WO2020181845A1

WO2020181845A1 - Method and device for encrypting blockchain data, computer apparatus, and storage medium

Info

Publication number: WO2020181845A1
Application number: PCT/CN2019/123142
Authority: WO
Inventors: 谢丹力; 张文明; 贾牧; 陆一凡
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2019-03-14
Filing date: 2019-12-05
Publication date: 2020-09-17
Also published as: CN110061845A

Abstract

Provided in embodiments of the present invention are a method and device for encrypting blockchain data, a computer apparatus, and a computer readable storage medium. In an embodiment of the present invention, the method for encrypting blockchain data comprises: acquiring data to be encrypted; generating a first key corresponding to a read permission and a second key corresponding to a write permission; using the first key to encrypt the data to obtain a ciphertext; using the second key to affix a signature on the ciphertext; and uploading the signed ciphertext to a blockchain, and storing the ciphertext in the blockchain after the ciphertext has passed authentication performed by the blockchain. The invention realizes separate control on a read permission and a write permission with respect to encrypted data in a blockchain, such that an authorizing party can flexibly select a permission with respect to encrypted data to be granted to an authorized party, thereby enhancing the efficiency of managing encrypted data in a blockchain.

Description

Block chain data encryption method, device, computer equipment and storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office, the application number is 201910192718.8, and the invention title is "Blockchain data encryption method, device, computer equipment and storage medium" on March 14, 2019, and its entire content Incorporated in this application by reference.

Technical field

This application relates to the field of blockchain encryption technology, and in particular to a blockchain data encryption method, device, computer equipment, and computer-readable storage medium.

Background technique

The blockchain network can realize information sharing between industries, but large companies regard data as life and are unwilling to share data. For this reason, all sensitive data uploaded to the blockchain must be encrypted to solve the problem of large companies Concerns about data sharing will not make data sharing a data welfare. However, in the traditional technology, the encrypted data authorization method is encrypted by using a key. Once the encrypted data is authorized to any authorized party, the authorized party has all rights to the data. However, in actual business needs, this method Reduce the efficiency of data management on the blockchain.

Summary of the invention

technical problem

The embodiments of the present application provide a blockchain data encryption method, device, computer equipment, and computer-readable storage medium, which can solve the problem of low efficiency of data management on the blockchain in the traditional technology.

The solution to the problem

Technical solutions

In the first aspect, an embodiment of the present application provides a blockchain data encryption method, the method includes: obtaining data to be encrypted; generating a first key corresponding to a read permission and a second key corresponding to a write permission; The first key encrypts the data to obtain a ciphertext; uses the second key to sign the ciphertext; uploads the signed ciphertext to the blockchain so that the blockchain can verify the ciphertext Store the ciphertext in the blockchain after the document verification is passed.

In a second aspect, an embodiment of the present application also provides a block chain data encryption device, including: a first obtaining unit for obtaining data to be encrypted; a first generating unit for generating a first key corresponding to the read permission And a second key corresponding to the write authority; an encryption unit, used to encrypt the data using the first key to obtain a ciphertext; a signature unit, used to perform an encryption on the ciphertext using the second key Signature; upload unit for uploading the signed ciphertext to the blockchain so that the blockchain will store the ciphertext in the blockchain after passing the verification of the ciphertext.

In a third aspect, an embodiment of the present application also provides a computer device, which includes a memory and a processor, the memory stores computer-readable instructions, and the processor implements the area when the computer-readable instructions are executed. Block chain data encryption method.

In a fourth aspect, an embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes The block chain data encryption method.

The details of one or more embodiments of the application are set forth in the following drawings and description. Other features, purposes and advantages of this application will become apparent from the description, drawings and claims.

The beneficial effects of the invention

Brief description of the drawings

Description of the drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only of the present application. For some embodiments, for those of ordinary skill in the art, other drawings can be obtained from these drawings without creative labor.

Figure 1 is a schematic diagram of an application scenario of a blockchain data encryption method provided by an embodiment of the application;

2 is a schematic flowchart of a blockchain data encryption method provided by an embodiment of the application;

3 is a schematic diagram of the encryption process interaction of the blockchain data encryption method provided by an embodiment of the application;

4 is a schematic diagram of digital signature flow interaction of the blockchain data encryption method provided by an embodiment of the application;

FIG. 5 is another flowchart of the blockchain data encryption method provided by an embodiment of the application;

FIG. 6 is an interactive schematic diagram of a specific embodiment of a blockchain data encryption method provided by an embodiment of the application;

FIG. 7 is a schematic block diagram of a block chain data encryption device provided by an embodiment of the application;

FIG. 8 is another schematic block diagram of a block chain data encryption device provided by an embodiment of the application; and

FIG. 9 is a schematic block diagram of a computer device provided by an embodiment of the application.

Invention embodiment

Embodiments of the invention

In the following description, for the purpose of illustration rather than limitation, specific details such as a specific system structure and technology are proposed for a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from obstructing the description of this application.

In order to illustrate the technical solutions described in the present application, specific embodiments are used for description below.

It should be understood that when used in this specification and the appended claims, the terms "including" and "including" indicate the existence of the described features, wholes, steps, operations, elements and/or components, but do not exclude one or The existence or addition of multiple other features, wholes, steps, operations, elements, components, and/or collections thereof.

