WO2021114872A1

WO2021114872A1 - Verifiable claim-based service processing method, apparatus, and device

Info

Publication number: WO2021114872A1
Application number: PCT/CN2020/121874
Authority: WO
Inventors: 杨仁慧; 刘佳伟; 孙善禄
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2019-12-11
Filing date: 2020-10-19
Publication date: 2021-06-17
Also published as: CN111125731A; TW202123040A

Abstract

Disclosed are a verifiable claim-based service processing method, apparatus, and device. The method comprises: receiving a service processing request of a target service, wherein the target service is processed on the basis of a verifiable claim, the service processing request comprises the verifiable claim processed by a first data processing rule, in the verifiable claim processed by the first data processing rule, the field value of a claim field required by the target service is plain text, and the field value of at least one of the remaining claim fields is ciphertext that is encrypted on the basis of a specified hash algorithm; next, verifying the validity of the verifiable claim; and if the verification result is valid, performing a service processing corresponding to the target service on the basis of the field value of the claim field required by the target service in the verifiable claim.

Description

Business processing method, device and equipment based on verifiable statement

Technical field

This specification relates to the field of computer technology, and in particular to a business processing method, device and equipment based on verifiable claims.

Background technique

With the development of digitization, how individuals, organizations or entities define their identities in the network environment and how to effectively protect their private data has become an important issue facing people. Generally, user data generated by using Internet services is almost not controlled by the user, and user identity information is leaked or sold from time to time. For this reason, it is necessary to perform identity verification in the process of data exchange.

Usually, the unique identity verification method of digital identity can be used, but under this identity verification method, it can only be carried out in the same scene or specified scene, and consensus and mutual recognition are often not possible in different scenes. This is the application and management of identity verification. All have brought great inconvenience. Therefore, it is necessary to provide a technical solution that can effectively ensure that user information is stored safely, users can manage their user information, and can controllably present user information to relevant third parties.

Summary of the invention

The purpose of the embodiments of this specification is to provide a business processing method, device, and equipment based on verifiable claims, so as to provide a method that can effectively guarantee that user information is stored safely, that users can manage their user information, and that user information can be controlled. The technical solution presented to the relevant third party.

In order to implement the above technical solutions, the embodiments of this specification are implemented in this way.

The embodiment of this specification provides a business processing method based on a verifiable statement, the method includes: receiving a business processing request of a target business, wherein the target business is processed based on the verifiable statement, and the business processing request includes The verifiable statement processed by the first data processing rule; in the verifiable statement processed by the first data processing rule, the field value of the statement field required by the target business is plain text, and at least one of the remaining statement fields The field value of the declared field is the ciphertext encrypted based on the specified hash algorithm. The validity of the verifiable statement is verified. If the verification result is valid, the business processing corresponding to the target business is executed based on the field value of the statement field required by the target business in the verifiable statement.

The embodiment of this specification provides a business processing method based on a verifiable statement, the method includes: determining the target statement field required by the target business according to the target business to be processed of the user holding the verifiable statement; The target statement field is at least one statement field in the verifiable statement. Perform data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and removing the target statement from the verifiable statement The field value of at least one of the declaration fields other than the field is encrypted, and the encryption processing is an encryption processing based on a specified hash algorithm. Based on the verifiable statement after data processing, the business processing corresponding to the target business is performed.

The embodiment of this specification provides a service processing device based on a verifiable statement. The device includes a request receiving module that receives a service processing request of a target service. The target service is processed based on the verifiable claim. The processing request includes the verifiable statement processed by the first data processing rule; in the verifiable statement processed by the first data processing rule, the value of the statement field required by the target business is plain text, and the remaining statement fields The field value of at least one declaration field in the ciphertext is encrypted based on a specified hash algorithm. The verification module verifies the validity of the verifiable statement. The business processing module, if the verification result is valid, execute the business processing corresponding to the target business based on the field value of the statement field required by the target business in the verifiable statement.

The embodiment of this specification provides a business processing device based on a verifiable statement, the device includes: a field determination module, which determines the target required by the target business according to the target business to be processed of the user holding the verifiable statement Statement field; the target statement field is at least one statement field in the verifiable statement. The data processing module performs data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and excluding the verifiable statement The field value of at least one of the declaration fields other than the target declaration field is encrypted, and the encryption processing is an encryption processing based on a specified hash algorithm. The business processing module performs business processing corresponding to the target business based on the verifiable statement after data processing.

An embodiment of this specification provides a business processing device based on a verifiable statement. The business processing device based on a verifiable statement includes: a processor; and a memory arranged to store computer-executable instructions, where the executable instructions are When executed, the processor is caused to receive a service processing request of a target service, wherein the target service is processed based on a verifiable statement, and the service processing request includes the verifiable statement processed by the first data processing rule; In the verifiable statement processed by the first data processing rule, the field value of the statement field required by the target business is plain text, and the field value of at least one of the remaining statement fields is encrypted based on a specified hash algorithm The processed ciphertext. The validity of the verifiable statement is verified. If the verification result is valid, the business processing corresponding to the target business is executed based on the field value of the statement field required by the target business in the verifiable statement.

An embodiment of this specification provides a business processing device based on a verifiable statement. The business processing device based on a verifiable statement includes: a processor; and a memory arranged to store computer-executable instructions, where the executable instructions are When executed, the processor is caused to: determine the target statement field required by the target business according to the target business to be processed of the user holding the verifiable statement; the target statement field is at least one of the verifiable claims A declaration field. Perform data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and removing the target statement from the verifiable statement The field value of at least one of the declaration fields other than the field is encrypted, and the encryption processing is an encryption processing based on a specified hash algorithm. Based on the verifiable statement after data processing, the business processing corresponding to the target business is performed.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of this specification, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some of the implementations recorded in this specification. For example, for those of ordinary skill in the art, without creative work, other drawings can be obtained from these drawings.

Figure 1 is an embodiment of a business processing method based on verifiable claims in this specification;

Figure 2 is another embodiment of the business processing method based on verifiable claims in this specification;

Figure 3 is another embodiment of a business processing method based on verifiable claims in this specification;

Figure 4 is an embodiment of a business processing device based on verifiable claims in this specification;

Figure 5 is another embodiment of a business processing device based on verifiable claims in this specification;

Figure 6 is an embodiment of a business processing device based on verifiable claims in this specification;

Figure 7 is another embodiment of a business processing device based on verifiable claims in this specification.

Detailed ways

The embodiments of this specification provide a business processing method, device and equipment based on verifiable claims.

In order to enable those skilled in the art to better understand the technical solutions in this specification, the following will clearly and completely describe the technical solutions in the embodiments of this specification in conjunction with the drawings in the embodiments of this specification. Obviously, the described The embodiments are only a part of the embodiments in this specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of this specification.

Example one

As shown in Figure 1, the embodiment of this specification provides a business processing method based on verifiable claims. The execution subject of the method can be a server, where the server can be an independent server or can be composed of multiple servers. Server clusters, etc. The server may be a server on the side of the claiming user or a server of an agent that performs encryption processing for the claim of the claiming user. The method may specifically include steps S102 to S106.

In step S102, according to the target business to be processed of the user holding the verifiable claim, a target statement field required by the target business is determined, where the target statement field is at least one statement field in the verifiable statement.

