WO2019136959A1

WO2019136959A1 - Data processing method and device, computer device and storage medium

Info

Publication number: WO2019136959A1
Application number: PCT/CN2018/096760
Authority: WO
Inventors: 张宇; 宦鹏飞; 谢丹力; 王梦寒
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2018-01-12
Filing date: 2018-07-24
Publication date: 2019-07-18
Also published as: CN108322451B; CN108322451A

Abstract

A data processing method, comprising: acquiring a first temporary session key by means of a pre-configured interface according to a key exchange protocol and distributed system exchange; encrypting data to be written in by means of the first temporary session key; and sending the encrypted data to be written in to a distributed system by means of the pre-configured interface, thereby enabling the distributed system to decrypt the encrypted data to be written in by means of a second temporary session key so as to obtain a first plaintext, the second temporary session key corresponding to the first temporary session key.

Description

Data processing method, device, computer device and storage medium

Cross-reference to related applications

This application claims priority to Chinese Patent Application No. 201810030994X, filed on Jan. 12, 2018, the entire disclosure of which is incorporated herein by reference. In this application.

Technical field

The present application relates to a data processing method, apparatus, computer device, and storage medium.

Background technique

The distributed database is used by multiple organizations to write data to this database. Typically, nodes that join a distributed system provide a read-write interface.

The data read and write of the existing distributed system is initiated and controlled by the mechanism that interfaces with the distributed system. During a write operation, the docking mechanism initiates a request for data to be stored in the distributed system, and the data is distributed. The write interface provided by the system writes the data to the distributed system and synchronizes to other nodes in the distributed system. During a read operation, the access mechanism uses the read interface provided by the distributed system from the distributed system. Read the data and use it.

Therefore, the inventors realized that all data to be stored in a distributed system must be completed via a read/write interface provided by the distributed system, which causes problems such as concentration of permissions and performance bottlenecks. In addition, once this read/write interface fails, there is a risk that data cannot be written to the distributed system. When the amount of data to be written is large, there are also problems such as data write delay and loss.

Summary of the invention

According to various embodiments disclosed herein, a data processing method, apparatus, computer device, and storage medium are provided.

A data processing method comprising:

Obtaining a first temporary session key by exchanging with a distributed system according to a key exchange protocol through a pre-configured interface;

Encrypting the data to be written by the first temporary session key; and

Transmitting the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system decrypts the encrypted data to be written by using a second temporary session key to obtain a first In plaintext, the second temporary session key corresponds to the first temporary session key.

A data processing device comprising:

a key obtaining module, configured to exchange, by using a pre-configured interface, a first temporary session key according to a key exchange protocol and a distributed system;

An encryption module, configured to encrypt data to be written by using the first temporary session key; and

a writing module, configured to send the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system writes the encrypted to be written by using a second temporary session key The data is decrypted to obtain a first plaintext, and the second temporary session key corresponds to the first temporary session key.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executable by the processor to cause the one or more processors to execute The following steps: obtaining a first temporary session key by exchanging with a distributed system according to a key exchange protocol through a pre-configured interface; encrypting the data to be written by the first temporary session key; and encrypting through a pre-configured interface The to-be-written data is sent to the distributed system, so that the distributed system decrypts the encrypted data to be written by using a second temporary session key to obtain a first plaintext, the second temporary The session key corresponds to the first temporary session key.

One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of: pre-configuring The interface exchanges with the distributed system according to the key exchange protocol to obtain a first temporary session key; encrypts the data to be written by the first temporary session key; and sends the encrypted data to be written through a pre-configured interface And the distributed system, wherein the distributed system decrypts the encrypted data to be written by using a second temporary session key to obtain a first plaintext, the second temporary session key and the first A temporary session key corresponds.

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

1 is an application scenario diagram of a data processing method in accordance with one or more embodiments.

2 is a flow diagram of a data processing method in accordance with one or more embodiments.

FIG. 3 is a flow diagram of pre-configured steps in accordance with one or more embodiments.

4 is a timing diagram of a data processing method in accordance with one or more embodiments.

FIG. 5 is a block diagram of a data processing apparatus in accordance with one or more embodiments.

FIG. 6 is a block diagram of a computer device in accordance with one or more embodiments.

Detailed ways

In order to make the technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The data processing method provided by the present application can be applied to an application environment as shown in FIG. 1. The terminal connects to the distributed system through the network through the network. The distributed system allocates the read and write permissions of the read/write nodes originally deployed in the distributed system to the terminal by configuring the terminal in advance, so that the data to be written can be uploaded to any node of the distributed system through the terminal, for example, The terminal is configured by using a configuration file, which may be an integrated SDK (Software Development Kit), and a security module is formed on the terminal by configuring an interface of the terminal, and the security module is distributed. System access rights, encryption and decryption key management, terminal private key management, authorization certificate management, etc. The terminal obtains the first temporary session key by using the security module to exchange with the distributed system according to the key exchange protocol, encrypts the data to be written by using the first temporary session key, and encrypts the data to be written through the pre-configured interface. Sending to the distributed system to achieve data writing, the same data reading may be through the security module to send a data read request to the distributed system, and then through the pre-configured interface to receive the distributed system returned through the second temporary The data to be read after the session key is encrypted; the encrypted data to be read is decrypted by the first temporary session key to obtain the second plaintext. Terminal 102 can be, but is not limited to, a variety of personal computers, notebook computers, smart phones, tablets, and portable wearable devices.

In one embodiment, as shown in FIG. 2, a data processing method is provided, which is applied to the terminal in FIG. 1 as an example, and includes the following steps:

S202: Obtain a first temporary session key by exchanging with a distributed system according to a key exchange protocol through a pre-configured interface.

