WO2021088728A1 - 数据加密、解密和共享方法、设备、系统及存储介质 - Google Patents

数据加密、解密和共享方法、设备、系统及存储介质 Download PDF

Info

Publication number
WO2021088728A1
WO2021088728A1 PCT/CN2020/125226 CN2020125226W WO2021088728A1 WO 2021088728 A1 WO2021088728 A1 WO 2021088728A1 CN 2020125226 W CN2020125226 W CN 2020125226W WO 2021088728 A1 WO2021088728 A1 WO 2021088728A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
ciphertext
key
symmetric
type
Prior art date
Application number
PCT/CN2020/125226
Other languages
English (en)
French (fr)
Inventor
许重建
陀前途
钟文波
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2021088728A1 publication Critical patent/WO2021088728A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • This application relates to the field of data processing technology, and in particular to a data encryption, decryption, and sharing method, device, system, and storage medium.
  • Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.
  • the blockchain has the advantages of openness, non-tamperability, and distributed sharing of the global ledger, but at the same time these features also bring data leakage problems, which seriously affect the application of blockchain technology in many business scenarios. Therefore, how to ensure the security and privacy of data in the blockchain has become an urgent problem to be solved.
  • Various aspects of this application provide a data encryption, decryption, and sharing method, device, system, and storage medium to improve data security and privacy.
  • the embodiment of the present application provides a data encryption method, including:
  • the ciphertext of the data to be processed and the ciphertext of the symmetric key are written into the blockchain, so that the second user can access the data to be processed according to his private key.
  • the embodiment of the present application also provides a data decryption method, including:
  • the embodiment of the present application also provides a data sharing method, including:
  • the key ciphertext is decrypted asymmetrically according to the local private key to obtain the first symmetric key; the key ciphertext is based on the public key corresponding to the local private key to the first symmetric key Key encryption;
  • the second ciphertext and the ciphertext of the second symmetric key are written into the blockchain to share the data to be shared with the second user.
  • the embodiment of the present application also provides a data encryption method, including:
  • to-be-processed data provided by the first user, where the to-be-processed data includes first-type data with designated attributes and second-type data without the designated attributes;
  • the intermediate data is symmetrically encrypted according to the second symmetric key
  • the second symmetric key is asymmetrically encrypted according to the public key of the third user to obtain the ciphertext of the intermediate data and the second The ciphertext of the symmetric key
  • the ciphertext of the intermediate data and the ciphertext of the second symmetric key are written into the blockchain, so that the third user can access the second type of data according to his private key.
  • An embodiment of the present application also provides a computer device, including: a memory and a processor; wherein the memory is used to store a computer program;
  • the processor is coupled to the memory, and is configured to execute the computer program for:
  • the ciphertext of the data to be processed and the ciphertext of the symmetric key are written into the blockchain, so that the second user can access the data to be processed according to his private key.
  • An embodiment of the present application also provides a computer device, including: a memory and a processor; wherein the memory is used to store a computer program;
  • the processor is coupled to the memory, and is configured to execute the computer program for:
  • An embodiment of the present application also provides a computer device, including: a memory and a processor; wherein the memory is used to store a computer program;
  • the key ciphertext is decrypted asymmetrically according to the local private key to obtain the first symmetric key; the key ciphertext is based on the public key corresponding to the local private key to the first symmetric key Key encryption;
  • the second ciphertext and the ciphertext of the second symmetric key are written into the blockchain to share the data to be shared with the second user.
  • An embodiment of the present application also provides a computer device, including: a memory and a processor; wherein the memory is used to store a computer program;
  • to-be-processed data provided by the first user, where the to-be-processed data includes first-type data with designated attributes and second-type data without the designated attributes;
  • the intermediate data is symmetrically encrypted according to the second symmetric key
  • the second symmetric key is asymmetrically encrypted according to the public key of the third user to obtain the ciphertext of the intermediate data and the second The ciphertext of the symmetric key
  • the ciphertext of the intermediate data and the ciphertext of the second symmetric key are written into the blockchain, so that the third user can access the second type of data according to his private key.
  • the embodiment of the present application also provides a blockchain system, including: multiple node devices, wherein the node devices are used to: obtain the data to be processed and the first symmetric key provided by the first user; A symmetric key performs symmetric encryption on the to-be-processed data to obtain the ciphertext of the to-be-processed data; the first symmetric key is decrypted according to the public key of the second user in the blockchain system Symmetric encryption to obtain the ciphertext of the first symmetric key; and write the ciphertext of the data to be processed and the ciphertext of the first symmetric key into the blockchain for the second user Access the to-be-processed data according to its private key.
  • the node device is further configured to: obtain the data ciphertext and the key ciphertext corresponding to the data ciphertext from the blockchain; encrypt the key according to the local private key The text is decrypted asymmetrically to obtain a second symmetric key; wherein, the key ciphertext is encrypted according to the public key corresponding to the local private key; the data ciphertext is encrypted according to the second symmetric key Perform symmetric decryption to obtain data plaintext.
  • An embodiment of the present application also provides a blockchain system, including: multiple node devices, wherein the node devices are used to: obtain the first ciphertext of the data to be shared and the data to be shared from the blockchain Corresponding key ciphertext; asymmetrically decrypt the key ciphertext according to the local private key to obtain the first symmetric key; the key ciphertext is based on the public key corresponding to the local private key
  • the first symmetric key is encrypted; the first ciphertext is decrypted according to the first symmetric key to obtain the data to be shared; the second symmetric key is obtained, and according to the The second symmetric key performs symmetric encryption on the data to be shared to obtain the second ciphertext of the data to be shared; the second symmetric encryption is performed according to the public key of the second user in the blockchain system Key is encrypted to obtain the ciphertext of the second symmetric key; and the second ciphertext and the ciphertext of the second symmetric key are written into the blockchain to communicate with the second symmetric
  • the node device is further configured to: obtain the data ciphertext and the key ciphertext corresponding to the data ciphertext from the blockchain; encrypt the key according to the local private key The text is decrypted asymmetrically to obtain a third symmetric key; wherein, the key ciphertext is encrypted according to the public key corresponding to the local private key; the data ciphertext is encrypted according to the third symmetric key Perform symmetric decryption to obtain data plaintext.
  • An embodiment of the present application also provides a blockchain system, including: multiple node devices, wherein the node devices are used to: obtain to-be-processed data provided by a first user, and the to-be-processed data includes data with specified attributes The first type of data and the second type of data that do not have the specified attribute; the first type of data is symmetrically encrypted according to the first symmetric key, and according to the public key of the second user in the blockchain system Perform asymmetric encryption on the first symmetric key to obtain the cipher text of the first type of data and the cipher text of the first symmetric key; combine the cipher text of the first type of data with the cipher text of the first symmetric key; The ciphertext of a symmetric key is written into the blockchain for the second user to access the first type of data according to his private key; replace the first type of data in the to-be-processed data with the first type of data Ciphertext of the class data to obtain intermediate data; perform symmetric encryption on the intermediate data according to the second
  • the node device is further configured to: obtain the data ciphertext and the key ciphertext corresponding to the data ciphertext from the blockchain; encrypt the key according to the local private key The text is decrypted asymmetrically to obtain a third symmetric key; wherein, the key ciphertext is encrypted according to the public key corresponding to the local private key; the data ciphertext is encrypted according to the third symmetric key Perform symmetric decryption to obtain data plaintext.
  • the embodiment of the application also provides a data encryption system, including: a smart contract layer and a blockchain storage layer;
  • the smart contract layer is used to obtain the data to be processed and the symmetric key provided by the first user; the data to be processed is symmetrically encrypted according to the symmetric key to obtain the ciphertext of the data to be processed And performing asymmetric encryption on the symmetric key according to the public key of the second user to obtain the ciphertext of the symmetric key; and the ciphertext of the data to be processed and the ciphertext of the symmetric key Write to the storage layer for the second user to access the to-be-processed data according to his private key.
  • the embodiment of the present application also provides a data decryption system, including: a smart contract layer and a blockchain storage layer; the blockchain storage layer is used to store data ciphertexts and key ciphertexts corresponding to the data ciphertexts ;
  • the smart contract layer is used to obtain the data ciphertext and the key ciphertext corresponding to the data ciphertext from the blockchain storage layer; perform non-transaction on the key ciphertext according to the local private key Symmetric decryption to obtain a symmetric key; wherein the key ciphertext is encrypted according to the public key corresponding to the local private key; and the data ciphertext is symmetrically decrypted according to the symmetric key to obtain data Plaintext.
  • the embodiment of the present application also provides a data sharing system, including: a smart contract layer and a blockchain storage layer; wherein the blockchain storage layer is used to store the first ciphertext of the data to be shared and the data to be shared The key ciphertext corresponding to the data;
  • the smart contract layer is used to obtain the first ciphertext and the key ciphertext from the blockchain storage layer; perform asymmetric decryption on the key ciphertext according to the local private key to Obtain the first symmetric key;
  • the key ciphertext is formed by encrypting the first symmetric key according to the public key corresponding to the local private key; Encrypting the first symmetric key according to the first symmetric key Ciphertext is decrypted to obtain the data to be shared; a second symmetric key is obtained, and the data to be shared is symmetrically encrypted according to the second symmetric key to obtain the second data of the data to be shared Cipher text; encrypt the second symmetric key according to the public key of the second user to obtain the cipher text of the second symmetric key; and combine the second cipher text and the second symmetric key
  • the ciphertext of is written into the blockchain storage layer to share the data to be shared with the second user.
  • the embodiment of the application also provides a data encryption system, including: a smart contract layer and a blockchain storage layer;
  • the smart contract layer is used to obtain the data to be processed provided by the first user, and the data to be processed includes the first type of data with specified attributes and the second type of data without the specified attributes; according to the first
  • the symmetric key performs symmetric encryption on the first type of data, and performs asymmetric encryption on the first symmetric key according to the public key of the second user to obtain the ciphertext of the first type of data and the first type of data.
  • a ciphertext of a symmetric key; the ciphertext of the first type of data and the ciphertext of the first symmetric key are written into the blockchain storage layer for the second user according to his private key Access the first type of data; and replace the first type of data in the to-be-processed data with the ciphertext of the first type of data to obtain intermediate data; perform symmetrical on the intermediate data according to the second symmetric key Encrypt, and perform asymmetric encryption on the second symmetric key according to the public key of the third user to obtain the ciphertext of the intermediate data and the ciphertext of the second symmetric key; and combine the intermediate data
  • the ciphertext of and the ciphertext of the second symmetric key are written into the blockchain storage layer for the third user to access the second type of data according to his private key.
  • the embodiment of the application also provides a trade blockchain system, including: buyer-side equipment, seller-side equipment, and third-party equipment;
  • the buyer-side device or the seller-side device is configured to: obtain transaction data to be processed; the transaction data includes first-type data with designated attributes and second-type data without the designated attributes;
  • the first symmetric key performs symmetric encryption on the first type of data, and performs asymmetric encryption on the first symmetric key according to the public key of the other party of the transaction to obtain the ciphertext and The ciphertext of the first symmetric key; and the ciphertext of the first type of data and the ciphertext of the first symmetric key are written into the trade block chain for the other party of the transaction according to its
  • the private key accesses the first type of data; and replaces the first type of data in the to-be-processed data with the ciphertext of the first type of data to obtain intermediate data; compares the intermediate data according to the second symmetric key Perform symmetric encryption, and perform asymmetric encryption on the second symmetric key according to the public key of the other party of the transaction and the third party corresponding to the third-party device to obtain the
  • the embodiments of the present application also provide a computer-readable storage medium storing computer instructions.
  • the computer instructions When the computer instructions are executed by one or more processors, the one or more processors will cause the one or more processors to execute the steps in each of the above methods. .
  • the data to be processed is symmetrically encrypted according to the symmetric key on the blockchain
  • the symmetric key is asymmetrically encrypted
  • the ciphertext of the data to be processed and the ciphertext of the symmetric key are written into the area Block chain.
  • Figures 1a-1c are schematic diagrams of the structure of a blockchain system provided by an embodiment of the application.
  • FIGS. 2a and 2b are schematic diagrams of the structure of a data encryption system provided by an embodiment of the application.
  • 3a and 3b are schematic structural diagrams of a data decryption system provided by an embodiment of the application.
  • Figure 3c is a schematic structural diagram of a data sharing system provided by an embodiment of the application.
  • FIG. 4 is a schematic flowchart of a data encryption method provided by an embodiment of this application.
  • FIG. 5 is a schematic flowchart of another data encryption method provided by an embodiment of this application.
  • FIG. 6 is a schematic flowchart of a data decryption method provided by an embodiment of this application.
  • FIG. 7a is a schematic flowchart of a data sharing method provided by an embodiment of this application.
  • Fig. 7b is a schematic structural diagram of a trade blockchain system provided by an embodiment of the application.
  • FIGS. 8-11 are schematic diagrams of the structure of a computer device provided by an embodiment of this application.
  • the data to be processed is symmetrically encrypted according to the symmetric key on the blockchain, and the symmetric key is asymmetrically encrypted. Encrypt and write the ciphertext of the data to be processed and the ciphertext of the symmetric key into the blockchain.
  • This encryption method that uses a combination of symmetric encryption and asymmetric encryption can improve the efficiency of data encryption processing on the one hand, and on the other hand, it can also help ensure data security.
  • Figure 1a is a schematic structural diagram of a blockchain system provided by an embodiment of the application.
  • the blockchain system includes multiple node devices 10a.
  • multiple units refer to 2 units or more.
  • multiple node devices 10a form a blockchain system, and each node device 10a can realize data sharing.
  • the multiple node devices 10a may be wired or wirelessly connected.
  • multiple node devices 10a can be connected via mobile network communication.
  • the network standard of the mobile network can be 2G (GSM), 2.5G (GPRS), 3G (WCDMA, TD-SCDMA, CDMA2000, UTMS). ), 4G (LTE), 4G+ (LTE+), 5G, WiMax, etc.
  • multiple node devices 10a may also communicate and connect via Bluetooth, WiFi, infrared, or the like.
  • the node device 10a refers to a computer device with functions such as computing, storage, and communication.
  • the node device 10a may be a single server device, a cloudized server array, or a virtual machine (VM) or container running in a cloudized server array.
  • VM virtual machine
  • the node device 10a may also refer to other computing devices with corresponding data processing and storage capabilities, such as smart phones, tablet computers, personal computers, wearable devices and other terminal devices (running data processing programs).
  • each node device 10a can execute corresponding data processing logic.
  • the first node device 10a1 is any user in the blockchain system, and the operating user of the first node device 10a1 is defined as the first user.
  • the first node device 10a1 can obtain the to-be-processed data provided by the first user, and obtain the first symmetric key.
  • the first user is the operating user of the first node device 10a1, that is, the provider of the data to be processed. Further, the first node device 10a1 performs symmetric encryption on the data to be processed according to the first symmetric key to obtain the ciphertext of the data to be processed.
  • the specific implementation manner in which the first node device 10a1 performs symmetric encryption on the data to be processed according to the first symmetric key is not limited.
  • the first node device 10a1 may use encryption algorithms such as DES, 3DES, IDEA, RC5, and RC6 to perform symmetric encryption on the data to be processed, but it is not limited to this.
  • the adopted symmetric encryption algorithm is different, and the specific implementation manners of performing symmetric encryption on the data to be processed according to the first symmetric key are different.
  • the symmetric encryption method is used to encrypt the data to be processed, especially for data to be processed with a large amount of data, which helps to increase the encryption processing speed of the data to be processed and improve the encryption efficiency.
  • the first node device 10a1 performs asymmetric encryption on the first symmetric key according to the public key of the second user in the blockchain system to obtain the ciphertext of the first symmetric key.
  • the second user is a user who has the authority to access the data to be processed.
  • the second user is a user who is located in the blockchain system where the first node device 10a1 is located and has the authority to access the data to be processed.
  • the number of second users may be one or more. Multiple refers to two or more. If there are multiple second users, the first node device 10a1 can perform asymmetric encryption on the first symmetric key according to the public keys of the multiple second users. In this way, each second user can perform asymmetric encryption on the first symmetric key.
  • the respective private keys perform asymmetric decryption on the ciphertext of the first symmetric key.
  • the specific implementation manner in which the first node device 10a1 performs asymmetric encryption on the first symmetric key is not limited.
  • the first node device 10a1 can perform asymmetric encryption on the first symmetric key with algorithms such as RSA, Elgamal, knapsack algorithm, Rabin, D-H, ECC (Elliptic Curve Encryption Algorithm), but it is not limited to this.
  • the adopted asymmetric encryption algorithm is different, and the specific implementation manners of performing symmetric encryption on the data to be processed according to the public key of the second user are different.
  • the first node device 10a1 writes the ciphertext of the data to be processed and the ciphertext of the first symmetric key into the blockchain.
  • the second user can access the data to be processed according to his private key.
  • the public key of the second user corresponds to the private key.
  • the first symmetric key is encrypted and propagated, which can ensure the security and privacy of the first symmetric key, thereby helping to ensure the security and privacy of the data to be processed.
  • the ciphertext of the data to be processed and the ciphertext of the first symmetric key can be obtained from the blockchain, and the ciphertext of the first symmetric key can be obtained according to the private key pair at the local end.
  • the ciphertext of the first symmetric key is decrypted asymmetrically to obtain the first symmetric key; then, the node device of the second user can decrypt the ciphertext of the data to be processed according to the first symmetric key, thereby obtaining the data to be processed.
  • the node device can perform symmetric encryption on the data to be processed on the blockchain according to the symmetric key, perform asymmetric encryption on the symmetric key, and combine the ciphertext and symmetric data of the data to be processed on the blockchain.
  • the ciphertext of the key is written into the blockchain.
  • the first symmetric key may be randomly obtained by the first node device 10a1 from a plurality of preset symmetric keys, or it may be the first node device 10a1 in the process of obtaining the data to be processed.
  • a symmetric key generated randomly from the data can be understood as: when acquiring the data to be processed, after acquiring the data to be processed, or in the process of acquiring the data to be processed, etc., but not limited to this.
  • the specific implementation manner in which the first node device 10a1 randomly generates the first symmetric key is not limited.
  • a symmetric key generation rule may be preset, and the first node device 10a1 may randomly generate the first symmetric key according to the preset generation rule.
  • the preset generation rule may be the number of bits of the generated symmetric key, the type of characters contained in the generated symmetric key, etc., but it is not limited to this.
  • the preset generation rule may be that the generated symmetric key is 6 digits, and needs to contain both letters and numbers, etc., but it is not limited to this.
  • the first user may want to distinguish users who access the data to be processed provided by the first user. For some data in the data to be processed, the first user only wants to be accessed by designated users; the remaining part of data is for another part of users to access, and so on.
  • buyers, sellers, freight companies, customs, tax bureaus, etc. can form a blockchain system.
  • the sensitive information (such as transaction amount, quantity, address information of the buyer and seller, etc.) in the data to be processed provided by the buyer and the seller is only accessible to the buyer and the seller, and the remaining non-sensitive information can be used in the blockchain. All users access.
  • the data to be processed may include data with specified attributes.
  • the data to be processed may all have designated attributes, some may have designated attributes, or all of them may not have designated attributes.
  • the designated attributes may be different; even in the same application scenario, the identity of the first user is different, the designated attributes may also be different.
  • the designated attributes can be transaction amount, quantity, and address information of the buyers and sellers, but not limited to this; for logistics companies, the designated attributes can be the individual of the freight driver Information (ID number, contact information, etc.) etc.
  • the first node device 10a1 can identify the first type of data with designated attributes and the second type of data without designated attributes from the data to be processed. Further, the first node device 10a1 generates a first random key and a second random key for the first type of data and the second type of data, respectively, where the first random key and the second random key are both symmetric keys.
  • the first node device 10a1 to randomly generate the first random key and the second random key, refer to the related content of the above-mentioned randomly generating the first symmetric key, which will not be repeated here.
  • the first node device 10a1 can symmetrically encrypt the first type of data according to the first random key to obtain the ciphertext of the first type of data; and replace the first type of data in the to-be-processed data with the first type of data The ciphertext of the data to get the intermediate data. Further, the first node device 10a1 may perform symmetric encryption on the intermediate data according to the second random key, thereby obtaining the ciphertext of the data to be processed. The first node device 10a1 double-encrypts the first type of data in the data to be processed according to the first random key and the second random key, which is beneficial to further improve the security and privacy of the first type of data. In addition, the first node device separately encrypts the first type of data and the second type of data in the data to be processed, which helps to achieve field-granular data privacy protection.
  • the first node device 10a1 encrypts the first random key according to the public key of the first-type user who has the right to access the first-type data, and then obtains the ciphertext of the first random key;
  • the public key of the second-type user with the second-type data authority performs encryption processing on the second random key to obtain the ciphertext of the second random key.
  • the second type of user may be a user different from the first type of user, and may also include the first type of user.
  • the first type of user refers to a user who is located in the blockchain system where the first node device 10a1 is located and has the authority to access the first type of data.
  • the number of users of the first type may be one or more. If the number of users of the first type is multiple, the first node device 10a1 may perform asymmetric encryption on the first random key according to the public keys of the multiple users of the first type. The ciphertext of the first random key can be decrypted asymmetrically according to their respective private keys.
  • the second type of user refers to a user who is located in the blockchain system where the first node device 10a1 is located and has the authority to access the second type of data. Further, the number of users of the second type may be one or more.
  • the first node device 10a1 may perform asymmetric encryption on the second random key according to the public keys of the multiple users of the second type.
  • the ciphertext of the second random key can be decrypted asymmetrically according to its respective private key.
  • the first node device 10a1 may also form a key-value pair between the public key of the first type of user and the first random key.
  • the key-value pair is defined as the first key-value pair.
  • the first node device 10a1 can store the ciphertext of the first key-value pair and the first type of data in the world state variable of the blockchain; and combine the first key-value pair and the first type of data
  • the log corresponding to the ciphertext is stored in the block ledger of the blockchain.
  • the log corresponding to the first key-value pair may be an event record forming the first key-value pair, and may include the formation time of the first key-value pair, description of the operator and related operations, etc., but is not limited thereto.
  • the log corresponding to the ciphertext of the first type of data may be the generation log of the ciphertext of the first type of data, which may include the generation time of the ciphertext of the first type of data, the description of the operator and related operations, etc., but Not limited to this.
  • the first node device 10a1 may also form a key-value pair between the public key of the second type of user and the second random key.
  • the key-value pair is defined as a second key-value pair.
  • the first node device 10a1 can also store the second key-value pair and the ciphertext of the data to be processed into the world state variable of the blockchain; and the second key-value pair and the ciphertext of the data to be processed are corresponding The log is stored in the block ledger of the blockchain.
  • the foregoing first node device 10a1 is only a description of the manner in which the data to be processed is encrypted, and does not limit the execution order of each operation. These operations can be executed sequentially or in parallel according to the order in which they appear in the foregoing embodiment. It may also be executed out of the order of appearance in the above-mentioned embodiments.
  • the first node device 10a1 may first store the ciphertext of the first key-value pair and the first type of data in the world state variable of the blockchain; and store the ciphertext of the first key-value pair and the first type of data.
  • the log corresponding to the text is stored in the block ledger of the blockchain; a second random key is generated for the second type of data and so on.
  • the first node device 10a1 encrypts the first type of data first, and then encrypts the second type of data as an example, for example.
  • the first node device 10a1 identifies the first type of data with designated attributes and the second type of data without designated attributes from the data to be processed.
  • the first node device 10a1 performs the first layer encryption on the first type of data.
  • the specific implementation process is: the first node device 10a1 symmetrically encrypts the first type of data according to the first symmetric key to obtain the encryption of the first type of data. Text.
  • the first node device 10a1 performs asymmetric encryption on the first symmetric key according to the public key of the second user to obtain the ciphertext of the first symmetric key.