Among them, a verifiable statement can be a kind of normative information used to describe certain attributes of entities such as individuals, organizations, etc., a verifiable statement can realize evidence-based trust, and a verifiable statement can prove to other entities that the current Information about certain attributes of the entity is credible. The target business needs can be the business needs of the target business, etc. The business needs can be the requirements needed to perform a certain business. The business needs can be a bachelor's degree or above, or an age of 18 or older. Different businesses can have different business requirements, which can be set according to actual conditions. The target declaration field can be one or more declaration fields contained in the verifiable declaration. For example, the verifiable declaration contains declaration fields such as name, ID number, date of birth, and academic information. The target declaration field can be any of the above declaration fields. A declaration field, such as the declaration field of the date of birth, etc. The target declaration field may also be multiple declaration fields of the above declaration fields, such as two declaration fields of the date of birth and education information.

In the implementation, with the development of digitization, how to define the identity of individuals, organizations or entities in the network environment and how to effectively protect their private data has become an important issue facing people. Generally, user data generated by using Internet services is almost not controlled by the user, and user identity information is leaked or sold from time to time. For this reason, it is necessary to perform identity verification in the process of data exchange.

Usually, the unique identity verification method of digital identity can be used, but under this identity verification method, it can only be carried out in the same scene or specified scene, and consensus and mutual recognition are often not possible in different scenes. This is the application and management of identity verification. All have brought great inconvenience. Therefore, it is necessary to provide a technical solution that can effectively ensure that user information is stored safely, users can manage their user information, and can controllably present user information to relevant third parties. The embodiment of this specification provides a feasible technical solution, which may specifically include the following content:

In daily life, many scenarios need to verify the attributes of the user, and check whether the information provided by the user meets the predetermined standards of the corresponding business. In the embodiments of this specification, this can be achieved by issuing a verifiable statement. The verifiable statement may include Information related to the properties of the. Specifically, for a certain one or more businesses, the business processor (or business provider) can set the processing mechanism of the aforementioned business according to the actual needs of the one or more businesses, that is, the business processor can set a verifiable basis A statement performs business processing. The business processing requester (which can be a user requesting a certain business service) can send a business processing request to the business processing party. The business processing requester can include multiple types, such as a user who holds a verifiable statement. , It can also be a claim holder or an agent that encrypts the verifiable claim of the claim holder, etc. In this embodiment, the business processing requester is an example of a user. Before the business processing requester needs to perform a certain business processing, the user who can verify the claim can start the corresponding application through the terminal device. In the application The relevant information of different services can be set. When the user selects a certain service (that is, the target service), the terminal device can obtain the relevant information of the service (such as the identification of the service, etc.) and send it to the server. The server can according to the relevant information of the service. The information determines the target business and the business requirements of the target business, etc.

Different services can have different business requirements, and different business requirements may correspond to different attribute information (that is, corresponding to different declaration fields), and different services (or business requirements) and declaration fields can be preset in the server Based on the target business that the user needs to perform, the server can search for the declaration field corresponding to the target business from the above correspondence, and can determine the found declaration field as the target declaration field required to execute the target business. Alternatively, the relevant information about the target business performed by the user can be input into a predetermined model (such as a classification model, etc.) for analysis to output the corresponding result (ie target statement field). For example, the target business that the user needs to perform needs to meet If you have a bachelor’s degree or above, you can determine that the target declaration field corresponding to the above target business is an academic information field based on a predetermined classification model. For another example, the business requirements that the user needs to perform the target business need to meet include a bachelor’s degree or above , And the age is over 18 years old, based on the predetermined classification model, it is determined that the target declaration fields required by the above target business are two declaration fields such as academic information and date of birth.

In step S104, data processing is performed on the verifiable statement based on the first data processing rule. The first rule includes: keeping the field value of the target statement field as plain text, and checking the statement fields other than the target statement field in the verifiable statement. Encryption processing is performed on the field value of at least one of the declared fields, and the encryption processing is an encryption processing based on a specified hash algorithm.

Among them, the verifiable statement can include the statement field and the corresponding field value. The statement field can be information indicating the common characteristics of the corresponding field value, such as name, date of birth, education information, etc., and the field value can be corresponding to the statement field Specific content, such as the declaration field is name, the field value can be Zhang San etc. The specified hash algorithm can be any hash algorithm, such as SHA-1 algorithm, SHA-224 algorithm, SHA-256 algorithm, etc. The specific hash algorithm to be used as the specified hash algorithm can be set according to the actual situation The embodiments of this specification do not limit this.

In implementation, different business requirements may correspond to different declaration fields. In actual applications, other declaration fields except the target declaration field corresponding to the business requirement are not necessary in the business processing process corresponding to the business requirement. , And usually the verifiable statement contains all the statement fields and their field values, which will cause the field values of some statement fields to be leaked. For this reason, in the embodiment of this specification, you can pre-set the verifiable statement Processing rules (that is, the first data processing rules), based on the first data processing rules, the specified field values in the verifiable statement can be encrypted, and some field values can be kept in plaintext, etc., specifically, according to user needs After the target business executed determines the target declaration field required to execute the target business, since the field value of the target declaration field needs to be used in the business processing corresponding to the target business, the field value of the target declaration field in the verifiable declaration can be maintained The plain text does not change, and at the same time, other declaration fields except the target declaration field in the verifiable declaration can be obtained, and the field value of at least one of the other declaration fields can be encrypted through a specified hash algorithm. The verifiable statement processed based on the first data processing rule may be stored in the server for subsequent execution of the business processing of the target business.

It should be noted that in the process of encrypting the field values of multiple declaration fields in other declaration fields through the specified hash algorithm, the specified hash algorithm used for the field values of multiple different declaration fields should be the same A kind of hashing algorithm, for example, use the SHA-256 algorithm to encrypt the field value of each of the above declaration fields or use MD5 (Message-Digest Algorithm 5, the fifth message digest algorithm) to perform the field value of each of the above declaration fields Encryption processing, etc.

In step S106, the business processing corresponding to the target business is performed based on the verifiable statement after the data processing.

In implementation, a verifiable statement based on data processing can be implemented in a variety of ways to perform business processing corresponding to the target business. For example, the server (on the side of the statement holding the user) directly sends the target business to the server of the business processor The service processing request, which triggers the service processing party’s server to perform business processing on the target service according to the service processing request, or (declaring that it holds the user’s side) the server receives the request from the user to the service processing party’s server After the notification message or prompt information of the service processing request of the target service, the notification message or prompt information can be sent to the user whose statement can be verified, and the user can send the service processing request of the target service to the server of the service processor through the terminal device. This triggers the service processor’s server to process the target service according to the service processing request, or the user can actively initiate the service processing request for the target service, and the server (declaring that it holds the user’s side) receives the service After processing the request, the corresponding verifiable statement after data processing and the service processing request can be sent to the server of the service processor to trigger the server of the service processor to perform service processing on the target service according to the service processing request. The specific method by which the business processing corresponding to the target business needs to be performed can be set according to the actual situation, which is not limited in the embodiment of this specification.

The embodiment of this specification provides a business processing method based on a verifiable statement. In the process of executing the business processing of the target business based on the verifiable statement, data processing is performed on the verifiable statement, that is, the field of the statement field required by the target business The value is plain text, and the field value of at least one of the remaining claim fields is the cipher text that has been encrypted based on the specified hash algorithm, and then the validity of the verifiable claim is verified, and when the verification result is valid, based on the target The field value of the statement field required by the business executes the business processing corresponding to the target business, so that by verifying the validity of the verifiable statement, and then using the field value in the verifiable statement, the safe storage of user information is effectively guaranteed.

Example two

As shown in Figure 2, the embodiment of this specification provides a business processing method based on verifiable claims. The execution subject of the method can be a server, where the server can be an independent server or can be composed of multiple servers. Server clusters, etc. The server may be a server of a party that processes one or more services based on a verifiable statement. The method may specifically include steps S202 to S206.