The distributed system may be a blockchain or other distributed system, and is not specifically limited herein.

Specifically, the pre-configured interface is obtained by the terminal by registering with the distributed system. For example, the terminal sends a registration request to the distributed system, and the distributed system determines whether the terminal is a secure terminal. When the terminal is a secure terminal, the terminal may perform the terminal. Authorization, for example, sending a corresponding configuration file to configure the target interface of the terminal. That is, the read and write permissions of the read/write nodes originally deployed in the distributed system are placed on the terminal through pre-configuration, so that the data to be uploaded can be uploaded to any node of the distributed system after being processed by the terminal, and the distributed system is no longer distributed. A large number of read and write nodes need to be deployed, which can greatly reduce the cost. The deployment process may be in the form of forming a security module in the terminal. For example, after downloading the configured SDK to the terminal for loading and running, the SDK uniformly manages an interface for interacting with the distributed system.

The first temporary session key may be different temporary data keys according to different types of data, for example, the temporary session key for each terminal interaction with the distributed system may be different, so that even the criminals Obtaining the temporary session key also fails to predict the key of the next data interaction, so that the data plaintext cannot be obtained.

Specifically, the sharing curve parameter may be stored in the terminal and the authorized terminal, for example, the first shared curve parameter is stored in the first terminal, and the second shared curve parameter is stored in the second terminal, and all the shared files are stored in the distributed system. Curve parameters, each shared curve parameter includes an elliptic curve E, a step N, and a base point G. Obtaining the first temporary session key by using the pre-configured interface to exchange with the distributed system according to the key exchange protocol may include: sending a key exchange request to the distributed system through the pre-configured interface; receiving the distributed system according to the key exchange Requesting a first key key to be returned; generating a first temporary session key according to the first key key; wherein the second temporary session key is generated by the terminal to generate a second random number, and generating a second according to the second random number The key key transmits the second key key to the distributed system, and the distributed system generates the second temporary session key according to the second key key and the first random number generated by the distributed system.

The process of generating the first temporary session key and the second temporary session key is described in detail below: the terminal sends a key exchange request to the distributed system, the request carries a terminal identifier, and the terminal identifier can uniquely determine the terminal and generate a second random number; after receiving the key exchange request sent by the terminal, the distributed system acquires the base point G corresponding to the terminal, and generates a first random number a, and the distributed system according to the base point G and the first random number The first key key A=a*G is generated, and the generated first key key is sent to the terminal; the terminal generates the second key key B=b according to the base point G stored by the terminal and the second random number. *G, and transmitting the second key key to the distributed system; the distributed system calculates the second temporary session key Q=a*B according to the second key key and the first random number, and the terminal according to the The first temporary session key Q'=b*A is obtained by a key key and the second random number. According to the exchange law and the combination law Q=Q', the process is Q=a*B=a*b*G= b*a*G=b*G=Q'. The delivery of A can be made public, that is, the attacker can acquire A. Since the discrete logarithm problem of the elliptic curve is a problem, the attacker cannot calculate a through A and G. Therefore, the exchange parties can negotiate a key without sharing any secrets, thereby ensuring the security of the data to be written.

S204: Encrypt data to be written by the first temporary session key.

Specifically, after the terminal and the distributed system calculate the temporary session key, the terminal may encrypt the data to be written by using the first temporary session key, thereby ensuring the security of the data to be written, and further The distributed system can be configured to know which terminal to send the data to be written, and send the terminal identifier and the encrypted data to be written together to the distributed system, where the terminal identifier can uniquely determine the terminal, which can It is the MAC address of the terminal, etc.

S206: Send the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system decrypts the encrypted data to be written by using the second temporary session key to obtain the first plaintext, and second. The temporary session key corresponds to the first temporary session key.

Specifically, after the data is successfully encrypted, the encrypted data to be written is sent to the distributed system through the pre-configured interface, and the distributed system can obtain the data after the encrypted data to be written. Calculating the obtained second temporary session key, and decrypting the encrypted data to be written by using the second temporary session key to obtain data plaintext. And preferably, when there are multiple terminals simultaneously transmitting data to be written to the distributed system, the distributed system first obtains the calculated second temporary session key according to the terminal identifier of the terminal, for example, the distributed system calculates the When the second temporary session key is used, the second temporary session key is first stored in association with the corresponding terminal identifier, so that the distributed system can obtain the calculated second temporary session key according to the terminal identifier, and then according to the second The temporary session key decrypts the encrypted data to be uploaded to obtain the first plaintext.

After the first plaintext is obtained by the distributed system, the data may be encrypted and stored according to the data encryption method on the distributed system to ensure the security of the data on the distributed system.

The above data processing method pre-configures the interface in the authorization center, and does not need to be deployed at the ingress node of the distributed system, thereby greatly saving the deployment cost, and by configuring the interface to the authorized terminal, the data source in the distributed system can be rich and the access is more. It is simple and convenient, and greatly relieves the pressure on the access nodes of the distributed system, and avoids the problem of writing data by one access node.

In one embodiment, after the step of encrypting the data to be written by the first temporary session key, step S204 further comprises: signing the encrypted data to be written by the pre-deployed terminal private key; The pre-configured interface sends the encrypted data to be written to the distributed system, so that the distributed system decrypts the encrypted data to be written by using the second temporary session key to obtain the first plaintext, that is, step S206 The method may include: sending, by using a pre-configured interface, the encrypted and signed data to be written to the distributed system, so that the distributed system successfully checks the received data to be written through the terminal public key, and then passes the The second temporary session key decrypts the encrypted data to be written to obtain the first plaintext, and the terminal public key corresponds to the terminal private key.

