WO2021209052A1 - 基于区块链的数据处理 - Google Patents

基于区块链的数据处理 Download PDF

Info

Publication number
WO2021209052A1
WO2021209052A1 PCT/CN2021/087884 CN2021087884W WO2021209052A1 WO 2021209052 A1 WO2021209052 A1 WO 2021209052A1 CN 2021087884 W CN2021087884 W CN 2021087884W WO 2021209052 A1 WO2021209052 A1 WO 2021209052A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
transaction
business
public key
data
Prior art date
Application number
PCT/CN2021/087884
Other languages
English (en)
French (fr)
Inventor
林建海
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2021209052A1 publication Critical patent/WO2021209052A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures

Definitions

  • One or more embodiments of this specification relate to the field of blockchain technology, and in particular to a data processing system, method, and device based on blockchain.
  • Blockchain technology also known as distributed ledger technology, is an emerging technology in which several computing devices participate in "bookkeeping" and jointly maintain a complete distributed database. Because the blockchain technology has the characteristics of decentralization, openness and transparency, each computing device can participate in database records, and the rapid data synchronization between computing devices, the blockchain technology has been widely used in many fields. To apply.
  • one or more embodiments of this specification provide a blockchain-based data processing system, method, and device.
  • a blockchain-based data processing system including: business equipment, the business equipment is used to initiate the business to the first blockchain network A binding transaction between a device and a business data contract deployed on the second blockchain network, the binding transaction being signed by the private key of the business device; and, the business device is used to send to the second zone
  • the block chain network initiates a processing transaction for the data to be processed; the first block chain network, the first node in the first block chain network is used to respond to the binding transaction by using the service device When the public key of the binding transaction passes the verification, the public key of the business device is synchronized across the chain to the second blockchain network; the second blockchain network, the second The second node in the blockchain network is used to respond to the processing transaction, in the case that the public key of the business device is used to verify the signature of the processing transaction, call the business data contract to the pending transaction Data is processed.
  • a blockchain-based data processing method which includes: a first node in a first blockchain network receives a service device initiated by a service device The binding transaction with the business data contract deployed on the second blockchain network, the binding transaction is signed by the private key of the business device; the first node is using the public key pair of the business device In the case that the binding transaction is verified and signed, the public key of the business device is synchronized across the chain to the second blockchain network, and the second node in the second blockchain network is used to respond to The processing transaction for the data to be processed initiated by the business device to the second blockchain network, in the case that the public key of the business device is used to verify and sign the processing transaction, the business data contract is invoked Process the to-be-processed data.
  • a blockchain-based data processing method which includes: a second node in a second blockchain network receives the data to be processed initiated by a business device For processing transactions, the business device is also used to initiate a binding transaction for the business device and the business data contract deployed on the second blockchain network to the first blockchain network, and the binding transaction is determined by The private key of the service device is used to sign; the second node uses the public key of the service device to verify the transaction, and then invokes the service data contract to process the to-be-processed data; The public key of the business device maintained by the second node is synchronized across the chain by the first node in the first blockchain network using the public key of the business device to verify and sign the binding transaction.
  • the second blockchain network includes: a second node in a second blockchain network receives the data to be processed initiated by a business device For processing transactions, the business device is also used to initiate a binding transaction for the business device and the business data contract deployed on the second blockchain network to the first blockchain network, and the binding transaction is determined by The private key of
  • a blockchain-based data processing device which includes: a receiving unit that enables a first node in the first blockchain network to receive a data processing device initiated by a business device The binding transaction between the service device and the service data contract deployed on the second blockchain network, and the binding transaction is signed by the private key of the service device; the synchronization unit enables the first node to use
  • the public key of the business device passes the verification of the binding transaction
  • the public key of the business device is synchronized across the chain to the second blockchain network, in the second blockchain network
  • the second node is used to respond to the processing transaction for the data to be processed initiated by the business device to the second blockchain network, in the case that the public key of the business device is used to verify the signature of the processing transaction
  • call the business data contract to process the to-be-processed data.
  • a blockchain-based data processing device which includes: a receiving unit, which enables a second node in a second blockchain network to receive a data processing device initiated by a business device For processing transactions of to-be-processed data, the business device is also used to initiate a binding transaction to the first blockchain network for the business device and the business data contract deployed on the second blockchain network, the The binding transaction is signed by the private key of the business device; the processing unit enables the second node to invoke the business data contract to verify the signature of the processing transaction using the public key of the business device.
  • the to-be-processed data is processed; the public key of the business device maintained by the second node is verified and signed by the first node in the first blockchain network using the public key of the business device In the case of passing, cross-chain synchronization to the second blockchain network.
  • an electronic device including: a processor; and a memory for storing executable instructions of the processor.
  • the processor executes the executable instruction to implement the method according to the second aspect or the third aspect.
  • a computer-readable storage medium is provided, and computer instructions are stored thereon.
  • the instructions are executed by a processor, the method described in the second or third aspect is implemented. step.
  • Fig. 1 is a schematic diagram of creating a smart contract according to an exemplary embodiment.
  • Fig. 2 is a schematic diagram of invoking a smart contract provided by an exemplary embodiment.
  • Fig. 3 is a flowchart of a block chain-based data processing method provided by an exemplary embodiment.
  • Fig. 4 is a flowchart of another blockchain-based data processing method provided by an exemplary embodiment.
  • Fig. 5 is a schematic diagram of a block chain-based data processing system provided by an exemplary embodiment.
  • Fig. 6 is an interaction diagram of registering an Internet of Things device provided by an exemplary embodiment.
  • Fig. 7 is an interaction diagram of binding an Internet of Things device provided by an exemplary embodiment.
  • Fig. 8 is an interaction diagram of a blockchain-based data processing method provided by an exemplary embodiment.
  • Fig. 9 is an interaction diagram for unbinding an IoT device according to an exemplary embodiment.
  • Fig. 10 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • Fig. 11 is a block diagram of a block chain-based data processing device provided by an exemplary embodiment.
  • Fig. 12 is a block diagram of another block chain-based data processing device provided by an exemplary embodiment.
  • the steps of the corresponding method may not be executed in the order shown and described in this specification.
  • the method may include more or fewer steps than described in this specification.
  • a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may also be combined into a single step in other embodiments. describe.
  • Blockchain is generally divided into three types: Public Blockchain, Private Blockchain and Consortium Blockchain.
  • the public chain is represented by Bitcoin and Ethereum. Participants who join the public chain can read the data records on the chain, participate in transactions, and compete for the accounting rights of new blocks. Moreover, each participant (ie, node) can freely join and exit the network, and perform related operations.
  • the private chain is the opposite.
  • the write permission of the network is controlled by an organization or institution, and the data read permission is regulated by the organization.
  • the private chain can be a weakly centralized system with strict restrictions and few participating nodes.
  • This type of blockchain is more suitable for internal use by specific institutions.
  • Consortium chain is a block chain between public chain and private chain, which can realize "partial decentralization".
  • Each node in the alliance chain usually has a corresponding entity or organization; participants are authorized to join the network and form a stakeholder alliance to jointly maintain the operation of the blockchain.
  • a smart contract on the blockchain is a contract that can be triggered and executed by a transaction on the blockchain system.
  • Smart contracts can be defined in the form of codes.
  • EVM Ethereum Virtual Machine
  • Every Ethereum node can run EVM.
  • EVM is a Turing complete virtual machine, which means that various complex logic can be implemented through it.
  • Users who publish and call smart contracts in Ethereum run on the EVM.
  • virtual machine code virtual machine bytecode, hereinafter referred to as "bytecode"
  • the smart contract deployed on the blockchain can be in the form of bytecode.
  • the EVM of node 1 can execute the transaction and generate a corresponding contract instance.
  • "0x6f8ae93" in Figure 1 represents the address of this contract, the data field of the transaction can be stored in bytecode, and the to field of the transaction is empty.
  • the contract is successfully created and can be called in the subsequent process.
  • a contract account corresponding to the smart contract appears on the blockchain and has a specific address, and the contract code will be stored in the contract account.
  • the behavior of the smart contract is controlled by the contract code.
  • the smart contract enables a virtual account containing contract code and account storage (Storage) to be generated on the blockchain.
  • the EVM of a certain node can execute the transaction and generate a corresponding contract instance.
  • the from field of the transaction in Figure 2 is the address of the account of the transaction initiator (ie Bob), the "0x6f8ae93" in the to field represents the address of the called smart contract, and the value field in Ethereum is the value of Ether ,
  • the method and parameters of calling the smart contract are stored in the data field of the transaction. Smart contracts are executed independently on each node in the blockchain network in a prescribed manner. All execution records and data are stored on the blockchain. Therefore, when the transaction is completed, the Lost transaction certificate.
  • the receipt data obtained by a node executing a transaction can include the following:
  • the Result field indicates the execution result of the transaction
  • the Gas used field indicates the gas value consumed by the transaction
  • the Logs field indicates the log generated by the transaction.
  • the log may further include the From field, To field, Topic field, and Log data field, among which the From field indicates the account address of the initiator of the call, and the To field indicates the called object (such as a smart contract)
  • the account address and Topic field indicate the subject of the log, and the Log data field indicates the log data;
  • the Output field indicates the output of the transaction.
  • the type of request initiated on the blockchain by a user accessing the blockchain may specifically refer to the transaction used in the traditional blockchain.
  • the type of request initiated on the blockchain by a user who accesses the blockchain can also be other than transactions, other forms of instructions, messages, etc. with a standard data structure.
  • One or more embodiments of this specification It is not particularly limited. In the following embodiments, the request initiated on the blockchain by a user who accesses the blockchain is taken as an example for description.
  • This specification provides a blockchain-based data processing system, which includes business equipment, a first blockchain network, and a second blockchain network.
  • the business device is used to initiate a binding transaction for the business device and the business data contract deployed on the second blockchain network to the first blockchain network, and the binding transaction is determined by the private transaction of the business device. Key for signing; and, the service device is used to initiate a processing transaction for the data to be processed to the second blockchain network.
  • the first node in the first blockchain network uses the public key of the service device to verify the binding transaction and crosses the public key of the service device.
  • the chain is synchronized to the second blockchain network.
  • the second node in the second blockchain network uses the public key of the business device to verify the processing transaction and invokes the business data contract for the pending transaction. Data is processed.
  • FIG. 3 is a flowchart of a blockchain-based data processing method on the network side of the first blockchain provided by an exemplary embodiment. As shown in Figure 3, the method is applied to the first node in the first blockchain network (any node in the first blockchain network), and may include the following steps:
  • Step 302 The first node in the first blockchain network receives a binding transaction initiated by the business device for the business device and the business data contract deployed on the second blockchain network, and the binding transaction is determined by the business device.
  • the private key of the service device is used for signing.
  • the business device creates the binding transaction, signs the binding transaction, and submits the binding transaction to the first blockchain network.
  • the processing performance of the business device is poor, and there are not enough processing resources to perform the operations of creating, signing, and submitting the transaction.
  • the blockchain-based data processing system may also include an access device, which assists the business device to complete the access to the first blockchain network and the second blockchain network, instead of the business device Interact with the first blockchain network and the second blockchain network, and return the obtained results to the business equipment.
  • the business device can send a binding request for the business device and the business data contract to the access device, and the access device can respond to the binding request, Create a binding transaction and use the private key of the business device to sign the binding transaction, and then submit the signed binding transaction to the first blockchain network.
  • the business device can record its own device ID and the contract address of the business data contract in the binding request.
  • a business device when a business device generates data to be processed or obtains data to be processed from other devices, and then needs to call the business data contract deployed on the second blockchain network to process the data to be processed, it can be connected to
  • the access device sends a processing request for the data to be processed, then the access device can respond to the processing request, create a processing transaction and use the private key of the business device to sign the processing transaction, and then submit the signed processing to the second blockchain network trade.
  • the first node may establish a mapping relationship between the contract address of the business data contract and the business device in response to the binding transaction. Then, the access device can determine the business data contract bound to the business device according to the mapping relationship (that is, obtain the contract address of the business data contract), and store the contract address of the business data contract in the to field of the transaction processing, so as to pass Process the transaction to call the business data contract.
  • the access device may obtain the mapping relationship established by the first node, and cache the obtained mapping relationship locally, so as to subsequently respond to the processing sent by the service device
  • the business data contract bound to the business device is determined according to the mapping relationship in the local cache, without the need to query the first blockchain network for the business data bound to the business device in real time after receiving the processing request Contract, thereby improving the efficiency of data processing.
  • the access device may, in response to the processing request sent by the business device, first submit the query transaction for the business device to the first node in the first blockchain network, so that the first node responds to the query transaction Query the mapping relationship corresponding to the service device.
  • the access device obtains the mapping relationship queried by the first node, and determines the service data contract bound to the service device according to the obtained mapping relationship.
  • Step 304 The first node synchronizes the public key of the business device to the second blockchain network across the chain in the case that the public key of the business device is used to verify and sign the binding transaction.
  • the second node in the second blockchain network is used to respond to the processing transaction for the data to be processed initiated by the business device to the second blockchain network, In the case that the key passes the processing transaction verification, the business data contract is invoked to process the to-be-processed data.
  • the first blockchain network is responsible for the unified management of the public keys of all business devices
  • the second blockchain network is responsible for processing the data to be processed from the business devices.
  • the processing of the data to be processed is realized by deploying a business data contract on the second blockchain network.
  • the processing method may include publishing the data to the blockchain for storage, identifying the data, and calculating the data, etc. ; Of course, this manual does not limit the specific processing methods of the data.
  • different blockchain networks can be built to provide corresponding services, that is, there can be multiple second blockchain networks. Take deposit data as an example. Different types of business equipment produce different data types.
