A blockchain-based information processing method and device

Abstract

The present application discloses a blockchain-based information processing method and device, which encrypts sensitive information and stores it in the blockchain, and can only decrypt the sensitive information through a designated node; when a user accesses sensitive information, firstly, it is determined through permission verification whether the user has the permission to access the sensitive information, if so, the decrypted sensitive information is obtained from the designated node and returned to the user, if not, an error message is returned or the encrypted information is obtained from other nodes and returned to the user; in addition, the user's access to sensitive information will also be recorded and stored in the blockchain. In this way, the encrypted sensitive information can be securely shared and tracked throughout the process by utilizing the characteristics of blockchain data that cannot be tampered with and can be traced, and authorized users can directly obtain the plaintext information of sensitive information through the nodes of the blockchain, and illegal access can also be tracked and traced.

Description

Technical Field

[0001] The present application relates to the field of information processing, and in particular to a blockchain-based information processing method and device. Background Art

[0002] With the increasing degree of digitization of various information and the continuous development of Internet technology, the dissemination and sharing of various information is becoming easier and easier. In the process of disseminating and sharing information, how to ensure the information security of sensitive information such as personal privacy and national security has become an increasingly prominent issue.

[0003] Because blockchain has the characteristics of decentralization and immutability, it is particularly suitable for storing some important information. However, the information on the blockchain is often recorded in each node and shared by users on the blockchain, which limits the application of blockchain technology in storing sensitive information. Summary of the invention

[0004] The applicant creatively provides a blockchain-based information processing method and device.

[0005] According to the first aspect of the embodiment of the present application, a blockchain-based information processing method is provided, the method comprising: obtaining an information access request sent by a user, the first information corresponding to the information access request is in ciphertext form and stored on the blockchain; determining whether the user has the authority to access the corresponding information, if so, obtaining second information from a first type of node on the blockchain, the second information being the first information decrypted by the first type of node; if not, obtaining third information, the third information being error information or the first information obtained from a second type of node on the blockchain; storing the access record on the blockchain; and sending the second information or the third information to the user.

[0006] According to one embodiment of the present application, obtaining the second information from the first type of node on the blockchain includes: sending an information access request to the first type of node, and the first type of node decrypting the first information to obtain the second information; and receiving the second information returned by the first type of node.

[0007] According to an embodiment of the present application, determining whether a user has permission to access corresponding information includes: obtaining the user's identity authentication information; and determining whether the user has permission to access the corresponding information based on a security policy and the identity authentication information.

[0008] According to an embodiment of the present application, before determining whether the user has the authority to access the corresponding information based on the security policy and the identity authentication information, the method further includes: establishing a security policy corresponding to the user identity authentication information.

[0009] According to one embodiment of the present application, storing access records in a blockchain includes: obtaining user information that sends an information access request; generating an access record based on the user information and the information access request; and storing the access record in a blockchain.

[0010] According to one embodiment of the present application, the method also includes: obtaining fourth information to be stored; encrypting the fourth information to be stored by the first type of node to obtain first information; and storing the first information in the blockchain.

[0011] According to an embodiment of the present application, the first information is in a ciphertext form encrypted using a key, the key is stored on a first type of node, and the second information is the first information decrypted by the key on the first type of node.

[0012] According to an embodiment of the present application, before obtaining the key from the first type of node, the method further includes: determining the first type of node according to the first configuration information; and storing the key in the first type of node.

[0013] According to one embodiment of the present application, the method also includes: determining at least one node from the nodes of the blockchain; establishing configuration information to determine at least one node as a first-type node; and allocating a private data set storage space to the first-type node, wherein the private data set storage space is used to store a key.

[0014] According to the second aspect of the embodiment of the present application, a blockchain-based information processing device includes: an information access request acquisition module, used to obtain an information access request sent by a user, the first information corresponding to the information access request is in ciphertext form and stored on the blockchain; an information acquisition module, used to determine whether the user has the authority to access the corresponding information, if so, obtain second information from a first type of node on the blockchain, the second information is the first information decrypted by the first type of node, if not, obtain third information, the third information is error information or the first information obtained from the second type of node on the blockchain; an access record storage module, used to store access records on the blockchain; an information return module, used to send the second information or the third information to the user.

