WO2021098152A1

WO2021098152A1 - Blockchain-based data processing method, device, and computer apparatus

Info

Publication number: WO2021098152A1
Application number: PCT/CN2020/087739
Authority: WO
Inventors: 赖骏; 王梦寒; 高建欣
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2019-11-21
Filing date: 2020-04-29
Publication date: 2021-05-27
Also published as: CN111212026A

Abstract

Embodiments of the present application provide a blockchain-based data processing method, a device, and a computer apparatus. First-level nodes and second-level nodes of a blockchain are deployed at a data supervision end and a data providing end. The method comprises: dividing original data into multiple pieces of subdata; generating multiple sub-keys corresponding to the multiple pieces of sub-data; encrypting, by using the sub-keys, the multiple pieces of sub-data, respectively, and generating multiple ciphertexts; sending to the first-level nodes of the blockchain the ciphertexts; determining whether the data supervision end has supervision permission of all of the pieces of subdata, and if not, determining, from the multiple pieces of subdata, first subdata of which the data supervision end has supervision permission; and sending to a second-level node corresponding to the data supervision end a first sub-key corresponding to the first subdata, such that the second-level node corresponding to the data supervision end is capable of decrypting, by using the first sub-key, a ciphertext corresponding to the first subdata. The method enables dividing original data and independently uploading the divided data to a blockchain, thereby enhancing flexibility of encryption data processing.

Description

Block chain-based data processing method, device and computer equipment

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on November 21, 2019, the application number is 201911149572.5, and the invention title is "Blockchain-based data processing methods, devices, and computer equipment". The entire content of the application is approved The reference is incorporated in this application.

Technical field

This application relates to the field of blockchain, and in particular to a data processing method, device and computer equipment based on blockchain.

Background technique

For a blockchain network with a supervision mechanism, the data uploaded by the data provider needs to be monitored by the data supervisor. In order to prevent your sensitive data from being randomly accessed by other non-supervisors in the blockchain, you must keep your own data Encrypted on the chain, the authorization key is adopted for the data that needs to be obtained, and the supervisor can view the encrypted data corresponding to the key on the chain after obtaining the key. In the traditional encryption authorization method, the entire piece of business data must be authorized to the supervisor at the same time, which ensures the overall security and independence of each piece of encrypted data. However, in actual business requirements, the inventor realized that in the case where there are multiple supervisors and each supervisor has different supervisory authority, if you want different supervisors to supervise different content in the same piece of business data, for example, in the same piece of business data For content with different attributes, the same piece of business data must be split and sent to the blockchain, and because these multiple pieces of data belong to the same piece of business data and are related to each other, and they need to be managed after being split. The relationship between data, such an operation is more complicated, which brings a lot of trouble to the encrypted data processing of the business side, and reduces the flexibility of encrypted data processing.

Summary of the invention

The embodiments of the present application provide a blockchain-based data processing method, device, storage medium, and computer equipment, which are used to solve the problem of low flexibility in encrypted data processing in the prior art.

In the first aspect, the embodiments of the present application provide a data processing method based on a blockchain. The blockchain includes a first-level node and a second-level node, and both the data monitoring end and the data providing end are configured with corresponding first-level nodes And a secondary node, wherein the secondary node corresponding to the data supervisory terminal is used to establish a connection between the data supervisory terminal and its corresponding primary node, and the secondary node corresponding to the data provider uses To establish a connection between the data provider and its corresponding first-level node; the method is applied to the data provider, and the method includes:

Acquiring original data, and dividing the original data into multiple sub-data;

Generating a plurality of sub-keys corresponding to the plurality of sub-data in a one-to-one manner;

Respectively encrypting each sub-data of the plurality of sub-data by using the plurality of sub-keys to generate a plurality of ciphertexts corresponding to the plurality of sub-data in a one-to-one manner;

Sending the multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

Determine whether the data supervisory terminal has supervisory authority for all the sub-data, and if not, determine the first sub-data for which the data supervisory end has supervisory authority among the plurality of sub-data;

The first subkey corresponding to the first subdata among the plurality of subkeys is sent to the secondary node corresponding to the data supervisory end, so that the secondary node corresponding to the data supervisory end can use all The first subkey decrypts the ciphertext corresponding to the first subdata to obtain the plaintext and returns the plaintext to the data supervisory end.

In the second aspect, an embodiment of the present application provides a block chain-based data encryption device, including:

The blockchain includes a first-level node and a second-level node. The data monitoring end and the data providing end are both configured with corresponding first-level nodes and second-level nodes, wherein the second-level node corresponding to the data monitoring end is used to establish The connection between the data supervisory terminal and its corresponding primary node, and the secondary node corresponding to the data provider is used to establish a connection between the data provider and its corresponding primary node; The data encryption device is applied to the data provider, and the data encryption device includes:

The dividing module is used to obtain original data and divide the original data into multiple sub-data;

The first generating module is configured to generate a plurality of sub-keys corresponding to the plurality of sub-data in a one-to-one manner;

A second generation module, configured to use the plurality of subkeys to respectively encrypt each subdata in the plurality of subdata, and generate a plurality of ciphertexts corresponding to the plurality of subdata in a one-to-one manner;

The first sending module is configured to send the multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

The determining module is used to determine whether the data monitoring terminal has the monitoring authority of all the sub-data, and if not, determining the first sub-data for which the data monitoring terminal has the monitoring authority among the plurality of sub-data; and

The second sending module is configured to send the first subkey corresponding to the first subdata among the plurality of subkeys to the secondary node corresponding to the data supervisory end, so that the data supervisory end corresponds to The secondary node of can use the first subkey to decrypt the ciphertext corresponding to the first subdata to obtain the plaintext and return the plaintext to the data supervisory end.

