WO2020253105A1

WO2020253105A1 - Authorization management method, system, apparatus, and computer readable storage medium

Info

Publication number: WO2020253105A1
Application number: PCT/CN2019/120831
Authority: WO
Inventors: 谢丹力; 张文明; 陈飞; 宦鹏飞
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2019-06-21
Filing date: 2019-11-26
Publication date: 2020-12-24
Also published as: CN110311787B; CN110311787A

Abstract

The present application relates to the technical field of blockchains, and discloses an authorization management method, a system, an apparatus, and a computer readable storage medium. The authorization management method comprises: a first node signing a second public key by means of a first private key, and obtaining a first signature code; performing signature verification on the first signature code by means of a first public key, and adding the second public key to an authorization list if the signature verification succeeds; a second node signing second encryption data by means of a second private key, and obtaining a second signature code; and performing signature verification on the second signature code on the basis of the authorization list, and publishing the second encryption data on a blockchain if the signature verification succeeds. The present application enables a data owner to grant permission for modifying data to a party to be authorized without providing a private key to the party, such that data owners always keep absolute control of data, thereby enhancing data security.

Description

Authorization management method, system, equipment and computer readable storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 21, 2019, the application number is 201910541123.9, and the invention title is "Authorization Management Methods, Systems, Equipment, and Computer-readable Storage Media", all of which are approved The reference is incorporated in the application.

Technical field

This application relates to the field of blockchain technology, in particular to an authorization management method, system, equipment, and computer-readable storage medium.

Background technique

The problem to be solved by the blockchain network is, first of all, the sharing of information between industries, and large companies regard data as life and are unwilling to share data. For this reason, all sensitive data uploaded to the blockchain must be encrypted. Only in this way can the big companies' concerns about data sharing be resolved, and data sharing will not become a data benefit.

In the business, information sharing between all business related parties is realized by authorizing the key. For example: Alice will generate a unique public-private key pair for the data when the data is on the chain, and Alice will use the private key Authorize to Bob, so Bob can provide the correct signature value of this piece of data, and the smart contract uses the result of public key verification to determine whether Bob has the authority to modify the current data.

The inventor found that in the existing practice, if the data owner Alice needs to grant Bob the permission to modify the data, he must give Bob the private key of the data. As a result, even after the business connection is completed, because Bob has the private key of the data, Bob always has the authority to modify the data, and Alice cannot withdraw the authority from Bob, which brings unnecessary trouble to the implementation of the business.

Summary of the invention

The main purpose of this application is to provide an authorization management method, system, equipment, and computer-readable storage medium, which aims to solve the problem that if the data owner Alice in the prior art needs to grant Bob the right to modify data, he must change the private key of the data Give it to Bob, causing Alice to be unable to withdraw permission from Bob.

In order to achieve the above objective, this application provides an authorization management method, which is applied to a blockchain-based authorization management system. The authorization management system includes a first node, a second node and a miner node. The authorization management method includes the following steps :

The first node signs the second public key of the authorized user with the first private key of the data owner to obtain the first signature code;

The miner node obtains the first signature code, and verifies the first signature code using the first public key of the data owner;

When the verification of the first signature code is passed, the miner node adds the second public key to the authorization list;

The second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code;

The miner node obtains the second signature code, and verifies the second signature code based on the authorization list;

When the verification of the second signature code is passed, the miner node publishes the second encrypted data to the blockchain.

Optionally, before the step of signing the second public key of the authorized user by the first node using the first private key of the data owner to obtain the first signature code, the method further includes:

The first node generates a first public key and a first private key, and encrypts the original data with a symmetric key to obtain the first encrypted data;

The miner node publishes the first public key and the first encrypted data to the blockchain;

The second node obtains the first encrypted data from the blockchain, and decrypts the first encrypted data with a symmetric key to obtain the original data;

The second node generates a second public key and a second private key, and sends the second public key to the first node.

