WO2020088108A1

WO2020088108A1 - Blockchain-based data attestation method and apparatus, and electronic device

Info

Publication number: WO2020088108A1
Application number: PCT/CN2019/104943
Authority: WO
Inventors: 王林青; 蒋海滔; 张鸿; 翁欣雨; 李富强; 林锋; 吴军; 曾晓东; 杨磊
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2018-10-31
Filing date: 2019-09-09
Publication date: 2020-05-07
Also published as: TWI701573B; CN109660350A; TW202018569A

Abstract

Disclosed is a blockchain-based data attestation method, which is applied to a terminal device, wherein the terminal device is mounted with a secure computing environment, and a private key corresponding to the terminal device is stored in the secure computing environment. The method comprises: obtaining collected target data; calculating a data digest of the target data; signing the data digest on the basis of the private key corresponding to the terminal device in the secure computing environment, and publishing the signed data digest to a blockchain, so that a node device in the blockchain verifies the signature of the data digest on the basis of a public key corresponding to the private key, and once the signature verification passes, data attestation is performed for the data digest in the blockchain.

Description

Blockchain-based data storage method and device, and electronic equipment

Technical field

One or more embodiments of this specification relate to the field of blockchain technology, and in particular to a blockchain-based data certification method and device, and electronic equipment.

Background technique

Blockchain technology, also known as distributed ledger technology, is an emerging technology in which several computing devices jointly participate in "bookkeeping" and jointly maintain a complete distributed database. Blockchain technology has the characteristics of decentralization, openness and transparency, each computing device can participate in database records, and data synchronization can be quickly performed between computing devices, making blockchain technology widely used in many fields. To apply.

Summary of the invention

This specification proposes a blockchain-based data storage method, which is applied to terminal devices; wherein the terminal device is equipped with a secure computing environment, and the secure computing environment stores a private key corresponding to the terminal device The method includes:

Obtain the collected target data;

Calculate a data summary of the target data;

Sign the data digest based on the private key corresponding to the terminal device in the secure computing environment, and publish the signed data digest to the blockchain to allow the nodes in the blockchain The device verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.

Optionally, signing the data digest based on the private key corresponding to the terminal device in the secure computing environment includes:

Acquiring identity information input by the user of the terminal;

Perform identity authentication for the user based on the obtained identity information;

If the identity authentication for the user is passed, the data digest is signed based on the private key corresponding to the terminal device in the secure computing environment.

Optionally, a key generation algorithm is stored in the secure computing environment;

The method also includes:

Acquiring the identity information input by the user of the terminal device when using the terminal device for the first time;

If the identity authentication for the user is passed, call the key generation algorithm in the secure computing environment to generate the private key and the public key; and,

The generated private key is bound to the user's identity information, and the binding relationship is stored in the secure computing environment.

Acquiring identity information input by the user of the terminal;

Determining whether a private key bound to the identity information is stored in the secure computing environment;

If so, sign the data digest based on the private key bound to the identity information in the secure computing environment.

Optionally, the secure computing environment also stores device authentication information signed based on the private key held by the manufacturer of the terminal device;

Before signing the data digest based on the private key in the secure computing environment, the method further includes:

Verify the signature of the device authentication information based on the public key corresponding to the private key held by the manufacturer of the terminal device; if the verification passes, determine that the terminal device is a legitimate terminal device produced by the manufacturer, Sign the data digest based on the private key corresponding to the terminal device in the secure computing environment.

Optionally, signing the data digest based on the private key corresponding to the terminal device in the secure computing environment, and publishing the signed target data to the blockchain includes:

In the secure computing environment, the data digest and the description information of the target data are overall signed based on the private key corresponding to the terminal device, and the signed data digest and the description data are published To the blockchain certificate; or,

In the secure computing environment, sign the data digest based on the private key corresponding to the terminal device, and publish the description data of the target data and the signed data digest to the blockchain.

Optionally, the description data includes: a collection time, a collection location of the target data, and a combination of one or more of the objects related to the target data.

Optionally, the terminal device includes a law enforcement recorder or a driving recorder; the target data includes one or a combination of video data, audio data, and image data.

This specification also proposes a blockchain-based data certificate storage device, which is applied to terminal devices; wherein the terminal device is equipped with a secure computing environment, and the secure computing environment stores a private key corresponding to the terminal device , The device includes:

Acquisition module to acquire the collected target data;

A calculation module to calculate a data summary of the target data;

The certificate storage module signs the data digest based on the private key corresponding to the terminal device in the secure computing environment, and publishes the signed data digest to the blockchain to allow the block The node device in the chain verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.

