform multiple signature examination and approval on the blind transaction data. It is necessary to verify the validity of the blind signature information before multiple signature approval is performed to ensure that the blind transaction data is subject to approval.

Specific implementation modes for verifying the validity of the blind signature information can be as follows: the multi-signature component can be called, and the signature key address of the registered main object can be acquired from a key management system related to the main object through the multi-signature component; further, the signing key address of the main object may be determined as a second signing key of the blind signing information; the second signing verification key can be used for signing verification processing of the blind signature information, so that a second signing verification result can be obtained; when the second signature verification result is determined to be a signature verification passing result, the validity of the blind signature information can be determined; and when the second signature verification result is determined to be the signature verification failure result, the blind signature information can be determined to have invalidity.

It should be understood that when the second signature verification result is a signature verification passing result, it can be determined that the blind signature information is indeed signed by the private key of the master object, so that it can be determined that the blind transaction data submitted by the second slave object is approved by the master object layer, and then multiple signature approval can be performed on the blind transaction data by at least two approval objects in the first slave object.

Step S103, when the validity of the blind signature information is determined, multiple signature approval is carried out on the blind transaction data by adopting approval signature keys of at least two approval objects; at least two approval objects have approval rights of blinded transaction data, and a subordinate relationship exists between the main object and each of the at least two approval objects.

In the application, when the validity of the blind signature information is determined, the multiple signature component can be called, and the multiple signature component can adopt at least two approval signature keys (such as private keys of approval objects) of the approval objects to carry out multiple signature approval on the blind transaction data so as to obtain a multiple signature approval result.

Step S104, when the multi-signature approval result of the blind transaction data is determined to be an approval passing result, invoking a resource management contract related to the main object to perform uplink processing on the blind transaction data.

In the application, only when the multi-signature approval result of the blind transaction data is determined, the resource management contract related to the main object can be called to carry out the uplink processing on the blind transaction data. Specifically, for the blind transaction data subjected to multiple signature approval, the resource management contract can add the blind transaction data into the transaction pool, acquire a batch of transaction data including the blind transaction data from the transaction pool, package the batch of transaction data to generate a block, and add the block into the blockchain.

It can be appreciated that, for the blind transaction data stored in the blockchain, the blind signature information can determine that the blind transaction data is signed by the main object, but cannot know which object in the main object the blind transaction data is initiated, so that the privacy of the transaction data can be ensured; meanwhile, because the blind transaction data is subjected to the blind processing, even if other objects in the main object can acquire the blind transaction data from the blockchain, specific transaction contents cannot be decrypted (namely, the original transaction data cannot be acquired). For the original transaction data corresponding to the blind transaction data, only after the permission of the transaction initiating object (namely the first slave object) is acquired, the original transaction data can be disclosed to some other object for reference.

For example, assuming that a second slave object within the master object desires to review the original transaction data of the blinded transaction data, the second slave object requires consent via the first slave object. That is, after the blinded transaction data is subjected to the uplink processing by calling the resource management contract related to the master object, if the second slave object wants to refer to the original transaction data, the second slave object may send a refer request for the original transaction data to the object device of the master object (refer request is used for requesting to refer to the original transaction data), and after receiving the refer request for the original transaction data sent by the second slave object, the refer request may be sent to at least two approval objects (that is, the object with approval authority in the first slave object); each of the at least two approval objects may vote on the review request to vote whether the second slave object is permitted to review the original transaction data, each approval object may return its own voting information (the voting information may include voting passing information and voting failing information, the voting passing information may be used to characterize that the approval object agrees to review the original transaction data by the second slave object; according to the voting information returned by at least two approval objects, the reference authority of the second slave object about the original transaction data can be determined; when the second slave object is determined to have the reference right of the original transaction data, a reference permission notification can be sent to the second slave object, so that the second slave object refers to the original transaction data in the slave blockchain based on the reference permission notification.

The specific implementation manner of determining the reference authority of the second slave object about the original transaction data according to the voting information returned by at least two approved objects may be: in the voting information returned by at least two examination and approval objects, the passing number of the voting passing information can be counted; further, the total number of approval objects contained by the at least two approval objects may be counted; a second number ratio between the number of passes and the total number may be determined; if the second quantity ratio is determined to be larger than the ratio threshold, determining that the second slave object has the reference authority of the original transaction data; if the second number ratio is smaller than the ratio threshold, it may be determined that the second slave object does not have the reference authority of the original transaction data.

In other words, if the voting information of up to a certain number of the approval objects is voting passing information in at least two approval objects, it may be stated that a certain number of the approval objects agree that the second slave object refers to the original transaction data, and it may be determined that the second object has the reference authority of the original transaction data. The ratio threshold herein may refer to a manually determined threshold (e.g., 2/3, 60%, etc.).