Optionally, the second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code include:

The second node modifies the original data to obtain second data, and uses the symmetric key to encrypt the second data to obtain second encrypted data;

The second node signs the second encrypted data by using the second private key to obtain a second signature code.

Optionally, the step of obtaining the second signature code by the miner node and verifying the second signature code based on the authorization list includes:

The miner node obtains the second signature code, and obtains the added public key from the authorization list;

The second signature code is checked in turn by the added public key.

Optionally, after the step of publishing the second encrypted data on the blockchain by the miner node when the verification of the second signature code is passed, the method further includes:

The first node decrypts the second encrypted data by using the symmetric key to obtain the second data;

The first node generates a new symmetric key, and encrypts the second data with the new symmetric key to obtain the third encrypted data;

The first node signs the third encrypted data with the first private key to obtain the third signature code;

The miner node obtains the third signature code, and verifies the third signature code through the first public key;

When the verification of the third signature code is passed, the miner node publishes the third encrypted data on the blockchain and deletes the second encrypted data.

Optionally, after the step of adding the second public key to the authorization list by the miner node when the first signature code is verified, the method further includes:

The first node generates a deletion request for the second public key, and signs the deletion request with the first private key to obtain a fourth signature code;

The miner node obtains the fourth signature code, and verifies the fourth signature code through the first public key;

When the verification of the fourth signature code is passed, the miner node deletes the second public key from the authorization list.

The first node counts the existence time of the second public key in the authorization list;

When it is detected that the existence duration is greater than a preset threshold, the execution of the first node generates a deletion request for the second public key, and signs the deletion request with the first private key to obtain a fourth signature code A step of.

In addition, in order to achieve the above objective, this application also provides an authorization management system applied to the blockchain, the authorization management system including a first node, a second node, and a miner node,

The first node includes:

The first signature module is used to sign the second public key of the authorized user with the first private key of the data owner to obtain the first signature code;

The miner node includes:

The first signature verification module is configured to obtain the first signature code, and verify the first signature code by the first public key of the data owner;

An authorization adding module, which is used to add the second public key to the authorization list when the first signature code is verified;

The second node includes:

The second signature module is used to modify and encrypt the original data to obtain the second encrypted data, and to sign the second encrypted data using the second private key of the authorized user to obtain the second signature code;

The miner node also includes:

A second signature verification module, configured to obtain the second signature code, and verify the second signature code based on the authorization list;

The publishing module is used for publishing the second encrypted data to the blockchain when the verification of the second signature code is passed.

In addition, in order to achieve the above object, the present application also provides an authorization management device, the authorization management device includes: a memory, a processor, and an authorization management program stored in the memory and running on the processor, so When the authorization management program is executed by the processor, the steps of the authorization management method described above are implemented.

In addition, in order to achieve the above objective, the present application also provides a computer-readable storage medium, the computer-readable storage medium stores an authorization management program, and when the authorization management program is executed by a processor, the authorization management as described above is realized Method steps.

In this application, the first node uses the first private key of the data owner to sign the second public key of the authorized user to obtain the first signature code; the miner node obtains the first signature code and passes The first public key of the data owner verifies the first signature code; when the first signature code is verified, the miner node adds the second public key to the authorization list; The second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code; the miner node obtains the Second signature code, and verify the second signature code based on the authorization list; when the second signature code is verified, the miner node publishes the second encrypted data to the block On the chain. Through this application, the owner of the data can grant the authorized party the right to modify the data without providing the private key to the authorized party, so that the owner of the data always retains absolute control over the data and improves the data safety.

Description of the drawings

FIG. 1 is a schematic diagram of the structure of the authorization management device of the hardware operating environment involved in the solution of the embodiment of the application;

FIG. 2 is a schematic flowchart of a first embodiment of an authorization management method for an application;

3 is a schematic flowchart of a second embodiment of the authorization management method for this application;

Fig. 4 is a schematic diagram of functional modules of the first embodiment of the authorization management system of this application.