[0015] The embodiments of the present application provide a blockchain-based information processing method and device. The method encrypts sensitive information and stores it in the blockchain, and the sensitive information can only be decrypted through a designated node. When a user accesses sensitive information, first, a permission check is performed to determine whether the user has the permission to access the sensitive information. If the user has the permission, the decrypted sensitive information is obtained from the designated node and returned to the user. If the user does not have the permission, an error message is returned or the encrypted information is obtained from other nodes and returned to the user. In addition, the user's access to the sensitive information will also be recorded and stored in the blockchain.

[0016] It can be seen that the embodiments of the present application can make sensitive information more secure through information encryption, and use the characteristics of blockchain data that cannot be tampered with and can be traced to share and store the encrypted sensitive information and track and manage it throughout the process; and the embodiments of the present application divide the nodes of the blockchain into two types of nodes, the first type of nodes can decrypt the encrypted information to obtain decrypted information, and the second type of nodes cannot decrypt and can only obtain encrypted information. In this way, when users who pass the permission check can directly obtain decrypted information through the first type of nodes, the decryption process is simplified, and users who do not pass the permission check only get error messages or obtain encrypted information from the second type of nodes. In this way, illegal access can be prevented to ensure that operations such as updating and querying sensitive information are all performed under authorization.

[0017] Storing the access records of users accessing sensitive information on the blockchain can make the access record data secure, reliable and tamper-proof, so that the access records can be tracked throughout the process.

[0018] It should be understood that the implementation of the present application does not require the realization of all the beneficial effects described above, but a specific technical solution can achieve a specific technical effect, and other embodiments of the present application can also achieve beneficial effects not mentioned above. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easily understood. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, wherein:

[0020] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0021] Figure 1 This is a schematic diagram of the implementation process of an embodiment of the information processing method based on blockchain of this application;

[0022] Figure 2 This is a schematic diagram of the system architecture and information interaction of another embodiment of the information processing method based on blockchain of the present application;

[0023] Figure 3 This is a schematic diagram of the structure of an embodiment of the information processing device based on blockchain of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, features, and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0025] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0026] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0027] Figure 1 The implementation process of the information processing method based on blockchain in the embodiment of the present application is shown. Figure 1 , an embodiment of the present application provides an information processing method based on blockchain, the method comprising: operation 110, obtaining an information access request sent by a user, the first information corresponding to the information access request is in ciphertext form and stored on the blockchain; operation 120, determining whether the user has the authority to access the corresponding information, if so, obtaining second information from a first type of node on the blockchain, the second information being the first information decrypted by the first type of node, if not, obtaining third information, the third information being error information or the first information obtained from the second type of node on the blockchain; operation 130, storing the access record in the blockchain; operation 140, sending the second information or the third information to the user.

[0028] In operation 110, the information access request includes multiple operations such as viewing, changing and deleting. The information requested by the information access request sent by the user is usually sensitive information, that is, data that can only be viewed by people with sensitive information access rights, such as electronic medical records, salary slips, personal education experience, resident income verification reports, social assistance information, etc. Storing this sensitive information in the form of ciphertext, i.e., first information, on the blockchain can not only ensure the authenticity and validity of the data by utilizing the tamper-proof characteristics of blockchain data, but also ensure the security and reliability of sensitive information, and timely share it through the shared ledger without causing information leakage.

[0029] However, for people with access rights to sensitive information, if they can only obtain information in ciphertext form, they must also use other encryption and decryption systems to support it, which will cause a lot of inconvenience.

[0030] To this end, in operation 120, the embodiment of the present application also introduces the authorization verification and sensitive information decryption process into the process of blockchain information access, and decrypts the first information in ciphertext form through the first type of node on the blockchain. In this way, the maintenance cost of multiple systems can be further saved, and user operations can be greatly simplified. However, this operation is only open to users with access rights to sensitive information, and different processing is required for other users. Therefore, it is also necessary to perform permission verification in operation 120 to ensure that only users with access rights to sensitive information can obtain the decrypted sensitive information.