Further, based on the foregoing, the blinded transaction data is obtained by performing a blinding process on the original transaction data, where the blinding process may refer to a specific manner of performing an encrypting process on the original transaction data, and the encrypting process on the original transaction data may be performed by using a pair of key pairs, specifically, the first slave object may generate a pair of keys based on a symmetric key algorithm or an asymmetric key algorithm, and may generate a symmetric key pair using the symmetric key algorithm (an encryption key and a decryption key in the key pair are consistent); a pair of asymmetric key pairs (the encryption key and decryption key of the key pair being asymmetric) may be generated using an asymmetric key algorithm. The first slave object can save the encryption key (i.e. the blinded encryption key in the application) and the decryption key by itself, and when the second slave object is determined to have the reference right of the original transaction data, the second slave object can be informed of the decryption key of the blinded transaction data (i.e. the blinded decryption key in the application), so that the second slave object can decrypt the blinded transaction data based on the decryption key to obtain the original transaction data.

Specifically, the present application may refer to the encryption key of the original transaction data as a blinded encryption key, and the decryption key of the original transaction data as a blinded decryption key, that is, the blinded transaction data is obtained after blinding the original transaction data based on the blinded encryption key, and for the specific implementation manner of sending the notification of permission to refer to the second slave object when determining that the second slave object has the reference right of the original transaction data may be: when the second slave object is determined to have the reference right of the original transaction data, a key inquiry request can be generated; the key inquiry request is used for requesting to acquire a blinded decryption key of the blinded transaction data; further, a key query request may be sent to a target approval object of the at least two approval objects; wherein the target approval object refers to any one of at least two approval objects; further, a blinded decryption key of blinded transaction data returned by the target approval object can be received, an allowed reference notification containing the blinded decryption key is generated, and the allowed reference notification can be sent to the second slave object; the blind decryption key is used for decrypting the blind transaction data acquired from the blockchain by the second slave object to obtain the original transaction data.

In the embodiment of the application, a scheme of a resource management contract for a main object is provided, and the scheme protects the security and privacy of different transaction data in the main object in a multi-dimensional way through blind signature and multiple signatures. Specifically, for the original transaction data in the main object, after blinding processing can be performed on the original transaction data to obtain blinded transaction data, blind signature processing is performed on the received blinded transaction data by using a signature key of the main object layer to obtain blind signature information; further, after verifying the validity of the blind signature information, at least two approval objects (each approval object has approval authority of the blind transaction data and each approval object has a subordinate relationship with the main object) may be adopted to perform multiple signature approval on the blind transaction data, and after determining that the multiple signature approval result is an approval passing result, the resource management contract related to the main object is called to perform uplink processing on the blind transaction data. It should be understood that by performing blind processing on the original transaction data and then performing blind signature processing on the blind transaction data based on the signature key of the main object, the specific content of the original transaction data in the main object can be known only by the transaction initiator, other non-transaction initiators in the main object can not know the specific content of the original transaction data, and only the blind transaction data of the original transaction data can be determined to be approved by the signature of the main object, so that the privacy of the original transaction data can be well protected, the risk of malicious leakage of the original transaction data is reduced, and then the security of the original transaction data can be improved; in addition, for the blind transaction data approved by the signature of the main object, the blind transaction data can be subjected to multiple signature approval by an approval object with approval authority, and the blind transaction data can be subjected to multiple signature approval to be uplink, so that the reliability of the blind transaction data can be further improved through multiple signature approval.

Further, for easy understanding, please refer to fig. 4, fig. 4 is a schematic diagram of a system architecture according to an embodiment of the present application. As shown in fig. 4, the system architecture may include at least a client, a blind signature component, a multiple signature component, a verification component, and a blockchain network. For ease of understanding, the various components of the system architecture will be described as follows:

client side: may refer to a client (e.g., a client in a master object) for an object (e.g., a user) to initiate transaction data or to initiate a transaction request, where a user interaction interface may be provided through which a transaction (e.g., a resource transfer transaction) may be initiated. The client may also be configured to blindly process the initiated transaction data to obtain blinded transaction data, and may sign the blinded transaction data based on a signature key of a transaction initiating object (e.g., a slave object).

Blind signature component: the encryption machine deployed in the main object (such as enterprises and institutions) can be responsible for storing the signing key of the main object, and blind signing is carried out on transaction data submitted by the client by adopting the signing key of the main object to generate blind signature information.

Multiple signature component: the method can be used for verifying the blind signature information and performing multiple signature approval on the blind transaction data to generate multiple signature information.

And (3) an authentication component: can be used to verify the validity of the multi-signature information (i.e., to determine whether the multi-signature approval result is an approval passing result, which is equivalent to the validity of the multi-signature information).

Block chain network: may be responsible for receiving and recording transaction data (e.g., blinded transaction data).

For the specific implementation manner of each component, no detailed description will be given here, and the drawings provided in this embodiment are only logic flows for more clearly describing each step in the present application.

Further, referring to fig. 5, fig. 5 is a schematic flow chart of obtaining a multiple signature approval result by performing multiple signature approval on transaction data according to an embodiment of the present application, where the flow chart may correspond to the flow chart of obtaining a multiple signature approval result by performing multiple signature approval on blind transaction data using approval signing keys of at least two approval objects in the embodiment corresponding to fig. 3. The flow is based on the flow described by the basis that the blinded transaction data is sent by the first slave object (the first slave object refers to any slave object that is slaved to the master object). As shown in fig. 5, the flow may include at least the following steps S501 to S506:

Step S501, calling a multiple signature component, and acquiring at least two approval objects with approval authorities of blind transaction data through the multiple signature component; at least two approval objects are each subordinate to the first slave object.

