WO2022237588A1 - 基于区块链的数据存证方法、装置、设备和存储介质 - Google Patents

基于区块链的数据存证方法、装置、设备和存储介质 Download PDF

Info

Publication number
WO2022237588A1
WO2022237588A1 PCT/CN2022/090367 CN2022090367W WO2022237588A1 WO 2022237588 A1 WO2022237588 A1 WO 2022237588A1 CN 2022090367 W CN2022090367 W CN 2022090367W WO 2022237588 A1 WO2022237588 A1 WO 2022237588A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
user
mentioned
query
user data
Prior art date
Application number
PCT/CN2022/090367
Other languages
English (en)
French (fr)
Inventor
刘晓磊
王磊
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2022237588A1 publication Critical patent/WO2022237588A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22—Indexing; Data structures therefor; Storage structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10—Services
    • G06Q50/20—Education
    • G06Q50/205—Education administration or guidance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10—Services
    • G06Q50/26—Government or public services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10—Services
    • G06Q50/26—Government or public services
    • G06Q50/265—Personal security, identity or safety
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • This application relates to computer technology, in particular to a blockchain-based data storage method, device, device and storage medium.
  • the certification authority can form authentication data related to the user.
  • These authentication data may include information closely related to the user.
  • the above-mentioned certification body as a vocational certification body as an example, users can obtain vocational skills training provided by various vocational training institutions. After the user graduates, the certification authority can generate certification data for the user that can certify that the user has relevant skills.
  • the above-mentioned authentication data may include data information such as user identity information, age, occupational skills, and education level.
  • the relationship between the agency and the person is a cross-type network service relationship, which brings great challenges to the storage, query, and use of user authentication data.
  • this application discloses a blockchain-based data storage method, wherein the above-mentioned blockchain deploys smart contracts for managing data assets, and the above-mentioned method may include: obtaining the data storage initiated by the data holder Wherein, the above-mentioned data deposit transaction includes the user data to be deposited; the above-mentioned user data includes the authentication data generated after the certification authority performs user authentication on the above-mentioned user; in response to the above-mentioned data deposit transaction, call the above-mentioned smart contract.
  • the data asset generation logic marks the data value of the above-mentioned user data, and associates the above-mentioned user data marked with data value with the user data marked with data value generated by other certification agencies after authenticating the user to form a Data assets corresponding to the above users.
  • the above method before associating and depositing the user data marked with data value with the user data marked with data value after the user is authenticated by other authentication institutions, the above method further includes: generating a data attribute mark event, so that when the corresponding user client of the above-mentioned data holder obtains the above-mentioned data attribute tag event, it responds to the above-mentioned data attribute tag event, and outputs a prompt of a data attribute tag corresponding to the above-mentioned user data to the above-mentioned data holder ; Acquiring the data attributes sent by the above user client and prompted by the above data holder to mark the above user data based on the above data mark.
  • the above-mentioned mark data value for the above-mentioned user data includes any of the following: generating a data value mark event, so that the above-mentioned user client responds when the above-mentioned data value mark event is obtained
  • the above-mentioned data value marking event reminds the above-mentioned data holder to mark the data value of the above-mentioned user data; according to the data value information included in the above-mentioned data storage transaction, mark the data value of the above-mentioned user data; according to the number of times the above-mentioned user data is queried, Mark the data value for the above user data.
  • the above method further includes: before associating and storing the user data marked with data value with the user data marked with data value after authentication by other certification bodies for the user,
  • the encryption key corresponding to the above-mentioned user maintained in the first TEE carried by the node device encrypts the above-mentioned user data, so that when the data query party accesses the above-mentioned encrypted user data, it can use the encryption key maintained in the second TEE carried by itself to The decryption key corresponding to the above-mentioned user decrypts the above-mentioned encrypted user data.
  • the method further includes: in response to the logout transaction for the user, calling the logout logic of the smart contract, deleting the user account corresponding to the user, and clearing the information maintained in the first TEE that is consistent with the above
  • the encryption key corresponding to the user and the decryption key corresponding to the encryption key maintained in the second TEE are used to prohibit the data query party from accessing the user data.
  • the above method further includes: obtaining a data query transaction initiated by the data query party and corresponding to the target user data; in response to the above data query transaction, calling the query logic included in the above smart contract to query the above block
  • the above-mentioned target user data stored in the chain, and the query results for the above-mentioned target user data are sent to the above-mentioned data query party; and, from the virtual resources held by the user account of the above-mentioned data query party, to the above-mentioned data holder
  • the above-mentioned data attribute indicates whether the above-mentioned target user data is a data disclosure attribute of public data; the above-mentioned sending the query result for the above-mentioned target user data to the above-mentioned data query party includes: based on the above-mentioned target user data corresponding The data disclosure attribute of the above-mentioned target user data determines whether the above-mentioned target user data is public data; if the above-mentioned target user data is public data, the query result for the above-mentioned target user data is sent to the above-mentioned data query party.
  • the above-mentioned data attribute includes a data privacy attribute indicating the privacy level of the above-mentioned target user data;
  • the above-mentioned sending the query result for the above-mentioned target user data to the above-mentioned data query party includes: based on the above-mentioned target user data The corresponding data privacy attribute determines the privacy level corresponding to the above-mentioned target user data; wherein, the above-mentioned privacy level includes the first-level privacy level and the second-level privacy level; the above-mentioned first-level privacy level means that the above-mentioned target user data supports plaintext data query; the above-mentioned The second-level privacy level means that the above-mentioned target user data supports data comparison query; if the data level corresponding to the above-mentioned target user data is the first-level privacy level, the plaintext data of the above-mentioned target user data will be sent to the above-mentioned data query party
  • the above-mentioned sending the query result for the above-mentioned target user data to the above-mentioned data query party includes: determining whether the above-mentioned data query party is the data holder corresponding to the above-mentioned target user data; The above query result is sent to the above data query party; if not, the verification logic included in the above smart contract is further invoked to authenticate the above data query party, and when the identity verification is passed, the above query result is sent to the above data query party.
  • the above method further includes: after sending the query result for the above target user data to the above data query party, updating the query times of the above target user data maintained by the above smart contract; and/or, From the virtual resources held by the user account of the above-mentioned data query party, after transferring to the user account of the above-mentioned data holder the virtual resources corresponding to the data value marked for the above-mentioned target user data, record the number of the above-mentioned virtual resources transferred Quantity, and update the revenue bill corresponding to the above target user data maintained by the above smart contract based on the above recorded quantity.
  • the authentication institution includes a training institution; the user data includes training data generated by the training institution performing training and authentication on the user.
  • the above-mentioned training institution includes a vocational training institution; the above-mentioned user data includes a vocational education skill certificate issued by the above-mentioned training institution to the above-mentioned user after performing vocational education and training certification on the above-mentioned user.
  • This application also proposes a blockchain-based data storage method, wherein the above-mentioned blockchain deploys a smart contract for managing data assets, and the above-mentioned method may include: obtaining a data storage transaction initiated by a data holder; Among them, the above-mentioned data deposit transaction includes the user data to be deposited; the above-mentioned user data includes the authentication data generated after the certification authority conducts user authentication on the above-mentioned user; in response to the above-mentioned data deposit transaction, call the data assets included in the above-mentioned smart contract Logic, associate the above user data with the user data generated by other authentication agencies after authenticating the user, generate a user data set corresponding to the above user, and mark the data value of the generated user data set to form a Data assets corresponding to users.
  • the above method further includes: before associating and storing the user data marked with data value with the user data marked with data value after authentication by other certification bodies for the user,
  • the encryption key corresponding to the above-mentioned user maintained in the first TEE carried by the node device encrypts the above-mentioned user data, so that when the data query party accesses the above-mentioned encrypted user data, it can use the encryption key maintained in the second TEE carried by itself to The decryption key corresponding to the above-mentioned user decrypts the above-mentioned encrypted user data.
  • the method further includes: in response to the logout transaction for the user, calling the logout logic of the smart contract, deleting the user account corresponding to the user, and clearing the information maintained in the first TEE that is consistent with the above
  • the encryption key corresponding to the user and the decryption key corresponding to the encryption key maintained in the second TEE are used to prohibit the data query party from accessing the user data.
  • the above method further includes: obtaining a data query transaction initiated by the data query party and corresponding to the target user data; in response to the above data query transaction, calling the query logic included in the above smart contract to query the above block
  • the above-mentioned target user data stored in the chain, and the query results for the above-mentioned target user data are sent to the above-mentioned data query party; and, from the virtual resources held by the user account of the above-mentioned data query party, to the above-mentioned data holder
  • This application also proposes a data storage device based on blockchain, wherein the above-mentioned blockchain deploys smart contracts for managing data assets, and the above-mentioned device may include: a first acquisition module, which acquires the Data deposit transaction; wherein, the above-mentioned data deposit transaction includes user data to be deposited; the above-mentioned user data includes the authentication data generated after the certification authority performs user authentication on the above-mentioned user; the first data asset generation module responds to the above-mentioned data deposit Invoke the data asset generation logic included in the above-mentioned smart contract to mark the data value of the above-mentioned user data, and combine the above-mentioned user data marked with data value with the marked data value generated by other certification agencies after authenticating the user.
  • User data is associated and deposited to form data assets corresponding to the above-mentioned users.
  • the above-mentioned device further includes: a second acquisition module, which acquires the data query transaction corresponding to the target user data initiated by the data query party; the query module, in response to the above-mentioned data query transaction, calls the above-mentioned smart contract including The query logic of the above-mentioned target user data stored in the above-mentioned block chain is queried, and the query result for the above-mentioned target user data is sent to the above-mentioned data query party; and, from the virtual resources held by the user account of the above-mentioned data query party , transfer to the user account of the above-mentioned data holder the amount of virtual resources corresponding to the data value marked for the above-mentioned target user data.
  • a second acquisition module which acquires the data query transaction corresponding to the target user data initiated by the data query party
  • the query module in response to the above-mentioned data query transaction, calls the above-mentioned smart contract including
  • This application also proposes a data storage device based on blockchain, wherein the above-mentioned blockchain deploys smart contracts for managing data assets, and the above-mentioned device may include: a third acquisition module, which acquires the Data deposit transaction; wherein, the above-mentioned data deposit transaction includes user data to be deposited; the above-mentioned user data includes the authentication data generated after the certification authority conducts user authentication on the above-mentioned user; the second data asset generation module responds to the above-mentioned data deposit To conduct a certificate transaction, call the data asset generation logic included in the above-mentioned smart contract, associate the above-mentioned user data with the user data generated by other certification agencies after authenticating the user, generate a user data set corresponding to the above-mentioned user, and generate The user data sets mark the data value to form data assets corresponding to the above users.
  • a third acquisition module which acquires the Data deposit transaction
  • the above-mentioned data deposit transaction includes user data to be deposited
  • the present application also proposes an electronic device, including: a processor; a memory for storing executable instructions of the above-mentioned processor; wherein, the above-mentioned processor is configured to call the executable instructions stored in the above-mentioned memory to implement any of the above-mentioned implementations Example data storage method.
  • the present application also proposes a computer-readable storage medium, where the above-mentioned storage medium stores a computer program, and the above-mentioned computer program is used to execute the data storage method shown in any one of the foregoing embodiments.
  • the data value of the above user data will be marked, and the user data marked with data value will be verified with other certification agencies for the user.
  • user data marked with data value is associated and stored to form data assets corresponding to the above users, so that on the one hand, the authentication data generated by different authentication agencies for user authentication on users is associated and stored in the blockchain, so it can be used
  • the blockchain has a high degree of transparency, non-tamperable modification and the signature function of the blockchain secret key to ensure the credibility and security of user data and eliminate data abuse; on the other hand, by marking the data value of user data, users can be The authentication data generated by different authentication agencies is safely stored in the blockchain as the user's data assets, which is convenient for data query.
  • Figure 1 is a schematic diagram of creating a smart contract shown in this application.
  • Fig. 2 is a method flowchart of a blockchain-based data storage method proposed by the present application
  • FIG. 3 is a schematic diagram of a data query process shown in the present application.
  • FIG. 4 is a schematic diagram of an identity verification process shown in the present application.
  • FIG. 5 is a diagram of a professional certification data management scenario shown in the present application.
  • FIG. 6 is a schematic diagram of a data management system architecture shown in the present application.
  • FIG. 7 is a schematic diagram of a data storage process shown in this application.
  • FIG. 8 is a schematic diagram of a data query process shown in the present application.
  • FIG. 9 is a schematic structural diagram of a blockchain-based data storage device shown in the present application.
  • FIG. 10 is a schematic diagram of a hardware structure of an electronic device shown in the present application.
  • Blockchain technology also known as distributed ledger technology, is an emerging technology in which several computing devices jointly participate in "bookkeeping" and jointly maintain a complete distributed database. Due to the characteristics of decentralization, openness and transparency, each computing device can participate in database records, and fast data synchronization between computing devices, blockchain technology has been widely used in many fields. to apply.
  • Blockchains are generally divided into three types: Public Blockchain, Private Blockchain and Consortium Blockchain.
  • the public chain has the highest degree of decentralization.
  • the public chain is represented by Bitcoin and Ethereum. Participants who join the public chain can read the data records on the chain, participate in transactions, and compete for the bookkeeping rights of new blocks.
  • each participant ie node
  • the private chain the write permission of the network is controlled by an organization or institution, and the data read permission is regulated by the organization.
  • the private chain can be a weakly centralized system with strict restrictions and few participating nodes. This type of blockchain is more suitable for internal use by specific institutions.
  • the alliance chain is a blockchain between the public chain and the private chain, which can realize "partial decentralization".
  • Each node in the consortium chain usually has a corresponding entity or organization; participants join the network through authorization and form an alliance of stakeholders to jointly maintain the operation of the blockchain.
  • Smart contracts on the blockchain are contracts that can be triggered by transactions on the blockchain system. Smart contracts can be defined in the form of code.
  • EVM Ethereum Virtual Machine
  • bytecode virtual machine code
  • a contract account corresponding to the smart contract appears on the blockchain and has a specific address.
  • the contract code and account storage will be saved in the contract account.
  • the behavior of the smart contract is controlled by the contract code, and the account storage (Storage) of the smart contract saves the state of the contract.
  • smart contracts enable virtual accounts containing contract codes and account storage to be generated on the blockchain.
  • the data field of the transaction containing the creation of the smart contract can save the bytecode of the smart contract.
  • Bytecode consists of a series of bytes, each byte can identify an operation.
  • developers can choose a high-level language to write smart contract code instead of directly writing bytecode.
  • high-level languages such as SolIDity, Serpent, LLL language, etc. are adopted.
  • smart contract code written in a high-level language it can be compiled by a compiler to generate bytecode that can be deployed on the blockchain.
  • the contract written in it is very similar to the class (Class) in the object-oriented programming language.
  • Class class
  • various members can be declared, including state variables, functions, function modifiers, events, etc.
  • a state variable is a value permanently stored in the smart contract's account storage to hold the state of the contract.
  • This application aims to propose a blockchain-based data storage method.
  • this method uses smart contracts to associate and store the authentication data generated by different authentication agencies for user authentication to the blockchain, so it can take advantage of the high degree of transparency, non-tamperable modification of the blockchain and the secret key of the blockchain.
  • the signature function ensures the credibility and security of user data and eliminates data abuse; on the other hand, by marking the data value of user data, the authentication data generated by the user in different certification agencies can be used as the user's data assets for safe storage In the blockchain, it is convenient for data query.
  • the above data storage method can be applied to a data asset management system (hereinafter referred to as the management system).
  • the system can interact with the client corresponding to the data holder (hereinafter referred to as the data holder) and the client corresponding to the data queryer (hereinafter referred to as the data queryer), and the data holder uploaded by a user
