A method and device for providing user privacy data based on blockchain

Abstract

One or more embodiments of this specification provide a method and device for providing user privacy data based on blockchain, the method comprising: receiving a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for user privacy data of a target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to a trusted execution environment TEE, and the TEE is built in a node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

Description

[0001] This application is a divisional application of Chinese invention patent application No. 202010953541.1 filed on September 11, 2020, and the name of the invention is [A method and device for providing user privacy data based on blockchain]. Technical Field

[0002] This document relates to the field of computers, and in particular to a method and device for providing user privacy data based on blockchain. Background Art

[0003] At present, with the rapid development of Internet data service technology and the increasingly perfect digital credentials, whether data consumers can quickly and conveniently query the personal data generated by target users in a specified industry, for example, employers need to quickly query the user education data of applicants (for example, educational experience), these data provision services have also become a service scenario worthy of attention.

[0004] Taking the education industry as an example, user education data can reflect the user's business capabilities to a certain extent, but user education data involves the user's relevant privacy and belongs to user privacy data. However, in the existing solutions for providing privacy data such as user education data, there are problems such as poor confidentiality and low security of user privacy data, which may lead to the risk of user privacy data being leaked, which is bound to bring unnecessary trouble to users.

[0005] From this, it can be seen that there is a need to provide a technical solution that protects user privacy and provides privacy data with high security. Summary of the invention

[0006] The purpose of one or more embodiments of this specification is to provide a method for providing user privacy data based on blockchain. The method for providing user privacy data based on blockchain includes:

[0007] Receive a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

[0008] The purpose of one or more embodiments of this specification is to provide a user privacy data providing device based on blockchain. The user privacy data providing device based on blockchain includes:

[0009] A consumption request acquisition module receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. An information verification module performs a preset verification on the data consumption request in the trusted execution environment TEE through the smart contract deployed in the blockchain, based on the request body data corresponding to the data consumption request, and obtains the corresponding preset verification result. A data provision module obtains the target privacy data obtained for the data consumption request if the preset verification result meets the verification pass condition, and sends the encrypted target privacy data to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

[0010] The purpose of one or more embodiments of this specification is to provide a user privacy data providing device based on blockchain, including: a processor; and a memory arranged to store computer-executable instructions.

[0011] When the computer executable instructions are executed, the processor receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

[0012] The purpose of one or more embodiments of this specification is to provide a storage medium for storing computer executable instructions. When the executable instructions are executed by the processor, they receive a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0014] Figure 1 A schematic diagram of an application scenario of a blockchain-based user privacy data providing system provided in one or more embodiments of this specification;

[0015] Figure 2 A first flow chart of a method for providing user privacy data based on blockchain provided in one or more embodiments of this specification;

[0016] Figure 3 A second flow chart of a method for providing user privacy data based on blockchain provided in one or more embodiments of this specification;

[0017] Figure 4 A third flow chart of a method for providing user privacy data based on blockchain provided in one or more embodiments of this specification;

[0018] Figure 5 A first schematic diagram of a multi-terminal interaction process involved in a method for providing user privacy data based on blockchain provided in one or more embodiments of this specification;

[0019] Figure 6 A second schematic diagram of a multi-terminal interaction process involved in a method for providing user privacy data based on blockchain provided in one or more embodiments of this specification;

[0020] Figure 7 A schematic diagram of the first module composition of a blockchain-based user privacy data providing device provided in one or more embodiments of this specification;

[0021] Figure 8 A schematic diagram of the second module composition of the device for providing user privacy data based on blockchain provided in one or more embodiments of this specification;

[0022] Fig. 9 A schematic diagram of the structure of a device for providing user privacy data based on blockchain provided in one or more embodiments of this specification. DETAILED DESCRIPTION

[0023] In order to enable persons skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only one or more partial embodiments of this specification, rather than all embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0024] It should be noted that, in the absence of conflict, one or more embodiments and features in the embodiments in this specification can be combined with each other. One or more embodiments of this specification will be described in detail below with reference to the drawings and in combination with the embodiments.

[0025] One or more embodiments of the present specification provide a method and device for providing user privacy data based on blockchain. Whether it is the data chain-up stage of user privacy data or the data consumption stage of user privacy data, the corresponding data processing is performed with the help of the trusted execution environment TEE built in the node of the blockchain, and the user privacy data is transmitted in the form of encrypted data during the data transmission process, and the user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer, so as to realize the external provision of user privacy data consumption services. This can ensure the security of user privacy data during the data transmission process, and ensure the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in a specified industry from the whole link, thereby improving the security level of user privacy data related to the user's personal experience in the specified industry.

[0026] Figure 1 A schematic diagram of an application scenario of a blockchain-based user privacy data providing system provided in one or more embodiments of this specification, such as Figure 1 As shown, the system includes: a data holder, a data consumer, a data providing node and at least one blockchain node in the blockchain, wherein a trusted execution environment TEE (Trusted Execution Environment) is provided in the blockchain node, that is, the blockchain node is provided with trusted hardware that provides a safer space for the execution of data and code; wherein the data holder and the data consumer can be a mobile terminal such as a smart phone, a tablet computer, etc. used by the target user, or a terminal device such as a computer used by the target organization, the data providing node can be an independent server, or a server cluster composed of multiple servers, the data providing node can be any blockchain node in the blockchain, or an external trusted node outside the blockchain node; wherein, considering that there may be data holders and data consumers who do not have the ability to directly connect with the blockchain node, therefore, preferably, the data providing node is an external trusted node that interacts with the blockchain node for data, so as to upload the user's private data information to the chain and provide external consumption services for the user's private data, thus shielding the complex interaction process between the data holder and the data consumer and the blockchain, and providing safe, reliable, convenient and simplified data provision services for the data holder and the data consumer.

[0027] In specific implementation, any of the data holders, data consumers, data provider nodes, and blockchain nodes in the blockchain can set up a trusted execution environment TEE and install a trusted application. For any terminal device or server that sets up a trusted execution environment TEE and installs a trusted application, the externally transmitted data can be obtained through the trusted application, and the obtained data can be passed to the local trusted execution environment TEE through the trusted application. Data can also be sent to other terminal devices or servers through the trusted application. Taking the blockchain node that sets up a trusted execution environment TEE and installs a trusted application as an example, for the process of putting user privacy data on the chain, the blockchain node receives the user privacy data to be put on the chain in the form of ciphertext sent by the data provider node through the trusted application, and passes the user privacy data to be put on the chain to the local trusted execution environment TEE, so that the user privacy data can be put on the chain in the trusted execution environment TEE. Similarly, for data provision nodes that set up a trusted execution environment TEE and install trusted applications, it is also possible to receive user privacy data to be uploaded to the chain in encrypted form sent by the data holder through the trusted application, and pass the user privacy data to be uploaded to the local trusted execution environment TEE, so that the user privacy data can be processed accordingly in the trusted execution environment TEE, for example, decryption, security verification, encryption, etc.