In a third aspect, an embodiment of the present application provides a storage medium, the storage medium includes a stored program, wherein the device where the storage medium is located is controlled to execute the above method when the program is running.

In a fourth aspect, an embodiment of the present application provides a computer device, including a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and the program instructions are processed. The above method is implemented when the processor is loaded and executed.

It can be understood that, in the embodiment of the present application, when data encryption is implemented, the original data is divided into different sub-data according to preset rules, and then multiple sub-keys are generated, and the sub-keys are used to pair multiple sub-data. Encryption, to realize separate encryption of multiple sub-data of a piece of original data, so that multiple sub-data of the same piece of business data can be decrypted separately using corresponding sub-keys, and further realize the separate realization of different sub-data of the same piece of business data. Compared with traditional technology, in the same piece of business data, if you only want the supervisor to access only part of the content, you must split the data into a separate processing method on the chain, which can greatly improve the efficiency and efficiency of encrypted data processing. Ease of access.

In addition, this application sets up the second-level node to connect the first-level node with the data supervisory end and the data provider, so that the data supervisory end and the data provider only need to connect to the blockchain through the node. This connection method reduces the data supervisory end. The difficulty of docking the blockchain transformation corresponding to the data provider, saving implementation time and manpower. At the same time, the data monitoring terminal and the data provider are not directly connected to the first-level nodes of the blockchain, which can further ensure the first-level nodes The security of the data stored inside.

Description of the drawings

Figure 1 is a flowchart of a blockchain-based data processing method provided by an embodiment of the application;

2 is a schematic block diagram of a data encryption device provided by an embodiment of the application;

Fig. 3 is a schematic block diagram of a computer device provided by an embodiment of the application.

Specific embodiment

In order to better understand the technical solutions of the present application, the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

The embodiment of the application provides a data processing method based on a blockchain, wherein the blockchain includes a first-level node and a second-level node, and the data monitoring end and the data providing end are both configured with corresponding first-level nodes and second-level nodes. Nodes, where the secondary node configured by the data supervisory terminal is used to establish the connection between the data supervisory terminal and its configured primary node, and the secondary node configured by the data provider terminal is used to establish the data provider and its configured primary node The connection between the first-level nodes.

The blockchain in the implementation of this application can specifically refer to a P2P network system with a distributed data storage structure reached by each node through a consensus mechanism. The data in the blockchain is distributed in time-connected “blocks”. Within (block)”, the next block contains the data summary of the previous block, and according to the specific consensus mechanism (such as POW, POS, DPOS, or PBFT, etc.), a full backup of all or part of the node data is achieved. Those skilled in the art are well aware that because the blockchain system operates under the corresponding consensus mechanism, the data that has been included in the blockchain database is difficult to be tampered with by any node, so the blockchain system has other centralized database systems. Comparable to ensure data security, anti-attack and tamper-proof features. It can be seen that in the embodiments provided in this specification, the "information" provided by the data provider and included by the first-level nodes of the blockchain will not be attacked or tampered with, thereby ensuring the authenticity and fairness of supervision Sex.

The primary node of the blockchain in the embodiment of the application is an electronic device that stores data on the blockchain, such as a tablet computer, a personal computer (PC) or other smart devices, etc., the second of the blockchain The level node is a server or terminal used to establish the connection between the data supervisory end/data provider and the level one node and to store the key.

The data supervision terminal in the embodiment of this application is the terminal where the institution performing supervision duties in the information supervision is located. The data provider of the embodiment provided in this solution can be the supervised terminal in the information supervision or the supervised terminal. Other terminals that have a data connection to the terminal, such as a smart phone, a tablet, a personal computer (PC) or other smart devices, etc., and the "information" provided by the data provider is the object information data to be supervised.

In the embodiment of the present application, there may be multiple data supervisory terminals or data providers connected to the blockchain, and each data supervisory terminal or data provider connected to the blockchain is configured with a corresponding independent secondary node. , Each data supervisory end or data provider connected to the blockchain can be configured with an independent first-level node, or multiple data supervisory end or data provider can share one node.

In the embodiment of this application, the central Ministry of Finance system (Public-Private-Partnership, PPP) and the provincial Ministry of Finance system are the data supervision end, and each social capital party, financial institution, project company, intermediary institution, and shareholder system are different Data provider.