Optionally, the certificate storage module further:

Acquiring identity information input by the user of the terminal;

The acquisition module further:

The certificate storage module further:

Performing identity authentication for the user based on the identity information obtained by the obtaining module; if the identity authentication for the user is passed, calling the key generation algorithm in the secure computing environment to generate the private A key and a public key; and, binding the generated private key with the identity information of the user, and storing the binding relationship in the secure computing environment.

Optionally, the certificate storage module further:

Acquiring identity information input by the user of the terminal;

The certificate storage module further:

Before signing the data digest based on the private key in the secure computing environment, verify the signature of the device authentication information based on the public key corresponding to the private key held by the manufacturer of the terminal device; If the verification is passed, it is determined that the terminal device is a legal terminal device produced by the manufacturer, and the data digest is further signed based on the private key corresponding to the terminal device in the secure computing environment.

Optional, certificate storage module:

This manual also proposes an electronic device, including:

processor;

Memory for storing machine executable instructions;

Wherein, by reading and executing the machine-executable instructions stored in the memory corresponding to the control logic of the blockchain-based blockchain-based data certification, the processor is prompted to:

Acquiring the collected target data; wherein, the electronic device is equipped with a secure computing environment, and a private key corresponding to the electronic device is stored in the secure computing environment;

Calculate a data summary of the target data;

Sign the data digest based on the private key corresponding to the electronic device in the secure computing environment, and publish the signed data digest to the blockchain to allow the nodes in the blockchain The device verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.

In the above technical solution, on the one hand, through the transformation of the hardware environment of the terminal device, the terminal device is equipped with a secure computing environment, and the private key corresponding to the terminal device is stored in the secure computing environment, so that the terminal device will collect When storing data on the blockchain, you can sign the data that needs to be stored based on the private key in the secure computing environment, so that the data stored on the blockchain can be prevented from being tampered during the propagation process. Ensure data security when storing data on the blockchain;

On the other hand, by improving the process of data certification on the blockchain, terminal devices no longer need to deposit the original content of the collected data on the blockchain, but the original content of the collected data Store locally, and deposit the data summary of the original content on the blockchain, so that the terminal device can serve as the hub of the physical world and the on-chain world, and it is more convenient to deposit the collected data on the blockchain; Moreover, for the third party that obtains the data collected by the terminal, since the data summary of the obtained data is matched with the data summary of the data stored on the blockchain, the obtained data can be conveniently Perform legality verification; therefore, the data collected by the terminal device can be submitted to third parties as evidence, which can significantly improve the availability of the data collected by the terminal device.

BRIEF DESCRIPTION

FIG. 1 is a flowchart of a blockchain-based data certification method provided by an exemplary embodiment.

FIG. 2 is a schematic structural diagram of an electronic device provided by an exemplary embodiment.

FIG. 3 is a block diagram of a blockchain-based data certification device provided by an exemplary embodiment.

detailed description

Because the data stored in the blockchain is tamper-proof, it is the current mainstream trend in the industry to store the data on the blockchain for data storage.

However, in practical applications, for some streaming data; for example, video streams, audio streams and other data collected by law enforcement recorders or driving recorders; due to the large storage space required by itself, it cannot usually be directly stored to Deposit certificate on the blockchain.

However, in some scenarios, there is a strong evidence storage requirement for such streaming data; for example, in the case of judicial evidence storage, the video stream collected by the law enforcement recorder or driving recorder may be submitted as evidence to the judicial department.

Due to the lack of data authentication methods, the legality of such streaming data as evidence is often widely questioned. Therefore, for this kind of streaming data, the best way to deal with it is to store it on the blockchain for data bureau certification; at the same time, it also needs to be able to more easily verify the legitimacy of the data stored as judicial evidence.

Based on the above requirements, this specification proposes a technical solution that uses the terminal device as the hub of the physical world and the on-chain world to more conveniently store the data it collects on the blockchain.

During implementation, the hardware environment of the terminal device can be improved, a secure computing environment can be built in the hardware environment of the terminal device, and the private key corresponding to the terminal device can be stored and maintained in the secure computing environment.

For example, taking a terminal device as a law enforcement recorder or a driving recorder as an example, a security chip can be mounted in the hardware environment of the law enforcement recorder or a driving recorder, and a secure computing environment can be built based on the security chip. Store and maintain the private key held by the law enforcement recorder or driving recorder, and provide a secure computing environment for the law enforcement recorder or driving recorder.