  • the second user can asymmetrically decrypt the ciphertext of the first symmetric key according to his private key to obtain the plaintext of the first random key.
  • the ciphertext of the first type of data is symmetrically decrypted according to the first symmetric key, and then the ciphertext of the first type of data is obtained.
  • the first node device 10a1 may randomly generate a first symmetric key for the first type of data.
  • the second user is equivalent to the above-mentioned first-category user.
  • the description of the second user please refer to the related content of the above-mentioned first-category user's description, which will not be repeated here.
  • the first node device 10a1 may also write the ciphertext of the first type of data and the ciphertext of the first symmetric key into the blockchain.
  • the first node device 10a1 may form a first key-value pair with the public key of the second user and the ciphertext of the first symmetric key, and store the ciphertext of the first key-value pair and the first type of data in In the world state variable, the log corresponding to the first key-value pair and the log corresponding to the ciphertext of the first type of data are written into the block ledger.
  • the first node device 10a1 may perform the second layer encryption on the data to be processed.
  • the specific implementation process is as follows: the first node device 10a1 replaces the first type of data in the to-be-processed data with the ciphertext of the first type of data to obtain the intermediate data, and performs symmetric encryption on the intermediate data according to the second symmetric key to obtain the intermediate data.
  • the ciphertext of the data may randomly generate the second symmetric key.
  • the first node device 10a1 performs asymmetric encryption on the second symmetric key according to the public key of the third user to obtain the ciphertext of the second symmetric key.
  • the third user is a user who has access authority to the second type of data.
  • the third user may be the second user, or may be a user other than the second user.
  • the number of third users may be one or more. If the number of third users is multiple, the first node device 10a1 can perform asymmetric encryption on the second symmetric key according to the public keys of the multiple third users. In this way, each third user can perform asymmetric encryption on the second symmetric key.
  • the respective private keys perform asymmetric decryption of the ciphertext of the second symmetric key to obtain the plaintext of the second symmetric key, and then perform asymmetric decryption of the ciphertext of the data to be processed according to the second symmetric key to obtain the second type of data
  • the plaintext and the ciphertext of the first type of data are examples of the first type of data.
  • the first node device 10a1 can also write the ciphertext of the intermediate data and the ciphertext of the second symmetric key into the blockchain, so that the third user can access the second type of data according to his private key.
  • the first node device 10a1 may form a second key-value pair of the public key of the third user and the ciphertext of the second symmetric key, and store the ciphertext of the second key-value pair and the intermediate data in the world state In the variable, the log corresponding to the second key-value pair and the log corresponding to the ciphertext of the intermediate data are written into the block ledger.
  • the node device 10a in the blockchain system can also perform decryption processing.
  • the first node device 10a1 is still taken as an example for exemplary description.
  • the data ciphertext is the ciphertext corresponding to the data to be accessed by the first node device 10a1 (that is, the data to be accessed); the key ciphertext is encrypted according to the public key corresponding to the local private key of the first node device 10a1.
  • the first node device 10a1 has the right to access the data (data to be accessed) corresponding to the data ciphertext. Further, the first node device 10a can perform asymmetric decryption of the key ciphertext according to the private key of the local end to obtain the symmetric key; after that, the first node device 10a1 can perform symmetric decryption of the data ciphertext according to the symmetric key to obtain the data Plaintext.
  • the first node device 10a1 may receive an access instruction issued by the first user, and the access designation carries an identifier of the data to be accessed. Further, the first node device 10a1 can obtain the data ciphertext corresponding to the identification of the data to be accessed and the correspondence between the public key and the key ciphertext corresponding to the data ciphertext from the blockchain; and the first node The local public key of the device 10a1 matches in the correspondence between the public key and the key cipher text, and then the key cipher text corresponding to the data cipher text is obtained.
  • the correspondence between the public key corresponding to the data ciphertext and the key ciphertext may be a key-value pair list composed of the public key corresponding to the data ciphertext and the key ciphertext.
  • the first node device 10a1 when the first node device 10a1 matches the local public key in the corresponding relationship between the public key and the key ciphertext, if the corresponding public key can be matched, it means that the first user has The authority to access the data to be accessed; if the corresponding public key is not matched, it means that the first user does not have the authority to access the data to be accessed.
  • the first node device 10a1 when the first node device 10a1 fails to match the local public key in the corresponding relationship between the public key and the key ciphertext, it may also output a prompt message to remind the first user that he does not have access to the data to be accessed. Permissions.
  • the above method can be used to decrypt the data.
  • the first node device 10a1 can also identify the identifier of the first type of data with the designated attribute and the second type of data without the designated attribute from the identifier of the data to be accessed. After that, according to the identification of the first type of data and the identification of the second type of data, the public key and key ciphertext corresponding to the first type of data and the second type of data are obtained from the world state variables of the blockchain. Correspondence between. Further, the first node device 10a1 matches the local public key in the correspondence between the public key corresponding to the second type of data and the key ciphertext to obtain the second key ciphertext.
  • the first node device 10a1 may perform asymmetric decryption on the ciphertext of the second key according to the private key of the local end to obtain the second symmetric key. Further, the first node device 10a1 may decrypt the ciphertext of the data according to the second symmetric key to obtain the plaintext of the second type of data and the ciphertext of the first type of data.
  • the first node device 10a1 may match the local public key in the correspondence between the public key corresponding to the first type of data and the key ciphertext to obtain the first key ciphertext. Further, the first node device 10a1 may also perform asymmetric decryption on the ciphertext of the first key according to the private key of the local end to obtain the first symmetric key. Further, the first node device 10a1 may decrypt the ciphertext of the first type of data according to the first symmetric key, and then obtain the plaintext of the first type of data.
  • the first node device 10a1 when the first node device 10a1 matches the local public key in the correspondence between the public key corresponding to the first type of data and the key ciphertext, if the corresponding public key can be matched, It means that the first user has the right to access the first type of data; if the corresponding public key is not matched, it means that the first user does not have the right to access the first type of data.
  • the first node device 10a1 fails to match the local public key in the correspondence between the public key and the key ciphertext, it may also output a prompt message to remind the first user that the first user does not have the first type of data access permission.
  • the description of the data decryption processing method performed by the first node device 10a1 above does not limit the execution order of the operations. These operations can be executed sequentially or in parallel according to the order in which they appear in the above embodiments, or not. They are executed in the order in which they appear in the above-mentioned embodiments.
  • the first node device 10a1 performs decryption according to the reverse process of the encryption process of the data to be accessed.
  • the first node device 10a1 only needs to perform the second layer data decryption process.
  • the specific implementation process is: the first node device 10a1 reads the correspondence between the public key and the key ciphertext corresponding to the second type of data from the world state metamorphosis.
  • the correspondence may be in the form of a key-value pair list Store it.
  • the first node device 10a1 matches the corresponding relationship between the public key and the key cipher text according to the local public key to obtain the second key cipher text corresponding to the local private key.
  • the first node device 10a1 decrypts the second key ciphertext according to the private key of the local end to obtain the plaintext of the second random key, and decrypts the data ciphertext according to the second random ciphertext to obtain the first The plaintext of the second type of data.
  • the first node device 10a1 can perform the first layer data decryption process.
  • the specific implementation process is: the first node device 10a1 reads the corresponding relationship between the public key and the key ciphertext corresponding to the first type of data from the world state metamorphosis.
  • the corresponding relationship may be in the form of a key-value pair list Store it.
  • the first node device 10a matches the corresponding relationship between the public key corresponding to the first type of data and the key ciphertext according to the local public key to obtain the first key ciphertext corresponding to the local private key.
  • the first node device 10a1 decrypts the ciphertext of the first key according to the local private key to obtain the plaintext of the first random key, and decrypts the ciphertext of the first type of data according to the first random ciphertext, And then get the plaintext of the first type of data.
  • the node device of the blockchain system can also share data.
  • a first user can share data for which he has access rights to a second user who does not have access rights, and so on.
  • the data to which the first user has access authority may be data provided by the first user himself or data provided by other users.
  • the process of data sharing is still exemplified below by taking the first node device 10a1 as an example.
  • the first node device 10a1 obtains the first ciphertext of the data to be shared from the blockchain and the first ciphertext of the data to be shared and the key ciphertext corresponding to the data to be shared from the blockchain. ; And perform asymmetric decryption of the key ciphertext according to the local private key to obtain the first symmetric key; wherein the key ciphertext is formed by encrypting the first symmetric key according to the public key corresponding to the local private key ; Afterwards, the first ciphertext is decrypted according to the first symmetric key to obtain the data to be shared.
  • the first node device obtains the second symmetric key, and performs symmetric encryption on the data to be shared according to the second symmetric key to obtain the second ciphertext of the data to be shared; then, according to the second user in the blockchain system Encrypt the second symmetric key with the public key to obtain the ciphertext of the second symmetric key; and write the second ciphertext and the ciphertext of the second symmetric key to the blockchain to share with the second user Data to be shared.
  • the second user refers to the shared party of the data to be shared, and it is the user who has access rights to the data to be shared.
  • the second user can obtain the data to be shared from the blockchain.
  • the second user's access to the data to be shared please refer to the relevant content of the foregoing data decryption embodiment, which will not be repeated here.
  • blockchain system provided by the embodiments of this application can be Ethereum, HyperLedger Fabric, R3 Corda and other blockchain platforms or frameworks, or it can be based on blockchain backend as a service (BAAS) Platform for development.
  • BAAS blockchain backend as a service
  • the data processing logic of the node device 10a can be implemented in a smart contract deployed on the node device 10a.
  • the embodiment of the present application also provides a data encryption and decryption system.
  • Figure 2a is a schematic structural diagram of a data encryption system provided by an embodiment of this application.
  • the data encryption system includes: a smart contract layer 20a and a blockchain storage layer 20b.
  • the data encryption system can be deployed in each node device in the blockchain.
  • the smart contract layer 20a can obtain the data to be processed provided by the first user and obtain the symmetric key. After that, the smart contract layer 20a performs symmetric encryption on the data to be processed according to the symmetric key to obtain the ciphertext of the data to be processed; and performs asymmetric encryption on the symmetric key according to the public key of the second user to obtain the symmetric key Ciphertext. After that, the smart contract layer 20a writes the ciphertext of the data to be processed and the ciphertext of the symmetric key into the blockchain storage layer 20b, so that the second user can access the data to be processed according to his private key. Among them, the public key and the private key of the second user have a one-to-one correspondence.
  • the smart contract layer 20a may randomly generate a symmetric key for the data to be processed in the process of acquiring the data to be processed.
  • the data to be processed all have designated attributes; or, the data to be processed does not have the designated attributes; or, the part of the data to be processed has designated attributes.
  • the smart contract layer 20a randomly generates a symmetric key for the data to be processed, it is specifically used to: identify the first type of data with the specified attributes and not having the first type of data from the data to be processed Specify the second type of data of the attribute; and generate the first random key and the second random key for the first type of data and the second type of data, respectively, where the first random key and the second random key are both symmetric keys key.
  • the smart contract layer 20a encrypts the data to be processed according to the symmetric key
  • it is specifically used to: perform symmetric encryption on the first type of data according to the first random key to obtain the secret of the first type of data. Text; and replace the first type of data in the data to be processed with the ciphertext of the first type of data to obtain the intermediate data; after that, the intermediate data is symmetrically encrypted according to the second random key to obtain the ciphertext of the data to be processed Text.
  • the smart contract layer 20a performs asymmetric encryption on the symmetric key according to the public key of the second user, it is specifically used to: pair the first type of data with the public key of the first type of user who has the right to access the first type of data.
  • the random key is encrypted to obtain the ciphertext of the first random key; and the second random key is encrypted according to the public key of the second type of user who has the authority to access the second type of data to obtain the second random key.
  • the ciphertext of the random key is specifically used to: pair the first type of data with the public key of the first type of user who has the right to access the first type of data.
  • the random key is encrypted to obtain the ciphertext of the first random key
  • the second random key is encrypted according to the public key of the second type of user who has the authority to access the second type of data to obtain the second random key.
  • the ciphertext of the random key is specifically used to: pair the first type of data with the public key of the first type of user who has the right to
  • the blockchain storage layer 20b includes a world state variable 20b1 and a block ledger 20b2.
  • the smart contract layer 20a writes the ciphertext of the data to be processed and the ciphertext of the symmetric key into the blockchain storage layer 20b, it is specifically used to:
  • the first key-value pair formed by the ciphertext and the ciphertext of the first type of data are stored in the world state variable 20b1; and the log corresponding to the first key-value pair and the ciphertext of the first type of data is stored in the block In the ledger 20b2;
  • the second key-value pair formed by the public key of the second type of user and the ciphertext of the second random key and the ciphertext of the data to be processed are stored in the world state variable 20b1; and the second key-value pair
  • the log corresponding to the ciphertext of the data to be processed is stored in the block ledger 20b2.
  • the data encryption system provided in this embodiment can perform symmetric encryption on the data to be processed according to the symmetric key in the smart contract, perform asymmetric encryption on the symmetric key, and write the ciphertext of the data to be processed and the ciphertext of the symmetric key Enter the blockchain.
  • This encryption method that uses a combination of symmetric encryption and asymmetric encryption can improve the efficiency of data encryption processing on the one hand, and on the other hand, it can also help ensure data security.
  • the completion of the encryption processing of the data to be processed in the smart contract can also be fully based on the decentralization and non-tampering characteristics of the blockchain technology.
  • the foregoing embodiment is only a description of the manner in which the smart contract layer 20a encrypts the data to be processed, and does not limit the execution order of each operation. These operations can be executed sequentially or in the order in which they appear in the foregoing embodiment. Parallel execution may also be executed out of the order in which they appear in the above-mentioned embodiments.
  • the following takes the smart contract layer to encrypt the first type of data first, and then encrypts the second type of data as an example to illustrate.
  • the smart contract layer 20a identifies the first type of data with designated attributes and the second type of data without designated attributes from the data to be processed.
  • the smart contract layer 20a performs the first layer encryption on the first type of data.
  • the specific implementation process is: the smart contract layer 20a randomly generates a first random key for the first type of data, where the first random key is a symmetric key.
  • the smart contract layer 20a symmetrically encrypts the first type of data according to the first random key to obtain the ciphertext of the first type of data.
  • the smart contract layer 20a performs asymmetric encryption on the first random key according to the public key of the second user to obtain the ciphertext of the first random key.
  • the second user can asymmetrically decrypt the ciphertext of the first random key according to his private key to obtain the plaintext of the first random key.
  • the ciphertext of the first type of data is symmetrically decrypted according to the first random key, and then the ciphertext of the first type of data is obtained.
  • the second user please refer to the relevant content of the above-mentioned embodiment, which will not be repeated here.
  • the smart contract layer 20a may compose the ciphertext of the public key of the second user and the first random key into a first key-value pair, and store the ciphertext of the first key-value pair and the first type of data in the world state variable , And write the log corresponding to the first key-value pair and the log corresponding to the ciphertext of the first type of data into the block ledger.
  • the smart contract layer 20a can perform a second layer of encryption on the data to be processed.
  • the specific implementation process is: the smart contract layer 20a replaces the first type of data in the to-be-processed data with the ciphertext of the first type of data to obtain intermediate data. Further, the smart contract layer 20a randomly generates a second random key, which is also a symmetric key, and performs symmetric encryption on the intermediate data according to the second random key to obtain the ciphertext of the data to be processed. After that, the smart contract layer 20a performs asymmetric encryption on the second random key according to the private key of the third user to obtain the ciphertext of the second random key.
  • the third user is a user who has access authority to the second type of user.
  • the third user may be the second user, or may be a user other than the second user.
  • the third user please refer to the related content of the foregoing embodiment, which is not repeated here.
  • the smart contract layer 20a can form a second key-value pair with the public key of the third user and the ciphertext of the first random key, and store the second key-value pair and the ciphertext of the data to be processed in the world state variable , And write the log corresponding to the second key-value pair and the log corresponding to the ciphertext of the data to be processed into the block ledger.
  • the embodiment of the present application also provides a data decryption system.
  • the data decryption system includes: a smart contract layer 30a and a blockchain storage layer 30b.
  • the blockchain storage layer 30b includes world state variables 30b1 and a block ledger 30b2.
  • the data encryption system can be deployed in each node device in the blockchain.
  • the blockchain storage layer 30b stores the data ciphertext and the key ciphertext corresponding to the data ciphertext.
  • the smart contract layer 30a is used to obtain the data ciphertext and the key ciphertext corresponding to the data ciphertext from the blockchain storage layer 30b; perform the key ciphertext according to the local private key of the node device to which the smart contract layer 30a belongs Asymmetric decryption to obtain a symmetric key; where the key ciphertext is encrypted according to the public key corresponding to the local private key of the node device to which the smart contract layer 30a belongs; and the data ciphertext is symmetrically performed according to the symmetric key Decrypt and get the data plaintext.
  • the smart contract layer 30a only needs the second layer data decryption process.
  • the specific implementation process please refer to the relevant content of the above embodiment. This will not be repeated here.
  • the smart contract layer 30a can also perform the first layer data decryption process.
  • the specific implementation process please refer to the relevant content of the above-mentioned embodiment. This will not be repeated here.
  • the embodiment of the present application also provides a data sharing system. As shown in FIG. 3c, the first ciphertext of the data to be shared and the key ciphertext corresponding to the first ciphertext are stored in the blockchain storage layer 30b.
  • the smart contract layer 30a can obtain the first ciphertext of the data to be shared and the key ciphertext corresponding to the data to be shared from the blockchain storage layer 30b;
  • the key performs asymmetric decryption on the key ciphertext to obtain the first symmetric key; wherein, the key ciphertext is formed by encrypting the first symmetric key according to the public key corresponding to the private key of the local end.
  • the smart contract layer 30a may decrypt the first ciphertext according to the first symmetric key to obtain the data to be shared.
  • the smart contract layer 30a can obtain the second symmetric key, and perform symmetric encryption on the data to be shared according to the second symmetric key to obtain the second ciphertext of the data to be shared; then, the smart contract layer 30a according to the blockchain system Encrypt the second symmetric key with the public key of the second user in, to obtain the ciphertext of the second symmetric key; and write the second ciphertext and the ciphertext of the second symmetric key into the blockchain to Share the data to be shared with the second user.
  • the second user refers to a user who has access rights to the data to be shared.
  • the second user can obtain the data to be shared from the blockchain.
  • the second user's access to the data to be shared please refer to the relevant content of the foregoing data decryption embodiment, which will not be repeated here.
  • the embodiment of the present application also provides a data encryption method and a data decryption method, which will be exemplified below.
  • FIG. 4 is a schematic flowchart of a data encryption method provided by an embodiment of this application. As shown in Figure 4, the method includes:
  • the second user is a user who has access authority to the data to be processed.
  • step 401 the to-be-processed data provided by the first user is obtained, and the symmetric key is obtained.
  • the first user is the user who provides the data to be processed.
  • step 402 the data to be processed is symmetrically encrypted according to the symmetric key to obtain the ciphertext of the data to be processed.
  • the specific implementation manner of performing symmetric encryption on the data to be processed according to the first symmetric key is not limited.
  • the specific algorithm can refer to the related content of the above-mentioned embodiment, which will not be repeated here.
  • the symmetric encryption method is used to encrypt the data to be processed, especially for data to be processed with a large amount of data, which helps to increase the encryption processing speed of the data to be processed and improve the encryption efficiency.
  • the symmetric key can be asymmetrically encrypted according to the public key of the second user in the blockchain system to obtain the ciphertext of the symmetric key.
  • the second user is a user who has the authority to access the data to be processed.
  • the ciphertext of the data to be processed and the ciphertext of the symmetric key are written into the blockchain. In this way, the second user can access the data to be processed according to his private key.
  • the public key of the second user corresponds to the private key.
  • the symmetric key is encrypted and propagated, which can ensure the security and privacy of the symmetric key, which in turn helps to ensure the security and privacy of the data to be processed.
  • the node device of the second user accesses the aforementioned data to be processed
  • the ciphertext of the data to be processed and the ciphertext of the symmetric key can be obtained from the blockchain, and the ciphertext of the symmetric key can be obtained from the local private key.
  • the text is decrypted asymmetrically to obtain a symmetric key; then, the node device of the second user can decrypt the ciphertext of the data to be processed according to the symmetric key, thereby obtaining the data to be processed.
  • the node device can perform symmetric encryption on the data to be processed on the blockchain according to the symmetric key, perform asymmetric encryption on the symmetric key, and combine the ciphertext and symmetric data of the data to be processed on the blockchain.
  • the ciphertext of the key is written into the blockchain.
  • multiple symmetric keys can be preset in the node device. Accordingly, an optional implementation of step 401 is: randomly obtaining a symmetric key from the multiple preset symmetric keys . Or, in the process of obtaining the data to be processed, a symmetric key randomly generated for the data to be processed can also be used. For the description of the process of acquiring the data to be processed, reference may be made to the relevant content of the foregoing embodiment, which will not be repeated here.
  • the data to be processed may all have specified attributes, some may have specified attributes, or all of them may not have specified attributes.
  • the designated attributes may be different; even in the same application scenario, the identity of the first user is different, the designated attributes may also be different.
  • the specific description please refer to the related content of the above-mentioned embodiment, which will not be repeated here.
  • For all encryption methods with designated attributes and none with designated attributes please refer to the relevant content of the above-mentioned embodiment, which will not be repeated here. The following focuses on the encryption method with the specified attributes of the data to be processed as an example, and exemplifies the description.
  • an optional implementation of step 402 is to identify the first type of data with designated attributes and the first type of data without designated attributes from the data to be processed.
  • Type two data and generate a first random key and a second random key for the first type of data and the second type of data, respectively, where the first random key and the second random key are both symmetric keys.
  • an optional implementation manner of step 402 is: symmetrically encrypt the first type of data according to the first random key to obtain the ciphertext of the first type of data; and combine the first type of data in the data to be processed Replace the ciphertext of the first type of data to obtain the intermediate data; perform symmetric encryption on the intermediate data according to the second random key to obtain the ciphertext of the data to be processed.
  • using the first random key and the second random key to double-encrypt the first type of data in the data to be processed is beneficial to further improve the security and privacy of the first type of data.
  • the first node device separately encrypts the first type of data and the second type of data in the data to be processed, which helps to achieve field-granular data privacy protection.
  • step 403 is: encrypt the first random key according to the public key of the first type of user who has the permission to access the first type of data, and then obtain the ciphertext of the first random key ; And the second random key is encrypted according to the public key of the second type of user who has the authority to access the second type of data to obtain the ciphertext of the second random key.
  • the second type of user may be a user different from the first type of user, and may also include the first type of user.
  • an optional implementation manner of step 404 is: storing the first key-value pair formed by the ciphertext of the public key of the first type of user and the ciphertext of the first random key and the ciphertext of the first type of data in the block In the world state variables of the chain; store the log corresponding to the ciphertext of the first key-value pair and the first type of data in the block ledger of the blockchain; and store the public key of the second type of user and the second random password
  • the second key-value pair formed by the ciphertext of the key and the ciphertext of the data to be processed are stored in the world state variable of the blockchain; and the log corresponding to the second key-value pair and the ciphertext of the data to be processed is stored in the block In the block ledger of the chain.