In the embodiment of the present application, the blockchain also includes a management node, and the management node of the blockchain will manage each secondary node through the CA digital certificate to verify its legitimacy. When the secondary node is connected to the blockchain, the legality of the CA digital certificate of the secondary node will be verified. If it is legal, the connection between the secondary node and the primary node will be established, and the connection will no longer be correct during the time the connection is maintained. The CA digital certificate is verified. If the secondary node disconnects from the primary node, it needs to verify the validity of the CA digital certificate when requesting the connection again. Among them, the CA digital certificate has a certificate (including a public key) and a private key, and the secondary node corresponding to the CA digital certificate is trusted by verifying the signature of the CA digital certificate.

In the embodiment of the present application, the data processing method takes the data provider as the execution subject, and the data processing method includes:

Step S01: Obtain original data, and divide the original data into multiple sub-data.

Step S02: Generate multiple sub-keys corresponding to multiple sub-data one-to-one.

Step S03: Encrypt each sub-data in the multiple sub-data by using multiple sub-keys to generate multiple ciphertexts corresponding to the multiple sub-data one-to-one.

Step S04: Send multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node, so that each first-level node saves the ciphertext.

Step S05: Determine whether the data supervisory terminal has supervisory authority for all sub-data. If the data supervisory end does not have supervisory authority for all sub-data, then the first sub-data is determined in the sub-data. The first sub-data is that the data supervisory end has supervisory authority Permission data;

Step S06: Send the first subkey corresponding to the first subdata among the multiple subkeys to the secondary node corresponding to the data supervisory terminal, so that the secondary node corresponding to the data supervisory terminal can use the first subkey pair The ciphertext corresponding to the first sub-data is decrypted to obtain the plaintext and return the plaintext to the data supervisory end.

It can be understood that, when implementing data encryption, the embodiment of the present application divides the original data into different sub-data according to preset rules, and then generates multiple sub-keys, and uses the sub-keys to encrypt multiple sub-data, so as to realize one piece of data. Separately encrypt multiple sub-data of the original data, so that multiple sub-data of the same piece of business data can be decrypted separately using the corresponding sub-key, and further realize separate access to different sub-data of the same piece of business data. Compared with traditional technology, In the same piece of business data, if the supervisor only wants to access part of the content and must split the data into a separate processing method, it can greatly improve the efficiency of encrypted data processing and the convenience of access.

The specific implementation of a blockchain-based data processing method provided by an embodiment of the present application will be described in more detail below with reference to FIG. 1.

First, perform step S01: obtain original data, and divide the original data into multiple sub-data.

Specifically, in this embodiment, the original data includes, but is not limited to, data generated during the project process such as project name, project type, project amount, project feasibility report, environmental impact assessment report, value for money assessment report, etc.

Further, step S01: dividing the original data into multiple sub-data, which may specifically include:

Step S011: Determine whether the original data is in JSON format;

Step S012: If not, convert the original data into JSON format;

Step S013: Use each key-value pair in the converted original data in the JSON format as a sub-data to divide the original data into multiple sub-data.

Further, if the original data is in the JSON format, the original data can be split into different parts according to the key-value pairs in the JSON format to obtain different sub-data, that is, each key-value pair in the JSON format is used as a sub-data. data. If the original data is not in JSON format, the original data is converted into a key-value pair format, that is, the object in the original data is used as the Key, and the value or attribute of the object is used as the Value. For example, if the original data is in an array format, after converting the array format of this data into a JSON object, the Key value is the index in the array, and the Value is the value corresponding to the array. After converting the data to be encrypted into key-value pairs, each key-value pair is used as a sub-data, and the data to be encrypted is divided into multiple sub-data to further realize the flexible authorization of the data corresponding to the sub-data by encrypting different sub-data . The way to divide the sub-data can be based on the attributes of the data. For example, the data of the same business attribute is in JSON format, and each key-value pair (that is, a key-value pair) of JSON is used as a sub-data (in English) For Field).

What you need to know is that sub-data refers to the data range that is encrypted with a key for independent authorization. For example, the two columns of item name and unit price can each be a sub-data. Among them, JSON, English is JavaScript Object Notation, JS Object Notation, is a lightweight data exchange format, and the writing format of JSON data is: name/value pair.

Then, step S02 is performed: multiple subkeys corresponding to the multiple subdata one-to-one are generated.

Specifically, step S02: generating multiple sub-keys corresponding to multiple sub-data in one-to-one correspondence may specifically include:

Step S021: Generate the root key, initial parameters and agreed step value corresponding to the original data;

Specifically, the initial parameter can be a random number with a fixed length generated instantly by the random number generator inside the data provider, such as 342. The initial parameter and the agreed step value can be preset or instantaneous like the initial parameter. generate.

Step S022: Based on the preset sub-key derivation mechanism, perform iterative operations on the root key, the initial parameters, and the agreed step value to generate multiple sub-keys corresponding to multiple sub-data one-to-one.

Specifically, in the embodiment of the present application, the process of performing iterative operations on the root key, initial parameters, and agreed step value to generate multiple sub-keys corresponding to multiple sub-data is specifically: combining the root key and The initial parameters are substituted into the preset first function to obtain the first subkey. At the same time, the initial parameters and the agreed step value are added together to obtain the first variable; then the root key and the first variable are substituted into In the preset first function, the second subkey is obtained, and the first variable and the agreed step value are added together to obtain the second variable; then the root key and the second variable are substituted into the preset In the first function, the third subkey is obtained, and so on, until a preset number of subkeys are generated.