  • the value of data is anchored, the user data is associated with other user data of the user, and the data query behavior of the data query party is managed in an orderly manner.
  • the above-mentioned management system may be a server system, a client system or a cloud service system, which is not limited in this application.
  • the above-mentioned management system may include a construction system based on a public chain, a private chain or an alliance chain.
  • the above-mentioned blockchain can include several node devices, which are used for consensus processing of the data to be stored to realize decentralized management of the data.
  • the aforementioned blockchains can deploy smart contracts for managing data assets.
  • the above-mentioned smart contract can be developed by the project operator (data management project operator) according to business needs, and deployed in the above-mentioned blockchain.
  • the smart contract above may include several processing logics for data management.
  • the smart contract may include data asset generation logic, which is used to mark the data value of the above user data in response to the above data deposit transaction, and share the user data marked with data value with other authentication institutions for the user. After authentication, user data marked with data value will be associated and stored to form data assets corresponding to the above-mentioned users.
  • the smart contract (hereinafter referred to as the contract) can also transmit information with the data holder and/or the data query party through the event mechanism, and obtain the response information of the data holder or the data message party to the event.
  • the contract can construct a data confirmation event for the user data to be deposited, so that the data holder can confirm the data information of the user data in response to the data confirmation event.
  • the above-mentioned data holder can send the above-mentioned confirmation information to the contract through a mechanism such as an oracle machine, and the contract can obtain the confirmation information and store it in association with the above-mentioned user data.
  • FIG. 2 is a method flow chart of a blockchain-based data storage method proposed in this application.
  • the above method may include: S202, acquiring a data certificate deposit transaction initiated by the data holder; wherein, the above data certificate deposit transaction includes user data to be deposited; Authentication data generated after user authentication.
  • the above-mentioned user may refer to a person, an enterprise or an organization.
  • the above-mentioned certification authority refers to any organization that can authenticate the above-mentioned user.
  • the above-mentioned certification body includes a training organization; the above-mentioned user data includes training data generated by the above-mentioned training organization performing training and certification on the above-mentioned user.
  • the above-mentioned training institutions include vocational training institutions; the above-mentioned user data includes vocational education skills certificates issued by the above-mentioned training institutions to the above-mentioned users after the above-mentioned training institutions have conducted vocational education training certification for the above-mentioned users.
  • the above-mentioned users may be individual users participating in training, and the above-mentioned certification agency may be an organization that certifies professional skills; Qualification certification body.
  • the above-mentioned user may be an individual user, and the above-mentioned authentication institution may be an identity authentication institution; or the above-mentioned user may be an enterprise user, and the above-mentioned authentication institution may be an institution that authenticates the identity of the enterprise.
  • the above-mentioned data holder may refer to any party that holds user data.
  • the above-mentioned data holder may be the user himself, or a certification authority.
  • the above-mentioned data holder may be the user himself who participates in vocational training, or a professional certification institution that certifies the user's professional skills.
  • the above-mentioned data holder can be the user himself or the identity authentication agency.
  • the above-mentioned blockchain can assign an exclusive public-private key pair to the above-mentioned data holder.
  • the above-mentioned data holders can use the private key to sign the user data, and broadcast the public key to other parties for signature verification.
  • the above-mentioned user data may include authentication data generated after the authentication authority performs user authentication on the above-mentioned user.
  • the aforementioned authentication data may be any data closely related to the aforementioned user.
  • the above-mentioned authentication data may include data information such as user identity information, age, occupational skills, and education level.
  • the above authentication data may include user identity information, age, date of birth, place of birth, and other information.
  • the data holder when uploading user data, can set the data attributes of the above user data, and send the set data attribute information and the user data to be stored to the above management system in association with The above-mentioned management system can store user data according to the data storage mode characterized by the above-mentioned data attribute information.
  • the aforementioned data attributes include at least one of the following: data hosting attributes; data disclosure attributes; data privacy attributes.
  • the above data escrow attribute can represent whether user data is escrowed to the data custodian.
  • the above-mentioned data custodian may specifically be any unit that provides data escrow services.
  • the data custodian may be the above-mentioned management system.
  • the above-mentioned management system can process the user data by itself within the scope of authority granted by the user. For example, the user grants the management system the authority to perform data queries on the data. At this time, if a data query party is willing to pay to query the above user data, the management system can provide the data to the data query party without the consent of the user. In some examples, the above-mentioned management system may transfer the fee collected from the data query party to the above-mentioned user. In some examples, the above data attribute information may also include time limit information representing the entrustment of the above user data to the management system, so that the data is entrusted to the management system within the time limit, thereby guaranteeing the user's rights.
  • the above-mentioned management system may only be responsible for user data storage and has no right to perform other processing on user data.
  • the above-mentioned data disclosure attribute can represent whether the user data is public data. If the data disclosure attribute indicates that the user data cannot be disclosed to third parties, the user data can only be disclosed to the above-mentioned users, and other users have no right to query the user data.
  • the data disclosure attribute indicates that the user data can be disclosed to a third party
  • the user data can be disclosed to third-party data query parties in addition to the above-mentioned users.
  • the disclosure attributes of the data can be defined to ensure the security and privacy of user data, thereby ensuring the rights of users.
  • the above data privacy attributes may represent the user data privacy level.
  • different privacy levels can be assigned to data, ensuring different levels of security for the data.
  • privacy levels may be assigned at least a first level and a second level.
  • the data privacy level of the first level is relatively low, and the data can be directly sent to the data query party when the data query party queries the data.
  • the data privacy level of the second level is higher.
  • the data to be verified provided by the data query party can be obtained, and then the data to be verified is verified according to the user data, and the verification result is sent to the above data query party.
  • the privacy level of the authentication data corresponding to user A is the first level.
  • the above-mentioned management system can send the authentication data corresponding to user A to enterprise B in plain text.
  • the privacy level of the authentication data corresponding to user A is the second level.
  • enterprise B wants to confirm whether user A has a certain professional skill.
  • the above-mentioned management system cannot send the authentication data corresponding to user A to enterprise B, but can obtain the data that enterprise B needs to verify, that is, whether user A has a professional skill.
  • the above-mentioned management system can obtain the verification result according to the authentication data corresponding to user A, and return the verification result to enterprise B. In this way, the privacy of user A's data can be guaranteed.
  • the privacy level of the data can be defined to ensure the security and privacy of user data, thereby ensuring the rights of users.
  • S204 may be executed.
  • S204 in response to the above-mentioned data deposit transaction, call the data asset generation logic included in the above-mentioned smart contract, mark the data value of the above-mentioned user data, and generate The user data marked with data value will be associated and deposited to form the data assets corresponding to the above users.
  • the above-mentioned data deposit transaction may include the contract address corresponding to the above-mentioned smart contract. After each node in the above-mentioned blockchain agrees on the above-mentioned data deposit transaction, it can obtain the above-mentioned contract according to the above-mentioned contract address, and execute the deposit logic included in the above-mentioned contract through the locally equipped virtual machine EVM.
  • the above-mentioned data value may specifically represent the value of the data to be deposited.
  • the data query party When the data query party queries user data, it needs to pay for the data a virtual resource equivalent to the data value of the data.
  • the above-mentioned data deposit transaction includes data value information for the user data
  • the above-mentioned management system can mark the data value for the above-mentioned user data according to the above-mentioned data value information.
  • the above contract can generate a data value mark event, so that when the user client corresponding to the above data holder obtains the above data value mark event, in response to the above data value mark event, prompt the above data holder Mark the data value for the above user data.
  • the above-mentioned contract can generate a data value token event and publish it to the above-mentioned blockchain.
  • the above-mentioned management system can obtain the above-mentioned data value marking event by pulling blocks, etc., and send the event to the above-mentioned user client.
  • pop-up reminders can be sent to the above-mentioned data holders.
  • the above-mentioned data holder can fill in the data value information for the above-mentioned user data to be certified in response to the event, and send the above-mentioned data value information to the above-mentioned contract.
  • the above-mentioned data holder can package a contract call transaction through the user client to send the above-mentioned data value information to the above-mentioned contract, so as to mark the data value for the above-mentioned data to be deposited.
  • the data holder may send the data value information to the management system, so that the management system sends the data value information to the contract for data value marking.
  • the data value of user data may change.
  • the above-mentioned management system may acquire the number of times that the above-mentioned user data is queried. It can be understood that the number of times the data is queried may refer to the number of times the data is queried in the above-mentioned management system, or the number of times the data is queried in other trusted systems.
  • the management system After the management system acquires the number of times the user data is queried, it can mark the corresponding data value for the user data according to the number of times. In this way, the data value can be bound to the number of times the user data is queried, so as to mark the above-mentioned user data with a more objective and real data value, thereby protecting user rights.
  • the above-mentioned contract can obtain the data attribute of the user data to be stored through the event mechanism.
  • the contract can generate a data attribute marking event, so that when the corresponding user client of the above-mentioned data holder obtains the above-mentioned data attribute marking event, it responds to the above-mentioned data attribute marking event, and outputs to the above-mentioned data holder
  • the data attribute tag prompt corresponding to the data.
  • the above-mentioned contract can obtain the data attribute sent by the above-mentioned user client and prompted by the above-mentioned data holder to mark the above-mentioned user data based on the above-mentioned data mark, and use the user data marked with data value with other authentication institutions to authenticate the user User data association certificate marked with data value.
  • the aforementioned data attributes include at least one of the following: data hosting attributes; data disclosure attributes; data privacy attributes.
  • data hosting attributes include at least one of the following: data hosting attributes; data disclosure attributes; data privacy attributes.
  • Obtaining the data attributes of the user data through the event mechanism can assign multiple types of data attributes to the above user data, so that the user data can be flexibly managed according to different user needs and user experience can be improved.
  • the contract account corresponding to the above contract may store user data marked with data value after other authentication agencies authenticate the user.
  • the above-mentioned contract can associate and store the user data to be deposited with the above-mentioned stored data.
  • the manner of data association may include data association of any dimension.
  • authentication data under different institutions can be associated through different dimensions such as user ID, age, gender, and ID number of the above user data.
  • the data query party accesses the user's authentication data through user ID, age, gender, ID number, etc., he can access the relevant authentication data of the user under different institutions.
  • the above contracts can further enhance the security and privacy of user data through TEE (Trusted Execution Environment, Trusted Execution Environment) when depositing user data.
  • TEE Trusted Execution Environment, Trusted Execution Environment
  • the secret key corresponding to the user can be managed through a trusted program in the above TEE.
  • the secret key is unknown to anyone, thereby increasing data security.
  • the above-mentioned associated data is encrypted based on the encryption key corresponding to the above-mentioned user maintained in the first TEE carried by the blockchain node device, so that when the data query party accesses the above-mentioned encrypted user data, through The decryption key corresponding to the user maintained in the second TEE carried by itself decrypts the encrypted user data. Therefore, the security of user data can be improved through TEE hardware encryption.
  • the above-mentioned first TEE may be a trusted environment carried in a blockchain node device. Encryption keys corresponding to the above users can be maintained in the trusted environment. Wherein, the encryption key mentioned above is unknown to anyone. After the above-mentioned device acquires the user data, it may encrypt it in the first TEE. In some examples, when the above user data needs to be stored in association with other data. The user data may be associated with the user data authenticated by other authentication institutions to obtain associated data, and then data encryption is performed in the above-mentioned first TEE.
  • the above-mentioned second TEE may be a trusted environment installed in the terminal of the data inquiring party.
  • the decryption key corresponding to the above user can be maintained in the trusted environment.
  • the above-mentioned decryption key is unknown to anyone. After the data query party obtains the user data, the data decryption can be completed in the second TEE through the decryption key.
  • a logout transaction may be initiated when the user does not need to manage data through the management system.
  • the above-mentioned management system may respond to the above-mentioned user’s log-out transaction, call the above-mentioned smart contract’s log-out logic, delete the account information corresponding to the above-mentioned user, and clear the encryption key in the above-mentioned first TEE and the decryption key in the above-mentioned second TEE To prohibit the above-mentioned data query party from accessing the above-mentioned user data. In this way, it can be ensured that the user data obtained by the above-mentioned data query party cannot be opened normally, the security of the user data is improved, and the interests of the users are guaranteed.
  • the data value of the above user data will be marked, and the user data marked with data value will be verified with other certification agencies for the user.
  • user data marked with data value is associated and stored to form data assets corresponding to the above users, so that on the one hand, the authentication data generated by different authentication agencies for user authentication on users is associated and stored in the blockchain, so it can be used
  • the blockchain has a high degree of transparency, non-tamperable modification and the signature function of the blockchain secret key to ensure the credibility and security of user data and eliminate data abuse;
  • the authentication data generated by the user in different certification agencies can be safely stored in the blockchain as the user's data assets, which is convenient for data query.
  • the above-mentioned smart contract also includes query logic, which is used to call the query logic included in the above-mentioned smart contract in response to the above-mentioned data query transaction, query the above-mentioned target user data stored in the above-mentioned block chain, and will target the above-mentioned
  • the query results of user data are sent to the above-mentioned data query party; and, from the virtual resources held by the user account of the above-mentioned data query party, the transfer to the user account of the above-mentioned data holder corresponds to the value of the data marked for the above-mentioned target user data The number of virtual resources.
  • FIG. 3 is a schematic diagram of a data query process shown in this application.
  • S302 acquire a data query transaction corresponding to the target user data initiated by the data query party.
  • the above-mentioned data query party may refer to any party that has data query needs.
  • the above-mentioned data query party may be the user himself. When the user has data query needs, he can initiate an active query (data query) request as a data query party to query the stored user data.
  • the data query party may be a telemarketer, and the telemarketer needs to obtain the user's contact information from the user data.
  • the above-mentioned data query party may be a bank sponsor, and the bank sponsor needs to obtain the user's credit information from the user data.
  • the above-mentioned target user data may refer to user data related to the above-mentioned target user that has been stored in the block chain.
  • the data query party initiates a data query transaction, it may carry information such as the user ID corresponding to the above-mentioned target user.
  • the above smart contract can query the stored user data related to the target user according to the user ID, and send the user data to the data query party.
  • S304 can be executed.
  • the query logic included in the above-mentioned smart contract is invoked to query the above-mentioned target user data stored in the above-mentioned block chain, and the target user data for the above-mentioned target user data will be
  • the query result is sent to the above-mentioned data query party; and, from the virtual resources held by the user account of the above-mentioned data query party, the amount corresponding to the data value marked for the above-mentioned target user data is transferred to the user account of the above-mentioned data holder virtual resources.
  • the above query result may be user data in plain text or a comparison result obtained after verifying the data to be verified according to the user data.
  • the aforementioned virtual resources may refer to virtual assets, token tokens, and the like.
  • the aforementioned virtual resources can be virtual assets anchored to offline physical objects.
  • the offline physical objects such as cars, real estate, account balances, etc. owned by the demander can be anchored as virtual assets on the chain, and stored in the account corresponding to the above-mentioned demander .
  • the anchor relationship between data value and virtual assets is pre-deployed in the above-mentioned smart contracts.
  • the above-mentioned contract can first determine the data value of the above-mentioned target user data mark. Then, through the above-mentioned anchor relationship, determine the amount of virtual resources that need to be paid for data query. Afterwards, the above-mentioned contract can transfer the above-mentioned amount of virtual resources from the account corresponding to the above-mentioned data query party, and transfer it to the account corresponding to the above-mentioned data holder.