Specifically, in order to further ensure the security of data transmission between the terminal and the distributed system, the public key of the terminal may be pre-deployed, that is, the data sent by the terminal to the distributed system is signed by the private key of the terminal, so that the distributed system is The verification can be performed through the corresponding terminal public key, which further ensures the security of data transmission.

The pre-deployed terminal public private key may be generated by the terminal, that is, when the terminal registers, the public key generated by the terminal is submitted to the distributed system, and then the distributed system passes the certificate public authority of the distributed system to the terminal public key. The signature is stored on the distributed system, and the authorization certificate is returned to the terminal to indicate that the terminal is successfully registered. In another embodiment, the public and private keys of the terminal may be generated in a distributed system, that is, the distributed system is based on the terminal information. The public key of the terminal is generated, and then the terminal private key is returned to the terminal, and in order to ensure the security of the private key of the terminal, the process may be performed offline.

Specifically, after the terminal encrypts the data to be written by using the first temporary session key, the encrypted data to be written may be further signed by the pre-deployed terminal private key, thereby encrypting and signing the data. The data to be written and the identifier of the terminal are sent to the distributed system. After receiving the data, the distributed system may first obtain the public key of the terminal according to the identifier of the terminal, and the encrypted and tagged to be written by the public key of the terminal. The data is checked. Only after the verification is successful, the encrypted data to be written is decrypted by the second temporary session key to obtain the first plaintext. Otherwise, the data to be written that is unsuccessful in the verification is directly deleted to ensure uploading to the data. The data on the distributed system is all secure data. The step of obtaining the public key of the terminal may be that the distributed system is signed by the certificate of the distributed system, so that the signed public key of the terminal can be checked and verified by the private key corresponding to the distributed system certificate. key. Preferably, a different session key can be used for both encryption and digital signatures to achieve a one-purpose key. In order to ensure the reliability of the data, the double-layer signing can be performed. For example, after the terminal adds the key through the terminal private key, the terminal adds the key through the distributed system public key, so that after the distributed system receives the data, it first passes the distribution. The private key corresponding to the public key of the system is checked. After the verification is successful, the terminal public key is used for verification, and finally the second temporary session key is used for decryption to further ensure data security.

In the above embodiment, the distributed system performs signature verification on the data sent by the terminal, confirms the authorization authority of the terminal, ensures that the data is actually sent by the terminal, and has not been tampered with; thereby ensuring that the data on the distributed system is valid. Sex and authenticity. Through this scheme, the security problem of uploading data in a system in which a multi-terminal accesses a distributed system is effectively solved, and after obtaining the data, the authorized reader of the data can obtain a certificate of an authorized terminal through the distributed system, and verify Get the authenticity of the data and solve the trust problem of the authorized organization.

In one embodiment, the data processing method may further include a data reading step, the data reading step may include receiving, by the pre-configured interface, the to-be-read after being encrypted by the second temporary session key returned by the distributed system. Data; decrypting the encrypted data to be read by the first temporary session key to obtain a second plaintext.

Specifically, the foregoing embodiment mainly relates to uploading data to be uploaded of the terminal to the distributed system. The embodiment mainly relates to the terminal reading the data to be read from the distributed system, where the terminal may firstly go to the distributed system. Sending a data read request, where the data read request carries a terminal identifier, and then the distributed system performs key exchange with the terminal according to the key exchange protocol to obtain a second temporary session key and a first temporary session key, the first For the specific manner of obtaining the temporary session key and the second temporary session key, refer to the foregoing, and no further details are provided herein. The distributed system encrypts the data to be read by the acquired second temporary session key, and sends the encrypted data to be read to the corresponding terminal, so that the terminal can pass the second temporary session key. A temporary session key decrypts the data to be read to obtain a second plaintext, so that the second plaintext can be processed.

In the foregoing embodiment, the interface is configured in the authorization center in advance, and the ingress node deployed in the distributed system is not used, which greatly saves the deployment cost, and the interface is configured to the authorized terminal, so that the data source in the distributed system is rich and the access is more. It is simple and convenient, and greatly relieves the pressure on the access nodes of the distributed system, and avoids the problem of writing data by one access node. At the same time, each terminal uses a unique identifier for the same data, which avoids duplication of incoming data. The access of multiple channels is realized, thereby realizing the function of data sharing. Moreover, each entrance is independent of each other, and the downtime of an entrance does not affect the work of other entrances.

In one embodiment, the step of receiving, by the pre-configured interface, the data to be read after being encrypted by the second temporary session key returned by the distributed system may include: receiving, by the pre-configured interface, the through terminal returned by the distributed system The public key and the second temporary session key are tagged and encrypted data to be read. Therefore, before the step of decrypting the encrypted data to be read by the first temporary session key to obtain the second plaintext, the method further includes: performing, by using the terminal private key, the data to be read after the public key is signed by the terminal The encrypted data to be read is obtained.

Specifically, the public key and the private key of the terminal may be configured in a pre-configuration phase, and the public key of the terminal is stored on the distributed system, so that when the terminal reads data from the distributed system, the distributed system may first pass the first The temporary session key encrypts the data to be read, and then the data to be read is added by the terminal public key to further ensure the security of the data to be read. When the terminal receives the data to be read, the terminal obtains the private key of the terminal, and performs verification on the data to be read after the encryption and the signing. After the verification is successful, the data to be read is passed. A temporary session key is decrypted to obtain a second plaintext, thereby performing other processing on the second plaintext. Among them, different session keys can be used for encryption and digital signatures, and one-purpose and one-key can be used. In order to ensure the reliability of the data, the double-layer signing can be performed. For example, after the tag is added by the terminal public key, the distributed system can be added through the distributed system private key, so that after the terminal receives the data, the first After the verification is performed by the distributed system public key, after the verification is successful, the terminal private key is used for verification, and finally the first temporary session key is used for decryption, thereby further ensuring data security.