  • the business data generated by the business equipment of the business party is stored on the consortium chain built by itself, so that only the consortium chain that belongs to the business party is built. Only members of the company have the right to access business data, ensuring that business data is only transferred between alliance members, which is conducive to improving the privacy of business data.
  • a new second blockchain network can be built to realize the business needs, so as to expand the business horizontally by slicing the business level, effectively improving the blockchain’s performance. Throughput.
  • the second blockchain network After the second blockchain network receives the processing transaction initiated by the business device, it needs to use the public key of the business device to verify the transaction, and the public keys of all business devices are determined by the first block.
  • Chain Network is responsible for unified management. Those skilled in the art should understand that the cross-chain communication method is inefficient and requires a large amount of processing resources of the blockchain node. Therefore, if the second blockchain network queries the first blockchain network for the public key of the business device through cross-chain communication every time it receives a processing transaction initiated by a business device, frequent cross-chain communication will severely affect the performance of the first blockchain network and the second blockchain network.
  • the first blockchain network is responsible for verifying the binding transaction, and if the verification is passed, the public key of the business device Cross-chain synchronization to the second blockchain network, so that the second node in the second blockchain network can directly process the transaction verification according to the public key pair maintained by itself, without having to receive the business device initiated each time
  • the public key of the business equipment is inquired from the first blockchain network through cross-chain communication. It can be seen that the data processing scheme in this manual can effectively avoid frequent cross-chain communication, thereby improving the efficiency of data processing , And can improve the performance of the blockchain network.
  • the business device when the binding relationship between the business device and the business data contract needs to be released, the business device can initiate an unbinding transaction for the business device and the business data contract to the first blockchain network. Then, in response to the unbinding transaction, the first node can submit the first cross-chain invalidation request for the public key of the service device to the second node in the case that the public key of the service device is used to verify the signature of the unbinding transaction. , So that the second node deletes the public key of the service device maintained by the second node in response to the first cross-chain invalidation request.
  • the first node can monitor the validity period of the public key of the service device maintained, and when it is determined that the public key of the service device has expired, delete the public key of the service device maintained by the first node, and send the notification to the first node.
  • the two nodes submit a second cross-chain invalidation request for the public key of the service device, so that the second node is used to delete the public key of the service device maintained by the second node in response to the second cross-chain invalidation request.
  • the business device can initiate a cancellation transaction for the business device to the first blockchain network, then the first node adopts the public key of the business device to verify the signature of the cancellation transaction.
  • Delete the public key of the service device maintained by the first node and submit a second cross-chain invalidation request for the public key of the service device to the second node, so that the second node is used to delete the first cross-chain invalidation request in response to the second cross-chain invalidation request.
  • the public key of the business device maintained by the second node is used to delete the first cross-chain invalidation request in response to the second cross-chain invalidation request.
  • any member of the blockchain can access data on the blockchain.
  • members who join the second blockchain network can query the public of the business equipment maintained in the second blockchain network. Key, thereby inferring the business information of the related business, leading to the leakage of business privacy. For example, after querying the number of public keys maintained by the second blockchain network, it can be inferred from this how many business devices the second blockchain network has established a cooperative relationship with.
  • the first blockchain network also has similar hidden dangers of privacy leakage. Therefore, the first node in the first blockchain network and the second node in the second blockchain network can maintain the public keys of the business equipment in the TEE (Trusted Execution Environment) deployed respectively, So as to solve the above-mentioned hidden danger of privacy leakage.
  • TEE Trusted Execution Environment
  • TEE is a secure extension based on CPU hardware and a trusted execution environment that is completely isolated from the outside. TEE can play the role of a black box in the hardware. Neither the code executed in the TEE nor the data operating system layer can be peeped, and only the pre-defined interface in the code can operate on it. In terms of efficiency, due to the black box nature of TEE, plaintext data is calculated in TEE instead of complex cryptographic operations in homomorphic encryption. There is no loss of efficiency in the calculation process. Therefore, the combination of TEE can achieve less performance loss. Under the premise, the security and privacy of the blockchain are greatly improved.
  • SGX provides a circle, that is, an encrypted trusted execution area in the memory, and the CPU protects data from being stolen.
  • the SGX-supported CPU used by the blockchain node as an example.
  • EPC Enclave Page Cache, Enclave Page Cache, Enclave Page Cache
  • the engine MEE Memory Encryption Engine
  • SGX users can distrust the operating system, VMM (Virtual Machine Monitor), and even BIOS (Basic Input Output System). They only need to trust the CPU to ensure that private data will not leakage.
  • the first node maintains the public key of the business device, establishes a mapping relationship, and verifies the signature
  • the second node maintains the public key of the business device, verifies the signature, and processes to-be-processed data, etc.
  • a device management contract can be deployed on the first blockchain network to maintain the public key of the business device and use the maintained public key to verify signatures, and to deploy a business binding contract to establish a mapping relationship and synchronize the public key across the chain To the second blockchain network.
  • a device shadow contract can be deployed on the second blockchain network to maintain the first node's cross-chain synchronization public key and use the maintained public key to verify signatures.
  • a business binding contract can be deployed on the first blockchain network to maintain the public key of the business device, use the maintained public key to verify the signature, establish a mapping relationship, and synchronize the public key across the chain to the second blockchain The internet.
  • a business data contract can be deployed on the second blockchain network to maintain the first node's cross-chain synchronization public key, use the maintained public key to verify the signature, and process the data to be processed.
  • these logics can also be defined in the chain code, so that the nodes in the blockchain network can complete the above operations by executing the chain code.
  • this specification also proposes an embodiment on the second blockchain network side.
  • the description involved in the first blockchain network side embodiment can also be applied to the first blockchain network side embodiment.
  • Second, the embodiment of the blockchain network side will not be described in detail below.
  • FIG. 4 is a flowchart of a blockchain-based data processing method on the second blockchain network side according to an exemplary embodiment. As shown in Figure 4, the method is applied to the second node in the second blockchain network (any node in the second blockchain network), and may include the following steps:
  • a second node in the second blockchain network receives a processing transaction for the data to be processed initiated by a business device, and the business device also initiates a transaction for the business device and deployed on the first blockchain network.
  • a binding transaction of a business data contract on the second blockchain network, and the binding transaction is signed by the private key of the business device.
  • the second node invokes the business data contract to process the to-be-processed data when the public key of the business device is used to verify the transaction.
  • the public key of the business device is synchronized across the chain to the second blockchain by the first node in the first blockchain network using the public key of the business device to verify and sign the binding transaction.
  • the internet The internet.
  • the binding transaction is created by the access device in response to the binding request for the service device and the service data contract sent by the service device, and is used by the access device.
  • the private key of the business device is signed and submitted to the first blockchain network;
  • the processing transaction is created by the access device in response to the processing request for the to-be-processed data sent by the business device, and After being signed by the access device using the private key of the service device, it is submitted to the second blockchain network.
  • the processing transaction is created by the access device after determining the business data contract based on the mapping relationship between the contract address of the business data contract established by the first node and the business device.
  • mapping relationship established by the first node is acquired by the access device and then cached locally, so that when the access device responds to the processing request, according to the locally cached
  • the mapping relationship determines the business data contract.
  • the access device determines the service data contract by obtaining the mapping relationship inquired by the first node in response to the query transaction for the service device submitted by the access device, so The query transaction is submitted by the access device in response to the processing request.
  • the second node receives the first cross-chain invalidation request for the public key of the service device submitted by the first node, and the first cross-chain invalidation request is adopted by the first node.
  • the public key pair of the business device is submitted when the received unbinding transaction for the business device and the business data contract has passed the verification; in response to the first cross-chain invalidation request, delete the second The public key of the service device maintained by the node.
  • the second node receives a second cross-chain invalidation request for the public key of the service device submitted by the first node, and the second cross-chain invalidation request is determined by the first node when the service device is The public key expires, or it is submitted when the cancellation transaction for the business device received using the public key of the business device has passed the verification; in response to the second cross-chain invalidation request, delete the first The public key of the service device maintained by the second node.
  • the public key of the service device is maintained in the trusted execution environment deployed on the first node and the second node, respectively.
  • Tbox50 needs to periodically report the real location information and operating status information to the service chain 53 so that these data can be recorded on the service chain 53 in a credible and unchangeable manner.
  • Tbox50 needs to register and release the device public key with the device chain 52 (i.e. the first blockchain) through the access device 51, and connect the service chain 53 (i.e. the second block chain) corresponding to Tbox50 and Tbox50. For example, it can be called a trailer chain) binding to establish a mapping relationship.
  • the device chain 52 synchronizes the device public key across the chain to the service chain 53 after completing the binding.
  • Tbox50 directly publishes data to the business chain 53 through the access device 51, and the blockchain node in the business chain 53 is responsible for verifying the reported data to ensure that the data comes from the Tbox50 and not through other devices. Falsified data after tampering. After the trailer is retired or sold, the binding relationship between the Tbox 50 and the service chain 53 can be released through the unbinding and deregistration process, and the Tbox 50 cannot publish data to the service chain 53 after the binding relationship is released.
  • multiple business chains can be included, and each business chain corresponds to a different business that the IOT device participates in.
  • the above system architecture may also include a service chain 54.
  • the device chain 52 can also synchronize the device public key of the Tbox 50 across the chain to the service chain 54.
  • the Tbox 50 can also report data to the service chain 54 so that the blockchain on the service chain 54 The node processes the reported data when the device public key is used to verify the signature.
  • this specification does not limit the application scenarios of the data processing system, and can be flexibly selected according to actual needs.
  • it can also be applied to the security field.
  • the surveillance camera reports the captured image information to the business chain (for example, it can be called the security chain) through the above process, so that the image information can be identified by the business data contract.
  • FIG. 6 is an interaction diagram of registering an Internet of Things device according to an exemplary embodiment.
  • the interaction process may include the following steps:
  • Step 602 The vehicle-mounted Tbox generates an asymmetric key pair.
  • the vehicle-mounted Tbox may use asymmetric encryption algorithms such as RSA, Elgamal, knapsack algorithm, Rabin, D-H, and ECC (elliptic curve encryption algorithm).
  • RSA RSA
  • Elgamal knapsack algorithm
  • Rabin Rabin
  • D-H D-H
  • ECC elliptic curve encryption algorithm
  • Step 604 The vehicle-mounted Tbox sends an asymmetric key pair to the access device.
  • Step 606 The access device creates a transaction for invoking the device management contract.
  • the access device can store the private key of the vehicle-mounted Tbox, so that it can replace the vehicle-mounted Tbox to implement the signature operation.
  • the transaction created by the access device to call the device management contract contains the public key of the on-board Tbox.
  • the transaction will be certified on the blockchain. Users can view the transaction.
  • users of the blockchain can query the public keys of the business equipment maintained in the blockchain, thereby inferring the business information of the relevant business, leading to the leakage of business privacy. For example, after querying the number of public keys maintained by the blockchain, it can be used to infer how many business devices are registered on the blockchain.
  • the access device can use digital envelope encryption to encrypt the created transaction, which combines a symmetric encryption algorithm and an asymmetric encryption algorithm.
  • the symmetric key of the access device (or the vehicle-mounted Tbox) can be used to encrypt the transaction content, and then the public key of the blockchain node can be used to encrypt the symmetric key.
  • the blockchain node uses its own private key to decrypt to obtain the symmetric key, and then uses the decrypted symmetric key to decrypt the transaction content to obtain the public key of the vehicle Tbox (in plaintext), and then read the public key of the vehicle Tbox into Maintenance is carried out in the TEE deployed by itself.
  • the transaction evidenced on the blockchain is in the form of cipher text (encrypted by a digital envelope), so there is no hidden danger of privacy leakage.
  • Step 608 The access device submits the transaction to the device chain.
  • Step 610 In response to the received transaction, the blockchain node on the device chain executes the device management contract, and stores the public key of the Tbox in the device management contract.
  • Step 612 The access device obtains the contract invocation result.
  • the device management contract can generate an event containing the result of the contract call and store it in the blockchain log. Then, the access device can obtain the event through the callback mechanism of the blockchain to view the result of the contract call.
  • Step 614 The access device returns the contract invocation result to the vehicle-mounted Tbox.
  • FIG. 7 is an interaction diagram of binding an Internet of Things device provided by an exemplary embodiment. As shown in Figure 7, the interaction process may include the following steps:
  • Step 702 The vehicle-mounted Tbox generates a binding request.
  • Step 704 The vehicle-mounted Tbox sends a binding request to the access device.
  • the vehicle-mounted Tbox can record its own device ID and the contract address of the service binding contract in the binding request, so that when the access device creates the binding transaction, it stores the service binding in the to field of the binding transaction.
  • the contract address of the specified contract is used to indicate that the binding transaction is used to call the business binding contract; and the device ID of the vehicle-mounted Tbox is stored in the data field (or other fields) for subsequent establishment of the mapping relationship.
  • the binding request only includes the device ID, and the access device queries the contract address of the service binding contract.
  • Step 706 The access device creates a binding transaction and signs it with the private key of the vehicle-mounted Tbox.
  • Step 708 The access device submits the binding transaction to the device chain.
  • step 710 the blockchain node on the device chain executes the business binding contract and initiates a call to the device management contract.
  • Step 712 the blockchain node on the device chain executes the device management contract to verify the signature of the binding transaction.
  • the signature verification logic can be defined in the equipment management contract to verify the signature.
  • the blockchain node on the device chain can call the device management contract to execute the verification logic defined in the device management contract to verify the signature of the binding transaction.
  • Step 714 The equipment management contract returns the verification result to the service binding contract.
  • the device management contract may also return the public key of the vehicle-mounted Tbox to the service binding contract.
  • Step 716 The business binding contract establishes a mapping relationship between the on-board Tbox and the contract address of the business data contract.
  • the mapping relationship between the device ID of the vehicle-mounted Tbox and the contract address is established.
  • step 718 the business binding contract calls the device shadow contract deployed on the business chain across the chain to synchronize the public key of the vehicle-mounted Tbox to the device shadow contract across the chain.