  • the smart contract can be used to assist the data query party to obtain user data after paying the fee. On the one hand, the interests of the data holder can be guaranteed; The full record of the query process ensures the security and reliability of data query.
  • the identity of the data query party may be verified.
  • FIG. 4 is a schematic diagram of an identity verification process shown in this application.
  • S401 may be executed to determine whether the above-mentioned data querying party is the data holder corresponding to the above-mentioned target user data.
  • S402 may be executed to send the above-mentioned target user data to the above-mentioned data query party.
  • the verification logic included in the above-mentioned smart contract can be further invoked to authenticate the above-mentioned data query party, and when the identity verification is passed, the above query result will be sent to The above data query party.
  • the content of the above identity verification can be set according to business requirements.
  • the above identity verification may include query authority verification.
  • the above-mentioned smart contract can assign the query authority to the data query party in response to the completion of the fee payment.
  • the above-mentioned data inquiring party may pre-register in the management system, and stipulate in the registration agreement whether the data inquiring party has inquiry authority.
  • S403 may be further executed to determine whether the above-mentioned data query party has query authority.
  • the data query request of the above-mentioned data query party may be rejected.
  • the above user data may be sent to the above data query party.
  • the above-mentioned management system may execute S404, and ask the above-mentioned data holder whether to agree to the data query through means such as an internal message. If the data holder agrees, the user data can be signed with the corresponding private key of the data holder, and the signed data can be sent out; otherwise, the data query can be terminated.
  • the data query party before sending the user data to the data query party, the data query party can be authenticated, thereby ensuring the security of the user data and the user's rights.
  • the data query can be guided according to the data disclosure attributes corresponding to the user data.
  • the target user data when the target user data is sent to the data query party, it may be determined whether the target user data is public data based on the data disclosure attribute corresponding to the target user data.
  • the data disclosure attribute can be represented by an identification bit.
  • the provision of query results to the above data query party may be terminated; if the data disclosure attribute corresponding to the above target user data indicates that the target user data is public data, Send the query result for the above-mentioned target user data to the above-mentioned data query party.
  • data query can be guided according to the data public data corresponding to user data, and then flexible management of data can be realized, that is, it is convenient for the data query party to perform data query, and at the same time, data security and privacy are protected.
  • the data query can be guided according to the data disclosure attributes corresponding to the user data.
  • the target user data when sending the target user data to the data query party, it may be determined whether the target user data is escrow data based on the data hosting attribute corresponding to the target user data.
  • data managed attributes may be represented by identification bits.
  • the above-mentioned target user data can be signed with the private key corresponding to the above-mentioned data custodian, and the query of the above-mentioned target user data after signing The results are sent to the data query party mentioned above.
  • the party uses its own private key to sign the query result of the above-mentioned target user data; obtain the signed query result of the above-mentioned target user data sent by the above-mentioned user client, and send the signed query result of the above-mentioned target user data Send to the above data query party.
  • the above-mentioned data custodian can be any party. After the above-mentioned data custodian completes the registration in the above-mentioned blockchain, the above-mentioned blockchain can assign an exclusive public-private key pair to the data custodian. The above-mentioned data custodian can use the private key for identity signature.
  • the data query can be guided according to the data privacy attributes corresponding to the user data.
  • the privacy level corresponding to the target user data may be determined based on the data privacy attributes corresponding to the target user data.
  • the data privacy attribute can be represented by an identification bit.
  • the data level corresponding to the above-mentioned target user data is the first-level privacy level, send the plaintext data of the above-mentioned target user data to the above-mentioned data query party;
  • the data level corresponding to the above-mentioned target user data is the second-level privacy level, obtain the data to be verified carried in the above-mentioned data query transaction, compare the above-mentioned data to be verified with the above-mentioned target data, and use the comparison result as a query The results are sent to the data query party mentioned above.
  • the business logic corresponding to the above-mentioned first level and the above-mentioned second level can be set according to business requirements.
  • the first-level privacy level indicates that the target user data supports plaintext data query;
  • the second-level privacy level indicates that the target user data supports data comparison query.
  • the data query can be guided according to the data privacy attribute corresponding to the user data, so as to ensure data privacy and security on the one hand; on the other hand, realize flexible management of user data and improve user experience.
  • the number of queries of the target user data maintained by the smart contract is updated.
  • the above-mentioned management system may maintain a dedicated counter for each user data. Whenever the user data is queried, the value in the above-mentioned counter can be updated. In some examples, the above-mentioned number of times can represent the importance of the user data, and the above-mentioned management system can periodically update the data value corresponding to each user data according to the corresponding query times of each user data, so as to make the data value of user data more objective truth.
  • the above-mentioned management system can also maintain the data value corresponding to each user data when it is queried, and the revenue brought by each user data can be maintained by counting the corresponding data value when each user data is queried. In this way, bills associated with individual user data can be maintained.
  • the above-mentioned management system may also maintain revenue bills corresponding to users corresponding to the user data. Whenever certain user data is queried, the revenue bill corresponding to the user corresponding to the user data may also be updated.
  • the record transfer After transferring from the virtual resources held by the user account of the above-mentioned data query party to the user account of the above-mentioned data holder, the virtual resources corresponding to the value of the data marked for the above-mentioned target user data, the record transfer The amount of the above-mentioned virtual resources, and update the revenue bill corresponding to the above-mentioned target user data maintained by the above-mentioned smart contract based on the above-mentioned number of records.
  • a revenue query request can be initiated.
  • the above-mentioned management system may respond to the above-mentioned revenue query request, and send the revenue corresponding to the above-mentioned target user maintained by the above-mentioned smart contract to the above-mentioned target user.
  • the above income statement can be maintained in the contract account, thereby ensuring the credibility of the income statement.
  • the above-mentioned management system can initiate a revenue query transaction for the above-mentioned target user, call the query logic included in the above-mentioned smart contract, query the revenue bill according to the ID corresponding to the target user, and publish it to the blockchain.
  • the above-mentioned management system can obtain the block including the revenue bill by means such as pulling blocks, and parse out the revenue bill. Then the above-mentioned management system can send the revenue bill to the above-mentioned target user.
  • a blockchain-based data storage method is also proposed.
  • the above-mentioned block chain deploys a smart contract for managing data assets, and the above-mentioned method may include: obtaining a data deposit transaction initiated by a data holder; wherein, the above-mentioned data deposit transaction includes user data to be deposited;
  • the user data includes the authentication data generated by the authentication agency after the user authentication of the above-mentioned user; in response to the above-mentioned data storage transaction, the data asset generation logic included in the above-mentioned smart contract is invoked, and the above-mentioned user data is combined with other authentication agencies to authenticate the user.
  • the generated user data is associated and stored, and a user data set corresponding to the above-mentioned user is generated, and the data value of the generated user data set is marked to form a data asset corresponding to the above-mentioned user.
  • the above user data set may be a collection of data assets corresponding to the user in the table.
  • the user data obtained by the user after being authenticated by Institution A, Institution B, and Institution C can be associated and stored in the blockchain to form a user data set corresponding to the above-mentioned users, that is, user data assets .
  • this method uses smart contracts to associate and store the authentication data generated by different certification agencies for user authentication to the blockchain, so it can take advantage of the high degree of transparency of the blockchain, non-tamperable modification and block
  • the chain secret key signature function ensures the credibility and security of user data and eliminates data abuse; on the other hand, by marking the data value of user data, the authentication data generated by the user in different certification agencies can be used as the user's data assets
  • the security certificate is stored in the blockchain, which is convenient for data query.
  • a value marking event may be generated, so that the above-mentioned data holder can mark the value of the user data set in response to the value marking event.
  • the data of the user in the above user data set may be marked with data attributes, and the specific process may refer to the foregoing embodiments, which will not be described in detail here.
  • the first TEE based on the blockchain node device maintains The encryption key corresponding to the above-mentioned user encrypts the above-mentioned user data, so that when the data query party accesses the above-mentioned encrypted user data, the decryption key corresponding to the above-mentioned user maintained in the second TEE carried by itself, Decrypt the above encrypted user data.
  • the logout logic of the above-mentioned smart contract can be invoked, the user account corresponding to the above-mentioned user can be deleted, and the encryption key corresponding to the above-mentioned user maintained in the above-mentioned first TEE and the above-mentioned first TEE can be cleared.
  • Two decryption keys corresponding to the above-mentioned encryption keys maintained in the TEE to prohibit the above-mentioned data query party from accessing the above-mentioned user data.
  • the data query transaction initiated by the data query party and corresponding to the target user data can be obtained;
  • call the query logic included in the above-mentioned smart contract query the above-mentioned target user data stored in the above-mentioned block chain, and send the query result for the above-mentioned target user data to the above-mentioned data query party; and, from Among the virtual resources held by the user account of the above-mentioned data query party, the virtual resources of the amount corresponding to the data value marked for the above-mentioned target user data are transferred to the user account of the above-mentioned data holder.
  • the aforementioned user data may have different data attributes. Different responses can be made when accessing user data with different data attributes. For details, reference may be made to the foregoing embodiments, and details are not described herein.
  • Embodiments are described below in conjunction with specific professional certification data management scenarios.
  • FIG. 5 is a scene diagram of professional certification data management shown in this application.
  • the business system shown in Figure 5 is a data management system (hereinafter referred to as the management system) built on the alliance chain.
  • the aforementioned data management system may include a blockchain network (hereinafter referred to as blockchain).
  • Smart contracts for user data management (hereinafter referred to as contracts) can be deployed in the above blockchain.
  • the contract can include data storage logic and data query logic, responsible for effective management of data.
  • the users shown in FIG. 5 may be users who need vocational training.
  • the user can participate in vocational training at different institutions.
  • the data certification body shown in FIG. 5 may be a professional certification body that provides professional certification services.
  • the above-mentioned certification body may generate certification data for the above-mentioned user after the user passes the vocational training assessment. It can be understood that the above-mentioned users or professional certification agencies can apply for certificate storage and certification data to the above-mentioned management system as data holders.
  • the user can initiate an application for depositing the authentication data.
  • the data attributes corresponding to the user data may include not hosting, the privacy level is the first level, and the data can be disclosed.
  • the direct data inquirer shown in FIG. 5 may refer to the data holder himself.
  • the data indirect queryer shown in FIG. 5 can be any party that needs authentication data.
  • the indirect inquirer of the above-mentioned data may be the employing enterprise.
  • the employer needs to recruit talents with certain professional skills (for example, electric welding), and the employer needs to determine whether a certain user is qualified for electric welding according to the certification data stored in the management system.
  • FIG. 6 is a schematic diagram of a data management system architecture shown in this application.
  • the above data management system may include a client-side computing device 101 , a server-side 102 and a blockchain system 103 .
  • the above client-side computing device 101 may include various types of client-side computing devices; for example, the client-side terminal device may include PC terminal devices, mobile terminal devices, IoT devices, and other forms of Smart devices with computing power, and more.
  • the client-side terminal device may include PC terminal devices, mobile terminal devices, IoT devices, and other forms of Smart devices with computing power, and more.
  • At least part of the computing devices in the above-mentioned client-side terminal device 101 may be coupled to the server-side 102 through various communication networks; for example, the device 1 and device 2 shown in FIG. coupling.
  • terminal devices in the client-side terminal device 101 may not be coupled with the server 102, but are directly coupled to the blockchain system as blockchain nodes through various communication networks; for example, The device 4 shown in FIG. 6 can be coupled to the blockchain system as a blockchain node.
  • the above-mentioned communication network may include a wired and/or wireless communication network; for example, it may be a local area network (Local Area Network, LAN) implemented based on a wired access network or a wireless access network (such as a mobile cellular network) provided by an operator, Wide Area Network (Wide Area Network, WAN), the Internet, or a combination thereof.
  • LAN Local Area Network
  • WAN Wide Area Network
  • the client-side computing device 101 may further include one or more user-side servers; for example, the device 5 shown in FIG. 6 . At least part of the computing devices in the client-side terminal device 101 may be coupled to the user-side server, and the user-side server may be further coupled to the above-mentioned server 102; for example, the device 1 and the device shown in FIG. 6 2 is coupled to device 5, and device 5 is further coupled to server end 102.
  • the above-mentioned user-side server may be implemented by a service entity that has established a user account system; the above-mentioned service entity may include an operating entity that provides various online and/or offline service carriers for users;
  • the above-mentioned service carrier may include a service carrier in the form of software, and may also include a service carrier in the form of hardware.
  • the above-mentioned service carrier may include various client softwares that provide online Internet services; for example, websites, webpages, APPs, etc.
  • the above-mentioned service carriers may also include various smart devices deployed offline and capable of providing offline services; for example, smart express cabinets deployed in residential areas, office areas, and public places.
  • the above-mentioned operating entity may include the operator corresponding to the above-mentioned service carrier; for example, the above-mentioned operating entity may include individuals, organizations, companies, enterprises, etc. that operate and manage the above-mentioned service carrier.
  • the server end 102 can also be coupled to one or more blockchain systems through various communication networks; for example, the server end 102 shown in FIG. Block chain system 104 and block chain system 105, and so on.
  • the aforementioned blockchain system 103 may be an alliance blockchain.
  • the blockchain system 103 may include several nodes participating in the consensus mechanism. When any of the node devices needs to distribute blocks, the release of the blocks can be completed after each node completes the consensus.
  • the above-mentioned server end 102 may be a BaaS platform (also referred to as a BaaS cloud) for providing blockchain as a service (BaaS, Blockchain as a Service).
  • the BaaS platform can provide pre-written software for activities that occur on the blockchain (such as subscriptions and notifications, user verification, database management, and remote updates), oriented to client-side computing devices coupled with the BaaS platform, providing Easy to use, one-click deployment, fast verification, flexible and customizable blockchain services, which can accelerate the development, testing, and launch of blockchain business applications, and help the implementation of blockchain business application scenarios in various industries.
  • the BaaS platform can provide software such as MQ (Message Queue, message queue) service; the client-side computing device coupled with the BaaS platform can subscribe to the blockchain system coupled with the BaaS platform A smart contract deployed on a certain blockchain in the blockchain generates contract events on the blockchain after the execution is triggered; while the BaaS platform can monitor the events generated by the smart contract on the blockchain after the execution is triggered, and then based on the MQ
  • the service-related software adds the contract event to the message queue in the form of a notification message, so that the client-side computing device that subscribes to the message queue can get notifications related to the above contract event.
  • the above-mentioned client segment computing device 101 may be a client corresponding to any one of the user, the certification authority, and the data inquiring party shown in FIG. 5 .
  • the client corresponding to the user is called the user client;
  • the client corresponding to the data indirect query party is called the indirect client.
  • the node devices in the aforementioned blockchain are equipped with a first TEE, which includes an encryption key for authentication data.
  • the terminal device used by the above-mentioned indirect data inquiring party includes the second TEE, which includes a decryption key for the authentication data.
  • FIG. 7 is a schematic diagram of a data storage process shown in this application.
  • the above-mentioned contract call transaction includes the authentication data, attribute information corresponding to the authentication data, and data value information of the authentication data.
  • the data attributes corresponding to the authentication data may include no hosting, the privacy level is the first level, and the data may be disclosed.
  • S702 can be executed to construct a contract call transaction based on the data and publish it to the blockchain.
  • the node device in the above-mentioned blockchain can execute S703, call the smart contract certificate storage logic, associate the authentication data with the relevant authentication data of the user, and store the certificate after completing the encryption of the associated data in the first TEE.
  • the authentication data can be stored flexibly according to the user's need for certificate storage to improve user experience.
  • the authentication data generated by different authentication agencies for user authentication is associated and stored in the blockchain to form data assets.
  • FIG. 8 is a schematic diagram of a data query process shown in this application.
  • S801 may be executed to construct a data query transaction based on the user ID corresponding to the user.
  • S802 can be executed, publishing the data query transaction to the block chain.