In this embodiment, the accessed terminal can save the deployment cost by using the ingress node of the distributed system, and can provide differentiated interface configurations for different terminals, so that the access mode is more abundant. By adopting such a system, the data source in the distributed system is rich, the access is simpler and more convenient, and the pressure of the distributed system accessing the server is greatly alleviated. The problem of writing data by one access port is avoided. At the same time, organizations and enterprises use unique identifiers for the same data to avoid duplication of incoming data. The access of multiple channels is realized, thereby realizing the function of data sharing. Moreover, each entrance is independent of each other, and the downtime of an entrance does not affect the work of other entrances.

In one embodiment, the data processing method may further include a pre-configuration step for lowering the read and write permissions originally deployed in the read/write node of the distributed system to the terminal, so that the data can pass through the terminal. After processing, it is directly uploaded to the distributed system, and the terminal can directly obtain data from the distributed system. The accessed terminal can save the deployment cost without deploying the ingress node of the distributed system.

Referring to FIG. 3, FIG. 3 is a flowchart of a pre-configuration step in an embodiment, where the pre-configuration step may include:

S302: Send a registration request to the distributed system, where the registration request carries a registration type and a terminal identifier.

Specifically, when the terminal wants to directly exchange data with the distributed system, the authorization of the distributed system needs to be acquired, so the terminal sends a registration request to the distributed system, where the registration request carries the terminal identifier to uniquely Characterizing the terminal, the registration type is because some terminals are data storage type terminals, and some terminals are accounting type terminals. The configuration files are different for different terminals, and different interfaces can be provided for different authorized terminals. Configuration makes the access method richer.

When receiving the registration request of the terminal, the distributed system may first determine the terminal according to the terminal identifier, and then determine whether the terminal is a secure terminal. For example, the distributed system may pre-store the identifier of the security terminal, when receiving the terminal. The registration request may be compared with the identifier of the pre-stored security terminal. Only if the comparison is successful, the corresponding configuration file may be obtained according to the terminal identifier and the registration type.

S304: Receive a configuration file generated by the distributed system according to the terminal identifier and the registration type.

Specifically, the step of obtaining the corresponding configuration file according to the terminal identifier and the registration type may include obtaining the corresponding configuration file according to the registration type in the registration request, and then filling in the related information of the terminal in the configuration file, such as the terminal identifier. . Specifically, the registration type may include a data storage type and a billing type. For the data storage type, the initialized interface in the configuration file includes: an interface for data encryption, decryption, data ID confusion, and distributed system database query; The accounting type needs to provide an interface related to accounting reconciliation such as homomorphic encryption and ring signature. After the distributed system generates the corresponding configuration file, the configuration file can be sent to the corresponding terminal, and in order to ensure the security of the configuration file, the configuration file is prevented from being obtained by illegal elements in the online transmission, and can be transmitted offline. The method sends the configuration file to the corresponding terminal.

S306: Configure according to a configuration file.

Specifically, after acquiring the configuration file, the terminal configures the terminal according to the content in the configuration file. The configuration file is not only the access rights of the authorized terminal, but also includes other functions, such as encryption and decryption, private key/certificate management, etc., which is equivalent to the written SDK module, which is loaded and run locally after being downloaded by the terminal, and the authorized terminal is authorized. It is equivalent to calling the SDK, and the SDK accesses the distributed system read and write nodes. These functions are more complicated, so they can provide security modules. When configuring, they can also be understood as configuring security modules, so that subsequent data upload and data reading are all. It is unified from the security module processing.

In the above embodiment, the read/write permission originally deployed in the read/write node of the distributed system is placed on the terminal, so that the data can be directly uploaded to the distributed system after being processed by the terminal, and the terminal can be directly obtained from the distributed system. Data, the access terminal can not deploy the ingress node of the distributed system, which greatly saves the deployment cost.

In one embodiment, the pre-configuration step may further include a terminal public-private key generation step, which may include two implementation manners, one is that a public-private key pair is generated by the terminal, and the terminal submits to the distributed system when registering. The certificate authority has the certificate authority to sign the terminal public key, and store the signed terminal public key and the terminal identifier in association with the distributed system, so that the distributed system receives the data signed by the terminal private key. The terminal can be checked by the public key of the terminal. In another mode, the terminal submits the terminal information to the distributed system, and the distributed system generates the public and private key of the terminal according to the terminal information, and returns the generated terminal private key to the terminal, optionally, by offline The terminal private key is returned to the terminal to ensure the security of the private key of the terminal.

The following two methods are respectively described in detail: the first method may include acquiring terminal information by the terminal, and generating a terminal public key and a terminal private key corresponding to the terminal public key according to the terminal information; and transmitting the terminal public key to the distributed system . The terminal information may include a terminal identifier, user information, such as an account number and a password, etc., according to the terminal information, the public key of the terminal may be generated through an open source tool, or the terminal information may be sent to an authoritative certificate authority center, and the authority certificate authority The terminal public key is generated according to the terminal information, and is sent to the terminal, and the terminal uploads the generated terminal public key to the distributed system, so that the distributed system can pass the terminal when receiving the data signed by the terminal private key. The key is checked. Specifically, the step of receiving a configuration file generated by the distributed system according to the terminal identifier and the registration type includes: after the distributed system successfully signs the terminal public key through the certificate authority, the receiving distributed system generates the terminal identifier and the registration type according to the terminal identifier and the registration type. Configuration file. After the distributed system receives the terminal public key uploaded by the terminal, the terminal public key is signed by the certificate authority on the distributed system to be stored in the distributed system, and the public key of the terminal is prevented from being acquired by other illegal elements. After the storage is complete, the authorization certificate is issued to the terminal, that is, the configuration file generated according to the terminal identifier and the registration type.