It should also be understood that the terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in the specification of this application and the appended claims, unless the context clearly indicates other circumstances, the singular forms "a", "an" and "the" are intended to include plural forms.

It should be further understood that the term "and/or" used in the specification and appended claims of this application refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations .

Please refer to FIG. 1, which is a schematic diagram of an application scenario of a blockchain data encryption method provided by an embodiment of the application. The application scenarios include:

(1) Blockchain and multiple terminals in the blockchain. The blockchain shown in Figure 1 contains 6 terminals. If there are encrypted data on terminal 1 that needs to be uploaded to the blockchain, so that other terminals in the blockchain can share the encrypted data, the data on terminal 1 passes through The data encryption method in the embodiment of this application is encrypted and uploaded to the chain. After obtaining the corresponding authorization authority such as read authorization or write authorization, other terminals in the blockchain can obtain encrypted data from the chain to achieve access to the encrypted data. The terminal 1 that needs to upload encrypted data executes the steps of the data encryption method in the embodiment of the present application. The terminal may be an electronic device such as a notebook computer, a tablet computer, a smart phone, or a desktop computer.

Taking the terminal 1 executing the blockchain encryption data method in the embodiment of the application and the terminal 5 accessing the terminal 1 to upload the encrypted data in the blockchain as an example, the working process of each subject in Fig. 1 is as follows: obtaining the data to be encrypted; generating A first key corresponding to the read permission and a second key corresponding to the write permission; encrypt the data using the first key to obtain a ciphertext; use the second key to sign the ciphertext; Upload the signed ciphertext to the blockchain so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext. After the terminal 5 obtains the first key provided by the terminal 1, it obtains the read permission for the encrypted data. After the terminal 5 obtains the second key provided by the terminal 1, it obtains the write permission for the encrypted data. With the first key and the second key, the terminal 5 obtains the read permission and write permission of the encrypted data to obtain full authorization.

It should be noted that FIG. 1 only shows a desktop computer as a terminal. In actual operation, the type of the terminal is not limited to that shown in FIG. 1. The terminal may also be an electronic device such as a mobile phone, a notebook computer, or a tablet computer. The application scenarios of the above-mentioned blockchain data encryption method are only used to illustrate the technical solutions of this application, and are not used to limit the technical solutions of this application. The above-mentioned connection relationship may also have other forms.

Fig. 2 is a schematic flowchart of a blockchain data encryption method provided by an embodiment of the application. The blockchain data encryption method is applied to the terminal in FIG. 1 to complete all or part of the functions of the blockchain data encryption method.

Please refer to FIG. 2, which is a schematic flowchart of a blockchain data encryption method provided by an embodiment of the present application. As shown in Figure 2, the method includes the following steps S210-S290:

S210. Obtain the data to be encrypted;

S220: Generate a first key corresponding to the read permission and a second key corresponding to the write permission.

Among them, the read permission refers to the permission to view or access encrypted data, and the write permission refers to the permission to modify or delete the encrypted data.

Specifically, in order to separate the read permission and the write permission of the encrypted data to realize the separate authorization of the read permission and the write permission, in this embodiment of the application, the first key corresponding to the read permission and the second key corresponding to the write permission are respectively generated. The key, the first key is used to control the read authority of the encrypted data, and the second key is used to control the write authority of the encrypted data, so that the first key is used to obtain authorization to view the encrypted data. The second key obtains authorization to modify or delete the encrypted data. The node that uploads the encrypted data in the blockchain will generate two keys for the data to be encrypted. One key is the first key, which is the read permission key, the English is Read Key, and the other is the first key. The second key is the write authority key, and the English is WriteKey.

Further, the step of generating the first key corresponding to the read permission and the second key corresponding to the write permission includes:

The first key of the symmetric key and the second key of the asymmetric key are generated.

Among them, the symmetric key refers to the use of symmetric cryptographic encoding technology, and the use of the same key for file encryption and decryption. Since the symmetric encryption algorithm is simple and quick to use, the key is short, and it is difficult to decipher, the symmetric key is used for the corresponding read permission.

An asymmetric key means that the encryption algorithm requires two keys, one of which is a public key, English is Publickey, the other is a private key, and English is Privatekey. The public key and the private key are a pair. If the public key is used to encrypt the data, only the corresponding private key can be used to decrypt; if the private key is used to encrypt the data, only the corresponding public key can be used Decrypt. Because encryption and decryption use two different keys, this key is called an asymmetric encryption key. Since the typical application of asymmetric encryption is a digital signature, the second key corresponding to the write permission uses an asymmetric key.

Specifically, the node uploading the encrypted data in the blockchain will generate two keys for the data to be encrypted, one of which is the first key, which is the read authority key, and the English is Read Key, which adopts the symmetric key. , The other key is the second key, which is the write authority key, and the English is WriteKey, which is an asymmetric key.

S230: Use the first key to encrypt the data to obtain a ciphertext.