The realization, functional characteristics, and advantages of the purpose of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the application, and are not used to limit the application.

As shown in FIG. 1, FIG. 1 is a schematic diagram of the structure of an authorization management device for a hardware operating environment involved in a solution of an embodiment of the application.

The authorization management device in the embodiment of the present application may be a PC, or a terminal device with data processing capabilities, such as a smart phone, a tablet computer, and a portable computer.

As shown in FIG. 1, the authorization management device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to implement connection and communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as a magnetic disk memory. Optionally, the memory 1005 may also be a storage device independent of the foregoing processor 1001.

Those skilled in the art can understand that the structure of the authorization management device shown in FIG. 1 does not constitute a limitation on the authorization management device, and may include more or less components than shown in the figure, or a combination of certain components, or different components Layout.

As shown in FIG. 1, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an authorization management program.

In the authorization management device shown in FIG. 1, the network interface 1004 is mainly used to connect to the back-end server and communicate with the back-end server; the user interface 1003 is mainly used to connect to the client (user side) and communicate with the client; and The processor 1001 may be used to call an authorization management program stored in the memory 1005, and execute the steps of the following authorization management methods in each embodiment.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of the first embodiment of the authorization management method of this application.

In the first embodiment of the authorization management method of this application, it is applied to a blockchain-based authorization management system. The authorization management system includes a first node, a second node, and a miner node. The authorization management method includes:

Step S50, the first node signs the second public key of the authorized user with the first private key of the data owner to obtain the first signature code;

In this embodiment, user A who owns the data wants to grant user B the right to modify the data, and both user A’s terminal and user B’s terminal are connected to the blockchain, and user A’s terminal is called the first node, and user B’s The terminal is the second node. The miner node is used to publish the data from the first node and the second node to the block of the blockchain. User A has a pair of public and private keys, called the first public key and the first private key; user B also has a pair of public and private keys, called the second public key and the second private key. User A's terminal stores the above-mentioned first private key and second public key, and the first public key is stored on the blockchain.

In this embodiment, the first node signs the second public key through the first private key (that is, the principle of private key signature, the second public key is encrypted through the first private key), and the first signature code is obtained (that is, through the first private key). A private key encrypts the second public key to obtain the encryption result).

Step S60, the miner node obtains the first signature code, and verifies the first signature code using the first public key of the data owner;

In this embodiment, after the first node generates the first signature code, it broadcasts task one to each miner node on the blockchain, obtains the miner node of task one, obtains the first signature code, and saves it in the blockchain The first public key above verifies the first signature code.

Step S70, when the first signature code is verified, the miner node adds the second public key to the authorization list;

In this embodiment, the first private key and the first public key are relative. Therefore, the first signature can be successfully decrypted by the first public key, that is, the first signature code is verified. When the first signature code is verified through the first public key, the decryption information of the first signature code, that is, the second public key, can be obtained. Since the first private key is only known to user A, it means that the generation of the first signature code is allowed by user A (that is, the user to which the data belongs). When the verification is passed, the miner node adds the decrypted information (second public key) to the authorization In the list (the authorization list is recorded on the blockchain).

Step S80, the second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain a second signature code;

In this embodiment, the original data T is stored on the blockchain. It can be the original data itself, or it can be encrypted original data (the encryption method can be to encrypt the original data T with a symmetric key), that is, T1.

In this embodiment, step S80 includes: the second node modifies the original data to obtain second data, and encrypts the second data using the symmetric key to obtain second encrypted data; Sign the second encrypted data by using the second private key to obtain a second signature code. That is, the second node obtains the original data from the blockchain (or obtains T1, and then decrypts the original data through the symmetric key), and modifies the original data (based on the operation of user B). After the modification is completed, it passes the symmetric encryption The key encrypts the modified original data to obtain the second encrypted data, namely T2. Then, sign T2 with the second private key (that is, the principle of private key signature, T2 is encrypted with the second private key), and the second signature code is obtained (that is, T2 is encrypted with the second private key, and the encryption result is obtained ).