For example, when the number of sub-data is 3, calculate Key1=BootKey+f(V0), where BootKey is the root key, and V0 is the initial parameter to obtain the first sub-key Key1; then, calculate V1= V0+StepFactor, where StepFactor is the agreed step value, the first variable V1 is obtained, and Key2=BootKey+f(V1) is calculated to obtain the second subkey Key2; then, V2=V1+StepFactor is calculated to obtain the first variable V2, calculate Key3=BootKey+f(V2) to obtain the third subkey Key3.

Furthermore, step S021: generating a root key corresponding to the original data may specifically include:

Step S0211: Obtain the password entered by the user and generate a random number;

The password can be obtained by the user pressing or clicking on the touchable display screen, or inputting through the physical keyboard, and the random number is generated by the random number generating unit inside the data provider.

In the implementation of the present application, the password entered by the user may be obtained first, and then the random number is generated, or the random number is generated first, and then the password entered by the user is obtained, which is not limited in this application.

Step S0212: randomly select a first preset algorithm from a plurality of preset algorithms, and calculate a password and a random number based on the first preset algorithm to obtain a root key, wherein each of the plurality of preset algorithms is preset The algorithm corresponds to a unique algorithm identifier;

Multiple preset algorithms may include, but are not limited to, KDF (Key Derivation Function, key derivation algorithm) algorithm, bcrypt encryption algorithm, Blowfish algorithm, DES algorithm, DESede algorithm, HmacMD5 algorithm, or HmacSHA1 algorithm. Each algorithm corresponds to a unique algorithm. The algorithm ID of the algorithm, such as 1, 2, 3, etc., uses the password and random number input by the user as the input data of the preset algorithm, and then obtains the root key. Taking KDF algorithm as the first budget method as an example, calculate BootKey=PBKDF2(Password, Salt, it), where Password is the password entered by the user, Salt is a random number generated internally, it is the number of iterations, and the number of iterations can be based on user needs Specify.

Step S0213: Store the random number and the algorithm identifier corresponding to the first preset algorithm in the corresponding secondary node.

Further, after the data provider sends the generated subkey to the corresponding data supervisory end with supervisory authority, the data provider also deletes the calculated first root key.

When the data provider itself needs to query one or more sub-data in the original data, the data provider obtains the ciphertext corresponding to the sub-data that needs to be queried from its configured secondary node, and then decrypts it. The decryption process includes: generation Prompt information to prompt the user to enter the corresponding password. The password is the password the user entered when uploading the corresponding original data. According to the stored algorithm identifier corresponding to the first preset algorithm, it is determined that the first preset algorithm is determined in the plurality of preset algorithms. Set the algorithm, and then use the password input by the user and the stored random number as the input data of the first preset algorithm to obtain the root key, and then obtain the corresponding subkey through the root key operation, and then decrypt it by the subkey. Get the corresponding plaintext, that is, the sub-data.

It can be understood that since the root key is the foundation of the entire original data key system, storing the root key will bring hidden dangers to the security protection of the root key and increase security risks. Therefore, this application does not directly store the root key, but instead stores the parameters (such as random numbers) and algorithm identifications for generating the root key, which will greatly improve the security of the entire system. Attackers cannot steal the root key, and cannot crack other keys in the entire key system. At the same time, the secondary node generated by the data provider cannot store all the sub-keys and other information, which can reduce the use of storage space. In addition, this application increases the flexibility and security of generating the root key by using the user's input password as the root key generation parameter.

Then, step S03 is performed: each sub-data in the multiple sub-data is respectively encrypted with multiple sub-keys to generate multiple ciphertexts corresponding to the multiple sub-data one-to-one.

Specifically, for example, if multiple sub-data are respectively the project name, project amount, and company name, then Key1 can be used to encrypt the project name, so Key1 can be used to access the project name separately; Key2 is used to encrypt the project amount Therefore, Key2 can be used to access the project amount separately, and Key3 can be used to encrypt the company name. Therefore, Key3 can be used to access the company name individually, so that different sub-data can be respectively encrypted with different sub-keys to realize the pairing. Different sub-data of the same piece of business data use separate keys for separate authorization and access.

Next, perform step S04: send multiple ciphertexts to each primary node of the blockchain through the corresponding secondary node, and each primary node of the blockchain saves the ciphertext after receiving the ciphertext.

More specifically, when each first-level node saves the ciphertext, different indexes will be established for different ciphertexts, so that the data supervisory end and the data provider can both query the corresponding ciphertext according to different indexes.

Next, perform step S05: determine whether the data supervisory terminal has supervisory authority for all sub-data, and if not, determine the first sub-data for which the data supervisory end has supervisory authority among the multiple sub-data.

In the implementation of the present application, the data monitoring terminal's monitoring authority for the sub-data may be set by the user. For example, after the data provider divides the original data into multiple sub-data, each sub-data is displayed on the display interface for The user views and selects the sub-data to be authorized by each data supervisory terminal.