Among them, encryption involves the concept of public key and private key. Public and private keys are equivalent to keys and locks. Locks can be used to lock things, and keys can be used to open corresponding locks. One key can only open one lock. Of course, both keys and locks can be copied. Encryption is equivalent to generating a lock and a key by myself, and then sending the lock to you. You use my lock to lock what you want to send to me and then send it to me. After I receive it, I open the lock with the key. Everyone in the world can get my lock, but only I have the key to this lock. The key is equivalent to the private key, and the lock is equivalent to the public key. Digital encryption involves three processes. Specifically, please refer to FIG. 3. FIG. 3 is a schematic diagram of the encryption process interaction of the blockchain data encryption method provided by an embodiment of the application. As shown in Figure 3, the process is as follows:

1) The first subject generates a pair of public key and private key, and sends the public key to the second subject;

2) The second subject uses the public key to encrypt the data, the encryption process is: public key + plaintext -> ciphertext, and the second subject sends the ciphertext to the first subject;

3) After the first subject receives the ciphertext, it uses its own private key to decrypt, and the decryption process is: private key+ciphertext->plaintext, thereby obtaining encrypted data.

Specifically, in the embodiment of the present application, the node in the blockchain uses the first key to encrypt the data to obtain the ciphertext.

S240. Use the second key to sign the ciphertext.

Among them, signature and encryption are two different concepts, and both involve the concepts of public key and private key. Public and private keys are equivalent to keys and locks. Locks can be used to lock things, and keys can be used to open corresponding locks. One key can only open one lock. Of course, both keys and locks can be copied. Signing is equivalent to generating a lock and a key by myself, then locking the content I want to publish with my lock to form a signature, publishing the content and signature together, and telling everyone what my key is. People can get the key to open the content in the signature to verify that it is consistent with the published content. Everyone in the world can get the key to verify the consistency between the signature and the content, but only I have the signature lock. In this example, the key is equivalent to the public key, and the lock is equivalent to the private key. Please refer to Figure 4. Figure 4 is a schematic diagram of the digital signature process interaction of the blockchain data encryption method provided by an embodiment of the application. The digital signature involves four or three processes:

1) The first subject generates a pair of public key and private key;

2) The first subject uses the private key to sign the encrypted data, and the signing process is: private key + content -> signature;

3) The first subject publishes the encrypted data and signature together, and publishes the public key;

4) The second subject uses the published public key to verify the signature. The verification process is: public key + signature + content -> whether the content has changed, so as to determine whether the encrypted data published by the first subject has changed or has been tampered with.

Specifically, in the embodiment of the present application, the node in the blockchain uses the second key to sign the ciphertext to obtain a signature code.

Further, before the step of using the second key to sign the ciphertext, the method further includes:

Generating a first public key using the second key as a private key;

Get the current timestamp;

The step of using the second key to sign the ciphertext includes:

Use the second key to sign the ciphertext, the first public key, and the timestamp to obtain a signature code;

The step of uploading the signed ciphertext to the blockchain to enable the blockchain to verify the ciphertext and storing the ciphertext in the blockchain includes:

Upload the signed ciphertext, the first public key, and the signature code to the blockchain so that the blockchain uses the public key to verify the signature code and stores the ciphertext in the district Block chain.

Specifically, when a node in the block chain adds data to the block chain, since there is no current data on the block chain at this time, data needs to be added to the block chain, which is referred to as the second block chain in the embodiment of the application. At this time, follow the steps below:

1) The blockchain secondary node will generate two cryptographically secure keys for this piece of data. The first key is the read authority key, the English is Read Key, and the second key is the write authority key, and the English is WriteKey.

2) Then use ReadKey to encrypt the data to get the ciphertext EncyptData, and then use WriteKey as the private key to generate its corresponding public key Public Key; and get the current timestamp TimeStamp; at the same time, use the current secondary node's own private key WriteKey, to EncyptData +PublicKey+TimeStamp to sign, get signature code S.

3) Send EncyptData+PublicKey+S to the blockchain. After the block link receives EncyptData+PublicKey+S, it will use the public key PublicKey to verify the signature code S. If the verification passes, the EncyptData+PublicKey +S is stored in each node of the blockchain, that is, the encrypted data is uploaded to the chain.

S250. Upload the signed ciphertext to the blockchain, so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext.

Specifically, the ciphertext is signed using the write authority key, and the ciphertext is sent to the blockchain, so that different subjects obtain the corresponding authority of the data according to the obtained key. Specifically, the blockchain node processes the data to be encrypted as follows:

The process for nodes of the blockchain to encrypt encrypted data is as follows:

3) Send EncyptData+PublicKey+S to the blockchain.

After the block link receives the encrypted data EncyptData+PublicKey+S sent by the secondary node of the blockchain, it verifies the encrypted data. The verification process on the blockchain is as follows:

1) Verify that the sent time stamp TimeStamp is the current time to prevent replay attacks;

2) The public key PublicKey of the secondary node of the blockchain sending the data will be obtained on the blockchain, and the S code in the data will be verified. If the verification is passed, the data storage is agreed.

Please refer to FIG. 5. FIG. 5 is another flowchart of a blockchain data encryption method provided by an embodiment of the application. As shown in FIG. 5, in this embodiment, the ciphertext after the signature is uploaded to the blockchain so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext. After the steps, it also includes:

S260. Send an authorization key to a node in the blockchain so that the node uses the authorization key to access the encrypted data uploaded to the blockchain, where the authorization key includes the first key, The second key or the first key and the second key.