Further, after collecting the data that needs to be stored on the blockchain, the terminal device can obtain the collected data and calculate the data summary of the collected data, and then based on the private corresponding to the terminal device in the secure computing environment Key, sign the calculated data digest, and then publish the signed data digest to the blockchain.

After receiving the signed data digest issued by the terminal device, the node device in the blockchain can obtain the public key corresponding to the private key of the terminal device, and then verify the signature of the data digest based on the public key; if After the signature is verified, the data digest can be stored in the blockchain for data certification.

The following describes the specification through specific embodiments and specific application scenarios.

Please refer to FIG. 1. FIG. 1 is a blockchain-based data certification method provided in an embodiment of the present specification, which is applied to a terminal device, wherein the terminal device is equipped with a secure computing environment, and the secure computing environment The private key corresponding to the terminal device is stored and the following steps are performed:

Step 102: Obtain the collected target data;

Step 104: Calculate the data summary of the target data;

Step 106, sign the data digest based on the private key corresponding to the terminal device in the secure computing environment, and publish the signed data digest to the blockchain, so that the blockchain The node device in verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified for data in the blockchain.

The blockchain described in this specification may specifically include private chains, shared chains, and alliance chains, etc., and is not particularly limited in this specification.

For example, in a scenario, the above-mentioned blockchain may specifically be a consortium chain consisting of a server of a third-party payment platform, a domestic bank server, an overseas bank server, and several user node devices as member devices. The operator of the alliance chain can rely on the alliance chain to deploy online services such as cross-border transfer and asset transfer based on the alliance chain online.

The above terminal device may include any form of terminal device that can join the blockchain as a node device and deposit the collected data on the blockchain;

For example, in practical applications, the terminal device may specifically include a law enforcement recorder or a driving recorder. Law enforcement recorders or driving recorders can be added to the blockchain as nodes, and the collected streaming data such as video data and audio data can be stored on the blockchain for certification.

Among them, storing data on the blockchain refers to using the data as evidence for persistent storage in the blockchain.

The above target data, including any type of data collected by the terminal device, needs to be completed in the distributed database of the blockchain for data certification;

For example, the above target data may specifically be stream data such as video data, audio data, and image data collected by terminal devices such as law enforcement recorders or driving recorders.

In this manual, you can transform the hardware environment of the terminal device, build a secure computing environment in the hardware environment of the terminal device, and use the built secure computing environment to store and maintain the private key corresponding to the terminal device and face the terminal. The device provides a safe computing environment.

Among them, the specific way to build a secure computing environment in the hardware environment of the terminal device is not particularly limited in this specification.

In practical applications, you can build a secure computing environment by introducing new hardware into the hardware environment of the terminal device, or you can modify the software environment of the existing hardware in the terminal device hardware environment to build a secure computing environment; or, It is also possible to build a safe computing environment for the terminal device by combining new hardware introduced into the hardware environment of the terminal device and a building method that transforms the software environment of the existing hardware in the hardware environment of the terminal device.

For example, in one embodiment, a solution based on SE (Secure Elements) can be used to build a secure computing environment for terminal devices. With this solution, SE hardware can be introduced into the hardware environment of the terminal device (either hardware built into the terminal ’s hardware environment or hardware externally connected to the terminal through the interface), using SE hardware to store and Maintain the private key of the terminal equipment, and provide a secure computing environment for the terminal equipment.

In another embodiment shown, a solution based on TEE (Trusted Execution, Trusted Execution Environment) can be used to build a secure computing environment for terminal devices. With this solution, you can transform the software environment of the existing hardware (such as the main chip) in the hardware environment of the terminal device, build a trusted execution environment in the software environment, and use the trusted execution environment to store And maintain the private key of the terminal equipment, and provide a secure computing environment for the terminal equipment.

In the third embodiment shown, a solution based on SE + TEE can be adopted to build a secure computing environment for terminal devices. Under this solution, SE hardware can be used to store and maintain the private key of the terminal device, and TEE can be used to provide a secure computing environment for the terminal device.

It should be noted that the embodiments listed above for establishing a secure computing environment for terminal devices are exemplary. In practical applications, it is obvious that other implementation means listed above can also be used to build a secure computing environment for the terminal device, which is not enumerated in this specification.