The second method may be that the terminal acquires the terminal information, and sends the terminal information to the distributed system, and the distributed system generates a public key of the corresponding terminal according to the terminal information, where the terminal information may include the terminal identifier and the user information. For example, an account and a password, the distributed system generates a public key of the terminal according to the terminal information through the certificate authority of the distributed system, and sends the terminal private key to the terminal for storage, and the terminal public key is stored in association with the terminal identifier to be distributed. The system, so that the distributed system can perform the verification by the terminal public key when receiving the data signed by the terminal private key. Receiving the terminal private key and the terminal public key corresponding to the terminal information returned by the distributed system, and the terminal private key and the terminal public key are generated by the distributed authorization system according to the terminal information by the certificate authorization center.

In the foregoing embodiment, the pre-configuration step may further generate a public-private key of the terminal, so that when the terminal and the distributed system perform data transmission, not only the temporary session key is used for encryption, but also the terminal public key is used for signing, thereby further improving the data. Security.

Referring to FIG. 4, FIG. 4 is a sequence diagram of a data processing method in an embodiment. In this embodiment, a terminal uploads data to a distributed system, and a public-private key of the terminal is generated by the terminal. In this embodiment, The distributed system is a blockchain.

The terminal first acquires the terminal information, and then generates the terminal public private key according to the terminal information. Secondly, the terminal sends a registration request to the blockchain, where the registration request carries the registration type, the terminal identifier, and the generated terminal public key information; After receiving the registration request, the block link signs the terminal public key through the certificate authority of the blockchain, and stores it on the blockchain, and generates a corresponding configuration file according to the registration type and the terminal identifier; The blockchain delivers the configuration file to the terminal, and the step can be performed in an offline manner. Fifth, the terminal configures the terminal according to the configuration file, for example, forms a corresponding security module. Sixth, after the configuration is completed, the terminal The authorization certificate can be obtained from the blockchain, that is, the data can be encrypted to ensure data security; seventh, the terminal exchanges with the blockchain according to the key exchange protocol by the security module to obtain a temporary session key; The temporary session key encrypts the uploaded data, and the data is added by the terminal private key; ninth, final The encrypted and tagged data is sent to the blockchain through the security module. Tenth, after receiving the encrypted and tagged data, the blockchain can obtain the terminal public key according to the terminal identifier, and pass the terminal public key. The encrypted and tagged data is checked. After the successful verification, the encrypted session data is decrypted by the temporary session key obtained by the key exchange to obtain the plaintext. After obtaining the plaintext, the zone can be passed as needed. The public and private keys on the blockchain encrypt the data and store it on the blockchain to ensure the security of the data on the blockchain.

The above data processing method pre-configures the interface in the authorization center, and does not need to be deployed at the ingress node of the blockchain, which greatly saves the deployment cost, and by configuring the interface to the authorized terminal, the data source in the blockchain can be rich and the access is more It is simple and convenient, and greatly relieves the pressure of the block link into the node, avoiding the problem of writing data by an access node.

It should be understood that although the various steps in the flowcharts of FIGS. 2-4 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIGS. 2-4 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be executed at different times, these sub-steps or stages The order of execution is not necessarily performed sequentially, but may be performed alternately or alternately with at least a portion of other steps or sub-steps or stages of other steps.

In one embodiment, as shown in FIG. 5, a data processing apparatus is provided, including a key acquisition module 100, an encryption module 200, and a write module 300, wherein:

The key obtaining module 100 is configured to obtain a first temporary session key by exchanging with a distributed system according to a key exchange protocol through a pre-configured interface.

The encryption module 200 is configured to encrypt the data to be written by using the first temporary session key.

The writing module 300 is configured to send the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system decrypts the encrypted data to be written by using the second temporary session key. In plaintext, the second temporary session key corresponds to the first temporary session key.

In one embodiment, the apparatus may further include:

The signing module is configured to: after encrypting the data to be written by the first temporary session key, sign the encrypted data to be written by using the pre-deployed terminal private key.

The writing module 300 is further configured to send the encrypted and signed data to be written to the distributed system through a pre-configured interface, so that the distributed system successfully checks the received data to be written through the terminal public key. Then, the encrypted data to be written is decrypted by the second temporary session key to obtain the first plaintext, and the terminal public key corresponds to the terminal private key.

In one embodiment, the apparatus may further include:

And a reading module, configured to receive, by using a pre-configured interface, the data to be read that is encrypted by the second temporary session key returned by the distributed system.

And a decryption module, configured to decrypt the encrypted data to be read by using the first temporary session key to obtain a second plaintext.

In one embodiment, the reading module is further configured to receive, by the pre-configured interface, the data to be read that is signed and encrypted by the terminal public key and the second temporary session key returned by the distributed system.

The device may further include an verification module, configured to: after the encrypted temporary data to be read is decrypted by the first temporary session key to obtain the second plaintext, the terminal private key is to be read after being signed by the terminal public key The data is checked to obtain the encrypted data to be read.