Specifically, in this embodiment of the application, since the encrypted data authorization method with separation of read and write permissions is adopted, the authorizing party, that is, the party encrypting the data, uses two keys when encrypting the data. , The first key is a symmetric key, which is used to encrypt data, and the second key is an asymmetric key, which is used to sign the encrypted result. In the authorization process, if only authorized to the authorized party The first key, the authorized party only has the right to view the data, and if the second key is authorized, the authorized party has the right to modify and delete data; at the same time, this method also supports reading the secret The key and the write key are authorized to the authorized party at the same time, and the authorized party has both the read permission and the write permission. This method is called full authorization. The authorized party performs corresponding operations on encrypted data according to the obtained authorization, which can be divided into the following types:

(1) The authorized party obtains the first key of the read permission.

Specifically, if the authorized party obtains the first key, that is, the reader has been authorized to ReadKey, the process of the authorized party to access encrypted data is as follows:

1) The data reader directly queries from the blockchain, and the query is Query in English to obtain the data EncyptData;

2) The secondary node of the data reader uses ReadKey to decrypt EncyptData to obtain the original data.

(2) The authorized party obtains the first key of read permission and the second key of write permission.

Specifically, since the authorized party has obtained the second key of the write authority, the authorized party has the authority to modify the data, that is, the authorized party can modify the data. Assuming that the operator has been authorized for ReadKey and WriteKey, at this time, follow Proceed as follows:

1) The operator uses ReadKey to encrypt the modified data to obtain the encrypted data EncyptData2; the operator uses WriteKey as the private key to sign the new EncyptData2+TimeStamp2 to obtain the signature code S2; the operator sends EncyptData2+TimeStamp2+S2 To the blockchain.

2) Detection on the blockchain:

① Verify that the timestamp TimeStamp2 sent by the authorized party is the current time to prevent replay attacks;

②The PublicKey of the original data will be obtained on the blockchain, and the PublicKey will be used to verify the S2 of the current data on the chain. If the verification is passed, the data is allowed to be modified. If the verification fails, the modification of the data is refused, and the operation fails. .

(3) The authorized party obtains the second key of the write authority.

Delete data: Assume that the operator has been authorized to WriteKey; at this time, follow the steps below:

1) The operator uses WriteKey as the private key to sign the new EncyptData3 and TimeStamp3 to obtain the signature code S3; the operator sends TimeStamp3+S3 to the blockchain.

2) Detection on the blockchain:

①Verify that the timestamp TimeStamp3 sent by the authorized party is the current time to prevent replay attacks;

②The PublicKey of the original data will be obtained on the blockchain, and the PublicKey will be used to verify the current S3 of the data on the chain. If the verification is passed, the data is allowed to be deleted. If the verification fails, the data is refused to be deleted, and the operation fails. .

Please refer to FIG. 5, as shown in FIG. 5, in this embodiment, the ciphertext after the signature is uploaded to the blockchain so that the ciphertext is stored after the blockchain passes the verification of the ciphertext After the steps to the blockchain, it also includes:

S270: Send the first key through a key exchange algorithm, so that nodes in the blockchain can view the data to be encrypted.

The step of sending the first key through a key exchange algorithm to enable nodes in the blockchain to view the data to be encrypted includes:

Obtain the second public key sent by the node in the blockchain;

Use the second key and the second public key to perform key exchange to obtain a third key of the symmetric key;

Encrypting the first key using the third key to obtain the encrypted first key;

Send the encrypted first key to the blockchain so that the node uses the private key corresponding to the second public key to decrypt the first key.

Wherein, the use of the second key and the second public key for key exchange to obtain the third key of the symmetric key refers to the use of the second key and the second public key for ECDH Get the third key of the symmetric key.

Specifically, in the embodiment of the present application, the first key may also be sent through a key exchange algorithm so that nodes in the blockchain can view the data to be encrypted, for example, when implementing penetrating supervision, The supervising unit can obtain the first key through the key exchange algorithm to view the encrypted data, that is, the embodiment of the present application can support transparent supervision at the same time, where the transparent supervision refers to adopting the key agreement algorithm to The data uploading unit and the supervisory unit exchange information securely through the blockchain and the third party cannot obtain the information. Among them, the key agreement algorithm includes ECDH and ECDHE. Among them, ECDH is a DH (Diffie-Hellman) key exchange algorithm based on ECC (Elliptic Curve Cryptosystems, elliptic curve cryptosystems), and both parties can negotiate a key without sharing any secrets. The ECC algorithm is used in conjunction with DH for key negotiation. This key exchange algorithm is called ECDH. Diffie-Hellman algorithm, referred to as DH algorithm, is a key agreement algorithm. The algorithm is a method of establishing a key, not an encryption method, but the generated key can be used for encryption, key management or any other Encryption method. The purpose of this key exchange technology is to enable two users to exchange keys (KEY) securely for future message encryption.