  • cross-chain relays can be connected to multiple blockchains through the bridge interface, and based on the implemented data handling logic, the cross-chain data synchronization between the multiple blockchains can be completed.
  • the cross-chain technology used in the implementation of the above-mentioned cross-chain relay is not particularly limited in this specification; for example, in practical applications, multiple blocks can be combined through cross-chain mechanisms such as side-chain technology and notary technology.
  • the chains are connected.
  • the data on other blockchains can be read and authenticated between the blockchains, and they can also be deployed on other blockchains through cross-chain relays. Smart contract.
  • cross-chain relay is only used to transfer data between multiple blockchains, and does not require persistent storage of the transferred data, nor does it need to maintain the data status of the transferred data.
  • cross-chain relays can be configured on devices, nodes, or platforms other than the multiple blockchains connected to it, or on the node devices of multiple blockchains connected to it. It is not particularly limited in this specification.
  • Step 720 The device shadow contract stores the public key of the vehicle-mounted Tbox.
  • Step 722 The business binding contract obtains the calling result of the cross-chain calling device shadow contract.
  • Step 724 The access device obtains the binding result.
  • Step 726 The access device locally caches the mapping relationship recorded in the binding result.
  • Step 728 The access device returns the binding result to the vehicle-mounted Tbox.
  • the subsequent vehicle-mounted Tbox can initiate a processing transaction to the business chain, thereby invoking the business data contract to process the data of the vehicle-mounted Tbox.
  • FIG. 8 is an interaction diagram of a blockchain-based data processing method provided by an exemplary embodiment. As shown in Figure 8, the interaction process may include the following steps:
  • Step 802 The vehicle-mounted Tbox generates a processing request (including data to be processed).
  • the vehicle-mounted Tbox collects the location information and operating status information of the vehicle, thereby initiating a call to the business data contract on the business chain, and the business data contract processes the collected information.
  • Step 804 The vehicle-mounted Tbox sends a processing request to the access device.
  • Step 806 The access device determines the contract address of the service data contract according to the mapping relationship in the local cache.
  • Step 808 the access device creates and processes the transaction, and uses the private key of the vehicle-mounted Tbox to sign.
  • the access device stores the contract address of the business data contract in the to field of the processing transaction, which is used to indicate that the processing transaction is used to call the business data contract; and the data to be processed is stored in the data field (or other fields) .
  • Step 810 The access device submits a processing transaction to the service chain to invoke the service data contract.
  • step 812 the blockchain node on the business chain executes the business data contract and initiates a call to the device shadow contract.
  • Step 814 the blockchain node on the business chain executes the device shadow contract to verify the signature of the processing transaction.
  • the signature verification logic can be defined in the device shadow contract to verify the signature.
  • the blockchain node on the business chain can call the device shadow contract to execute the verification logic defined in the device shadow contract to verify the signature of the processing transaction.
  • the business binding contract on the device chain synchronizes the public key of the vehicle Tbox across the chain to the device shadow contract.
  • the device shadow contract uses the public key of the vehicle Tbox to verify the signature.
  • the verification result is the verification passed.
  • Step 816 The device shadow contract returns the verification result to the business data contract.
  • step 818 the business data contract processes the data to be processed.
  • processing logic can be defined in the business data contract for processing data. Then, when the verification result is that the verification is passed, the blockchain node on the business chain invokes the business data contract to execute the processing logic defined in the business data contract, and processes the data to be processed.
  • the specific processing method of the processing logic can be flexibly set according to the actual scenario, such as publishing the data to the blockchain for storage, identifying the data, calculating the data, etc.; of course, this manual does not deal with the specific processing method of the data Make restrictions.
  • Step 820 The access device obtains the processing result.
  • Step 822 The access device returns the processing result to the vehicle-mounted Tbox.
  • FIG. 9 is an interaction diagram for unbinding an IoT device according to an exemplary embodiment.
  • the interaction process may include the following steps:
  • Step 902 The vehicle-mounted Tbox generates an unbinding request.
  • Step 904 The vehicle-mounted Tbox sends an unbinding request to the access device.
  • step 906 the access device creates an unbinding transaction and signs it with the private key of the vehicle-mounted Tbox.
  • step 908 the access device submits an unbinding transaction to the device chain.
  • step 910 the blockchain node on the device chain executes the business binding contract and initiates a call to the device management contract.
  • step 912 the blockchain node on the device chain executes the device management contract to verify the signature of the unbinding transaction.
  • Step 914 The equipment management contract returns the verification result to the service binding contract.
  • Step 916 The business binding contract cancels the mapping relationship between the vehicle-mounted Tbox and the contract address of the business data contract.
  • Step 918 the business binding contract calls the device shadow contract deployed on the business chain across the chain.
  • Step 920 the device shadow contract deletes the public key of the vehicle-mounted Tbox.
  • Step 922 the business binding contract obtains the invocation result.
  • Step 924 The access device obtains the unbinding result.
  • Step 926 The access device deletes the mapping relationship in the local cache.
  • Step 928 The access device returns the unbinding result to the vehicle-mounted Tbox.
  • the device management contract can also monitor the validity period of the public key of each vehicle Tbox that it maintains. Assuming that the device management contract detects that the public key of the vehicle TboxA expires, delete the public key of the vehicle TboxA and cross The chain calls the device shadow contract to delete the on-board TboxA public key maintained in the device shadow contract.
  • the vehicle-mounted Tbox can also submit a cancellation transaction for the vehicle-mounted Tbox to the device chain through the access device (signature with the private key of the vehicle-mounted Tbox), thereby calling the device management contract to delete the public key of the vehicle-mounted Tbox, and
  • the device management contract cross-chain calls the device shadow contract to delete the public key of the vehicle Tbox. It should be noted that only when the vehicle-mounted Tbox is unbound, the logout operation for the vehicle-mounted Tbox can be initiated.
  • the business equipment in this manual includes the following equipment states: unbound state without public key, unbound public key invalid state, bound public key invalid state, unbound public key valid state, and bound public key valid state .
  • the service device is initialized in an unbound state without a public key.
  • the unbound state without public key the service device is in the effective state of unbound public key after generating the public key.
  • the service device In the invalid state of the unbound public key, the service device is in the valid state of the unbound public key after updating the public key.
  • the valid state of the unbound public key after the public key of the service device is cancelled or the public key expires, the service device returns to the invalid state of the unbound public key.
  • the service device In the valid state of the unbound public key, the service device is in the valid state of the bound public key after being bound to the service chain. In the valid state of the bound public key, the service device is in the valid state of the unbound public key after unbinding with the service chain. In the valid state of the bound public key, the public key of the service device is in the invalid state of the bound public key after expiration. In the invalid state of the bound public key, the service device is in the valid state of the bound public key after updating the public key.
  • this specification also provides an embodiment of a data processing device based on blockchain.
  • the embodiments of the block chain-based data processing device in this specification can be applied to electronic equipment.
  • the device embodiments can be implemented by software, or can be implemented by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory through the processor of the electronic device where it is located.
  • FIG. 10 is a schematic structural diagram of a device provided by an exemplary embodiment.
  • the device includes a processor 1002, an internal bus 1004, a network interface 1006, a memory 1008, and a non-volatile memory 1010, and of course, it may also include hardware required for other services.
  • the processor 1002 reads the corresponding computer program from the non-volatile memory 1010 to the memory 1008 and then runs it to form a data processing device based on the blockchain at the logical level.
  • one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each
  • the logic unit can also be a hardware or a logic device.
  • the blockchain-based data processing device on the first blockchain network side may include:
  • the receiving unit 1101 enables the first node in the first blockchain network to receive a binding transaction initiated by the business device for the business device and the business data contract deployed on the second blockchain network, the binding transaction Signed by the private key of the service device;
  • the synchronization unit 1102 enables the first node to synchronize the public key of the business device to the second block across the chain when the binding transaction is verified and signed by the public key of the business device Chain network, the second node in the second block chain network is used to respond to the processing transaction for the data to be processed initiated by the business device to the second block chain network.
  • the service data contract is invoked to process the to-be-processed data.
  • the binding transaction is created by the access device in response to a binding request for the service device and the service data contract sent by the service device, and is used by the access device
  • the private key of the business device is signed and submitted to the first blockchain network
  • the processing transaction is created by the access device in response to the processing request for the to-be-processed data sent by the business device, and is The access device uses the private key of the service device to sign and submit it to the second blockchain network.
  • the first node establishes a mapping relationship between the contract address of the service data contract and the service device; the access device performs the transaction processing according to the mapping relationship. Create after determining the business data contract.
  • mapping relationship established by the first node is acquired by the access device and then cached locally, so that when the access device responds to the processing request, according to the locally cached mapping The relationship determines the business data contract.
  • it further includes: a query unit 1104, where the first node receives the query transaction for the service device submitted by the access device in response to the processing request, and queries the service device corresponding to the service device. Mapping relationship; the access device determines the service data contract by obtaining the mapping relationship queried by the first node.
  • the first node receives an unbinding transaction for the service device and the service data contract, and uses the public key of the service device to perform the unbinding transaction.
  • the binding transaction passes the verification, submit a first cross-chain invalidation request for the public key of the business device to the second node, and the first cross-chain invalidation request is used to instruct the second node to delete the The public key of the service device maintained by the second node.
  • it further includes: a second maintenance unit 1106, where the first node determines that the public key of the service device expires, or uses the public key pair of the service device to receive the received information for the service device. If the cancellation transaction passes the verification, delete the public key of the service device maintained by the first node;
  • the public key of the service device is separately maintained in a trusted execution environment deployed on the first node and the second node.
  • the blockchain-based data processing device on the second blockchain network side may include:
  • the receiving unit 1201 enables a second node in the second blockchain network to receive a processing transaction for the data to be processed initiated by a business device, and the business device is also used to initiate a transaction to the first blockchain network for the business device and A binding transaction of a business data contract deployed on the second blockchain network, the binding transaction being signed by the private key of the business device;
  • the processing unit 1202 enables the second node to invoke the business data contract to process the to-be-processed data when the public key of the business device is used to verify the signature of the processing transaction; the second node maintains The public key of the business device is synchronized to the second area across the chain by the first node in the first blockchain network using the public key of the business device to verify and sign the binding transaction Block chain network.
  • the binding transaction is created by the access device in response to a binding request for the service device and the service data contract sent by the service device, and is used by the access device
  • the private key of the business device is signed and submitted to the first blockchain network
  • the processing transaction is created by the access device in response to the processing request for the to-be-processed data sent by the business device, and is The access device uses the private key of the service device to sign and submit it to the second blockchain network.
  • the processing transaction is created by the access device after determining the business data contract according to the mapping relationship between the contract address of the business data contract established by the first node and the business device.
  • mapping relationship established by the first node is acquired by the access device and then cached locally, so that when the access device responds to the processing request, according to the locally cached mapping The relationship determines the business data contract.
  • the access device determines the service data contract by acquiring the mapping relationship queried by the first node in response to a query transaction for the service device submitted by the access device, and The query transaction is submitted by the access device in response to the processing request.
  • it further includes: a first maintenance unit 1203, where the second node receives a first cross-chain invalidation request for the public key of the service device submitted by the first node, and the first cross-chain invalidation request Submitted by the first node when the unbinding transaction for the business device and the business data contract received using the public key pair of the business device has passed the verification; in response to the first cross-chain The invalidation request is to delete the public key of the service device maintained by the second node.
  • it further includes: a second maintenance unit 1204, where the second node receives a second cross-chain invalidation request for the public key of the service device submitted by the first node, and the second cross-chain invalidation request Submitted by the first node when it is determined that the public key of the service device has expired, or when the cancellation transaction for the service device received using the public key pair of the service device has passed the verification; in response to The second cross-chain invalidation request deletes the public key of the service device maintained by the second node.
  • a second maintenance unit 1204 where the second node receives a second cross-chain invalidation request for the public key of the service device submitted by the first node, and the second cross-chain invalidation request Submitted by the first node when it is determined that the public key of the service device has expired, or when the cancellation transaction for the service device received using the public key pair of the service device has passed the verification; in response to The second cross-chain invalidation request deletes the public key of the service device maintained by the second node.
  • the public key of the service device is separately maintained in a trusted execution environment deployed on the first node and the second node.
  • a typical implementation device is a computer.
  • the computer may be, for example, a personal computer, a laptop computer, a cell phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or Any combination of these devices.
  • this specification can be provided as a method, a system, or a computer program product. Therefore, this specification may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types.
  • This specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network.
  • program modules can be located in local and remote computer storage media including storage devices.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the computer includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.
  • the memory may include non-permanent memory in computer readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash memory
  • Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
  • the information can be computer-readable instructions, data structures, program modules, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission media, can be used to store information that can be accessed by computing devices.
  • computer-readable media does not include transitory media, such as modulated data signals and carrier waves.
  • first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
  • word “if” as used herein can be interpreted as "when” or “when” or "in response to determination”.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Bioethics (AREA)
  • Finance (AREA)
  • General Health & Medical Sciences (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Data Mining & Analysis (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种基于区块链的数据处理系统及方法、装置，包括：业务设备，用于向第一区块链网络发起针对业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，绑定交易由业务设备的私钥进行签名；以及，业务设备用于向第二区块链网络发起针对待处理数据的处理交易；第一区块链网络中的第一节点用于响应于绑定交易，在采用业务设备的公钥对绑定交易验签通过的情况下，将业务设备的公钥跨链同步至第二区块链网络；第二区块链网络中的第二节点用于响应于处理交易，在采用业务设备的公钥对处理交易验签通过的情况下，调用业务数据合约对待处理数据进行处理。