Specifically, when the validity of the blind signature information is determined, a multiple signature component may be invoked, through which at least two approval objects with approval authority of the blind transaction data (i.e., at least two approval objects with approval authority of the original transaction data in the first slave object) may be obtained.

Step S502, the blind transaction data is sent to at least two approval objects, so that the at least two approval objects adopt at least two approval signing keys to carry out multi-signature approval on the blind transaction data; one of the at least two approval objects is provided with one of the at least two approval signing keys.

Specifically, the multiple signature component may send the blinded transaction data to at least two approval objects, where each approval object may sign and approve the blinded transaction data, and specifically, the blinded transaction data may be obtained after blinding processing by using a blinded encryption key, where each approval object in the first slave object may have a blinded decryption key, and then each approval object may decrypt the blinded transaction data by using the blinded decryption key, and sign and approve the blinded transaction data after obtaining the original transaction data. Wherein an approval object may possess a signing key (e.g., private key), and signature approval of the approval object may refer to signing the blinded transaction data with the signing key. That is, the present application specifically may send the blinded transaction data to at least two approval objects, and then perform multiple signature approval on the blinded transaction data by using at least two approval signing keys through at least two approval objects. For multiple signature approval of blind transaction data by at least two approval subjects using at least two approval signing keys, see the description of the subsequent steps S503-S506.

Step S503, receiving multiple signature information returned by at least two approval objects; the multiple signature information comprises N approval signature information; at least two approval objects including approval object S _i The N approval signature information comprises an approval object S _i Corresponding approval signature information S _i Approval of signature information S _i Is based on approval object S _i The second key to be verified is obtained after the blind transaction data is signed; i. n is a positive integer.

Specifically, after approval objects agreeing to execute the original transaction data can sign and approve the blind transaction data, approval signature information can be obtained, and if at least two approval objects are signed, N (N is a positive integer) approval signature information can be obtained, and multiple signature information can be generated by the N approval signature information. That is, the at least two approval objects may return a multiple signature information, where the multiple signature information includes N pieces of approval signature information, each piece of approval signature information is obtained by an approval object, and blind transaction data is performed by using a signature keyThe key that is included in the approval signature information and that signs the blinded transaction data may be referred to herein as the second key to be verified. For ease of illustration, the at least two approval objects will be included in the approval object S _i (which may refer to any one of the signed approval objects), the N approval signature information includes an approval object S _i Corresponding approval signature information S _i For the purposes of illustration, i.e. approval of the signature information S _i Is based on approval object S _i Is obtained after the second key to be verified signs the blinded transaction data.

Step S504, signing information S of the trial batch _i Validity verification is carried out to obtain approval signature information S _i Is a result of validity verification of (a).

Specifically, for each approval signature information in the multiple signature information, validity verification needs to be performed on the approval signature information to determine validity of the approval signature information. To approve the signature information S _i For example, for approval signature information S _i Validity verification is carried out to obtain approval signature information S _i The specific way of the validity verification result of (a) can be as follows: the approval object S registered in the key management system related to the main object can be used _i Is determined as approval signature information S _i A third signing key of (2); the third signing key can sign the trial batch of signature information S _i Performing signature verification processing, so that a third signature verification result can be obtained; when the third signature verification result is determined to be the signature verification passing result, the second key to be verified can be determined to be the approval object S _i The legal signature key of (2) can further determine approval signature information S _i The validity verification result of (a) is a valid signature result; when the third verification result is determined to be the verification failure result, the second key to be verified can be determined to be the approval object S _i To determine approval signature information S _i The validity verification result of (a) is an invalid signature result.

It should be appreciated that, based on the corresponding embodiments described above, the signing key address of each of the approval objects registered in the key management system is a baseAs derived from the public key, a signing key address may be mapped to a public key, and thus the signing key address of the approval object may be determined as the public key of the approval object, and the approval signing information S may be obtained by using the public key _i Checking the signature, if the signature passes, determining the second key to be verified as the approval object S _i Legal signature key of (i.e. the second key to be verified is indeed the approval object S _i Private key of (a), whereby the approval signature information S can be used _i The validity verification result of (a) is a valid signature result; otherwise, the signature information S can be approved _i The validity verification result of (a) is an invalid signature result.

In step S505, if the validity verification result of each of the N approval signature information is determined, the validity of the multiple signature information is determined based on the N validity verification results.

Specifically, the verification approval signature information S is adopted _i The validity of each approval signature information in the multiple signature information can be verified, so that a validity verification result of each approval signature information in the N approval signature information can be obtained, and the validity of the multiple signature information can be determined based on the N validity verification results, and the specific implementation method can be as follows: a first number of valid signature results included in the N validity verification results may be counted; further, a second number of validity verification results included in the N validity verification results may be counted; the first number may be compared to the second number; if the first number is determined to be the same as the second number, the multiple signature information can be determined to be valid; if the first number is different from the second number, the multiple signature information can be determined to be invalid.