[0028] based on Figure 1The application scenario diagram of the blockchain-based user privacy data provision system in FIG. 1 is a diagram showing the application scenario of the blockchain-based user privacy data provision system. Taking the data provision node as an external trusted node other than the blockchain node as an example, the blockchain-based user privacy data provision process specifically includes:

[0029] The data holder sends a privacy data notarization request of the target user to the data providing node, wherein the privacy data notarization request carries the first encrypted data, and the first encrypted data includes the user privacy data to be uploaded to the chain, and the user privacy data may include: the personal data generated by the target user in the designated industry. Taking the designated industry as the education industry as an example, the data holders include: the school attended by the user, the training institution attended by the user, the professional examination authority, and the Human Resources and Social Security Bureau of each province and city. Correspondingly, the user privacy data may include: user behavior data used to characterize the educational experience of the target user, for example, at least one of the school information attended by the target user at each stage, the training course information participated in, the certificate information obtained, and the score information of each examination taken.

[0030] The data providing node receives a privacy data storage request from a data holder; wherein the first encrypted data carried in the storage request is obtained by encrypting the plaintext user privacy data using an envelope encryption method.

[0031] The data providing node transmits the user private data to be uploaded to the chain to the trusted execution environment TEE based on the first encrypted data carried in the private data notarization request; wherein the TEE is built in at least one blockchain node in the blockchain, and a first smart contract is deployed in the blockchain.

[0032] At least one blockchain node in the blockchain performs on-chain processing on the user privacy data of the target user in the corresponding trusted execution environment TEE through the first smart contract deployed in the blockchain, so as to store the user privacy data of the target user in the trusted execution environment TEE.

[0033] The data providing node receives a data consumption request sent by a data consumer after the user privacy data of the target user is stored in the trusted execution environment TEE; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in at least one blockchain node in the blockchain.

[0034] The data providing node transmits the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain; wherein, a second smart contract is also deployed in the blockchain; specifically, the data providing node can encrypt the request body data using envelope encryption, and transmit the encrypted request body data to the trusted execution environment TEE in the blockchain to trigger the blockchain node to return the corresponding target privacy data.

[0035] At least one blockchain node in the blockchain, through a second smart contract deployed in the blockchain, performs a preset check on the data consumption request in the corresponding trusted execution environment TEE based on the request body data corresponding to the data consumption request, and obtains a corresponding preset check result; specifically, considering that the request body data transmitted by the data providing node to the trusted execution environment TEE may be encrypted using an envelope encryption method, correspondingly, the blockchain node needs to first decrypt the plaintext request body data, and then perform a corresponding check on the data consumption request based on the request body data to determine whether to return the target privacy data requested by the data consumer.

[0036] The data providing node obtains the target privacy data obtained from the data consumption request of the data consumer if the preset verification result satisfies the verification pass condition, and sends the encrypted target privacy data to the data consumer; wherein, the target privacy data is obtained by the blockchain node in the trusted execution environment TEE when determining that the preset verification result satisfies the verification pass condition and is based on the user privacy data stored in the blockchain. Correspondingly, the blockchain node sends the encrypted target privacy data to the data providing node, so that the data providing node returns the target privacy data to the data consumer.

[0037] In the above application scenarios, in the process of providing target users' privacy data consumption services to the outside, whether it is the data chain-up stage for user privacy data or the data consumption stage for user privacy data, the trusted execution environment TEE built in the node of the blockchain is used to perform corresponding data processing, and the user privacy data is transmitted in the form of encrypted data during the data transmission process, and the user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer, so as to realize the external provision of user privacy data consumption services, which can ensure the security of user privacy data during data transmission and the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in the specified industry from the whole link, thereby improving the security level of user privacy data related to the user's personal experience in the specified industry; and, through the blockchain, all personal data of the target user in the specified industry are associated and integrated, so that it is convenient to provide the user privacy data of the user at any time node to the data consumer, and on the premise of ensuring the security of the user privacy data, the efficiency of providing user privacy data is also improved.

[0038] Figure 2 A first flow chart of a method for providing user privacy data based on blockchain provided in one or more embodiments of this specification, such as Figure 2 As shown, the method comprises at least the following steps:

[0039] S202, receiving a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for user privacy data of a target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to a trusted execution environment TEE, and the TEE is built in a node of a blockchain;

[0040] Among them, taking the education industry as an example, the above-mentioned user privacy data may include: user behavior data used to characterize the educational experience of the target user; for example, at least one of the following information: the school information attended by the target user at each stage, the training course information participated in, the training institution information, the certificate information obtained, and the score information of various examinations taken.

[0041] The above-mentioned blockchain can be a public chain or a consortium chain. Preferably, the above-mentioned blockchain is a consortium chain. The members joining the consortium chain may include: relevant users or institutions under the specified industry, data providing nodes, wherein the relevant users or institutions under the specified industry may be data trustees, data authenticators, data holders, data consumers, etc., forming a user privacy data on-chain and consumption service network; wherein, the user or institution joining the consortium chain may have multiple roles, for example, an institution may be a data holder, a data consumer, a data authenticator or a data trustee. Further, in order to ensure the security of data, only users or institutions joining the consortium chain are provided with data on-chain services or data consumption services, wherein a unique on-chain account is assigned to each user or institution joining the consortium chain, and the unique on-chain account is used to represent the unique identity information of the user or institution joining the consortium chain, and then the corresponding user privacy data on-chain service or user privacy data consumption service is provided to it based on the unique on-chain account of each consortium chain member; in addition, the above-mentioned data providing node may be any data trustee joining the consortium chain.

[0042] S204, performing a preset check on the data consumption request in the trusted execution environment TEE based on the request body data corresponding to the data consumption request through the smart contract deployed in the blockchain, and obtaining a corresponding preset check result; wherein the preset check includes: at least one of: data privacy attribute check, data trusteeship relationship check, data authorization relationship check, and consumption request type check;

[0043] In specific implementation, if the data privacy level is lower than or equal to the first preset privacy level, the preset verification includes: data privacy attribute verification, data custody relationship verification; if the data privacy level is higher than the first preset privacy level and lower than the second preset privacy level, the preset verification includes: data privacy attribute verification, data custody relationship verification and data authorization relationship verification; if the data privacy level is higher than or equal to the second preset privacy level, the preset verification includes: data privacy attribute verification, data custody relationship verification, data authorization relationship verification and consumption request type verification.

[0044] Specifically, in the case where the data providing node is an external trusted node, after receiving the data consumption request sent by the data consumer, the data providing node passes the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain, so that at least one blockchain node in the blockchain performs a preset verification on the data consumption request based on the request body data in the trusted execution environment TEE through the smart contract deployed in the blockchain, and obtains the corresponding preset verification result.