Description

基于区块链的数据处理 技术领域
本说明书一个或多个实施例涉及区块链技术领域，尤其涉及一种基于区块链的数据处理系统及方法、装置。
背景技术
区块链技术，也被称之为分布式账本技术，是一种由若干台计算设备共同参与“记账”，共同维护一份完整的分布式数据库的新兴技术。由于区块链技术具有去中心化、公开透明、每台计算设备可以参与数据库记录、并且各计算设备之间可以快速的进行数据同步的特性，使得区块链技术已在众多的领域中广泛的进行应用。
发明内容
有鉴于此，本说明书一个或多个实施例提供一种基于区块链的数据处理系统及方法、装置。
为实现上述目的，本说明书一个或多个实施例提供技术方案如下：
根据本说明书一个或多个实施例的第一方面，提出了一种基于区块链的数据处理系统，包括：业务设备，所述业务设备用于向第一区块链网络发起针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；以及，所述业务设备用于向所述第二区块链网络发起针对待处理数据的处理交易；所述第一区块链网络，所述第一区块链网络中的第一节点用于响应于所述绑定交易，在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络；所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
根据本说明书一个或多个实施例的第二方面，提出了一种基于区块链的数据处理方法，包括：第一区块链网络中的第一节点接收业务设备发起的针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；所述第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述业务设备向所述第二区块链网络发起的针对待处理数据的处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
根据本说明书一个或多个实施例的第三方面，提出了一种基于区块链的数据处理方法，包括：第二区块链网络中的第二节点接收业务设备发起的针对待处理数据的处理交易，所述业务设备还用于向第一区块链网络发起针对所述业务设备和部署于所述第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；所述第二节点在采用业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理；所述第二节点维护的所述业务设备的公钥由第一区块链网络中的第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下跨链同步至所述第二区块链网络。
根据本说明书一个或多个实施例的第四方面，提出了一种基于区块链的数据处理装 置，包括：接收单元，使第一区块链网络中的第一节点接收业务设备发起的针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；同步单元，使所述第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述业务设备向所述第二区块链网络发起的针对待处理数据的处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
根据本说明书一个或多个实施例的第五方面，提出了一种基于区块链的数据处理装置，包括：接收单元，使第二区块链网络中的第二节点接收业务设备发起的针对待处理数据的处理交易，所述业务设备还用于向第一区块链网络发起针对所述业务设备和部署于所述第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；处理单元，使所述第二节点在采用业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理；所述第二节点维护的所述业务设备的公钥由第一区块链网络中的第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下跨链同步至所述第二区块链网络。
根据本说明书一个或多个实施例的第六方面，提出了一种电子设备，包括：处理器；用于存储处理器可执行指令的存储器。其中，所述处理器通过运行所述可执行指令以实现如第二方面或第三方面所述的方法。
根据本说明书一个或多个实施例的第七方面，提出了一种计算机可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现如第二或第三方面所述方法的步骤。
附图说明
图1是一示例性实施例提供的一种创建智能合约的示意图。
图2是一示例性实施例提供的一种调用智能合约的示意图。
图3是一示例性实施例提供的一种基于区块链的数据处理方法的流程图。
图4是一示例性实施例提供的另一种基于区块链的数据处理方法的流程图。
图5是一示例性实施例提供的一种基于区块链的数据处理系统的架构示意图。
图6是一示例性实施例提供的一种注册物联网设备的交互图。
图7是一示例性实施例提供的一种绑定物联网设备的交互图。
图8是一示例性实施例提供的一种基于区块链的数据处理方法的交互图。
图9是一示例性实施例提供的一种解除绑定物联网设备的交互图。
图10是一示例性实施例提供的一种设备的结构示意图。
图11是一示例性实施例提供的一种基于区块链的数据处理装置的框图。
图12是一示例性实施例提供的另一种基于区块链的数据处理装置的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本说明书一个或多个实施例相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本说明书一个或多个实施例的一些方 面相一致的装置和方法的例子。
需要说明的是：在其他实施例中并不一定按照本说明书示出和描述的顺序来执行相应方法的步骤。在一些其他实施例中，其方法所包括的步骤可以比本说明书所描述的更多或更少。此外，本说明书中所描述的单个步骤，在其他实施例中可能被分解为多个步骤进行描述；而本说明书中所描述的多个步骤，在其他实施例中也可能被合并为单个步骤进行描述。
区块链一般被划分为三种类型：公有链(Public Blockchain)，私有链(Private Blockchain)和联盟链(Consortium Blockchain)。此外，还有多种类型的结合，比如私有链+联盟链、联盟链+公有链等不同组合形式。其中去中心化程度最高的是公有链。公有链以比特币、以太坊为代表，加入公有链的参与者可以读取链上的数据记录、参与交易以及竞争新区块的记账权等。而且，各参与者(即节点)可自由加入以及退出网络，并进行相关操作。私有链则相反，该网络的写入权限由某个组织或者机构控制，数据读取权限受组织规定。简单来说，私有链可以为一个弱中心化系统，参与节点具有严格限制且少。这种类型的区块链更适合于特定机构内部使用。联盟链则是介于公有链以及私有链之间的区块链，可实现“部分去中心化”。联盟链中各个节点通常有与之相对应的实体机构或者组织；参与者通过授权加入网络并组成利益相关联盟，共同维护区块链运行。
不论是公有链、私有链还是联盟链，都可提供智能合约的功能。区块链上的智能合约是在区块链系统上可被交易触发执行的合约。智能合约可通过代码的形式定义。
以以太坊为例，支持用户在以太坊网络中创建并调用一些复杂的逻辑，这是以太坊区别于比特币区块链技术的最大挑战。以太坊作为一个可编程区块链的核心是以太坊虚拟机(EVM)，每个以太坊节点都可以运行EVM。EVM是一个图灵完备的虚拟机，这意味着可以通过它实现各种复杂的逻辑。用户在以太坊中发布和调用智能合约就是在EVM上运行的。实际上，虚拟机直接运行的是虚拟机代码(虚拟机字节码，下简称“字节码”)。部署在区块链上的智能合约可以是字节码的形式。
例如图1所示，Bob将一个包含创建智能合约信息的交易发送到以太坊网络后，节点1的EVM可以执行这个交易并生成对应的合约实例。图中1中的“0x6f8ae93…”代表了这个合约的地址，交易的data字段保存的可以是字节码，交易的to字段为空。节点间通过共识机制达成一致后，这个合约成功创建，并且可以在后续过程中被调用。合约创建后，区块链上出现一个与该智能合约对应的合约账户，并拥有一个特定的地址，合约代码将保存在该合约账户中。智能合约的行为由合约代码控制。换句话说，智能合约使得区块链上产生包含合约代码和账户存储(Storage)的虚拟账户。
如图2所示，仍以以太坊为例，Bob将一个用于调用智能合约的交易发送到以太坊网络后，某一节点的EVM可以执行这个交易并生成对应的合约实例。图中2中交易的from字段是交易发起方(即Bob)的账户的地址，to字段中的“0x6f8ae93…”代表了被调用的智能合约的地址，value字段在以太坊中是以太币的值，交易的data字段保存的调用智能合约的方法和参数。智能合约以规定的方式在区块链网络中每个节点独立的执行，所有执行记录和数据都保存在区块链上，所以当交易完成后，区块链上就保存了无法篡改、不会丢失的交易凭证。
区块链网络中的节点在执行Bob发起的交易后，会生成相应的收据(receipt)数据，以用于记录该交易相关的收据信息。这样，可以通过查询交易的收据来获得该交易执行结果的相关信息。以以太坊为例，节点执行交易所得的收据数据可以包括如下内容：
Result字段，表示交易的执行结果；
Gas used字段，表示交易消耗的gas值；
Logs字段，表示交易产生的日志，日志可以进一步包括From字段、To字段、Topic字段和Log data字段等，其中From字段表示调用的发起方的账户地址、To字段表示被调用对象(如智能合约)的账户地址、Topic字段表示日志的主题、Log data字段表示日志数据；
Output字段，表示交易的输出。
需要说明的是，接入区块链的用户在区块链上发起的请求的类型，具体可以是指传统的区块链中所采用的交易(transaction)。当然，接入区块链的用户在区块链上发起的请求的类型，具体也可以是交易以外的，其它形式的具有标准的数据结构的指令、消息等，本说明书一个或多个实施例并不进行特别限定。在以下的各实施例中，将以接入区块链的用户在区块链上发起的请求为交易为例进行说明。
本说明书提供一种基于区块链的数据处理系统，该系统包括业务设备、第一区块链网络和第二区块链网络。
其中，业务设备用于向第一区块链网络发起针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；以及，所述业务设备用于向所述第二区块链网络发起针对待处理数据的处理交易。
第一区块链网络中的第一节点响应于所述绑定交易，在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络。
第二区块链网络中的第二节点响应于所述处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
下面分别从数据处理系统中的第一区块链网络侧和第二区块链网络侧对本说明书的数据处理方案进行详细说明。
请参见图3，图3是一示例性实施例提供的第一区块链网络侧的基于区块链的数据处理方法的流程图。如图3所示，该方法应用于第一区块链网络中的第一节点(第一区块链网络中的任一节点)，可以包括以下步骤：
步骤302，第一区块链网络中的第一节点接收业务设备发起的针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名。
在一种情况下，由业务设备创建绑定交易、对绑定交易签名以及将绑定交易提交至第一区块链网络。
在另一种情况下，业务设备的处理性能较差，没有足够的处理资源来执行上述创建、签名和提交交易的操作。在该情况下，基于区块链的数据处理系统中还可包含接入设备，由该接入设备协助业务设备与第一区块链网络以及第二区块链网络完成接入，代替业务设备与第一区块链网络以及第二区块链网络进行交互，并将得到的结果返回至业务设备。
以业务设备发起绑定交易和处理交易为例进行说明。当业务设备需要发起针对业务设备和业务数据合约的绑定交易时，业务设备可向接入设备发送针对业务设备和业务数据合约的绑定请求，那么接入设备可响应于该绑定请求，创建绑定交易并采用业务设备的私钥对绑定交易签名，进而向第一区块链网络提交签名后的绑定交易。例如，业务设备可在绑定请求中记录自身的设备ID和业务数据合约的合约地址。
类似的，当业务设备生成待处理数据或者获取到来自于其他设备的待处理数据，进而需要调用部署于第二区块链网络上的业务数据合约对该待处理数据进行处理时，可向 接入设备发送针对待处理数据的处理请求，那么接入设备可响应于该处理请求，创建处理交易并采用业务设备的私钥对处理交易签名，进而向第二区块链网络提交签名后的处理交易。
进一步的，承接于上述对接入设备的配置，第一节点可响应于绑定交易，将业务数据合约的合约地址与业务设备建立映射关系。那么，接入设备可根据该映射关系确定出与业务设备绑定的业务数据合约(即获取业务数据合约的合约地址)，将业务数据合约的合约地址存放在处理交易的to字段中，从而通过处理交易来调用业务数据合约。
在一种情况下，在第一节点建立上述映射关系后，接入设备可获取第一节点建立的映射关系，并将获取到的映射关系缓存至本地，以在后续响应于业务设备发送的处理请求的情况下，根据本地缓存的映射关系确定出与业务设备绑定的业务数据合约，而无需在接收到处理请求后，实时地向第一区块链网络查询与业务设备绑定的业务数据合约，从而提高了处理数据的效率。在另一种情况下，接入设备可响应于业务设备发送的处理请求，先向第一区块链网络中的第一节点提交针对业务设备的查询交易，以由第一节点响应于查询交易查询对应于业务设备的映射关系。然后，接入设备再获取第一节点查询到的映射关系，根据获取到的映射关系确定出与业务设备绑定的业务数据合约。通过上述在接收到处理请求后实时向第一区块链网络查询业务数据合约的方式，可减少对接入设备存储空间的占用。
步骤304，所述第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络网络，所述第二区块链网络中的第二节点用于响应于所述业务设备向所述第二区块链网络发起的针对待处理数据的处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