Further, the data processing method further includes: if the data supervisory end has supervisory authority for all sub-data, sending the generated root key, initial parameters, and agreed step value to the data supervisory end, so that the data supervisory end can according to the sub-secret. The key derivation mechanism performs iterative operations on the root key, initial parameters, and agreed step values to obtain the sub-key corresponding to each sub-data and save the sub-key corresponding to each sub-data in its corresponding secondary node, and then Delete the root key, where both the data supervisory terminal and the data provider are configured with algorithms corresponding to the subkey derivation mechanism.

It can be understood that if the data supervisory end has the supervisory authority of all sub-data, the generated root key, initial parameters and agreed step value will be sent to the corresponding secondary node of the data supervisory end, so that the corresponding data supervisory end can be based on The root key, the initial parameters and the agreed step value obtain the sub-key corresponding to each sub-data, thereby obtaining the plaintext of each sub-data. There is no need for the data provider to send the subkey corresponding to each subdata to the corresponding secondary node of the data supervisory terminal, so as to reduce the data transmission load of the communication network and the storage space usage of each secondary node.

Then, step S06 is performed: the first subkey corresponding to the first subdata among the multiple subkeys is sent to the secondary node corresponding to the data supervisory end, so that the secondary node corresponding to the data supervisory end can adopt the first subkey The key decrypts the ciphertext corresponding to the first sub-data to obtain the plaintext and returns the plaintext to the data supervisory end.

Further, in order to further improve security, before the data provider sends the generated root key, initial parameters, and agreed step value to the corresponding secondary node of the data supervisory end, or the subkeys are combined with the first Before the first subkey corresponding to a subdata is sent to the secondary node configured by the data supervisory terminal, the secondary node corresponding to the data supervisory terminal and the secondary node corresponding to the data provider will also provide the data supervisory terminal and the data provider respectively. The specific process for the secondary node corresponding to the data provider to verify the data provider includes: the secondary node corresponding to the data provider determines whether the data provider is within the legal period, and if not, the data provider The end sends a token verification request, and the secondary node corresponding to the data provider receives the token of the data provider and judges whether the token of the data provider is legal. If the token of the data provider is legal, then Confirm that the data provider has passed the verification; similarly, the specific process for the secondary node corresponding to the data monitoring terminal to verify the data monitoring terminal includes: the secondary node corresponding to the data monitoring terminal judges whether the data monitoring terminal is within the legal period, if not, to The data supervisory end sends a token verification request, and the corresponding secondary node of the data supervisory end receives the token (token) of the data supervisory end, and judges whether the token of the data supervisory end is legal, if the token of the data supervisory end is legal , It is determined that the data supervisory terminal has passed the verification. After both the data provider and the data supervisory end have passed the verification, the data provider will send the generated root key, initial parameters and agreed step value to the corresponding secondary node of the data supervisory end, or combine multiple subkeys with The first subkey corresponding to the first subdata is sent to the secondary node configured by the data supervisory end.

It should be noted that, in the data encryption method of each of the foregoing embodiments, the technical features contained in different embodiments can be recombined as needed to obtain a combined implementation solution, but they are all within the scope of protection required by this application.

Please refer to Figure 2. This application provides a block chain-based data encryption device 1, including:

The blockchain includes a first-level node and a second-level node. The data monitoring terminal and the data providing terminal are equipped with corresponding first-level nodes and second-level nodes. Among them, the second-level node corresponding to the data monitoring terminal is used to establish the data monitoring terminal and For the connection between the corresponding primary nodes, the secondary node corresponding to the data provider is used to establish the connection between the data provider and its corresponding primary node; the data encryption device is applied to the data provider, and the data encryption device 1 includes:

The dividing module 11 is used to obtain original data and divide the original data into multiple sub-data;

The first generating module 12 is configured to generate a plurality of sub-keys corresponding to a plurality of sub-data in a one-to-one manner;

The second generating module 13 is configured to use a plurality of subkeys to respectively encrypt each subdata of the plurality of subdata, and generate a plurality of ciphertexts corresponding to the plurality of subdata one to one;

The first sending module 14 is configured to send multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

The determining module 15 is used to determine whether the data supervisory terminal has the supervisory authority of all sub-data, if not, determine the first sub-data of the data supervisory end with supervisory authority among the multiple sub-data; and

The second sending module 16 is configured to send the first subkey corresponding to the first subdata among the plurality of subkeys to the secondary node corresponding to the data supervisory terminal, so that the secondary node corresponding to the data supervisory terminal can adopt the first subkey A subkey decrypts the ciphertext corresponding to the first subdata to obtain the plaintext and returns the plaintext to the data supervisory terminal.

Further, the dividing module 11 includes:

The judging unit is used to judge whether the original data is in JSON format;

The conversion unit is used to convert the original data into the JSON format when the original data is not in the JSON format; and

The dividing unit is used to treat each key-value pair in the converted original data in the JSON format as a sub-data to divide the original data into multiple sub-data.