In one embodiment, the apparatus may further include:

The sending module is configured to send a registration request to the distributed system, where the registration request carries a registration type and a terminal identifier.

The receiving module is configured to receive a configuration file generated by the distributed system according to the terminal identifier and the registration type.

Configuration module for configuring according to the configuration file.

In one embodiment, the apparatus may further include:

The first public private key generating module is configured to acquire terminal information, and generate a terminal public key and a terminal private key corresponding to the terminal public key according to the terminal information.

The sending module is also used to send the terminal public key to the distributed system.

The receiving module is further configured to: after the distributed system successfully signs the terminal public key through the certificate authority, receive the configuration file generated by the distributed system according to the terminal identifier and the registration type.

In one of the embodiments, the sending module is further configured to acquire terminal information and send the terminal information to the distributed system.

The receiving module is further configured to receive the terminal private key and the terminal public key corresponding to the terminal information returned by the distributed system, where the terminal private key and the terminal public key are generated by the distributed authorization system according to the terminal information by the certificate authorization center.

For specific definitions of the data processing apparatus, reference may be made to the definition of the data processing method in the above, and details are not described herein again. The various modules in the data processing apparatus described above may be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor calls to perform operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in FIG. 6. The computer device includes a processor, memory, network interface, display screen, and input device connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The non-volatile storage medium stores operating systems and computer readable instructions. The internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. The computer readable instructions are executed by a processor to implement a data processing method. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or may be a button, a trackball or a touchpad provided on the computer device casing. It can also be an external keyboard, trackpad or mouse.

It will be understood by those skilled in the art that the structure shown in FIG. 6 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied. The specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions that, when executed by a processor, cause one or more processors to perform the steps of: preconfiguring an interface Obtaining a first temporary session key according to a key exchange protocol and a distributed system; and encrypting the data to be written by the first temporary session key; and sending the encrypted data to be written to the distributed through a pre-configured interface a system, wherein the distributed system decrypts the encrypted data to be written by using the second temporary session key to obtain a first plaintext, and the second temporary session key corresponds to the first temporary session key.

In one embodiment, after the step of encrypting the data to be written by the first temporary session key implemented by the processor when the processor executes the computer readable instructions, the method may further include: encrypting the to-be-prepared by the pre-deployed terminal private key pair Writing data for signature; transmitting the encrypted data to be written to the distributed system through a pre-configured interface when the processor executes the computer readable instructions, so that the distributed system is encrypted by the second temporary session key pair The step of decrypting the data to be decrypted to obtain the first plaintext may include: transmitting the encrypted and signed data to be written to the distributed system through a pre-configured interface, so that the distributed system receives the terminal through the public key pair After the data to be written is successfully verified, the encrypted data to be written is decrypted by the second temporary session key to obtain the first plaintext, and the terminal public key corresponds to the terminal private key.

In one embodiment, the processor, when executing the computer readable instructions, further implements: receiving, by the pre-configured interface, the data to be read after being encrypted by the second temporary session key returned by the distributed system; The temporary session key decrypts the encrypted data to be read to obtain a second plaintext.

In one embodiment, the step of receiving, by the processor when executing the computer readable instructions, the data to be read after being encrypted by the second temporary session key returned by the distributed system through the pre-configured interface may include: The configured interface receives, by the distributed system, the data to be read after being encrypted and encrypted by the terminal public key and the second temporary session key; and the first temporary session key pair implemented by the processor when executing the computer readable instruction Before the step of decrypting the encrypted data to obtain the second plaintext, the method further includes: performing, by using the terminal private key, the data to be read after the public key is signed by the terminal to obtain the encrypted data to be read.

In one embodiment, the processor, when executing the computer readable instructions, further implements the steps of: sending a registration request to the distributed system, the registration request carrying the registration type and the terminal identifier; and receiving the distributed system according to the terminal identifier and the registration type The generated configuration file; configured according to the configuration file.

In one embodiment, the processor further implements the steps of: acquiring terminal information, and generating a terminal public key and a terminal private key corresponding to the terminal public key according to the terminal information; and transmitting the terminal public key to the distribution And the step of receiving the configuration file generated by the distributed system according to the terminal identifier and the registration type, when the processor executes the computer readable instruction, may include: after the distributed system successfully signs the terminal public key through the certificate authority Receiving a configuration file generated by the distributed system according to the terminal identifier and the registration type.

In one embodiment, the processor further implements the steps of: acquiring terminal information and transmitting the terminal information to the distributed system; and receiving the terminal private key corresponding to the terminal information returned by the distributed system, when the processor executes the computer readable instructions The terminal public key, the terminal private key, and the terminal public key are generated by the distributed authorization system according to the terminal information by the certificate authority.

One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of: pre-configuring The interface exchanges with the distributed system according to the key exchange protocol to obtain the first temporary session key; encrypts the data to be written by the first temporary session key; and sends the encrypted data to be written to the distribution through a pre-configured interface The system is configured to cause the distributed system to decrypt the encrypted data to be written by using the second temporary session key to obtain a first plaintext, and the second temporary session key corresponds to the first temporary session key.

In one embodiment, after the step of encrypting the data to be written by the first temporary session key implemented by the processor, the computer readable instructions may further include: encrypting the encrypted pair by using a pre-deployed terminal The data to be written is signed; the computer readable instructions are executed by the processor to transmit the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system passes the second temporary session key pair The step of decrypting the encrypted data to obtain the first plaintext may include: sending the encrypted and signed data to be written to the distributed system through a pre-configured interface, so that the distributed system passes the terminal public key. After the verification of the received data to be written is successful, the encrypted data to be written is decrypted by the second temporary session key to obtain the first plaintext, and the terminal public key corresponds to the terminal private key.