  • the embodiment of the present application also provides a computer-readable storage medium storing computer instructions.
  • the computer instructions are executed by one or more processors, the one or more processors are caused to execute the data encryption method described above. step.
  • the above embodiment is only a description of the encryption processing method for the data to be processed, and does not limit the execution order of each operation. These operations can be executed sequentially or in parallel according to the order in which they appear in the above embodiment, or not They are executed in the order in which they appear in the above-mentioned embodiments.
  • the following is an example of encrypting the first type of data and then encrypting the second type of data.
  • FIG. 5 is a schematic flowchart of another data encryption method provided by an embodiment of the application. As shown in Figure 5, the method includes:
  • Acquire data to be processed provided by a first user, where the data to be processed includes data of a first type with designated attributes and data of a second type without the designated attributes.
  • the second user refers to a user who has access rights to the first type of data
  • the third user refers to a user who has access rights to the second type of data
  • the third user and the second user may be the same user or different users.
  • double encryption is used for the first type of data, which is beneficial to further improve the security and privacy of the first type of data.
  • encrypting the first type of data and the second type of data in the data to be processed is helpful to achieve field-granular data privacy protection.
  • adopting an encryption method that combines symmetric encryption and asymmetric encryption can not only improve the efficiency of data encryption processing, but also help ensure data security.
  • the embodiment of the present application also provides a computer-readable storage medium storing computer instructions.
  • the computer instructions are executed by one or more processors, the one or more processors are caused to execute the data encryption method described above. step.
  • FIG. 6 is a schematic flowchart of a data decryption method provided by an embodiment of the application. As shown in Figure 6, the method includes:
  • the data ciphertext may be the ciphertext of the first type of data with designated attributes, or the ciphertext of the second type of data without designated attributes.
  • the data decryption method provided in this embodiment corresponds to the data encryption method in FIG. 4. Since the data to be accessed is encrypted using a combination of symmetric encryption and asymmetric encryption, the asymmetric decryption method is adopted in this embodiment.
  • the key ciphertext is decrypted asymmetrically, and the data ciphertext is decrypted symmetrically according to the plaintext of the key ciphertext, and then the data plaintext is obtained, which helps to improve the efficiency of data decryption.
  • an optional implementation of step 601 is: receiving an access instruction issued by the first user, and the access designation carries an identifier of the data to be accessed; the data to be accessed can be obtained from the blockchain. Identify the corresponding data ciphertext and the corresponding relationship between the public key and the key ciphertext corresponding to the data ciphertext; match the local public key in the corresponding relationship between the public key and the key ciphertext to obtain The key ciphertext corresponding to the data ciphertext.
  • the method shown in FIG. 6 can be used to decrypt the data.
  • the identification of the first type of data with the specified attribute and the identification of the second type of data without the specified attribute can also be identified from the identification of the data to be accessed;
  • the corresponding relationship between the public key and the key ciphertext corresponding to the first type of data and the second type of data is obtained from the world state variables of the blockchain.
  • the local public key is matched in the correspondence between the public key corresponding to the second type of data and the key ciphertext to obtain the second symmetric key.
  • the ciphertext of the data can be decrypted according to the second symmetric key to obtain the plaintext of the second type of data and the ciphertext of the first type of data.
  • the local public key can be matched in the corresponding relationship between the public key corresponding to the first type of data and the key ciphertext to obtain the first symmetric key. Further, the ciphertext of the first type of data can be decrypted according to the first symmetric key to obtain the plaintext of the first type of data.
  • the embodiment of the present application also provides a computer-readable storage medium storing computer instructions.
  • the computer instructions are executed by one or more processors, the one or more processors are caused to execute the data decryption method described above. step.
  • FIG. 7a is a schematic flowchart of a data sharing method provided by an embodiment of this application. As shown in Figure 7a, the method includes:
  • the second user refers to the shared party of the data to be shared, and is a user who has access rights to the data to be shared.
  • the relevant content in the data decryption embodiment of the above embodiment please refer to the relevant content in the data decryption embodiment of the above embodiment.
  • the encryption processing of the data to be shared in steps 704-706 please refer to the relevant content of the data encryption embodiment in the above-mentioned embodiment, which will not be repeated here.
  • the second user can obtain the data to be shared from the blockchain.
  • the second user's access to the data to be shared please refer to the relevant content of the foregoing data decryption embodiment, which will not be repeated here.
  • an embodiment of the present application also provides a computer-readable storage medium storing computer instructions, which when the computer instructions are executed by one or more processors, cause the one or more processors to perform the aforementioned data sharing Steps in the method.
  • the execution subject of each step of the method provided in the foregoing embodiment may be the same device, or different devices may also be the execution subject of the method.
  • the execution subject of steps 401 and 402 may be device A; for another example, the execution subject of step 401 may be device A, and the execution subject of step 402 may be device B; and so on.
  • the data processing method provided in the embodiments of the present application can be applied to various blockchain application scenarios. For example, it can be applied to the financial field, logistics field, public service field, public welfare field, etc., but it is not limited to this.
  • the following takes the field of financial trade as an example to illustrate the data processing method provided in the embodiment of the present application.
  • Fig. 7b is a schematic structural diagram of a trade blockchain system provided by an embodiment of the application.
  • the trade blockchain system may include: a buyer-side device 70a, a seller-side device 70b, and a third-party device 70c.
  • the third party may be at least one of a freight company and a regulatory authority.
  • the third-party equipment may include: freight-side equipment and/or supervision-side equipment.
  • the freight company may be: a shipping company, a land transportation company, a freight forwarding company, etc., but it is not limited to this.
  • the supervision department can be: customs, tax bureau, etc.
  • These direct participants form a blockchain.
  • the participants of the trade block chain shown in FIG. 7b are only exemplary and do not constitute a limitation.
  • the trade blockchain system may also include other non-direct participants.
  • the data processing method provided in the embodiments of the present application can be applied to every link in the transaction process. Take the process of cargo transportation between the buyer and the seller as an example for illustration.
  • the transaction amount, quantity of goods, buyer address and other information are directly related to the interests of the buyer and seller, and can only be known to the buyer and seller. Furthermore, buyers and sellers can designate these attributes as designated attributes. Among them, the transaction data between buyers and sellers other than those with specified attributes can only be accessed by direct participants. Based on this, for the buyer-side device 70a or the seller-side device 70b, transaction data to be processed can be obtained.
  • the transaction data includes first-type data with designated attributes and second-type data without designated attributes. Among them, the first type of data can also be referred to as sensitive information, and the second type of data can also be referred to as basic transaction information.
  • the buyer-side device 70a or the seller-side device 70b can identify the first type of data (sensitive information) with specified attributes and the second type of data (basic transaction information) without the specified attributes from the transaction data. Further, the buyer-side device 70a or the seller-side device 70b can symmetrically encrypt the first type of data according to the first symmetric key to obtain the ciphertext of the first type of data; and encrypt the first random encryption according to the public key of the other party of the transaction. The key performs asymmetric encryption to obtain the ciphertext of the first symmetric key.
  • the other party of the transaction is the seller; for the seller, the other party of the transaction is the buyer.
  • the buyer-side buyer-side device 70a or the seller-side device 70b may randomly generate the first symmetric key for the first type of data. Further, the buyer-side device 70a or the seller-side device 70b may write the ciphertext of the first type of data and the ciphertext of the first symmetric key into the trade blockchain.
  • the device of the other party of the transaction can obtain the ciphertext of the first type of data and the ciphertext of the first symmetric key from the trade blockchain, and according to the local private
  • the key performs asymmetric decryption on the ciphertext of the first symmetric key to obtain the plaintext of the first symmetric key; and uses the first symmetric key to symmetrically decrypt the ciphertext of the first type of data to obtain the plaintext of the first type of data .
  • the third-party device since the local private key of the third-party device cannot decrypt the ciphertext of the first symmetric key, the first symmetric key cannot be obtained, and the first type of data cannot be accessed.
  • the buyer-side device 70a or the seller-side device 70b may combine the public key of the other party in the transaction and the ciphertext of the first symmetric key to form a first key-value pair, and combine the ciphertext of the first type of data with the first key-value pair.
  • a key-value pair is written into the blockchain system.
  • the device of the other party of the transaction can obtain the ciphertext of the first symmetric key according to the local public key, and perform asymmetric decryption on the ciphertext of the first symmetric key according to the local private key to obtain the first symmetric key
  • the device of the other party in the transaction can symmetrically decrypt the ciphertext of the first type of data according to the first symmetric key to obtain the first type of data.
  • the buyer and seller because they cannot know the private key of the other party in the transaction, they cannot decrypt the ciphertext of the first symmetric key, and thus cannot access the first symmetric key.
  • One type of data One type of data.
  • the first type of data in the transaction data may be replaced with the ciphertext of the first type of data to obtain intermediate data.
  • the buyer-side device 70a or the seller-side device 70b may also randomly generate the second symmetric key.
  • the buyer-side device 70a or the seller-side device 70b can also perform asymmetric encryption on the second symmetric key according to the public keys of the direct participants (the other party of the transaction and the third party) in the trade blockchain system, respectively, to obtain The ciphertext of the second symmetric key.
  • the buyer’s side device 70a or the seller’s side device 70b can also write the ciphertext of the intermediate data and the ciphertext of the second symmetric key into the trade blockchain, so that the other party and the third party of the transaction can use their private keys respectively. Access the second type of data.
  • the device of the other party of the transaction can obtain the ciphertext of the intermediate data and the ciphertext of the second symmetric key from the trade blockchain;
  • the private key performs asymmetric decryption on the ciphertext of the ciphertext of the second symmetric key to obtain the plaintext of the second symmetric key; and symmetrically decrypts the ciphertext of the intermediate data according to the second symmetric key to obtain the second The plain text of the class data and the cipher text of the first class data.
  • the buyer-side device 70a or the seller-side device 70b may respectively perform asymmetric encryption on the second symmetric key according to the public keys of the direct participants (the other party of the transaction and the third party) in the trade blockchain system. Obtain the ciphertext of multiple second symmetric keys. Further, the buyer-side device 70a or the seller-side device 70b may form multiple second key-value pairs with the public key of the direct participant and the ciphertext of multiple second symmetric keys, and combine the ciphertext of the intermediate data with multiple ciphertexts. The second key-value pair is written into the blockchain.
  • the ciphertext of the second symmetric key to which the public key is paired can be matched in a plurality of second key-value pairs according to its public key.
  • the ciphertext of the second symmetric key can be asymmetrically decrypted according to the private key of the local end to obtain the plaintext of the second symmetric key, and then, according to the second symmetric key pair
  • the ciphertext of the intermediate data is symmetrically decrypted to obtain the plaintext of the second type of data.
  • the links may involve land transport logistics companies, shipping logistics companies, customs, tax bureaus and other participants.
  • Sensitive information may be different for the parties involved in each transportation link.
  • the personal information of a freight driver (driver's license number, ID number, contact information, etc.) may be sensitive information, so it can only be known by the land transportation logistics company. Therefore, when the land transport logistics company writes the transaction data, it can use the personal information of the freight driver as the first type of data and so on.
  • data processing by the participants involved in each transport link please refer to the relevant content of the above-mentioned embodiment, which will not be repeated here.
  • FIG. 8 is a schematic structural diagram of a computer device provided by an embodiment of this application. As shown in Fig. 8, the computer device includes: a memory 80a and a processor 80b. Among them, the memory 80a is used to store computer programs.
  • the processor 80b is coupled to the memory 80a, and is used to execute a computer program for: obtaining the data to be processed and the symmetric key; wherein the data to be processed is provided by the first user; and the processing is based on the symmetric key.
  • the processed data is symmetrically encrypted to obtain the ciphertext of the data to be processed;
  • the symmetric key is asymmetrically encrypted according to the public key of the second user to obtain the ciphertext of the symmetric key; and the ciphertext of the data to be processed and the symmetric
  • the ciphertext of the key is written into the blockchain for the second user to access the data to be processed according to his private key.
  • the processor 80b when the processor 80b obtains the symmetric key, it is specifically configured to: in the process of obtaining the data to be processed, randomly generate the symmetric key for the data to be processed.
  • the data to be processed all have designated attributes; or, the data to be processed does not have designated attributes; or, the part of the data to be processed has designated attributes.
  • the processor 80b randomly generates a symmetric key for the data to be processed, it is specifically configured to: identify the first type of data with the designated attribute and the data from the data to be processed.
  • the second type of data with specified attributes; and the first random key and the second random key are respectively generated for the first type of data and the second type of data, where the first random key and the second random key are symmetric keys key.
  • the processor 80b when the processor 80b encrypts the data to be processed according to the symmetric key, it is specifically configured to: symmetrically encrypt the first type of data according to the first random key to obtain the ciphertext of the first type of data; The first type of data in the processed data is replaced with the ciphertext of the first type of data to obtain intermediate data; and the intermediate data is symmetrically encrypted according to the second random key to obtain the ciphertext of the data to be processed.
  • the processor 80b when the processor 80b performs asymmetric encryption on the symmetric key according to the public key of the second user, it is specifically configured to: encrypt the first random key according to the public key of the first type of user who has the right to access the first type of data.
  • the key is encrypted to obtain the ciphertext of the first random key; and the second random key is encrypted according to the public key of the second type of user who has the authority to access the second type of data to obtain the second random key.
  • the ciphertext of the key when the processor 80b performs asymmetric encryption on the symmetric key according to the public key of the second user, it is specifically configured to: encrypt the first random key according to the public key of the first type of user who has the right to access the first type of data.
  • the key is encrypted to obtain the ciphertext of the first random key
  • the second random key is encrypted according to the public key of the second type of user who has the authority to access the second type of data to obtain the second random key.
  • the processor 80b when the processor 80b writes the ciphertext of the data to be processed and the ciphertext of the symmetric key into the blockchain, it is specifically used to: form the ciphertext of the public key of the first type of user and the first random key
  • the first key-value pair and the ciphertext of the first type of data are stored in the world state variable of the blockchain; and the log corresponding to the first key-value pair and the ciphertext of the first type of data is stored in the area of the blockchain In the block ledger; and the second key-value pair formed by the public key of the second type of user and the ciphertext of the second random key and the ciphertext of the data to be processed are stored in the world state variable of the blockchain;
  • the log corresponding to the two key-value pairs and the ciphertext of the data to be processed is stored in the block ledger of the blockchain.
  • the node device may further include optional components such as a communication component 80c, a power supply component 80d, a display screen 80e, and an audio component 80f. Only some of the components are schematically shown in FIG. 8, which does not mean that the computer device must include all the components shown in FIG. 8, nor does it mean that the computer device can only include the components shown in FIG. 8.
  • the computer device provided in this embodiment can perform symmetric encryption on the data to be processed based on the symmetric key on the blockchain, perform asymmetric encryption on the symmetric key, and write the ciphertext of the data to be processed and the ciphertext of the symmetric key Enter the blockchain.
  • This encryption method that uses a combination of symmetric encryption and asymmetric encryption can improve the efficiency of data encryption processing on the one hand, and on the other hand, it can also help ensure data security.
  • FIG. 9 is a schematic structural diagram of another computer device provided by an embodiment of this application.
  • the computer device includes a memory 90a and a processor 90b.
  • the memory 90a is used to store computer programs.
  • the processor 90b is coupled to the memory 90a, and is used to execute a computer program for: obtaining the data ciphertext and the key ciphertext corresponding to the data ciphertext from the accessible blockchain;
  • the key performs asymmetric decryption on the key ciphertext to obtain a symmetric key; among them, the key ciphertext is encrypted according to the public key corresponding to the local private key; the data ciphertext is decrypted symmetrically according to the symmetric key to obtain Data in plain text.
  • the processor 90b when the processor 90b obtains the data ciphertext and the key ciphertext corresponding to the data ciphertext from the accessible blockchain, it is specifically configured to: according to the data to be accessed in the access instruction issued by the user The identification of the data ciphertext and the correspondence between the public key corresponding to the data ciphertext and the key ciphertext are obtained from the blockchain; and the public key corresponding to the local private key is in the public key corresponding to the data ciphertext and The corresponding relationship between the key ciphertexts is matched to obtain the key ciphertext corresponding to the data ciphertext.
  • the data to be accessed all have designated attributes; or, none of the data to be accessed has designated attributes; or, the part of the data to be accessed has designated attributes.
  • the processor 90b obtains the data ciphertext and the correspondence between the public key corresponding to the data ciphertext and the key ciphertext from the blockchain, it is specifically used to: Identify the identification of the first type of data with the specified attribute and the identification of the second type of data without the specified attribute from the identification of the data to be accessed; and according to the identification of the first type of data and the identification of the second type of data, from the district
  • the corresponding relationship between the public key and the key ciphertext corresponding to the first type of data and the second type of data is obtained from the world state variables of the block chain.
  • the processor 90b matches the public key corresponding to the local private key with the corresponding relationship between the public key corresponding to the data to be processed and the key ciphertext, it is specifically configured to: match the public key corresponding to the local private key.
  • the key is matched with the corresponding relationship between the public key and the key ciphertext corresponding to the first type of data and the second type of data, respectively, to obtain the first key ciphertext corresponding to the first type of data and the corresponding relationship between the second type of data The ciphertext of the second key.
  • the processor 90b when the processor 90b performs asymmetric decryption of the key ciphertext according to the local private key, it is specifically configured to: perform the non-discrimination of the first key ciphertext and the second key ciphertext respectively according to the local private key pair. Symmetric decryption to obtain the first symmetric key and the second symmetric key.
  • the processor 90b uses the symmetric key to symmetrically decrypt the data ciphertext, it is specifically configured to: decrypt the data ciphertext according to the second symmetric key to obtain the plaintext of the second type of data and the first type of data. Ciphertext; and decrypt the ciphertext of the first type of data according to the first symmetric key to obtain the plaintext of the first type of data.
  • the node device may further include optional components such as a communication component 90c, a power supply component 90d, a display screen 90e, and an audio component 90f. Only some components are schematically shown in FIG. 9, which does not mean that the computer device must include all the components shown in FIG. 9, nor does it mean that the computer device can only include the components shown in FIG. 9.
  • the key ciphertext of the asymmetric decryption method can be used, and the data ciphertext can be decrypted by the symmetric decryption method, which is helpful Improve the efficiency of data decryption.
  • FIG. 10 is a schematic structural diagram of another computer device provided by an embodiment of this application.
  • the computer device includes: a memory 100a and a processor 100b.
  • the memory 100a is used to store a computer program.
  • the processor 100b is coupled to the memory 100a, and is configured to execute a computer program for: acquiring the data to be processed provided by the first user.
  • the data to be processed includes data of the first type with designated attributes and data without designated attributes.
  • the first type of data in the data is replaced with the ciphertext of the first type of data to obtain intermediate data; the intermediate data is symmetrically encrypted according to the second symmetric key, and the second symmetric key is decrypted according to the public key of the third user.
  • Symmetric encryption to obtain the ciphertext of the intermediate data and the ciphertext of the second symmetric key; write the ciphertext of the intermediate data and the ciphertext of the second symmetric key to the blockchain for the third user to use its private key Access the second type of data.
  • the second user and the third user are the same user.
  • the node device may further include optional components such as a communication component 100c, a power supply component 100d, a display screen 100e, and an audio component 100f. Only some components are schematically shown in FIG. 10, which does not mean that the computer device must include all the components shown in FIG. 10, nor does it mean that the computer device can only include the components shown in FIG.
  • the computer device provided in this embodiment can use double encryption for the first type of data, which is beneficial to further improve the security and privacy of the first type of data.
  • encrypting the first type of data and the second type of data in the data to be processed is helpful to achieve field-granular data privacy protection.
  • adopting an encryption method that combines symmetric encryption and asymmetric encryption can not only improve the efficiency of data encryption processing, but also help ensure data security.
  • FIG. 11 is a schematic structural diagram of another computer device provided by an embodiment of this application.
  • the computer device includes: a memory 110a and a processor 110b.
  • the memory 110a is used to store computer programs.
  • the processor 110b is coupled to the memory 110a, and is used to execute a computer program for: obtaining the first ciphertext of the data to be shared and the key ciphertext corresponding to the data to be shared from the accessible blockchain ; Asymmetrically decrypt the key cipher text according to the local private key to obtain the first symmetric key; the key cipher text is formed by encrypting the first symmetric key according to the public key corresponding to the local private key; A symmetric key decrypts the first ciphertext to obtain the data to be shared; obtains the second symmetric key, and symmetrically encrypts the data to be shared according to the second symmetric key to obtain the second ciphertext of the data to be shared ; Encrypt the second symmetric key according to the public key of the second user to obtain the cipher text of the second symmetric key; write the second cipher text and the cipher text of the second symmetric key to the blockchain to be compared with The second user shares the data to be shared.
  • the node device may further include optional components such as a communication component 110c, a power supply component 110d, a display screen 110e, and an audio component 110f. Only part of the components are schematically shown in FIG. 11, which does not mean that the computer device must include all the components shown in FIG. 11, nor does it mean that the computer device can only include the components shown in FIG.
  • the computer equipment provided in this embodiment can use a combination of symmetric encryption and asymmetric encryption to encrypt data to be shared on the blockchain. On the one hand, it can improve the efficiency of data encryption processing, and on the other hand, it is also beneficial to Ensure the security of shared data.
  • the memory is used to store a computer program, and can be configured to store other various data to support operations on the node device.
  • the processor can execute the computer program stored in the memory to realize the corresponding control logic.
  • the memory can be implemented by any type of volatile or non-volatile storage devices or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable and programmable Read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable and programmable Read only memory
  • PROM programmable read only memory
  • ROM read only memory
  • magnetic memory flash memory
  • flash memory magnetic disk or optical disk.
  • the communication component is configured to facilitate wired or wireless communication between the node device and other devices.
  • Node devices can access wireless networks based on communication standards, such as WiFi, 2G or 3G, 4G, 5G or a combination of them.
  • the communication component receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel.
  • the communication component may also be based on near field communication (NFC) technology, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology Or other technologies to achieve.
  • NFC near field communication
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • the display screen may include a liquid crystal display (LCD) and a touch panel (TP). If the display screen includes a touch panel, the display screen may be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touch, sliding, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure related to the touch or slide operation.
  • the power supply component is configured to provide power to various components of the node device.
  • the power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device where the power supply component is located.
  • the audio component may be configured to output and/or input audio signals.
  • the audio component includes a microphone (MIC).
  • the microphone When the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals.
  • the received audio signal can be further stored in a memory or sent via a communication component.
  • the audio component further includes a speaker for outputting audio signals. For example, for computer equipment with language interaction functions, voice interaction with users can be realized through audio components.
  • the second users are all other users relative to the first user, and the second symmetric keys are all other symmetric keys relative to the first symmetric key; "First”, “Second”, and “Third” are only used to distinguish two different users or different keys, and are not enough for other restrictions.
  • the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM).
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供一种数据加密、解密和共享方法、设备、系统及存储介质。在本申请实施例中，在区块链上根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据的安全性。