In step S202, a business processing request of the target business is received, wherein the target business is processed based on a verifiable statement, and the business processing request includes the verifiable statement processed by the first data processing rule; the business processing request processed by the first data processing rule In the verifiable statement, the field value of the statement field required by the target business is plain text, and the field value of at least one statement field in the remaining statement fields is cipher text that has been encrypted based on a specified hash algorithm.

Among them, the service processing request may be a message requesting the execution of a certain service processing. The service processing request may also include the identifier of the service (such as the service name or code, etc.) and the identifier of the service processing requester (such as the account of the service processing requester). , Name or IMSI code, IP address, MAC address, communication number, etc. of the terminal equipment used by the requesting party for service processing. The business can be any business, and the specific business can be set according to the actual situation. The target business may be the target business required to be performed by the holder user that can be verified and declared in the first embodiment. As described in the first embodiment above, in the process of encrypting the field values of multiple statement fields in the remaining statement fields through a specified hash algorithm, the specified hash algorithm used for the field values of multiple different statement fields should be It is the same hash algorithm.

In implementation, the service processing requester can start the corresponding application program through the terminal device. The application program can be set up with different service processing trigger mechanisms. When the service processing requester triggers a certain service processing, the terminal device can obtain information such as business Identification, business processing requester identification and other relevant information, and obtain the verifiable statement required to perform the business processing corresponding to the target business, where the obtained verifiable statement may be the verifiable statement that has been processed by the first data processing rule , That is, the field value of the statement field required by the target business in the verifiable statement is plain text, and the field value of at least one of the other statement fields is cipher text that has been encrypted based on the specified hash algorithm. The service processing request can be generated from the acquired information, and the terminal device can send the service processing request to the server, so that the server can receive the service processing request.

It should be noted that for different businesses, the requirements in the process of business processing may be different. Correspondingly, the required declaration fields and field values will also be different. For example, in the insurance business, a certain insurance is only for the specified work For a user in a city, it is necessary to determine whether the user is working in a designated city in the business process, and for this, the user’s "work location" declaration field is required; for another example, in the information recommendation business, a piece of information to be recommended It is necessary to recommend to users with a bachelor’s degree and a bachelor’s degree or above. In the business process, it is necessary to determine whether the user has a bachelor’s degree or a bachelor’s degree or above. For this, the user’s "Educational Information" statement field value is required. In order to avoid the disclosure of the field values of certain declared fields, the field values of the aforementioned declaration fields can be encrypted, and the field values of the aforementioned declaration fields required by the target business need to be kept in plain text for subsequent business processing.

In step S204, the validity of the verifiable statement is verified.

In implementation, after the server receives a business processing request based on a verifiable statement, it can first verify the verifiable statement to determine whether the verifiable statement is valid, and if it is determined that the verifiable statement is valid, then based on the verifiable statement Perform business processing to further ensure the security of business processing. Specifically, after the server receives the business processing request, it can extract the verifiable statement processed by the first data processing rule contained therein from the business processing request, and then can perform the verification of the verifiable statement processed by the first data processing rule. authenticating. Among them, the verification of the verifiable statement can include multiple methods. For example, the encryption method used for the ciphertext in the verifiable statement or the related information of the specified hash algorithm can be obtained, and then the obtained encryption method or specified hash can be obtained. For the information related to the algorithm, the field value of the plaintext included in the verifiable statement is encrypted, so that the field value of the statement field included in the verifiable statement can be made ciphertext. Based on the ciphertext corresponding to the statement field contained in the verifiable statement, the calculation is performed through a predetermined algorithm to obtain the final calculation result. The verifiable statement also includes the benchmark value of the above calculation results. The calculated result can be compared with the benchmark value in the verifiable statement. If the two are the same, the verification is passed and the statement is valid. If the two are not the same , The verification fails and the verification statement is invalid.

In addition to the above methods, multiple methods may also be included. For another example, the verifiable statement may include the verification value of the verifiable statement processed by the first data, and the server obtains the verifiable statement processed by the first data processing rule. After verifying the statement, the verification value of the verifiable statement can be determined by a predetermined verification algorithm, and then the calculated verification value can be compared with the verification value in the verifiable statement. If the two are the same, the verification is passed , You can verify that the statement is valid, if the two are not the same, the verification fails, you can verify that the statement is invalid, etc. In practical applications, the method of verifying the validity of the verifiable statement not only includes the above two methods, but also includes other multiple achievable methods, which can be specifically set according to the actual situation. The embodiment of this specification does not include this. Make a limit.

In step S206, if the verification result is valid, the business processing corresponding to the business processing request is executed based on the field value of the statement field corresponding to the business requirement in the verifiable statement.

In the implementation, if the verification result of verifying the validity of the verifiable statement is valid, it indicates that the verifiable statement is accurate. Because the business processing process corresponding to the target business, only the target business location in the verifiable statement needs to be used. The field value of the required statement field, and the field value is plain text, therefore, the business processing corresponding to the above business processing request can be performed directly based on the field value of the statement field required by the target business in the verifiable statement. For example, in the information recommendation business, the business requirement corresponding to the information to be recommended is to recommend to users with a bachelor’s degree or above. You can verify that the declared field required for the information recommendation business in the statement is academic information. If the corresponding field value is For undergraduates, based on the field value, it can be determined that the service processing corresponding to the above information recommendation service can be performed. At this time, the server can send the information to be recommended to the user, etc.

The embodiment of this specification provides a business processing method based on a verifiable statement. The target business to be processed by the user determines the required target statement field, keeps the field value of the target statement field as plain text, and removes the target statement from the verifiable statement. The field value of at least one of the declared fields other than the field is encrypted, so that in the user’s verifiable information, the declaration field that is not required to be used in the target business is encrypted to prevent the declaration field outside the target declaration field from being encrypted. The field value is leaked, which can effectively ensure that user information is stored safely, and users can manage their user information (that is, information that can be encrypted), and can control and show user information to relevant third parties without worrying Some data leaks.

Example three

As shown in Figure 3, the embodiment of this specification provides a business processing method based on verifiable claims. The execution subject of the method can be a first server and a second server, where the first server can be a claim holder or a The server of the agent that declares that the user's statement is encrypted, and the second server may be the server of the party that processes one or more services based on the verifiable statement. The first server may be an independent server, or a server cluster composed of multiple servers. The second server may also be an independent server, or a server cluster composed of multiple servers. The method may specifically include steps S302 to S314.

In step S302, the first server determines the target statement field required by the target business according to the target business to be processed of the user holding the verifiable statement, and the target statement field is at least one statement field in the verifiable statement.

In implementation, the verifiable statement of the user can be as follows before data processing:

The declaration fields can be the above-mentioned "name", "ID number", "gender", "date of birth", "telephone number", "educational background", etc. The target declaration field required by the target business can be the above declaration field One or more of.

In step S304, the first server performs data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and for the verifiable statement except for the target statement field The field value of at least one of the other declaration fields of is subjected to encryption processing, and the encryption processing is an encryption processing based on a specified hash algorithm.

In implementation, the verifiable statement obtained after data processing of the verifiable statement based on the first data processing rule may be as follows:

Based on the verifiable statement after the above data processing, the target statement fields required by the target business are located in the "Education Information" item, which includes the statement fields of "Education", "Graduation College" and "Professional", among which "Item1" The field value corresponding to the declaration field of "Item2" and "Item3" corresponds to the field value of the ciphertext (that is, the hash value), and the field value corresponding to the declaration field in "Item2" and "Item3" is also the ciphertext (that is, the hash value), where "Item1" is the above step The "Basic Information" item in the example of S302, "Item2" is the corresponding items such as "Education", "Graduation College", "Major", and "Date of Graduation" in the example of step S302 above, and "Item3" is the above The "Emergency Contact" item in the example of step S302, etc.