In the embodiment of the application, the supervisory unit node in the blockchain can obtain the read permission key through the key exchange algorithm to view the data to be encrypted. When a key exchange algorithm is used to enable the supervisory unit node in the blockchain to view the data to be encrypted, the node uploading the data in the blockchain obtains the second public key sent by the supervisory node in the blockchain, and uses all The second key and the second public key are exchanged to obtain the third key of the symmetric key, and the first key is encrypted using the third key to obtain the encrypted first key, and then Send the encrypted first key to the blockchain so that the supervisory node in the blockchain uses the private key corresponding to the second public key to decrypt the first key to view the encrypted data in the blockchain. Wherein, the use of the second key and the second public key for key exchange to obtain the third key of the symmetric key refers to the use of the second key and the second public key for ECDH Get the third key of the symmetric key. For example, if the first key of the read permission is ReadKey and the second key of the write permission is WriteKey, the node uploading data in the blockchain uses WriteKey and the public key SupervisePubKey (supervised public key) provided by the supervision to perform ECDH, and obtain both parties At the same time have the symmetric key SymKey (symmetric key), and then use SymKey to encrypt the ReadKey and attach it to the end of the data. When adding data, the encrypted ReadKey is sent to the blockchain together. Therefore, the supervisory node can use its own private key to solve the ReadKey to view the content of the encrypted data.

Please refer to FIG. 6. FIG. 6 is an interactive schematic diagram of a specific embodiment of the blockchain data encryption method provided by the embodiment of the application. As shown in FIG. 6, the process of the blockchain data encryption method provided by the embodiment of the application is as follows :

1) The authorized party node in the blockchain obtains the data that needs to be encrypted;

2) The authorized party node in the blockchain generates the read key Read Key and the write key WriteKey;

3) The authorized party node in the blockchain uses the ReadKey to encrypt the data to obtain the ciphertext EncyptData;

4) The authorizing party node in the blockchain uses WriteKey as the private key to generate the corresponding public key PublicKey;

5) The authorized party node in the blockchain obtains the current timestamp TimeStamp;

6) The authorized party node in the blockchain uses the current private key WriteKey to sign EncyptData+PublicKey+TimeStamp to obtain the signature code S;

7) The authorized party node in the blockchain sends EncyptData+PublicKey+S to the blockchain;

8) The blockchain verifies that the sent time stamp TimeStamp is the current time to prevent replay attacks;

9) The blockchain obtains the public key PublicKey, and verifies the S code in the data. If the verification is passed, the data storage is agreed;

10) The authorized party node in the blockchain sends the authorized ReadKey;

11) The authorized party node in the blockchain obtains data EncyptData directly from the blockchain by query (query);

12) The authorized party node in the blockchain uses ReadKey to decrypt EncyptData to obtain the original data;

13) The authorized party node in the blockchain sends the authorized ReadKey and WriteKey;

14) The authorized party node in the blockchain obtains data EncyptData directly from the blockchain by query (query);

15) The authorized party node in the blockchain uses ReadKey to decrypt EncyptData to obtain the original data;

16) The authorized party node in the blockchain modifies the original data and uses ReadKey to encrypt the modified data to obtain the encrypted data EncyptData2;

17) The authorized party node in the blockchain uses WriteKey as the private key to sign the new EncyptData2+TimeStamp2 to obtain the signature code S2;

18) The authorized party node in the blockchain sends EncyptData2+TimeStamp2+S2 to the blockchain;

19) The blockchain verifies that the time stamp TimeStamp2 sent up is the current time to prevent replay attacks;

20) The blockchain obtains the PublicKey of the original data, and uses the PublicKey to verify the S2 of the current data on the chain. After the verification is passed, the data is allowed to be modified, the verification fails, and the data is refused to be modified, and the operation fails.

In a large number of business requirements, more fine-grained authorization methods are required. For example, authorized users can only view data, but cannot modify or delete data. In order to improve data security and management efficiency, only authorized users can be Delete data without viewing data and modifying data, etc. The encrypted data authorization method with separation of read and write permissions provided in the embodiment of this application uses two keys when encrypting data. The first key can be a symmetric key for encrypting data, and the second The key can be an asymmetric key, which is used to sign the encrypted result; in the authorization process, if only the first key is authorized to the other party, the other party only has the right to view the data, and if the other party is authorized the second Key, the other party has the authority to modify and delete data; at the same time, this method also supports to authorize the read and write key to the other party at the same time, so the other party has the read and write authority at the same time. This method is called full authorization. This scheme is an important supplement and enhancement to the traditional encryption data authorization method, and makes up for the shortcomings of the traditional encryption authorization method. This method allows the authorized party to flexibly choose to grant the other party view permissions, modify permissions, or delete permissions. It is a comparison to the traditional authorization method. An improvement that improves the flexibility of nodes in the blockchain to authorize encrypted data and the management efficiency of encrypted data.

It should be noted that the blockchain data encryption methods described in the above embodiments can recombine the technical features contained in different embodiments as needed to obtain a combined implementation plan, but they are all required by this application. Within the scope of protection.

Please refer to FIG. 7. FIG. 7 is a schematic block diagram of a block chain data encryption device provided by an embodiment of the application. Corresponding to the foregoing blockchain data encryption method, an embodiment of the present application also provides a blockchain data encryption device. As shown in FIG. 7, the block chain data encryption device includes a unit for executing the above block chain data encryption method, and the device can be configured in computer equipment such as a server. Specifically, referring to FIG. 7, the blockchain data encryption device 700 includes a first acquisition unit 701, a first generation unit 702, an encryption unit 703, a signature unit 704 and an upload unit 705.