[0045] Furthermore, in order to facilitate the blockchain node to quickly perform preset verification on the data consumption request, the request body data corresponding to the above data consumption request is determined based on the original request body data carried in the data consumption request and the unique on-chain account of each member in the alliance chain; specifically, the data providing node first determines the target request body data according to the original request body data carried in the data consumption request; and then transmits the target request body data to the trusted execution environment TEE in the blockchain, so that at least one blockchain node in the blockchain performs preset verification on the data consumption request based on the target request body data in the trusted execution environment TEE through the smart contract deployed in the blockchain, and obtains the corresponding preset verification result;

[0046] The original request body data includes at least one of the identification information of the data consumer, the identification information of the target user, and the identification information of the data to be consumed. For example, the identification information of the target user may include at least one of the student ID, ID card, and name of the target user; the identification information of the data to be consumed may include at least one of the effective time period, category, and data source information of the user's privacy data; correspondingly, the target request data may include at least one of the unique on-chain account of the data consumer, the unique on-chain account of the data holder of the data to be consumed, the unique on-chain account of the data custodian, and the identification information of the data to be consumed;

[0047] For example, data consumer AA needs to query the academic performance of a student with student ID aaaa in the first semester of XXX University, where the student can authorize the data consumer AA with his / her education-related data during college, and XXX University can host the student data to institution YYY; correspondingly, the original request body data includes the data consumer's identifier AA, the student ID aaaa of the target user, the effective time period of the user privacy data to be consumed is the first semester of college, the category is academic performance, and the data source information is XXX University; the target request data may include at least one of the unique on-chain account of the data consumer AA, the unique on-chain account of XXX University, the data holder of the data to be consumed, the unique on-chain account of the data custodian YYY, the identification information of the target user, and the identification information of the data to be consumed.

[0048] Specifically, the above-mentioned preset verification may include: at least one of: data privacy attribute verification, custody relationship verification, and authorization relationship verification. The smart contract deployed in the blockchain includes preset verification rules, and the preset verification for data consumption requests is automatically completed through the smart contract, and then it is determined whether to return the target privacy data to the data consumer based on the preset verification results.

[0049] S206: If the preset verification result meets the verification pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein, the target privacy data is obtained in the trusted execution environment TEE based on the above-mentioned user privacy data stored in the blockchain.

[0050] Among them, the above-mentioned data consumption request includes: data query request, data verification request, or data proof request; correspondingly, the above-mentioned target privacy data can be the user privacy data requested by the data consumer to query, or it can be the authenticity result of the user privacy data requested by the data consumer to verify, or it can be the proof information of the user privacy data requested by the data consumer to prove.

[0051] Specifically, in the case where the data providing node is an external trusted node, after determining that the preset verification result meets the verification pass condition, at least one blockchain node in the blockchain determines the target privacy data corresponding to the data consumption request of the data consumer, and sends the encrypted target privacy data to the data providing node; the data providing node receives the target privacy data returned by the blockchain node, and returns the target privacy data to the data consumer.

[0052] In one or more embodiments of the present specification, whether it is the data uploading stage of user privacy data or the data consumption stage of user privacy data, the corresponding data processing is performed with the help of the trusted execution environment TEE built in the node of the blockchain, and the user privacy data is transmitted in the form of encrypted data during the data transmission process, and the user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer, so as to realize the external provision of user privacy data consumption services, which can ensure the security of user privacy data during the data transmission process and the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in the specified industry from the whole link, thereby improving the security level of user privacy data related to the user's personal experience in the specified industry.

[0053] Among them, the user privacy data is transmitted to the trusted execution environment TEE built in the node of the blockchain through the data providing node, so as to associate and store all the user privacy data of the target user that has been uploaded to the chain in the trusted execution environment TEE, thereby ensuring the comprehensiveness, integrity and security of the user privacy data of the target user. Specifically, for the data upload process of the user privacy data, such as Figure 3 As shown, before receiving the data consumption request sent by the data consumer in S202, the process further includes:

[0054] S208, receiving a private data storage request of a target user sent by a data holder; wherein the storage request carries first encrypted data, and the first encrypted data is obtained by encrypting the plaintext private data of the user by using an envelope encryption method;

[0055] The data holder may be a terminal device used by the target user, or may be a data authenticator that authenticates the user's privacy data. For example, if the user's privacy data is university grades, the data authenticator may be the university the user attends.

[0056] S210, based on the first encrypted data, delivering the user privacy data of the target user to a trusted execution environment TEE in a blockchain; wherein a first smart contract is deployed in the blockchain;

[0057] Specifically, after receiving a request for privacy data storage, the data providing node can directly pass the first encrypted data carried by the storage request to the trusted execution environment TEE in the blockchain, or it can first decrypt and verify the security of the first encrypted data, and then encrypt the user privacy data that passes the security verification and pass it to the trusted execution environment TEE in the blockchain, so that at least one blockchain node in the blockchain can process the user privacy data of the target user on the chain in the trusted execution environment TEE.

[0058] S212, through the first smart contract deployed in the blockchain, the user privacy data of the target user is processed on the chain in the trusted execution environment TEE; specifically, in the process of storing the user privacy data in the trusted execution environment TEE in the blockchain, the user privacy data is associated with the user privacy data of the target user that has been on the chain, so as to ensure the comprehensiveness, integrity and security of the user privacy data of the target user.

[0059] Specifically, in the case where the blockchain is a consortium chain, by establishing a consortium chain, users or institutions related to the specified industry are added to the consortium chain, so as to realize the integration of all relevant information of the specified industry; for example, if the data consumer is an employer, the employer needs to verify the information on the applicant's resume or query more personal information of the applicant. At this time, the employer can request the corresponding data consumption service from the data provider node, that is, send the corresponding data consumption request to the data provider node, so that the employer can quickly complete the data verification and query of the applicant, reducing the intermediate manpower consumption of multi-party communication and collaboration in the society; for example, if the applicant's resume involves personal information such as: which school student X graduated from, which institution participated in what training, and which company he works for, if the authenticity of the data needs to be verified, there is no need to request data verification from the three institutions of school, training institution, and historical employment company respectively, and the verification of all data can be completed by directly requesting data verification service from the data provider node.

[0060] Furthermore, considering that the user privacy data requested by the data holder to be uploaded to the chain may have certain risks, in order to further improve the security of private data on the chain, the user privacy data with risks is directly filtered out at the data providing node to prevent it from flowing into the trusted execution environment TEE. Based on this, Figure 4 As shown, the above S210, based on the above first encrypted data, transmits the user privacy data of the target user to the trusted execution environment TEE in the blockchain, specifically including:

[0061] S2101, decrypt the first encrypted data to obtain the user privacy data of the target user;

[0062] S2102, determining whether the decrypted user privacy data passes the security verification; wherein the security verification process may be performed by the trusted data providing node, or may be performed by a third-party server triggered by the trusted data providing node;

[0063] If the security check passes, S2103 is executed to generate second encrypted data based on the decrypted user privacy data; and S2104 is executed to transmit the second encrypted data to the trusted execution environment TEE in the blockchain; wherein the first smart contract is deployed in the blockchain;

[0064] If the security check fails, S2105 is executed to generate data abnormality prompt information indicating that the security check fails, and S2106 is executed to send the data abnormality prompt information to the data holder;

[0065] Correspondingly, the above S212, through the first smart contract deployed in the blockchain, processes the user privacy data of the target user on the chain in the trusted execution environment TEE, specifically including:

[0066] S2121, through the first smart contract deployed in the blockchain, in the trusted execution environment TEE, the user privacy data of the target user is processed on the chain based on the second encrypted data. Specifically, the blockchain node can obtain the user privacy data (such as the second encrypted data) transmitted in ciphertext form by the data providing node through the trusted application, and pass the user privacy data to the local trusted execution environment TEE.