In this specification, the above terminal device can be added as a node device to the blockchain (also known as device on-chain), and the private key corresponding to the terminal device is performed in a secure computing environment built for the terminal device Storage and maintenance.

Wherein, the private key corresponding to the terminal device may specifically be a private key held by the terminal device or a private key held by a user who uses the terminal device.

That is, the "private key corresponding to the terminal device" described in this specification may specifically be the private key generated by the terminal device manufacturer for the terminal device in the device production stage and held by the terminal device; also It may be a private key generated by the terminal device for the user when the user uses the terminal device, and held by the user personally.

In an embodiment shown, the private key and the public key held by the terminal device can be generated by the device manufacturer for the terminal device during the device production stage, and the private key is written into the terminal device by the device manufacturer in advance Storage and maintenance in a secure computing environment.

In this case, the private key and public key held by the terminal device are not related to the identity of the user who uses the terminal device. For different users of the terminal device, they can share the same private key written by the device manufacturer in the secure computing environment of the terminal device by default.

In an embodiment shown, the private key and the public key held by the terminal device can also be generated by the terminal device for the user of the terminal device, and the terminal device can automatically write the private key to the Safe computing environment for terminal equipment.

In this case, the private key and the public key generated by the terminal device can be associated with the identity of the user of the terminal device, and the terminal device can generate one for each user based on the identity information of the different user. Bind the private key and the public key, and bind the generated private key with the identity information of each user, and then store and maintain the binding relationship in a secure computing environment.

For example, during implementation, the manufacturer of the terminal device may write the key generation algorithm into the secure computing environment of the terminal device in advance. When the user of the terminal device is using the terminal device, the terminal device may prompt the user to input identity information for identity authentication;

Among them, the data type of the identity information input by the user and the identity authentication method adopted by the terminal device are not particularly limited in this specification; for example, a traditional authentication method such as entering a password or a password may also be used. Authentication methods such as fingerprints or human faces.

After the terminal device obtains the identity information input by the user, it can determine whether the private key bound to the identity information is stored in the secure computing environment; if the private key bound to the identity information is not stored in the secure computing environment, It indicates that the user is a new user using the terminal device for the first time. At this time, the terminal device can authenticate the user based on the obtained identity information; if the identity authentication for the user is passed, the terminal device can be in the above security Call the above key generation algorithm in the computing environment to generate a pair of private and public keys, and bind the generated private key with the user's identity information, and then store and maintain the binding relationship in the above secure computing environment .

In this specification, users can use terminal devices to collect data, and deposit the collected data on the blockchain through the terminal device.

Among them, in this specification, the terminal device only needs to store the collected data locally, and save the data summary of the collected data on the blockchain, and it is no longer necessary to store the original data collected. The content is stored on the blockchain.

It should be noted that if the target data collected by the terminal device is streaming data such as video data, audio data, etc., when such streaming data is stored on the blockchain, the terminal device can check the streaming data according to a preset time period Ways to conduct shard deposit certificate;

For example, taking video data as an example, the terminal device can take the video data every N minutes as a shard, calculate the data summary of the shard, and then deposit the data summary of the shard in the blockchain, and strictly Ensure the chronological order of the data summary of each shard stored on the blockchain to facilitate backtracking.

In this specification, when the terminal device needs to collect the collected target data on the blockchain, it can first calculate the data summary of the target data; for example, the data summary can be calculated based on a specific hash algorithm The hash value of the target data; then, the terminal device can sign the data digest based on the private key stored in the secure computing environment in the secure computing environment.

In an embodiment shown, in the secure computing environment of the terminal device described above, device authentication information after signing based on the private key held by the manufacturer of the terminal device can also be stored and maintained; for example, the device The authentication information can be written into the secure computing environment for storage and maintenance after the device manufacturer signs the signature based on the held private key at the device generation stage.

Wherein, the above-mentioned device authentication information may specifically be any form of information for legally authenticating the terminal device; for example, the above-mentioned device authentication information may specifically be such as the production number of the terminal device or other forms of anti-counterfeiting information.

In this case, the terminal device can obtain the key corresponding to the private key held by the manufacturer of the terminal device before signing the data digest based on the private key stored in the secure computing environment in the secure computing environment The public key, and based on the obtained public key, verify the signature of the device authentication information; if the verification is passed, it can be determined that the terminal device is a legitimate terminal device produced by the manufacturer; at this time, the terminal device performs further, In a secure computing environment, the process of signing the data digest based on the private key stored in the secure computing environment.