在本实施例中，由第一区块链网络负责统一管理所有业务设备的公钥，由第二区块链网络负责对来自于业务设备的待处理数据进行处理。具体而言，通过在第二区块链网络上部署业务数据合约来实现对待处理数据的处理，处理方式可以包括将数据发布至区块链进行存证、对数据进行识别、对数据进行计算等；当然，本说明书并不对数据的具体处理方式进行限制。同时，针对不同的业务，可搭建不同的区块链网络以提供相应的业务，即第二区块链网络可存在多个。以存证数据为例，不同类型的业务设备产生的数据类型也随之不同，业务方的业务设备产生的业务数据存证在自身搭建的联盟链上，从而只有属于该业务方搭建的联盟链的成员才有权项访问业务数据，确保了业务数据只在联盟成员之间流转，有利于提高业务数据的隐私性。同时，当存在新的业务需求时，可新搭建一第二区块链网络以用于实现该业务需求，从而以对业务水平分片的方式将业务进行横向扩展，有效提升了区块链的吞吐量。
在上述应用场景中，第二区块链网络在接收到业务设备发起的处理交易后，需采用业务设备的公钥对该处理交易进行验签，而所有业务设备的公钥由第一区块链网络负责统一管理。本领域技术人员应当理解的是：跨链通讯的方式效率较低，并且需占用区块链节点大量的处理资源。因此，若第二区块链网络在每次接收到业务设备发起的处理交易时，均通过跨链通讯的方式向第一区块链网络查询业务设备的公钥，则频繁的跨链通讯将严重影响第一区块链网络和第二区块链网络的性能。而在本说明书的技术方案中，在绑定业务设备与业务数据合约的阶段，由第一区块链网络负责对绑定交易验签，并在验签通过的情况下将业务设备的公钥跨链同步至第二区块链网络，使得第二区块链网路中的第二节点后续可直接根据自身维护的公钥对处理交易验签，而无需在每次接收到业务设备发起的处理交易时，均通过跨链通讯的方式向第一区块链网络查询业务设备的公钥，由此可见，本说明书的数据处理方案可有效避免频繁的跨链通讯，从而提高处理数 据的效率，并可提升区块链网络的性能。
在本实施例中，当需要解除业务设备与业务数据合约之间的绑定关系时，业务设备可向第一区块链网络发起针对业务设备和业务数据合约的解绑交易。那么，第一节点可响应于该解绑交易，在采用业务设备的公钥对该解绑交易验签通过的情况下，向第二节点提交针对业务设备的公钥的第一跨链失效请求，使得第二节点响应于第一跨链失效请求，删除第二节点维护的业务设备的公钥。
在本实施例中，第一节点可监测所维护的业务设备的公钥的有效期，在确定业务设备的公钥到期的情况下，删除第一节点维护的业务设备的公钥，并向第二节点提交针对业务设备的公钥的第二跨链失效请求，使得第二节点用于响应于第二跨链失效请求，删除第二节点维护的业务设备的公钥。或者，当需要注销业务设备的公钥时，业务设备可向第一区块链网络发起针对业务设备的注销交易，那么第一节点在采用业务设备的公钥对注销交易验签通过的情况下，删除第一节点维护的业务设备的公钥，并向第二节点提交针对业务设备的公钥的第二跨链失效请求，使得第二节点用于响应于第二跨链失效请求，删除第二节点维护的业务设备的公钥。
在本实施例中，基于区块链公开透明的特性，任何区块链的成员均可访问区块链上的数据。以第二区块链网络为例，在未对第二区块链网络进行隐私保护的情况下，加入第二区块链网络的成员可查询第二区块链网络中维护的业务设备的公钥，从而据此推断出相关业务的业务信息，导致泄漏了业务隐私。比如，在查询到第二区块链网络维护的公钥数量后，可据此推断出第二区块链网络与多少业务设备建立有合作关系。类似的，第一区块链网络也存在类似的隐私泄露隐患。因此，第一区块链网络中的第一节点和第二区块链网络中的第二节点可将业务设备的公钥维护在各自部署的TEE(Trusted Execution Environment,可信执行环境)中，从而解决上述隐私泄露隐患。
TEE是基于CPU硬件的安全扩展，且与外部完全隔离的可信执行环境。TEE可起到硬件中的黑箱作用，在TEE中执行的代码和数据操作系统层都无法偷窥，只有代码中预先定义的接口才能对其进行操作。在效率方面，由于TEE的黑箱性质，在TEE中进行运算的是明文数据，而不是同态加密中的复杂密码学运算，计算过程效率没有损失，因此与TEE相结合可在性能损失较小的前提下极大提升区块链的安全性和隐私性。
以Intel SGX技术为例，SGX提供了围圈，即内存中一个加密的可信执行区域，由CPU保护数据不被窃取。以区块链节点采用支持SGX的CPU为例，利用新增的处理器指令，在内存中可以分配一部分区域EPC(Enclave Page Cache，围圈页面缓存或飞地页面缓存)，通过CPU内的加密引擎MEE(Memory Encryption Engine)对其中的数据进行加密。EPC中加密的内容只有进入CPU后才会被解密成明文。因此，在SGX中，用户可以不信任操作系统、VMM(Virtual Machine Monitor，虚拟机监控器)、甚至BIOS(Basic Input Output System，基本输入输出系统)，只需要信任CPU便能确保隐私数据不会泄漏。
在本实施例中，第一节点维护业务设备的公钥、建立映射关系、验签，以及第二节点维护业务设备的公钥、验签和处理待处理数据等操作，均可通过调用相应的智能合约来完成。例如，可在第一区块链网络上部署设备管理合约用于维护业务设备的公钥和利用维护的公钥验签，以及部署业务绑定合约用于建立映射关系和将公钥跨链同步至第二区块链网络。类似的，可在第二区块链网络上部署设备影子合约来维护第一节点跨链同步的公钥和利用维护的公钥验签。当然，也可以仅部署一个智能合约来完成所属区块链网络上所需执行的全部操作。比如，可在第一区块链网络上部署业务绑定合约用于维护业务设备的公钥、利用维护的公钥验签、建立映射关系，以及将公钥跨链同步至第二区块链网络。类似的，可在第二区块链网络上部署业务数据合约用于维护第一节点跨链同 步的公钥、利用维护的公钥验签，以及对待处理数据进行处理。或者，除将执行上述操作的逻辑定义在智能合约以外，还可将这些逻辑定义在链代码中，使得区块链网络中的节点通过执行链代码来完成上述操作。
对应于上述第一区块链网络侧的实施例，本说明书还提出了第二区块链网络侧的实施例，在第一区块链网络侧实施例中所涉及的描述同样可以适用于第二区块链网络侧的实施例，下文中不再对此进行赘述。
相应的，图4是一示例性实施例提供的一种第二区块链网络侧的基于区块链的数据处理方法的流程图。如图4所示，该方法应用于第二区块链网络中的第二节点(第二区块链网络中的任一节点)，可以包括以下步骤：
步骤402，第二区块链网络中的第二节点接收业务设备发起的针对待处理数据的处理交易，所述业务设备还向第一区块链网络发起针对所述业务设备和部署于所述第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名。
步骤404，所述第二节点在采用业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理；所述第二节点维护的所述业务设备的公钥由第一区块链网络中的第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下跨链同步至所述第二区块链网络。
如前所述，所述绑定交易由接入设备响应于所述业务设备发送的针对所述业务设备和所述业务数据合约的绑定请求创建得到，并被所述接入设备在采用所述业务设备的私钥签名后提交至所述第一区块链网络；所述处理交易由所述接入设备响应于所述业务设备发送的针对所述待处理数据的处理请求创建得到，并被所述接入设备采用所述业务设备的私钥签名后提交至所述第二区块链网络。
如前所述，所述处理交易由所述接入设备在根据所述第一节点建立的所述业务数据合约的合约地址与所述业务设备的映射关系确定出所述业务数据合约后创建。
如前所述，所述第一节点建立的所述映射关系被所述接入设备获取后缓存至本地，以在所述接入设备响应于所述处理请求的情况下根据本地缓存的所述映射关系确定出所述业务数据合约。
如前所述，所述接入设备通过获取所述第一节点响应于所述接入设备提交的针对所述业务设备的查询交易查询到的所述映射关系确定出所述业务数据合约，所述查询交易由所述接入设备响应于所述处理请求提交。
如前所述，所述第二节点接收所述第一节点提交的针对所述业务设备的公钥的第一跨链失效请求，所述第一跨链失效请求由所述第一节点在采用所述业务设备的公钥对接收到的针对所述业务设备和所述业务数据合约的解绑交易验签通过的情况下提交；响应于所述第一跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
所述第二节点接收所述第一节点提交的针对所述业务设备的公钥的第二跨链失效请求，所述第二跨链失效请求由所述第一节点在确定所述业务设备的公钥到期，或者在采用所述业务设备的公钥对接收到的针对所述业务设备的注销交易验签通过的情况下提交；响应于所述第二跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
如前所述，所述业务设备的公钥分别维护于所述第一节点和所述第二节点上部署的可信执行环境中。
请参见图5，结合IOT(Internet of Things,物联网)设备的场景进行说明。如图5所示，在挂车租赁的场景中，挂车的Tbox50需要定时向业务链53上报真实的位置信息和运行状态信息等数据，使得这些数据真实可信、不可篡改地记录到业务链53上。在安装 Tbox50的流程中，Tbox50需要通过接入设备51向设备链52(即第一区块链)注册发布设备公钥，并将Tbox50与Tbox50对应的业务链53(即第二区块链，比如可以称为挂车链)绑定以建立映射关系。设备链52在完成绑定之后将设备公钥跨链同步至业务链53。在数据上报的流程中，Tbox50通过接入设备51直接将数据发布至业务链53，由业务链53中的区块链节点负责对上报数据验签，确保数据来自于Tbox50，而不是经过其他设备篡改后的伪造数据。而在挂车退役或者出售之后，可通过解绑和注销流程解除Tbox50和业务链53之间的绑定关系，那么在解除绑定关系之后Tbox50便无法将数据发布至业务链53。当然，在本说明书的数据处理系统中，可包含多个业务链，各个业务链分别与IOT设备参与的不同业务相对应。比如上述系统架构中还可包含业务链54，设备链52同样可向业务链54跨链同步Tbox50的设备公钥，Tbox50也同样可以向业务链54上报数据以由业务链54上的区块链节点在采用设备公钥验签通过的情况下对上报的数据进行处理。
当然，本说明书并不对数据处理系统应用的场景进行限制，可根据实际需求灵活选取。比如，还可应用于安防领域，由监控摄像头通过上述流程将拍摄得到的图像信息上报到业务链(比如可以称之为安防链)，以由业务数据合约对图像信息进行识别。
为了便于理解，下面以业务设备为车载Tbox为例，结合图6-9对本说明书的数据处理方案进行详细说明。
请参见图6，图6是一示例性实施例提供的一种注册物联网设备的交互图。如图6所示，该交互过程可以包括以下步骤：
步骤602，车载Tbox生成非对称密钥对。
在本实施例中，车载Tbox可采用RSA、Elgamal、背包算法、Rabin、D-H、ECC(椭圆曲线加密算法)等非对称加密算法。当然，本说明书并不对此进行限制。
步骤604，车载Tbox向接入设备发送非对称密钥对。
步骤606，接入设备创建调用设备管理合约的交易。
在本实施例中，接入设备可存储车载Tbox的私钥，从而可代替车载Tbox实施签名的操作。接入设备创建的用于调用设备管理合约的交易中包含车载Tbox的公钥，而接入设备在向设备链提交该交易后，该交易将存证在区块链上，各个区块链的用户均可查看该交易。在未对区块链进行隐私保护的情况下，区块链的用户可查询区块链中维护的业务设备的公钥，从而据此推断出相关业务的业务信息，导致泄漏了业务隐私。比如，在查询到区块链维护的公钥数量后，可据此推断出该区块链上注册有多少业务设备。
因此，出于隐私保护的考虑，接入设备可采用数字信封加密的方式对创建好的交易进行加密，该数字信封加密结合对称加密算法和非对称加密算法。具体而言，可采用接入设备(或者车载Tbox)的对称密钥对交易内容进行加密，再采用区块链节点的公钥对该对称密钥进行加密。相应的，区块链节点采用自身的私钥解密得到对称密钥，再用解密得到的对称密钥解密交易内容从而获得车载Tbox的公钥(明文形式)，进而将车载Tbox的公钥读入自身部署的TEE内进行维护。而存证在区块链上的交易为密文形式(采用数字信封的方式加密)，因此不存在隐私泄露的隐患。
步骤608，接入设备向设备链提交交易。
步骤610，设备链上的区块链节点响应于接收到的交易，执行设备管理合约，将Tbox的公钥存储至设备管理合约中。
步骤612，接入设备获取合约调用结果。
在本实施例中，设备管理合约可生成包含合约调用结果的事件存储到区块链日志中，那么，接入设备可通过区块链的回调机制来获取该事件，从而查看合约调用结果。
步骤614，接入设备向车载Tbox返回合约调用结果。
请参见图7，图7是一示例性实施例提供的一种绑定物联网设备的交互图。如图7所示，该交互过程可以包括以下步骤：
步骤702，车载Tbox生成绑定请求。
步骤704，车载Tbox向接入设备发送绑定请求。
在本实施例中，车载Tbox可在绑定请求中记录自身的设备ID和业务绑定合约的合约地址，从而接入设备在创建绑定交易时，在绑定交易的to字段中存放业务绑定合约的合约地址，用于表明绑定交易用于调用业务绑定合约；以及在data字段(或者其他字段)中存放车载Tbox的设备ID以用于后续建立映射关系。或者，绑定请求中仅包含设备ID，由接入设备查询得到业务绑定合约的合约地址。
步骤706，接入设备创建绑定交易，采用车载Tbox的私钥签名。
步骤708，接入设备向设备链提交绑定交易。
步骤710，设备链上的区块链节点执行业务绑定合约对设备管理合约发起调用。
步骤712，设备链上的区块链节点执行设备管理合约，验证绑定交易的签名。
在本实施例中，在部署设备管理合约的阶段，可在设备管理合约中定义验签逻辑，用于验证签名。那么，设备链上的区块链节点可调用设备管理合约执行设备管理合约中定义的验签逻辑，验证绑定交易的签名。
步骤714，设备管理合约向业务绑定合约返回验签结果。
在本实施例中，在验签结果为验签通过的情况下，设备管理合约还可向业务绑定合约返回车载Tbox的公钥。
步骤716，业务绑定合约建立车载Tbox和业务数据合约的合约地址的映射关系。
在本实施例中，在验签结果为验签通过的情况下，建立车载Tbox的设备ID和合约地址的映射关系。
步骤718，业务绑定合约跨链调用部署于业务链上的设备影子合约，以将车载Tbox的公钥跨链同步至设备影子合约中。
多个区块链之间可通过跨链中继实现跨链对接。其中，跨链中继可以通过桥接接口与多个区块链分别进行对接，并基于实现的数据搬运逻辑，完成该多个区块链之间的跨链数据同步。在实现上述跨链中继时所采用的跨链技术，在本说明书中不进行特别限定；例如，在实际应用中，可以通过侧链技术、公证人技术等跨链机制，将多个区块链连接起来。当多个区块链通过跨链中继实现对接之后，区块链之间就可以去读取并认证其它区块链上的数据，也可以通过跨链中继去调用其它区块链上部署的智能合约。