[0067] Among them, TEE can be a trusted execution environment. TEE can be implemented by a program written in a predetermined programming language (that is, it can be implemented in the form of software). The trusted execution environment of TEE can be a data processing environment that is secure and isolated from other environments, that is, the processing performed in the trusted execution environment and the data generated during the data processing cannot be accessed by other execution environments or applications outside the executable environment. The trusted execution environment of TEE can be implemented by creating a small operating system that can run independently in a trusted area (such as TrustZone, etc.). TEE can directly provide services in the form of system calls (such as directly processed by the TrustZone kernel). TEE can perform processing such as uploading user privacy data to the chain or obtaining target privacy data through the provided interface, thereby ensuring that user privacy data (such as user education-related data, user payment-related data, etc.) will not be tampered with, passwords will not be hijacked, and fingerprints or facial information will not be stolen.

[0068] Among them, the trusted application can be a pre-designated trusted application that can be used to upload user privacy data to the chain or obtain target privacy data, such as a financial payment application, an instant messaging application or a pre-developed application, etc. The trusted application can be an application that needs to be installed in the terminal device or server, or a code program pre-implanted in a hardware device or server of the terminal device, or a program that runs in the background of the operating system of the terminal device or server in the form of a plug-in, etc. The specific settings can be based on actual conditions.

[0069] Among them, whether it is the stage of uploading user privacy data or the preset verification process in the consumption stage of user privacy data, the smart contract used can be pre-set in the TEE of the blockchain node. The smart contract may include a verification constraint for determining whether the preset verification result meets the verification, or includes a chain status determination condition for determining whether the private data is successfully uploaded to the chain. Therefore, in order to ensure the security and tamper-proof of the verification constraint and the chain status determination condition, the smart contract can be a ciphertext, that is, the smart contract can be encrypted or signed by a specified encryption or signature method to form the ciphertext of the smart contract, and then the ciphertext of the smart contract is transmitted to the trusted execution environment TEE of the blockchain node through a specified secure data transmission channel through a trusted application. In this feasible execution environment, the ciphertext of the smart contract can be decrypted or signed, and after determining that the verification constraint or chain status determination condition in the smart contract has not been tampered with, the smart contract can be stored in the TEE.

[0070] In the specific implementation, by setting up a trusted application for executing user privacy data on-chain, target privacy data acquisition, or user privacy data processing, the security of user privacy data can be further ensured, and user privacy data can be transferred through the trusted application, and temporary protection can be performed on the user privacy data to be transferred to the chain or the target privacy data to be returned to the data consumer, so as to protect the data. In addition, not only can the trusted application be installed in the blockchain node, but also the corresponding trusted application can be installed in the data providing node, and the trusted execution environment TEE can be set. The trusted application can be pre-set with a security interface, and correspondingly, the TEE of the blockchain node or the data providing node can also be set with a corresponding security interface. Through the security interface between the trusted application and the TEE, a secure data transmission channel can be established between the trusted application and the TEE. The trusted application can transfer the user privacy data to the TEE of the blockchain node or the data providing node through the above-mentioned security interface and data transmission channel. The security of the user privacy data in the process of data on-chain or data consumption can be guaranteed by setting the above-mentioned trusted application, security interface and data transmission channel.

[0071] It should be noted that trusted applications may include multiple types. Corresponding trusted applications can be set according to the privacy level of user privacy data, the data content or data type of user privacy data, or different users corresponding to user privacy data. In actual applications, how to set up trusted applications can be based on actual conditions, and the embodiments of this specification do not limit this.

[0072] Among them, in order to further provide the security of user privacy data, a trusted execution environment TEE can also be set in the data providing node. Correspondingly, all data processing processes of the data providing node are carried out in the trusted execution environment TEE; specifically, the data holder transmits the first encrypted data in the privacy data notarization request to the data providing node through a trusted application, and the data providing node generates second encrypted data based on the first encrypted data in the local trusted execution environment TEE, and transmits the second encrypted data to the trusted execution environment TEE in the blockchain.

[0073] The first encrypted data may include: first ciphertext privacy data obtained by encrypting user privacy data using a first symmetric key, and a first ciphertext key obtained by encrypting the first symmetric key using a first public key;

[0074] Correspondingly, the above S2101 decrypts the above first encrypted data to obtain the user privacy data of the target user, which specifically includes:

[0075] Step 1: Decrypt the first ciphertext key using the first private key corresponding to the first public key to obtain a first symmetric key;

[0076] Step 2: Use the first symmetric key obtained by decryption to decrypt the first ciphertext private data to obtain the user private data of the target user.

[0077] Specifically, the first symmetric key is a symmetric key automatically generated by the data holder using the preset SDK; the first public key and the first private key are a pair of asymmetric keys generated for the data providing node, wherein the first public key is issued to the data holder, and the first private key is stored locally at the data providing node, so that the data holder uses the first public key to encrypt the data, and correspondingly, the data providing node uses the first private key to decrypt the encrypted data to obtain plaintext data. Since the first private key is only stored locally at the data providing node, only the data providing node can decrypt the plaintext data of the data encrypted by the data holder using the first public key.

[0078] After decrypting the first encrypted data to obtain the plaintext user privacy data, first perform a security check on the user privacy data, then encrypt the user privacy data that passes the security check, and upload the encrypted user privacy data to the blockchain. Based on this, the above S2103 generates the second encrypted data based on the decrypted user privacy data, specifically including:

[0079] Step 1: Use the second symmetric key to encrypt the user privacy data of the target user to obtain second ciphertext privacy data;

[0080] Step 2: Use the second public key to encrypt the second symmetric key to obtain a second ciphertext key;

[0081] Step three: Generate second encrypted data based on the second ciphertext privacy data and the second ciphertext key.

[0082] Specifically, the second symmetric key is a symmetric key automatically generated by the data providing node using a preset SDK, and the second public key and the second private key are a pair of asymmetric keys generated for the blockchain, wherein the second public key is issued to the data providing node, and the second private key is stored locally in the blockchain node. In this way, the data providing node uses the second public key to encrypt data, and correspondingly, the blockchain node uses the second private key to decrypt the encrypted data to obtain plaintext data. Since the second private key is only stored locally in the blockchain node, only the blockchain node can decrypt the plaintext data of the data encrypted by the data providing node using the second public key.

[0083] Among them, after the data providing node uploads the second encrypted data to the blockchain, the blockchain node needs to first decrypt the second encrypted data, and then process the decrypted user privacy data on the chain. Based on this, the above S2121, through the first smart contract deployed in the blockchain, processes the user privacy data of the target user on the chain based on the second encrypted data in the trusted execution environment TEE, specifically including:

[0084] Step 1: Decrypting the second ciphertext key in the second encrypted data using the second private key corresponding to the second public key in the trusted execution environment TEE through the first smart contract deployed in the blockchain to obtain a second symmetric key; and

[0085] Step 2: Decrypt the second ciphertext privacy data in the second encrypted data using the second symmetric key obtained by decryption to obtain the user privacy data of the target user; and

[0086] Step three: Store the target user's privacy data in the trusted execution environment TEE in the blockchain.