Wherein, the first obtaining unit 701 obtains data to be encrypted;

The first generating unit 702 is configured to generate a first key corresponding to the read permission and a second key corresponding to the write permission;

The encryption unit 703 is configured to use the first key to encrypt the data to obtain a ciphertext;

The signature unit 704 is configured to use the second key to sign the ciphertext;

The uploading unit 705 is configured to upload the signed ciphertext to the blockchain so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext.

In an embodiment, the first generating unit 702. The first key used to generate the symmetric key and the second key of the asymmetric key.

Please refer to FIG. 8. FIG. 8 is another schematic block diagram of the block chain data encryption device provided by an embodiment of the application. As shown in FIG. 8, in this embodiment, the block chain data encryption device 700 further includes:

The second generating unit 706 is configured to use the second key as a private key to generate a first public key;

The second obtaining unit 707 is configured to obtain the current timestamp;

The signature unit 704 is configured to use the second key to sign the ciphertext, the first public key, and the timestamp to obtain a signature code;

The uploading unit 705 is configured to upload the signed ciphertext, the first public key, and the signature code to the blockchain so that the blockchain uses the public key to verify the signature code after passing Store the ciphertext in the blockchain.

Please continue to refer to FIG. 8. As shown in FIG. 8, in this embodiment, the block chain data encryption device 700 further includes:

The sending unit 708 is configured to send an authorization key to a node in the blockchain so that the node can use the authorization key to access the encrypted data uploaded to the blockchain, wherein the authorization key includes the first A key, the second key, or the first key and the second key.

The exchange unit 709 is configured to send the first key through a key exchange algorithm so that nodes in the blockchain can view the data to be encrypted;

The switching unit 709 includes:

The obtaining subunit 7091 is used to obtain the second public key sent by the node in the blockchain;

An exchange subunit 7092, configured to perform key exchange using the second key and the second public key to obtain a third key of the symmetric key;

An encryption subunit 7093, configured to use the third key to encrypt the first key to obtain an encrypted first key;

The sending subunit 7094 is configured to send the encrypted first key to the blockchain so that the node uses the private key corresponding to the second public key to decrypt the first key.

In one embodiment, the exchange subunit 7092 is configured to perform ECDH using the second key and the second public key to obtain the third key of the symmetric key.

It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned blockchain data encryption device and each unit can refer to the corresponding description in the foregoing method embodiment. For the convenience and brevity of the description, This will not be repeated here.

At the same time, the division and connection of the various units in the above-mentioned blockchain data encryption device are only used for illustration. In other embodiments, the blockchain data encryption device can be divided into different units as needed, or the block Each unit in the chain data encryption device adopts different connection sequences and methods to complete all or part of the functions of the block chain data encryption device.

The above-mentioned block chain data encryption device may be implemented in a form of computer-readable instructions, and the computer-readable instructions may run on the computer device as shown in FIG. 9.

Please refer to FIG. 9, which is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device 900 may be a computer device such as a desktop computer or a server, or may be a component or component in other devices.

Referring to FIG. 9, the computer device 900 includes a processor 902, a memory, and a network interface 905 connected through a system bus 901, where the memory may include a non-volatile storage medium 903 and an internal memory 904.

The non-volatile storage medium 903 can store an operating system 9031 and computer-readable instructions 9032. When the computer-readable instruction 9032 is executed, it can cause the processor 902 to execute one of the aforementioned blockchain data encryption methods.

The processor 902 is used to provide calculation and control capabilities to support the operation of the entire computer device 900.

The internal memory 904 provides an environment for the operation of the computer-readable instructions 9032 in the non-volatile storage medium 903. When the computer-readable instructions 9032 are executed by the processor 902, the processor 902 can execute the above-mentioned blockchain data. Encryption method.

The network interface 905 is used for network communication with other devices. Those skilled in the art can understand that the structure shown in FIG. 9 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 900 to which the solution of the present application is applied. The specific computer device 900 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement. For example, in some embodiments, the computer device may only include a memory and a processor. In such embodiments, the structures and functions of the memory and the processor are consistent with the embodiment shown in FIG. 9 and will not be repeated here.

Wherein, the processor 902 is configured to run computer-readable instructions 9032 stored in the memory to implement the following steps: obtain the data to be encrypted; generate a first key corresponding to the read permission and a second key corresponding to the write permission; Use the first key to encrypt the data to obtain a cipher text; use the second key to sign the cipher text; upload the signed cipher text to the blockchain so that the blockchain can After the ciphertext is verified and signed, the ciphertext is stored in the blockchain.