[0031] In addition, in order to ensure the absolute security, reliability and trustworthiness of sensitive information, the embodiment of the present application also divides the nodes on the blockchain into first-class nodes and second-class nodes, wherein the first-class nodes and the second-class nodes are both nodes of the blockchain and share a set of ledgers, and the sensitive information stored on the ledgers is in encrypted ciphertext form, i.e., the first information. Only the first-class nodes can decrypt the sensitive information in ciphertext form and return the decrypted plaintext information, while the second-class nodes cannot decrypt the sensitive information in ciphertext form and can only store and return the sensitive information in ciphertext form.

[0032] Since the second type of nodes cannot decrypt sensitive information in ciphertext form, on the one hand, when executing consensus, it can ensure the credibility and non-tamperability of the information and prevent the first type of nodes from colluding to modify the ledger; on the other hand, it can also be used to process information access that does not require authorization verification.

[0033] In operation 120, any existing or applicable authorization verification method may be used to determine whether the user has the authority to access the corresponding information, and may even be integrated with an existing authorization verification system as long as the authorization result is obtained.

[0034] When the result of the authorization verification indicates that the user has the authority to access sensitive information, the user request can be forwarded to the first type of node, which decrypts the sensitive information in ciphertext form, i.e., the first information, to obtain the second information. The second information is the sensitive information that can be directly viewed after decryption.

[0035] When a user does not have the authority to access the corresponding information, it can directly return an unauthorized error message (third information), or forward the user's information access request to the second type of node in the blockchain, so that users without access rights can only obtain information in ciphertext form (in this case, the third information is the first information), but cannot obtain decrypted information (second information). In this way, it can be ensured that only users with the authority to access the corresponding information can obtain the plaintext information of sensitive information, that is, the second information.

[0036] In addition, when illegal users cannot obtain plain text information, they may send a large number of information access requests to conduct information attacks by changing users or authorization information. These information attacks will consume a large amount of system processing power and affect the processing of normal information access requests. If illegal users cannot be discovered and located in time, it will be impossible to take appropriate measures to prevent illegal users from conducting information attacks.

[0037] Therefore, in operation 130, the embodiment of the present application stores the access records in the blockchain to form tamper-proof and traceable data, so as to perform access tracking and information analysis to discover and locate illegal users, so as to take corresponding measures in time to prevent illegal users from conducting information attacks.

[0038] The access record must at least include: the user information that sends the information access request and the information requested by the information access request. The user information may include user identification, user network IP, and other information that can help locate illegal users.

[0039] Afterwards, for users with information access rights, the decrypted sensitive information can be returned through operation 140; and for users without information access rights, error information or the first information obtained from the second type of node, that is, the third information, can be returned through operation 140.

[0040] It can be seen that the embodiments of the present application can make sensitive information more secure through information encryption, and use the characteristics of blockchain data that cannot be tampered with and can be traced to share and store the encrypted sensitive information and track and manage it throughout the process; and the embodiments of the present application divide the nodes of the blockchain into two types of nodes, so that the first type of nodes can decrypt the encrypted information to obtain decrypted information, while the second type of nodes cannot decrypt and can only obtain encrypted information. In this way, when users who pass the permission check can directly obtain decrypted information through the first type of nodes, the decryption process is simplified, and users who do not pass the permission check only get error messages or encrypted information obtained from the second type of nodes. In this way, illegal access can be prevented to ensure that operations such as updating and querying sensitive information are all performed under the authorization of the data owner.

[0041] Storing the access records of users accessing sensitive information on the blockchain can make the access record data secure, reliable and tamper-proof, so that the access records can be tracked throughout the process.

[0042] It should be noted that Figure 1 The embodiment shown is only the most basic embodiment of the information processing method based on blockchain of this application, and the implementer can further refine and expand it on this basis.