In one embodiment, the computer readable instructions are further executed by the processor to: receive, by the pre-configured interface, the data to be read after being encrypted by the second temporary session key returned by the distributed system; A temporary session key decrypts the encrypted data to be read to obtain a second plaintext.

In one embodiment, the step of receiving, by the processor, the pre-configured interface, when the computer readable instructions are executed by the processor, the data to be read after being encrypted by the second temporary session key returned by the distributed system may include: The pre-configured interface receives the data to be read that is returned and encrypted by the terminal public key and the second temporary session key returned by the distributed system; and the first temporary session is implemented when the computer readable instructions are executed by the processor Before the step of decrypting the encrypted data to be read to obtain the second plaintext, the method may further include: performing, by using the terminal private key, the data to be read after the public key is signed by the terminal, and the encrypted to be read. data.

In one of the embodiments, the computer readable instructions are further executed by the processor to: send a registration request to the distributed system, the registration request carries a registration type and a terminal identifier; and the receiving distributed system is based on the terminal identifier and the registration type. The generated configuration file; and configured according to the configuration file.

In one embodiment, the computer readable instructions are further executed by the processor to: obtain terminal information, and generate a terminal public key and a terminal private key corresponding to the terminal public key according to the terminal information; and send the terminal public key to And the step of receiving the configuration file generated by the distributed system according to the terminal identifier and the registration type, when the computer readable instructions are executed by the processor, may include: when the distributed system signs the terminal public key through the certificate authority After successful, it receives the configuration file generated by the distributed system based on the terminal identification and registration type.

In one of the embodiments, the computer readable instructions are further executed by the processor to: acquire terminal information and transmit the terminal information to the distributed system; and receive the terminal private key corresponding to the terminal information returned by the distributed system And the terminal public key, the terminal private key and the terminal public key are generated by the distributed authorization system according to the terminal information by the certificate authority.

One of ordinary skill in the art can understand that all or part of the process of implementing the above embodiments can be completed by computer readable instructions, which can be stored in a non-volatile computer. The readable storage medium, which when executed, may include the flow of an embodiment of the methods as described above. Any reference to a memory, storage, database or other medium used in the various embodiments provided herein may include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The technical features of the above embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, It is considered to be the range described in this specification.

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A data processing method comprising:

Obtaining a first temporary session key by exchanging with a distributed system according to a key exchange protocol through a pre-configured interface;

Encrypting the data to be written by the first temporary session key; and

Transmitting the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system decrypts the encrypted data to be written by using a second temporary session key to obtain a first In plaintext, the second temporary session key corresponds to the first temporary session key.
The method according to claim 1, wherein after the encrypting the data to be written by the first temporary session key, the method further comprises:

Signing the encrypted data to be written by the pre-deployed terminal private key; and

Transmitting, by the pre-configured interface, the encrypted data to be written to the distributed system, so that the distributed system decrypts the encrypted data to be written by using a second temporary session key The first plaintext includes:

Sending the encrypted and signed data to be written to the distributed system through the pre-configured interface, so that the distributed system successfully checks the received data to be written through the terminal public key, and then passes the second The temporary session key decrypts the encrypted data to be written to obtain a first plaintext, and the terminal public key corresponds to the terminal private key.
The method of claim 1 further comprising:

Receiving, by the pre-configured interface, the data to be read after being encrypted by the second temporary session key returned by the distributed system; and

Decrypting the encrypted data to be read by using the first temporary session key to obtain a second plaintext.
The method according to claim 3, wherein the receiving, by the pre-configured interface, the data to be read after being encrypted by the second temporary session key returned by the distributed system comprises:

Receiving, by the pre-configured interface, the data to be read after being signed and encrypted by the terminal public key and the second temporary session key returned by the distributed system;

Before the decrypting the encrypted data to be read by the first temporary session key to obtain the second plaintext, the method further includes:

The encrypted data to be read is obtained by checking the data to be read after the terminal public key is signed by the terminal private key.
The method according to any one of claims 1 to 4, further comprising:

Sending a registration request to the distributed system, where the registration request carries a registration type and a terminal identifier;

Receiving a configuration file generated by the distributed system according to the terminal identifier and the registration type; and

Configure according to the configuration file.
The method of claim 5, wherein the method further comprises:

Obtaining terminal information, and generating a terminal public key and a terminal private key corresponding to the terminal public key according to the terminal information;

Transmitting the terminal public key to a distributed system; and

And the step of receiving the configuration file generated by the distributed system according to the terminal identifier and the registration type, including:

After the distributed system successfully signs the public key of the terminal by the certificate authority, receiving a configuration file generated by the distributed system according to the terminal identifier and the registration type.
The method of claim 5, wherein the method further comprises:

Obtaining terminal information and transmitting the terminal information to a distributed system; and

Receiving, by the distributed system, a terminal private key and a terminal public key corresponding to the terminal information, where the terminal private key and the terminal public key are generated by the distributed authorization system according to the terminal information by using a certificate authority.
A data processing device comprising:

a key obtaining module, configured to exchange, by using a pre-configured interface, a first temporary session key according to a key exchange protocol and a distributed system;

An encryption module, configured to encrypt data to be written by using the first temporary session key; and

a writing module, configured to send the encrypted data to be written to the distributed system through a pre-configured interface, so that the distributed system writes the encrypted to be written by using a second temporary session key The data is decrypted to obtain a first plaintext, and the second temporary session key corresponds to the first temporary session key.
The device according to claim 8, wherein the device further comprises:

a signing module, configured to: after encrypting the data to be written by the first temporary session key, sign the encrypted data to be written by using a pre-deployed terminal private key; and