Further, the first generating module 12 includes:

The generating unit is used to generate the root key, initial parameters and agreed step value corresponding to the original data; and

The first arithmetic unit is configured to perform iterative operations on the root key, initial parameters, and agreed step values based on a preset sub-key derivation mechanism to generate multiple sub-keys corresponding to multiple sub-data one-to-one.

Further, the generating unit includes:

The obtaining subunit is used to obtain the password entered by the user and generate a random number;

The operation subunit is used to randomly select the first preset algorithm from a plurality of preset algorithms, and calculate the password and the random number based on the first preset algorithm to obtain the root key, wherein each of the plurality of preset algorithms Each preset algorithm corresponds to a unique algorithm identifier; and

The saving subunit is used to save the random number and the algorithm identifier corresponding to the first preset algorithm in the corresponding secondary node.

Optionally, the data encryption device 1 further includes: a third sending module, configured to send the generated root key, initial parameters and agreed step value to the data supervisory end when the data supervisory end has supervisory authority for all sub-data , Enabling the data supervisor to perform iterative operations on the root key, initial parameters, and agreed step value according to the sub-key derivation mechanism to obtain the sub-key corresponding to each sub-data, and save each sub-key in its corresponding Within the secondary node.

The embodiment of the present application provides a storage medium. The storage medium may be non-volatile or volatile. The storage medium includes a stored program, wherein the device where the storage medium is located is controlled to execute the implementation while the program is running. Data processing methods in.

Referring to FIG. 3, an embodiment of the present application provides a computer device. The computer device 50 of this embodiment includes a processor 51, a memory 52, and a computer program 53 stored in the memory 52 and running on the processor 51. When the computer program 53 is executed by the processor 51, the blockchain-based data processing method in the embodiment is implemented. In order to avoid repetition, it will not be repeated here. Alternatively, when the computer program is executed by the processor 51, the function of each model/unit in the data processing apparatus 1 in the embodiment is realized. In order to avoid repetition, it will not be repeated here.

The computer device 50 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The computer device 50 may include but is not limited to a processor 51 and a memory 52. Those skilled in the art can understand that FIG. 3 is only an example of the computer device 50, and does not constitute a limitation on the computer device 50. It may include more or less components than shown, or a combination of certain components, or different components. For example, computer equipment may also include input and output devices, network access devices, buses, and so on.

The so-called processor 51 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.

The memory 52 may be an internal storage unit of the computer device 50, such as a hard disk or memory of the computer device 50. The memory 52 may also be an external storage device of the computer device 50, such as a plug-in hard disk equipped on the computer device 50, a smart memory card (Smart Media Card, SMC), a Secure Digital (SD) card, and a flash memory card (Flash). Card) and so on. Further, the memory 52 may also include both an internal storage unit of the computer device 50 and an external storage device. The memory 52 is used to store computer programs and other programs and data required by the computer equipment. The memory 52 can also be used to temporarily store data that has been output or will be output.

Those skilled in the art can clearly understand that, for the convenience and conciseness of the description, the specific working process of the above-described system, device, and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.

The above-mentioned integrated unit implemented in the form of a software functional unit may be stored in a computer readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (Processor) execute part of the steps of the methods in the various embodiments of the present application . The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disks or optical disks and other media that can store program codes. .

The above are only preferred embodiments of this application, and are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the protection of this application. Within range.

Claims

A data processing method based on a blockchain. The blockchain includes a first-level node and a second-level node. Both the data monitoring end and the data-providing end are configured with corresponding first-level nodes and second-level nodes, wherein the data The secondary node corresponding to the supervisory terminal is used to establish a connection between the data supervisory terminal and its corresponding primary node, and the secondary node corresponding to the data provider is used to establish the data provider and its corresponding The connection between the first-level nodes; the method is applied to the data provider, and the method includes:

Acquiring original data, and dividing the original data into multiple sub-data;

Generating a plurality of sub-keys corresponding to the plurality of sub-data in a one-to-one manner;

Respectively encrypting each sub-data of the plurality of sub-data by using the plurality of sub-keys to generate a plurality of ciphertexts corresponding to the plurality of sub-data one-to-one;

Sending the multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

Determine whether the data supervisory terminal has supervisory authority for all the sub-data, and if not, determine the first sub-data for which the data supervisory end has supervisory authority among the plurality of sub-data;

The first subkey corresponding to the first subdata among the plurality of subkeys is sent to the secondary node corresponding to the data supervisory end, so that the secondary node corresponding to the data supervisory end can use all The first subkey decrypts the ciphertext corresponding to the first subdata to obtain the plaintext and returns the plaintext to the data supervisory end.
The method of claim 1, wherein the dividing the original data into a plurality of sub-data includes:

Determine whether the original data is in JSON format;

If not, convert the original data into JSON format;

Each key-value pair in the converted original data in the JSON format is used as a sub-data to divide the original data into a plurality of sub-data.
The method according to claim 1, wherein said generating a plurality of sub-keys corresponding to said plurality of sub-data includes:

Generating a root key, initial parameters, and agreed step value corresponding to the original data;