It should be noted that the verifiable statement of the user or the verifiable statement processed by the first data processing rule can be stored in the blockchain to ensure the accuracy of the verifiable statement. Among them, the specified hash algorithm is the same as the algorithm used in the hash processing in the specified block chain, and the specified block chain stores the hash value of the verifiable claim. In order to facilitate the verification of the stored verifiable statement by each blockchain node in the blockchain, and considering that the hash algorithm is irreversible, the algorithm used in the hash processing in the specified blockchain should be the same as the specified hash algorithm. The column algorithm is the same.

In practical applications, after the first server performs the first data processing on the verifiable statement of the user based on the processing of steps S302 and S304 above, the business processor can perform corresponding business processing based on the verifiable statement of the user, which can be specifically See the processing of step S306 to step S314 below.

In step S306, the first server sends a service processing request of the target service to the second server (that is, the server of the service processor of the target service), and the service processing request includes a verifiable statement after data processing; so that the second server Perform business processing on the target business based on the verifiable statement after data processing.

In implementation, before the service processing requester needs to perform a certain service processing, the corresponding user can be notified to prepare a verifiable statement. At this time, the user can send the target service that the user needs to perform to the first server through the terminal device. The server may execute the processing of step S302 and step S304 above to process the verifiable statement to obtain a verifiable statement processed based on the first data processing rule. It should be noted that the processed verifiable claims may be different for different business requirements. The first server may store verifiable claims of the same original content of the same user after being processed by different data processing rules.

When the business processor needs to perform the business processing of the target business, because the business processing needs to use the verifiable statement of the user, the first server can obtain the verifiable statement and other information after the data processing to generate the business processing request of the target business , And send the service processing request to the second server, and the second server can receive the service processing request of the target service based on the verifiable statement.

The service processing request of the target service can be triggered in a variety of ways. In addition to the above-mentioned methods, it can also be implemented in the following ways, which can specifically include the following content: the first server receives the indication information of the service processor; the indication information It is used to instruct the holder of the verifiable claim to send the service processing request of the target service to the service processor.

In implementation, the first server may receive the instruction information of the service processor (second server) to instruct the holder of the verifiable claim to send the service processing request of the target service to the service processor (second server). At this time, The user can obtain the above verifiable statement from the first server through the terminal device, and can generate the service processing request of the target service based on the terminal device. The terminal device sends the service processing request of the target service to the second server, or the first server sends the The instruction information and the above verifiable statement are sent to the user's terminal device, and the user's terminal device can generate a service processing request for the target service, and send the service processing request to the second server.

After receiving the service processing request, the second server may first verify the validity of the verifiable statement in the service processing request to ensure the security of the service processing. For details, refer to the processing of the following steps S308 to S312.

In step S308, the second server encrypts the field value of the plaintext contained in the verifiable statement based on the specified hash algorithm.

In implementation, since the verifiable statement contains plaintext and ciphertext, and the ciphertext is encrypted by a specified hash algorithm, it is usually difficult to obtain the actual content of the verifiable statement corresponding to the ciphertext. Therefore, the ciphertext can be passed The verifiable statement can be verified in the manner of, specifically, the ciphertext in the verifiable statement can be kept unchanged, and the plain text in the verifiable statement can be processed, that is, the display of each statement field in the verifiable statement can be displayed as plain text The field value of is encrypted. Since the purpose of the above-mentioned encryption processing is to verify the validity of the verifiable statement, the encryption processing and the above-mentioned encryption algorithm used in the process of processing the verifiable statement based on the first data processing rule should be Same, that is, the encryption algorithm is a designated hash algorithm. Based on the above content, the second server can encrypt the field values of the plaintext contained in the verifiable statement based on the specified hash algorithm, so that all the field values in the verifiable statement have been adjusted to ciphertext.

In practical applications, the specific processing of the above step S308 can be various. In addition to the above processing methods, it can also include other methods. The following provides an optional processing method, that is, in practical applications, the statement can be verified It is impossible to determine whether the field value in is plaintext or ciphertext. In this case, the following steps A2 to A6 can be included.

Step A2: The second server obtains the field value of the statement field contained in the verifiable statement.

In the implementation, the second server can analyze the content of the verifiable statement to determine the statement fields contained in the verifiable statement, where the determined statement field can be all the statement fields contained in the verifiable statement, or it can be a verifiable statement. Some specified declaration fields in the verification statement, such as the declaration fields related to user information in the verification statement (such as name, date of birth, ID card number, and other declaration fields), etc. In the embodiments of this specification, all the statement fields in the verifiable statement can be taken as an example for description.

Step A4: If the above field value includes a field value that meets a predetermined composition rule, the second server obtains the statement index information corresponding to the verifiable statement, and the statement index information records that the field value is plain text or the field value is cipher text.

The predetermined composition rule may be a ciphertext composition rule obtained by encrypting the original field value based on a specified hash algorithm, etc. The predetermined composition rule may be determined according to actual conditions, which is not limited in the embodiment of this specification. The declared index information can be information used to record the value of a certain field in plaintext or ciphertext. The declared index information can have multiple presentation forms. For example, the declared index information can be presented in the form of a Claim index field, and it can pass "0" or The "1" mode records whether each field value is plaintext or ciphertext, or the field value of the ciphertext can also be recorded by marking "hash" (as the example in step S304 above), and the remaining field values are plaintext.

In implementation, in the verifiable statement, it may not be able to accurately distinguish which field value is plain text and which field value is cipher text. For example, a user’s ID number is a string of numbers, and the user’s ID number is encrypted. After it is still a string of numbers, it may not be possible to determine whether the ID number is ciphertext or plaintext. For this reason, the first server can generate the statement index information corresponding to the verifiable statement while generating the verifiable statement. After the second server obtains the field value of the statement field contained in the verifiable statement, it can analyze each field value to determine whether each field value meets the predetermined composition rule, and if one or more of the field values meet the predetermined In order to determine which fields are in plaintext and which fields are in ciphertext, so that the corresponding field values can be processed later, the verifiable statement can be obtained from the first server. Verify the statement index information corresponding to the statement. The information recorded in the statement index information can determine which fields in the verifiable statement are in plaintext and which fields are in ciphertext.

Step A6: The second server encrypts the field value of the plain text contained in the verifiable statement based on the specified hash algorithm according to the statement index information.

In the implementation, since which field values are recorded in the declaration index information as plain text and which fields are in cipher text, based on the content recorded in the declaration index information, the field values of the plain text can be found from the verifiable declaration, and The field value of the plaintext contained in the verifiable statement is encrypted based on the specified hash algorithm to obtain the ciphertext of the field value. For example, the specified hash algorithm can be the MD5 algorithm, and the MD5 algorithm can be used to calculate the field value of each plaintext separately to obtain the MD5 value corresponding to each field value. Because the field value of the ciphertext contained in the verifiable statement is also passed through the specified hash The column algorithm (ie, the MD5 algorithm) is obtained. Therefore, the field value of the ciphertext contained in the verifiable statement is also the corresponding MD5 value. In this way, the field value of the statement field contained in the verifiable statement is all the MD5 value.

In step S310, the second server determines the Merkel root corresponding to the ciphertext in the verifiable statement based on the ciphertext in the verifiable statement.