  • the node devices in the above blockchain can execute S803, call the query logic of the smart contract, and judge whether the above enterprise is the data holder corresponding to the authentication data according to the user ID.
  • the above-mentioned enterprise is not the data holder of the data, so the above-mentioned indirect inquiring party may be notified to complete the payment for the data query, and the indirect inquiring party may be assigned data query authority in response to the completion of the payment.
  • the above contract can further determine whether the above authentication data is public data.
  • the above-mentioned authentication data is public data, so it can be further judged whether the above-mentioned indirect query party has query authority.
  • the above-mentioned enterprise has already completed the payment, so the privacy level corresponding to the above-mentioned authentication data can be further judged.
  • the aforementioned authentication data is the first level, so the authentication data can be sent directly to the indirect inquiring party. Before sending, the contract can further determine whether the above authentication data is escrow data.
  • the data is non-custodial data.
  • the above-mentioned contract can execute S804, initiate a confirmation request to the above-mentioned user whether to allow sending data through the event mechanism, and respond to the user's permission operation (after signing the data), the authentication data Send to the above companies.
  • the above-mentioned enterprise can execute S805 to complete the decryption of the authentication data in the second TEE, and analyze whether the user has the welding qualification, thereby completing the query for the authentication data. Therefore, if the user completes the account cancellation in the management system, the above-mentioned management system can issue the account cancellation transaction and call the contract to complete the invalidation request of the user-related secret key, so that even if the user’s authentication data is still retained in the enterprise, it cannot Normal access, thereby improving data privacy and security.
  • the above-mentioned contract may also execute S806 after sending the authentication data to update the number of queries corresponding to the authentication data and the revenue bill corresponding to the user. Therefore, on the one hand, when the user needs to query the income, he can obtain a clear and credible income bill through the contract to ensure the user's rights and interests; on the other hand, he can mark the authentication data with more objective and real data value according to the number of queries.
  • this application also proposes a blockchain-based data storage device.
  • the above-mentioned blockchain deploys smart contracts for managing data assets.
  • FIG. 9 is a schematic structural diagram of a blockchain-based data storage device shown in the present application.
  • the above-mentioned device 900 may include: a first acquisition module 910, which acquires a data deposit transaction initiated by a data holder; wherein, the above-mentioned data deposit transaction includes user data to be deposited; the above-mentioned user data includes authentication The authentication data generated after the institution authenticates the above-mentioned user; the first data asset generation module 920, in response to the above-mentioned data deposit transaction, invokes the data asset generation logic included in the above-mentioned smart contract to mark the data value of the above-mentioned user data, and
  • the above-mentioned user data marked with data value is associated with the user data marked with data value generated by other certification agencies after the user is authenticated, so as to form a data asset corresponding to the above-mentioned user.
  • the above-mentioned device 900 further includes: a data attribute marking module, which generates a data attribute marking event, so that the corresponding user client of the above-mentioned data holder responds when the above-mentioned data attribute marking event is acquired In the above-mentioned data attribute marking event, output the data attribute marking prompt corresponding to the above-mentioned user data to the above-mentioned data holder; obtain the data sent by the above-mentioned user client and marked as the above-mentioned user data by the above-mentioned data holder based on the above-mentioned data mark prompt Attributes.
  • a data attribute marking module which generates a data attribute marking event, so that the corresponding user client of the above-mentioned data holder responds when the above-mentioned data attribute marking event is acquired
  • output the data attribute marking prompt corresponding to the above-mentioned user data to the above-mentioned data holder
  • the above-mentioned data attribute marking module is specifically used for any of the following: generating a data value marking event, so that the above-mentioned user client responds to the above-mentioned data value marking event when obtaining the above-mentioned data value marking event Value marking event, prompting the above-mentioned data holder to mark the data value of the above-mentioned user data; marking the data value of the above-mentioned user data according to the data value information included in the above-mentioned data deposit transaction; User data mark data value.
  • the above-mentioned device 900 further includes: an encryption module, before associating and depositing the user data marked with data value with the user data marked with data value after the user is authenticated by other authentication institutions, block-based
  • the encryption key corresponding to the above-mentioned user maintained in the first TEE carried by the chain node device encrypts the above-mentioned user data, so that when the data query party accesses the above-mentioned encrypted user data, it can be maintained in the second TEE carried by itself.
  • the decryption key corresponding to the above-mentioned user is used to decrypt the above-mentioned encrypted user data.
  • the above-mentioned device 900 further includes: a logout module, in response to the logout transaction for the above-mentioned user, invoke the logout logic of the above-mentioned smart contract, delete the user account corresponding to the above-mentioned user, and clear the above-mentioned first TEE The maintained encryption key corresponding to the above user and the decryption key maintained in the second TEE corresponding to the above encryption key, so as to prohibit the above data query party from accessing the above user data.
  • a logout module in response to the logout transaction for the above-mentioned user, invoke the logout logic of the above-mentioned smart contract, delete the user account corresponding to the above-mentioned user, and clear the above-mentioned first TEE The maintained encryption key corresponding to the above user and the decryption key maintained in the second TEE corresponding to the above encryption key, so as to prohibit the above data query party from accessing the above user data.
  • the above-mentioned device 900 further includes: a second acquisition module 930, which acquires the data query transaction corresponding to the target user data initiated by the data query party; the query module 940, responding to the above-mentioned data query transaction, calls the above The query logic included in the smart contract queries the above-mentioned target user data stored in the above-mentioned blockchain, and sends the query results for the above-mentioned target user data to the above-mentioned data query party; and, from the user account of the above-mentioned data query party.
  • the amount of virtual resources corresponding to the data value marked for the above-mentioned target user data is transferred to the user account of the above-mentioned data holder.
  • the data attribute indicates whether the target user data is a data disclosure attribute of public data; the query module 940 is specifically configured to: determine whether the target user data is based on the data disclosure attribute corresponding to the target user data is public data; if the above-mentioned target user data is public data, send the query result for the above-mentioned target user data to the above-mentioned data query party.
  • the above-mentioned data attributes include a data hosting attribute indicating whether the above-mentioned target user data is hosted by a data custodian;
  • the above-mentioned query module 940 is specifically configured to: determine the above-mentioned Whether the target user data is escrow data; if the above target user data is escrow data hosted by the data custodian, use the private key corresponding to the above data custodian to sign the query result of the above target user data, and sign the above target user data after signing The query result of the user data is sent to the above-mentioned data query party; if the above-mentioned target user data is not hosted data hosted by the data custodian, a data signature event is generated so that the user client responds to the above-mentioned data signature event when it obtains the above-mentioned data signature event Signature event, prompting the data holder corresponding to the above-mentioned target user data to sign the query result of the above-
  • the above-mentioned data attributes include data privacy attributes indicating the privacy level of the above-mentioned target user data;
  • the above-mentioned query module 940 is specifically configured to: determine the corresponding The above-mentioned privacy level includes the first-level privacy level and the second-level privacy level;
  • the above-mentioned first-level privacy level means that the above-mentioned target user data supports plaintext data query;
  • the above-mentioned second-level privacy level means that the above-mentioned target user data supports Data comparison query; if the data level corresponding to the above-mentioned target user data is the first-level privacy level, send the plaintext data of the above-mentioned target user data to the above-mentioned data query party; if the data level corresponding to the above-mentioned target user data is the second-level
  • the privacy level is selected, the data to be verified carried in the above-mentioned data query transaction is obtained, the above-mentioned data to be
  • the above query module 940 is specifically configured to: determine whether the above data query party is the data holder corresponding to the above target user data; if yes, send the above query result to the above data query party; if No, further invoke the verification logic included in the above-mentioned smart contract, perform identity verification on the above-mentioned data query party, and send the above-mentioned query result to the above-mentioned data query party when the identity verification is passed.
  • the above-mentioned device 900 further includes: an updating module, after sending the query result for the above-mentioned target user data to the above-mentioned data inquiring party, updating the query times of the above-mentioned target user data maintained by the above-mentioned smart contract; And/or, the revenue statistics module, after transferring the virtual resources corresponding to the data value marked for the target user data to the user account of the data holder from the virtual resources held by the user account of the data query party , record the quantity of the above-mentioned virtual resources transferred, and update the revenue bill corresponding to the above-mentioned target user data maintained by the above-mentioned smart contract based on the above-mentioned recorded quantity.
  • the authentication institution includes a training institution; the user data includes training data generated by the training institution performing training and authentication on the user.
  • the above-mentioned training institution includes a vocational training institution; the above-mentioned user data includes a vocational education skill certificate issued by the above-mentioned training institution to the above-mentioned user after performing vocational education and training certification on the above-mentioned user.
  • this application also proposes a blockchain-based data storage device 100 .
  • the above-mentioned blockchain deploys smart contracts for managing data assets.
  • the above-mentioned device 100 may include: a third acquisition module, which acquires a data certificate deposit transaction initiated by a data holder; wherein, the above-mentioned data certificate deposit transaction includes user data to be deposited; The authentication data generated afterwards;
  • the second data asset generation module in response to the above-mentioned data deposit transaction, invokes the data asset generation logic included in the above-mentioned smart contract, and associates the above-mentioned user data with the user data generated by other authentication institutions after authenticating the user, and generates User data sets corresponding to the above users, and mark data value for the generated user data sets to form data assets corresponding to the above users.
  • the above-mentioned device 100 further includes: an encryption module, before correlating and depositing the user data marked with data value with the user data marked with data value after authentication by other authentication institutions for the user, Based on the encryption key corresponding to the user maintained in the first TEE carried by the blockchain node device, the above user data is encrypted, so that when the data query party accesses the above encrypted user data, the second The decryption key corresponding to the user maintained in the TEE decrypts the encrypted user data.
  • the above-mentioned device 100 further includes: a logout module, in response to the logout transaction for the above-mentioned user, invoke the logout logic of the above-mentioned smart contract, delete the user account corresponding to the above-mentioned user, and clear the above-mentioned first TEE The maintained encryption key corresponding to the above user and the decryption key maintained in the second TEE corresponding to the above encryption key, so as to prohibit the above data query party from accessing the above user data.
  • a logout module in response to the logout transaction for the above-mentioned user, invoke the logout logic of the above-mentioned smart contract, delete the user account corresponding to the above-mentioned user, and clear the above-mentioned first TEE The maintained encryption key corresponding to the above user and the decryption key maintained in the second TEE corresponding to the above encryption key, so as to prohibit the above data query party from accessing the above user data.
  • the above-mentioned device 100 further includes: a fourth acquisition module, which acquires the data query transaction corresponding to the target user data initiated by the data query party; the query module, in response to the above-mentioned data query transaction, invokes the above-mentioned smart contract Included query logic, query the above-mentioned target user data stored in the above-mentioned blockchain, and send the query results for the above-mentioned target user data to the above-mentioned data query party; and, from the virtual data held by the user account of the above-mentioned data query party Among the resources, the amount of virtual resources corresponding to the data value marked for the above-mentioned target user data is transferred to the user account of the above-mentioned data holder.
  • a fourth acquisition module which acquires the data query transaction corresponding to the target user data initiated by the data query party
  • the query module in response to the above-mentioned data query transaction, invokes the above-mentioned smart contract Included query logic, query
  • the embodiment of the blockchain-based data storage device shown in this application can be applied to electronic equipment.
  • the present application discloses an electronic device, and the above-mentioned electronic device is deployed on a block chain.
  • the device can include: a processor.
  • Memory used to store processor-executable instructions.
  • the above-mentioned processor is configured to invoke the executable instructions stored in the above-mentioned memory to implement the data storage method shown in any one of the above-mentioned embodiments.
  • FIG. 10 is a schematic diagram of a hardware structure of an electronic device shown in this application.
  • the electronic device may include a processor for executing instructions, a network interface for network connection, a memory for storing operating data for the processor, and a non-volatile memory for storing instructions corresponding to the remittance device. volatile memory.
  • the embodiment of the data storage device can be implemented by software, or by hardware or a combination of software and hardware.
  • software implementation as an example, as a device in a logical sense, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory for operation by the processor of the electronic device where it is located.
  • the electronic device where the device in the embodiment is usually based on the actual function of the electronic device can also include other Hardware, no more details on this.
  • the instructions corresponding to the data storage device can also be directly stored in the memory, which is not limited here.
  • the present application proposes a computer-readable storage medium.
  • the above-mentioned storage medium stores a computer program, and the above-mentioned computer program is used to execute the data storage method shown in any one of the above-mentioned embodiments.
  • one or more embodiments of the present application may be provided as a method, system or computer program product. Accordingly, one or more embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present application may employ the computer implemented above on one or more computer-usable storage media (which may include but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code therein. The form of the Program Product.
  • each embodiment in the present application is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments.
  • the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiment.
  • Embodiments of the subject matter and functional operations described in this application can be implemented in digital electronic circuitry, tangibly embodied computer software or firmware, computer hardware that may include the structures disclosed in this application and their structural equivalents, or their A combination of one or more of them.
  • Embodiments of the subject matter described in this application may be implemented as one or more computer programs, i.e. one or more of the above-mentioned computer program instructions encoded on a tangible, non-transitory program carrier to be executed by data processing means or to control the operation of parameter processing means. Multiple modules.
  • the program instructions may be encoded in an artificially generated propagated signal, such as a machine-generated electrical, optical or electromagnetic signal, which is generated to encode and transmit information to a suitable capture device for retrieval by the data
  • the processing means executes.
  • a computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.
  • the processes and logic flows described in this application can be performed by one or more programmable computers executing one or more computer programs to perform corresponding functions by operating on input data and generating output.
  • the above-mentioned processing and logic flow can also be executed by a dedicated logic circuit such as FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit), and the device can also be implemented as a dedicated logic circuit.
  • FPGA Field Programmable Gate Array
  • ASIC Application Specific Integrated Circuit
  • a computer suitable for the execution of a computer program may include, for example, a general and/or special purpose microprocessor, or any other type of central processing unit.
  • a central processing unit will fetch instructions and data from a read only memory and/or random access memory.
  • the basic components of a computer may include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data.
  • a computer will also include, or be operatively coupled to, one or more mass storage devices for storing data, such as magnetic or magneto-optical disks, or optical disks, to retrieve data therefrom or Send data to it, or both.
  • mass storage devices for storing data, such as magnetic or magneto-optical disks, or optical disks, to retrieve data therefrom or Send data to it, or both.
  • a computer may be embedded in another device such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, Global Positioning System (GPS) acquirer, or a device such as a Universal Serial Bus (USB ) portable storage devices like flash drives, to name a few.
  • PDA personal digital assistant
  • GPS Global Positioning System
  • USB Universal Serial Bus
  • Computer-readable media suitable for storing computer program instructions and data may include all forms of non-volatile memory, media and memory devices and may include, for example, semiconductor memory devices such as EPROM, EEPROM and flash memory devices, magnetic disks such as internal hard drives or removable disks), magneto-optical disks, and CD ROM and DVD-ROM disks.
  • semiconductor memory devices such as EPROM, EEPROM and flash memory devices
  • magnetic disks such as internal hard drives or removable disks
  • magneto-optical disks and CD ROM and DVD-ROM disks.
  • the processor and memory can be supplemented by, or incorporated in, special purpose logic circuitry.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Security & Cryptography (AREA)
  • Tourism & Hospitality (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Strategic Management (AREA)
  • Educational Administration (AREA)
  • Computer Hardware Design (AREA)
  • Human Resources & Organizations (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Primary Health Care (AREA)
  • General Business, Economics & Management (AREA)
  • Development Economics (AREA)
  • Educational Technology (AREA)
  • Data Mining & Analysis (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Storage Device Security (AREA)