[0087] Furthermore, considering that there may be a situation where data on-chain fails, in order to avoid the problem that the target user's user privacy data is missing or incomplete due to the failure of data on-chain due to network anomalies or blockchain node anomalies, a data on-chain status feedback mechanism is added. Specifically, in S212, after the target user's user privacy data is on-chained in the trusted execution environment TEE through the first smart contract deployed in the blockchain, it also includes:

[0088] Obtaining the data on-chain status information of the user's private data requested to be on-chain by the data holder; wherein the data on-chain status information includes: data on-chain success or data on-chain failure;

[0089] If the above-mentioned data on-chain status information indicates that the data on-chain has failed, the above-mentioned S212 is continued to be triggered to execute, and the user privacy data of the target user is processed on-chain in the trusted execution environment TEE through the first smart contract deployed in the blockchain, or an abnormal prompt message of on-chain is sent to the designated terminal.

[0090] Specifically, after the blockchain node processes the user's private data on the chain, it returns the data on-chain status information of the user's private data to the data providing node. After obtaining the data on-chain status information, the data providing node re-triggers the blockchain node to process the user's private data on the chain for the target user, thereby realizing a reliable on-chain service for user private data;

[0091] Furthermore, considering that the reasons for the failure of data on-chain are diverse, the above-mentioned data on-chain status information also includes: data on-chain execution data, the data providing node determines the reason for the failure of data on-chain based on the data on-chain execution data; if the reason for the failure of data on-chain is network abnormality, then continue to trigger the execution of the above-mentioned S212, and perform on-chain processing of the user privacy data of the target user in the trusted execution environment TEE through the first smart contract deployed in the blockchain; if the reason for the failure of data on-chain is blockchain node abnormality, then send a chain abnormality prompt message containing the identifier of the abnormal blockchain node to the designated terminal to trigger maintenance of the abnormal blockchain node.

[0092] In addition, the data providing node can also update the private data chain request status record based on the data chain status information of the user's private data, so as to serve as a basis for subsequent tracing.

[0093] In the privacy data consumption phase, the request body data may further include a third ciphertext key, where the third ciphertext key is obtained by encrypting the third symmetric key using the third public key;

[0094] Correspondingly, the above S206, sending the encrypted target private data to the data consumer, specifically includes:

[0095] Decrypting the third ciphertext key using a third private key corresponding to the third public key to obtain a third symmetric key;

[0096] Encrypting the target private data using the third symmetric key obtained by decryption to obtain encrypted target private data;

[0097] Send the encrypted target private data to the data consumer.

[0098] Specifically, the third symmetric key is a symmetric key automatically generated by the data consumer using the preset SDK; the third public key and the third private key are a pair of asymmetric keys generated for the data providing node, and the third public key and the third private key can be a unified pair of asymmetric keys with the first public key and the first private key, wherein the third public key is issued to the data consumer, and the third private key is stored locally at the data providing node, so that the data consumer uses the third public key to encrypt the data, and correspondingly, the data providing node uses the third private key to decrypt the encrypted data to obtain the plaintext data. Since the third private key is only stored locally at the data providing node, only the data providing node can decrypt the plaintext data of the data encrypted by the data consumer using the third public key.

[0099] Among them, for the process of performing preset verification on the data consumption request, the above S204 performs preset verification on the data consumption request in the trusted execution environment TEE through the smart contract deployed in the blockchain based on the request body data corresponding to the data consumption request, and obtains the corresponding preset verification result, which specifically includes:

[0100] Step 1: passing the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain; wherein a second smart contract is also deployed in the blockchain;

[0101] Step 2: Through the second smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the above request body data, a preset check is performed on the data consumption request of the data requester to obtain a corresponding preset check result.

[0102] Specifically, the above step 1, passing the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain, specifically includes:

[0103] Using the fourth symmetric key, encrypt the request body data corresponding to the data consumption request to obtain ciphertext request body data; wherein the request body data corresponding to the data consumption request may be target request body data determined by the data providing node based on the original request body data and the unique on-chain account of each member in the alliance chain;

[0104] Using the fourth public key, encrypt the fourth symmetric key to obtain a fourth ciphertext key;

[0105] The above-mentioned ciphertext request body data and the above-mentioned fourth ciphertext key are passed to the trusted execution environment TEE in the blockchain.

[0106] Specifically, the fourth symmetric key is a symmetric key automatically generated by the data providing node using a preset SDK, and the fourth public key and the fourth private key are a pair of asymmetric keys generated for the blockchain. The fourth public key and the fourth private key can be a unified pair of asymmetric keys with the second public key and the second private key, wherein the fourth public key is issued to the data providing node, and the fourth private key is stored locally in the blockchain node. In this way, the data providing node uses the fourth public key to encrypt data, and correspondingly, the blockchain node uses the fourth private key to decrypt the encrypted data to obtain plaintext data. Since the fourth private key is only stored locally in the blockchain node, only the blockchain node can decrypt the plaintext data of the data encrypted by the data providing node using the fourth public key.

[0107] Specifically, after the data providing node transmits the ciphertext request body data and the fourth ciphertext key as the request body data to the trusted execution environment TEE in the blockchain, in the above step 2, the second smart contract deployed in the blockchain performs a preset check on the data consumption request of the data requester in the trusted execution environment TEE based on the request body data, and obtains a corresponding preset check result, which specifically includes:

[0108] Decrypting the fourth ciphertext key in the trusted execution environment TEE using the fourth private key corresponding to the fourth public key through the second smart contract deployed in the blockchain to obtain a fourth symmetric key; and

[0109] Decrypting the ciphertext request body data using the fourth symmetric key obtained by decryption to obtain the plaintext request body data; and,

[0110] Based on the above plaintext request body data, a preset check is performed on the data consumption request of the data consumer to obtain a corresponding preset check result.

[0111] In addition, in the process of returning the target private data to the data providing node, the blockchain node can use the fourth symmetric key to encrypt the target private data and return the encrypted target private data to the data providing node; the data providing node uses the locally generated fourth symmetric key to decrypt the encrypted target private data to obtain the plaintext target private data, and then uses the decrypted third symmetric key to encrypt the plaintext target private data to obtain the encrypted target private data; and sends the encrypted target private data to the data consumer.

[0112] Among them, in order to further provide the security of user privacy data, a trusted execution environment TEE can also be set in the data provider node. Correspondingly, all data processing processes of the data provider node are carried out in the trusted execution environment TEE; specifically, the blockchain node transmits the encrypted target privacy data to the data provider node through the trusted application, and the data provider node decrypts and encrypts the encrypted target privacy data in the local trusted execution environment TEE to obtain the target privacy data encrypted by the third symmetric key, and then sends the encrypted target privacy data to the data consumer.