In implementation, since there are usually many declaration fields contained in verifiable declarations, it will take a lot of time to verify the field value of each declaration field one by one. In order to verify the validity of the verifiable declaration simply and quickly, you can use the default The Kerr tree method verifies the validity of the verifiable statement. Specifically, the Merkle tree (ie Merkle tree) can be constructed based on the ciphertext in the verifiable statement. The construction of a complete Merkle tree requires recursively The node pairs are hashed, and the newly generated hash node is inserted into the Merkle tree until there is only one node left (this node is the root node of the Merkle tree). Based on the constructed Merkle tree, the value corresponding to the root node of the Merkle tree is calculated, and the value corresponding to the root node can be regarded as the Merkle root. For example, based on the example in step A6 above, it can be verified that the field values of the statement fields included in the statement are all MD5 values, and the corresponding Merkel tree can be constructed from the above MD5 values to obtain a Merkel tree composed of MD5 values. The Merkel tree will contain a root node, and the MD5 value of the root node can be calculated based on the above MD5 value, and the obtained MD5 value of the root node can be used as the Merkel root corresponding to the ciphertext in the verifiable statement.

The specific processing methods of the above step S310 can be various. In addition to the above methods, it can also be implemented in other ways. The following provides an optional processing method, but it does not specifically include the following steps B2 to B6. .

In step B2, the second server constructs a binary tree based on the cipher text corresponding to the declared fields contained in the verifiable statement according to the order of the declared fields in the verifiable statement.

Among them, the binary tree may have a tree structure in which each node has at most two subtrees.

In implementation, the second server can determine the order in which the various statement fields in the verifiable statement appear in the verifiable statement. For example, the verifiable statement records from front to back: "Name": "Zhang San", "Gender": "Male", "Date of Birth": "19880102", the order in which the statement fields in the verifiable statement appear in the verifiable statement is: name-gender-date of birth, or it can be the statement in the verifiable statement The order of the fields from back to front, etc., in practical applications, may also be in other order, which is not limited in the embodiment of this specification. Through the above method, the second server can obtain the order of the declared fields in the verifiable statement. Then, the second server can construct a binary tree based on the ciphertext corresponding to the declared fields contained in the verifiable statement according to the order of the declared fields in the verifiable statement. . For example, you can construct a binary tree based on the cipher text corresponding to the name, the cipher text corresponding to the gender, and the cipher text corresponding to the date of birth according to the order name-gender-date of birth in which each statement field in the verifiable statement appears in the verifiable statement. Ground, a node can be constructed based on the ciphertext corresponding to the name, and a node can be constructed based on the ciphertext corresponding to the gender, and then a new node can be generated through the above two nodes. A node can be constructed based on the ciphertext corresponding to the date of birth, and then a second new node can be generated by constructing a node based on the ciphertext corresponding to the date of birth and the new node generated to form a complete binary tree.

Step B4: The second server determines the check value of the root node in the above binary tree according to the Merkel algorithm.

In implementation, a binary tree can be constructed by the method in step B2 above. The binary tree includes multiple nodes (including leaf nodes and root nodes, etc.). The nodes in the binary tree can be calculated step by step according to the Merkel algorithm to obtain each The check value of each node is used to obtain the check value of the root node in the binary tree. Specifically, the ciphertext corresponding to the name and the ciphertext corresponding to the gender can be combined into a piece of information, and the hash value of the piece of information can be calculated by a specified hash algorithm, and then the calculated hash value corresponding to the date of birth The ciphertext is combined into a piece of information, and the hash value of the piece of information is calculated through the specified hash algorithm again, and the finally calculated hash value can be used as the check value of the root node in the binary tree.

Step B6: The second server determines the check value of the root node in the above binary tree as the Merkel root corresponding to the ciphertext in the verifiable statement.

In step S312, the second server verifies the validity of the verifiable statement based on the verification information in the above-mentioned Merkel root and verifiable statement.

In implementation, the verification information in the verifiable statement can include the Merkel root corresponding to the cipher text in the verifiable statement. At this time, the calculated Merkel root can be combined with the verification information in the verifiable statement. Merkel root makes a comparison. If the two are the same, it indicates that the verifiable claim is valid. If the two are different, it indicates that the verifiable claim is invalid. At this time, the same notification message can be sent to the business processing requester.

In practical applications, the above-mentioned step S312 can be processed in a variety of ways. In addition to the above-mentioned methods, it can also be implemented in many other ways. The following provides an optional processing method, which can specifically include the following steps C2 to C6 Processing.

Step C2: The second server obtains the verification information in the verifiable statement and the key corresponding to the verifiable statement.

Among them, the verification information in the verifiable statement may be the signature information obtained after signing the Merkel root corresponding to the ciphertext in the verifiable statement, where the Merkel root corresponding to the ciphertext in the verifiable statement The signature processing can be a process of using a key to encrypt the Merkel root corresponding to the ciphertext in the verifiable statement. In actual applications, the Merkel root corresponding to the ciphertext in the verifiable statement is signed and processed. It may be processed in other ways, which is not limited in the embodiment of this specification. In this embodiment, the process of encrypting the Merkel root corresponding to the ciphertext in the verifiable statement using a key is taken as an example for description. The key can be the public key of the provider of the verifiable claim, etc.

In implementation, the second server can find the verification information from the verifiable statement, and can extract the verifiable information therefrom. In addition, the key (such as a public key, etc.) of the verifiable claim can also be obtained from the provider of the verifiable claim. Among them, the signature information can be obtained by the provider of the verifiable claim through the private key of the encryption process, and the Merkel root corresponding to the signature information can be obtained through the public key of the provider of the verifiable claim.

Step C4: The second server verifies the verification information in the verifiable statement based on the key to obtain the reference Merkel root corresponding to the verification information in the verifiable statement.

In implementation, the key corresponding to the verifiable statement (such as the public key of the provider of the verifiable statement) can be used to verify the verification information in the verifiable statement (that is, the process of verifying the signature information), if the verification is successful , You can get the benchmark Merkel root corresponding to the verification information in the verifiable statement. If the verification fails, it indicates that the verifiable statement may be at risk.

Step C6: The second server determines that the verifiable statement is valid if the aforementioned Merkel root matches the reference Merkel root.

It should be noted that there may be multiple ways to verify the validity of a verifiable statement. An optional processing method is provided below, which may specifically include the following content: the verification of the verifiable statement based on the above specified hash algorithm The field value of the plaintext contained in is encrypted, where the specified hash algorithm is the same as the algorithm used in the hash processing in the specified blockchain, and the specified blockchain stores the hash value of the verifiable claim. Based on the statement identifier of the verifiable statement (such as the name or code of the verifiable statement, etc.), the hash value of the verifiable statement corresponding to the statement identifier can be obtained from the specified blockchain above, and then, based on the specified block The hash value obtained in the chain, as well as the result of the encryption processing of the field value of the above plaintext and the ciphertext contained in the above verifiable statement, determine whether the verifiable statement is valid, for example, the above specified blockchain stores the above The hash value corresponding to the field value of each field contained in the verification statement can be obtained by matching the hash value corresponding to the field value of each field with the hash value or ciphertext of the above plaintext. If each field of both parties If the hash values corresponding to the field values of all match, the claim can be verified as valid, otherwise, the claim can be verified as invalid.

In step S314, if the verification result is valid, the second server executes the business processing corresponding to the business processing request based on the field value of the statement field corresponding to the business requirement in the verifiable statement.