The writing module is further configured to send the encrypted and signed data to be written to the distributed system through a pre-configured interface, so that the distributed system checks the received data to be written by using the terminal public key. After the success, the encrypted data to be written is decrypted by the second temporary session key to obtain a first plaintext, and the terminal public key corresponds to the terminal private key.
A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processor performs the steps of: obtaining, by the pre-configured interface, the first temporary session key by exchanging with the distributed system according to the key exchange protocol; encrypting the data to be written by the first temporary session key; and pre-configuring The interface sends the encrypted data to be written to the distributed system, so that the distributed system decrypts the encrypted data to be written by using the second temporary session key to obtain the first plaintext. The second temporary session key corresponds to the first temporary session key.
The computer device according to claim 10, wherein after the processor executes the computer readable instructions to encrypt the data to be written by the first temporary session key, the method further includes : signing the encrypted data to be written by a pre-deployed terminal private key; and

Transmitting the encrypted data to be written to the distributed system through the pre-configured interface when the processor executes the computer readable instructions to cause the distributed system to pass the second temporary session Decrypting the encrypted data to be written to obtain the first plaintext, comprising: sending the encrypted and signed data to be written to the distributed system through a pre-configured interface, so that the distributed system After the verification of the received data to be written by the terminal public key is successful, the encrypted data to be written is decrypted by the second temporary session key to obtain the first plaintext, and the terminal public key is private to the terminal. The key corresponds.
The computer apparatus according to claim 10, wherein said processor, when said computer readable instructions are executed, further performing the step of: receiving, by a preconfigured interface, the encryption by the second temporary session key returned by the distributed system After the data to be read is decrypted; and the encrypted data to be read is decrypted by the first temporary session key to obtain a second plaintext.
The computer apparatus according to claim 12, wherein said processor, when said processor executing said computer readable instructions, receives a second temporary session key encryption returned by said distributed system via a preconfigured interface The data to be read after the receiving data includes: receiving, by the pre-configured interface, the data to be read that is returned and encrypted by the terminal public key and the second temporary session key returned by the distributed system;

Before the step of decrypting the encrypted data to be read by the first temporary session key to obtain the second plaintext, the processor further includes: passing The terminal private key checks the data to be read after the terminal public key is added to obtain the encrypted data to be read.
A computer apparatus according to any one of claims 10 to 13, wherein the processor, when executing the computer readable instructions, further performs the step of transmitting a registration request to the distributed system, the registration request being carried Having a registration type and a terminal identifier; receiving a configuration file generated by the distributed system according to the terminal identifier and the registration type; and configuring according to the configuration file.
A computer apparatus according to claim 14, wherein said processor, when said computer readable instructions are executed, further performing the steps of: acquiring terminal information, and generating a terminal public key and a terminal public key based on said terminal information Corresponding terminal private key; transmitting the terminal public key to a distributed system; and

The receiving the configuration file generated by the distributed system according to the terminal identifier and the registration type, when the processor executes the computer readable instructions, includes: when the distributed system authorizes to pass a certificate After the center successfully signs the terminal public key, the center receives the configuration file generated by the distributed system according to the terminal identifier and the registration type.
A computer apparatus according to claim 15, wherein said processor, when said computer readable instructions are executed, further performing the steps of: acquiring terminal information, and transmitting said terminal information to a distributed system; and receiving distribution The terminal private key and the terminal public key corresponding to the terminal information returned by the system, the terminal private key and the terminal public key are generated by the distributed authorization system according to the terminal information by the certificate authorization center.
One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps: Obtaining a first temporary session key by exchanging with a distributed system according to a key exchange protocol through a pre-configured interface; encrypting the data to be written by the first temporary session key; and encrypting the to-be-configured interface through a pre-configured interface Writing data to the distributed system, so that the distributed system decrypts the encrypted data to be written by using a second temporary session key to obtain a first plaintext, the second temporary session key Corresponding to the first temporary session key.
A storage medium according to claim 17, wherein said computer readable instructions are encrypted by said first temporary session key when said processor performs execution of said data to be written to said data The method includes: signing the encrypted data to be written by using a pre-deployed terminal private key; and

Transmitting the encrypted data to be written to the distributed system by the preconfigured interface implemented by the processor when the computer readable instructions are executed to cause the distributed system to pass the second temporary The session key decrypts the encrypted data to be written to obtain the first plaintext, including: sending the encrypted and signed data to be written to the distributed system through a pre-configured interface, so that the distributed After the system successfully checks the received data to be written by using the terminal public key, the system decrypts the encrypted data to be written by using the second temporary session key to obtain the first plaintext, and the terminal public key and the terminal The private key corresponds.
A storage medium according to claim 17, wherein said computer readable instructions, when executed by said processor, further perform the step of receiving, by a preconfigured interface, a second temporary session key returned by the distributed system And the encrypted data to be read; and decrypting the encrypted data to be read by using the first temporary session key to obtain a second plaintext.
A storage medium according to claim 19, wherein said computer readable instructions are received by said processor to receive a second temporary session key returned by the distributed system via a preconfigured interface The encrypted data to be read includes: receiving, by using a pre-configured interface, the data to be read after being signed and encrypted by the terminal public key and the second temporary session key returned by the distributed system;

Before the step of decrypting the encrypted data to be read by the first temporary session key to obtain the second plaintext, the processor further includes: passing The terminal private key checks the data to be read after the terminal public key is added to obtain the encrypted data to be read.