It will be appreciated that the multiple signature information may be considered valid only if all of the N approval signature information contained in the multiple signature information is valid. That is, there should not be any trial object in the multi-signature information to sign the blinded transaction data using an illegal key.

In step S506, when the validity of the multiple signature information is determined, multiple signature approval results of the transaction data are determined according to the number of approval signature information contained in the N approval signature information and the number of approval objects contained in the at least two approval objects.

Specifically, when the validity of the multiple signature information is determined, the multiple signature approval result of the transaction data can be determined according to the number of approval signature information contained in the N approval signature information and the number of approval objects contained in at least two approval objects, and the specific implementation manner of the multiple signature approval result may be as follows: the number of approval signature information included in the N pieces of approval signature information may be determined as the third number; the number of approval objects included in the at least two approval objects may be determined as a fourth number; further, a first number ratio between the third number and the fourth number may be determined; if the first quantity ratio is greater than the ratio threshold, determining that the multi-signature approval result of the transaction data is an approval passing result; if the first quantity ratio is smaller than the ratio threshold, the multi-signature approval result of the transaction data can be determined to be an approval failure result.

It may be understood that the N approval signature information may refer to information obtained by signing an approval object agreeing to execute the original transaction data, and if a number ratio between the third number of the N approval signature information and the fourth number (i.e., the total number) of the at least two approval objects is greater than a ratio threshold, it may be determined that the approval objects reaching a certain threshold agree to execute the original transaction data, thereby determining that the multiple signature approval result is an approval passing result; otherwise, the multiple signature result is determined to be an approval failing result.

In the embodiment of the application, the original transaction data is subjected to blind signature processing and then subjected to blind signature processing based on the signature key of the main object, so that the specific content of the original transaction data in the main object can only be known by a transaction initiator, other non-transaction initiators in the main object can not know the specific content of the original transaction data, and only the blind transaction data of the original transaction data can be confirmed to be approved by the main object signature, thereby the privacy of the original transaction data can be well protected, the risk of malicious leakage of the original transaction data is reduced, and then the safety of the original transaction data can be improved; in addition, for the blind transaction data approved by the signature of the main object, the blind transaction data can be subjected to multiple signature approval by an approval object with approval authority, and the blind transaction data can be subjected to multiple signature approval to be uplink, so that the reliability of the blind transaction data can be further improved through multiple signature approval.

Further, referring to fig. 6, fig. 6 is a system logic interaction flow chart according to an embodiment of the present application. The embodiment shown in fig. 6 is a flow of an explanation taking a master object as an enterprise and a slave object as a certain department in the enterprise as an example. As shown in fig. 6, the flow may include at least the following steps S61 to S68:

in step S61, the user registers the department key in the key management system.

Specifically, a user in a department may register a department key in the key management system, where the department key may refer to a key used by an internal department of the enterprise, and the department key registered in the key management system may identify the department as transaction data within the enterprise when submitting the transaction data. The key management system can be deployed in an enterprise private network, a user (a management object in an enterprise) can register multiple signature addresses (namely, signature key addresses of various approval objects in departments) and blind signature addresses (signature key addresses in an enterprise layer, which can be specifically distributed to the enterprise through a hardware cryptographic machine) into the key management system, and the user in the departments registers a department key (signature key address of a department) into the key management system.

Step S62, the user fills in the transaction request through the wallet client to initiate the transaction.

Specifically, the wallet client may refer to a client for initiating transaction data in an enterprise, and a user interaction interface may be provided to enable a user to fill in a transaction request to initiate transaction data in the user interaction interface.

Step S63, the wallet client blinds the transaction data and forwards the blinded transaction data to the key management system.

Specifically, the wallet client may determine the transaction data initiated by the user as the original transaction data, the client may blindly obtain the blinded transaction data, and for the blinded transaction data, the client may sign the blind transaction data based on a signing key (e.g., a private key) of the department.

In step S64, the key management system performs blind signature processing on the blind transaction data.

Specifically, the key management system can verify the signature of the blinded transaction data (i.e. verify the signature of the signing key of the department, that is, verify the signature of the department based on the signing key address of the department registered in the key management system), after the verification passes, the transaction data can be known to be the transaction submitted by the enterprise, and the key management system can use the signing key (such as the private key) of the enterprise to perform blind signature processing on the blinded transaction data to obtain blind signature information. For this blind signature information, it can be determined that the signature is at the enterprise level (such as the signature of the enterprise manager), but it cannot be determined by which department the signed transaction data is submitted in particular, so that the privacy of the department traffic can be well protected.

In step S65, the key management system transmits the blinded transaction data to the transaction approval object.

Specifically, the key management system may send the blinded transaction data to a plurality of approval objects within the department, requiring multiple signature approval by the plurality of approval objects.

Step S66, the transaction approval object performs multiple signature approval to generate multiple signature information.