In the implementation, if it is determined that the verifiable statement is valid based on the verification information in the above Merkel root and verifiable statement, then the verification result can be determined to be valid. At this time, the second server is based on the verifiable statement corresponding to the above business requirements For the field value of the declared field, execute the business processing corresponding to the above business processing request. For example, in the information recommendation business, a piece of information to be recommended needs to be recommended to users with a bachelor’s degree or above. In the business process, it is necessary to determine whether the user has a bachelor’s degree or a bachelor’s degree or above. For this, the user’s The field value of the "Education Information" declaration field. Based on the above content, the first server can keep the field value of the user's "Education Information" declaration field in plaintext, and the field values of other declaration fields are encrypted, and then the second server is executing In the processing of the above information recommendation service, the processed verifiable statement can be validated based on the above processing process. When the verification result is valid, the second server can use the field value of the "educational information" statement field to determine whether the user is The requirements for information recommendation are met. If they are met, the corresponding information can be pushed to the user. If they are not met, the next user can be acquired to continue the above processing process to push the corresponding information to the corresponding user.

The embodiment of this specification provides a business processing method based on a verifiable statement. Based on the target business to be processed, the required target statement field is determined, and the field value of the target statement field is kept in plain text. The field value of at least one of the declared fields other than the field is encrypted, so that in the user’s verifiable information, the declaration field that is not required to be used in the target business is encrypted to prevent the declaration field outside the target declaration field from being encrypted. The field value is leaked, which can effectively ensure that user information is stored safely, and users can manage their user information (that is, information that can be encrypted), and can control and show user information to relevant third parties without worrying Some data leaks. Moreover, in the process of executing the business processing of the target business based on the verifiable statement, data processing is performed on the verifiable statement, that is, the field value of the statement field required by the target business is plain text, and the value of at least one of the other statement fields is The field value is the ciphertext encrypted based on the specified hash algorithm, and then the validity of the verifiable statement is verified, and when the verification result is valid, based on the field value of the statement field required by the target business, execute the target business correspondence In this way, by verifying the validity of the verifiable statement, and then using the field value in the verifiable statement, the safe storage of user information is further ensured.

Example four

The above embodiment of this specification provides a business processing method based on a verifiable statement. Based on the same idea, the embodiment of this specification also provides a service processing device based on a verifiable statement, as shown in FIG. 4.

The service processing device based on a verifiable statement includes: a request receiving module 401, a verification module 402, and a service processing module 403. The request receiving module 401 receives a service processing request for a target service, wherein the target service is based on a verifiable claim Processing, the business processing request includes the verifiable statement processed by the first data processing rule; in the verifiable statement processed by the first data processing rule, the field value of the statement field required by the target business It is plain text, and the field value of at least one of the remaining statement fields is the cipher text that has been encrypted based on the specified hash algorithm; the verification module 402 verifies the validity of the verifiable statement; the business processing module 403, if If the verification result is valid, the business processing corresponding to the target business is executed based on the field value of the statement field required by the target business in the verifiable statement.

In the embodiment of this specification, the verification module 402 includes: an encryption unit that encrypts the field value of the plaintext contained in the verifiable statement based on the specified hash algorithm; the Merkel root determination unit is based on the specified hash algorithm; The ciphertext in the verifiable statement determines the Merkel root corresponding to the ciphertext in the verifiable statement; the verification unit, based on the Merkel root and the verification information in the verifiable statement, The validity of the verification statement can be verified.

In the embodiment of this specification, the encryption unit obtains the field value of the statement field contained in the verifiable statement; if the field value includes a field value that satisfies a predetermined composition rule, obtains the corresponding verifiable statement In the statement index information, it is recorded that the field value is plaintext or the field value is ciphertext; according to the statement index information, based on the specified hash algorithm, the verifiable statement contains The field value of the plaintext is encrypted.

In the embodiment of this specification, the Merkel root determination unit constructs a binary tree based on the ciphertext corresponding to the declared fields contained in the verifiable statement according to the order of the declared fields in the verifiable statement; according to the Merkel algorithm , Determine the check value of the root node in the binary tree; determine the check value of the root node in the binary tree as the Merkel root corresponding to the ciphertext in the verifiable statement.

In the embodiment of this specification, the verification information in the verifiable statement is signature information, and the verification unit obtains the verification information in the verifiable statement and the key corresponding to the verifiable statement; based on the key Perform signature verification processing on the verification information in the verifiable statement to obtain the reference Merkel root corresponding to the verification information in the verifiable statement; if the Merkel root matches the reference Merkel root , It is determined that the verifiable statement is valid.

The embodiment of this specification provides a business processing device based on a verifiable statement. In the process of executing the business processing of the target business based on the verifiable statement, data processing is performed on the verifiable statement, that is, the field of the statement field required by the target business The value is plain text, and the field value of at least one of the remaining claim fields is the cipher text that has been encrypted based on the specified hash algorithm, and then the validity of the verifiable claim is verified, and when the verification result is valid, based on the target The field value of the statement field required by the business executes the business processing corresponding to the target business, so that by verifying the validity of the verifiable statement, and then using the field value in the verifiable statement, the safe storage of user information can be effectively guaranteed.

Example five

Based on the same idea, the embodiment of this specification also provides a service processing device based on a verifiable statement, as shown in FIG. 5.

The business processing device based on the verifiable statement includes: a field determination module 501, a data processing module 502, and a business processing module 503. The field determination module 501 determines the target business to be processed according to the verifiable statement holding the user’s target business. The target statement field required by the target business; the target statement field is at least one statement field in the verifiable statement; the data processing module 502 performs data processing on the verifiable statement based on the first data processing rule; The first data processing rule includes: keeping the field value of the target statement field as plain text, and encrypting the field value of at least one of the statement fields other than the target statement field in the verifiable statement Processing, the encryption processing is encryption processing based on a specified hash algorithm; the business processing module 503 performs business processing corresponding to the target business based on the verifiable statement after data processing.

In the embodiment of this specification, the service processing module 503 sends a service processing request of the target service to the service processor of the target service, and the service processing request includes the verifiable statement after the data processing; The business processor is enabled to perform business processing on the target business based on the verifiable statement after the data processing.

In the embodiment of this specification, the specified hash algorithm is the same as the algorithm used in the hash processing in the specified blockchain; the specified blockchain stores the hash value of the verifiable statement.

In the embodiment of this specification, it further includes: an instruction information receiving module to receive instruction information of the service processor; the instruction information is used to instruct the user holding the verifiable claim to send the target service to the service processor Business processing request.

The embodiment of this specification provides a business processing device based on a verifiable statement. The target business to be processed by the user determines the required target statement field, keeps the field value of the target statement field in plain text, and removes the target statement from the verifiable statement. The field value of at least one of the declared fields other than the field is encrypted, so that in the user’s verifiable information, the declaration field that is not required to be used in the target business is encrypted to prevent the declaration field outside the target declaration field from being encrypted. The field value is leaked, which can effectively ensure that user information is stored safely.

Example Six

The service processing device based on verifiable claims provided in the above embodiments of this specification, based on the same idea, the embodiments of this specification also provide a service processing device based on verifiable claims, as shown in FIG. 6.

The service processing device based on the verifiable statement may be the second server provided in the foregoing embodiment, and the second server may be a server of the party that processes one or more services based on the verifiable statement.

Business processing equipment based on verifiable claims may have relatively large differences due to different configurations or performances, and may include one or more processors 601 and a memory 602, and the memory 602 may store one or more storage applications or data . Among them, the memory 602 may be short-term storage or persistent storage. The application program stored in the memory 602 may include one or more modules (not shown in the figure), and each module may include a series of computer-executable instructions for a business processing device based on a verifiable statement. Further, the processor 601 may be configured to communicate with the memory 602, and execute a series of computer-executable instructions in the memory 602 on a service processing device based on a verifiable statement. The service processing equipment based on the verifiable statement may also include one or more power sources 603, one or more wired or wireless network interfaces 604, one or more input and output interfaces 605, and one or more keyboards 606.