In an embodiment, the processor 902 specifically implements the following steps when implementing the steps of generating the first key corresponding to the read permission and the second key corresponding to the write permission:

In an embodiment, the processor 902 further implements the following steps before implementing the step of signing the ciphertext using the second key:

Generating a first public key using the second key as a private key;

Get the current timestamp;

When the processor 902 implements the step of using the second key to sign the ciphertext, it specifically implements the following steps:

When the processor 902 implements the step of uploading the signed ciphertext to the blockchain so that the blockchain will store the ciphertext in the blockchain after passing the verification of the ciphertext, it specifically implements The following steps:

In an embodiment, the processor 902 uploads the signed ciphertext to the blockchain to enable the blockchain to verify the ciphertext and store the ciphertext in the blockchain. After the steps, the following steps are also implemented:

Send the authorization key to the node in the blockchain so that the node can use the authorization key to access the encrypted data uploaded to the blockchain, where the authorization key includes the first key, the The second key or the first key and the second key.

The first key is sent through a key exchange algorithm so that nodes in the blockchain can view the data to be encrypted.

In an embodiment, when the processor 902 implements the step of sending the first key through a key exchange algorithm so that the nodes in the blockchain can view the data to be encrypted, the following specifically implements step:

Obtain the second public key sent by the node in the blockchain;

Encrypting the first key using the third key to obtain the encrypted first key;

In an embodiment, when the processor 902 implements the step of using the second key and the second public key to perform key exchange to obtain the third key of the symmetric key, the processor 902 specifically implements the following steps :

Use the second key and the second public key to perform ECDH to obtain a third key of the symmetric key. It should be understood that in this embodiment of the application, the processor 902 may be a central processing unit (Central Processing Unit, CPU), and the processor 902 may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by computer-readable instructions, which can be stored in a computer-readable storage medium. The computer-readable instructions are executed by at least one processor in the computer system to implement the process steps of the foregoing method embodiments.

Therefore, this application also provides a computer-readable storage medium. The computer-readable storage medium may be a non-volatile computer-readable storage medium, the computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes the following steps:

The present application also provides a computer-readable instruction product, which when running on a computer, causes the computer to execute the steps of the blockchain data encryption method described in the above embodiments.

The computer-readable storage medium may be an internal storage unit of the aforementioned device, such as a hard disk or memory of the device. The computer-readable storage medium may also be an external storage device of the device, such as a plug-in hard disk equipped on the device, a Smart Media Card (SMC), or a Secure Digital (SD) card. , Flash Card, etc. Further, the computer-readable storage medium may also include both an internal storage unit of the device and an external storage device.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through computer-readable instructions, which can be stored in a non-volatile computer. In a readable storage medium, when the computer-readable instructions are executed, they may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Channel (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the equipment, device and unit described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

A person of ordinary skill in the art may realize that the units and algorithm steps of the examples described in the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the hardware and software Interchangeability. In the above description, the composition and steps of each example have been generally described in terms of function. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

In the several embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be omitted or not implemented.

The steps in the method of the embodiment of the present application can be adjusted, merged, and deleted in order according to actual needs. The units in the devices in the embodiments of the present application may be combined, divided, and deleted according to actual needs. In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application is essentially or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium It includes several instructions to make an electronic device (which may be a personal computer, a terminal, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.

The above are only specific implementations of this application, but the scope of protection stated in this application is not limited to this. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed in this application. Modifications or replacements, these modifications or replacements shall be covered within the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

A blockchain data encryption method, characterized in that the method includes:

Obtain the data to be encrypted;

Generate a first key corresponding to the read permission and a second key corresponding to the write permission;

Encrypting the data using the first key to obtain a ciphertext;

Use the second key to sign the ciphertext;

Upload the signed ciphertext to the blockchain so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext.
The blockchain data encryption method according to claim 1, wherein the step of generating the first key corresponding to the read permission and the second key corresponding to the write permission comprises:

The first key of the symmetric key and the second key of the asymmetric key are generated.
The blockchain data encryption method according to claim 2, wherein before the step of using the second key to sign the ciphertext, it further comprises:

Generating a first public key using the second key as a private key;

Get the current timestamp;

The step of using the second key to sign the ciphertext includes:

Use the second key to sign the ciphertext, the first public key, and the timestamp to obtain a signature code;

The step of uploading the signed ciphertext to the blockchain to enable the blockchain to verify the ciphertext and storing the ciphertext in the blockchain includes:

Upload the signed ciphertext, the first public key, and the signature code to the blockchain so that the blockchain uses the public key to verify the signature code and stores the ciphertext in the district Block chain.
The blockchain data encryption method according to claim 2 or 3, wherein the signed cipher text is uploaded to the blockchain so that the blockchain will verify the cipher text after passing the cipher text. After storing the document on the blockchain, it also includes:

Send the authorization key to the node in the blockchain so that the node can use the authorization key to access the encrypted data uploaded to the blockchain, where the authorization key includes the first key, the The second key or the first key and the second key.
The blockchain data encryption method according to claim 1, wherein the ciphertext after the signature is uploaded to the blockchain so that the ciphertext is stored after the blockchain passes the verification of the ciphertext After the steps to the blockchain, it also includes:

The first key is sent through a key exchange algorithm so that nodes in the blockchain can view the data to be encrypted.
The blockchain data encryption method according to claim 5, wherein the step of sending the first key through a key exchange algorithm to enable nodes in the blockchain to view the data to be encrypted comprises :

Obtain the second public key sent by the node in the blockchain;