Abstract

一种基于区块链的数据存证方法、装置、设备和存储介质。其中，上述区块链部署了用于管理数据资产的智能合约，上述方法可以包括，获取数据持有方发起的数据存证交易。其中，上述数据存证交易包括待存证的用户数据。上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据（S202）。响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，为上述用户数据标记数据价值，并将标记了数据价值的上述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与上述用户对应的数据资产（S204）。

Description

基于区块链的数据存证方法、装置、设备和存储介质 技术领域
本申请涉及计算机技术，具体涉及基于区块链的数据存证方法、装置、设备和存储介质。
背景技术
认证机构在对用户进行认证之后，可以形成与该用户相关的认证数据。这些认证数据可能包括与用户密切相关的信息。
以上述认证机构为职业认证机构为例，用户可以获取多种职业培训机构提供的职业技能培训。当用户结业后，认证机构可以为该用户生成可以认证该用户具备相关技能的认证数据。上述认证数据可以包括诸如用户身份信息、年龄、职业技能、受教育程度等数据信息。
当用户与多个不同的认证机构发生关联时，机构与人的关系是交叉型的网络服务关系，这给用户认证数据的存储，查询以及使用带来了很大的挑战。
发明内容
有鉴于此，本申请公开一种基于区块链的数据存证方法，其中，上述区块链部署了用于管理数据资产的智能合约，上述方法可以包括：获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，为上述用户数据标记数据价值，并将标记了数据价值的上述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与上述用户对应的数据资产。
在示出的一些实施例中，在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，上述方法还包括：生成数据属性标记事件，以使上述数据持有方的对应的用户客户端在获取到上述数据属性标记事件时，响应于上述数据属性标记事件，向上述数据持有方输出与上述用户数据对应的数据属性标记提示；获取上述用户客户端发送的由上述数据持有方基于上述数据标记提示为上述用户数据标记的数据属性。
在示出的一些实施例中，上述为上述用户数据标记数据价值，包括以下示出的任一：生成数据价值标记事件，以使上述用户客户端在获取到上述数据价值标记事时，响应于上述数据价值标记事件，提示上述数据持有方为上述用户数据标记数据价值；根据上述数据存证交易包括的数据价值信息，为上述用户数据标记数据价值；根据上述用户数据的被查询的次数，为上述用户数据标记数据价值。
在示出的一些实施例中，上述方法还包括：在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与上述用户对应的加密密钥对上述用户数据进行加密，以使数据查询方在访问上述加密后的用户数据时，通过自身搭载的第二TEE中维护的与上述用户对应的解密密钥，对上述加密后的用户数据进行解密。
在示出的一些实施例中，上述方法还包括：响应于针对上述用户的注销交易，调用上述智能合约的注销逻辑，删除上述用户对应的用户账户，并清除上述第一TEE中维护的与上述用户对应加密秘钥和上述第二TEE中维护的与上述加密密钥对应的解密秘钥，以禁止上述数据查询方访问上述用户数据。
在示出的一些实施例中，上述方法还包括：获取数据查询方发起的与目标用户数据对应的数据查询交易；响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
在示出的一些实施例中，上述数据属性指示上述目标用户数据是否为公开数据的数据公开属性；上述将针对上述目标用户数据的查询结果发送至上述数据查询方包括：基 于上述目标用户数据对应的数据公开属性确定上述目标用户数据是否为公开数据；如果上述目标用户数据为公开数据，将针对上述目标用户数据的查询结果发送至上述数据查询方。
在示出的一些实施例中，上述数据属性包括指示上述目标用户数据是否为托管至数据托管方的数据托管属性；上述将针对上述目标用户数据的查询结果发送至上述数据查询方包括：基于上述目标用户数据对应的数据托管属性确定上述目标用户数据是否为托管数据；如果上述目标用户数据为托管至数据托管方的托管数据，通过上述数据托管方对应的私钥对上述目标用户数据的查询结果进行签名，并将签名后的上述目标用户数据的查询结果发送至上述数据查询方；如果上述目标用户数据不是托管至数据托管方的托管数据，生成数据签名事件，以使用户客户端在获取到上述数据签名事件时，响应于上述数据签名事件，提示上述目标用户数据对应的数据持有方利用自身持有的私钥对上述目标用户数据的查询结果进行签名；获取上述用户客户端发送的签名后的上述目标用户数据的查询结果，并将签名后的上述目标用户数据的查询结果发送至上述数据查询方。
在示出的一些实施例中，上述数据属性包括指示上述目标用户数据的隐私等级的数据隐私属性；上述将针对上述目标用户数据的查询结果发送至上述数据查询方，包括：基于上述目标用户数据对应的数据隐私属性确定上述目标用户数据对应的隐私等级；其中，上述隐私等级包括第一级隐私等级和第二级隐私等级；上述第一级隐私等级表示上述目标用户数据支持明文数据查询；上述第二级隐私等级表示上述目标用户数据支持数据比较查询；如果上述目标用户数据对应的数据等级为第一级隐私等级时，将上述目标用户数据的明文数据发送至上述数据查询方；如果上述目标用户数据对应的数据等级为第二级的隐私等级时，获取上述数据查询交易中携带的待校验数据，将上述待校验数据与上述目标数据进行比较，并将比较结果作为查询结果发送至上述数据查询方。
在示出的一些实施例中，上述将针对上述目标用户数据的查询结果发送至上述数据查询方，包括：确定上述数据查询方是否为上述目标用户数据对应的数据持有方；如果是，将上述查询结果发送至上述数据查询方；如果否，进一步调用上述智能合约包括的验证逻辑，对上述数据查询方进行身份验证，并在身份验证通过时，将上述查询结果发送至上述数据查询方。
在示出的一些实施例中，上述方法还包括：在将针对上述目标用户数据的查询结果发送至上述数据查询方之后，更新上述智能合约维护的上述目标用户数据的查询次数；和/或，在从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应数量的虚拟资源之后，记录转移的上述虚拟资源的数量，并基于记录的上述数量更新上述智能合约维护的与上述目标用户数据对应的收益账单。
在示出的一些实施例中，上述认证机构包括培训机构；上述用户数据包括上述培训机构对上述用户进行培训认证产生的培训数据。
在示出的一些实施例中，上述培训机构包括职业培训机构；上述用户数据包括上述培训机构对上述用户进行职业教育培训认证后颁发的职业教育技能证书。
本申请还提出一种基于区块链的数据存证方法，其中，上述区块链部署了用于管理数据资产的智能合约，上述方法可以包括：获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，将上述用户数据与其它认证机构对该用户进行认证后产生的用户数据进行关联存证，生成与上述用户对应的用户数据集，并为生成的用户数据集标记数据价值，以形成与上述用户对应的数据资产。
在示出的一些实施例中，上述方法还包括：在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与上述用户对应的加密密钥对上述用户数据进行加密，以使数据查询方在访问上述加密后的用户数据时，通过自身搭载的第二TEE中维护的与上述用户对应的解密密钥，对上述加密后的用户数据进行解密。
在示出的一些实施例中，上述方法还包括：响应于针对上述用户的注销交易，调用上述智能合约的注销逻辑，删除上述用户对应的用户账户，并清除上述第一TEE中维护的与上述用户对应加密秘钥和上述第二TEE中维护的与上述加密密钥对应的解密秘钥，以禁止上述数据查询方访问上述用户数据。
在示出的一些实施例中，上述方法还包括：获取数据查询方发起的与目标用户数据对应的数据查询交易；响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
本申请还提出一种基于区块链的数据存证装置，其中，上述区块链部署了用于管理数据资产的智能合约，上述装置可以包括：第一获取模块，获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；第一数据资产生成模块，响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，为上述用户数据标记数据价值，并将标记了数据价值的上述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与上述用户对应的数据资产。
在示出的一些实施例中，上述装置还包括：第二获取模块，获取数据查询方发起的与目标用户数据对应的数据查询交易；查询模块，响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
本申请还提出一种基于区块链的数据存证装置，其中，上述区块链部署了用于管理数据资产的智能合约，上述装置可以包括：第三获取模块，获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；第二数据资产生成模块，响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，将上述用户数据与其它认证机构对该用户进行认证后产生的用户数据进行关联存证，生成与上述用户对应的用户数据集，并为生成的用户数据集标记数据价值，以形成与上述用户对应的数据资产。
本申请还提出一种电子设备，包括：处理器；用于存储上述处理器可执行指令的存储器；其中，上述处理器被配置为调用上述存储器中存储的可执行指令，实现如前述任一实施例示出的数据存证方法。
本申请还提出一种计算机可读存储介质，上述存储介质存储有计算机程序，上述计算机程序用于执行如前述任一实施例示出的数据存证方法。
在上述方案中，在有用户数据存证需求时，通过调用上述智能合约包括的存证逻辑，为上述用户数据标记数据价值，并将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据关联存证，以形成与上述用户对应的数据资产，从而一方面将不同认证机构对用户进行用户认证产生的认证数据关联存证至区块链，因此可以利用区块链透明化程度高、不可篡改性以及区块链秘钥签名功能，保证用户数据的可信性与安全性，排除数据滥用；另一方面，通过为用户数据标记数据价值，可以将用户在不同认证机构产生的认证数据作为该用户的数据资产安全存证在区块链中，便于进行数据查询。
应当理解的是，以上述的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本申请。
附图说明
图1为本申请示出的一种创建智能合约的示意图；
图2为本申请提出的一种基于区块链的数据存证方法的方法流程图；
图3为本申请示出的一种数据查询流程示意图；
图4为本申请示出的一种身份验证流程示意图；
图5为本申请示出的一种职业认证数据管理场景图；
图6为本申请示出的一种数据管理系统架构示意图；
图7为本申请示出的一种数据存证流程示意图；
图8为本申请示出的一种数据查询流程示意图；
图9为本申请示出的一种基于区块链的数据存证装置的结构示意图；
图10为本申请示出的一种电子设备的硬件结构示意图。
具体实施方式
区块链技术，也被称之为分布式账本技术，是一种由若干台计算设备共同参与“记账”，共同维护一份完整的分布式数据库的新兴技术。由于区块链技术具有去中心化、公开透明、每台计算设备可以参与数据库记录、并且各计算设备之间可以快速的进行数据同步的特性，使得区块链技术已在众多的领域中广泛的进行应用。
区块链一般被划分为三种类型：公有链(Public Blockchain)，私有链(Private Blockchain)和联盟链(Consortium Blockchain)。此外，还有多种类型的结合，比如私有链+联盟链、联盟链+公有链等不同组合形式。其中去中心化程度最高的是公有链。公有链以比特币、以太坊为代表，加入公有链的参与者可以读取链上的数据记录、参与交易以及竞争新区块的记账权等。
而且，各参与者(即节点)可自由加入以及退出网络，并进行相关操作。私有链则相反，该网络的写入权限由某个组织或者机构控制，数据读取权限受组织规定。简单来说，私有链可以为一个弱中心化系统，参与节点具有严格限制且少。这种类型的区块链更适合于特定机构内部使用。
联盟链则是介于公有链以及私有链之间的区块链，可实现“部分去中心化”。联盟链中各个节点通常有与之相对应的实体机构或者组织；参与者通过授权加入网络并组成利益相关联盟，共同维护区块链运行。
不论是公有链、私有链还是联盟链，都可能提供智能合约的功能。区块链上的智能合约是在区块链系统上可以被交易触发执行的合约。智能合约可以通过代码的形式定义。
以以太坊为例，支持用户在以太坊网络中创建并调用一些复杂的逻辑，这是以太坊区别于比特币区块链技术的最大挑战。以太坊作为一个可编程区块链的核心是以太坊虚拟机(EVM)，每个以太坊节点都可以运行EVM。EVM是一个图灵完备的虚拟机，这意味着可以通过它实现各种复杂的逻辑。用户在以太坊中发布和调用智能合约就是在EVM上运行的。实际上，虚拟机直接运行的是虚拟机代码(虚拟机字节码，下简称“字节码”)。部署在区块链上的智能合约可以是字节码的形式。
例如图1所示，Bob将一个包含创建智能合约信息的交易(Transaction)发送到以太坊网络后，节点1的EVM可以执行这个交易并生成对应的合约实例。图1中的“0x68e12cf284…”代表了这个合约的地址，交易的data字段保存的可以是字节码，交易的to字段为一个空的账户。节点间通过共识机制达成一致后，这个合约成功创建，后续用户可以调用这个合约。
合约创建后，区块链上出现一个与该智能合约对应的合约账户，并拥有一个特定的地址，合约代码和账户存储将保存在该合约账户中。智能合约的行为由合约代码控制，而智能合约的账户存储(Storage)则保存了合约的状态。换句话说，智能合约使得区块链上产生包含合约代码和账户存储的虚拟账户。
前述提到，包含创建智能合约的交易的data字段保存的可以是该智能合约的字节码。字节码由一连串的字节组成，每一字节可以标识一个操作。基于开发效率、可读性等多方面考虑，开发者可以不直接书写字节码，而是选择一门高级语言编写智能合约代码。例如，采用诸如SolIDity、Serpent、LLL语言等高级语言。对于采用高级语言编写的智能合约代码，可以经过编译器编译，生成可以部署到区块链上的字节码。
以SolIDity语言为例，用其编写的合约与面向对象编程语言中的类(Class)很相似，在一个合约中可以声明多种成员，包括状态变量、函数、函数修改器、事件等。状态变量是永久存储在智能合约的账户存储中的值，用于保存合约的状态。
本申请旨在提出一种基于区块链的数据存证方法。一方面，该方法通过智能合约，将不同认证机构对用户进行用户认证产生的认证数据关联存证至区块链，因此可利用区块链透明化程度高、不可篡改性以及区块链秘钥签名功能，保证用户数据的可信性与安全性，排除数据滥用；另一方面，通过为用户数据标记数据价值，可将用户在不同认证机构产生的认证数据作为该用户的数据资产安全存证在区块链中，便于进行数据查询。
在一些例子中，上述数据存证方法可以应用于数据资产管理系统(以下简称管理系统)。该系统可以与数据持有方对应的客户端(以下简称数据持有方)、数据查询方对应的客户端(以下简称数据查询方)进行数据交互，对数据持有方针对某用户上传的用户数据进行价值锚定，将用户数据与该用户的其他用户数据关联存证，以及对数据查询方的数据查询行为进行有序管理。
上述管理系统可为服务端系统、客户端系统或云服务系统，在本申请中不进行限定。
上述管理系统可以包括基于公有链、私有链或联盟链的构建系统。上述区块链可以包括若干节点设备，用于对待存证的数据进行共识处理，实现对数据的去中心化管理。
上述区块链可以部署了用于管理数据资产的智能合约。
上述智能合约可以是项目运营方(数据管理项目运营方)根据业务需求进行开发，并部署在上述区块链中。
上述智能合约可以包括若干处理逻辑，用于进行数据管理。
在一些例子中，该智能合约可以包括数据资产生成逻辑，用于响应于上述数据存证交易，为上述用户数据标记数据价值，并将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据关联存证，以形成与上述用户对应的数据资产。
该智能合约(以下简称合约)还可以通过事件机制与数据持有方和/或数据查询方进行信息传递，获取数据持有方或数据消息方针对事件的响应信息。例如，该合约可以针待存证的用户数据构建数据确认事件，以由数据持有方响应于该数据确认事件对上述用户数据的数据信息进行确认。上述数据持有方可以通过诸如预言机机制将上述确认信息发送至该合约，该合约可以获取该确认信息并与上述用户数据关联存储。
请参见图2，图2为本申请提出的一种基于区块链的数据存证方法的方法流程图。
如图2所示，上述方法可以包括：S202，获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据。
上述用户，可以是指人，企事业单位或组织。上述认证机构是指可以对上述用户进行认证的任意机构。在一些例子中，上述认证机构包括培训机构；上述用户数据包括上述培训机构对上述用户进行培训认证产生的培训数据。在一些例子中上述培训机构包括职业培训机构；上述用户数据包括上述培训机构对上述用户进行职业教育培训认证后颁发的职业教育技能证书。
例如，在职业认证数据管理场景中，上述用户可以是参与培训的个人用户，上述认证机构可以是对职业技能进行认证的机构；或者，上述用户可以是企业用户，上述认证机构可以是对企业进行资质认证的资质认证机构。再例如，在身份认证场景中，上述用户可以是个人用户，上述认证机构可以是身份认证机构；或者上述用户可以是企业用户，上述认证机构可以是对企业进行身份认证的事业机构。
上述数据持有方，可以是指持有用户数据的任意一方。例如，上述数据持有方可以是用户本人，或者认证机构。比如，在职业认证数据管理场景中，上述数据持有方可以是参加职业培训的用户本人，或者是对用户职业技能进行认证的职业认证机构。再比如，在身份认证场景中，上述数据持有方可以是用户本人，或者是身份认证机构。上述数据持有方在上述区块链中完成注册后，上述区块链可以为上述数据持有方分配专属公私钥对。上述数据持有方可以利用私钥对用户数据进行签名，并将公钥广播至其他各方进行验签。
上述用户数据可以包括认证机构对上述用户进行用户认证后产生的认证数据。上述认证数据可以是与上述用户密切相关的任意数据。例如，在职业认证数据管理场景中， 上述认证数据可以包括诸如用户身份信息、年龄、职业技能、受教育程度等数据信息。再例如，在身份认证场景中，上述认证数据可以包括用户身份信息、年龄、出生日期、出生地等信息。
在一些例子中，数据持有方在上传用户数据时可以对上述用户数据的数据属性进行设定，并将设定好的数据属性信息与待存证的用户数据关联发送至上述管理系统，以使上述管理系统可以根据上述数据属性信息表征的数据存储方式，对用户数据进行存储。
在一些例子中，上述数据属性包括以下至少一项：数据托管属性；数据公开属性；数据隐私属性。
上述数据托管属性可以表征用户数据是否托管至数据托管方。上述数据托管方，具体可以是提供数据托管服务的任意单位。在一些例子中数据托管方可以是上述管理系统。
以下以数据托管方为上述管理系统为例进行说明。如果上述用户数据托管至上述管理系统，则上述管理系统可以在用户授予的权限范围内自行处理该用户数据。例如，用户授予管理系统对数据进行数据查询的权限。此时，若有数据查询方愿意付费查询上述用户数据时，管理系统可以无需征得用户同意即可将该数据提供给数据查询方使用。在一些例子中，上述管理系统可以将向数据查询方收取的费用转移至上述用户。在一些例子中，上述数据属性信息中还可以包括表征将上述用户数据托管至管理系统的时限信息，使得在该时限内将数据托管至管理系统，进而保证用户权利。
如果上述用户数据未托管至上述管理系统，则上述管理系统可以仅负责用户数据存证，无权对用户数据进行其它处理。
通过为待存证数据分配数据托管属性，可以便于用户确定是否由数据托管方进行数据管理，提升用户体验。
上述数据公开属性，可以表征该用户数据是否为公开数据。如果数据公开属性表征该用户数据不能向第三方公开，则该用户数据只能向上述用户公开，其它用户无权对该用户数据进行查询。