Specifically, in this embodiment, the business processing device based on verifiable claims includes a memory and one or more programs. One or more programs are stored in the memory, and one or more programs may include one or more programs. Modules, and each module may include a series of computer-executable instructions in a business processing device based on verifiable claims, and is configured to be executed by one or more processors. The one or more programs include a computer for performing the following Executable instruction: receiving a business processing request of a target business, wherein the target business is processed based on a verifiable statement, and the business processing request includes the verifiable statement processed by the first data processing rule; In the verifiable statement processed by the rule, the field value of the statement field required by the target business is plaintext, and the field value of at least one statement field in the remaining statement fields is ciphertext encrypted based on a specified hash algorithm; The validity of the verifiable statement is verified; if the verification result is valid, the business processing corresponding to the target business is executed based on the field value of the statement field required by the target business in the verifiable statement.

In the embodiment of this specification, the verification of the validity of the verifiable statement includes: encrypting the field value of the plain text contained in the verifiable statement based on the specified hash algorithm; and based on the verifiable statement; Verify the ciphertext in the statement to determine the Merkel root corresponding to the ciphertext in the verifiable statement; based on the Merkel root and the verification information in the verifiable statement, the validity of the verifiable statement Verification.

In the embodiment of the present specification, the encrypting the field value of the plain text contained in the verifiable statement based on the specified hash algorithm includes: obtaining the field value of the statement field contained in the verifiable statement; if If the field value includes a field value that satisfies a predetermined composition rule, the statement index information corresponding to the verifiable statement is obtained, and the statement index information records that the field value is plain text or the field value is cipher text According to the statement index information, the field value of the plaintext contained in the verifiable statement is encrypted based on the specified hash algorithm.

In the embodiment of this specification, the determining the Merkel root corresponding to the ciphertext in the verifiable statement based on the ciphertext in the verifiable statement includes: in accordance with the order of the statement fields in the verifiable statement, Construct a binary tree based on the ciphertext corresponding to the statement field contained in the verifiable statement; determine the check value of the root node in the binary tree according to the Merkel algorithm; determine the check value of the root node in the binary tree as the verifiable statement The ciphertext in the verification statement corresponds to the Merkel root.

In the embodiment of this specification, the verification information in the verifiable statement is signature information, and the validity of the verifiable statement is verified based on the Merkel root and the verification information in the verifiable statement , Including: obtaining the verification information in the verifiable statement and the key corresponding to the verifiable statement; performing verification processing on the verification information in the verifiable statement based on the key to obtain the verifiable statement The verification information in the corresponding reference Merkel root; if the Merkel root matches the reference Merkel root, it is determined that the verifiable statement is valid.

Example Seven

Based on the same idea, the embodiment of this specification also provides a service processing device based on a verifiable statement, as shown in FIG. 7.

The service processing device based on the verifiable statement may be the first server provided in the above-mentioned embodiment, and the first server may be a server on the side of the statement holding user or a server of the agent that performs encryption processing for the statement holding the user’s statement .

Business processing equipment based on verifiable claims may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and a memory 702, and the memory 702 may store one or more storage applications or data . Among them, the memory 702 may be short-term storage or persistent storage. The application program stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer-executable instructions for a business processing device based on verifiable claims. Further, the processor 701 may be configured to communicate with the memory 702, and execute a series of computer-executable instructions in the memory 702 on a service processing device based on a verifiable statement. The service processing device based on the verifiable statement may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input and output interfaces 705, and one or more keyboards 706.

Specifically, in this embodiment, the business processing device based on verifiable claims includes a memory and one or more programs. One or more programs are stored in the memory, and one or more programs may include one or more programs. Modules, and each module may include a series of computer-executable instructions in a business processing device based on verifiable claims, and is configured to be executed by one or more processors. The one or more programs include a computer for performing the following Executable instruction: according to the target business to be processed of the user holding the verifiable claim, determine the target statement field required by the target business; the target statement field is at least one statement field in the verifiable statement; based on The first data processing rule performs data processing on the verifiable statement; the first data processing rule includes: keeping the field value of the target statement field as plain text, and removing the target statement field from the verifiable statement The field value of at least one of the other statement fields is encrypted, and the encryption is based on a specified hash algorithm; based on the verifiable statement after data processing, the business processing corresponding to the target business is performed .

In the embodiment of this specification, the performing the business processing corresponding to the target business based on the verifiable statement after data processing includes: sending the business processing request of the target business to the business processing party of the target business, the The business processing request includes the verifiable statement after the data processing; so that the business processor performs business processing on the target business based on the verifiable statement after the data processing.

In the embodiment of this specification, the verifiable statement based on the data processing, before performing the business processing corresponding to the target business, further includes: receiving instruction information from the business processor; the instruction information is used to indicate the verifiable The declared holder user sends a service processing request of the target service to the service processing party.

The embodiment of this specification provides a business processing device based on a verifiable statement. The target business to be processed by the user determines the required target statement field, and keeps the field value of the target statement field as plain text. Except the target statement in the verifiable statement The field value of at least one of the declared fields other than the field is encrypted, so that in the user’s verifiable information, the declaration field that is not required to be used in the target business is encrypted to prevent the declaration field outside the target declaration field from being encrypted. The field value is leaked, which can effectively ensure that user information is stored safely, and users can manage their user information (that is, information that can be encrypted), and can control and present user information to relevant third parties without worrying Some data leaks.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

In the 1990s, the improvement of a technology can be clearly distinguished between hardware improvements (for example, improvements in circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements in method flow). However, with the development of technology, the improvement of many methods and processes of today can be regarded as a direct improvement of the hardware circuit structure. Designers almost always get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be realized by the hardware entity module. For example, a programmable logic device (Programmable Logic Device, PLD) (such as a Field Programmable Gate Array (Field Programmable Gate Array, FPGA)) is such an integrated circuit whose logic function is determined by the user's programming of the device. It is programmed by the designer to "integrate" a digital system on a piece of PLD, without requiring chip manufacturers to design and manufacture dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly realized with "logic compiler" software, which is similar to the software compiler used in program development and writing, but before compilation The original code must also be written in a specific programming language, which is called Hardware Description Language (HDL), and there is not only one type of HDL, but many types, such as ABEL (Advanced Boolean Expression Language) , AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description), etc., currently most commonly used It is VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. It should also be clear to those skilled in the art that just a little bit of logic programming of the method flow in the above-mentioned hardware description languages and programming into an integrated circuit can easily obtain the hardware circuit that implements the logic method flow.

The controller can be implemented in any suitable manner. For example, the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program codes (such as software or firmware) executable by the (micro)processor. , Logic gates, switches, application specific integrated circuits (ASICs), programmable logic controllers and embedded microcontrollers. Examples of controllers include but are not limited to the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicon Labs C8051F320, the memory controller can also be implemented as part of the memory control logic. Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code manner, it is entirely possible to program the method steps to make the controller use logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded The same function can be realized in the form of a microcontroller, etc. Therefore, such a controller can be regarded as a hardware component, and the devices included in it for realizing various functions can also be regarded as a structure within the hardware component. Or even, the device for realizing various functions can be regarded as both a software module for realizing the method and a structure within a hardware component.

The systems, devices, modules, or units illustrated in the above embodiments may be specifically implemented by computer chips or entities, or implemented by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cell phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or Any combination of these devices.