[0113] Specifically, for the process of performing a preset check on the data consumption request of the data consumer, the above-mentioned request body data based on the plain text performs a preset check on the data consumption request of the data consumer to obtain a corresponding preset check result, specifically including:

[0114] Verify the data privacy attribute of the user privacy data targeted by the data consumption request of the data consumer to obtain a first verification result; wherein the first verification result includes the privacy level of the user privacy data; specifically, determine the data privacy attribute of the user privacy data targeted by the data consumption request based on the identification information of the data to be consumed in the plaintext request body data;

[0115] Based on the pre-stored data trusteeship record, verify whether there is a trusteeship relationship between the data holder of the user's private data and the data trustee, and obtain a second verification result; wherein, the data trusteeship record includes multiple data trusteeship relationship records, and the data trusteeship relationship record may be uploaded to the blockchain by the data providing node in advance based on the authorization agreement signed by the data holder and the data trustee; the data trustee may be at least one member of the alliance chain, that is, whether the data holder has signed a trusteeship agreement with at least one member of the alliance chain in advance; specifically, based on the pre-stored data trusteeship record, the unique on-chain account of the data holder of the data to be consumed in the plaintext request body data, the unique on-chain account of the data trustee, and the identification information of the data to be consumed, determine whether there is a trusteeship relationship between the data holder of the user's private data and the data trustee;

[0116] Based on the pre-stored data authorization record, verify whether there is an authorization relationship between the data consumer and the data holder of the above user privacy data, and obtain a third verification result; wherein, the data authorization record includes multiple data authorization relationship records, and the data authorization relationship record may be uploaded to the blockchain by the data providing node in advance based on the authorization agreement signed by the data consumer and the data holder; specifically, based on the pre-stored data authorization record, the unique on-chain account of the data holder of the data to be consumed in the plaintext request body data, the unique on-chain account of the data consumer, and the identification information of the data to be consumed, determine whether there is an authorization relationship between the data consumer and the data holder of the user privacy data;

[0117] Determine a preset verification result obtained for the data consumption request according to at least one of the first verification result, the second verification result, the third verification result and the type of the data consumption request;

[0118] In specific implementation, the data privacy level verification has the highest priority, that is, the privacy level of the user privacy data targeted by the data consumption request is given priority.

[0119] Specifically, the determining of the preset verification result obtained for the data consumption request according to at least one of the first verification result, the second verification result, the third verification result and the type of the data consumption request specifically includes:

[0120] According to the first verification result, determining whether the data privacy level is lower than or equal to the first preset privacy level;

[0121] If the privacy level is lower than or equal to the first preset privacy level, determining a preset verification result obtained for the data consumption request according to the first verification result and the third verification result;

[0122] If it is higher than the first preset privacy level, determining whether the data privacy level is higher than or equal to the second preset privacy level;

[0123] If it is higher than or equal to the second preset privacy level, determining a preset verification result obtained for the data consumption request according to the first verification result, the second verification result, the third verification result and the type of the data consumption request;

[0124] If it is higher than the first preset privacy level and lower than the second preset privacy level, the preset verification result obtained for the above data consumption request is determined according to the first verification result, the second verification result, and the third verification result.

[0125] After determining the preset verification result, determine whether the preset verification result meets any preset verification constraint condition. If so, determine that the preset verification result meets the verification pass condition, that is, allow the data consumer to obtain the required target privacy data.

[0126] The above verification constraint conditions may include at least one of the following:

[0127] (1) The data privacy level is higher than the first preset privacy level and lower than the second preset privacy level, and there is an authorization relationship or a trusteeship relationship;

[0128] (2) The data privacy level is higher than or equal to the second preset privacy level, the target request type is a data verification request, an authorization relationship exists, or a trusteeship relationship exists;

[0129] (3) The data privacy level is lower than or equal to the first preset privacy level and there is a trusteeship relationship;

[0130] For example, the first preset privacy level is level 0, and the second preset privacy level is level 2. If the data privacy level of the user's private data is level 1, the data consumer has an authorization relationship with the data holder, and the data holder has a trusteeship relationship with any data trustee, then it is determined that the preset verification result meets the verification pass condition;

[0131] If the data privacy level of the user's private data is level 2, the data consumption request is a data verification request, the data consumer has an authorization relationship with the data holder, and the data holder has a trusteeship relationship with any data trustee, then it is determined that the preset verification result meets the verification pass condition;

[0132] If the data privacy level of the user's private data is level 0, and the data holder has a trusteeship relationship with any data trustee, it is determined that the preset verification result meets the verification pass condition;

[0133] Among them, in the case where the data privacy level is higher than or equal to the second preset privacy level and the type of data consumption request is a query request, it is determined that the preset verification result does not meet the verification pass condition, and the data providing node sends feedback information of not responding to the data consumption request to the data consumer, so that the data consumer provides the user privacy data to be verified.

[0134] That is to say, if the privacy level of the user privacy data targeted by the data consumption request is higher than the first preset privacy level and lower than the second preset privacy level, the data consumer is allowed to query the authorized user privacy data, that is, the data consumer can obtain the plaintext user privacy data; if the privacy level of the user privacy data targeted by the data consumption request is higher than or equal to the second preset privacy level, a verification service for known user privacy data is provided to the data consumer. Specifically, the data consumer is required to provide a user privacy data, and then the user privacy data carried in the data consumption request is compared and verified with the real privacy data uploaded to the blockchain in advance, and the verification result of the user privacy data carried in the data consumption request is returned to the data consumer, that is, the data consumer cannot obtain the plaintext data of the user privacy data with a higher privacy level from the blockchain; if the privacy level of the user privacy data targeted by the data consumption request is lower than or equal to the first preset privacy level, the user privacy data is public data, and the query service of the user privacy data can be provided to the outside without authorization.

[0135] In a specific embodiment, taking the data interaction between an external trusted node and a blockchain node and the on-chain processing of the user privacy data sent by the data holder as an example, the data on-chain process of the user privacy data is as follows: Figure 5 As shown, specifically including:

[0136] S501, the data holder uses the first symmetric key to encrypt the user private data to be uploaded to the chain to obtain the first ciphertext private data;

[0137] S502, the data holder encrypts the first symmetric key using the first public key to obtain a first ciphertext key;

[0138] S503, the data holder sends a private data evidence storage request carrying the first ciphertext private data and the first ciphertext key to the data providing node;

[0139] S504, the data providing node uses the first private key corresponding to the first public key to decrypt the first ciphertext key to obtain a first symmetric key;

[0140] S505, the data providing node decrypts the first ciphertext private data using the first symmetric key obtained by decryption to obtain the plaintext user private data of the target user;

[0141] S506, if the security check on the plaintext user privacy data passes, the data providing node uses the second symmetric key to encrypt the user privacy data of the target user to obtain second ciphertext privacy data;

[0142] S507, the data providing node encrypts the second symmetric key using the second public key to obtain a second ciphertext key;

[0143] S508, the data providing node transmits the second ciphertext privacy data and the second ciphertext key to the trusted execution environment TEE in the blockchain to call the smart contract deployed in the blockchain to upload the data to the blockchain;

[0144] S509, the blockchain node, in the trusted execution environment TEE, uses the second private key corresponding to the second public key to decrypt the second ciphertext key to obtain a second symmetric key; and

[0145] S510, the blockchain node decrypts the second ciphertext private data using the second symmetric key obtained by decryption to obtain the user private data of the target user; and

[0146] S511, the blockchain node stores the target user's private data in the trusted execution environment TEE in the blockchain; and

[0147] S512, the blockchain node generates data on-chain receipt information for the user's private data through the first smart contract deployed in the blockchain, and encrypts the data on-chain receipt information using the second symmetric key to obtain the encrypted data on-chain receipt information;

[0148] S513, the blockchain node returns the encrypted data on-chain receipt information to the data providing node, so that the data providing node updates the on-chain execution status of the user's private data based on the data on-chain receipt information decrypted using the second symmetric key, wherein the on-chain execution status includes: on-chain success or on-chain failure.