Description

数据加密、解密和共享方法、设备、系统及存储介质
本申请要求2019年11月06日递交的申请号为201911077124.9、发明名称为“数据加密、解密和共享方法、设备、系统及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据处理技术领域，尤其涉及一种数据加密、解密和共享方法、设备、系统及存储介质。
背景技术
区块链(Blockchain)是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式。其中，区块链具有开放性、不可篡改、分布式共享全局账本等优点，但同时这些特性也带来数据泄露问题，严重影响了区块链技术在许多业务场景中的应用。因此，如何保障区块链中数据的安全性和隐私性已成为亟待解决的问题。
发明内容
本申请的多个方面提供一种数据加密、解密和共享方法、设备、系统及存储介质，用以提高数据的安全性和隐私性。
本申请实施例提供一种数据加密方法，包括：
获取待处理数据和对称密钥，所述待处理数据是由第一用户提供的；
根据所述对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；
根据第二用户的公钥对所述对称密钥进行非对称加密，以得到所述对称密钥的密文；
将所述待处理数据的密文和所述对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述待处理数据。
本申请实施例还提供一种数据解密方法，包括：
从可访问的区块链中获取数据密文和所述数据密文对应的密钥密文；
根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；
根据所述对称密钥对所述数据密文进行对称解密，得到数据明文。
本申请实施例还提供一种数据共享方法，包括：
从可访问的区块链中获取待共享数据的第一密文和所述待共享数据对应的密钥密文；
根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；
根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；
获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；
根据第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；
将所述第二密文和所述第二对称密钥的密文写入所述区块链，以与所述第二用户共享所述待共享数据。
本申请实施例还提供一种数据加密方法，包括：
获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；
根据第一对称密钥对所述第一类数据进行对称加密，并根据第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；
将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述第一类数据；
将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；
根据第二对称密钥对所述中间数据进行对称加密，并根据第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；
将所述中间数据的密文和所述第二对称密钥的密文写入区块链，以供所述第三用户根据其私钥访问所述第二类数据。
本申请实施例还提供一种计算机设备，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
所述处理器耦合至所述存储器，用于执行所述计算机程序以用于：
获取待处理数据和对称密钥；所述待处理数据是由第一用户提供的
根据所述对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；
根据第二用户的公钥对所述对称密钥进行非对称加密，以得到所述对称密钥的密文；
将所述待处理数据的密文和所述对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述待处理数据。
本申请实施例还提供一种计算机设备，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
所述处理器耦合至所述存储器，用于执行所述计算机程序以用于：
从可访问的区块链中获取数据密文和所述数据密文对应的密钥密文；
根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；
根据所述对称密钥对所述数据密文进行对称解密，得到数据明文。
本申请实施例还提供一种计算机设备，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
从可访问的区块链中获取待共享数据的第一密文和所述待共享数据对应的密钥密文；
根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；
根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；
获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；
根据第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；
将所述第二密文和所述第二对称密钥的密文写入所述区块链，以与所述第二用户共享所述待共享数据。
本申请实施例还提供一种计算机设备，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；
根据第一对称密钥对所述第一类数据进行对称加密，并根据第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；
将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用 户根据其私钥访问所述第一类数据；
将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；
根据第二对称密钥对所述中间数据进行对称加密，并根据第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；
将所述中间数据的密文和所述第二对称密钥的密文写入区块链，以供所述第三用户根据其私钥访问所述第二类数据。
本申请实施例还提供一种区块链系统，包括：多台节点设备，其中，所述节点设备，用于：获取第一用户提供的待处理数据和第一对称密钥；根据所述第一对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；根据所述区块链系统中的第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一对称密钥的密文；以及将所述待处理数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述待处理数据。
在一些实施例中，所述节点设备，还用于：从所述区块链中获取数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到第二对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；根据所述第二对称密钥对所述数据密文进行对称解密，得到数据明文。
本申请实施例还提供一种区块链系统，包括：多台节点设备，其中，所述节点设备，用于：从区块链中获取待共享数据的第一密文和所述待共享数据对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；根据所述区块链系统中的第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；以及将所述第二密文和所述第二对称密钥的密文写入所述区块链，以与所述第二用户共享所述待共享数据。
在一些实施例中，所述节点设备，还用于：从所述区块链中获取数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到第三对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；根据所述第三对称密钥对所述数据密文进行对称解密，得到数据明文。
本申请实施例还提供一种区块链系统，包括：多台节点设备，其中，所述节点设备， 用于：获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；根据第一对称密钥对所述第一类数据进行对称加密，并根据所述区块链系统中的第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述第一类数据；将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；根据第二对称密钥对所述中间数据进行对称加密，并根据所述区块链系统中的第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；将所述中间数据的密文和所述第二对称密钥的密文写入区块链，以供所述第三用户根据其私钥访问所述第二类数据。
在一些实施例中，所述节点设备，还用于：从所述区块链中获取数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到第三对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；根据所述第三对称密钥对所述数据密文进行对称解密，得到数据明文。
本申请实施例还提供一种数据加密系统，包括：智能合约层和区块链存储层；
其中，所述智能合约层，用于获取第一用户提供的待处理数据和对称密钥；根据所述对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；以及根据第二用户的公钥对所述对称密钥进行非对称加密，以得到所述对称密钥的密文；并将所述待处理数据的密文和所述对称密钥的密文写入所述存储层，以供所述第二用户根据其私钥访问所述待处理数据。
本申请实施例还提供一种数据解密系统，包括：智能合约层和区块链存储层；所述区块链存储层，用于存储数据密文和所述数据密文对应的密钥密文；
所述智能合约层，用于从所述区块链存储层中获取所述数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；以及根据所述对称密钥对所述数据密文进行对称解密，得到数据明文。
本申请实施例还提供一种数据共享系统，包括：智能合约层和区块链存储层；其中，所述区块链存储层，用于存储待共享数据的第一密文和所述待共享数据对应的密钥密文；
所述智能合约层，用于从所述区块链存储层中获取所述第一密文和所述密钥密文；根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是 根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；根据第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；以及将所述第二密文和所述第二对称密钥的密文写入所述区块链存储层，以与所述第二用户共享所述待共享数据。
本申请实施例还提供一种数据加密系统，包括：智能合约层和区块链存储层；
其中，所述智能合约层，用于获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；根据第一对称密钥对所述第一类数据进行对称加密，并根据第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；将所述第一类数据的密文和所述第一对称密钥的密文写入所述区块链存储层，以供所述第二用户根据其私钥访问所述第一类数据；以及将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；根据第二对称密钥对所述中间数据进行对称加密，并根据第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；并将所述中间数据的密文和所述第二对称密钥的密文写入所述区块链存储层，以供所述第三用户根据其私钥访问所述第二类数据。
本申请实施例还提供一种贸易区块链系统，包括：买家侧设备、卖家侧设备以及第三方设备；
所述买家侧设备或所述卖家侧设备，用于：获取待处理的交易数据；所述交易数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；根据第一对称密钥对所述第一类数据进行对称加密，并根据交易的另一方的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；以及将所述第一类数据的密文和所述第一对称密钥的密文写入贸易区块链，以供所述交易的另一方根据其私钥访问所述第一类数据；并将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；根据第二对称密钥对所述中间数据进行对称加密，并根据所述交易的另一方和所述第三方设备对应的第三方的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；将所述中间数据的密文和所述第二对称密钥的密文写入所述贸易区块链，以供所述交易的另一方和所述第三方分别根据其私钥访问所述第二类数据。
本申请实施例还提供一种存储有计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行上述各方法中的步骤。
在本申请实施例中，在区块链上根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据的安全性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1a-图1c为本申请实施例提供的区块链系统的结构示意图；
图2a和图2b为本申请实施例提供的数据加密系统的结构示意图；
图3a和图3b为本申请实施例提供的数据解密系统的结构示意图；
图3c为本申请实施例提供的数据共享系统的结构示意图；
图4为本申请实施例提供的一种数据加密方法的流程示意图；
图5为本申请实施例提供的另一种数据加密方法的流程示意图；
图6为本申请实施例提供的一种数据解密方法的流程示意图；
图7a为本申请实施例提供的一种数据共享方法的流程示意图；
图7b为本申请实施例提供的一种贸易区块链系统的结构示意图；
图8-图11为本申请实施例提供的计算机设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
针对现有区块链中数据缺乏的安全性和隐私性的技术问题，在本申请一些实施例中，在区块链上根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据 的安全性。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1a为本申请实施例提供的一种区块链系统的结构示意图。如图1a所示，该区块链系统包括：多台节点设备10a。在本申请实施例中，多台是指2台或2台以上。在本实施例中，多台节点设备10a组成一个区块链系统，各节点设备10a之间可实现数据共享。
在本实施例中，多台节点设备10a之间可以是有线或无线连接。可选地，多台节点设备10a之间可以通过移动网络通信连接，相应地，移动网络的网络制式可以为2G(GSM)、2.5G(GPRS)、3G(WCDMA、TD-SCDMA、CDMA2000、UTMS)、4G(LTE)、4G+(LTE+)、5G、WiMax等中的任意一种。可选地，多台节点设备10a之间也可以通过蓝牙、WiFi、红外线等方式通信连接。
在本实施例中，节点设备10a是指具有计算、存储、通信等功能的计算机设备。节点设备10a可以为单一服务器设备，也可以云化的服务器阵列，或者为云化的服务器阵列中运行的虚拟机(Virtual Machine，VM)或容器。另外，节点设备10a也可以指具备相应数据处理和存储能力的其他计算设备，例如智能手机、平板电脑、个人电脑、穿戴设备等终端设备(运行数据处理程序)等。
在本实施例中，每台节点设备10a均可以执行相应的数据处理逻辑。下面以第一节点设备10a1为例进行示例性说明。其中，第一节点设备10a1均为区块链系统中的任一用户，并将第一节点设备10a1的操作用户定义为第一用户。
在本实施例中，第一节点设备10a1可获取第一用户提供的待处理数据，并获取第一对称密钥。其中，第一用户为第一节点设备10a1的操作用户，即待处理数据的提供方。进一步，第一节点设备10a1根据第一对称密钥对待处理数据进行对称加密，得到待处理数据的密文。在本实施例中，对第一节点设备10a1根据第一对称密钥对待处理数据进行对称加密的具体实施方式不进行限定。可选地，第一节点设备10a1可采用DES、3DES、IDEA、RC5、RC6等加密算法对待处理数据进行对称加密，但不限于此。其中，采用的对称加密算法不同，根据第一对称密钥对待处理数据进行对称加密的具体实施方式不同。在本实施例中，采用对称加密方式对待处理数据进行加密，尤其对于数据量较大的待处理数据，有助于提高对待处理数据的加密处理速度，提高加密效率。
之后，第一节点设备10a1根据区块链系统中的第二用户的公钥对第一对称密钥进行非对称加密，得到第一对称密钥的密文。其中，第二用户为具有访问待处理数据的权限 的用户。第二用户位于第一节点设备10a1所在的区块链系统中，且具有访问待处理数据的权限的用户。进一步，第二用户的数量可以为1个或多个。多个是指2个或2个以上。若第二用户的数量为多个，则第一节点设备10a1可根据这多个第二用户的公钥对第一对称密钥分别进行非对称加密，这样，每个第二用户均可根据其各自的私钥对第一对称密钥的密文进行非对称解密。
在本实施例中，对第一节点设备10a1对第一对称密钥进行非对称加密的具体实施方式不进行限定。可选地，第一节点设备10a1可RSA、Elgamal、背包算法、Rabin、D-H、ECC(椭圆曲线加密算法)等算法对第一对称密钥进行非对称加密，但不限于此。相应地，采用的非对称加密算法不同，根据第二用户的公钥对待处理数据进行对称加密的具体实施方式不同。
进一步，第一节点设备10a1将待处理数据的密文和第一对称密钥的密文写入区块链中。这样，第二用户便可根据其私钥访问待处理数据。其中，第二用户的公钥和私钥相对应。在本实施例中，第一对称密钥是加密传播的，可保障第一对称密钥的安全性和隐私性，进而有助于保障待处理数据的安全性和隐私性。
相应地，第二用户的第二节点设备10a2在访问上述待处理数据时，可从区块链中获取待处理数据的密文和第一对称密钥的密文，并根据本端私钥对第一对称密钥的密文进行非对称解密，得到第一对称密钥；之后，第二用户的节点设备可根据第一对称密钥对待处理数据的密文进行解密，从而获取待处理数据。
在本实施例提供的区块链系统中，节点设备可在区块链上根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据的安全性。
可选地，第一对称密钥可以是第一节点设备10a1从预设的多个对称密钥中随机获取的，也可以是第一节点设备10a1在获取待处理数据的过程中，为待处理数据随机生成的对称密钥。其中，在获取待处理数据的过程中可以理解为：在获取待处理数据时，在获取待处理数据之后，或者，在获取待处理数据的进程中，等等，但不限于此。在本申请实施例中，不限定第一节点设备10a1随机生成第一对称密钥的具体实施方式。例如，可预设对称密钥的生成规则，第一节点设备10a1可根据预设的生成规则，随机生成第一对称密钥。其中，预设的生成规则，可以为生成的对称密钥的位数、生成的对称密钥包含的字符类型等等，但不限于此。例如，预设的生成规则，可以为生成的对称密钥为6位 数，并需要包含字母和数字两种字符等等，但不限于此。
进一步，在一些实施例中，对于待处理数据来说，第一用户可能想对其提供的待处理数据的访问用户进行区分。对于待处理数据中的部分数据，第一用户只想供指定的用户访问；剩余部分数据供另一部分用户访问等等。例如，在一些商务贸易的应用场景中，买家、卖家、货运公司、海关、税局等多方可形成一个区块链系统。在该区块链系统中，买卖双方提供的待处理数据中的敏感信息(例如交易金额、数量、买卖双方的地址信息等)只供买卖双方访问，其余非敏感信息可供区块链中的所有用户访问。
在该实施例中，待处理数据可包含具有指定属性的数据。对于具有指定属性的数据来说，仅可供区块链系统中的部分用户访问。在本申请实施例中，待处理数据可均具有指定属性，也可部分具有指定属性，也可全不具有指定属性。在本申请实施例中，在不同的应用场景中，指定属性可以不同；即便在相同的应用场景中，第一用户的身份不同，指定属性也可不同。例如，在商务贸易场景中，对于买卖双方来说，指定属性可以为交易金额、数量、买卖双方的地址信息等等，但不限于此；对于物流公司来说，指定属性可以为货运司机的个人信息(身份证号码、联系方式等等)等。其中，对于全部具有指定属性和全不具有指定属性的加密方式均可参见上述实施例的相关内容，在此不再赘述。下面重点对待处理数据部分具有指定属性的加密方式为例，进行示例性说明。
在本申请实施例中，对于部分具有指定属性的待处理数据，第一节点设备10a1可从待处理数据中识别出具有指定属性的第一类数据和不具有指定属性的第二类数据。进一步，第一节点设备10a1为第一类数据和第二类数据分别生成第一随机密钥和第二随机密钥，其中，第一随机密钥和第二随机密钥均为对称密钥。其中，第一节点设备10a1随机生成第一随机密钥和第二随机密钥的具体实施方式，均可参见上述随机生成第一对称密钥的相关内容，在此不再赘述。
进一步，第一节点设备10a1便可根据第一随机密钥对第一类数据进行对称加密，以得到第一类数据的密文；并将待处理数据中的第一类数据替换为第一类数据的密文，得到中间数据。进一步，第一节点设备10a1可根据第二随机密钥对中间数据进行对称加密，进而得到待处理数据的密文。第一节点设备10a1根据第一随机密钥和第二随机密钥对待处理数据中的第一类数据进行双重加密，有利于进一步提高第一类数据的安全性和隐私性。此外，第一节点设备对待处理数据中的第一类数据和第二类数据分别进行加密，有助于实现字段粒度的数据隐私保护。
进一步，第一节点设备10a1根据具有访问第一类数据的权限的第一类用户的公钥对 第一随机密钥进行加密处理，进而得到第一随机密钥的密文；并根据具有访问第二类数据的权限的第二类用户的公钥对第二随机密钥进行加密处理，以得到第二随机密钥的密文。可选地，第二类用户可为与第一类用户不同的用户，也可包含第一类用户。
在本实施例中，第一类用户是指位于第一节点设备10a1所在的区块链系统中，且具有访问第一类数据的权限的用户。进一步，第一类用户的数量可以为1个或多个。若第一类用户的数量为多个，则第一节点设备10a1可根据这多个第一类用户的公钥对第一随机密钥分别进行非对称加密，这样，每个第一类用户均可根据其各自的私钥对第一随机密钥的密文进行非对称解密。第二类用户是指位于第一节点设备10a1所在的区块链系统中，且具有访问第二类数据的权限的用户。进一步，第二类用户的数量可以为1个或多个。若第二类用户的数量为多个，则第一节点设备10a1可根据这多个第二类用户的公钥对第二随机密钥分别进行非对称加密，这样，每个第二类用户均可根据其各自的私钥对第二随机密钥的密文进行非对称解密。