Specifically, the approval object agreeing to the transaction execution can adopt its own approval signing key (such as private key) to sign the approval object, so that approval signing information can be obtained, and multiple signing information containing multiple approval signing information can be obtained after signing the approval objects agreeing to the transaction execution.

In step S67, the transaction approval object sends the multi-signature information and the transaction data to the wallet contract.

Specifically, the wallet contract herein may refer to an intelligent contract (such as a resource management contract) for managing resources of an enterprise, where the wallet contract may verify that multiple signature information is valid (specifically, may be verified by signing key addresses of respective approval objects registered in a key management system), and when the wallet contract is verified to be valid, transaction data may be sent to the blockchain network to enable the blockchain network to verify and record the transaction data.

It should be noted that, if the transaction approval object agrees to disclose the original transaction data, the transaction data sent to the wallet contract may be the original transaction data, and although the original transaction data is disclosed, other objects (such as other departments) in the enterprise still cannot know which department submitted the original transaction data, based on which department business privacy of the original transaction data can be still protected. That is, in the foregoing corresponding embodiment, when the validity of the multiple signature approval result is determined, the resource management contract may be invoked to link the original transaction data or link the blind transaction data, where the link of the original transaction data or the blind transaction data may depend on the disclosure requirement of the approval object from the object.

Step S68, the wallet contract links the transaction data after the verification passes.

In particular, the wallet contract can verify the multiple signature information through the signing key address of the approval object, and when the multiple signature information is determined to be valid, the transaction data (original transaction data or blind transaction data) can be sent to the blockchain network, so that the blockchain network verifies the transaction data and shares the same for uplink, and the specific mode of the blockchain uplink transaction data is that a block is generated based on the transaction data conventionally, then the block is shared, and the block is uplink after the block is shared, which will not be described herein.

It should be understood that the scheme needs to ensure that the transaction initiating object belongs to the enterprise private network, so that blind signature can be performed on the transaction initiating object, and the privacy of transaction data can be improved through the blind signature; in addition, the transaction data needs to be signed and approved by a plurality of approval objects in the department to execute the transaction, so that the reliability of the transaction can be improved.

Further, referring to fig. 7, fig. 7 is a schematic structural diagram of a data processing apparatus based on a blockchain according to an embodiment of the present application. The blockchain-based data processing device may be a computer program (including program code) running in a computer apparatus, for example, the blockchain-based data processing device is an application software; the blockchain-based data processing device may be used to perform the method shown in fig. 3. As shown in fig. 7, the blockchain-based data processing device 1 may include: a blind signature module 11, a verification module 12, a multiple signature module 13, and a contract invocation module 14.

The blind signature module 11 is used for carrying out blind signature processing on the received blind transaction data by adopting a signature key of the main object to obtain blind signature information; the blinded transaction data is obtained by blinding the original transaction data;

A verification module 12 for verifying the validity of the blind signature information;

the multiple signature module 13 is configured to perform multiple signature approval on the blinded transaction data by using approval signature keys of at least two approval objects when the validity of the blind signature information is determined; at least two approval objects have approval authorities of blinded transaction data, and a subordinate relationship exists between a main object and each of the at least two approval objects;

and the contract calling module 14 is used for calling the resource management contract related to the main object to carry out uplink processing on the blind transaction data when the multi-signature approval result of the blind transaction data is determined to be an approval passing result.

For specific implementation manners of the blind signature module 11, the verification module 12, the multiple signature module 13, and the contract invoking module 14, refer to the descriptions of step S101 to step S104 in the embodiment corresponding to fig. 3, and will not be described herein.

In one embodiment, before the blind signature module 11 performs blind signature processing on the received blind transaction data by using the signature key of the main object to obtain blind signature information, the blockchain-based data processing apparatus 1 further includes: registration request receiving module 15 and key registration module 16.

A registration request receiving module 15 for receiving a key registration request for a master object; the key registration request is used for requesting to register an associated key of the main object; the association key of the master object comprises a signing key address of the master object, signing key addresses of one or more slave objects and signing key addresses of at least two approval objects; each of the one or more slave objects refers to an object that is subordinate to the master object;

the key registration module 16 is configured to register, based on the key registration request, the signing key of the master object, the signing key addresses of the one or more slave objects, and the signing key addresses of the at least two approval objects, into a key management system associated with the master object.

For a specific implementation manner of the registration request receiving module 15 and the key registration module 16, reference may be made to the description in step S101 in the embodiment corresponding to fig. 3, which will not be described herein.

In one embodiment, the blind signature module 11 performs blind signature processing on the received blind transaction data by adopting the signature key of the main object, so as to obtain a specific mode of blind signature information, and the specific mode includes:

In one embodiment, the specific manner in which the verification module 12 verifies the validity of the blind signature information includes:

the multiple signature module 13 adopts the approval signing keys of at least two approval objects to carry out multiple signature approval on the blind transaction data, and the specific mode comprises the following steps:

In one embodiment, after the multiple signature module 13 sends the blinded transaction data to at least two approval objects, the blockchain-based data processing device 1 further includes: a signature information receiving module 17, an approval signature verification module 18, a multiple signature verification module 19, and an approval result determination module 20.