[0043] According to one embodiment of the present application, obtaining the second information from the first type of node on the blockchain includes: sending an information access request to the first type of node, and the first type of node decrypting the first information to obtain the second information; and receiving the second information returned by the first type of node.

[0044] The information access request is sent to the first type of node, which decrypts the information, and the second information returned is received from the first type of node. This allows the decryption process to be limited to the first type of node, making it a black box process and more secure.

[0045] Specifically, the first information can be decrypted by executing a blockchain smart contract stored on the first type of node.

[0046] According to an embodiment of the present application, determining whether a user has permission to access corresponding information includes: obtaining the user's identity authentication information; and determining whether the user has permission to access the corresponding information based on a security policy and the identity authentication information.

[0047] The identity authentication information mainly refers to the valid information obtained through identity authentication that has been confirmed and can identify the user's identity, such as the user ID, the role the user has, and the group the user belongs to.

[0048] Security policies are rules that define which users are allowed to perform which operations on which information under what conditions. Usually, these security policies are pre-established and can be stored in any applicable data storage system in any applicable information format.

[0049] When obtaining the user's identity authentication information, you can authenticate the user yourself or obtain it from a third-party identity authentication system. After that, you can obtain the security policy that matches the user's identity from the pre-established security policy based on the identity authentication information, and further determine whether the user has the authority to access the corresponding information through the matching security policy.

[0050] According to an embodiment of the present application, before determining whether the user has the authority to access the corresponding information based on the security policy and the identity authentication information, the method further includes: establishing a security policy corresponding to the user identity authentication information.

[0051] Based on the available user authentication information, a security policy corresponding to the user authentication information is established. After obtaining the user authentication information, a matching security policy can be found more quickly, the calculation complexity of the security policy can be simplified, and the processing time of authorization verification can be shortened.

[0052] According to one embodiment of the present application, storing access records in a blockchain includes: obtaining user information that sends an information access request; generating an access record based on the user information and the information access request; and storing the access record in a blockchain.

[0053] The user information is information that can identify and locate the user, such as a user ID or a user IP address, etc. This information can be obtained through a user identity authentication process or through a network address sent by a request.

[0054] Specifically, when storing access records in the blockchain, the interface provided by the blockchain can be directly called to upload the access records to the blockchain, and then stored in the shared ledger after consensus.

[0055] According to one embodiment of the present application, the method also includes: obtaining fourth information to be stored; encrypting the fourth information to be stored by the first type of node to obtain first information; and storing the first information in the blockchain.

[0056] The fourth information is the sensitive information to be stored, which can be the original information or the updated information. Usually, the encryption and decryption of information is a reverse process, in which some corresponding data are used, such as paired encryption and decryption keys, symmetric or asymmetric encryption and decryption algorithms, etc. Therefore, the encryption process of information is also preferably performed by the first type of node.

[0057] When storing the first information in the blockchain, the fourth information can be sent to the first type of node, the encrypted information can be obtained from the first type of node, and then the access record can be stored in the blockchain in a similar way to storing the access record; the fourth information can also be sent to the first type of node, which can be encrypted by the first type of node and directly stored in the blockchain.

[0058] According to an embodiment of the present application, the first information is in a ciphertext form encrypted using a key, the key is stored on a first type of node, and the second information is the first information decrypted by the key on the first type of node.

[0059] Using keys to encrypt and decrypt sensitive information, you can control which nodes can encrypt and decrypt sensitive information by controlling the storage location of the keys. This implementation is simple, direct, efficient, and has low system overhead.

[0060] According to an embodiment of the present application, before obtaining the key from the first type of node, the method further includes: determining the first type of node according to the first configuration information; and storing the key in the first type of node.

[0061] The first configuration information is a kind of configuration information of the blockchain, which is used to specify which nodes are the first type of nodes. For example, the Hyperledger Fabric blockchain provides a configuration option for configuring private data set nodes. By reading this configuration information, it is possible to determine which nodes are the first type of nodes and store the key in the first type of nodes. After that, the sensitive information can be encrypted and decrypted using the key.