进一步，第一节点设备10a1还可形成第一类用户的公钥和第一随机密钥之间的键值对，为了便于描述和区分，将该键值对定义为第一键值对。进一步，第一节点设备10a1可将第一键值对以及第一类数据的密文存储至区块链的世界状态变量(world state)中；并将第一键值对和第一类数据的密文对应的日志存储至区块链的区块账本中。其中，第一键值对对应的日志可以为形成第一键值对的事件记录，可以包括第一键值对的形成时间、操作者以及相关操作的描述等等，但不限于此。相应地，第一类数据的密文对应的日志可以为第一类数据的密文的生成日志，可以包括第一类数据的密文的生成时间、操作者以及相关操作的描述等等，但不限于此。
进一步，第一节点设备10a1还可形成第二类用户的公钥和第二随机密钥之间的键值对，为了便于描述和区分，将该键值对定义为第二键值对。相应地，第一节点设备10a1还可将第二键值对以及待处理数据的密文存储至区块链的世界状态变量中；并将第二键值对和待处理数据的密文对应的日志存储至区块链的区块账本中。其中，关于第二键值对和待处理数据的密文对应的日志的描述，可参见上述第一键值对和第一类数据密文对应的日志的相关内容，在此不再赘述。
值得说明的是，上述第一节点设备10a1只是对待处理数据进行加密处理方式的描述，并不限定各操作的执行顺序，这些操作可以按照其在上述实施例中出现的顺序来顺序执行或并行执行，也可不按照其在上述实施例中出现的顺序来执行。例如，第一节点设备10a1可先将可将第一键值对以及第一类数据的密文存储至区块链的世界状态变量 中；以及将第一键值对和第一类数据的密文对应的日志存储至区块链的区块账本中；再为第二类数据生成第二随机密钥等等。
下面以第一节点设备10a1先对第一类数据进行加密，再对第二类数据进行加密为例，进行示例性说明。
在本实施例中，第一节点设备10a1从待处理数据中识别出具有指定属性的第一类数据和不具有指定属性的第二类数据。首先，第一节点设备10a1对第一类数据进行第一层加密，具体实施过程为：第一节点设备10a1根据第一对称密钥对第一类数据进行对称加密，得到第一类数据的密文。进一步，第一节点设备10a1再根据第二用户的公钥对第一对称密钥进行非对称加密，得到第一对称密钥的密文。这样，第二用户便可根据其私钥对第一对称密钥的密文进行非对称解密，得到第一随机密钥的明文。之后，根据第一对称密钥对第一类数据的密文进行对称解密，进而得到第一类数据的密文。可选地，在第一层加密处理中，第一节点设备10a1可随机为第一类数据随机生成第一对称密钥。在本实施例中，第二用户相当于上述第一类用户，关于第二用户的描述可参见上述第一类用户的描述的相关内容，在此不再赘述。
进一步，第一节点设备10a1还可将第一类数据的密文和第一对称密钥的密文写入区块链。可选地，第一节点设备10a1可将第二用户的公钥与第一对称密钥的密文组成第一键值对，并将第一键值对和第一类数据的密文存放在世界状态变量中，并将第一键值对对应的日志以及第一类数据的密文对应的日志写入区块账本中。
之后，第一节点设备10a1可对待处理数据进行第二层加密。具体实施过程为：第一节点设备10a1将待处理数据中的第一类数据替换为第一类数据的密文，得到中间数据，并根据第二对称密钥对中间数据进行对称加密，得到中间数据的密文。可选地，第一节点设备10a1可随机生成第二对称密钥。之后，第一节点设备10a1根据第三用户的公钥对第二对称密钥进行非对称加密，得到第二对称密钥的密文。其中，第三用户是对第二类数据具有访问权限的用户。可选地，第三用户可以为第二用户，也可为第二用户之外的其它用户。
进一步，第三用户的数量可以为1个或多个。若第三用户的数量为多个，则第一节点设备10a1可根据这多个第三用户的公钥对第二对称密钥分别进行非对称加密，这样，每个第三用户均可根据其各自的私钥对第二对称密钥的密文进行非对称解密，得到第二对称密钥的明文，之后根据第二对称密钥对待处理数据的密文进行非对称解密，得到第二类数据的明文和第一类数据的密文。
进一步，第一节点设备10a1还可将中间数据的密文和第二对称密钥的密文写入区块链，以供第三用户根据其私钥访问第二类数据。可选地，第一节点设备10a1可将第三用户的公钥与第二对称密钥的密文组成第二键值对，并将第二键值对和中间数据的密文存放在世界状态变量中，并将第二键值对对应的日志以及中间数据的密文对应的日志写入区块账本中。
除了上述对待处理数据进行加密处理的过程，区块链系统中的节点设备10a还可执行解密处理。下面仍以第一节点设备10a1为例，进行示例性说明。如图1b所示，在第一节点设备10a1访问数据时，可从区块链中获取数据密文和该数据密文对应的密钥密文。其中，数据密文为第一节点设备10a1要访问的数据(即待访问数据)对应的密文；密钥密文是根据第一节点设备10a1的本端私钥对应的公钥加密的。这样，第一节点设备10a1便具有访问数据密文对应的数据(待访问数据)的权限。进一步，第一节点设备10a可根据本端私钥对密钥密文进行非对称解密，得到对称密钥；之后，第一节点设备10a1可根据对称密钥对数据密文进行对称解密，得到数据明文。
可选地，第一节点设备10a1可接收第一用户下发的访问指令，该访问指定中携带有待访问数据的标识。进一步，第一节点设备10a1可从区块链中获取与待访问数据的标识对应的数据密文以及该数据密文对应的公钥与密钥密文之间的对应关系；并将第一节点设备10a1的本端公钥在公钥与密钥密文之间的对应关系中匹配，进而得到数据密文对应的密钥密文。可选地，数据密文对应的公钥与密钥密文之间的对应关系可以为数据密文对应的公钥与密钥密文组成的键值对列表。
在本申请实施例中，在第一节点设备10a1将本端公钥在公钥与密钥密文之间的对应关系中匹配时，若可匹配到对应的公钥，则说明第一用户具有访问待访问数据的权限；若匹配不到对应的公钥，则说明第一用户不具有访问待访问数据的权限。可选地，第一节点设备10a1在公钥与密钥密文之间的对应关系中匹配不到本端公钥时，还可输出提示信息，以提示第一用户不具有待访问数据的访问权限。
无论对于具有指定属性的第一类数据，还是不具有指定属性的第二类数据，均可采用上述方法进行数据解密。
可选地，若待访问数据部分具有指定属性，则第一节点设备10a1还可从待访问数据的标识中识别出具有指定属性的第一类数据的标识和不具有指定属性的第二类数据的标识；之后，根据第一类数据的标识和第二类数据的标识，从区块链的世界状态变量中分别获取第一类数据和第二类数据分别对应的公钥与密钥密文之间的对应关系。进一步， 第一节点设备10a1将本端公钥在第二类数据对应的公钥与密钥密文之间的对应关系中进行匹配，得到第二密钥密文。进一步，第一节点设备10a1可根据本端私钥对第二密钥密文进行非对称解密，得到第二对称密钥。进一步，第一节点设备10a1可根据第二对称密钥对数据密文进行解密，进而得到第二类数据的明文和第一类数据的密文。
进一步，第一节点设备10a1可将本端公钥在第一类数据对应的公钥与密钥密文之间的对应关系中进行匹配，得到第一密钥密文。进一步，第一节点设备10a1还可根据本端私钥对第一密钥密文进行非对称解密，得到第一对称密钥。进一步，第一节点设备10a1可根据第一对称密钥对第一类数据的密文进行解密，进而得到第一类数据的明文。在本申请实施例中，在第一节点设备10a1将本端公钥在第一类数据对应的公钥与密钥密文之间的对应关系中匹配时，若可匹配到对应的公钥，则说明第一用户具有访问第一类数据的权限；若匹配不到对应的公钥，则说明第一用户不具有访问第一类数据的权限。可选地，第一节点设备10a1在公钥与密钥密文之间的对应关系中匹配不到本端公钥时，还可输出提示信息，以提示第一用户不具有第一类数据的访问权限。
值得说明的是，上述第一节点设备10a1进行数据解密处理方式的描述，并不限定各操作的执行顺序，这些操作可以按照其在上述实施例中出现的顺序来顺序执行或并行执行，也可不按照其在上述实施例中出现的顺序来执行。优选地，第一节点设备10a1按照待访问数据的加密过程的逆过程进行解密。
需要说明的是，若待访问数据只包含不具有指定属性的第二类数据，第一节点设备10a1只需执行第二层数据解密过程。具体实施过程为：第一节点设备10a1从世界状态变态中读取第二类数据对应的公钥和密钥密文之间的对应关系，可选地，该对应关系可以键值对列表的形式进行存储。进一步，第一节点设备10a1根据本端公钥在公钥和密钥密文之间的对应关系中进行匹配，得到本端私钥对应的第二密钥密文。进一步，第一节点设备10a1根据本端私钥对该第二密钥密文进行解密，得到第二随机密钥的明文，并根据第二随机密文对数据密文进行解密处理，进而得到第二类数据的明文。
若待访问数据包含具有指定属性的第一类数据，则第一节点设备10a1可执行第一层数据解密过程。具体实施过程为：第一节点设备10a1从世界状态变态中读取第一类数据对应的公钥和密钥密文之间的对应关系，可选地，该对应关系可以键值对列表的形式进行存储。进一步，第一节点设备10a根据本端公钥在第一类数据对应的公钥和密钥密文之间的对应关系中进行匹配，得到本端私钥对应的第一密钥密文。进一步，第一节点设备10a1根据本端私钥对第一密钥密文进行解密，得到第一随机密钥的明文，并根据第一 随机密文对第一类数据的密文进行解密处理，进而得到第一类数据的明文。
本申请实施例提供的区块链系统的节点设备除了可进行数据加密和数据解密之外，还可对数据进行共享。例如，第一用户可向其具有访问权限的数据共享给没有访问权限的第二用户等等。其中，第一用户具有访问权限的数据可以为第一用户自己提供的数据，也可为其他用户提供的数据。下面仍然以第一节点设备10a1为例对进行数据共享的过程进行示例性说明。
如图1c所示，第一节点设备10a1从区块链中获取待共享数据的第一密文和从区块链中获取待共享数据的第一密文和待共享数据对应的密钥密文；并根据本端私钥对密钥密文进行非对称解密，以得到第一对称密钥；其中，密钥密文是根据本端私钥对应的公钥对第一对称密钥加密形成的；之后，根据第一对称密钥对第一密文进行解密处理，以得到待共享数据。进一步，第一节点设备获取第二对称密钥，并根据第二对称密钥对待共享数据进行对称加密，以得到待共享数据的第二密文；之后，根据区块链系统中的第二用户的公钥对第二对称密钥进行加密，以得到第二对称密钥的密文；以及将第二密文和第二对称密钥的密文写入区块链，以与第二用户共享待共享数据。其中，在本实施例中，第二用户是指待共享数据的被共享方，其是对待共享数据具有访问权限的用户。
在本实施例中，对于第一节点设备10a1获取待共享数据的明文的具体过程可参见上述实施例关于数据解密的实施例中的相关内容，对于第一节点设备10a1对待共享数据进行加密处理的具体实施方式可参见上述实施例中关于数据加密的实施例的相关内容，在此均不再赘述。
相应地，对于第二用户便可从区块链中获取待共享数据，关于第二用户访问待共享数据的具体实施方式可参见上述数据解密实施例的相关内容，在此不再赘述。
值得说明的是，本申请实施例提供的区块链系统可以以太坊、HyperLedger Fabric、R3 Corda等区块链平台或框架，也可以基于区块链后端即服务(Backend as a Service，BAAS)平台来进行开发。
在本申请各实施例中，节点设备10a的数据处理逻辑可在节点设备10a上部署的智能合约中进行实现。相应地，本申请实施例还提供数据加密和解密系统。
图2a为本申请实施例提供的一种数据加密系统的结构示意图。如图2a所示，该数据加密系统包括：智能合约层20a和区块链存储层20b。其中，该数据加密系统可部署在区块链中的各节点设备中。
在本实施例中，智能合约层20a可获取第一用户提供的待处理数据，并获取对称密 钥。之后，智能合约层20a根据该对称密钥对待处理数据进行对称加密，以得到待处理数据的密文；以及根据第二用户的公钥对对称密钥进行非对称加密，以得到对称密钥的密文。之后，智能合约层20a将待处理数据的密文和对称密钥的密文写入区块链存储层20b中，以供第二用户根据其私钥访问待处理数据。其中，第二用户的公钥和私钥一一对应。
在一些实施例中，智能合约层20a可在获取待处理数据的过程中，为待处理数据随机生成对称密钥。
在本申请实施例中，待处理数据均具有指定属性；或者，待处理数据均不具有所述指定属性；或者，待处理数据部分具有指定属性。
进一步，若待处理数据部分具有指定属性，则智能合约层20a在为待处理数据随机生成对称密钥时，具体用于：从待处理数据中识别出具有指定属性的第一类数据和不具有指定属性的第二类数据；并为第一类数据和第二类数据分别生成第一随机密钥和第二随机密钥，其中，第一随机密钥和第二随机密钥均为对称密钥。
相应地，智能合约层20a在根据对称密钥对所述待处理数据进行加密处理时，具体用于：根据第一随机密钥对第一类数据进行对称加密，以得到第一类数据的密文；并将待处理数据中的第一类数据替换为第一类数据的密文，以得到中间数据；之后，根据第二随机密钥对中间数据进行对称加密，以得到待处理数据的密文。
进一步，智能合约层20a在根据第二用户的公钥对所述对称密钥进行非对称加密时，具体用于：根据具有访问第一类数据的权限的第一类用户的公钥对第一随机密钥进行加密处理，以得到第一随机密钥的密文；并根据具有访问第二类数据的权限的第二类用户的公钥对第二随机密钥进行加密处理，以得到第二随机密钥的密文。
可选地，如图2a所示，区块链存储层20b包括世界状态变量20b1和区块账本20b2。相应地，智能合约层20a在将待处理数据的密文和对称密钥的密文写入区块链存储层20b时，具体用于：将第一类用户的公钥和第一随机密钥的密文形成的第一键值对以及第一类数据的密文存储至世界状态变量20b1中；并将第一键值对和所述第一类数据的密文对应的日志存储至区块账本20b2中；将第二类用户的公钥和第二随机密钥的密文形成的第二键值对以及待处理数据的密文存储至世界状态变量20b1中；并将第二键值对和待处理数据的密文对应的日志存储至区块账本20b2中。
本实施例提供的数据加密系统，可在智能合约中根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入 区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据的安全性。
另外，在智能合约中完成对待处理数据的加密处理，还可充分根据区块链技术的去中心化和不可篡改等特点。
值得说明的是，上述实施例仅为智能合约层20a对待处理数据进行加密处理方式的描述，并不限定各操作的执行顺序，这些操作可以按照其在上述实施例中出现的顺序来顺序执行或并行执行，也可不按照其在上述实施例中出现的顺序来执行。下面以智能合约层先对第一类数据进行加密，再对第二类数据进行加密为例，进行示例性说明。
如图2b所示，在本实施例中，智能合约层20a从待处理数据中识别出具有指定属性的第一类数据和不具有指定属性的第二类数据。首先，智能合约层20a对第一类数据进行第一层加密，具体实施过程为：智能合约层20a为第一类数据随机生成第一随机密钥，其中第一随机密钥为对称密钥。之后，智能合约层20a根据第一随机密钥对第一类数据进行对称加密，得到第一类数据的密文。进一步，智能合约层20a再根据第二用户的公钥对第一随机密钥进行非对称加密，得到第一随机密钥的密文。这样，第二用户便可根据其私钥对第一随机密钥的密文进行非对称解密，得到第一随机密钥的明文。之后，根据第一随机密钥对第一类数据的密文进行对称解密，进而得到第一类数据的密文。其中，关于第二用户的描述可参见上述实施例的相关内容，在此不再赘述。
进一步，智能合约层20a可将第二用户的公钥与第一随机密钥的密文组成第一键值对，并将第一键值对和第一类数据的密文存放在世界状态变量中，并将第一键值对对应的日志以及第一类数据的密文对应的日志写入区块账本中。
之后，智能合约层20a可对待处理数据进行第二层加密。具体实施过程为：智能合约层20a将待处理数据中的第一类数据替换为第一类数据的密文，得到中间数据。进一步，智能合约层20a随机生成第二随机密钥，第二随机密钥也为对称密钥，并根据第二随机密钥对中间数据进行对称加密，得到待处理数据的密文。之后，智能合约层20a根据第三用户的私钥对第二随机密钥进行非对称加密，得到第二随机密钥的密文。其中，第三用户是对第二类用户具有访问权限的用户。可选地，第三用户可以为第二用户，也可为第二用户之外的其它用户。其中，关于第三用户的描述可参见上述实施例的相关内容，在此不再赘述。
进一步，智能合约层20a可将第三用户的公钥与第一随机密钥的密文组成第二键值对，并将第二键值对和待处理数据的密文存放在世界状态变量中，并将第二键值对对应 的日志以及待处理数据的密文对应的日志写入区块账本中。
除了上述数据加密系统之外，本申请实施例还提供数据解密系统。如图3a所示，该数据解密系统包括：智能合约层30a和区块链存储层30b。区块链存储层30b包括世界状态变量30b1和区块账本30b2。其中，该数据加密系统可部署在区块链中的各节点设备中。
在本实施例中，区块链存储层30b存储有数据密文和数据密文对应的密钥密文。
智能合约层30a用于从区块链存储层30b中获取数据密文和该数据密文对应的密钥密文；根据智能合约层30a所属的节点设备的本端私钥对密钥密文进行非对称解密，得到对称密钥；其中，该密钥密文是根据智能合约层30a所属的节点设备的本端私钥对应的公钥加密的；以及并根据对称密钥对数据密文进行对称解密，得到数据明文。
在本申请实施例中，若待访问数据只包含不具有指定属性的第二类数据，智能合约层30a只需第二层数据解密过程，其具体实施过程可参见上述实施例的相关内容，在此不再赘述。
若待访问数据包含具有指定属性的第一类数据，则如图3b所示，智能合约层30a还可执行第一层数据解密过程，其具体实施过程也可参见上述实施例的相关内容，在此不再赘述。
本申请实施例还提供一种数据共享系统。如图3c所示，区块链存储层30b中存储有待共享数据的第一密文和第一密文对应的密钥密文。
在本实施例中，如图3c所示，智能合约层30a可从区块链存储层30b中获取待共享数据的第一密文和待共享数据对应的密钥密文；并根据本端私钥对密钥密文进行非对称解密，以得到第一对称密钥；其中，密钥密文是根据本端私钥对应的公钥对第一对称密钥加密形成的。之后，智能合约层30a可根据第一对称密钥对第一密文进行解密处理，以得到待共享数据。进一步，智能合约层30a可获取第二对称密钥，并根据第二对称密钥对待共享数据进行对称加密，以得到待共享数据的第二密文；之后，智能合约层30a根据区块链系统中的第二用户的公钥对第二对称密钥进行加密，以得到第二对称密钥的密文；以及将第二密文和第二对称密钥的密文写入区块链，以与第二用户共享待共享数据。其中，在本实施例中，第二用户是指对待共享数据具有访问权限的用户。
在本实施例中，对于智能合约层30a获取待共享数据的明文的具体过程可参见上述实施例关于数据解密的实施例中的相关内容，对于智能合约层30a对待共享数据进行加密处理的具体实施方式可参见上述实施例中关于数据加密的实施例的相关内容，在此均 不再赘述。
相应地，对于第二用户便可从区块链中获取待共享数据，关于第二用户访问待共享数据的具体实施方式可参见上述数据解密实施例的相关内容，在此不再赘述。
除了上述系统实施例之外，本申请实施例还提供数据加密方法和数据解密方法，下面分别进行示例性说明。
图4为本申请实施例提供的一种数据加密方法的流程示意图。如图4所示，该方法包括：
401、获取待处理数据和对称密钥，其中，待处理数据是由第一用户提供的。
402、根据对称密钥对待处理数据进行对称加密，以得到待处理数据的密文。
403、根据第二用户的公钥对对称密钥进行非对称加密，以得到对称密钥的密文。
404、将待处理数据的密文和对称密钥的密文写入区块链，以供第二用户根据其私钥访问待处理数据。
在本实施例中，第二用户为对待处理数据具有访问权限的用户。
在本实施例中，在步骤401中，获取第一用户提供的待处理数据，并获取对称密钥。第一用户为提供待处理数据的用户。进一步，在步骤402中，根据该对称密钥对待处理数据进行对称加密，得到待处理数据的密文。在本实施例中，对根据第一对称密钥对待处理数据进行对称加密的具体实施方式不进行限定。其具体算法可参见上述实施例的相关内容，在此不再赘述。在本实施例中，采用对称加密方式对待处理数据进行加密，尤其对于数据量较大的待处理数据，有助于提高对待处理数据的加密处理速度，提高加密效率。
进一步，在步骤403中，可根据区块链系统中的第二用户的公钥对对称密钥进行非对称加密，得到对称密钥的密文。其中，第二用户为具有访问待处理数据的权限的用户。进一步，在步骤404中，将待处理数据的密文和对称密钥的密文写入区块链中。这样，第二用户便可根据其私钥访问待处理数据。其中，第二用户的公钥和私钥相对应。在本实施例中，对称密钥是加密传播的，可保障对称密钥的安全性和隐私性，进而有助于保障待处理数据的安全性和隐私性。
相应地，第二用户的节点设备在访问上述待处理数据时，可从区块链中获取待处理数据的密文和对称密钥的密文，并根据本端私钥对对称密钥的密文进行非对称解密，得到对称密钥；之后，第二用户的节点设备可根据对称密钥对待处理数据的密文进行解密，从而获取待处理数据。
在本实施例提供的区块链系统中，节点设备可在区块链上根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据的安全性。
在本申请实施例中，可在节点设备中预设多个对称密钥，相应地，步骤401的一种可选实施方式为：从预设的多个对称密钥中随机获取一个对称密钥。或者，也可在获取待处理数据的过程中，为待处理数据随机生成的对称密钥。其中，关于在获取待处理数据的过程中的描述可参见上述实施例的相关内容，在此不再赘述。
在一些实施例中，待处理数据可均具有指定属性，也可部分具有指定属性，也可全不具有指定属性。在本申请实施例中，在不同的应用场景中，指定属性可以不同；即便在相同的应用场景中，第一用户的身份不同，指定属性也可不同。其具体描述可参见上述实施例的相关内容，在此不再赘述。其中，对于全部具有指定属性和全不具有指定属性的加密方式均可参见上述实施例的相关内容，在此不再赘述。下面重点对待处理数据部分具有指定属性的加密方式为例，进行示例性说明。
在本申请实施例中，对于部分具有指定属性的待处理数据，步骤402的一种可选实施方式为：从待处理数据中识别出具有指定属性的第一类数据和不具有指定属性的第二类数据；并为第一类数据和第二类数据分别生成第一随机密钥和第二随机密钥，其中，第一随机密钥和第二随机密钥均为对称密钥。
相应地，步骤402的一种可选实施方式为：根据第一随机密钥对第一类数据进行对称加密，以得到第一类数据的密文；并将待处理数据中的第一类数据替换为第一类数据的密文，得到中间数据；根据第二随机密钥对中间数据进行对称加密，进而得到待处理数据的密文。其中，采用第一随机密钥和第二随机密钥对待处理数据中的第一类数据进行双重加密，有利于进一步提高第一类数据的安全性和隐私性。此外，第一节点设备对待处理数据中的第一类数据和第二类数据分别进行加密，有助于实现字段粒度的数据隐私保护。
进一步，步骤403的一种可选实施方式为：根据具有访问第一类数据的权限的第一类用户的公钥对第一随机密钥进行加密处理，进而得到第一随机密钥的密文；并根据具有访问第二类数据的权限的第二类用户的公钥对第二随机密钥进行加密处理，以得到第二随机密钥的密文。可选地，第二类用户可为与第一类用户不同的用户，也可包含第一类用户。