For the convenience of description, when describing the above device, the functions are divided into various units and described separately. Of course, when implementing one or more embodiments of this specification, the functions of each unit may be implemented in the same one or more software and/or hardware.

Those skilled in the art should understand that the embodiments of this specification can be provided as a method, a system, or a computer program product. Therefore, one or more embodiments of this specification may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may adopt computer programs implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The form of the product.

The embodiments of this specification are described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to general-purpose computers, special-purpose computers, embedded processors, or other processors that can program business processing equipment based on verifiable claims to generate a machine, so that a computer or other programmable business based on verifiable claims The instructions executed by the processor of the processing device generate means for implementing the functions specified in one or more processes in the flowchart and/or one or more blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable business processing equipment based on verifiable claims to work in a specific manner, so that the instructions stored in the computer-readable memory generate instructions that include the instruction device. For manufactured products, the instruction device realizes the functions specified in one or more processes in the flowchart and/or one or more blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable business processing equipment based on verifiable claims, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so that the computer or other The instructions executed on the programming device provide steps for implementing functions specified in one or more processes in the flowchart and/or one block or more in the block diagram.

In a typical configuration, the computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.

Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or also include elements inherent to such processes, methods, commodities, or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, commodity, or equipment that includes the element.

Those skilled in the art should understand that the embodiments of this specification can be provided as a method, a system or a computer program product. Therefore, one or more embodiments of this specification may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may adopt computer programs implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The form of the product.

One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification can also be practiced in distributed computing environments. In these distributed computing environments, tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

The above descriptions are only examples of this specification, and are not intended to limit this specification. For those skilled in the art, this specification can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims of this specification.

Claims

A business processing method based on verifiable claims, the method comprising:

Receive a business processing request for a target business, where the target business is processed based on a verifiable statement, the business processing request includes the verifiable statement processed by the first data processing rule; all the target business processed by the first data processing rule In the verifiable statement, the field value of the statement field required by the target business is plaintext, and the field value of at least one statement field in the remaining statement fields is ciphertext encrypted based on a specified hash algorithm;

Verify the validity of the verifiable statement;

If the verification result is valid, the business processing corresponding to the target business is executed based on the field value of the statement field required by the target business in the verifiable statement.
The method according to claim 1, wherein the verifying the validity of the verifiable statement comprises:

Encrypting the field value of the plaintext contained in the verifiable statement based on the specified hash algorithm;

Determine the Merkel root corresponding to the ciphertext in the verifiable statement based on the ciphertext in the verifiable statement;

Based on the Merkel root and the verification information in the verifiable statement, the validity of the verifiable statement is verified.
The method according to claim 2, wherein the encrypting the field value of the plaintext contained in the verifiable statement based on the specified hash algorithm comprises:

Obtaining the field value of the statement field included in the verifiable statement;

If the field value includes a field value that satisfies a predetermined composition rule, the statement index information corresponding to the verifiable statement is obtained, and the statement index information records that the field value is plain text or the field value is secret Text

According to the statement index information, the field value of the plaintext contained in the verifiable statement is encrypted based on the specified hash algorithm.
The method according to claim 2, wherein the determining the Merkel root corresponding to the ciphertext in the verifiable statement based on the ciphertext in the verifiable statement comprises:

Construct a binary tree based on the cipher text corresponding to the declared fields contained in the verifiable statement according to the order of the declared fields in the verifiable statement;

Determining the check value of the root node in the binary tree according to the Merkel algorithm;

The check value of the root node in the binary tree is determined as the Merkel root corresponding to the ciphertext in the verifiable statement.
The method according to claim 2, wherein the verification information in the verifiable statement is signature information, and the verification information based on the Merkel root and the verifiable statement is valid for the verifiable statement Verification, including:

Obtaining the verification information in the verifiable statement and the key corresponding to the verifiable statement;

Performing signature verification processing on the verification information in the verifiable statement based on the key to obtain the benchmark Merkel root corresponding to the verification information in the verifiable statement;

If the Merkel root matches the benchmark Merkel root, it is determined that the verifiable statement is valid.
A business processing method based on verifiable claims, the method comprising:

Determine the target statement field required by the target business according to the target business to be processed of the user holding the verifiable statement; the target statement field is at least one statement field in the verifiable statement;

Perform data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and removing the target statement from the verifiable statement The field value of at least one of the declaration fields other than the field is encrypted, and the encryption processing is an encryption processing based on a specified hash algorithm;

Based on the verifiable statement after data processing, the business processing corresponding to the target business is performed.
The method according to claim 6, wherein the performing business processing corresponding to the target business based on the verifiable statement after data processing includes:

Send the business processing request of the target business to the business processor of the target business, the business processing request includes the verifiable statement after the data processing; so that the business processor is based on the data processed The verifiable statement performs business processing on the target business.
The method according to claim 6, wherein the specified hash algorithm is the same as the algorithm used in the hash processing in the specified blockchain; the specified blockchain stores the hash value of the verifiable statement.
The method according to claim 6, wherein, before performing the business processing corresponding to the target business based on the verifiable statement after data processing, the method further comprises:

Receiving instruction information of the service processor; the instruction information is used to instruct the user holding the verifiable claim to send the service processing request of the target service to the service processor.
A business processing device based on a verifiable statement, the device comprising:

The request receiving module receives a business processing request of a target business, wherein the target business is processed based on a verifiable statement, and the business processing request includes the verifiable statement processed by the first data processing rule; In the verifiable statement processed by the rule, the field value of the statement field required by the target business is plaintext, and the field value of at least one statement field in the remaining statement fields is ciphertext encrypted based on a specified hash algorithm;

The verification module verifies the validity of the verifiable statement;

The business processing module, if the verification result is valid, execute the business processing corresponding to the target business based on the field value of the statement field required by the target business in the verifiable statement.
A business processing device based on a verifiable statement, the device comprising:

The field determination module determines the target statement field required by the target business according to the target business to be processed of the user holding the verifiable statement; the target statement field is at least one statement field in the verifiable statement;

The data processing module performs data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and excluding the verifiable statement Performing encryption processing on the field value of at least one of the declaration fields other than the target declaration field, and the encryption processing is an encryption processing based on a specified hash algorithm;

The business processing module performs business processing corresponding to the target business based on the verifiable statement after data processing.
The device according to claim 11, wherein the specified hash algorithm is the same as the algorithm used in the hash processing in the specified blockchain; the specified blockchain stores the hash value of the verifiable statement.
A business processing device based on a verifiable statement. The business processing device based on a verifiable statement includes:

Processor; and

A memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Receive a business processing request for a target business, where the target business is processed based on a verifiable statement, the business processing request includes the verifiable statement processed by the first data processing rule; all the target business processed by the first data processing rule In the verifiable statement, the field value of the statement field required by the target business is plaintext, and the field value of at least one statement field in the remaining statement fields is ciphertext encrypted based on a specified hash algorithm;

Verify the validity of the verifiable statement;

If the verification result is valid, the business processing corresponding to the target business is executed based on the field value of the statement field required by the target business in the verifiable statement.
A business processing device based on a verifiable statement. The business processing device based on a verifiable statement includes:

Processor; and

A memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Determine the target statement field required by the target business according to the target business to be processed of the user holding the verifiable statement; the target statement field is at least one statement field in the verifiable statement;

Perform data processing on the verifiable statement based on the first data processing rule; the first data processing rule includes: keeping the field value of the target statement field as plain text, and removing the target statement from the verifiable statement The field value of at least one of the declaration fields other than the field is encrypted, and the encryption processing is an encryption processing based on a specified hash algorithm;

Based on the verifiable statement after data processing, the business processing corresponding to the target business is performed.