In this way, you can introduce legal verification of terminal devices based on the private key stored in the secure computing environment before signing the summary data on the chain, and terminate some illegal devices (such as counterfeit devices or after malicious modification) in a timely manner Legal equipment) can improve the data security level of the data on the chain.

In one embodiment shown, if the private key stored and maintained in the secure computing environment of the terminal device is the private key generated by the device manufacturer for the terminal device during the device production stage and held by the terminal device; In this case, an identity authentication mechanism for the user of the terminal device can be introduced to prompt the user to enter identity information for identity authentication; when the terminal device obtains the identity information entered by the user, the user can use the identity information based on the obtained identity information. The user performs identity authentication; if the identity authentication for the user is passed, the terminal device can sign the data digest in the secure computing environment based on the private key held and maintained by the terminal device in the secure computing environment deal with.

In one embodiment shown, if the private key stored and maintained in the secure computing environment of the terminal device, the terminal device autonomously generates the private key generated by the user and held by the user; at this time, the secure computing environment The binding relationship between the user's identity information and the private key is stored and maintained in advance.

In this case, after the terminal device obtains the identity information input by the user, it can query the binding relationship maintained in the secure computing environment to determine whether the private key bound to the identity information is stored in the secure computing environment; If the private key bound to the identity information is stored in the secure computing environment, the terminal device can sign the data summary based on the queried private key in the secure computing environment.

Of course, if the private key bound to the identity information is not stored in the secure computing environment, it indicates that the user is a new user using the terminal device for the first time. At this time, the terminal device can identify the user based on the obtained identity information. Perform identity authentication, and after the identity authentication is passed, call the key generation algorithm stored in the secure computing environment to generate the private key and public key for the user, and use the generated private key to sign the data digest; and , Bind the generated private key with the user's identity information, and then store and maintain the binding relationship in a secure computing environment.

In this specification, when the terminal device is in a secure computing environment, based on the private key stored in the secure computing environment, after the signature digest of the collected target data is completed, the signed data digest can be placed in the block Publish in the chain;

For example, a blockchain transaction (Transaction) can be constructed based on the signed data digest, and the transaction can be broadcast and diffused to other node devices.

After receiving the signed data digest, the node device in the blockchain can obtain the public key corresponding to the private key stored in the secure computing environment, and then verify the signature of the data digest based on the obtained public key; If the signature verification of the data digest is passed, the node device can initiate consensus processing on the data digest in the blockchain, and after the data digest consensus processing is passed, package the data digest into the block in the blockchain Store to complete the data certification for the data summary.

Among them, it should be noted that the consensus mechanism adopted by the blockchain described in this specification is not particularly limited in this specification. In practical applications, the operator of the blockchain can flexibly based on actual needs select.

In another embodiment shown, when the terminal device collects the target data, when depositing on the blockchain, it can also describe the target data and the data summary of the target data. And deposit certificates on the blockchain.

In this case, the terminal device in the secure computing environment, based on the private key stored in the secure computing environment, when signing the data summary of the target data, the data summary and the description information of the target data can be signed as a whole The data summary and the description information of the target data are packaged and signed as a whole; then, the signed data summary and the description data of the above target data are released to the blockchain for data certification.

For example, the terminal device may construct a blockchain transaction based on the signed data digest and the above-mentioned target data description data, and broadcast the transaction to other node devices for broadcast diffusion.

Or, in another case, when the terminal device in the secure computing environment signs the data digest of the target data based on the private key stored in the secure computing environment, it may also sign only the data digest; then , The description data of the above target data, and the signed data summary, are released to the blockchain for data certification.

For example, the terminal device may construct a blockchain transaction based on the description data of the target data and the signed data summary, and broadcast the transaction to other node devices for broadcast diffusion.

The specific content contained in the description information of the above target data is not particularly limited in this specification, and in practical applications, it can cover any content related to the above target data;

In the illustrated embodiment, because the data collection time, collection location, and data-related objects are usually extremely important attributes of the data as evidence documents; therefore, in this specification, the description information of the above target data, Specifically, it may include a collection time, a collection location of the target data, and a combination of one or more of the objects related to the target data.

Among them, in one embodiment shown, the target data collection time may specifically be the terminal authority interacts with the time authentication center when the target data is collected, and obtains the authoritative authorized time obtained from the time authentication center ( Timestamp). The collection location of the target data may be an accurate collection location obtained by calling the positioning module (such as a GPS module) carried by the terminal device in real time when the terminal device collects the target data. The object related to the above target data may be a related object manually input by a legal user of the terminal device after the terminal device collects the target data.