[0149] Correspondingly, taking the data interaction between external trusted nodes and blockchain nodes to provide data consumers with user privacy data query services as an example, the data consumption process of user privacy data, such as Figure 6 As shown, specifically including:

[0150] S601, the data consumer encrypts the third symmetric key using the third public key to obtain a third ciphertext key, and obtains the original request body data based on the third ciphertext key;

[0151] S602, the data consumer sends a data consumption request carrying original request body data to the data providing node;

[0152] S603: The data providing node encrypts the request body data corresponding to the data consumption request obtained based on the original request body data by using the fourth symmetric key to obtain ciphertext request body data.

[0153] S604, the data providing node encrypts the fourth symmetric key using the fourth public key to obtain a fourth ciphertext key;

[0154] S605, the data providing node transmits the ciphertext request body data and the fourth ciphertext key to the trusted execution environment TEE in the blockchain, so as to call the smart contract deployed in the blockchain to obtain the corresponding target private data;

[0155] S606, the blockchain node, in the trusted execution environment TEE, uses the fourth private key corresponding to the fourth public key to decrypt the fourth ciphertext key to obtain a fourth symmetric key; and

[0156] S607, the blockchain node uses the fourth symmetric key obtained by decryption to decrypt the ciphertext request body data to obtain the plaintext request body data; and

[0157] S608, the blockchain node performs a preset check on the data consumption request of the data consumer based on the plaintext request body data through the second smart contract deployed in the blockchain, and obtains a corresponding preset check result; wherein the preset check includes: at least one of: data privacy attribute check, data trusteeship relationship check, and data authorization relationship check;

[0158] S609, the blockchain node obtains the target privacy data corresponding to the data consumption request if the preset verification result meets the verification pass condition;

[0159] S610, the blockchain node sends the target private data encrypted by using the fourth symmetric key to the data providing node;

[0160] S611, the data providing node decrypts the encrypted target private data using the local fourth symmetric key to obtain the plaintext target private data;

[0161] S612, the data providing node sends the target private data obtained by encrypting the plaintext target private data using the third symmetric key to the data consumer; wherein the third symmetric key is obtained by decrypting the third ciphertext key using the third private key corresponding to the third public key;

[0162] S613, the data consumer uses the local third symmetric key to decrypt the encrypted target private data to obtain the plain text target private data.

[0163] The method for providing user privacy data based on blockchain in one or more embodiments of this specification receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request of the data consumer is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain. Whether it is the data uploading stage or the data consumption stage of user privacy data, the corresponding data processing is performed with the help of the trusted execution environment TEE built in the node of the blockchain, and the data is transmitted in the form of encrypted data during the data transmission process. The user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer to provide external consumption services for user privacy data. This can not only ensure the security of user privacy data during data transmission, but also ensure the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in designated industries from the entire link, thereby improving the security level of user privacy data related to the user's personal experience in the designated industry.

[0164] Corresponding to the above Figures 2 to 6 The method for providing user privacy data based on blockchain described above is based on the same technical concept. One or more embodiments of this specification also provide a device for providing user privacy data based on blockchain. Figure 7 A schematic diagram of the first module composition of a blockchain-based user privacy data providing device provided in one or more embodiments of this specification, the device is used to execute Figures 2 to 6 The method for providing user privacy data based on blockchain is described as follows: Figure 7 As shown, the device comprises:

[0165] A consumption request acquisition module 702 receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for user privacy data of a target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to a trusted execution environment TEE, and the TEE is built in a node of a blockchain;

[0166] An information verification module 704 performs a preset verification on the data consumption request in the trusted execution environment TEE through the smart contract deployed in the blockchain based on the request body data corresponding to the data consumption request to obtain a corresponding preset verification result;

[0167] The data providing module 706 obtains the target privacy data obtained for the data consumption request if the preset verification result meets the verification pass condition, and sends the encrypted target privacy data to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

[0168] Alternatively, if Figure 8 As shown, the device also includes:

[0169] The on-chain request acquisition module 708 receives a private data storage request of a target user sent by a data holder; wherein the storage request carries first encrypted data, and the first encrypted data is obtained by encrypting the plaintext user private data using an envelope encryption method;

[0170] A first data transmission module 710, which transmits the user privacy data to a trusted execution environment TEE in the blockchain based on the first encrypted data; wherein a first smart contract is deployed in the blockchain;

[0171] The data on-chain module 712 performs on-chain processing on the user's privacy data in the trusted execution environment TEE through the first smart contract.

[0172] Optionally, the first data transmission module 710:

[0173] Decrypting the first encrypted data to obtain the user privacy data of the target user;

[0174] Determining whether the decrypted user privacy data passes the security verification;

[0175] If the security check passes, generating second encrypted data based on the user privacy data;

[0176] The second encrypted data is passed to the trusted execution environment TEE in the blockchain.

[0177] Optionally, the first encrypted data includes: first ciphertext privacy data obtained by encrypting user privacy data using a first symmetric key, and a first ciphertext key obtained by encrypting the first symmetric key using a first public key;

[0178] Correspondingly, the first data transmission module 710:

[0179] Using a first private key corresponding to the first public key, decrypting the first ciphertext key to obtain the first symmetric key;

[0180] The first ciphertext private data is decrypted using the first symmetric key to obtain the user private data.

[0181] Optionally, the first data transmission module 710:

[0182] Using a second symmetric key, encrypting the user privacy data of the target user to obtain second ciphertext privacy data;

[0183] Using the second public key, encrypting the second symmetric key to obtain a second ciphertext key;

[0184] Second encrypted data is generated based on the second ciphertext private data and the second ciphertext key.

[0185] Optionally, the data uplink module 712:

[0186] Decrypting the second ciphertext key in the trusted execution environment TEE using the second private key corresponding to the second public key through the first smart contract to obtain the second symmetric key; and

[0187] Using the second symmetric key, decrypting the second ciphertext private data to obtain the user private data; and,

[0188] The user privacy data is stored in the trusted execution environment TEE in the blockchain.

[0189] Optionally, the device further comprises:

[0190] The abnormality feedback module generates data abnormality prompt information indicating that the security check fails if the security check on the user privacy data fails, and sends the data abnormality prompt information to the data holder.

[0191] Optionally, the device further comprises:

[0192] An on-chain status acquisition module, which acquires the on-chain status information of the user's private data;

[0193] The on-chain abnormality response module continues to trigger the execution of the step of on-chain processing of the user's private data through the first smart contract in the trusted execution environment TEE if the data on-chain status information is that the data on-chain has failed, or sends an on-chain abnormality prompt message to the designated terminal.

[0194] Optionally, the request body data includes a third ciphertext key, where the third ciphertext key is obtained by encrypting a third symmetric key using a third public key;

[0195] The data providing module 706:

[0196] Decrypting the third ciphertext key using a third private key corresponding to the third public key to obtain the third symmetric key;

[0197] Encrypting the target private data using the third symmetric key to obtain encrypted target private data;

[0198] The encrypted target private data is sent to the data consumer.

[0199] Optionally, the device further comprises:

[0200] A second data transmission module 714 transmits the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain; wherein a second smart contract is also deployed in the blockchain;

[0201] Correspondingly, the information verification module 704 performs a preset verification on the data consumption request based on the request body data in the trusted execution environment TEE through the second smart contract to obtain a corresponding preset verification result.