需要说明的是，跨链中继仅用于多个区块链之间搬运数据，并不需要对搬运的数据进行持久化存储，也不需要维护所搬运的数据的数据状态。在实际应用中，跨链中继可以配置在其所连接的多个区块链之外的设备、节点或平台等处，也可以配置在其所连接的多个区块链的节点设备上，在本说明书中不进行特别限定。
步骤720，设备影子合约存储车载Tbox的公钥。
步骤722，业务绑定合约获取跨链调用设备影子合约的调用结果。
步骤724，接入设备获取绑定结果。
步骤726，接入设备在本地缓存绑定结果中记录的映射关系。
步骤728，接入设备向车载Tbox返回绑定结果。
通过上述将车载Tbox绑定至业务链的过程，后续车载Tbox便可向业务链发起处理交易，从而调用业务数据合约对车载Tbox的数据进行处理。
请参见图8，图8是一示例性实施例提供的一种基于区块链的数据处理方法的交互图。如图8所示，该交互过程可以包括以下步骤：
步骤802，车载Tbox生成处理请求(包含待处理数据)。
在本实施例中，车载Tbox采集车辆的位置信息和运行状态信息，从而发起对业务链上业务数据合约的调用，由业务数据合约对采集的信息进行处理。
步骤804，车载Tbox向接入设备发送处理请求。
步骤806，接入设备根据本地缓存的映射关系确定业务数据合约的合约地址。
步骤808，接入设备创建处理交易，采用车载Tbox的私钥签名。
在本实施例中，接入设备在处理交易的to字段中存放业务数据合约的合约地址，用于表明处理交易用于调用业务数据合约；以及在data字段(或者其他字段)中存放待处理数据。
步骤810，接入设备向业务链提交处理交易以调用业务数据合约。
步骤812，业务链上的区块链节点执行业务数据合约对设备影子合约发起调用。
步骤814，业务链上的区块链节点执行设备影子合约，验证处理交易的签名。
在本实施例中，在部署设备影子合约的阶段，可在设备影子合约中定义验签逻辑，用于验证签名。那么，业务链上的区块链节点可调用设备影子合约执行设备影子合约中定义的验签逻辑，验证处理交易的签名。在上述图7所示的绑定阶段中，由设备链上的业务绑定合约向设备影子合约跨链同步了车载Tbox的公钥，那么设备影子合约在采用车载Tbox的公钥验签的情况下，验签结果为验签通过。
步骤816，设备影子合约向业务数据合约返回验签结果。
步骤818，业务数据合约对待处理数据进行处理。
在本实施例中，在部署业务数据合约的阶段，可在业务数据合约中定义处理逻辑，用于对数据进行处理。那么，当验签结果为验签通过时，业务链上的区块链节点调用业务数据合约执行业务数据合约中定义的处理逻辑，对待处理数据进行处理。其中，处理逻辑的具体处理方式可根据实际场景灵活设定，比如将数据发布至区块链进行存证、对数据进行识别、对数据进行计算等；当然，本说明书并不对数据的具体处理方式进行限制。
步骤820，接入设备获取处理结果。
步骤822，接入设备向车载Tbox返回处理结果。
请参见图9，图9是一示例性实施例提供的一种解除绑定物联网设备的交互图。如图9所示，该交互过程可以包括以下步骤：
步骤902，车载Tbox生成解绑请求。
步骤904，车载Tbox向接入设备发送解绑请求。
步骤906，接入设备创建解绑交易，采用车载Tbox的私钥签名。
步骤908，接入设备向设备链提交解绑交易。
步骤910，设备链上的区块链节点执行业务绑定合约对设备管理合约发起调用。
步骤912，设备链上的区块链节点执行设备管理合约，验证解绑交易的签名。
步骤914，设备管理合约向业务绑定合约返回验签结果。
步骤916，业务绑定合约解除车载Tbox和业务数据合约的合约地址的映射关系。
上述步骤902-916的实施过程与上述步骤702-716类似，在此不再赘述。
步骤918，业务绑定合约跨链调用部署于业务链上的设备影子合约。
步骤920，设备影子合约删除车载Tbox的公钥。
步骤922，业务绑定合约获取调用结果。
步骤924，接入设备获取解绑结果。
步骤926，接入设备删除本地缓存的映射关系。
步骤928，接入设备向车载Tbox返回解绑结果。
在本实施例中，设备管理合约还可监测自身维护的各个车载Tbox的公钥的有效期，假定设备管理合约监测到车载TboxA的公钥到期的情况下，删除车载TboxA的公钥，并跨链调用设备影子合约删除设备影子合约中维护的车载TboxA的公钥。
在本实施例中，车载Tbox还可通过接入设备向设备链提交针对该车载Tbox的注销交易(采用该车载Tbox的私钥签名)，从而调用设备管理合约删除该车载Tbox的公钥，并且由设备管理合约跨链调用设备影子合约删除该车载Tbox的公钥。需要说明的是，只有在车载Tbox解除绑定的情况下，才可发起针对该车载Tbox的注销操作。
本说明书中的业务设备包含以下设备状态：未绑定无公钥状态、未绑定公钥无效状态、已绑定公钥无效状态、未绑定公钥有效状态、已绑定公钥有效状态。其中，业务设备初始化处于未绑定无公钥状态。在未绑定无公钥状态下，业务设备生成公钥之后处于未绑定公钥有效状态。在未绑定公钥无效状态下，业务设备更新公钥之后处于未绑定公钥有效状态。在未绑定公钥有效状态下，业务设备的公钥被注销或者公钥到期之后，业务设备回归至未绑定公钥无效状态。在未绑定公钥有效状态下，业务设备在绑定至业务链后处于已绑定公钥有效状态。在已绑定公钥有效状态下，业务设备在解除与业务链的绑定后处于未绑定公钥有效状态。在已绑定公钥有效状态下，业务设备的公钥在过期后处于已绑定公钥无效状态。在已绑定公钥无效状态下，业务设备在更新公钥后处于已绑定公钥有效状态。
与上述方法实施例相对应，本说明书还提供了一种基于区块链的数据处理装置的实施例。本说明书的基于区块链的数据处理装置的实施例可以应用在电子设备上。装置实施例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，作为一个逻辑意义上的装置，是通过其所在电子设备的处理器将非易失性存储器中对应的计算机程序指令读取到内存中运行形成的。
从硬件层面而言，请参考图10，图10是一示例性实施例提供的一种设备的示意结构图。如图10所示，在硬件层面，该设备包括处理器1002、内部总线1004、网络接口1006、内存1008以及非易失性存储器1010，当然还可能包括其他业务所需要的硬件。处理器1002从非易失性存储器1010中读取对应的计算机程序到内存1008中然后运行，在逻辑层面上形成基于区块链的数据处理装置。当然，除了软件实现方式之外，本说明 书一个或多个实施例并不排除其他实现方式，比如逻辑器件抑或软硬件结合的方式等等，也就是说以下处理流程的执行主体并不限定于各个逻辑单元，也可以是硬件或逻辑器件。
请参考图11，在一软件实施方式中，第一区块链网络侧的基于区块链的数据处理装置可以包括：
接收单元1101，使第一区块链网络中的第一节点接收业务设备发起的针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；
同步单元1102，使所述第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述业务设备向所述第二区块链网络发起的针对待处理数据的处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
可选的，所述绑定交易由接入设备响应于所述业务设备发送的针对所述业务设备和所述业务数据合约的绑定请求创建得到，并被所述接入设备在采用所述业务设备的私钥签名后提交至所述第一区块链网络；所述处理交易由所述接入设备响应于所述业务设备发送的针对所述待处理数据的处理请求创建得到，并被所述接入设备采用所述业务设备的私钥签名后提交至所述第二区块链网络。
可选的，还包括：建立单元1103，所述第一节点将所述业务数据合约的合约地址与所述业务设备建立映射关系；所述处理交易由所述接入设备在根据所述映射关系确定出所述业务数据合约后创建。
可选的，所述第一节点建立的所述映射关系被所述接入设备获取后缓存至本地，以在所述接入设备响应于所述处理请求的情况下根据本地缓存的所述映射关系确定出所述业务数据合约。
可选的，还包括：查询单元1104，所述第一节点接收所述接入设备由响应于所述处理请求提交的针对所述业务设备的查询交易，查询对应于所述业务设备的所述映射关系；所述接入设备通过获取所述第一节点查询到的所述映射关系确定出所述业务数据合约。
可选的，还包括：第一维护单元1105，所述第一节点在接收到针对所述业务设备和所述业务数据合约的解绑交易，且采用所述业务设备的公钥对所述解绑交易验签通过的情况下，向所述第二节点提交针对所述业务设备的公钥的第一跨链失效请求，所述第一跨链失效请求用于指示所述第二节点删除所述第二节点维护的所述业务设备的公钥。
可选的，还包括：第二维护单元1106，所述第一节点在确定所述业务设备的公钥到期，或者在采用所述业务设备的公钥对接收到的针对所述业务设备的注销交易验签通过的情况下，删除所述第一节点维护的所述业务设备的公钥；
向所述第二节点提交针对所述业务设备的公钥的第二跨链失效请求，所述第二跨链失效请求用于指示所述第二节点删除所述第二节点维护的所述业务设备的公钥。
可选的，所述业务设备的公钥分别维护于所述第一节点和所述第二节点上部署的可信执行环境中。
请参考图12，在另一软件实施方式中，第二区块链网络侧的基于区块链的数据处理装置可以包括：
接收单元1201，使第二区块链网络中的第二节点接收业务设备发起的针对待处理数据的处理交易，所述业务设备还用于向第一区块链网络发起针对所述业务设备和部署于所述第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；
处理单元1202，使所述第二节点在采用业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理；所述第二节点维护的所述业务设备的公钥由第一区块链网络中的第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下跨链同步至所述第二区块链网络。
可选的，所述绑定交易由接入设备响应于所述业务设备发送的针对所述业务设备和所述业务数据合约的绑定请求创建得到，并被所述接入设备在采用所述业务设备的私钥签名后提交至所述第一区块链网络；所述处理交易由所述接入设备响应于所述业务设备发送的针对所述待处理数据的处理请求创建得到，并被所述接入设备采用所述业务设备的私钥签名后提交至所述第二区块链网络。
可选的，所述处理交易由所述接入设备在根据所述第一节点建立的所述业务数据合约的合约地址与所述业务设备的映射关系确定出所述业务数据合约后创建。
可选的，所述第一节点建立的所述映射关系被所述接入设备获取后缓存至本地，以在所述接入设备响应于所述处理请求的情况下根据本地缓存的所述映射关系确定出所述业务数据合约。
可选的，所述接入设备通过获取所述第一节点响应于所述接入设备提交的针对所述业务设备的查询交易查询到的所述映射关系确定出所述业务数据合约，所述查询交易由所述接入设备响应于所述处理请求提交。
可选的，还包括：第一维护单元1203，所述第二节点接收所述第一节点提交的针对所述业务设备的公钥的第一跨链失效请求，所述第一跨链失效请求由所述第一节点在采用所述业务设备的公钥对接收到的针对所述业务设备和所述业务数据合约的解绑交易验签通过的情况下提交；响应于所述第一跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
可选的，还包括：第二维护单元1204，所述第二节点接收所述第一节点提交的针对所述业务设备的公钥的第二跨链失效请求，所述第二跨链失效请求由所述第一节点在确定所述业务设备的公钥到期，或者在采用所述业务设备的公钥对接收到的针对所述业务设备的注销交易验签通过的情况下提交；响应于所述第二跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
可选的，所述业务设备的公钥分别维护于所述第一节点和所述第二节点上部署的可信执行环境中。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本说明书时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本说明书的实施例可提供为方法、系统、或计算机程序产品。因此，本说明书可采用完全硬件实施例、完全软件实施例、或结合软件和 硬件方面的实施例的形式。而且，本说明书可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本说明书是参照根据本说明书实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
本说明书可以在由计算机执行的计算机可执行指令的一般上下文中描述，例如程序模块。一般地，程序模块包括执行特定任务或实现特定抽象数据类型的例程、程序、对象、组件、数据结构等等。也可以在分布式计算环境中实践本说明书，在这些分布式计算环境中，由通过通信网络而被连接的远程处理设备来执行任务。在分布式计算环境中，程序模块可以位于包括存储设备在内的本地和远程计算机存储介质中。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。在一个典型的配置中，计算机包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带、磁盘存储、量子存储器、基于石墨烯的存储介质或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序 来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
在本说明书一个或多个实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本说明书一个或多个实施例。在本说明书一个或多个实施例和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本说明书一个或多个实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本说明书一个或多个实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
以上所述仅为本说明书一个或多个实施例的较佳实施例而已，并不用以限制本说明书一个或多个实施例，凡在本说明书一个或多个实施例的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本说明书一个或多个实施例保护的范围之内。