For example, taking the forensic video data collected by the law enforcement recorder and the car accident incident as an example, the description information of the video data may specifically include the authoritative and authorized moments acquired from the time certification center At the moment of the video data, the law enforcement recorder calls the precise collection location obtained by the positioning module in real time, and the vehicle information and driver information related to the video data input by the law enforcement officer.

On the other hand, by improving the process of data certification on the blockchain, terminal devices no longer need to deposit the original content of the collected data on the blockchain, but the original content of the collected data Store locally, and deposit the data summary of the original content on the blockchain, so that the terminal device can serve as the hub of the physical world and the on-chain world, and it is more convenient to deposit the collected data on the blockchain;

Moreover, for the third party that obtains the data collected by the terminal, since the data summary of the obtained data is matched with the data summary of the data stored on the blockchain, the obtained data can be conveniently Perform legality verification; therefore, the data collected by the terminal device can be submitted to third parties as evidence, which can significantly improve the availability of the data collected by the terminal device.

For example, for terminal devices such as law enforcement recorders or driving recorders, you only need to store the original content of the collected streaming data such as video data and audio data locally, and summarize the data of the original content of these streaming data on the blockchain Just deposit the certificate, no longer need to deposit the original content of these stream data on the blockchain;

Moreover, when the user submits the flow data collected by the law enforcement recorder or driving recorder as evidence to a third-party institution (such as a judicial institution or an insurance company), the third-party institution only needs to recalculate the data summary of the obtained data The data summary of the data matches the data summary of the data stored on the blockchain, so that the legality of the obtained data can be conveniently verified, so that in this way, the law enforcement recorder or driving recorder can be significantly improved The high availability of the collected data as legal evidence files.

Corresponding to the above method embodiments, this specification also provides an embodiment of a blockchain-based data storage device. The embodiment of the blockchain-based data certification device of this specification can be applied to electronic devices. Wherein, the electronic device is equipped with a secure computing environment, and a private key corresponding to the electronic device is stored in the secure computing environment. The device embodiments may be implemented by software, or by hardware or a combination of hardware and software. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory through the processor of the electronic device where it is located. From the hardware level, as shown in Figure 2, it is a hardware structure diagram of the electronic equipment where the blockchain-based data certification device is located in this specification, except for the processor, memory, network interface, and In addition to the non-volatile memory, the electronic device in which the apparatus is located in the embodiment generally may include other hardware according to the actual function of the electronic device, which will not be repeated here.

FIG. 3 is a block diagram of a blockchain-based data certification device shown in an exemplary embodiment of this specification.

Please refer to FIG. 3, the blockchain-based data certification device 30 can be applied to the aforementioned electronic device shown in FIG. 2, including: an acquisition module 301, a calculation module 302 and a certification module 303.

The obtaining module 301 obtains the collected target data;

The calculation module 302 calculates the data summary of the target data;

The certificate storage module 303 signs the data digest based on the private key corresponding to the electronic device in the secure computing environment, and publishes the signed data digest to the blockchain to allow The node device in the blockchain verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.

In this embodiment, the certificate storage module 303 further:

Acquiring identity information input by the user of the terminal;

If the identity authentication for the user is passed, the data digest is signed based on the private key corresponding to the electronic device in the secure computing environment.

In this embodiment, a key generation algorithm is stored in the secure computing environment;

The obtaining module 301 further:

Acquiring the identity information input by the user of the electronic device when using the electronic device for the first time;

The certificate storage module 303 further:

Based on the identity information acquired by the acquiring module 301, perform identity authentication for the user; if the identity authentication for the user is passed, call the key generation algorithm in the secure computing environment to generate the A private key and a public key; and, binding the generated private key with the identity information of the user, and storing the binding relationship in the secure computing environment.

In this embodiment, the certificate storage module 303 further:

Acquiring identity information input by the user of the terminal;

In this embodiment, the secure computing environment also stores device authentication information signed based on the private key held by the manufacturer of the electronic device;

The certificate storage module 303 further:

Before signing the data digest based on the private key in the secure computing environment, verifying the signature of the device authentication information based on the public key corresponding to the private key held by the manufacturer of the electronic device; If the verification is passed, it is determined that the electronic device is a legitimate electronic device produced by the manufacturer, and the data digest is further signed based on the private key corresponding to the electronic device in the secure computing environment.