如果数据公开属性表征该用户数据可以向第三方公开，则该用户数据除了可以向上述用户公开外，也可以向第三方数据查询方公开。
通过为待存证数据分配数据公开属性，可以定义数据的公开属性，保证用户数据的安全性与隐私性，进而保证用户的权利。
上述数据隐私属性可以表征该用户数据隐私等级。在一些例子中，可以为数据分配不同的隐私等级，保证数据有不同级别的安全性。在一些例子中，可以将隐私等级至少分配为第一级和第二级。其中第一级的数据隐私级别较低，在数据查询方查询该数据时可以将该数据直接发送给数据查询方。其中第二级的数据隐私级别较高，在数据查询方查询该数据时，不能直接将数据发送给查询方。可以获取数据查询方提供的待校验数据，然后根据该用户数据对该待校验数据进行校验，并将校验结果发给上述数据查询方。
例如，在职业认证数据管理场景中，假设与用户A对应的认证数据的隐私级别为第一级。此时，如果有企业B想要获取用户A的认证数据时，上述管理系统可以将用户A对应的认证数据以明文形式发送给企业B。
例如，在职业认证数据管理场景中，假设与用户A对应的认证数据的隐私级别为第二级。假设企业B想要确认用户A是否具有某项职业技能。此时，如果有企业B想要获取用户A的认证数据时，上述管理系统不能将用户A对应的认证数据发送给企业B，而是可以获取企业B需要校验的数据，即用户A是否具有某项职业技能。然后上述管理系统可以根据用户A对应的认证数据得到校验结果，并将该校验结果返回至企业B。由此可以保证用户A的数据的隐私性。
通过为待存证数据分配数据隐私属性，可以定义数据的隐私级别，保证用户数据的安全性与隐私性，进而保证用户的权利。
当获取到上述数据存证交易后，可以执行S204。
S204，响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，为上述用户数据标记数据价值，并将标记了数据价值的上述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与上述用户 对应的数据资产。
在一些例子中，上述数据存证交易中可以包括上述智能合约对应的合约地址。上述区块链中的各节点对上述数据存证交易共识之后，可以根据上述合约地址获取上述合约，并通过本地搭载的虚拟机EVM执行上述合约包括的存证逻辑。
上述数据价值，具体可以是表征待存证数据具有的价值。
当数据查询方查询用户数据时，需要为该数据付出与该数据的数据价值等价的虚拟资源。
在一些例子中，上述数据存证交易中包括针对用户数据的数据价值信息，上述管理系统可以根据上述数据价值信息，为上述用户数据标记数据价值。
在一些例子中，上述合约可以生成数据价值标记事件，以使上述数据持有方对应的用户客户端在获取到上述数据价值标记事时，响应于上述数据价值标记事件，提示上述数据持有方为上述用户数据标记数据价值。
在一些例子中，上述合约可以生成数据价值标记事件，并发布至上述区块链中。当上述区块链中的各节点完成共识后，上述管理系统可以通过拉块等方式获取上述数据价值标记事件，并将该事件发送至上述用户客户端。在一些例子中，可以向上述数据持有方进行弹窗提醒。上述数据持有方可以响应于该事件为上述待存证的用户数据填写数据价值信息，并将上述数据价值信息发送至上述合约。
在一些例子中，上述数据持有方可以通过用户客户端打包一笔合约调用交易将上述数据价值信息发送至上述合约，以为上述待存证数据标记数据价值。在一些例子中，上述数据持有方可以将上述数据价值信息发送至上述管理系统，以由该管理系统将该数据价值信息发送至上述合约进行数据价值标记。
在一些例子中，用户数据的数据价值可以改变。上述管理系统可以获取上述用户数据被查询的次数。可以理解的是，该数据被查询的次数可以是指该数据在上述管理系统内被查询的次数，或者是该数据在其他可信系统中被查询的次数。上述管理系统在获取到上述用户数据被查询的次数后，可以根据该次数为上述用户数据标记响应的数据价值。由此可以将数据价值与用户数据被查询的次数绑定，从而为上述用户数据标记更客观真实的数据价值，进而保护用户权利。
在一些例子中，上述合约可以通过事件机制获取该待存证的用户数据的数据属性。该合约可以生成数据属性标记事件，以使上述数据持有方的对应的用户客户端在获取到上述数据属性标记事件时，响应于上述数据属性标记事件，向上述数据持有方输出与上述用户数据对应的数据属性标记提示。然后上述合约可以获取上述用户客户端发送的由上述数据持有方基于上述数据标记提示为上述用户数据标记的数据属性，并将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据关联存证。
在一些例子中，上述数据属性包括以下至少一项：数据托管属性；数据公开属性；数据隐私属性。关于数据属性的相关介绍可以参照前述实施例，在此不作详述。
通过事件机制获取用户数据的数据属性可以为上述用户数据分配多种类型的数据属性，从而可以根据不同的用户需求对用户数据进行灵活管理，提升用户体验。
在一些例子中，上述合约对应的合约账户中可能存储了其它认证机构对该用户进行认证后标记了数据价值的用户数据。上述合约可以将待存证的用户数据与上述已经存储的数据进行关联存储。在一些例子中，数据关联的方式可以包括任一维度的数据关联。
例如，可以通过上述用户数据的用户ID、年龄、性别、身份证号等不同维度将将不同机构下的认证数据进行关联。此时，当数据查询方通过用户ID、年龄、性别、身份证号等访问该用户的认证数据时，可以访问到将该用户在不同机构下的相关认证数据。
在一些例子中，上述合约在存证用户数据时，可以通过TEE(Trusted Execution Environment，可信执行环境)进一步提升用户数据的安全性与隐私性。
上述TEE中可以通过可信程序管理用户对应的秘钥。该秘钥对于任何人员来讲都是不可知的，从而增加了数据的安全性。
在一些例子中，基于区块链节点设备搭载的第一TEE中维护的与上述用户对应的加 密密钥对上述关联数据进行加密，以使数据查询方在访问上述加密后的用户数据时，通过自身搭载的第二TEE中维护的与上述用户对应的解密密钥，对上述加密后的用户数据进行解密。由此通过TEE硬件加密的方式可以提升用户数据的安全性。
上述第一TEE可以是搭载在区块链节点设备中的可信环境。该可信环境中可以维护与上述用户对应的加密秘钥。其中，上述加密秘钥对任何人不可知。当上述设备获取到该用户数据后，可以在第一TEE中进行加密。在一些例子中，当上述用户数据需要和其他数据关联存储时。可以先将该用户数据与其它认证机构对该用户进行认证后的用户数据进行关联，得到关联数据，然后再在上述第一TEE中进行数据加密。
上述第二TEE可以是搭载在数据查询方终端中的可信环境。该可信环境中可以维护与上述用户对应的解密秘钥。其中，上述解密秘钥对任何人不可知。当上述数据查询方获取到用户数据后，可以在第二TEE中通过解密秘钥完成数据解密。
在一些例子中，当用户不需要通过管理系统管理数据时，可以发起注销交易。上述管理系统可以响应于针对上述用户的注销交易，调用上述智能合约的注销逻辑，删除上述用户对应的账户信息，并清除上述第一TEE中的加密秘钥和上述第二TEE中的解密秘钥以禁止上述数据查询方访问上述用户数据。由此可以确保上述数据查询方已经获取的用户数据无法被正常打开，提升用户数据的安全性，进而保证用户利益。
在上述方案中，在有用户数据存证需求时，通过调用上述智能合约包括的存证逻辑，为上述用户数据标记数据价值，并将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据关联存证，以形成与上述用户对应的数据资产，从而一方面将不同认证机构对用户进行用户认证产生的认证数据关联存证至区块链，因此可以利用区块链透明化程度高、不可篡改性以及区块链秘钥签名功能，保证用户数据的可信性与安全性，排除数据滥用；
另一方面，通过为用户数据标记数据价值，可以将用户在不同认证机构产生的认证数据作为该用户的数据资产安全存证在区块链中，便于进行数据查询。
在一些例子中，上述智能合约还包括查询逻辑，用于响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。通过该智能合约可以有效管理数据查询行为，提升用户体验。
请参见图3，图3为本申请示出的一种数据查询流程示意图。
如图3所示，S302，获取数据查询方发起的与目标用户数据对应的数据查询交易。
上述数据查询方，可以是指有数据查询需求的任意方。例如，上述数据查询方可以是用户本人。当用户有数据查询需求时，可以作为数据查询方发起主动查询(数据查询)请求，从而查询存证的用户数据。再例如，上述数据查询方可以是电话销售方，该电话销售方需要从用户数据中获取用户的联系方式。再例如，上述数据查询方可以是银行出资方，该银行出资方需要从用户数据中获取用户的征信信息。
上述目标用户数据可以是指已经存证在区块链中的与上述目标用户相关的用户数据。数据查询方在发起数据查询交易时，可以携带上述目标用户对应的用户ID等信息。上述智能合约可以根据用户ID查询存证的与该目标用户相关的用户数据，并将该用户数据发送至数据查询方。
在获取到数据查询交易后，可以执行S304，响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
上述查询结果可以是明文形式的用户数据或根据用户数据对待校验数据进行校验后得到的比较结果。
上述虚拟资源可以是指虚拟资产、token令牌等。在一些例子中，上述虚拟资源可 以是与线下实物锚定的虚拟资产。通过上述区块链中搭载的价值锚定合约，可以将需求方拥有的线下实物(例如，汽车，房产，账户余额等)锚定为链上虚拟资产，并存在上述需求方对应的账户中。
在一些例子中，上述智能合约中预先部署了数据价值与虚拟资产的锚定关系。上述合约可以先确定上述目标用户数据标记的数据价值。然后通过上述锚定关系，确定数据查询需要支付的虚拟资源数量。之后上述合约可以从上述数据查询方对应的账户中划出上述数量的虚拟资源，并划入至上述数据持有方对应的账户中。在上述例子中可以通过智能合约协助数据查询方在支付费用后获取用户数据，一方面，可以保证数据持有方的利益；另一方面，可以通过智能合约透明程度高，不可篡改等特性实现数据查询过程的全记录，保证数据查询的安全可信性。
可以理解的是，在一些例子中，如果是用户本人需要查询数据时，可以无需进行虚拟资源转移的过程。
在一些例子中，为进一步保证用户数据的安全性，可对数据查询方的身份进行验证。
请参见图4，图4为本申请示出的一种身份验证流程示意图。
如图4所示，当获取到数据查询请求时，可以执行S401，确定上述数据查询方是否为上述目标用户数据对应的数据持有方。
如果上述数据查询方是上述目标用户数据对应的数据持有方，可以执行S402，将上述目标用户数据发送至上述数据查询方。
如果上述数据查询方不是上述目标用户数据对应的数据持有方，可以进一步调用上述智能合约包括的验证逻辑，对上述数据查询方进行身份验证，并在身份验证通过时，将上述查询结果发送至上述数据查询方。
其中，上述身份验证的内容可以根据业务需求进行设定。
在一些例子中，上述身份验证可以包括查询权限验证。在一些例子中，当任一数据查询方完成数据查询费用支付后，上述智能合约可以响应于完成费用支付，为该数据查询方分配查询权限。在一些例子中，上述数据查询方可以预先在管理系统中进行注册，并在注册协议中约定数据查询是否具有查询权限。
如图4所示，如果上述数据查询方不是上述目标用户数据对应的数据持有方，可以进一步执行S403，判断上述数据查询方是否具有查询权限。
如果否，则可以拒绝上述数据查询方的数据查询请求。
如果有，则可以将上述用户数据发送至上述数据查询方。在一些例子中，在将上述用户数据发送至上述数据查询方之前需要征得该用户数据持有方的同意。此时，上述管理系统可以执行S404，通过诸如站内信等方式询问上述数据持有方是否同意该次数据查询。如果数据持有方同意则可以使用该数据持有方对应的私钥对该用户数据进行签名，并将签名后的数据发送出去；反之，则可以终止该次数据查询。
由此，可以在将用户数据发送至数据查询方之前可以对数据查询方进行身份验证，进而保证用户数据的安全性，保证用户权利。
在一些例子中，可以根据用户数据对应的数据公开属性引导数据查询。
在一些例子中，在将上述目标用户数据发送至上述数据查询方时，可以基于上述目标用户数据对应的数据公开属性确定上述目标用户数据是否为公开数据。在一些例子中可以通过标识位表征数据公开属性。
如果上述目标用户数据对应的数据公开属性表征该目标用户数据为非公开数据，可以终止向上述数据查询方提供查询结果；如果上述目标用户数据对应的数据公开属性表征该目标用户数据为公开数据，将针对上述目标用户数据的查询结果发送至上述数据查询方。
由此，可以根据用户数据对应的数据公开数据引导数据查询，进而实现对数据的灵活管理，即方便数据查询方进行数据查询，同时也保护了数据安全性与隐私性。
在一些例子中，可以根据用户数据对应的数据公开属性引导数据查询。
在一些例子中，在将上述目标用户数据发送至上述数据查询方时，可以基于上述目标用户数据对应的数据托管属性确定上述目标用户数据是否为托管数据。在一些例子中， 可以通过标识位表征数据托管属性。
如果上述目标用户数据对应的数据隐私属性表征该目标用户数据托管至数据托管方，可以通过上述数据托管方对应的私钥对上述目标用户数据进行签名，并将签名后的上述目标用户数据的查询结果发送至上述数据查询方。
如果上述目标用户数据不是托管至数据托管方的托管数据，生成数据签名事件，以使用户客户端在获取到上述数据签名事件时，响应于上述数据签名事件，提示上述目标用户数据对应的数据持有方利用自身持有的私钥对上述目标用户数据的查询结果进行签名；获取上述用户客户端发送的签名后的上述目标用户数据的查询结果，并将签名后的上述目标用户数据的查询结果发送至上述数据查询方。
上述数据托管方可以是任意方。上述数据托管方在上述区块链中完成注册后，上述区块链可以为该数据托管方分配专属公私钥对。上述数据托管方可以利用私钥进行身份签名。
在上述例子中，在向数据查询方发送目标用户数据时，可以根据数据是否被托管使用不同的私钥对数据进行签名，从而一方面，可以在数据查询过程中保留查询许可的记录(签名信息)，方便后续对该次数据查询的查验；另一方面，可以实现灵活的数据管理机制，提高用户体验。
在一些例子中，可以根据用户数据对应的数据隐私属性引导数据查询。
在一些例子中，在将上述目标用户数据发送至上述数据查询方时，可以基于上述目标用户数据对应的数据隐私属性确定上述目标用户数据对应的隐私等级。在一些例子中，可以通过标识位表征数据隐私属性。
如果上述目标用户数据对应的数据等级为第一级隐私等级时，将上述目标用户数据的明文数据发送至上述数据查询方；
如果上述目标用户数据对应的数据等级为第二级的隐私等级时，获取上述数据查询交易中携带的待校验数据，将上述待校验数据与上述目标数据进行比较，并将比较结果作为查询结果发送至上述数据查询方。
上述第一级、上述第二级分别对应的业务逻辑，可以根据业务需求进行设定。在一些例子中，上述第一级隐私等级表示上述目标用户数据支持明文数据查询；上述第二级隐私等级表示上述目标用户数据支持数据比较查询。
在上述例子中，可以根据用户数据对应的数据隐私属性指引数据查询，从而一方面，保证数据隐私性与安全性；另一方面实现对用户数据的灵活管理，提高用户体验。
在一些例子中，在将针对上述目标用户数据的查询结果发送至上述数据查询方之后，更新上述智能合约维护的上述目标用户数据的查询次数。
在一些例子中，上述管理系统中可以针对各用户数据维护专属计数器。每当用户数据被查询一次，则可以更新上述计数器中的数值。在一些例子中，上述次数可以表征该用户数据的重要程度，上述管理系统可以根据各用户数据对应的被查询次数，周期性的更新各用户数据对应的数据价值，从而使用户数据的数据价值更客观真实。
在一些例子中，上述管理系统还可以维护各用户数据被查询时对应的数据价值，通过统计各用户数据被查询时对应的数据价值，可以维护各用户数据带来的收益。由此可以维护与各用户数据对应的账单。
在一些例子中，上述管理系统还可以维护与用户数据对应的用户对应的收益账单。每当某一用户数据被查询时，还可以更新该用户数据对应的用户所对应的收益账单。
在一些例子中，在从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应数量的虚拟资源之后，记录转移的上述虚拟资源的数量，并基于记录的上述数量更新上述智能合约维护的与上述目标用户数据对应的收益账单。
在一些例子中，如果任一目标用户需要查询收益时，可以发起收益查询请求。上述管理系统可以响应于上述收益查询请求，将上述智能合约维护的与上述目标用户对应的收益发送至上述目标用户。
在一些例子中，上述收益账单可以维护在合约账户中，进而确保收益账单的可信性。 此时，上述管理系统可以针对上述目标用户发起收益查询交易，调用上述智能合约包括的查询逻辑，根据该目标用户对应的ID查询到收益账单并发布至区块链。上述管理系统可以通过诸如拉块等方式获取包括该收益账单的区块，并解析出该收益账单。然后上述管理系统可以将该收益账单发送至上述目标用户。
在一些例子中还提出一种基于区块链的数据存证方法。其中，上述区块链部署了用于管理数据资产的智能合约，上述方法可以包括：获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，将上述用户数据与其它认证机构对该用户进行认证后产生的用户数据进行关联存证，生成与上述用户对应的用户数据集，并为生成的用户数据集标记数据价值，以形成与上述用户对应的数据资产。
上述用户数据集可以表中与用户对应的数据资产集合。例如，在职业教育培训场景中，用户在机构A、机构B、机构C进行认证后得到的用户数据可以在区块链中关联存证，形成与上述用户对应的用户数据集，即用户数据资产。由此可以一方面，该方法通过智能合约，将不同认证机构对用户进行用户认证产生的认证数据关联存证至区块链，因此可以利用区块链透明化程度高、不可篡改性以及区块链秘钥签名功能，保证用户数据的可信性与安全性，排除数据滥用；另一方面，通过为用户数据标记数据价值，可以将用户在不同认证机构产生的认证数据作为该用户的数据资产安全存证在区块链中，便于进行数据查询。
在一些例子中，在为生成的用户数据集标记数据价值时，可以生成价值标记事件，以由上述数据持有方响应于该价值标记事件为用户数据集进行价值标记。
在一些例子中，上述用户数据集中的用户的数据可以被标记数据属性，具体过程可以参照前述实施例，在此不作详述。
在一些例子中，在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与上述用户对应的加密密钥对上述用户数据进行加密，以使数据查询方在访问上述加密后的用户数据时，通过自身搭载的第二TEE中维护的与上述用户对应的解密密钥，对上述加密后的用户数据进行解密。
在一些例子中，可以响应于针对上述用户的注销交易，调用上述智能合约的注销逻辑，删除上述用户对应的用户账户，并清除上述第一TEE中维护的与上述用户对应加密秘钥和上述第二TEE中维护的与上述加密密钥对应的解密秘钥，以禁止上述数据查询方访问上述用户数据。
在一些例子中，可以获取数据查询方发起的与目标用户数据对应的数据查询交易；
响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
上述用户数据可能具有不同的数据属性。当访问不同数据属性的用户数据时，可以做出不同的响应。具体可以参照前述实施例，在此不作详述。
以下结合具体的职业认证数据管理场景进行实施例描述。
请参见图5，图5为本申请示出的一种职业认证数据管理场景图。
图5示出的业务系统为基于联盟链构建的数据管理系统(以下简称管理系统)。上述数据管理系统可以包括区块链网络(以下简称区块链)。上述区块链中可以部署了用户数据管理的智能合约(以下简称合约)。
该合约可以包括数据存证逻辑与数据查询逻辑，负责对数据进行有效管理。
图5示出的用户可以是需要进行职业培训的用户。该用户可以在不同的机构参与职业培训。
图5示出的数据认证机构可以是提供职业认证服务的职业认证机构。上述认证机构可以在用户通过职业培训考核后，为上述用户生成认证数据。可以理解的是上述用户或 职业认证机构均可以作为数据持有方向上述管理系统申请存证认证数据。在本例中，可以由用户发起认证数据存证申请。该用户数据对应的数据属性可以包括不进行托管，隐私级别为第一级，可以公开数据。
图5示出的数据直接查询者可以是指数据持有方本人。
图5示出的数据间接查询者可为对认证数据有需求的任意方。在本例中，上述数据间接查询者，可为用人企业。该用人单位需要招聘具有某项职业技能(例如，电焊)的人才，该用人单位需要根据管理系统中存证的认证数据确定某一用户是否具有电焊资格。