Based on a preset sub-key derivation mechanism, the root key, the initial parameter, and the agreed step value are iteratively operated to generate a plurality of sub-keys corresponding to the plurality of sub-data one-to-one.
The method according to claim 3, wherein said generating a root key corresponding to said original data comprises:

Obtain the password entered by the user and generate a random number;

A first preset algorithm is randomly selected from a plurality of preset algorithms, and the password and the random number are calculated based on the first preset algorithm to obtain the root key, wherein the plurality of preset algorithms Each preset algorithm in the algorithm corresponds to a unique algorithm identifier;

The random number and the algorithm identifier corresponding to the first preset algorithm are stored in the corresponding secondary node.
The method according to claim 1, the method further comprising: if the data supervisory terminal has supervisory authority for all the sub-data, then the generated root key, the initial parameters and the agreed step The input value is sent to the data supervisory end, so that the data supervisory end can perform iterative operations on the root key, the initial parameters, and the agreed step value according to the sub-key derivation mechanism to obtain each Sub-keys corresponding to each sub-data, and each sub-key is stored in its corresponding secondary node.
A data encryption device based on a block chain. The block chain includes a first-level node and a second-level node. Both the data monitoring end and the data providing end are configured with corresponding first-level nodes and second-level nodes, wherein the data The secondary node corresponding to the supervisory terminal is used to establish a connection between the data supervisory terminal and its corresponding primary node, and the secondary node corresponding to the data provider is used to establish the data provider and its corresponding The connection between the first-level nodes; the data encryption device is applied to the data provider, and the data encryption device includes:

The dividing module is used to obtain original data and divide the original data into multiple sub-data;

The first generating module is configured to generate a plurality of sub-keys corresponding to the plurality of sub-data in a one-to-one manner;

A second generation module, configured to use the plurality of subkeys to respectively encrypt each subdata in the plurality of subdata, and generate a plurality of ciphertexts corresponding to the plurality of subdata in a one-to-one manner;

The first sending module is configured to send the multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

The determining module is used to determine whether the data monitoring terminal has the monitoring authority of all the sub-data, and if not, determining the first sub-data for which the data monitoring terminal has the monitoring authority among the plurality of sub-data; and

The second sending module is configured to send the first subkey corresponding to the first subdata among the plurality of subkeys to the secondary node corresponding to the data supervisory end, so that the data supervisory end corresponds to The secondary node of can use the first subkey to decrypt the ciphertext corresponding to the first subdata to obtain the plaintext and return the plaintext to the data supervisory end.
7. The data encryption device according to claim 6, wherein the dividing module comprises:

The judging unit is used to judge whether the original data is in JSON format;

The conversion unit is configured to convert the original data into the JSON format when the original data is not in the JSON format; and

The dividing unit is configured to use each key-value pair in the converted original data in the JSON format as a sub-data, so as to divide the original data into a plurality of the sub-data
7. The data encryption device according to claim 6, wherein the first generating module comprises:

A generating unit for generating the root key, initial parameters, and agreed step value corresponding to the original data; and

The first arithmetic unit is configured to perform iterative operations on the root key, the initial parameter, and the agreed step value based on a preset sub-key derivation mechanism, and generate a plurality of one-to-one with the plurality of sub-data The corresponding subkey.
8. The data encryption device according to claim 8, wherein the generating unit comprises:

The obtaining subunit is used to obtain the password entered by the user and generate a random number;

The operation subunit is configured to randomly select a first preset algorithm from a plurality of preset algorithms, and perform operations on the password and the random number based on the first preset algorithm to obtain the root key, wherein: Each of the plurality of preset algorithms corresponds to a unique algorithm identifier;

The saving subunit is configured to save the random number and the algorithm identifier corresponding to the first preset algorithm in the corresponding secondary node.
7. The data encryption device according to claim 6, the data encryption device further comprising:

The third sending module is configured to send the generated root key, the initial parameter, and the agreed step value to the data supervisor when the data supervisory terminal has supervisory authority for all the sub-data Terminal, enabling the data supervisory terminal to perform iterative operations on the root key, the initial parameters, and the agreed step value according to the subkey derivation mechanism to obtain the subkey corresponding to each subdata, And save each said subkey in its corresponding secondary node.
A storage medium, the storage medium includes a stored program, wherein, when the program is running, the device where the storage medium is located is controlled to execute a blockchain-based data processing method:

Wherein, the blockchain includes a first-level node and a second-level node, and the data monitoring end and the data providing end are configured with corresponding first-level nodes and second-level nodes, and the second-level node corresponding to the data monitoring end is used for To establish a connection between the data supervisory terminal and its corresponding primary node, the secondary node corresponding to the data provider is used to establish a connection between the data provider and its corresponding primary node; The method is applied to the data provider, and the method includes:

Acquiring original data, and dividing the original data into multiple sub-data;

Generating a plurality of sub-keys corresponding to the plurality of sub-data in a one-to-one manner;

Respectively encrypting each sub-data of the plurality of sub-data by using the plurality of sub-keys to generate a plurality of ciphertexts corresponding to the plurality of sub-data one-to-one;