In this embodiment, the certificate storage module 303:

In the secure computing environment, based on the private key corresponding to the electronic device, the data digest and the description information of the target data are overall signed, and the signed data digest and the description data are published To the blockchain certificate; or,

Sign the data digest based on the private key corresponding to the electronic device in the secure computing environment, and publish the description data of the target data and the signed data digest to the blockchain.

In this embodiment, the description data includes: a collection time of the target data, a collection location, and a combination of one or more of the objects related to the target data.

In this embodiment, the electronic device includes a law enforcement recorder or a driving recorder; the target data includes one or a combination of one of video data, audio data, and image data.

For the implementation process of the functions and functions of each module in the above device, please refer to the implementation process of the corresponding steps in the above method for details, which will not be repeated here.

As for the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the description of the method embodiments. The device embodiments described above are only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, may be located in One place, or can be distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solution in this specification. Those of ordinary skill in the art can understand and implement without paying creative labor.

The system, device, module or module explained in the above embodiments may be implemented by a computer chip or entity, or by a product with a certain function. A typical implementation device is a computer, and the specific form of the computer may be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email sending and receiving device, and a game control Desk, tablet computer, wearable device, or any combination of these devices.

Corresponding to the above method embodiments, this specification also provides an embodiment of an electronic device. The electronic device includes: a processor and a memory for storing machine-executable instructions; wherein, the processor and the memory are usually connected to each other through an internal bus. In other possible implementations, the device may also include an external interface to be able to communicate with other devices or components.

In this embodiment, by reading and executing machine-executable instructions stored in the memory corresponding to the control logic of blockchain-based data certification, the processor is prompted to:

Calculate a data summary of the target data;

Acquiring identity information input by the user of the terminal;

By reading and executing machine-executable instructions stored in the memory corresponding to the control logic of blockchain-based data certification, the processor is prompted to:

Acquiring identity information input by the user of the terminal;

Verify the signature of the device authentication information based on the public key corresponding to the private key held by the manufacturer of the electronic device; if the verification passes, determine that the electronic device is a legitimate electronic device produced by the manufacturer, further Sign the data digest based on the private key corresponding to the electronic device in the secure computing environment.

After considering the description and practicing the invention disclosed herein, those skilled in the art will easily think of other embodiments of the description. This specification is intended to cover any variations, uses, or adaptive changes of this specification. These variations, uses, or adaptive changes follow the general principles of this specification and include common general knowledge or common technical means in the technical field not disclosed in this specification. . The description and examples are to be considered exemplary only, and the true scope and spirit of this description are pointed out by the following claims.

It should be understood that this specification is not limited to the precise structure that has been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of this description is limited only by the appended claims.

The above are only the preferred embodiments of this specification and are not intended to limit this specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of this specification should be included in this specification Within the scope of protection.

Claims

A blockchain-based data certification method applied to terminal equipment; wherein the terminal equipment is equipped with a secure computing environment, and the secure computing environment stores a private key corresponding to the terminal equipment, the method include:

Obtain the collected target data;

Calculate a data summary of the target data;

Sign the data digest based on the private key corresponding to the terminal device in the secure computing environment, and publish the signed data digest to the blockchain to allow the nodes in the blockchain The device verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.
The method according to claim 1, wherein signing the data digest based on the private key corresponding to the terminal device in the secure computing environment includes:

Acquiring identity information input by the user of the terminal;

Perform identity authentication for the user based on the obtained identity information;

If the identity authentication for the user is passed, the data digest is signed based on the private key corresponding to the terminal device in the secure computing environment.
The method according to claim 1, wherein a key generation algorithm is stored in the secure computing environment;

The method also includes:

Acquiring the identity information input by the user of the terminal device when using the terminal device for the first time;

Perform identity authentication for the user based on the obtained identity information;

If the identity authentication for the user is passed, call the key generation algorithm in the secure computing environment to generate the private key and the public key; and,

The generated private key is bound to the user's identity information, and the binding relationship is stored in the secure computing environment.
According to the method of claim 3, signing the data digest based on the private key corresponding to the terminal device in the secure computing environment includes:

Acquiring identity information input by the user of the terminal;

Determining whether a private key bound to the identity information is stored in the secure computing environment;

If so, sign the data digest based on the private key bound to the identity information in the secure computing environment.
According to the method of claim 1, the secure computing environment further stores device authentication information signed based on a private key held by the manufacturer of the terminal device;