请参见图6，图6为本申请示出的一种数据管理系统架构示意图。
如图6所示，上述数据管理系统可以包括客户端侧计算设备101，服务器端102以及区块链系统103。
上述客户端侧计算设备101，可以包括各种不同类型的客户端侧计算设备；例如，客户端侧终端设备可以包括诸如PC终端设备、移动终端设备、物联网设备，以及其它形式的具有一定的计算能力的智能设备，等等。
在一些例子中，上述客户端侧终端设备101中的至少部分计算设备，可以通过各种通信网络耦接到服务器端102；例如，图6中示出的设备1和设备2与服务器端102进行了耦接。
不难理解，客户端侧终端设备101中的部分终端设备，也可以不与服务器端102进行耦接，而是作为区块链节点通过各种通信网络直接耦接到区块链系统；例如，图6中示出的设备4，可以作为区块链节点耦接到区块链系统。
其中，上述通信网络可以包括有线和/或无线通信网络；例如，可以是基于运营商提供的有线接入网络或者无线接入网络(比如移动蜂窝网络)实现的局域网(Local Area Network，LAN)、广域网(Wide Area Network，WAN)、因特网或其组合。
在一些例子中，上述客户端侧计算设备101，还可以包括一个或多个用户侧服务器；例如，图6中示出的设备5。客户端侧终端设备101中的至少部分计算设备，可以耦接到该用户侧服务器，而该用户侧服务器可以进一步与上述服务端102进行耦接；例如，图6中示出的设备1和设备2耦接到设备5，设备5进一步耦接服务器端102。
在一些例子中，上述用户侧服务器可以由搭建了用户账户体系的服务实体来实现；上述服务实体可以包括面向用户提供各种线上和/或线下服务的服务载体的运营实体；
其中，上述服务载体可以包括软件形式的服务载体，也可以包括硬件形式的服务载体。
在一些例子中，上述服务载体可以包括提供线上互联网服务的各种客户端软件；例如，网站、网页、APP等。
在一些例子中，上述服务载体也可以包括部署在线下的，能够提供线下服务的各种智能设备；例如，部署在居住区、办公区、公共场所的智能快递柜。
相应的，上述运营实体可以包括上述服务载体对应的运营方；例如，上述运营实体可以包括对上述服务载体进行运营和管理的个人、组织、公司和企业，等等。
在一些例子中，服务器端102也可以通过各种通信网络耦接到一个或者多个区块链系统；例如，图6中示出的服务器端102可以分别耦接到区块链系统103、区块链系统104和区块链系统105，等等。
上述区块链系统103可以是联盟区块链。该区块链系统103中可以包括若干节点参与共识机制。当其中任一节点设备需要分布区块时，可以在各节点完成共识后完成区块的发布。
上述服务器端102，可以是包括用于提供区块链即服务(BaaS，Blockchain as a Service)的BaaS平台(也称之为BaaS云)。BaaS平台可以通过为区块链上发生的活动(诸如订阅和通知、用户验证、数据库管理和远程更新)，提供预先编写的软件的方式，面向与BaaS平台耦接的客户端侧计算设备，提供简单易用，一键部署，快速验证，灵活可定制的区块链服务，进而可以加速区块链业务应用开发、测试、上线，助力各行业区块链商业应用场景的落地。
例如，在一个例子中，与BaaS平台可以提供诸如MQ(Message Queue，消息队列) 服务之类的软件；与BaaS平台耦接的客户端侧计算设备，可以订阅BaaS平台耦接的区块链系统中某一区块链上部署的智能合约，在触发执行后在区块链上产生的合约事件；而BaaS平台可以监听该智能合约在触发执行后在区块链上产生的事件，再基于MQ服务相关的软件，将该合约事件以通知消息的形式添加到消息队列中，使得订阅该消息队列的客户端侧计算设备，能够得到与上述合约事件相关的通知。
可以理解的是，上述客户端段测计算设备101可以是图5示出的用户、认证机构、数据查询方任一方对应的客户端。以下将与用户对应的客户端称为用户客户端；数据间接查询方对应的客户端称为间接客户端。上述区块链中的节点设备搭载了第一TEE，其中包括针对认证数据的加密秘钥。上述数据间接查询方使用的终端设备中包括第二TEE，其中包括针对认证数据的解密秘钥。
请参见图7，图7为本申请示出的一种数据存证流程示意图。
如图7所示，上述用户在通过职业培训获取认证数据后，可以执行S701，构建合约调用交易。其中，上述合约调用交易中包括该认证数据，该认证数据对应的属性信息，以及该认证数据的数据价值信息。在本例中，该认证数据对应的数据属性可以包括不进行托管，隐私级别为第一级，可以公开数据。
然后可以执行S702，将基于该数据构建合约调用交易，并发布至区块链中。
上述区块链中的节点设备可以执行S703，调用智能合约存证逻辑，将该认证数据与该用户的相关认证数据关联，并在第一TEE中完成关联数据的加密后进行存证。
由此一方面，可以根据用户的存证需求，将认证数据灵活存证，提升用户体验。另一方面，通过智能合约，将不同认证机构对用户进行用户认证产生的认证数据关联存证至区块链形成数据资产。
请参见图8，图8为本申请示出的一种数据查询流程示意图。
如图8所示，当用人企业(以下简称企业)需要获取认证数据时，可以执行S801，基于用户对应的用户ID构建数据查询交易。
然后可以执行S802，将该数据查询交易发布至区块链。
上述区块链中的节点设备可以执行S803，调用智能合约的查询逻辑，根据用户ID判断上述企业是否为认证数据对应的数据持有方。在本例中上述企业并非该数据的数据持有方，因此可以通知上述间接查询方完成该次数据查询支付，并响应于完成支付为该间接查询方分配数据查询权限。
上述合约可以进一步判断上述认证数据是否为公开数据。在本例中，上述认证数据为公开数据，因此可以进一步判断上述间接查询方是否具有查询权限。在本例中，上述企业已已经完成支付，因此可以进一步判断上述认证数据对应的隐私级别。
在本例中，上述认证数据为第一级，因此可以将认证数据直接发送给间接查询方。在发送之前，合约可以进一步判断上述认证数据是否为托管数据。
在本例中该数据为非托管数据，上述合约可以执行S804，通过事件机制向上述用户发起是否允许发送数据的确认请求，并响应于用户的允许操作(为数据签名后)，将该认证数据发送至上述企业。
上述企业可以执行S805，在第二TEE中完成认证数据的解密，并分析该用户是否具备电焊资质，由此完成针对认证数据的查询。由此，如果用户在管理系统中完成账户注销，上述管理系统可以发布账户注销交易，调用合约完成与该用户相关秘钥的失效请求，以使即便企业中仍保留有该用户的认证数据也无法正常访问，进而提升数据隐私性与安全性。
上述合约还可以在完成认证数据发送后执行S806，更新该认证数据对应的被查询次数，以及与该用户对应的收益账单。由此一方面，当该用户需要查询收益时，可以通过合约获取明确可信的收益账单，保证用户权益；另一方面，可以根据被查询次数为认证数据标记更客观真实的数据价值。
与上述任一实施例相对应的，本申请还提出一种基于区块链的数据存证装置。其中，上述区块链部署了用于管理数据资产的智能合约。
请参见图9，图9为本申请示出的一种基于区块链的数据存证装置的结构示意图。
如图9所示，上述装置900可以包括：第一获取模块910，获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；第一数据资产生成模块920，响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，为上述用户数据标记数据价值，并将标记了数据价值的上述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与上述用户对应的数据资产。
在示出的一些实施例中，上述装置900还包括：数据属性标记模块，生成数据属性标记事件，以使上述数据持有方的对应的用户客户端在获取到上述数据属性标记事件时，响应于上述数据属性标记事件，向上述数据持有方输出与上述用户数据对应的数据属性标记提示；获取上述用户客户端发送的由上述数据持有方基于上述数据标记提示为上述用户数据标记的数据属性。
在示出的一些实施例中，上述数据属性标记模块具体用于以下示出的任一：生成数据价值标记事件，以使上述用户客户端在获取到上述数据价值标记事时，响应于上述数据价值标记事件，提示上述数据持有方为上述用户数据标记数据价值；根据上述数据存证交易包括的数据价值信息，为上述用户数据标记数据价值；根据上述用户数据的被查询的次数，为上述用户数据标记数据价值。
在一些实施例中，上述装置900还包括：加密模块，在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与上述用户对应的加密密钥对上述用户数据进行加密，以使数据查询方在访问上述加密后的用户数据时，通过自身搭载的第二TEE中维护的与上述用户对应的解密密钥，对上述加密后的用户数据进行解密。
在示出的一些实施例中，上述装置900还包括：注销模块，响应于针对上述用户的注销交易，调用上述智能合约的注销逻辑，删除上述用户对应的用户账户，并清除上述第一TEE中维护的与上述用户对应加密秘钥和上述第二TEE中维护的与上述加密密钥对应的解密秘钥，以禁止上述数据查询方访问上述用户数据。
在示出的一些实施例中，上述装置900还包括：第二获取模块930，获取数据查询方发起的与目标用户数据对应的数据查询交易；查询模块940，响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
在示出的一些实施例中，上述数据属性指示上述目标用户数据是否为公开数据的数据公开属性；上述查询模块940具体用于：基于上述目标用户数据对应的数据公开属性确定上述目标用户数据是否为公开数据；如果上述目标用户数据为公开数据，将针对上述目标用户数据的查询结果发送至上述数据查询方。
在示出的一些实施例中，上述数据属性包括指示上述目标用户数据是否为托管至数据托管方的数据托管属性；上述查询模块940具体用于：基于上述目标用户数据对应的数据托管属性确定上述目标用户数据是否为托管数据；如果上述目标用户数据为托管至数据托管方的托管数据，通过上述数据托管方对应的私钥对上述目标用户数据的查询结果进行签名，并将签名后的上述目标用户数据的查询结果发送至上述数据查询方；如果上述目标用户数据不是托管至数据托管方的托管数据，生成数据签名事件，以使用户客户端在获取到上述数据签名事件时，响应于上述数据签名事件，提示上述目标用户数据对应的数据持有方利用自身持有的私钥对上述目标用户数据的查询结果进行签名；获取上述用户客户端发送的签名后的上述目标用户数据的查询结果，并将签名后的上述目标用户数据的查询结果发送至上述数据查询方。
在示出的一些实施例中，上述数据属性包括指示上述目标用户数据的隐私等级的数据隐私属性；上述查询模块940具体用于：基于上述目标用户数据对应的数据隐私属性确定上述目标用户数据对应的隐私等级；其中，上述隐私等级包括第一级隐私等级和第二级隐私等级；上述第一级隐私等级表示上述目标用户数据支持明文数据查询；上述第 二级隐私等级表示上述目标用户数据支持数据比较查询；如果上述目标用户数据对应的数据等级为第一级隐私等级时，将上述目标用户数据的明文数据发送至上述数据查询方；如果上述目标用户数据对应的数据等级为第二级的隐私等级时，获取上述数据查询交易中携带的待校验数据，将上述待校验数据与上述目标数据进行比较，并将比较结果作为查询结果发送至上述数据查询方。
在示出的一些实施例中，上述查询模块940具体用于：确定上述数据查询方是否为上述目标用户数据对应的数据持有方；如果是，将上述查询结果发送至上述数据查询方；如果否，进一步调用上述智能合约包括的验证逻辑，对上述数据查询方进行身份验证，并在身份验证通过时，将上述查询结果发送至上述数据查询方。
在示出的一些实施例中，上述装置900还包括：更新模块，在将针对上述目标用户数据的查询结果发送至上述数据查询方之后，更新上述智能合约维护的上述目标用户数据的查询次数；和/或，收益统计模块，在从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应数量的虚拟资源之后，记录转移的上述虚拟资源的数量，并基于记录的上述数量更新上述智能合约维护的与上述目标用户数据对应的收益账单。
在示出的一些实施例中，上述认证机构包括培训机构；上述用户数据包括上述培训机构对上述用户进行培训认证产生的培训数据。
在示出的一些实施例中，上述培训机构包括职业培训机构；上述用户数据包括上述培训机构对上述用户进行职业教育培训认证后颁发的职业教育技能证书。
与上述任一实施例相对应的，本申请还提出一种基于区块链的数据存证装置100。其中，上述区块链部署了用于管理数据资产的智能合约。上述装置100可以包括：第三获取模块，获取数据持有方发起的数据存证交易；其中，上述数据存证交易包括待存证的用户数据；上述用户数据包括认证机构对上述用户进行用户认证后产生的认证数据；
第二数据资产生成模块，响应于上述数据存证交易，调用上述智能合约包括的数据资产生成逻辑，将上述用户数据与其它认证机构对该用户进行认证后产生的用户数据进行关联存证，生成与上述用户对应的用户数据集，并为生成的用户数据集标记数据价值，以形成与上述用户对应的数据资产。
在示出的一些实施例中，上述装置100还包括：加密模块，在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与上述用户对应的加密密钥对上述用户数据进行加密，以使数据查询方在访问上述加密后的用户数据时，通过自身搭载的第二TEE中维护的与上述用户对应的解密密钥，对上述加密后的用户数据进行解密。
在示出的一些实施例中，上述装置100还包括：注销模块，响应于针对上述用户的注销交易，调用上述智能合约的注销逻辑，删除上述用户对应的用户账户，并清除上述第一TEE中维护的与上述用户对应加密秘钥和上述第二TEE中维护的与上述加密密钥对应的解密秘钥，以禁止上述数据查询方访问上述用户数据。
在示出的一些实施例中，上述装置100还包括：第四获取模块，获取数据查询方发起的与目标用户数据对应的数据查询交易；查询模块，响应于上述数据查询交易，调用上述智能合约包括的查询逻辑，查询上述区块链中存证的上述目标用户数据，并将针对上述目标用户数据的查询结果发送至上述数据查询方；以及，从上述数据查询方的用户账户持有的虚拟资源中，向上述数据持有方的用户账户转移与为上述目标用户数据标记的数据价值对应的数量的虚拟资源。
本申请示出的基于区块链的数据存证装置的实施例可以应用于电子设备上。相应地，本申请公开了一种电子设备，上述电子设备部署于区块链。该设备可以包括：处理器。
用于存储处理器可执行指令的存储器。
其中，上述处理器被配置为调用上述存储器中存储的可执行指令，实现如上述任一实施例示出的数据存证方法。
请参见图10，图10为本申请示出的一种电子设备的硬件结构示意图。
如图10所示，该电子设备可以包括用于执行指令的处理器，用于进行网络连接的网络接口，用于为处理器存储运行数据的内存，以及用于存储汇款装置对应指令的非易失性存储器。
其中，数据存证装置的实施例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，作为一个逻辑意义上的装置，是通过其所在电子设备的处理器将非易失性存储器中对应的计算机程序指令读取到内存中运行形成的。从硬件层面而言，除了图10所示的处理器、内存、网络接口、以及非易失性存储器之外，实施例中装置所在的电子设备通常根据该电子设备的实际功能，还可以包括其他硬件，对此不再赘述。
为了提升处理速度，数据存证装置对应指令也可直接存储于内存中，在此不作限定。
本申请提出一种计算机可读存储介质。上述存储介质存储有计算机程序，上述计算机程序用于执行上述任一实施例示出的数据存证方法。
本领域技术人员应明白，本申请一个或多个实施例可提供为方法、系统或计算机程序产品。因此，本申请一个或多个实施例可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请一个或多个实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(可以包括但不限于磁盘存储器、CD-ROM、光学存储器等)上述实施的计算机程序产品的形式。
本申请中的“和/或”表示至少具有两者中的其中一个，例如，“A和/或B”可以包括三种方案：A、B、以及“A和B”。
本申请中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于数据处理设备实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本申请特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的行为或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
本申请中描述的主题及功能操作的实施例可以在以下中实现：数字电子电路、有形体现的计算机软件或固件、可以包括本申请中公开的结构及其结构性等同物的计算机硬件、或者它们中的一个或多个的组合。本申请中描述的主题的实施例可以实现为一个或多个计算机程序，即编码在有形非暂时性程序载体上述以被数据处理装置执行或控制参数处理装置的操作的计算机程序指令中的一个或多个模块。可替代地或附加地，程序指令可以被编码在人工生成的传播信号上述，例如机器生成的电、光或电磁信号，该信号被生成以将信息编码并传输到合适的获取机装置以由数据处理装置执行。计算机存储介质可以是机器可读存储设备、机器可读存储基板、随机或串行存取存储器设备、或它们中的一个或多个的组合。
本申请中描述的处理及逻辑流程可以由执行一个或多个计算机程序的一个或多个可编程计算机执行，以通过根据输入数据进行操作并生成输出来执行相应的功能。上述处理及逻辑流程还可以由专用逻辑电路—例如FPGA(现场可编程门阵列)或ASIC(专用集成电路)来执行，并且装置也可以实现为专用逻辑电路。
适合用于执行计算机程序的计算机可以包括，例如通用和/或专用微处理器，或任何其他类型的中央处理单元。通常，中央处理单元将从只读存储器和/或随机存取存储器获取指令和数据。计算机的基本组件可以包括用于实施或执行指令的中央处理单元以及用于存储指令和数据的一个或多个存储器设备。通常，计算机还将可以包括用于存储数据的一个或多个大容量存储设备，例如磁盘、磁光盘或光盘等，或者计算机将可操作地与此大容量存储设备耦接以从其获取数据或向其传送数据，抑或两种情况兼而有之。然而，计算机不是必须具有这样的设备。此外，计算机可以嵌入在另一设备中，例如移动电话、个人数字助理(PDA)、移动音频或视频播放器、游戏操纵台、全球定位系统(GPS) 获取机、或例如通用串行总线(USB)闪存驱动器的便携式存储设备，仅举几例。
适合于存储计算机程序指令和数据的计算机可读介质可以包括所有形式的非易失性存储器、媒介和存储器设备，例如可以包括半导体存储器设备(例如EPROM、EEPROM和闪存设备)、磁盘(例如内部硬盘或可移动盘)、磁光盘以及CD ROM和DVD-ROM盘。处理器和存储器可由专用逻辑电路补充或并入专用逻辑电路中。
虽然本申请包含许多具体实施细节，但是这些不应被解释为限制任何公开的范围或所要求保护的范围，而是主要用于描述特定公开的具体实施例的特征。本申请内在多个实施例中描述的某些特征也可以在单个实施例中被组合实施。另一方面，在单个实施例中描述的各种特征也可以在多个实施例中分开实施或以任何合适的子组合来实施。此外，虽然特征可以如上述在某些组合中起作用并且甚至最初如此要求保护，但是来自所要求保护的组合中的一个或多个特征在一些情况下可以从该组合中去除，并且所要求保护的组合可以指向子组合或子组合的变型。
类似地，虽然在附图中以特定顺序描绘了操作，但是这不应被理解为要求这些操作以所示的特定顺序执行或顺次执行、或者要求所有例示的操作被执行，以实现期望的结果。在某些情况下，多任务和并行处理可能是有利的。此外，上述实施例中的各种系统模块和组件的分离不应被理解为在所有实施例中均需要这样的分离，并且应当理解，所描述的程序组件和系统通常可以一起集成在单个软件产品中，或者封装成多个软件产品。
由此，主题的特定实施例已被描述。其他实施例在所附权利要求书的范围以内。在某些情况下，权利要求书中记载的动作可以以不同的顺序执行并且仍实现期望的结果。此外，附图中描绘的处理并非必需所示的特定顺序或顺次顺序，以实现期望的结果。在某些实现中，多任务和并行处理可能是有利的。
以上仅为本申请一个或多个实施例的较佳实施例而已，并不用以限制本申请一个或多个实施例，凡在本申请一个或多个实施例的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请一个或多个实施例保护的范围之内。