[0062] In addition, in order to ensure the security and effectiveness of the key, the key used for encryption and decryption will be updated regularly. Therefore, after the key is updated, the key information stored in the first type of node also needs to be updated.

[0063] If there are multiple nodes in the blockchain that are first-class nodes, when storing the key in the first-class nodes, the key needs to be stored in each of the first-class nodes.

[0064] According to one embodiment of the present application, the method also includes: determining at least one node from the nodes of the blockchain; establishing configuration information to determine at least one node as a first-type node; and allocating a private data set storage space to the first-type node, wherein the private data set storage space is used to store a key.

[0065] When establishing configuration information, at least one node may be determined from the nodes of the blockchain as the first type of node. When determining the first type of node, any node may be selected from a blockchain with stricter access control (e.g., a private network), or a node with stricter information access control may be selected from the blockchain to ensure the security of the key.

[0066] Theoretically, the more nodes of the first category there are, the better. On the one hand, they can share the processing load of user information access requests, and on the other hand, they can ensure the authenticity and credibility of the information.

[0067] Afterwards, since the key is private data that cannot be shared with other nodes, it is also necessary to create a private data set storage space for the first type of nodes to store the key used to encrypt and decrypt sensitive information.

[0068] The above embodiments are for how to Figure 1 The exemplary descriptions of how to further refine and expand the basic embodiments shown are provided. Implementers may also combine the various implementation methods in the above embodiments to form new embodiments according to specific implementation conditions and needs to achieve more ideal implementation effects.

[0069] Figure 2 The system architecture and information interaction diagram of another embodiment of the present application are shown. This embodiment combines multiple implementation methods of the above embodiments to form an optimized and new embodiment.

[0070] like Figure 2 As shown, in the blockchain system applied in this embodiment, the user accesses the information stored in the blockchain through the blockchain client 20.

[0071] Specifically, the user must first send an information access request to the blockchain client 20, which will filter and screen the information access request sent by the user, and only send valid and legal information access requests to the nodes in the blockchain (for example, node 21, node 22 and node 23), and then return the information obtained by the blockchain to the user, thereby greatly reducing the amount of information processing in the blockchain and further ensuring the information security of the blockchain.

[0072] Assume that Figure 2 The blockchain shown is implemented by Hyperledger Fabric blockchain, which stores the patient's electronic medical record, and the electronic medical record is stored in the nodes of the blockchain in the form of ciphertext sensitive information obtained after encryption with a key, for example, in nodes 21, 22 and 23.

[0073] Before receiving user access information, it is necessary to configure node 21 and node 22 as first-class nodes for setting private datasets through the configuration options of the Hyperledger Fabric blockchain private dataset, and allocate private dataset storage space for node 21 and node 22.

[0074] Afterwards, the key used to encrypt and decrypt the electronic medical record is stored in the first type of nodes, namely node 21 and node 22, through the interface provided by the Hyperledger Fabric blockchain. In this way, in addition to storing ciphertext sensitive information and sensitive access records, the first type of nodes also stores private data including keys; while node 23, as a second type of node, only stores ciphertext sensitive information and sensitive access records, but no key data.

[0075] Therefore, in this blockchain system, only ciphertext sensitive information and sensitive information access records are shared, while the key is the private data of the first type of node and is not shared with the second type of nodes.

[0076] Then, the blockchain client 20 sends the newly generated patient medical record or the updated electronic medical record to the first type of node (node ​​21 or node 22), and the first type of node encrypts the electronic medical record and stores it in the shared ledger of the blockchain through consensus.