Step S90, the miner node obtains the second signature code, and verifies the second signature code based on the authorization list;

In this embodiment, step S90 includes: the miner node obtains the second signature code, and obtains the added public key from the authorization list; and sequentially signs the second signature by the added public key Code for verification.

In this embodiment, according to the description of step S50 to step S70, the second public key of user B is added to the authorization list. Similarly, user C, user D... these users A want to give the public keys of authorized users It can also be added to the authorization list, that is, the public key of the authorized party exists in the authorization list. In this embodiment, after the second node generates the second signature code, it broadcasts task two to each miner node on the blockchain, and obtains the miner node of the task two. Based on the public keys stored in the authorization list, the Second, the signature code is verified (that is, decrypted).

In step S100, when the verification of the second signature code is passed, the miner node publishes the second encrypted data to the blockchain.

In this embodiment, when the miner node passes the second signature code verification through the added second public key, the second encrypted data is released to the blockchain.

In this embodiment, since the second signature code is the encrypted result obtained by encrypting T2 with the second private key, and the second public key exists in the authorization list, the miner node can use the second public key to The signature code is successfully decrypted (that is, the signature is successfully verified), and T2 is obtained, and then the miner node publishes T2 on the blockchain (equivalent to accepting the modification of the original data by the second node only when the second signature code is verified) .

In this embodiment, the first node signs the second public key of the authorized user with the first private key of the data owner to obtain the first signature code; the miner node obtains the first signature code, and The first signature code is verified by the first public key of the data owner; when the first signature code is verified, the miner node adds the second public key to the authorization list; The second node modifies and encrypts the original data to obtain the second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code; the miner node obtains the second encrypted data; The second signature code, and verify the second signature code based on the authorization list; when the second signature code is verified, the miner node publishes the second encrypted data to the district Block chain. Through this embodiment, the owner of the data can grant the authorized party the right to modify the data without providing the private key to the authorized party, so that the owner of the data always retains absolute control over the data, which improves Data security.

Further, referring to FIG. 3, FIG. 3 is a schematic flowchart of a second embodiment of the authorization management method of this application.

In the second embodiment of the authorization management method of this application, before step S50, the method further includes:

Step S10, the first node generates a first public key and a first private key, and encrypts the original data with the symmetric key to obtain the first encrypted data;

In this embodiment, the first node can use the openssl tool to generate a pair of RSA public and private keys, that is, the first public key and the first private key; on the terminal of user A (ie, the first node) to which the data belongs, a random number generation algorithm is used , Generate a symmetric key, and pre-store the symmetric key on the first node and the second node. The original data T is encrypted by the symmetric key to obtain the first encrypted data T1.

Step S20, the miner node publishes the first public key and the first encrypted data to the blockchain;

In this embodiment, the miner node publishes the first public key and T1 to the blockchain. That is, an information publishing task is generated on the first node, and the miner node that has acquired the task publishes the information that needs to be published (that is, the first public key and T1) on the blockchain.

Step S30, the second node obtains the first encrypted data from the blockchain, and decrypts the first encrypted data with a symmetric key to obtain the original data;

In this embodiment, the second node obtains the first encrypted data T1 from the blockchain, and decrypts the first encrypted data with a symmetric key to obtain the original data. Thus, subsequent actions to modify the original data can be performed.

Step S40: The second node generates a second public key and a second private key, and sends the second public key to the first node.

In this embodiment, on the second node, a pair of RSA public and private keys, namely the second public key and the second private key, can be generated by the openssl tool, and then the second public key is sent to the first node.