Claims (28)

  1. 一种基于区块链的数据处理系统，包括：
    业务设备，所述业务设备用于向第一区块链网络发起针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；以及，所述业务设备用于向所述第二区块链网络发起针对待处理数据的处理交易；
    所述第一区块链网络，所述第一区块链网络中的第一节点用于响应于所述绑定交易，在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络；
    所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
  2. 根据权利要求1所述的系统，还包括：
    接入设备，所述接入设备用于响应于所述业务设备发送的针对所述业务设备和所述业务数据合约的绑定请求，创建所述绑定交易并采用所述业务设备的私钥对所述绑定交易签名，向所述第一区块链网络提交所述绑定交易；以及，所述接入设备用于响应于所述业务设备发送的针对所述待处理数据的处理请求，创建所述绑定交易并采用所述业务设备的私钥对所述处理交易签名，向所述第二区块链网络提交所述处理交易。
  3. 根据权利要求2所述的系统，
    所述第一节点用于响应于所述绑定交易，将所述业务数据合约的合约地址与所述业务设备建立映射关系；
    所述接入设备用于根据所述映射关系确定出所述业务数据合约以创建所述处理交易。
  4. 根据权利要求3所述的系统，所述接入设备用于将获取到的所述第一节点建立的所述映射关系缓存至本地，以在响应于所述处理请求的情况下根据本地缓存的所述映射关系确定出所述业务数据合约。
  5. 根据权利要求3所述的系统，所述接入设备用于响应于所述处理请求，向所述第一节点提交针对所述业务设备的查询交易，以获取所述第一节点响应于所述查询交易查询到的所述映射关系，并根据获取到的所述映射关系确定出所述业务数据合约。
  6. 根据权利要求1所述的系统，
    所述第一节点用于响应于针对所述业务设备和所述业务数据合约的解绑交易，在采用所述业务设备的公钥对所述解绑交易验签通过的情况下，向所述第二节点提交针对所述业务设备的公钥的第一跨链失效请求；
    所述第二节点用于响应于所述第一跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
  7. 根据权利要求1所述的系统，
    所述第一节点用于在确定所述业务设备的公钥到期，或者在采用所述业务设备的公钥对接收到的针对所述业务设备的注销交易验签通过的情况下，删除所述第一节点维护的所述业务设备的公钥，并向所述第二节点提交针对所述业务设备的公钥的第二跨链失效请求；
    所述第二节点用于响应于所述第二跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
  8. 根据权利要求1所述的系统，所述业务设备的公钥分别维护于所述第一节点和所述第二节点上部署的可信执行环境中。
  9. 一种基于区块链的数据处理方法，包括：
    第一区块链网络中的第一节点接收业务设备发起的针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行 签名；
    所述第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述业务设备向所述第二区块链网络发起的针对待处理数据的处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
  10. 根据权利要求9所述的方法，所述绑定交易由接入设备响应于所述业务设备发送的针对所述业务设备和所述业务数据合约的绑定请求创建得到，并被所述接入设备在采用所述业务设备的私钥签名后提交至所述第一区块链网络；所述处理交易由所述接入设备响应于所述业务设备发送的针对所述待处理数据的处理请求创建得到，并被所述接入设备采用所述业务设备的私钥签名后提交至所述第二区块链网络。
  11. 根据权利要求10所述的方法，还包括：
    所述第一节点将所述业务数据合约的合约地址与所述业务设备建立映射关系；所述处理交易由所述接入设备在根据所述映射关系确定出所述业务数据合约后创建。
  12. 根据权利要求11所述的方法，所述第一节点建立的所述映射关系被所述接入设备获取后缓存至本地，以在所述接入设备响应于所述处理请求的情况下根据本地缓存的所述映射关系确定出所述业务数据合约。
  13. 根据权利要求11所述的方法，还包括：
    所述第一节点接收所述接入设备由响应于所述处理请求提交的针对所述业务设备的查询交易，查询对应于所述业务设备的所述映射关系；所述接入设备通过获取所述第一节点查询到的所述映射关系确定出所述业务数据合约。
  14. 根据权利要求9所述的方法，还包括：
    所述第一节点在接收到针对所述业务设备和所述业务数据合约的解绑交易，且采用所述业务设备的公钥对所述解绑交易验签通过的情况下，向所述第二节点提交针对所述业务设备的公钥的第一跨链失效请求，所述第一跨链失效请求用于指示所述第二节点删除所述第二节点维护的所述业务设备的公钥。
  15. 根据权利要求9所述的方法，还包括：
    所述第一节点在确定所述业务设备的公钥到期，或者在采用所述业务设备的公钥对接收到的针对所述业务设备的注销交易验签通过的情况下，删除所述第一节点维护的所述业务设备的公钥；
    向所述第二节点提交针对所述业务设备的公钥的第二跨链失效请求，所述第二跨链失效请求用于指示所述第二节点删除所述第二节点维护的所述业务设备的公钥。
  16. 根据权利要求9所述的方法，所述业务设备的公钥分别维护于所述第一节点和所述第二节点上部署的可信执行环境中。
  17. 一种基于区块链的数据处理方法，包括：
    第二区块链网络中的第二节点接收业务设备发起的针对待处理数据的处理交易，所述业务设备还用于向第一区块链网络发起针对所述业务设备和部署于所述第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；
    所述第二节点在采用业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理；所述第二节点维护的所述业务设备的公钥由第一区块链网络中的第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下跨链同步至所述第二区块链网络。
  18. 根据权利要求17所述的方法，所述绑定交易由接入设备响应于所述业务设备发送的针对所述业务设备和所述业务数据合约的绑定请求创建得到，并被所述接入设备在采用所述业务设备的私钥签名后提交至所述第一区块链网络；所述处理交易由所述接入设备响应于所述业务设备发送的针对所述待处理数据的处理请求创建得到，并被所述 接入设备采用所述业务设备的私钥签名后提交至所述第二区块链网络。
  19. 根据权利要求18所述的方法，所述处理交易由所述接入设备在根据所述第一节点建立的所述业务数据合约的合约地址与所述业务设备的映射关系确定出所述业务数据合约后创建。
  20. 根据权利要求19所述的方法，所述第一节点建立的所述映射关系被所述接入设备获取后缓存至本地，以在所述接入设备响应于所述处理请求的情况下根据本地缓存的所述映射关系确定出所述业务数据合约。
  21. 根据权利要求19所述的方法，所述接入设备通过获取所述第一节点响应于所述接入设备提交的针对所述业务设备的查询交易查询到的所述映射关系确定出所述业务数据合约，所述查询交易由所述接入设备响应于所述处理请求提交。
  22. 根据权利要求17所述的方法，还包括：
    所述第二节点接收所述第一节点提交的针对所述业务设备的公钥的第一跨链失效请求，所述第一跨链失效请求由所述第一节点在采用所述业务设备的公钥对接收到的针对所述业务设备和所述业务数据合约的解绑交易验签通过的情况下提交；
    响应于所述第一跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
  23. 根据权利要求17所述的方法，还包括：
    所述第二节点接收所述第一节点提交的针对所述业务设备的公钥的第二跨链失效请求，所述第二跨链失效请求由所述第一节点在确定所述业务设备的公钥到期，或者在采用所述业务设备的公钥对接收到的针对所述业务设备的注销交易验签通过的情况下提交；
    响应于所述第二跨链失效请求，删除所述第二节点维护的所述业务设备的公钥。
  24. 根据权利要求17所述的方法，所述业务设备的公钥分别维护于所述第一节点和所述第二节点上部署的可信执行环境中。
  25. 一种基于区块链的数据处理装置，包括：
    接收单元，使第一区块链网络中的第一节点接收业务设备发起的针对所述业务设备和部署于第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；
    同步单元，使所述第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下，将所述业务设备的公钥跨链同步至所述第二区块链网络，所述第二区块链网络中的第二节点用于响应于所述业务设备向所述第二区块链网络发起的针对待处理数据的处理交易，在采用所述业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理。
  26. 一种基于区块链的数据处理装置，包括：
    接收单元，使第二区块链网络中的第二节点接收业务设备发起的针对待处理数据的处理交易，所述业务设备还用于向第一区块链网络发起针对所述业务设备和部署于所述第二区块链网络上的业务数据合约的绑定交易，所述绑定交易由所述业务设备的私钥进行签名；
    处理单元，使所述第二节点在采用业务设备的公钥对所述处理交易验签通过的情况下，调用所述业务数据合约对所述待处理数据进行处理；所述第二节点维护的所述业务设备的公钥由第一区块链网络中的第一节点在采用所述业务设备的公钥对所述绑定交易验签通过的情况下跨链同步至所述第二区块链网络。
  27. 一种电子设备，包括：
    处理器；
    用于存储处理器可执行指令的存储器；
    其中，所述处理器通过运行所述可执行指令以实现如权利要求9-24中任一项所述的方法。
  28. 一种计算机可读存储介质，其上存储有计算机指令，该指令被处理器执行时实现如权利要求9-24中任一项所述方法的步骤。
PCT/CN2021/087884 2020-04-17 2021-04-16 基于区块链的数据处理 WO2021209052A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010302402.2A CN111461723B (zh) 2020-04-17 2020-04-17 基于区块链的数据处理系统及方法、装置
CN202010302402.2 2020-04-17