[0077] Assume that at this time, doctor A sends a request to the blockchain through the outpatient system to obtain the electronic medical record of patient A stored in the blockchain. After receiving the request, the blockchain client 20 mainly performs the following steps to access the electronic medical record:

[0078] First, the blockchain client 20 obtains the identity authentication information of doctor A, and then prompts doctor A to let patient B swipe the medical card to obtain patient B's authorization (the authorization conditions defined in the security policy, i.e., under what circumstances can access be obtained). After obtaining the authorization of user B through patient B's medical card, the authorization result will indicate that doctor A is an authorized user with access to patient B's electronic medical record;

[0079] Next, the blockchain client 20 will send the information access request to the first type of node: node 21 or node 22 according to the load balancing distribution strategy. The first type of node will query the electronic medical record ciphertext sensitive information of patient B, and then decrypt the ciphertext sensitive information using the key stored in the private data center by executing the smart contract to obtain the plaintext electronic medical record, and then return the plaintext electronic medical record to the blockchain client 20;

[0080] Meanwhile, the blockchain client 20 will generate an access record such as "Doctor A has obtained the authorization of patient B to access the electronic medical record of patient B" based on the user information of "Doctor A" and the information access request of "Patient B's electronic medical record", and upload it to the blockchain through the data upload interface provided by the blockchain. The blockchain will store the information in the shared ledger of the blockchain by executing consensus, and synchronize it to nodes 21, 23 and 24 for future tracking;

[0081] Afterwards, when blockchain client 20 receives the plaintext information of the electronic medical record returned by node 21 or node 22, it will return the plaintext information of the electronic medical record of patient B to doctor A.

[0082] Assume that doctor A wants to view the electronic medical record of patient C again, but patient C is not present and cannot swipe the medical card. At this time, the authorization verification fails, and the blockchain client 20 will also generate an access record similar to "doctor A wants to access the electronic medical record of patient C, but has not obtained authorization" and store it in the blockchain; then return an error message similar to "no medical card information was received within the specified time, authorization failed, and the patient's electronic medical record cannot be accessed", and no longer send any request to the first type of node.

[0083] Assume that information security inspector E wants to view the recent information access records, and then sends a request to blockchain client 20 to view the sensitive information access records. After blockchain client 20 receives the request and performs authorization verification to obtain an authorized result, it forwards the request to any node in the blockchain according to the load balancing distribution strategy. Assuming that it is sent to node 23 this time, node 23 will return the Mingge information access record stored on node 23.

[0084] It should be noted that Figure 2 The embodiment shown is only an exemplary description of the information processing method based on blockchain of the present application, and is not a limitation on the implementation method or application scenario of the embodiment of the present application. The implementer can adopt any applicable implementation method and apply it to any applicable application scenario according to specific implementation needs and conditions.

[0085] Furthermore, according to the second aspect of the embodiment of the present application, there is also provided an information processing device based on blockchain, such as Figure 3 As shown, the device 30 includes: an information access request acquisition module 301, used to obtain an information access request sent by a user, the first information corresponding to the information access request is in ciphertext form and stored on the blockchain; an information acquisition module 302, used to determine whether the user has the authority to access the corresponding information, if so, obtain the second information from the first type of node on the blockchain, the second information is the first information decrypted by the first type of node, if not, obtain the third information, the third information is error information or the first information obtained from the second type of node on the blockchain; an access record storage module 303, used to store the access record in the blockchain; an information return module 304, used to send the second information or the third information to the user.

[0086] According to one embodiment of the present application, the information acquisition module 302 includes: an information sending submodule, used to send an information access request to a first type of node, and the first type of node decrypts the first information to obtain second information; an information receiving submodule, used to receive the second information returned by the first type of node.

[0087] According to an embodiment of the present application, the information acquisition module 302 includes: an identity authentication information acquisition submodule, used to obtain the user's identity authentication information; and a permission verification submodule, used to determine whether the user has the permission to access the corresponding information based on the security policy and the identity authentication information.

[0088] According to an embodiment of the present application, the device 30 further includes: a security policy establishing module, configured to establish a security policy corresponding to the user identity authentication information.

[0089] According to an embodiment of the present application, the access record storage module 303 includes: a user information acquisition submodule, used to obtain user information that sends an information access request; an access record generation submodule, used to generate an access record based on the user information and the information access request; and an access record storage submodule, used to store the access record in the blockchain.

[0090] According to one embodiment of the present application, the device 30 also includes: a fourth information acquisition module, which acquires the fourth information to be stored; a first information acquisition module, which is used for the first type of node to encrypt the fourth information to be stored to obtain the first information; and a first information storage module, which is used to store the first information in the blockchain.