Further, in an embodiment of the authorization management method of the present application, after step S100, the method further includes:

Step S110, the first node decrypts the second encrypted data by using the symmetric key to obtain second data;

In this embodiment, after the miner node uploads the modified original data (that is, the second encrypted data) to the blockchain, if user A no longer wants user B to view the decryption information of the second encrypted data , User A can trigger a viewing prohibition instruction, and restrict viewing prohibited users as user B. When the first node receives the instruction, the first node obtains the second encrypted data from the blockchain, and uses the symmetric key to decrypt the second encrypted data to obtain the second data.

Step S120, the first node generates a new symmetric key, and encrypts the second data with the new symmetric key to obtain third encrypted data;

In this embodiment, the first node generates a new symmetric key (without notifying the second node), and encrypts the second data with the new symmetric key to obtain the third encrypted data.

Step S130, the first node signs the third encrypted data with the first private key to obtain a third signature code;

In this embodiment, the first node signs the third encrypted data with the first private key (that is, the principle of private key signature, the third encrypted data is encrypted with the first private key) to obtain the third signature code.

Step S140: The miner node obtains the third signature code, and verifies the third signature code through the first public key. When the verification of the third signature code is passed, the miner node will The third encrypted data is published on the blockchain, and the second encrypted data is deleted.

In this embodiment, after the first node generates the third signature code, it broadcasts task three to each miner node on the blockchain, obtains the miner node of task three, and uses the first public key (stored on the blockchain) The third signature code is verified (decrypted). When the verification is passed (decrypted), the third encrypted data is obtained. The miner node then publishes the third encrypted data to the blockchain and deletes the second encrypted data. . At this time, user B cannot know the third encrypted data because he does not know what the new symmetric key is. That is, user B's permission to view data is withdrawn.

Further, in an embodiment of the authorization management method of the present application, after step S70, the method further includes:

Step S150, the first node generates a deletion request for deleting the second public key, and signs the deletion request with the first private key to obtain a fourth signature code;

In this embodiment, referring to the above steps S50 to S100, only through steps S50 to S70, the public key (the second public key in this embodiment) of the authorized party (user B in this embodiment) is stored in In the authorized list, the modification of the original data by the user B's terminal (second node) will be accepted (that is, published to the blockchain).

In this embodiment, when user B’s public key is added to the authorization list (that is, user B is granted the right to modify the original data), if user A wants to withdraw the authorization to user B, the first node is controlled to generate Second, the public key deletion request, and the deletion request is signed by the first private key (that is, the principle of private key signature, the deletion request is encrypted by the first private key), and the fourth signature code is obtained.

Step S160, the miner node obtains the fourth signature code, and verifies the fourth signature code using the first public key; step S170, when the fourth signature code is verified, the The miner node deletes the second public key from the authorization list.

In this embodiment, after the first node generates the fourth signature code, it broadcasts task four to each miner node on the blockchain, obtains the miner node of task four, and verifies the fourth signature code with the first public key (I.e. decryption), when the verification is passed (i.e. the decryption is successful), the deletion request is obtained, and the deletion request is executed according to the regulations, and the second public key is deleted from the authorization list. In this way, since the second public key no longer exists in the authorization list, user B no longer has the right to modify data.

When it is detected that the duration of existence is greater than the preset threshold, steps S150-S170 are executed.

In this embodiment, a preset threshold can be set in advance, for example, one month. When a certain public key is added to the authorization list, start timing. When a certain public key exists in the authorization list for more than one month, automatically execute steps S150 to S170 (that is, delete the public key from the authorization list) .

Referring to Figure 4, Figure 4 is a schematic diagram of the functional modules of the first embodiment of the authorization management system of this application.