Before signing the data digest based on the private key in the secure computing environment, the method further includes:

Verify the signature of the device authentication information based on the public key corresponding to the private key held by the manufacturer of the terminal device; if the verification passes, determine that the terminal device is a legitimate terminal device produced by the manufacturer, Sign the data digest based on the private key corresponding to the terminal device in the secure computing environment.
The method according to claim 1, in the secure computing environment, signing the data digest based on a private key corresponding to the terminal device, and publishing the signed target data to the blockchain ,include:

In the secure computing environment, the data digest and the description information of the target data are overall signed based on the private key corresponding to the terminal device, and the signed data digest and the description data are published To the blockchain certificate; or,

In the secure computing environment, sign the data digest based on the private key corresponding to the terminal device, and publish the description data of the target data and the signed data digest to the blockchain.
The method according to claim 6, wherein the description data includes: a combination of one or more of a collection time, a collection location, and objects related to the target data of the target data.
The method according to claim 1, wherein the terminal device includes a law enforcement recorder or a driving recorder; the target data includes one or a combination of video data, audio data, and image data.
A blockchain-based data certificate storage device applied to terminal equipment; wherein the terminal equipment is equipped with a secure computing environment, and the secure computing environment stores a private key corresponding to the terminal equipment, the device include:

Acquisition module to acquire the collected target data;

A calculation module to calculate a data summary of the target data;

The certificate storage module signs the data digest based on the private key corresponding to the terminal device in the secure computing environment, and publishes the signed data digest to the blockchain to allow the block The node device in the chain verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.
The apparatus according to claim 9, the certificate depositing module further:

Acquiring identity information input by the user of the terminal;

Perform identity authentication for the user based on the obtained identity information;

If the identity authentication for the user is passed, the data digest is signed based on the private key corresponding to the terminal device in the secure computing environment.
The device according to claim 9, wherein a key generation algorithm is stored in the secure computing environment;

The acquisition module further:

Acquiring the identity information input by the user of the terminal device when using the terminal device for the first time;

The certificate storage module further:

Performing identity authentication for the user based on the identity information obtained by the obtaining module; if the identity authentication for the user is passed, calling the key generation algorithm in the secure computing environment to generate the private A key and a public key; and, binding the generated private key with the identity information of the user, and storing the binding relationship in the secure computing environment.
The apparatus of claim 11, the certificate storage module further:

Acquiring identity information input by the user of the terminal;

Determining whether a private key bound to the identity information is stored in the secure computing environment;

If so, sign the data digest based on the private key bound to the identity information in the secure computing environment.
The apparatus according to claim 9, wherein the secure computing environment further stores device authentication information signed based on a private key held by the manufacturer of the terminal device;

The certificate storage module further:

Before signing the data digest based on the private key in the secure computing environment, verify the signature of the device authentication information based on the public key corresponding to the private key held by the manufacturer of the terminal device; If the verification is passed, it is determined that the terminal device is a legal terminal device produced by the manufacturer, and the data digest is further signed based on the private key corresponding to the terminal device in the secure computing environment.
The device according to claim 9, the certificate storage module:

In the secure computing environment, the data digest and the description information of the target data are overall signed based on the private key corresponding to the terminal device, and the signed data digest and the description data are published To the blockchain certificate; or,

In the secure computing environment, sign the data digest based on the private key corresponding to the terminal device, and publish the description data of the target data and the signed data digest to the blockchain.
The apparatus according to claim 14, wherein the description data includes: a combination of one or more of a collection time, a collection location, and objects related to the target data of the target data.
The apparatus according to claim 9, wherein the terminal device includes a law enforcement recorder or a driving recorder; and the target data includes one or a combination of video data, audio data, and image data.
An electronic device, including:

processor;

Memory for storing machine executable instructions;

Wherein, by reading and executing the machine-executable instructions stored in the memory corresponding to the control logic of the blockchain-based blockchain-based data certification, the processor is prompted to:

Acquiring the collected target data; wherein, the electronic device is equipped with a secure computing environment, and a private key corresponding to the electronic device is stored in the secure computing environment;

Calculate a data summary of the target data;

Sign the data digest based on the private key corresponding to the electronic device in the secure computing environment, and publish the signed data digest to the blockchain to allow the nodes in the blockchain The device verifies the signature of the data digest based on the public key corresponding to the private key, and after the signature verification is passed, the data digest is verified in the blockchain for data certification.