Publications (1)

Publication Number Publication Date
WO2021209052A1 true WO2021209052A1 (zh) 2021-10-21

Family

ID=71684595

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/087884 WO2021209052A1 (zh) 2020-04-17 2021-04-16 基于区块链的数据处理

Country Status (2)

Country Link
CN (1) CN111461723B (zh)
WO (1) WO2021209052A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114172663A (zh) * 2021-12-07 2022-03-11 泰康保险集团股份有限公司 基于区块链的业务确权方法及装置、存储介质和电子设备
CN114338676A (zh) * 2021-12-31 2022-04-12 支付宝(杭州)信息技术有限公司 一种区块同步方法、装置、电子设备和存储介质
CN114363335A (zh) * 2021-12-31 2022-04-15 支付宝(杭州)信息技术有限公司 跨链交互方法及装置
CN114553884A (zh) * 2022-01-24 2022-05-27 中国科学院计算技术研究所 一种基于按需建域的区块链跨链交互方法及系统
CN114612103A (zh) * 2022-05-10 2022-06-10 中国信息通信研究院 跨区块链交易的方法、装置、系统、介质及电子设备
CN114968405A (zh) * 2022-05-25 2022-08-30 山东国子软件股份有限公司 一种自定义工作流引擎配置系统及方法
CN115187250A (zh) * 2022-09-09 2022-10-14 南方科技大学 一种以太坊隐私交易的探测方法、终端及存储介质
CN114968405B (zh) * 2022-05-25 2024-06-04 山东国子软件股份有限公司 一种自定义工作流引擎配置系统及方法

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111461723B (zh) * 2020-04-17 2020-12-15 支付宝(杭州)信息技术有限公司 基于区块链的数据处理系统及方法、装置
CN112396421B (zh) * 2020-10-10 2023-12-12 安徽中科晶格技术有限公司 一种基于区块链通证的身份认证系统及方法
CN112270005B (zh) * 2020-10-28 2022-04-26 支付宝(杭州)信息技术有限公司 一种数据传输方法和系统
CN112287033B (zh) * 2020-12-24 2021-03-19 腾讯科技（深圳）有限公司 一种数据同步方法、设备以及计算机可读存储介质
CN113487202B (zh) * 2021-07-14 2023-04-07 海南马良师傅网络科技有限公司 基于区块链管理的仪器搬迁监管方法
CN113706148B (zh) * 2021-08-27 2023-09-29 杭州云象网络技术有限公司 基于渠道权限控制的跨链方法、系统、存储介质及装置
CN114677137A (zh) * 2022-03-30 2022-06-28 网易（杭州）网络有限公司 区块链跨链方法、系统及装置、电子设备、存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566117A (zh) * 2017-07-14 2018-01-09 浙商银行股份有限公司 一种区块链密钥管理系统及方法
CN108712257A (zh) * 2018-04-03 2018-10-26 阿里巴巴集团控股有限公司 跨区块链的认证方法及装置、电子设备
CN108880794A (zh) * 2018-06-15 2018-11-23 浙江华信区块链科技服务有限公司 跨链用户身份及其数字资产管理系统
CN110008686A (zh) * 2018-11-16 2019-07-12 阿里巴巴集团控股有限公司 跨区块链的数据处理方法、装置、客户端、区块链系统
US20190287175A1 (en) * 2018-03-16 2019-09-19 SALT Lending Holdings, Inc. Investment Fund Token Ownership
CN110266655A (zh) * 2019-05-30 2019-09-20 中国工商银行股份有限公司 一种基于区块链的跨链互联方法、设备以及系统
CN111461723A (zh) * 2020-04-17 2020-07-28 支付宝(杭州)信息技术有限公司 基于区块链的数据处理系统及方法、装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108764925A (zh) * 2018-05-31 2018-11-06 李沁福 一种基于区块链技术的综合业务平台
CN113095822A (zh) * 2018-06-27 2021-07-09 创新先进技术有限公司 基于区块链的智能合约调用方法及装置、电子设备
CN109257342B (zh) * 2018-09-04 2020-05-26 阿里巴巴集团控股有限公司 区块链跨链的认证方法、系统、服务器及可读存储介质
CN109299338B (zh) * 2018-10-31 2019-08-06 山东云溪网络科技有限公司 一种跨区块链数据管理系统及方法
CN110597925B (zh) * 2019-08-15 2021-09-14 腾讯科技（深圳）有限公司 一种基于区块链的跨链数据处理方法及装置
CN110505058B (zh) * 2019-08-20 2021-07-20 西安电子科技大学 跨链场景下异构区块链的身份认证方法

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107566117A (zh) * 2017-07-14 2018-01-09 浙商银行股份有限公司 一种区块链密钥管理系统及方法
US20190287175A1 (en) * 2018-03-16 2019-09-19 SALT Lending Holdings, Inc. Investment Fund Token Ownership
CN108712257A (zh) * 2018-04-03 2018-10-26 阿里巴巴集团控股有限公司 跨区块链的认证方法及装置、电子设备
CN108880794A (zh) * 2018-06-15 2018-11-23 浙江华信区块链科技服务有限公司 跨链用户身份及其数字资产管理系统
CN110008686A (zh) * 2018-11-16 2019-07-12 阿里巴巴集团控股有限公司 跨区块链的数据处理方法、装置、客户端、区块链系统
CN110266655A (zh) * 2019-05-30 2019-09-20 中国工商银行股份有限公司 一种基于区块链的跨链互联方法、设备以及系统
CN111461723A (zh) * 2020-04-17 2020-07-28 支付宝(杭州)信息技术有限公司 基于区块链的数据处理系统及方法、装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
SHE WEI, ZHIHAO GU, XIAOYU YANG, ZHAO TIAN, JIANSEN CHEN, WEI LIU: "A Model of Multi-energy Complementation and Safety Transaction on Heterogeneous Energy Blockchain", POWER SYSTEM TECHNOLOGY, SHUILI-DIANLIBU DIANLI KEXUE YANJIUYUAN, BEIJING, CN, vol. 43, no. 9, 30 September 2019 (2019-09-30), CN , pages 3193 - 3201, XP055857996, ISSN: 1000-3673, DOI: 10.13335/j.1000-3673.pst.2018.3010 *

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114172663A (zh) * 2021-12-07 2022-03-11 泰康保险集团股份有限公司 基于区块链的业务确权方法及装置、存储介质和电子设备
CN114172663B (zh) * 2021-12-07 2023-09-26 泰康保险集团股份有限公司 基于区块链的业务确权方法及装置、存储介质和电子设备
CN114338676A (zh) * 2021-12-31 2022-04-12 支付宝(杭州)信息技术有限公司 一种区块同步方法、装置、电子设备和存储介质
CN114363335A (zh) * 2021-12-31 2022-04-15 支付宝(杭州)信息技术有限公司 跨链交互方法及装置
CN114363335B (zh) * 2021-12-31 2024-03-15 支付宝(杭州)信息技术有限公司 跨链交互方法及装置
CN114338676B (zh) * 2021-12-31 2024-05-28 支付宝(杭州)信息技术有限公司 一种区块同步方法、装置、电子设备和存储介质
CN114553884A (zh) * 2022-01-24 2022-05-27 中国科学院计算技术研究所 一种基于按需建域的区块链跨链交互方法及系统
CN114612103A (zh) * 2022-05-10 2022-06-10 中国信息通信研究院 跨区块链交易的方法、装置、系统、介质及电子设备
CN114968405A (zh) * 2022-05-25 2022-08-30 山东国子软件股份有限公司 一种自定义工作流引擎配置系统及方法
CN114968405B (zh) * 2022-05-25 2024-06-04 山东国子软件股份有限公司 一种自定义工作流引擎配置系统及方法
CN115187250A (zh) * 2022-09-09 2022-10-14 南方科技大学 一种以太坊隐私交易的探测方法、终端及存储介质

Also Published As

Publication number Publication date
CN111461723B (zh) 2020-12-15
CN111461723A (zh) 2020-07-28

Similar Documents

Publication Publication Date Title
WO2021209052A1 (zh) 基于区块链的数据处理
WO2021088546A1 (zh) 基于区块链账户的隐私数据查询方法及装置
WO2021088547A1 (zh) 基于区块链账户的隐私数据查询方法及装置
WO2021184963A1 (zh) 调用合约的方法及装置
WO2021103794A1 (zh) 在区块链中实现隐私保护的高效交易方法及装置
WO2021179743A1 (zh) 区块链中账户隐私信息的查询方法及装置
WO2021088548A1 (zh) 基于智能合约的隐私数据查询方法及装置
WO2020238255A1 (zh) 基于区块链的智能合约管理方法及装置、电子设备
AU2017320341B2 (en) Dynamic access control on blockchain
WO2021042818A1 (zh) 基于区块链的资产查询方法及装置、电子设备
WO2021082664A1 (zh) 区块链隐私数据的查询方法及装置
WO2021184973A1 (zh) 访问外部数据的方法及装置
TWI759563B (zh) 資產管理方法及裝置、電子設備
WO2021088549A1 (zh) 基于链代码的权限查询配置方法及装置
CN110166442B (zh) 一种基于区块链的数据处理方法和装置
WO2021088533A1 (zh) 隐私数据的共享方法及装置
CN111988338B (zh) 基于区块链的权限可控的物联网云平台及数据交互方法
WO2021088535A1 (zh) 基于智能合约的隐私数据查询方法及装置
CN117640099A (zh) 用于避免或减少区块链网络上的加密滞留资源的系统和方法
US11362805B2 (en) Database encryption layer
WO2020233623A1 (zh) 结合交易类型和判断条件的收据存储方法和节点
WO2020233631A1 (zh) 基于交易类型的收据存储方法和节点
WO2021088543A1 (zh) 基于智能合约的权限查询配置方法及装置
WO2020233625A1 (zh) 结合用户类型和判断条件的收据存储方法和节点
WO2021174927A1 (zh) 基于区块链的身份校验方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21788974

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21788974

Country of ref document: EP

Kind code of ref document: A1