The signature information receiving module 17 is used for receiving multiple signature information returned by at least two approval objects; the multiple signature information comprises N approval signature information; at least two approval objects including approval object S _i The N approval signature information comprises an approval object S _i Corresponding approval signature information S _i Approval of signature information S _i Is based on approval object S _i The second key to be verified is obtained after the blind transaction data is signed; i. n is a positive integer;

an approval signature verification module 18 for verifying approval signature information S _i Validity verification is carried out to obtain approval signature information S _i A validity verification result of (2);

the multiple signature verification module 19 is configured to determine, if a validity verification result of each of the N approval signature information is determined, validity of the multiple signature information based on the N validity verification results;

and the approval result determining module 20 is configured to determine, when the multiple signature information is determined to be valid, a multiple signature approval result of the transaction data according to the number of approval signature information included in the N approval signature information and the number of approval objects included in the at least two approval objects.

The specific implementation manners of the signature information receiving module 17, the approval signature verification module 18, the multiple signature verification module 19, and the approval result determining module 20 may be referred to the description of step S503-step S504 in the embodiment corresponding to fig. 5, and will not be described herein.

In one embodiment, the approval signature verification module 18 verifies the approval signature information S _i Validity verification is carried out to obtain approval signature information S _i The specific mode of the validity verification result of the (c) comprises the following steps:

will be related to the primary objectIs registered in the key management system _i Is determined as approval signature information S _i A third signing key of (2);

In one embodiment, the specific manner in which the multiple signature verification module 19 determines the validity of the multiple signature information based on the N validity verification results includes:

comparing the first number with the second number;

In one embodiment, the approval result determining module 20 determines a specific manner of the multi-signature approval result of the transaction data according to the number of approval signature information contained in the N pieces of approval signature information and the number of approval objects contained in the at least two approval objects, including:

In one embodiment, after the contract invoking module 14 invokes the resource management contract related to the master object to perform the uplink processing on the blinded transaction data, the blockchain-based data processing apparatus 1 further includes: a review request receiving module 21, a request transmitting module 22, a right determining module 23, and a notification transmitting module 24.

A reference request receiving module 21 for receiving a reference request for the original transaction data sent by the second slave object; the consulting request is used for requesting to consult the original transaction data;

a request sending module 22, configured to send a review request to at least two approval objects;

the permission determining module 23 is configured to determine, according to voting information returned by at least two approved objects, reference permission of the second slave object with respect to the original transaction data;

and a notification transmitting module 24, configured to transmit a notification of allowing reference to the second slave object to allow the second slave object to refer to the original transaction data from the blockchain based on the notification of allowing reference, when it is determined that the second slave object has the reference authority of the original transaction data.

The specific implementation manner of the reference request receiving module 21, the request sending module 22, the permission determining module 23, and the notification sending module 24 may be referred to the description in step S104 in the embodiment corresponding to fig. 3, and will not be described herein.

In one embodiment, the rights determining module 23 determines the specific manner of referring rights of the second slave object with respect to the original transaction data according to the voting information returned by at least two approval objects, including:

the notification sending module 24 sends, to the second slave object, a specific manner of allowing the review notification when it is determined that the second slave object has the review right of the original transaction data, including:

In the embodiment of the application, the original transaction data is subjected to blind signature processing and then subjected to blind signature processing based on the signature key of the main object, so that the specific content of the original transaction data in the main object can only be known by a transaction initiator, other non-transaction initiators in the main object can not know the specific content of the original transaction data, and only the blind transaction data of the original transaction data can be confirmed to be approved by the main object signature, thereby the privacy of the original transaction data can be well protected, the risk of malicious leakage of the original transaction data is reduced, and then the safety of the original transaction data can be improved; in addition, for the blind transaction data approved by the signature of the main object, the blind transaction data can be subjected to multiple signature approval by an approval object with approval authority, and the blind transaction data can be subjected to multiple signature approval to be uplink, so that the reliability of the blind transaction data can be further improved through multiple signature approval. In summary, the application can improve the security and privacy of transaction data in the business of storing related transaction data in the main object based on the blockchain.

Further, referring to fig. 8, fig. 8 is a schematic structural diagram of a computer device according to an embodiment of the present application. As shown in fig. 8, the above-described computer device 8000 may include: processor 8001, network interface 8004, and memory 8005, and further, the above-described computer device 8000 further includes: a user interface 8003, and at least one communication bus 8002. Wherein a communication bus 8002 is used to enable connected communications between these components. The user interface 8003 may include a Display screen (Display), a Keyboard (Keyboard), and the optional user interface 8003 may also include standard wired, wireless interfaces, among others. Network interface 8004 may optionally include a standard wired interface, a wireless interface (e.g., WI-FI interface). Memory 8005 may be a high speed RAM memory or a non-volatile memory, such as at least one disk memory. Memory 8005 may optionally also be at least one memory device located remotely from the aforementioned processor 8001. As shown in fig. 8, an operating system, a network communication module, a user interface module, and a device control application program may be included in the memory 8005, which is one type of computer-readable storage medium.