相应地，步骤404的一种可选实施方式为：将第一类用户的公钥和第一随机密钥的密文形成的第一键值对以及第一类数据的密文存储至区块链的世界状态变量中；并将第一键值对和第一类数据的密文对应的日志存储至区块链的区块账本中；以及将第二类用户的公钥和第二随机密钥的密文形成的第二键值对以及待处理数据的密文存储至区块链的世界状态变量中；并将第二键值对和待处理数据的密文对应的日志存储至区块链的区块账本中。
本申请实施例还提供一种存储有计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行上述数据加密方法中的步骤。
值得说明的是，上述实施例只是对待处理数据进行加密处理方式的描述，并不限定各操作的执行顺序，这些操作可以按照其在上述实施例中出现的顺序来顺序执行或并行执行，也可不按照其在上述实施例中出现的顺序来执行。下面以先对第一类数据进行加密，再对第二类数据进行加密为例，进行示例性说明。
图5为本申请实施例提供的另一种数据加密方法的流程示意图。如图5所示，该方法包括：
501、获取第一用户提供的待处理数据，其中，待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据。
502、根据第一对称密钥对第一类数据进行对称加密，并根据第二用户的公钥对第一对称密钥进行非对称加密，以得到第一类数据的密文和第一对称密钥的密文。
503、将第一类数据的密文和第一对称密钥的密文写入区块链，以供第二用户根据其私钥访问所述第一类数据。
504、将待处理数据中的第一类数据替换为第一类数据的密文，得到中间数据。
505、根据第二对称密钥对中间数据进行对称加密，并根据第三用户的公钥对第二对称密钥进行非对称加密，以得到中间数据的密文和第二对称密钥的密文。
506、将中间数据的密文和第二对称密钥的密文写入区块链，以供第三用户根据其私钥访问第二类数据。
在本实施例中，第二用户是指对第一类数据具有访问权限的用户，第三用户是指对第二类数据具有访问权限的用户。可选地，第三用户可与第二用户为同一用户，也可为不同用户。
在本实施例中，对于第一类数据采用双重加密，有利于进一步提高第一类数据的安 全性和隐私性。此外，对待处理数据中的第一类数据和第二类数据分别进行加密，有助于实现字段粒度的数据隐私保护。另一方面，采用对称加密和非对称加密相结合的加密方式，不仅可提高对数据加密处理的效率，还有利于保障数据的安全性。
本申请实施例还提供一种存储有计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行上述数据加密方法中的步骤。
图6为本申请实施例提供的一种数据解密方法的流程示意图。如图6所示，该方法包括：
601、从可访问的区块链中获取数据密文和数据密文对应的密钥密文。
602、根据本端私钥对密钥密文进行非对称解密，得到对称密钥；其中，密钥密文是根据本端私钥对应的公钥加密的。
603、根据对称密钥对数据密文进行对称解密，得到数据明文。
在本实施例中，数据密文可以为具有指定属性的第一类数据的密文，也可为不具有指定属性的第二类数据的密文。
本实施例所提供的数据解密方法对应于图4中的数据加密方法，由于待访问数据是采用对称加密和非对称加密相结合的方式进行加密的，因此本实施例中采用非对称解密方式对密钥密文进行非对称解密，并根据密钥密文的明文对数据密文进行对称解密，进而得到数据明文，有助于提高数据解密的效率。
在一些实施例中，步骤601的一种可选实施方式为：接收第一用户下发的访问指令，该访问指定中携带有待访问数据的标识；可从区块链中获取与待访问数据的标识对应的数据密文以及该数据密文对应的公钥与密钥密文之间的对应关系；并将本端公钥在公钥与密钥密文之间的对应关系中匹配，进而得到数据密文对应的密钥密文。
无论对于具有指定属性的第一类数据，还是不具有指定属性的第二类数据，均可采用上述图6中所示的方法进行数据解密。
可选地，若待访问数据部分具有指定属性，则还可从待访问数据的标识中识别出具有指定属性的第一类数据的标识和不具有指定属性的第二类数据的标识；之后，根据第一类数据的标识和第二类数据的标识，从区块链的世界状态变量中分别获取第一类数据和第二类数据分别对应的公钥与密钥密文之间的对应关系。进一步，将本端公钥在第二类数据对应的公钥与密钥密文之间的对应关系中进行匹配，得到第二对称密钥。进一步，可根据第二对称密钥对数据密文进行解密，进而得到第二类数据的明文和第一类数据的 密文。
进一步，可将本端公钥在第一类数据对应的公钥与密钥密文之间的对应关系中进行匹配，得到第一对称密钥。进一步，可根据第一对称密钥对第一类数据的密文进行解密，进而得到第一类数据的明文。
本申请实施例还提供一种存储有计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行上述数据解密方法中的步骤。
图7a为本申请实施例提供的一种数据共享方法的流程示意图。如图7a所示，该方法包括：
701、从可访问的区块链中获取待共享数据的第一密文和待共享数据对应的密钥密文。
702、根据本端私钥对密钥密文进行非对称解密，以得到第一对称密钥；其中，密钥密文是根据本端私钥对应的公钥对第一对称密钥加密形成的。
703、根据第一对称密钥对第一密文进行解密处理，以得到待共享数据。
704、获取第二对称密钥，并根据第二对称密钥对待共享数据进行对称加密，以得到待共享数据的第二密文。
705根据第二用户的公钥对第二对称密钥进行加密，以得到第二对称密钥的密文。
706、将第二密文和第二对称密钥的密文写入区块链，以与第二用户共享待共享数据。
在本实施例中，第二用户是指待共享数据的被共享方，其是对待共享数据具有访问权限的用户。在本实施例中，对于步骤701-703中获取待共享数据的明文的描述可参见上述实施例关于数据解密的实施例中的相关内容，对于步骤704-706中对待共享数据进行加密处理的具体实施方式可参见上述实施例中关于数据加密的实施例的相关内容，在此均不再赘述。
相应地，对于第二用户便可从区块链中获取待共享数据，关于第二用户访问待共享数据的具体实施方式可参见上述数据解密实施例的相关内容，在此不再赘述。
相应地，本申请实施例还提供一种存储有计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行上述数据共享方法中的步骤。
需要说明的是，上述实施例所提供方法的各步骤的执行主体均可以是同一设备，或者，该方法也由不同设备作为执行主体。比如，步骤401和402的执行主体可以为设备 A；又比如，步骤401的执行主体可以为设备A，步骤402的执行主体可以为设备B；等等。
另外，在上述实施例及附图中的描述的一些流程中，包含了按照特定顺序出现的多个操作，但是应该清楚了解，这些操作可以不按照其在本文中出现的顺序来执行或并行执行，操作的序号如401、402等，仅仅是用于区分开各个不同的操作，序号本身不代表任何的执行顺序。另外，这些流程可以包括更多或更少的操作，并且这些操作可以按顺序执行或并行执行。
本申请实施例提供的数据处理方法可应用于各种区块链的应用场景中。例如，可应用于金融领域、物流领域、公共服务领域、公益领域等等，但不限于此。下面以金融贸易领域为例对本申请实施例提供的数据处理方法进行示例性说明。
图7b为本申请实施例提供的贸易区块链系统的结构示意图。如图7b所示，该贸易区块链系统可包括：买家侧设备70a、卖家侧设备70b以及第三方设备70c。可选地，第三方可以为货运公司和监管部门中的至少一种。相应地，第三方设备可包括：货运侧设备和/或监管侧设备。其中，货运公司可以为：海运公司、陆运公司、货代公司等等，但不限于此。监管部门可以为：海关、税局等等。这些直接参与方组成一个区块链。其中，图7b中所示的贸易区块链的参与方仅为示例性说明，并不对其构成限定。可选地，贸易区块链系统还可包括其它一些非直接参与方。
本申请实施例提供的数据处理方法可适用于交易过程中的每一个环节。现以买卖双方进行货物运输的过程为例进行示例性说明。
对于买卖双方来说，交易金额、货物数量、买家地址等信息为买卖双方的直接利益相关数据，可只供买卖双方知道。进而，买卖双方可指定这些属性为指定属性。对于其中，买卖双方之间的除具有指定属性之外的其它交易数据可只供直接参与方访问。基于此，对于买家侧设备70a或卖家侧设备70b，可获取待处理的交易数据。该交易数据包含具有指定属性的第一类数据和不具有指定属性的第二类数据。其中，第一类数据也可称为敏感信息，第二类数据也可称为基础交易信息。可选地，买家侧设备70a或卖家侧设备70b可从交易数据中识别出具有指定属性的第一类数据(敏感信息)和不具有指定属性的第二类数据(基础交易信息)。进一步，买家侧设备70a或卖家侧设备70b可根据第一对称密钥对第一类数据进行对称加密，得到第一类数据的密文；并根据交易另一方的公钥对第一随机密钥进行非对称加密，得到第一对称密钥的密文。其中，对于买家来说，交易的另一方为卖家；对于卖家来说，交易的另一方为买家。可选地，买家侧买 家侧设备70a或卖家侧设备70b可为第一类数据随机生成第一对称密钥。进一步，买家侧设备70a或卖家侧设备70b可将第一类数据的密文和第一对称密钥的密文写入贸易区块链。这样，交易另一方的设备(买家侧设备70a或卖家侧设备70b)便可从贸易区块链中获取第一类数据的密文和第一对称密钥的密文，并根据本端私钥对第一对称密钥的密文进行非对称解密，得到第一对称密钥的明文；并利用第一对称密钥对第一类数据的密文进行对称解密，得到第一类数据的明文。对于第三方设备来说，由于第三方设备的本端私钥无法对解密第一对称密钥的密文，也就无法获取第一对称密钥，进而也就无法访问第一类数据。
可选地，买家侧设备70a或卖家侧设备70b可将交易另一方的公钥与第一对称密钥的密文组成的第一键值对，并将第一类数据的密文和第一键值对写入区块链系统中。这样，交易另一方的设备便可根据本端公钥获取第一对称密钥的密文，并根据本端私钥对第一对称密钥的密文进行非对称解密，得到第一对称密钥的明文，进而交易另一方的设备可根据第一对称密钥对第一类数据的密文进行对称解密，得到第一类数据。而对于区块链系统中除买卖双方之外的其它参与方，由于无法得知交易另一方的私钥，因此也就无法对第一对称密钥的密文进行解密，进而也就无法访问第一类数据。
进一步，对于买家侧设备70a或卖家侧设备70b，还可将交易数据中的第一类数据替换为第一类数据的密文，得到中间数据。根据第二对称密钥对中间数据进行对称加密，得到中间数据的密文。可选地，买家侧设备70a或卖家侧设备70b还可随机生成第二对称密钥。进一步，买家侧设备70a或卖家侧设备70b还可根据贸易区块链系统中的直接参与方(交易的另一方和第三方)的公钥对第二对称密钥分别进行非对称加密，得到第二对称密钥的密文。进一步，买家侧设备70a或卖家侧设备70b还可将中间数据的密文和第二对称密钥的密文写入贸易区块链，以供交易的另一方和第三方分别根据其私钥访问第二类数据。
相应地，交易的另一方的设备(买家侧设备或卖家侧设备)或第三方设备可从贸易区块链中获取中间数据的密文和第二对称密钥的密文；并根据本端私钥对第二对称密钥的密文的密文进行非对称解密，得到第二对称密钥的明文；并根据第二对称密钥对所述中间数据的密文进行对称解密，得到第二类数据的明文和第一类数据的密文。
可选地，买家侧设备70a或卖家侧设备70b可根据贸易区块链系统中的直接参与方(交易的另一方和第三方)的公钥分别对第二对称密钥进行非对称加密，得到多个第二对称密钥的密文。进一步，买家侧设备70a或卖家侧设备70b可将直接参与方的公钥与 多个第二对称密钥的密文组成多个第二键值对，并将中间数据的密文和多个第二键值对写入区块链中。这样，对于直接参与方中的任一方的节点设备来说，均可根据其公钥在多个第二键值对中匹配到该公钥对于的第二对称密钥的密文。进一步，对于直接参与方侧的设备来说，可根据本端私钥对第二对称密钥的密文进行非对称解密，得到第二对称密钥的明文，之后，根据第二对称密钥对中间数据的密文进行对称解密，得到第二类数据的明文。
进一步，在买卖双方进行货物运输的过程中，还可根据区块链系统进行物流轨迹跟踪，期间环节可能涉及到陆运物流公司、船运物流公司、海关、税局等参与方。对于每个运输环节涉及到的参与方来说，敏感信息可能不同。例如，对于陆运物流公司来说，可能货运司机的个人信息(驾驶证号码、身份证号码、联系方式等等)属于敏感信息，所以只能陆运物流公司知道。因此，陆运物流公司在写入交易数据时，便可将货运司机的个人信息作为第一类数据等等。对于每个运输环节涉及的参与方进行数据处理的过程均可参见上述实施例的相关内容，在此不再赘述。
图8为本申请实施例提供的一种计算机设备的结构示意图。如图8所示，该计算机设备包括：存储器80a和处理器80b。其中，存储器80a用于存储计算机程序。
在本实施例中，处理器80b耦合至存储器80a，用于执行计算机程序以用于：获取待处理数据和对称密钥；其中，待处理数据是由第一用户提供的；根据对称密钥对待处理数据进行对称加密，以得到待处理数据的密文；根据第二用户的公钥对对称密钥进行非对称加密，以得到对称密钥的密文；以及将待处理数据的密文和对称密钥的密文写入区块链，以供第二用户根据其私钥访问待处理数据。
在一些实施例中，处理器80b在获取对称密钥时，具体用于：在获取待处理数据的过程中，为待处理数据随机生成对称密钥。
在本申请实施例中，待处理数据均具有指定属性；或者，待处理数据均不具有指定属性；或者，待处理数据部分具有指定属性。
可选地，若待处理数据部分具有指定属性，则处理器80b在为待处理数据随机生成对称密钥时，具体用于：从待处理数据中识别出具有指定属性的第一类数据和不具有指定属性的第二类数据；并为第一类数据和第二类数据分别生成第一随机密钥和第二随机密钥，其中，第一随机密钥和第二随机密钥为对称密钥。
相应地，处理器80b在根据对称密钥对待处理数据进行加密处理时，具体用于：根据第一随机密钥对第一类数据进行对称加密，以得到第一类数据的密文；将待处理数据 中的第一类数据替换为第一类数据的密文，以得到中间数据；并根据第二随机密钥对中间数据进行对称加密，以得到待处理数据的密文。
相应地，处理器80b在根据第二用户的公钥对对称密钥进行非对称加密时，具体用于：根据具有访问第一类数据的权限的第一类用户的公钥对第一随机密钥进行加密处理，以得到第一随机密钥的密文；并根据具有访问第二类数据的权限的第二类用户的公钥对第二随机密钥进行加密处理，以得到第二随机密钥的密文。
相应地，处理器80b在将待处理数据的密文和对称密钥的密文写入区块链时，具体用于：将第一类用户的公钥和第一随机密钥的密文形成的第一键值对以及第一类数据的密文存储至区块链的世界状态变量中；并将第一键值对和第一类数据的密文对应的日志存储至区块链的区块账本中；以及将第二类用户的公钥和第二随机密钥的密文形成的第二键值对以及待处理数据的密文存储至区块链的世界状态变量中；并将第二键值对和待处理数据的密文对应的日志存储至区块链的区块账本中。
在一些可选实施方式中，如图8所示，该节点设备还可以包括：通信组件80c、电源组件80d、显示屏80e和音频组件80f等可选组件。图8中仅示意性给出部分组件，并不意味着计算机设备必须包含图8所示全部组件，也不意味着计算机设备只能包括图8所示组件。
本实施例提供的计算机设备，可在区块链上根据对称密钥对待处理数据进行对称加密，对于对称密钥进行非对称加密，并将待处理数据的密文和对称密钥的密文写入区块链。这种采用对称加密和非对称加密相结合的加密方式，一方面可提高对数据加密处理的效率，另一方面还有利于保障数据的安全性。
图9为本申请实施例提供的另一种计算机设备的结构示意图。如图9所示，该计算机设备包括：存储器90a和处理器90b。其中，存储器90a用于存储计算机程序。
在本实施例中，处理器90b耦合至存储器90a，用于执行计算机程序以用于：从可访问的区块链中获取数据密文和数据密文对应的密钥密文；根据本端私钥对密钥密文进行非对称解密，得到对称密钥；其中，其中，密钥密文是根据本端私钥对应的公钥加密的；根据对称密钥对数据密文进行对称解密，得到数据明文。
在一些实施例中，处理器90b在从可访问的区块链中获取数据密文和数据密文对应的密钥密文时，具体用于：根据用户下发的访问指令中的待访问数据的标识，从区块链中获取数据密文以及数据密文对应的公钥与密钥密文之间的对应关系；并将本端私钥对应的公钥在数据密文对应的公钥与密钥密文之间的对应关系中匹配，以得到数据密文对 应的密钥密文。
在另一些实施例中，待访问数据均具有指定属性；或者，待访问数据均不具有指定属性；或者，待访问数据部分具有指定属性。
可选地，若待访问数据部分具有指定属性，处理器90b在从区块链中获取数据密文以及数据密文对应的公钥与密钥密文之间的对应关系时，具体用于：从待访问数据的标识中识别出具有指定属性的第一类数据的标识和不具有指定属性的第二类数据的标识；并根据第一类数据的标识和第二类数据的标识，从区块链的世界状态变量中分别获取第一类数据和第二类数据分别对应的公钥与密钥密文之间的对应关系。
进一步，处理器90b在将本端私钥对应的公钥与从待处理数据对应的公钥与密钥密文之间的对应关系中匹配时，具体用于：将本端私钥对应的公钥分别在第一类数据和第二类数据分别对应的公钥与密钥密文之间的对应关系进行匹配，以得到第一类数据对应的第一密钥密文和第二类数据对应的第二密钥密文。
相应地，处理器90b在根据本端私钥对密钥密文进行非对称解密时，具体用于：根据本端私钥对分别对第一密钥密文和第二密钥密文进行非对称解密，以得到第一对称密钥和第二对称密钥。
进一步，处理器90b在用对称密钥对数据密文进行对称解密时，具体用于：根据第二对称密钥对数据密文进行解密，以得到第二类数据的明文和第一类数据的密文；并根据第一对称密钥对第一类数据的密文进行解密，以得到第一类数据的明文。
在一些可选实施方式中，如图9所示，该节点设备还可以包括：通信组件90c、电源组件90d、显示屏90e和音频组件90f等可选组件。图9中仅示意性给出部分组件，并不意味着计算机设备必须包含图9所示全部组件，也不意味着计算机设备只能包括图9所示组件。
本实施例提供的计算机设备，对于采用对称加密和非对称加密相结合的加密方式进行加密的数据，可采用非对称解密方式密钥密文，并采用对称解密方式解密数据密文，有助于提高对数据解密的效率。
图10为本申请实施例提供的又一种计算机设备的结构示意图。如图10所示，计算机设备包括：存储器100a和处理器100b。其中，存储器100a用于存储计算机程序。
在本实施例中，处理器100b耦合至存储器100a，用于执行计算机程序以用于：获取第一用户提供的待处理数据，待处理数据包含具有指定属性的第一类数据和不具有指定属性的第二类数据；根据第一对称密钥对第一类数据进行对称加密，并根据第二用户 的公钥对第一对称密钥进行非对称加密，以得到第一类数据的密文和第一对称密钥的密文；将第一类数据的密文和第一对称密钥的密文写入区块链，以供第二用户根据其私钥访问第一类数据；将待处理数据中的第一类数据替换为第一类数据的密文，得到中间数据；根据第二对称密钥对中间数据进行对称加密，并根据第三用户的公钥对第二对称密钥进行非对称加密，以得到中间数据的密文和第二对称密钥的密文；将中间数据的密文和第二对称密钥的密文写入区块链，以供第三用户根据其私钥访问第二类数据。
可选地，第二用户与第三用户为同一用户。
在一些可选实施方式中，如图10所示，该节点设备还可以包括：通信组件100c、电源组件100d、显示屏100e和音频组件100f等可选组件。图10中仅示意性给出部分组件，并不意味着计算机设备必须包含图10所示全部组件，也不意味着计算机设备只能包括图10所示组件。
本实施例提供的计算机设备，可对第一类数据采用双重加密，有利于进一步提高第一类数据的安全性和隐私性。此外，对待处理数据中的第一类数据和第二类数据分别进行加密，有助于实现字段粒度的数据隐私保护。另一方面，采用对称加密和非对称加密相结合的加密方式，不仅可提高对数据加密处理的效率，还有利于保障数据的安全性。
图11为本申请实施例提供的又一种计算机设备的结构示意图。如图11所示，计算机设备包括：存储器110a和处理器110b。其中，存储器110a用于存储计算机程序。
在本实施例中，处理器110b耦合至存储器110a，用于执行计算机程序以用于：从可访问的区块链中获取待共享数据的第一密文和待共享数据对应的密钥密文；根据本端私钥对密钥密文进行非对称解密，以得到第一对称密钥；密钥密文是根据本端私钥对应的公钥对第一对称密钥加密形成的；根据第一对称密钥对第一密文进行解密处理，以得到待共享数据；获取第二对称密钥，并根据第二对称密钥对待共享数据进行对称加密，以得到待共享数据的第二密文；根据第二用户的公钥对第二对称密钥进行加密，以得到第二对称密钥的密文；将第二密文和第二对称密钥的密文写入区块链，以与第二用户共享待共享数据。
在一些可选实施方式中，如图11所示，该节点设备还可以包括：通信组件110c、电源组件110d、显示屏110e和音频组件110f等可选组件。图11中仅示意性给出部分组件，并不意味着计算机设备必须包含图11所示全部组件，也不意味着计算机设备只能包括图11所示组件。
本实施例提供的计算机设备，可在区块链上采用对称加密和非对称加密相结合的加 密方式对待共享数据进行加密处理，一方面可提高对数据加密处理的效率，另一方面还有利于保障共享数据的安全性。
在本申请实施例中，存储器用于存储计算机程序，并可被配置为存储其它各种数据以支持在节点设备上的操作。其中，处理器可执行存储器中存储的计算机程序，以实现相应控制逻辑。存储器可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
在本申请实施例中，通信组件被配置为便于节点设备和其他设备之间有线或无线方式的通信。节点设备可以接入基于通信标准的无线网络，如WiFi，2G或3G，4G，5G或它们的组合。在一个示例性实施例中，通信组件经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，所述通信组件还可基于近场通信(NFC)技术、射频识别(RFID)技术、红外数据协会(IrDA)技术、超宽带(UWB)技术、蓝牙(BT)技术或其他技术来实现。
在本申请实施例中，显示屏可以包括液晶显示屏(LCD)和触摸面板(TP)。如果显示屏包括触摸面板，显示屏可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。所述触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与所述触摸或滑动操作相关的持续时间和压力。
在本申请实施例中，电源组件被配置为节点设备的各种组件提供电力。电源组件可以包括电源管理系统，一个或多个电源，及其他与为电源组件所在设备生成、管理和分配电力相关联的组件。
在本申请实施例中，音频组件可被配置为输出和/或输入音频信号。例如，音频组件包括一个麦克风(MIC)，当音频组件所在设备处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器或经由通信组件发送。在一些实施例中，音频组件还包括一个扬声器，用于输出音频信号。例如，对于具有语言交互功能的计算机设备，可通过音频组件实现与用户的语音交互等。
应注意到：在本申请不同的实施例中，第二用户都是相对第一用户而言的其他用户，第二对称密钥都是相对第一对称密钥而言的其它对称密钥；“第一”、“第二”、“第 三”仅仅用于区分两个不同用户或不同的密钥，并不够成其他限制。
还需要说明的是，本文中的“第一”、“第二”等描述，是用于区分不同的消息、设备、模块等，不代表先后顺序，也不限定“第一”和“第二”是不同的类型。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。 计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (37)