In the first embodiment of the authorization management system of this application, the authorization management system is applied to the blockchain, including the first node, the second node and the miner node,

The first node 10 includes:

The first signature module 101 is used to sign the second public key of the authorized user by the first private key of the data owner to obtain the first signature code;

The miner node 20 includes:

The first signature verification module 201 is configured to obtain the first signature code, and verify the first signature code using the first public key of the data owner;

The authorization adding module 202 is configured to add the second public key to the authorization list when the first signature code passes the verification;

The second node 30 includes:

The second signature module 301 is used to modify and encrypt the original data to obtain the second encrypted data, and to sign the second encrypted data using the second private key of the authorized user to obtain the second signature code;

The miner node 20 further includes:

The second verification module 203 is configured to obtain the second signature code, and verify the second signature code based on the authorization list;

The publishing module 204 is configured to publish the second encrypted data to the blockchain when the verification of the second signature code is passed.

In this embodiment, the first node uses the first private key of the data owner to sign the second public key of the authorized user to obtain the first signature code; the miner node obtains the first signature code and passes the data to the owner The first public key to verify the first signature code; when the first signature code is verified, the miner node adds the second public key to the authorization list; the second node verifies the original The data is modified and encrypted to obtain the second encrypted data, and the second encrypted data is signed by the authorized user's second private key to obtain the second signature code; the miner node obtains the second signature code, The second signature code is verified based on the authorization list; when the second signature code is verified, the miner node publishes the second encrypted data to the blockchain. Through this embodiment, the owner of the data can grant the authorized party the right to modify the data without providing the private key to the authorized party, so that the owner of the data always retains absolute control over the data, which improves Data security.

In addition, the embodiment of the present application also proposes a computer-readable storage medium, where the computer-readable storage medium may be volatile or non-volatile, which is not specifically limited by this application. The computer-readable storage medium stores an authorization management program, and when the authorization management program is executed by a processor, the steps of each embodiment of the authorization management method described above are implemented.

The specific embodiments of the computer-readable storage medium of the present application are basically the same as the respective embodiments of the authorization management method described above, and will not be repeated here.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better.的实施方式。 Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM) as described above. , Magnetic disks, optical disks), including several instructions to make a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in the various embodiments of the present application.

The above are only preferred embodiments of this application, and do not limit the scope of this application. Any equivalent structure or equivalent process transformation made using the content of the description and drawings of this application, or directly or indirectly used in other related technical fields , The same reason is included in the scope of patent protection of this application.

Claims

An authorization management method is applied to a blockchain-based authorization management system. The authorization management system includes a first node, a second node, and a miner node. The authorization management method includes the following steps:

The first node signs the second public key of the authorized user by using the first private key of the data owner to obtain the first signature code;

The miner node obtains the first signature code, and verifies the first signature code using the first public key of the data owner;

When the verification of the first signature code is passed, the miner node adds the second public key to the authorization list;

The second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code;

The miner node obtains the second signature code, and verifies the second signature code based on the authorization list;

When the verification of the second signature code is passed, the miner node publishes the second encrypted data to the blockchain.
The authorization management method according to claim 1, before the first node signs the second public key of the authorized user with the first private key of the data owner to obtain the first signature code, the method further comprises:

The first node generates a first public key and a first private key, and encrypts the original data with a symmetric key to obtain the first encrypted data;

The miner node publishes the first public key and the first encrypted data to the blockchain;

The second node obtains the first encrypted data from the blockchain, and decrypts the first encrypted data with a symmetric key to obtain the original data;

The second node generates a second public key and a second private key, and sends the second public key to the first node.
The authorization management method according to claim 2, wherein the second node modifies and encrypts the original data to obtain the second encrypted data, and signs the second encrypted data by the second private key of the authorized user, The steps of obtaining the second signature code include:

The second node modifies the original data to obtain second data, and uses the symmetric key to encrypt the second data to obtain second encrypted data;

The second node signs the second encrypted data with the second private key to obtain a second signature code.
The authorization management method according to claim 3, wherein the step of obtaining the second signature code by the miner node and verifying the second signature code based on the authorization list comprises:

The miner node obtains the second signature code, and obtains the added public key from the authorization list;

The second signature code is checked in turn by the added public key.
The authorization management method of claim 1, after the step of publishing the second encrypted data on the blockchain by the miner node when the second signature code is verified, the method further comprises :