[0091] According to an embodiment of the present application, the device 30 further includes: a first-type node determination module, used to determine the first-type node according to the first configuration information; and a key storage module, used to store the key to the first-type node.

[0092] According to one embodiment of the present application, the device 30 also includes: a node selection module, used to determine at least one node from the nodes of the blockchain; a configuration information establishment module, used to establish configuration information to determine at least one node as a first-class node; a private data set storage space allocation module, used to allocate private data set storage space to the first-class node, and the private data set storage space is used to store keys.

[0093] It should be pointed out here that the above description of the information processing device embodiment based on blockchain is similar to the description of the aforementioned method embodiment, and has similar beneficial effects as the aforementioned method embodiment, so it will not be repeated. For the technical details that have not been disclosed in the description of the information processing device embodiment based on blockchain in this application, please refer to the description of the aforementioned method embodiment of this application for understanding, and in order to save space, it will not be repeated.

[0094] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0095] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another device, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0096] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0097] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0098] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage medium, read-only memory (ROM), disk or optical disk, etc. Various media that can store program codes.

[0099] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage media, ROM, magnetic disks or optical disks.

[0100] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A blockchain-based information processing method, the method comprising: Obtaining an information access request sent by a user, where the first information corresponding to the information access request is in ciphertext form and is stored on the blockchain; Determine whether the user has permission to access the first information, and if so, obtain second information from the first type of node on the blockchain, where the second information is the first information decrypted by the first type of node; if not, obtain third information, where the third information is error information or the first information obtained from the second type of node on the blockchain; The obtaining of the third information includes: sending the information access request to the second type of node; receiving the first information returned by the second type of node; the second type of node cannot decrypt the first information; Storing the access record in the blockchain; The second information or the third information is sent to the user.

2. According to the method of claim 1, obtaining the second information from the first type of node on the blockchain comprises: Sending the information access request to the first type of node, and having the first type of node decrypt the first information to obtain the second information; The second information returned by the first type of node is received.

3. The method according to claim 1, wherein determining whether the user has permission to access the first information comprises: Obtaining identity authentication information of the user; Determine whether the user has permission to access the first information according to the security policy and the identity authentication information.

4. The method according to claim 3, before determining whether the user has the right to access the first information according to the security policy and the identity authentication information, the method further comprises: A security policy corresponding to the user identity authentication information is established.

5. The method according to claim 1, wherein storing the access record in the blockchain comprises: Obtaining user information that sends the information access request; generating the access record according to the user information and the information access request; The access record is stored in the blockchain.

6. The method according to claim 1, further comprising: Acquiring fourth information to be stored; The first type of node encrypts the fourth information to be stored to obtain the first information; The first information is stored in the blockchain.

7. According to any one of the methods described in claims 1 to 6, the first information is in ciphertext form encrypted using a key, the key is stored on the first type of node, and the second information is the first information decrypted by the key on the first type of node.

8. The method according to claim 7, before obtaining the key from the first type of node, the method further comprises: Determine the first type of node according to the first configuration information; The key is stored in the first type of node.

9. The method according to claim 8, further comprising: Determine at least one node from the nodes of the blockchain; Establishing configuration information to determine the at least one node as the first type of node; A private data set storage space is allocated to the first-type node, where the private data set storage space is used to store the key.

10. An information processing device based on blockchain, the device comprising: An information access request acquisition module, used to acquire an information access request sent by a user, wherein the first information corresponding to the information access request is in ciphertext form and is stored on the blockchain; An information acquisition module, used to determine whether the user has the authority to access the first information, and if so, to acquire second information from the first type of node on the blockchain, where the second information is the first information decrypted by the first type of node; if not, to acquire third information, where the third information is error information or the first information acquired from the second type of node on the blockchain; The obtaining of the third information includes: sending the information access request to the second type of node; receiving the first information returned by the second type of node; the second type of node cannot decrypt the first information; An access record storage module, used to store access records in the blockchain; An information returning module is used to send the second information or the third information to the user.

Images