  1. 一种数据加密方法，其特征在于，包括：
    获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；
    根据第一对称密钥对所述第一类数据进行对称加密，并根据第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；
    将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述第一类数据；
    将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；
    根据第二对称密钥对所述中间数据进行对称加密，并根据第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；
    将所述中间数据的密文和所述第二对称密钥的密文写入区块链，以供所述第三用户根据其私钥访问所述第二类数据。
  2. 根据权利要求1所述的方法，其特征在于，所述将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，包括：
    将所述第二用户的公钥和所述第一对称密钥的密文形成的第一键值对以及所述第一类数据的密文存储至所述区块链的世界状态变量中；并将所述第一键值对和所述第一类数据的密文对应的日志存储至所述区块链的区块账本中。
  3. 根据权利要求1所述的方法，其特征在于，所述将所述中间数据的密文和所述第二对称密钥的密文写入区块链，包括：
    将所述第三用户的公钥和所述第二对称密钥的密文形成的第二键值对以及所述中间数据的密文存储至所述区块链的世界状态变量中；并将所述第二键值对和所述中间数据的密文对应的日志存储至所述区块链的区块账本中。
  4. 一种数据解密方法，其特征在于，包括：
    从可访问的区块链中获取数据密文和所述数据密文对应的密钥密文；
    根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；
    根据所述对称密钥对所述数据密文进行对称解密，得到数据明文。
  5. 根据权利要求4所述的方法，其特征在于，所述从可访问的区块链中获取数据密 文和所述数据密文对应的密钥密文，包括：
    根据用户下发的访问指令中的待访问数据的标识，从所述区块链中获取所述数据密文以及所述数据密文对应的公钥与密钥密文之间的对应关系；
    将所述本端私钥对应的公钥在所述数据密文对应的公钥与密钥密文之间的对应关系中匹配，以得到所述数据密文对应的密钥密文。
  6. 根据权利要求5所述的方法，其特征在于，所述待访问数据均具有指定属性；或者，所述待访问数据均不具有所述指定属性；或者，所述待访问数据部分具有指定属性。
  7. 根据权利要求5所述的方法，其特征在于，若所述待访问数据部分具有指定属性，则所述根据用户下发的访问指令中的待访问数据的标识，从所述区块链中获取所述数据密文以及待处理数据对应的公钥与密钥密文之间的对应关系，包括：
    从所述待访问数据的标识中识别出具有所述指定属性的第一类数据的标识和不具有所述指定属性的第二类数据的标识；
    根据所述第一类数据的标识和所述第二类数据的标识，从所述区块链的世界状态变量中分别获取所述第一类数据和所述第二类数据分别对应的公钥与密钥密文之间的对应关系。
  8. 根据权利要求7所述的方法，其特征在于，所述将所述本端私钥对应的公钥在所述数据密文对应的公钥与密钥密文之间的对应关系中匹配，以得到所述数据密文对应的密钥密文，包括：
    将所述本端私钥对应的公钥分别在所述第一类数据和所述第二类数据分别对应的公钥与密钥密文之间的对应关系进行匹配，以得到所述第一类数据对应的第一密钥密文和所述第二类数据对应的第二密钥密文。
  9. 根据权利要求8所述的方法，其特征在于，所述根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥，包括：
    根据所述本端私钥对分别对第一密钥密文和所述第二密钥密文进行非对称解密，以得到第一对称密钥和第二对称密钥。
  10. 根据权利要求9所述的方法，其特征在于，所述根据所述对称密钥对所述数据密文进行对称解密，得到数据明文，包括：
    根据所述第二对称密钥对所述数据密文进行解密，以得到所述第二类数据的明文和所述第一类数据的密文；
    根据所述第一对称密钥对所述第一类数据的密文进行解密，以得到所述第一类数据 的明文。
  11. 一种数据加密方法，其特征在于，包括：
    获取待处理数据和对称密钥，所述待处理数据是由第一用户提供的；
    根据所述对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；
    根据第二用户的公钥对所述对称密钥进行非对称加密，以得到所述对称密钥的密文；
    将所述待处理数据的密文和所述对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述待处理数据。
  12. 根据权利要求11所述的方法，其特征在于，所述获取对称密钥，包括：
    在获取所述待处理数据的过程中，为所述待处理数据随机生成所述对称密钥。
  13. 根据权利要求11所述的方法，其特征在于，所述待处理数据均具有指定属性；或者，所述待处理数据均不具有所述指定属性；或者，所述待处理数据部分具有指定属性。
  14. 根据权利要求12所述的方法，其特征在于，若所述待处理数据部分具有指定属性，则所述为所述待处理数据随机生成所述对称密钥，包括：
    从所述待处理数据中识别出具有所述指定属性的第一类数据和不具有所述指定属性的第二类数据；
    为所述第一类数据和所述第二类数据分别生成第一随机密钥和第二随机密钥，其中，所述第一随机密钥和所述第二随机密钥为对称密钥。
  15. 根据权利要求14所述的方法，其特征在于，所述根据所述对称密钥对所述待处理数据进行加密处理，以得到所述待处理数据的密文，包括：
    根据所述第一随机密钥对所述第一类数据进行对称加密，以得到所述第一类数据的密文；
    将所述待处理数据中的第一类数据替换为所述第一类数据的密文，以得到中间数据；
    根据所述第二随机密钥对所述中间数据进行对称加密，以得到所述中间数据的密文，作为所述待处理数据的密文。
  16. 根据权利要求15所述的方法，其特征在于，所述根据第二用户的公钥对所述对称密钥进行非对称加密，包括：
    根据具有访问所述第一类数据的权限的第一类用户的公钥对所述第一随机密钥进行非对称加密，以得到所述第一随机密钥的密文；
    根据具有访问所述第二类数据的权限的第二类用户的公钥对所述第二随机密钥进行非对称加密，以得到所述第二随机密钥的密文。
  17. 根据权利要求16所述的方法，其特征在于，所述将所述待处理数据的密文和所述对称密钥的密文写入区块链，包括：
    将所述第一类用户的公钥和所述第一随机密钥的密文形成的第一键值对以及所述第一类数据的密文存储至所述区块链的世界状态变量中；并将所述第一键值对和所述第一类数据的密文对应的日志存储至所述区块链的区块账本中；
    将所述第二类用户的公钥和所述第二随机密钥的密文形成的第二键值对以及所述待处理数据的密文存储至所述区块链的世界状态变量中；并将所述第二键值对和所述待处理数据的密文对应的日志存储至所述区块链的区块账本中。
  18. 一种数据共享方法，其特征在于，包括：
    从可访问的区块链中获取待共享数据的第一密文和所述待共享数据对应的密钥密文；
    根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；
    根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；
    获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；
    根据第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；
    将所述第二密文和所述第二对称密钥的密文写入所述区块链，以与所述第二用户共享所述待共享数据。
  19. 一种计算机设备，其特征在于，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
    所述处理器耦合至所述存储器，用于执行所述计算机程序以用于：
    获取待处理数据和对称密钥；所述待处理数据是由第一用户提供的；
    根据所述对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；
    根据第二用户的公钥对所述对称密钥进行非对称加密，以得到所述对称密钥的密文；
    将所述待处理数据的密文和所述对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述待处理数据。
  20. 一种计算机设备，其特征在于，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
    所述处理器耦合至所述存储器，用于执行所述计算机程序以用于：
    从可访问的区块链中获取数据密文和所述数据密文对应的密钥密文；
    根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；
    根据所述对称密钥对所述数据密文进行对称解密，得到数据明文。
  21. 一种计算机设备，其特征在于，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
    从可访问的区块链中获取待共享数据的第一密文和所述待共享数据对应的密钥密文；
    根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；
    根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；
    获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；
    根据第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；
    将所述第二密文和所述第二对称密钥的密文写入所述区块链，以与所述第二用户共享所述待共享数据。
  22. 一种计算机设备，其特征在于，包括：存储器和处理器；其中，所述存储器用于存储计算机程序；
    获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；
    根据第一对称密钥对所述第一类数据进行对称加密，并根据第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密 文；
    将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述第一类数据；
    将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；
    根据第二对称密钥对所述中间数据进行对称加密，并根据第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；
    将所述中间数据的密文和所述第二对称密钥的密文写入区块链，以供所述第三用户根据其私钥访问所述第二类数据。
  23. 一种区块链系统，其特征在于，包括：多台节点设备，其中，所述节点设备，用于：获取第一用户提供的待处理数据和第一对称密钥；根据所述第一对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；根据所述区块链系统中的第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一对称密钥的密文；以及将所述待处理数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述待处理数据。
  24. 根据权利要求23所述的系统，其特征在于，所述节点设备，还用于：从所述区块链中获取数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到第二对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；根据所述第二对称密钥对所述数据密文进行对称解密，得到数据明文。
  25. 一种区块链系统，其特征在于，包括：多台节点设备，其中，所述节点设备，用于：从区块链中获取待共享数据的第一密文和所述待共享数据对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；根据所述区块链系统中的第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；以及将所述第二密文和所述第二对称密钥的密文写入所述区块链，以与所述第二用户共享所述待共享数据。
  26. 根据权利要求25所述的系统，其特征在于，所述节点设备，还用于：从所述区块链中获取数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到第三对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公 钥加密的；根据所述第三对称密钥对所述数据密文进行对称解密，得到数据明文。
  27. 一种区块链系统，其特征在于，包括：多台节点设备，其中，所述节点设备，用于：获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；根据第一对称密钥对所述第一类数据进行对称加密，并根据所述区块链系统中的第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；将所述第一类数据的密文和所述第一对称密钥的密文写入区块链，以供所述第二用户根据其私钥访问所述第一类数据；将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；根据第二对称密钥对所述中间数据进行对称加密，并根据所述区块链系统中的第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；将所述中间数据的密文和所述第二对称密钥的密文写入区块链，以供所述第三用户根据其私钥访问所述第二类数据。
  28. 根据权利要求27所述的系统，其特征在于，所述节点设备，还用于：从所述区块链中获取数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到第三对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；根据所述第三对称密钥对所述数据密文进行对称解密，得到数据明文。
  29. 一种数据加密系统，其特征在于，包括：智能合约层和区块链存储层；
    其中，所述智能合约层，用于获取待处理数据和对称密钥；其中，所述待处理系统由第一用户提供；根据所述对称密钥对所述待处理数据进行对称加密，以得到所述待处理数据的密文；以及根据第二用户的公钥对所述对称密钥进行非对称加密，以得到所述对称密钥的密文；并将所述待处理数据的密文和所述对称密钥的密文写入所述区块链存储层，以供所述第二用户根据其私钥访问所述待处理数据。
  30. 一种数据解密系统，其特征在于，包括：智能合约层和区块链存储层；所述区块链存储层，存储有数据密文和所述数据密文对应的密钥密文；
    所述智能合约层，用于从所述区块链存储层中获取所述数据密文和所述数据密文对应的密钥密文；根据本端私钥对所述密钥密文进行非对称解密，得到对称密钥；其中，所述密钥密文是根据所述本端私钥对应的公钥加密的；以及根据所述对称密钥对所述数据密文进行对称解密，得到数据明文。
  31. 一种数据共享系统，其特征在于，包括：智能合约层和区块链存储层；其中，所述区块链存储层，存储有待共享数据的第一密文和所述待共享数据对应的密钥密文；
    所述智能合约层，用于从所述区块链存储层中获取所述第一密文和所述密钥密文；根据本端私钥对所述密钥密文进行非对称解密，以得到第一对称密钥；所述密钥密文是根据所述本端私钥对应的公钥对所述第一对称密钥加密形成的；根据所述第一对称密钥对所述第一密文进行解密处理，以得到所述待共享数据；获取第二对称密钥，并根据所述第二对称密钥对所述待共享数据进行对称加密，以得到所述待共享数据的第二密文；根据第二用户的公钥对所述第二对称密钥进行加密，以得到所述第二对称密钥的密文；以及将所述第二密文和所述第二对称密钥的密文写入所述区块链存储层，以与所述第二用户共享所述待共享数据。
  32. 一种数据加密系统，其特征在于，包括：智能合约层和区块链存储层；
    其中，所述智能合约层，用于获取第一用户提供的待处理数据，所述待处理数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；根据第一对称密钥对所述第一类数据进行对称加密，并根据第二用户的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；将所述第一类数据的密文和所述第一对称密钥的密文写入所述区块链存储层，以供所述第二用户根据其私钥访问所述第一类数据；以及将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；根据第二对称密钥对所述中间数据进行对称加密，并根据第三用户的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；并将所述中间数据的密文和所述第二对称密钥的密文写入所述区块链存储层，以供所述第三用户根据其私钥访问所述第二类数据。
  33. 一种贸易区块链系统，其特征在于，包括：买家侧设备、卖家侧设备以及第三方设备；
    所述买家侧设备或所述卖家侧设备，用于：获取待处理的交易数据；所述交易数据包含具有指定属性的第一类数据和不具有所述指定属性的第二类数据；根据第一对称密钥对所述第一类数据进行对称加密，并根据交易的另一方的公钥对所述第一对称密钥进行非对称加密，以得到所述第一类数据的密文和所述第一对称密钥的密文；以及将所述第一类数据的密文和所述第一对称密钥的密文写入贸易区块链，以供所述交易的另一方根据其私钥访问所述第一类数据；并将所述待处理数据中的第一类数据替换为所述第一类数据的密文，得到中间数据；根据第二对称密钥对所述中间数据进行对称加密，并根据所述交易的另一方和所述第三方设备对应的第三方的公钥对所述第二对称密钥进行非对称加密，以得到所述中间数据的密文和所述第二对称密钥的密文；将所述中间数据 的密文和所述第二对称密钥的密文写入所述贸易区块链，以供所述交易的另一方和所述第三方分别根据其私钥访问所述第二类数据。
  34. 根据权利要求33所述的系统，其特征在于，所述第三方设备包括：货运侧设备和/或监管侧设备。
  35. 根据权利要求33所述的系统，其特征在于，所述买家侧设备、所述卖家侧设备或所述第三方设备用于：从所述贸易区块链中获取所述中间数据的密文和所述第二对称密钥的密文；根据本端私钥对所述第二对称密钥的密文的密文进行非对称解密，得到所述第二对称密钥的明文；并根据所述第二对称密钥对所述中间数据的密文进行对称解密，得到所述第二类数据的明文和所述第一类数据的密文。
  36. 根据权利要求33所述的系统，其特征在于，所述买家侧设备或所述卖家侧设备还用于：从所述贸易区块链中获取所述第一类数据的密文和所述第一对称密钥的密文；根据本端私钥对所述第一对称密钥的密文的密文进行非对称解密，得到所述第一对称密钥的明文；并根据所述第一对称密钥对所述第一类数据的密文进行对称解密，得到所述第一类数据的明文。
  37. 一种存储有计算机指令的计算机可读存储介质，其特征在于，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行权利要求1-18任一项所述方法中的步骤。
PCT/CN2020/125226 2019-11-06 2020-10-30 数据加密、解密和共享方法、设备、系统及存储介质 WO2021088728A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911077124.9A CN112787976B (zh) 2019-11-06 2019-11-06 数据加密、解密和共享方法、设备、系统及存储介质
CN201911077124.9 2019-11-06