In the computer device 8000 shown in fig. 8, the network interface 8004 may provide a network communication function; while user interface 8003 is primarily an interface for providing input to the user; and the processor 8001 may be used to invoke a device control application stored in the memory 8005 to implement:

verifying the validity of the blind signature information;

It should be understood that the computer device 8000 according to the embodiment of the present application may perform the description of the blockchain-based data processing method according to the embodiment of fig. 3 to 6, and may also perform the description of the blockchain-based data processing apparatus 1 according to the embodiment of fig. 7, which is not repeated herein. In addition, the description of the beneficial effects of the same method is omitted.

Furthermore, it should be noted here that: the embodiment of the present application further provides a computer readable storage medium, where a computer program executed by the computer device 8000 for data processing mentioned above is stored, and the computer program includes program instructions, when the processor executes the program instructions, the description of the blockchain-based data processing method in the embodiment corresponding to fig. 3 to 6 is executed, and therefore will not be repeated herein. In addition, the description of the beneficial effects of the same method is omitted. For technical details not disclosed in the embodiments of the computer-readable storage medium according to the present application, please refer to the description of the method embodiments of the present application.

The computer readable storage medium may be a blockchain-based data processing apparatus provided in any of the foregoing embodiments or an internal storage unit of the computer device, such as a hard disk or a memory of the computer device. The computer readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash card (flash card) or the like, which are provided on the computer device. Further, the computer-readable storage medium may also include both internal storage units and external storage devices of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

The terms first, second and the like in the description and in the claims and drawings of embodiments of the application are used for distinguishing between different objects and not for describing a particular sequential order. Furthermore, the term "include" and any variations thereof is intended to cover a non-exclusive inclusion. For example, a process, method, apparatus, article, or device that comprises a list of steps or elements is not limited to the list of steps or modules but may, in the alternative, include other steps or modules not listed or inherent to such process, method, apparatus, article, or device.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps described in connection with the embodiments disclosed herein may be embodied in electronic hardware, in computer software, or in a combination of the two, and that the elements and steps of the examples have been generally described in terms of function in the foregoing description to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

The method and related apparatus provided in the embodiments of the present application are described with reference to the flowchart and/or schematic structural diagrams of the method provided in the embodiments of the present application, and each flow and/or block of the flowchart and/or schematic structural diagrams of the method may be implemented by computer program instructions, and combinations of flows and/or blocks in the flowchart and/or block diagrams. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or structural diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or structures.

The foregoing disclosure is illustrative of the present application and is not to be construed as limiting the scope of the application, which is defined by the appended claims.

Claims

1. A blockchain-based data processing method, comprising:

verifying the validity of the blind signature information;

when the validity of the blind signature information is determined, adopting approval signature keys of at least two approval objects to carry out multiple signature approval on the blind transaction data; the at least two approval objects have approval authorities of the blinded transaction data, and a subordinate relationship exists between the main object and each of the at least two approval objects;

2. The method of claim 1, wherein prior to blinding the received blinded transaction data with the signature key of the master object to obtain the blind signature information, the method further comprises:

receiving a key registration request for the master object; the key registration request is used for requesting to register an associated key of the main object; the association key of the master object comprises a signing key address of the master object, signing key addresses of one or more slave objects and signing key addresses of the at least two approval objects; each of the one or more slave objects refers to an object that is subordinate to the master object;

and based on the key registration request, registering the signing key address of the master object, the signing key addresses of the one or more slave objects and the signing key addresses of the at least two approved objects into a key management system related to the master object.

3. The method according to claim 1, wherein the blind signature processing is performed on the received blind transaction data by using the signature key of the main object to obtain blind signature information, including:

Receiving blinded transaction data sent by a first slave object; the blind transaction data carries transaction signature information; the transaction signature information is obtained after the blind transaction data is signed based on a first key to be verified of the first slave object; the first slave object refers to any slave object subordinate to the master object;

determining a signing key address of the first slave object registered in a key management system related to the master object as a first signing key of the transaction signing information;

and when the first signature verification result is determined to be a signature verification passing result, determining that the first key to be verified is a legal signature key of the first slave object, calling a blind signature assembly, and carrying out blind signature processing on the received blind transaction data by adopting the signature key of the master object in the blind signature assembly to obtain blind signature information.

4. The method of claim 1, wherein said verifying the validity of said blind signature information comprises:

5. The method of claim 1, wherein the blinded transaction data is transmitted by a first slave object; the first slave object refers to any slave object subordinate to the master object;

the adoption of the approval signing keys of at least two approval objects carries out multi-signature approval on the blind transaction data, and the method comprises the following steps:

invoking a multiple signature component, and acquiring at least two approval objects with approval authorities of the blinded transaction data through the multiple signature component; the at least two approval objects are all subordinate to the first slave object;

transmitting the blind transaction data to the at least two approval objects, so that the at least two approval objects adopt at least two approval signing keys to carry out multi-signature approval on the blind transaction data; one of the at least two approval objects is provided with one of the at least two approval signing keys.