The first node decrypts the second encrypted data by using the symmetric key to obtain the second data;

The first node generates a new symmetric key, and encrypts the second data with the new symmetric key to obtain the third encrypted data;

The first node signs the third encrypted data with the first private key to obtain the third signature code;

The miner node obtains the third signature code, and verifies the third signature code through the first public key;

When the verification of the third signature code is passed, the miner node publishes the third encrypted data on the blockchain and deletes the second encrypted data.
The authorization management method according to claim 1, after the step of adding the second public key to the authorization list by the miner node when the first signature code is verified, the method further comprises:

The first node generates a deletion request for the second public key, and signs the deletion request with the first private key to obtain a fourth signature code;

The miner node obtains the fourth signature code, and verifies the fourth signature code through the first public key;

When the verification of the fourth signature code is passed, the miner node deletes the second public key from the authorization list.
7. The authorization management method according to claim 6, after the step of adding the second public key to the authorization list by the miner node when the first signature code is verified, the method further comprises:

The first node counts the existence time of the second public key in the authorization list;

When it is detected that the existence duration is greater than a preset threshold, the execution of the first node generates a deletion request for the second public key, and signs the deletion request with the first private key to obtain a fourth signature code A step of.
An authorization management system, applied to a blockchain, the authorization management system including a first node, a second node, and a miner node,

The first node includes:

The first signature module is used to sign the second public key of the authorized user with the first private key of the data owner to obtain the first signature code;

The miner node includes:

The first signature verification module is configured to obtain the first signature code, and verify the first signature code by the first public key of the data owner;

The authorization adding module is used to add the second public key to the authorization list when the first signature code passes the verification

The second node includes:

The second signature module is used to modify and encrypt the original data to obtain the second encrypted data, and to sign the second encrypted data using the second private key of the authorized user to obtain the second signature code;

The miner node also includes:

A second signature verification module, configured to obtain the second signature code, and verify the second signature code based on the authorization list;

The publishing module is used for publishing the second encrypted data to the blockchain when the verification of the second signature code is passed.
The authorization management system according to claim 8, wherein the first node further comprises:

The first encryption module is used to generate the first public key and the first private key, and encrypt the original data with the symmetric key to obtain the first encrypted data;

The publishing module is also used to publish the first public key and the first encrypted data to the blockchain;

The second node further includes:

The second decryption module is used to obtain the first encrypted data from the blockchain, and decrypt the first encrypted data with the symmetric key to obtain the original data;

The sending module is used to generate a second public key and a second private key, and send the second public key to the first node.
The authorization management system according to claim 9, wherein the second signature module comprises:

A second encryption unit, configured to modify the original data to obtain second data, and use the symmetric key to encrypt the second data to obtain second encrypted data;

The second signature unit is configured to sign the second encrypted data by using the second private key to obtain a second signature code.
The authorization management system according to claim 10, wherein the second verification module comprises:

A second obtaining unit, configured to obtain the second signature code, and obtain the added public key from the authorization list;

The second verification unit is configured to verify the second signature code sequentially by using the added public key.
The authorization management system according to claim 8, wherein the first node further comprises:

The first decryption module is configured to decrypt the second encrypted data by using the symmetric key to obtain second data;

The first encryption module is also used to generate a new symmetric key, and encrypt the second data with the new symmetric key to obtain third encrypted data;

The first signature unit is further configured to sign the third encrypted data with the first private key to obtain a third signature code;

The miner node also includes:

The third signature verification module is configured to obtain the third signature code, and verify the third signature code through the first public key;

The viewing authority recovery module is also used to publish the third encrypted data to the blockchain and delete the second encrypted data when the third signature code is verified.
The authorization management system according to claim 8, wherein the first signature unit is further configured to generate a deletion request for the second public key, and sign the deletion request with the first private key to obtain the fourth Signature code

The miner node also includes:

A fourth signature verification module, configured to obtain the fourth signature code, and verify the fourth signature code through the first public key;

The modification authority recovery module is configured to delete the second public key from the authorization list when the verification of the fourth signature code is passed.
The authorization management system according to claim 13, wherein the first node further comprises:

A timing module, configured to count the existence time of the second public key in the authorization list;

The trigger module is configured to execute the generation of a deletion request for the second public key when it is detected that the existence duration is greater than a preset threshold, and sign the deletion request with the first private key to obtain the fourth Steps to sign code.
An authorization management device, the authorization management device comprising: a memory, a processor, and an authorization management program stored in the memory and capable of running on the processor, and when the authorization management program is executed by the processor Steps to implement the authorization management method described below:

The first node signs the second public key of the authorized user by using the first private key of the data owner to obtain the first signature code;

The miner node obtains the first signature code, and verifies the first signature code using the first public key of the data owner;

When the verification of the first signature code is passed, the miner node adds the second public key to the authorization list;

The second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code;

The miner node obtains the second signature code, and verifies the second signature code based on the authorization list;

When the verification of the second signature code is passed, the miner node publishes the second encrypted data to the blockchain.
The authorization management device according to claim 15, wherein the authorization management program is executed by the processor, and the first node signs the second public key of the authorized user through the first private key of the data owner to obtain the first Before the step of a signature code, perform the following steps:

The first node generates a first public key and a first private key, and encrypts the original data with a symmetric key to obtain the first encrypted data;

The miner node publishes the first public key and the first encrypted data to the blockchain;

The second node obtains the first encrypted data from the blockchain, and decrypts the first encrypted data with a symmetric key to obtain the original data;

The second node generates a second public key and a second private key, and sends the second public key to the first node.
The authorization management device according to claim 16, wherein the authorization management program is executed by the processor and the second node modifies and encrypts the original data to obtain the second encrypted data, and passes the second private data of the authorized user When the second encrypted data is signed by the key to obtain the second signature code, the following steps are also performed:

The second node modifies the original data to obtain second data, and uses the symmetric key to encrypt the second data to obtain second encrypted data;

The second node signs the second encrypted data by using the second private key to obtain a second signature code.
A computer-readable storage medium, the computer-readable storage medium stores an authorization management program, and when the authorization management program is executed by a processor, the steps of the authorization management method described below are implemented:

The first node signs the second public key of the authorized user by using the first private key of the data owner to obtain the first signature code;

The miner node obtains the first signature code, and verifies the first signature code using the first public key of the data owner;

When the verification of the first signature code is passed, the miner node adds the second public key to the authorization list;

The second node modifies and encrypts the original data to obtain second encrypted data, and signs the second encrypted data with the second private key of the authorized user to obtain the second signature code;

The miner node obtains the second signature code, and verifies the second signature code based on the authorization list;

When the verification of the second signature code is passed, the miner node publishes the second encrypted data to the blockchain.
The computer-readable storage medium according to claim 18, wherein the authorization management program is executed by the processor, and the first node signs the second public key of the authorized user through the first private key of the data owner to obtain the first Before the step of a signature code, perform the following steps:

The first node generates a first public key and a first private key, and encrypts the original data with a symmetric key to obtain the first encrypted data;

The miner node publishes the first public key and the first encrypted data to the blockchain;

The second node obtains the first encrypted data from the blockchain, and decrypts the first encrypted data with a symmetric key to obtain the original data;

The second node generates a second public key and a second private key, and sends the second public key to the first node.
The computer-readable storage medium according to claim 19, wherein the authorization management program is executed by the processor, and the second node modifies and encrypts the original data to obtain the second encrypted data, and passes the second private data of the authorized user When the second encrypted data is signed by the key to obtain the second signature code, the following steps are also performed:

The second node modifies the original data to obtain second data, and uses the symmetric key to encrypt the second data to obtain second encrypted data;

The second node signs the second encrypted data by using the second private key to obtain a second signature code.