Publications (1)

Publication Number Publication Date
WO2021088728A1 true WO2021088728A1 (zh) 2021-05-14

Family

ID=75747600

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/125226 WO2021088728A1 (zh) 2019-11-06 2020-10-30 数据加密、解密和共享方法、设备、系统及存储介质

Country Status (2)

Country Link
CN (1) CN112787976B (zh)
WO (1) WO2021088728A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572618A (zh) * 2021-08-10 2021-10-29 东北大学 结合Fabric和IPFS的去中心化存储系统及其数据存储方法
CN113783847A (zh) * 2021-08-24 2021-12-10 上海浦东发展银行股份有限公司 消息交互方法、装置、计算机设备和存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113507468A (zh) * 2021-07-08 2021-10-15 上海欧冶金融信息服务股份有限公司 一种基于区块链技术的加密方法、解密方法及授权方法
CN113949552A (zh) * 2021-10-13 2022-01-18 广州广电运通金融电子股份有限公司 一种大文件加解密系统、方法、存储介质和设备
CN114285555A (zh) * 2021-12-15 2022-04-05 支付宝(杭州)信息技术有限公司 基于区块链的组播方法及装置
CN114254365A (zh) * 2021-12-26 2022-03-29 迅鳐成都科技有限公司 基于区块链技术的键值数据定向分享方法、装置、系统及存储介质
CN114331480A (zh) * 2022-03-15 2022-04-12 北京市农林科学院信息技术研究中心 农产品溯源数据处理方法和系统
CN115374462B (zh) * 2022-10-20 2023-01-24 武汉耳东信息科技有限公司 一种基于金融服务数据的存储管理系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107294709A (zh) * 2017-06-27 2017-10-24 阿里巴巴集团控股有限公司 一种区块链数据处理方法、装置及系统
CN109450910A (zh) * 2018-11-26 2019-03-08 远光软件股份有限公司 基于区块链的数据共享方法、数据共享网络及电子设备
CN109587132A (zh) * 2018-11-29 2019-04-05 苏宁易购集团股份有限公司 一种基于联盟链的数据传递方法及装置
WO2019147477A1 (en) * 2018-01-26 2019-08-01 Alibaba Group Holding Limited Blockchain system and data processing method for blockchain system
WO2019179277A1 (zh) * 2018-03-19 2019-09-26 华为技术有限公司 一种数据访问权限的控制方法和装置

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10841082B2 (en) * 2015-11-24 2020-11-17 Adi BEN-ARI System and method for blockchain smart contract data privacy
US10992649B2 (en) * 2016-04-01 2021-04-27 Consensys Software Inc. Systems and methods for privacy in distributed ledger transactions
CN107579952A (zh) * 2017-07-17 2018-01-12 招商银行股份有限公司 报文发送方法、报文处理方法和系统及存储介质
CN109462472A (zh) * 2017-09-06 2019-03-12 阿里巴巴集团控股有限公司 数据加密和解密的方法、装置和系统
CN110100422B (zh) * 2017-12-28 2021-11-05 达闼机器人有限公司 基于区块链智能合约的数据写入方法、装置及存储介质
CN108259169B (zh) * 2018-01-09 2021-07-20 北京大学深圳研究生院 一种基于区块链云存储的文件安全分享方法及系统
CN109033855B (zh) * 2018-07-18 2020-02-11 腾讯科技（深圳）有限公司 一种基于区块链的数据传输方法、装置及存储介质
CN109120639B (zh) * 2018-09-26 2021-03-16 众安信息技术服务有限公司 一种基于区块链的数据云存储加密方法及系统
CN110061845A (zh) * 2019-03-14 2019-07-26 深圳壹账通智能科技有限公司 区块链数据加密方法、装置、计算机设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107294709A (zh) * 2017-06-27 2017-10-24 阿里巴巴集团控股有限公司 一种区块链数据处理方法、装置及系统
WO2019147477A1 (en) * 2018-01-26 2019-08-01 Alibaba Group Holding Limited Blockchain system and data processing method for blockchain system
WO2019179277A1 (zh) * 2018-03-19 2019-09-26 华为技术有限公司 一种数据访问权限的控制方法和装置
CN109450910A (zh) * 2018-11-26 2019-03-08 远光软件股份有限公司 基于区块链的数据共享方法、数据共享网络及电子设备
CN109587132A (zh) * 2018-11-29 2019-04-05 苏宁易购集团股份有限公司 一种基于联盟链的数据传递方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572618A (zh) * 2021-08-10 2021-10-29 东北大学 结合Fabric和IPFS的去中心化存储系统及其数据存储方法
CN113572618B (zh) * 2021-08-10 2022-11-18 东北大学 结合Fabric和IPFS的去中心化存储系统及其数据存储方法
CN113783847A (zh) * 2021-08-24 2021-12-10 上海浦东发展银行股份有限公司 消息交互方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
CN112787976A (zh) 2021-05-11
CN112787976B (zh) 2023-04-07

Similar Documents

Publication Publication Date Title
WO2021088728A1 (zh) 数据加密、解密和共享方法、设备、系统及存储介质
CN111181720B (zh) 基于可信执行环境的业务处理方法及装置
WO2021083179A1 (zh) 一种安全多方计算方法、设备、系统及存储介质
US11057189B2 (en) Providing data authorization based on blockchain
CN111082934B (zh) 基于可信执行环境的跨域安全多方计算的方法及装置
US10903976B2 (en) End-to-end secure operations using a query matrix
WO2021017433A1 (zh) 基于智能合约的数据授权方法及装置
CN108055125B (zh) 一种产品信息的加密、解密方法及装置
WO2021197037A1 (zh) 双方联合进行数据处理的方法及装置
WO2021179743A1 (zh) 区块链中账户隐私信息的查询方法及装置
CN108932297B (zh) 一种数据查询、数据共享的方法、装置及设备
Sun et al. Data security and privacy in cloud computing
US20180212753A1 (en) End-To-End Secure Operations Using a Query Vector
US11790106B1 (en) Methods for protecting data
US10250613B2 (en) Data access method based on cloud computing platform, and user terminal
TW202008272A (zh) 區塊鏈交易方法及裝置、電子設備
CN111475850B (zh) 基于智能合约的隐私数据查询方法及装置
CN109995781A (zh) 数据的传输方法、装置、介质以及设备
US10762231B2 (en) Protecting screenshots of applications executing in a protected workspace container provided in a mobile device
WO2022237558A1 (zh) 一种基于区块链的用户要素认证的方法及装置
CN111740815A (zh) 基于密文的两方秘密分享方法、装置、设备及存储介质
CN115296794A (zh) 基于区块链的密钥管理方法及装置
US10848312B2 (en) Zero-knowledge architecture between multiple systems
CN111008386A (zh) 一种基于区块链管理户籍的方法、设备及介质
CN115131029A (zh) 基于区块链的数字文件签署方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20885863

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20885863

Country of ref document: EP

Kind code of ref document: A1