Claims (22)

  1. 一种基于区块链的数据存证方法，其中，所述区块链部署了用于管理数据资产的智能合约，所述方法包括：
    获取数据持有方发起的数据存证交易；其中，所述数据存证交易包括待存证的用户数据；所述用户数据包括认证机构对所述用户进行用户认证后产生的认证数据；
    响应于所述数据存证交易，调用所述智能合约包括的数据资产生成逻辑，为所述用户数据标记数据价值，并将标记了数据价值的所述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与所述用户对应的数据资产。
  2. 根据权利要求1所述的方法，在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，所述方法还包括：
    生成数据属性标记事件，以使所述数据持有方的对应的用户客户端在获取到所述数据属性标记事件时，响应于所述数据属性标记事件，向所述数据持有方输出与所述用户数据对应的数据属性标记提示；
    获取所述用户客户端发送的由所述数据持有方基于所述数据标记提示为所述用户数据标记的数据属性。
  3. 根据权利要求2所述的方法，所述为所述用户数据标记数据价值，包括以下示出的任一：
    生成数据价值标记事件，以使所述用户客户端在获取到所述数据价值标记事时，响应于所述数据价值标记事件，提示所述数据持有方为所述用户数据标记数据价值；
    根据所述数据存证交易包括的数据价值信息，为所述用户数据标记数据价值；
    根据所述用户数据的被查询的次数，为所述用户数据标记数据价值。
  4. 根据权利要求2所述的方法，所述方法还包括：
    在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与所述用户对应的加密密钥对所述用户数据进行加密，以使数据查询方在访问所述加密后的用户数据时，通过自身搭载的第二TEE中维护的与所述用户对应的解密密钥，对所述加密后的用户数据进行解密。
  5. 根据权利要求4所述的方法，所述方法还包括：
    响应于针对所述用户的注销交易，调用所述智能合约的注销逻辑，删除所述用户对应的用户账户，并清除所述第一TEE中维护的与所述用户对应加密秘钥和所述第二TEE中维护的与所述加密密钥对应的解密秘钥，以禁止所述数据查询方访问所述用户数据。
  6. 根据权利要求5所述的方法，还包括：
    获取数据查询方发起的与目标用户数据对应的数据查询交易；
    响应于所述数据查询交易，调用所述智能合约包括的查询逻辑，查询所述区块链中存证的所述目标用户数据，并将针对所述目标用户数据的查询结果发送至所述数据查询方；以及，
    从所述数据查询方的用户账户持有的虚拟资源中，向所述数据持有方的用户账户转移与为所述目标用户数据标记的数据价值对应的数量的虚拟资源。
  7. 根据权利要求6所述的方法，所述数据属性指示所述目标用户数据是否为公开数据的数据公开属性；
    所述将针对所述目标用户数据的查询结果发送至所述数据查询方包括：
    基于所述目标用户数据对应的数据公开属性确定所述目标用户数据是否为公开数据；
    如果所述目标用户数据为公开数据，将针对所述目标用户数据的查询结果发送至所述数据查询方。
  8. 根据权利要求6所述的方法，所述数据属性包括指示所述目标用户数据是否为托管至数据托管方的数据托管属性；
    所述将针对所述目标用户数据的查询结果发送至所述数据查询方包括：
    基于所述目标用户数据对应的数据托管属性确定所述目标用户数据是否为托管数据；
    如果所述目标用户数据为托管至数据托管方的托管数据，通过所述数据托管方对应的私钥对所述目标用户数据的查询结果进行签名，并将签名后的所述目标用户数据的查询结果发送至所述数据查询方；
    如果所述目标用户数据不是托管至数据托管方的托管数据，生成数据签名事件，以使用户客户端在获取到所述数据签名事件时，响应于所述数据签名事件，提示所述目标用户数据对应的数据持有方利用自身持有的私钥对所述目标用户数据的查询结果进行签名；获取所述用户客户端发送的签名后的所述目标用户数据的查询结果，并将签名后的所述目标用户数据的查询结果发送至所述数据查询方。
  9. 根据权利要求6所述的方法，所述数据属性包括指示所述目标用户数据的隐私等级的数据隐私属性；
    所述将针对所述目标用户数据的查询结果发送至所述数据查询方，包括：
    基于所述目标用户数据对应的数据隐私属性确定所述目标用户数据对应的隐私等级；其中，所述隐私等级包括第一级隐私等级和第二级隐私等级；所述第一级隐私等级表示所述目标用户数据支持明文数据查询；所述第二级隐私等级表示所述目标用户数据支持数据比较查询；
    如果所述目标用户数据对应的数据等级为第一级隐私等级时，将所述目标用户数据的明文数据发送至所述数据查询方；
    如果所述目标用户数据对应的数据等级为第二级的隐私等级时，获取所述数据查询交易中携带的待校验数据，将所述待校验数据与所述目标数据进行比较，并将比较结果作为查询结果发送至所述数据查询方。
  10. 根据权利要求6所述的方法，所述将针对所述目标用户数据的查询结果发送至所述数据查询方，包括：
    确定所述数据查询方是否为所述目标用户数据对应的数据持有方；
    如果是，将所述查询结果发送至所述数据查询方；
    如果否，进一步调用所述智能合约包括的验证逻辑，对所述数据查询方进行身份验证，并在身份验证通过时，将所述查询结果发送至所述数据查询方。
  11. 根据权利要求6所述的方法，还包括：
    在将针对所述目标用户数据的查询结果发送至所述数据查询方之后，更新所述智能合约维护的所述目标用户数据的查询次数；和/或，
    在从所述数据查询方的用户账户持有的虚拟资源中，向所述数据持有方的用户账户转移与为所述目标用户数据标记的数据价值对应数量的虚拟资源之后，记录转移的所述虚拟资源的数量，并基于记录的所述数量更新所述智能合约维护的与所述目标用户数据对应的收益账单。
  12. 根据权利要求6所述的方法，所述认证机构包括培训机构；所述用户数据包括所述培训机构对所述用户进行培训认证产生的培训数据。
  13. 根据权利要求12所述的方法，所述培训机构包括职业培训机构；所述用户数据包括所述培训机构对所述用户进行职业教育培训认证后颁发的职业教育技能证书。
  14. 一种基于区块链的数据存证方法，其中，所述区块链部署了用于管理数据资产的智能合约，所述方法包括：
    获取数据持有方发起的数据存证交易；其中，所述数据存证交易包括待存证的用户数据；所述用户数据包括认证机构对所述用户进行用户认证后产生的认证数据；
    响应于所述数据存证交易，调用所述智能合约包括的数据资产生成逻辑，将所述用户数据与其它认证机构对该用户进行认证后产生的用户数据进行关联存证，生成与所述用户对应的用户数据集，并为生成的用户数据集标记数据价值，以形成与所述用户对应的数据资产。
  15. 根据权利要求14所述的方法，还包括：
    在将标记了数据价值的用户数据与其它认证机构对该用户进行认证后标记了数据 价值的用户数据进行关联存证之前，基于区块链节点设备搭载的第一TEE中维护的与所述用户对应的加密密钥对所述用户数据进行加密，以使数据查询方在访问所述加密后的用户数据时，通过自身搭载的第二TEE中维护的与所述用户对应的解密密钥，对所述加密后的用户数据进行解密。
  16. 根据权利要求15所述的方法，还包括：
    响应于针对所述用户的注销交易，调用所述智能合约的注销逻辑，删除所述用户对应的用户账户，并清除所述第一TEE中维护的与所述用户对应加密秘钥和所述第二TEE中维护的与所述加密密钥对应的解密秘钥，以禁止所述数据查询方访问所述用户数据。
  17. 根据权利要求16所述的方法，还包括：
    获取数据查询方发起的与目标用户数据对应的数据查询交易；
    响应于所述数据查询交易，调用所述智能合约包括的查询逻辑，查询所述区块链中存证的所述目标用户数据，并将针对所述目标用户数据的查询结果发送至所述数据查询方；以及，
    从所述数据查询方的用户账户持有的虚拟资源中，向所述数据持有方的用户账户转移与为所述目标用户数据标记的数据价值对应的数量的虚拟资源。
  18. 一种基于区块链的数据存证装置，其中，所述区块链部署了用于管理数据资产的智能合约，所述装置包括：
    第一获取模块，获取数据持有方发起的数据存证交易；其中，所述数据存证交易包括待存证的用户数据；所述用户数据包括认证机构对所述用户进行用户认证后产生的认证数据；
    第一数据资产生成模块，响应于所述数据存证交易，调用所述智能合约包括的数据资产生成逻辑，为所述用户数据标记数据价值，并将标记了数据价值的所述用户数据与其它认证机构对该用户进行认证后产生的被标记了数据价值的用户数据进行关联存证，以形成与所述用户对应的数据资产。
  19. 根据权利要求18所述的装置，还包括：
    第二获取模块，获取数据查询方发起的与目标用户数据对应的数据查询交易；
    查询模块，响应于所述数据查询交易，调用所述智能合约包括的查询逻辑，查询所述区块链中存证的所述目标用户数据，并将针对所述目标用户数据的查询结果发送至所述数据查询方；以及，
    从所述数据查询方的用户账户持有的虚拟资源中，向所述数据持有方的用户账户转移与为所述目标用户数据标记的数据价值对应的数量的虚拟资源。
  20. 一种基于区块链的数据存证装置，其中，所述区块链部署了用于管理数据资产的智能合约，所述装置包括：
    第三获取模块，获取数据持有方发起的数据存证交易；其中，所述数据存证交易包括待存证的用户数据；所述用户数据包括认证机构对所述用户进行用户认证后产生的认证数据；
    第二数据资产生成模块，响应于所述数据存证交易，调用所述智能合约包括的数据资产生成逻辑，将所述用户数据与其它认证机构对该用户进行认证后产生的用户数据进行关联存证，生成与所述用户对应的用户数据集，并为生成的用户数据集标记数据价值，以形成与所述用户对应的数据资产。
  21. 一种电子设备，包括：
    处理器；
    用于存储所述处理器可执行指令的存储器；
    其中，所述处理器被配置为调用所述存储器中存储的可执行指令，实现如所述权利要求1-17任一所述的数据存证方法。
  22. 一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序用于执行如所述权利要求1-17任一所述的数据存证方法。
PCT/CN2022/090367 2021-05-10 2022-04-29 基于区块链的数据存证方法、装置、设备和存储介质 WO2022237588A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110507726.4A CN113221191B (zh) 2021-05-10 2021-05-10 基于区块链的数据存证方法、装置、设备和存储介质
CN202110507726.4 2021-05-10

Publications (1)

Publication Number Publication Date
WO2022237588A1 true WO2022237588A1 (zh) 2022-11-17

Family

ID=77094363

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/090367 WO2022237588A1 (zh) 2021-05-10 2022-04-29 基于区块链的数据存证方法、装置、设备和存储介质

Country Status (2)

Country Link
CN (1) CN113221191B (zh)
WO (1) WO2022237588A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113221191B (zh) * 2021-05-10 2022-05-31 支付宝(杭州)信息技术有限公司 基于区块链的数据存证方法、装置、设备和存储介质
CN114118987A (zh) * 2021-11-08 2022-03-01 支付宝(杭州)信息技术有限公司 基于区块链的跨境汇款方法及装置、电子设备
CN117217719B (zh) * 2023-11-07 2024-02-09 湖南海润天恒科技集团有限公司 一种基于大数据的人才信息招聘数据智能管理方法及系统

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110046996A (zh) * 2019-01-18 2019-07-23 阿里巴巴集团控股有限公司 区块链交易的生成方法和装置
US20190340946A1 (en) * 2018-05-01 2019-11-07 Odem Ltd. System and method for educational offering staking and token architecture
CN110874464A (zh) * 2018-09-03 2020-03-10 巍乾全球技术有限责任公司 用户身份认证数据的管理方法和设备
WO2020189926A1 (ko) * 2019-03-15 2020-09-24 주식회사 코인플러그 블록체인 네트워크를 이용하여 사용자의 아이덴티티를 관리하는 방법 및 서버, 그리고, 블록체인 네트워크 기반의 사용자 아이덴티티를 이용하여 사용자를 인증하는 방법 및 단말
CN111797169A (zh) * 2020-07-09 2020-10-20 杭州复杂美科技有限公司 数据存证方法、设备和存储介质
CN111859422A (zh) * 2020-07-10 2020-10-30 郑州信大先进技术研究院 一种基于区块链的数字资产存证系统
CN112308561A (zh) * 2020-10-16 2021-02-02 浙江甲骨文超级码科技股份有限公司 基于区块链的存证方法、系统、计算机设备和存储介质
CN113221191A (zh) * 2021-05-10 2021-08-06 支付宝(杭州)信息技术有限公司 基于区块链的数据存证方法、装置、设备和存储介质

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109767336A (zh) * 2018-12-27 2019-05-17 福建省农村信用社联合社 一种基于区块链的p2p理财平台资金银行存管管理方法
CN111914023B (zh) * 2019-07-31 2024-06-14 创新先进技术有限公司 基于区块链的票据管理方法、装置及电子设备
CN110706114B (zh) * 2019-09-05 2021-05-18 创新先进技术有限公司 一种基于区块链的违约资产处理方法、装置及电子设备
CN110766550B (zh) * 2019-09-05 2021-06-22 创新先进技术有限公司 基于区块链的资产查询方法及装置、电子设备
CN111353180A (zh) * 2020-03-30 2020-06-30 北京海益同展信息科技有限公司 一种区块链存证方法、取证方法及系统
CN111966967A (zh) * 2020-08-07 2020-11-20 北京网聚云联科技有限公司 一种基于区块链技术和cdn的版权存证方法及系统
CN112016924A (zh) * 2020-10-21 2020-12-01 支付宝(杭州)信息技术有限公司 一种基于区块链的数据存证方法、装置以及设备
CN112435006A (zh) * 2020-11-24 2021-03-02 大连理工江苏研究院有限公司 一种应用区块链技术的专利全过程管理方法、系统及设备
CN112258189A (zh) * 2020-12-03 2021-01-22 支付宝(杭州)信息技术有限公司 基于区块链的签约管理方法及装置和电子设备

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190340946A1 (en) * 2018-05-01 2019-11-07 Odem Ltd. System and method for educational offering staking and token architecture
CN110874464A (zh) * 2018-09-03 2020-03-10 巍乾全球技术有限责任公司 用户身份认证数据的管理方法和设备
CN110046996A (zh) * 2019-01-18 2019-07-23 阿里巴巴集团控股有限公司 区块链交易的生成方法和装置
WO2020189926A1 (ko) * 2019-03-15 2020-09-24 주식회사 코인플러그 블록체인 네트워크를 이용하여 사용자의 아이덴티티를 관리하는 방법 및 서버, 그리고, 블록체인 네트워크 기반의 사용자 아이덴티티를 이용하여 사용자를 인증하는 방법 및 단말
CN111797169A (zh) * 2020-07-09 2020-10-20 杭州复杂美科技有限公司 数据存证方法、设备和存储介质
CN111859422A (zh) * 2020-07-10 2020-10-30 郑州信大先进技术研究院 一种基于区块链的数字资产存证系统
CN112308561A (zh) * 2020-10-16 2021-02-02 浙江甲骨文超级码科技股份有限公司 基于区块链的存证方法、系统、计算机设备和存储介质
CN113221191A (zh) * 2021-05-10 2021-08-06 支付宝(杭州)信息技术有限公司 基于区块链的数据存证方法、装置、设备和存储介质

Also Published As

Publication number Publication date
CN113221191B (zh) 2022-05-31
CN113221191A (zh) 2021-08-06

Similar Documents

Publication Publication Date Title
CN110457875B (zh) 基于区块链的数据授权方法及装置
CN110473094B (zh) 基于区块链的数据授权方法及装置
US20210075589A1 (en) System and method for blockchain-based cross-entity authentication
US20200304315A1 (en) System and method for blockchain-based cross-entity authentication
WO2022237588A1 (zh) 基于区块链的数据存证方法、装置、设备和存储介质
US11481768B2 (en) System and method of generating and validating encapsulated cryptographic tokens based on multiple digital signatures
CN110059495A (zh) 数据共享方法、装置及系统、电子设备
CN113255005B (zh) 一种基于区块链的数据资产流转方法、装置及设备
CN109409122A (zh) 文件存储方法及其电子设备、存储介质
CN110473096A (zh) 基于智能合约的数据授权方法及装置
TW202008290A (zh) 基於區塊鏈的服務租賃方法、裝置、系統及電子設備
CN109472164A (zh) 合同数据的验证方法及其网络和电子设备
TW202209211A (zh) 區塊鏈執行智能化合同的註冊及自動化管理方法
US11876801B2 (en) User ID codes for online verification
CN111783114A (zh) 区块链交易方法及装置、电子设备
CN109491965A (zh) 购售电合同的存储方法及其网络和电子设备
CN109003185A (zh) 一种智能合约的建立方法、装置、计算设备及存储介质
US20230004970A1 (en) Distributed Ledgers with Ledger Entries Containing Redactable Payloads
CN113112262B (zh) 一种知识产权对应的数字资产流转方法
CN111683082A (zh) 一种基于区块链的数据共享方法、系统及电子设备
US20220278845A1 (en) Honest behavior enforcement via blockchain
US20240187259A1 (en) Method and apparatus for generating, providing and distributing a trusted electronic record or certificate based on an electronic document relating to a user
Yang et al. PrivCrowd: A Secure Blockchain‐Based Crowdsourcing Framework with Fine‐Grained Worker Selection
CN113541965B (zh) 一种基于区块链的通信授权方法、装置、设备和存储介质
McCorry Applications of the Blockchain using Cryptography

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22806556

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22806556

Country of ref document: EP

Kind code of ref document: A1