Sending the multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

Determine whether the data supervisory terminal has supervisory authority for all the sub-data, and if not, determine the first sub-data for which the data supervisory end has supervisory authority among the plurality of sub-data;

The first subkey corresponding to the first subdata among the plurality of subkeys is sent to the secondary node corresponding to the data supervisory end, so that the secondary node corresponding to the data supervisory end can use all The first subkey decrypts the ciphertext corresponding to the first subdata to obtain the plaintext and returns the plaintext to the data supervisory end.
11. The storage medium of claim 11, wherein the dividing the original data into a plurality of sub-data includes:

Determine whether the original data is in JSON format;

If not, convert the original data into JSON format;

Each key-value pair in the converted original data in the JSON format is used as a sub-data to divide the original data into a plurality of sub-data.
11. The storage medium of claim 11, wherein the generating a plurality of subkeys corresponding to the plurality of subdata one-to-one includes:

Generating a root key, initial parameters, and agreed step value corresponding to the original data;

Based on a preset sub-key derivation mechanism, the root key, the initial parameter, and the agreed step value are iteratively operated to generate a plurality of sub-keys corresponding to the plurality of sub-data one-to-one.
The storage medium according to claim 13, wherein said generating a root key corresponding to said original data comprises:

Obtain the password entered by the user and generate a random number;

A first preset algorithm is randomly selected from a plurality of preset algorithms, and the password and the random number are calculated based on the first preset algorithm to obtain the root key, wherein the plurality of preset algorithms Each preset algorithm in the algorithm corresponds to a unique algorithm identifier;

The random number and the algorithm identifier corresponding to the first preset algorithm are stored in the corresponding secondary node.
The storage medium according to claim 11, the method further comprising: if the data supervisory terminal has supervisory authority for all the sub-data, then the generated root key, the initial parameters, and the agreement The step value is sent to the data supervisory end, so that the data supervisory end can perform iterative operations on the root key, the initial parameters, and the agreed step value according to the sub-key derivation mechanism to obtain Each sub-data corresponds to a sub-key, and each sub-key is stored in its corresponding secondary node.
A computer device includes a memory and a processor, the memory is used to store information including program instructions, the processor is used to control the execution of the program instructions, and the program instructions are loaded and executed by the processor to implement a zone-based Data processing method of block chain:

Wherein, the blockchain includes a first-level node and a second-level node, and the data monitoring end and the data providing end are configured with corresponding first-level nodes and second-level nodes, and the second-level node corresponding to the data monitoring end is used for To establish a connection between the data supervisory terminal and its corresponding primary node, the secondary node corresponding to the data provider is used to establish a connection between the data provider and its corresponding primary node; The method is applied to the data provider, and the method includes:

Acquiring original data, and dividing the original data into multiple sub-data;

Generating a plurality of sub-keys corresponding to the plurality of sub-data in a one-to-one manner;

Respectively encrypting each sub-data of the plurality of sub-data by using the plurality of sub-keys to generate a plurality of ciphertexts corresponding to the plurality of sub-data one-to-one;

Sending the multiple ciphertexts to each first-level node of the blockchain through the corresponding second-level node;

Determine whether the data supervisory terminal has supervisory authority for all the sub-data, and if not, determine the first sub-data for which the data supervisory end has supervisory authority among the plurality of sub-data;

The first subkey corresponding to the first subdata among the plurality of subkeys is sent to the secondary node corresponding to the data supervisory end, so that the secondary node corresponding to the data supervisory end can use all The first subkey decrypts the ciphertext corresponding to the first subdata to obtain the plaintext and returns the plaintext to the data supervisory end.
The computer device according to claim 16, wherein the dividing the original data into a plurality of sub-data includes:

Determine whether the original data is in JSON format;

If not, convert the original data into JSON format;

Each key-value pair in the converted original data in the JSON format is used as a sub-data to divide the original data into a plurality of sub-data.
The computer device according to claim 16, wherein said generating a plurality of subkeys corresponding to the plurality of subdata one-to-one comprises:

Generating a root key, initial parameters, and agreed step value corresponding to the original data;

Based on a preset sub-key derivation mechanism, the root key, the initial parameter, and the agreed step value are iteratively operated to generate a plurality of sub-keys corresponding to the plurality of sub-data one-to-one.
The computer device according to claim 18, wherein said generating a root key corresponding to said original data comprises:

Obtain the password entered by the user and generate a random number;

A first preset algorithm is randomly selected from a plurality of preset algorithms, and the password and the random number are calculated based on the first preset algorithm to obtain the root key, wherein the plurality of preset algorithms Each preset algorithm in the algorithm corresponds to a unique algorithm identifier;

The random number and the algorithm identifier corresponding to the first preset algorithm are stored in the corresponding secondary node.
The computer device according to claim 16, the method further comprising: if the data supervisory terminal has supervisory authority of all the sub-data, then the generated root key, the initial parameters and the agreement The step value is sent to the data supervisory end, so that the data supervisory end can perform iterative operations on the root key, the initial parameters, and the agreed step value according to the sub-key derivation mechanism to obtain Each sub-data corresponds to a sub-key, and each sub-key is stored in its corresponding secondary node.