6. The method of claim 5, wherein after transmitting the blinded transaction data to the at least two approval objects, the method further comprises:

receiving multiple signature information returned by the at least two approval objects; the multiple signature information comprises N approval signature information; the at least two approval objects comprise an approval object S _i The N approval signature information comprises the approval object S _i Corresponding approval signature information S _i The approval signature information S _i Is based on the approval object S _i The second key to be verified is obtained after signing the blind transaction data; i. n is a positive integer;

to said approval signature information S _i Validity verification is carried out to obtain the approval signature information S _i A validity verification result of (2);

if the validity verification result of each approval signature information in the N approval signature information is determined, determining the validity of the multiple signature information based on the N validity verification results;

and when the validity of the multi-signature information is determined, determining a multi-signature approval result of the transaction data according to the number of the approval signature information contained in the N approval signature information and the number of the approval objects contained in the at least two approval objects.

7. The method according to claim 6, wherein said signing said approval information S _i Validity verification is carried out to obtain the approval signature information S _i The validity verification result of (1) includes:

the approval object S registered in the key management system related to the main object _i Is determined as the signing key address of the approval signature information S _i A third signing key of (2);

signing the approval signature information S through the third signing verification key _i Performing label verification processing to obtain a third label verification result;

when the third signature verification result is determined to be a signature verification passing result, determining that the second key to be verified is the approval object S _i Determining said approval signature information S _i The validity verification result of (a) is a valid signature result;

when the third signature verification result is determined to be a signature verification failure result, determining that the second key to be verified is the approval object S _i Is used for determining the approval signature information S _i The validity verification result of (a) is an invalid signature result.

8. The method of claim 6, wherein the determining the validity of the multi-signature information based on the N validity verification results comprises:

counting a second number of validity verification results contained in the N validity verification results;

comparing the first number with the second number;

and if the first quantity is determined to be different from the second quantity, determining that the multi-signature information has invalidity.

9. The method of claim 6, wherein determining the multiple signature approval result of the transaction data based on the number of approval signature information included in the N approval signature information and the number of approval objects included in the at least two approval objects comprises:

if the first quantity ratio is greater than a ratio threshold, determining that the multi-signature approval result of the transaction data is an approval passing result;

And if the first quantity ratio is smaller than the ratio threshold, determining that the multi-signature approval result of the transaction data is an approval failing result.

10. The method of claim 1, wherein after invoking a resource management contract associated with the master object to uplink the blinded transaction data, the method further comprises:

receiving a reference request for the original transaction data sent by a second slave object; the consulting request is used for requesting to consult the original transaction data;

transmitting the consulting request to the at least two approval objects;

determining the reference authority of the second slave object with respect to the original transaction data according to the voting information returned by the at least two approval objects;

and when the second slave object is determined to have the reference right of the original transaction data, transmitting a reference permission notification to the second slave object so that the second slave object refers to the original transaction data from the blockchain based on the reference permission notification.

11. The method of claim 10, wherein said determining reference rights of said second slave object with respect to said original transaction data in accordance with voting information returned by said at least two approval objects comprises:

Counting the passing number of voting passing information in the voting information returned by the at least two examination and approval objects;

if the second quantity ratio is determined to be larger than a ratio threshold, determining that the second slave object has the reference authority of the original transaction data;

and if the second quantity ratio is smaller than the ratio threshold, determining that the second slave object does not have the reference authority of the original transaction data.

12. The method of claim 10, wherein the blinded transaction data is obtained by blinding the original transaction data based on a blinded encryption key;

the sending, when it is determined that the second slave object has the reference right of the original transaction data, a notification of permitting reference to the second slave object includes:

Sending the key inquiry request to a target approval object in the at least two approval objects; the target approval object refers to any one of the at least two approval objects;

receiving a blinded decryption key of the blinded transaction data returned by the target approval object, generating a review permission notification containing the blinded decryption key, and sending the review permission notification to the second slave object; the blind decryption key is used for decrypting the blind transaction data acquired from the blockchain by the second slave object to obtain the original transaction data.

13. A blockchain-based data processing device, comprising:

the multi-signature module is used for carrying out multi-signature approval on the blind transaction data by adopting approval signature keys of at least two approval objects when the validity of the blind signature information is determined; the at least two approval objects have approval authorities of the blinded transaction data, and a subordinate relationship exists between the main object and each of the at least two approval objects;

14. A computer device, comprising: a processor, a memory, and a network interface;

the processor is connected to the memory and the network interface, wherein the network interface is configured to provide a network communication function, the memory is configured to store a computer program, and the processor is configured to invoke the computer program to cause the computer device to perform the method of any of claims 1-12.

15. A computer readable storage medium, characterized in that the computer readable storage medium has stored therein a computer program adapted to be loaded by a processor and to perform the method of any of claims 1-12.

16. A computer program product, characterized in that the computer program product comprises a computer program stored in a computer readable storage medium, the computer program being adapted to be read and executed by a processor to cause a computer device having the processor to perform the method of any of claims 1-12.