Use the second key and the second public key to perform key exchange to obtain a third key of the symmetric key;

Encrypting the first key using the third key to obtain the encrypted first key;

Send the encrypted first key to the blockchain so that the node uses the private key corresponding to the second public key to decrypt the first key.
The blockchain data encryption method according to claim 6, wherein the step of using the second key and the second public key to perform key exchange to obtain the third key of the symmetric key comprises:

Use the second key and the second public key to perform ECDH to obtain a third key of the symmetric key.
A block chain data encryption device is characterized in that it comprises:

The first obtaining unit is used to obtain the data to be encrypted;

The first generating unit is configured to generate a first key corresponding to the read permission and a second key corresponding to the write permission;

An encryption unit, configured to encrypt the data using the first key to obtain a ciphertext;

A signature unit, configured to use the second key to sign the ciphertext;

The uploading unit is configured to upload the signed ciphertext to the blockchain so that the ciphertext will be stored in the blockchain after the blockchain passes the verification of the ciphertext.
The block chain data encryption device according to claim 8, characterized in that it further comprises:

A second generating unit, configured to use the second key as a private key to generate a first public key;

The second acquiring unit is used to acquire the current timestamp;

Correspondingly, the signature unit is configured to use the second key to sign the ciphertext, the first public key, and the timestamp to obtain a signature code;

The uploading unit is configured to upload the signed ciphertext, the first public key, and the signature code to the blockchain so that the blockchain will verify the signature code using the public key and pass it The ciphertext is stored in the blockchain.
The block chain data encryption device according to claim 8 or 9, characterized in that it further comprises:

The sending unit is configured to send an authorization key to a node in the blockchain so that the node uses the authorization key to access the encrypted data uploaded to the blockchain, wherein the authorization key includes the first A key, the second key, or the first key and the second key.
The block chain data encryption device according to claim 8 or 9, characterized in that it further comprises:

The exchange unit is configured to send the first key through a key exchange algorithm so that the nodes in the blockchain can view the data to be encrypted.
The block chain data encryption device according to claim 11, wherein the exchange unit comprises:

The obtaining subunit is used to obtain the second public key sent by the node in the blockchain;

An exchange subunit, configured to use the second key and the second public key to perform key exchange to obtain the third key of the symmetric key;

An encryption subunit, configured to use the third key to encrypt the first key to obtain an encrypted first key;

The sending subunit is configured to send the encrypted first key to the blockchain so that the node uses the private key corresponding to the second public key to decrypt the first key.
A computer device, wherein the computer device includes a memory and a processor connected to the memory; the memory is used to store computer-readable instructions; the processor is used to run the computer stored in the memory Read the command to perform the following steps:

Obtain the data to be encrypted;

Generate a first key corresponding to the read permission and a second key corresponding to the write permission;

Encrypting the data using the first key to obtain a ciphertext;

Use the second key to sign the ciphertext;

Upload the signed ciphertext to the blockchain so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext.
The computer device according to claim 13, wherein the step of generating the first key corresponding to the read permission and the second key corresponding to the write permission comprises:

The first key of the symmetric key and the second key of the asymmetric key are generated.
15. The computer device according to claim 14, wherein before the step of signing the ciphertext using the second key, the method further comprises:

Generating a first public key using the second key as a private key;

Get the current timestamp;

The step of using the second key to sign the ciphertext includes:

Use the second key to sign the ciphertext, the first public key, and the timestamp to obtain a signature code;

The step of uploading the signed ciphertext to the blockchain to enable the blockchain to verify the ciphertext and storing the ciphertext in the blockchain includes:

Upload the signed ciphertext, the first public key, and the signature code to the blockchain so that the blockchain uses the public key to verify the signature code and stores the ciphertext in the district Block chain.
The computer equipment according to claim 14 or 15, wherein the ciphertext after the signature is uploaded to the blockchain so that the ciphertext is stored in the district after the blockchain passes the verification of the ciphertext. After the block chain steps, it also includes:

Send the authorization key to the node in the blockchain so that the node can use the authorization key to access the encrypted data uploaded to the blockchain, where the authorization key includes the first key, the The second key or the first key and the second key.
The computer device according to claim 13, wherein the ciphertext after the signature is uploaded to the blockchain so that the ciphertext is stored in the blockchain after the blockchain passes the verification of the ciphertext After the steps, it also includes:

The first key is sent through a key exchange algorithm so that nodes in the blockchain can view the data to be encrypted.
18. The computer device according to claim 17, wherein the step of sending the first key through a key exchange algorithm so that nodes in the blockchain can view the data to be encrypted comprises:

Obtaining a second public key sent by a node in the blockchain; performing key exchange using the second key and the second public key to obtain the third key of the symmetric key;

Encrypting the first key using the third key to obtain the encrypted first key;

Send the encrypted first key to the blockchain so that the node uses the private key corresponding to the second public key to decrypt the first key.
The computer device according to claim 18, wherein the step of using the second key and the second public key to perform key exchange to obtain the third key of the symmetric key comprises:

Use the second key and the second public key to perform ECDH to obtain the third key of the symmetric key
A computer-readable storage medium, characterized in that, the computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes as described in claims 1-7. Any of the steps of the blockchain data encryption method.