[0202] Optionally, the second data transmission module 714:

[0203] Using a fourth symmetric key, encrypting the request body data corresponding to the data consumption request to obtain ciphertext request body data;

[0204] Using the fourth public key, encrypting the fourth symmetric key to obtain a fourth ciphertext key;

[0205] The ciphertext request body data and the fourth ciphertext key are passed to the trusted execution environment TEE in the blockchain.

[0206] Optionally, the information verification module 704:

[0207] Decrypting the fourth ciphertext key in the trusted execution environment TEE using the fourth private key corresponding to the fourth public key through the second smart contract to obtain a fourth symmetric key; and

[0208] Decrypting the ciphertext request body data using the fourth symmetric key to obtain plaintext request body data; and

[0209] Based on the plaintext request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

[0210] Optionally, the information verification module 704:

[0211] Verifying the data privacy attribute of the user privacy data targeted by the data consumption request to obtain a first verification result;

[0212] Based on the pre-stored data trusteeship record, verify whether a trusteeship relationship exists between the data holder of the user's private data and the data trustee, and obtain a second verification result;

[0213] Based on the pre-stored data authorization record, verify whether there is an authorization relationship between the data consumer and the data holder to obtain a third verification result;

[0214] According to at least one of the first verification result, the second verification result and the third verification result, a preset verification result obtained for the data consumption request is determined.

[0215] Optionally, the user privacy data includes: user behavior data for characterizing the educational experience of the target user.

[0216] The user privacy data providing device based on blockchain in one or more embodiments of this specification receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request of the data consumer is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain. Whether it is the data uploading stage or the data consumption stage of user privacy data, the corresponding data processing is performed with the help of the trusted execution environment TEE built in the node of the blockchain, and the data is transmitted in the form of encrypted data during the data transmission process. The user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer to provide external consumption services for user privacy data. This can not only ensure the security of user privacy data during data transmission, but also ensure the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in designated industries from the entire link, thereby improving the security level of user privacy data related to the user's personal experience in the designated industry.

[0217] It should be noted that the embodiment of the user privacy data providing device based on blockchain in this specification and the embodiment of the user privacy data providing method based on blockchain in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the corresponding user privacy data providing method based on blockchain, and the repeated parts will not be repeated.

[0218] Furthermore, corresponding to the above Figures 2 to 6 Based on the same technical concept, one or more embodiments of this specification also provide a user privacy data providing device based on blockchain, which is used to execute the above-mentioned user privacy data providing method based on blockchain, such as Fig. 9 shown.

[0219] The user privacy data providing device based on blockchain may have relatively large differences due to different configurations or performances, and may include one or more processors 901 and memory 902, and one or more storage applications or data may be stored in the memory 902. Among them, the memory 902 may be a short-term storage or a persistent storage. The application stored in the memory 902 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the user privacy data providing device based on blockchain. Furthermore, the processor 901 may be configured to communicate with the memory 902, and execute a series of computer executable instructions in the memory 902 on the user privacy data providing device based on blockchain. The user privacy data providing device based on blockchain may also include one or more power supplies 903, one or more wired or wireless network interfaces 904, one or more input and output interfaces 905, one or more keyboards 906, etc.

[0220] In a specific embodiment, the user privacy data providing device based on blockchain includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the user privacy data providing device based on blockchain, and the one or more programs are configured to be executed by one or more processors, including the following computer executable instructions:

[0221] Receive a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to a trusted execution environment TEE, and the TEE is built in a node of the blockchain;

[0222] By means of the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result;

[0223] If the preset verification result meets the verification pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein, the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

[0224] Optionally, when the computer executable instructions are executed, before receiving the data consumption request sent by the data consumer, they also include:

[0225] Receive a private data storage request of a target user sent by a data holder; wherein the storage request carries first encrypted data, and the first encrypted data is obtained by encrypting the plaintext user private data using an envelope encryption method;

[0226] Based on the first encrypted data, the user privacy data is transmitted to a trusted execution environment TEE in the blockchain; wherein a first smart contract is deployed in the blockchain;

[0227] The user privacy data is processed on-chain in the trusted execution environment TEE through the first smart contract.

[0228] Optionally, when the computer executable instructions are executed, the user private data is transmitted to a trusted execution environment TEE in the blockchain based on the first encrypted data, including:

[0229] Decrypting the first encrypted data to obtain the user privacy data of the target user;

[0230] Determining whether the decrypted user privacy data passes the security verification;

[0231] If the security check passes, generating second encrypted data based on the user privacy data;

[0232] The second encrypted data is passed to the trusted execution environment TEE in the blockchain.

[0233] Optionally, when the computer executable instruction is executed, the first encrypted data includes: first ciphertext privacy data obtained by encrypting user privacy data using a first symmetric key, and a first ciphertext key obtained by encrypting the first symmetric key using a first public key;

[0234] The decrypting the first encrypted data to obtain the user privacy data of the target user includes:

[0235] Using a first private key corresponding to the first public key, decrypting the first ciphertext key to obtain the first symmetric key;

[0236] The first ciphertext private data is decrypted using the first symmetric key to obtain the user private data.

[0237] Optionally, when the computer executable instructions are executed, generating second encrypted data based on the user privacy data includes:

[0238] Using a second symmetric key, encrypting the user privacy data of the target user to obtain second ciphertext privacy data;

[0239] Using the second public key, encrypting the second symmetric key to obtain a second ciphertext key;

[0240] Second encrypted data is generated based on the second ciphertext private data and the second ciphertext key.

[0241] Optionally, when the computer executable instruction is executed, the user privacy data is processed on-chain in the trusted execution environment TEE through the first smart contract, including:

[0242] Decrypting the second ciphertext key in the trusted execution environment TEE using the second private key corresponding to the second public key through the first smart contract to obtain the second symmetric key; and

[0243] Using the second symmetric key, decrypting the second ciphertext private data to obtain the user private data; and,

[0244] The user privacy data is stored in the trusted execution environment TEE in the blockchain.

[0245] Optionally, when the computer executable instructions are executed, after decrypting the first encrypted data to obtain the user privacy data of the target user, the computer executable instructions further include:

[0246] If the security check on the user privacy data fails, data abnormality prompt information indicating that the security check fails is generated, and the data abnormality prompt information is sent to the data holder.

[0247] Optionally, when the computer executable instructions are executed, after the user privacy data is processed on-chain in the trusted execution environment TEE through the first smart contract, the computer executable instructions further include:

[0248] Obtaining the data chain status information of the user's private data;

[0249] If the data on-chain status information indicates that data on-chain has failed, the step of on-chain processing of the user's private data through the first smart contract in the trusted execution environment TEE is continued to be triggered, or an on-chain abnormality prompt message is sent to the designated terminal.

[0250] Optionally, when the computer executable instruction is executed, the request body data includes a third ciphertext key, and the third ciphertext key is obtained by encrypting a third symmetric key using a third public key;

[0251] The sending the encrypted target private data to the data consumer includes:

[0252] Decrypting the third ciphertext key using a third private key corresponding to the third public key to obtain the third symmetric key;

[0253] Encrypting the target private data using the third symmetric key to obtain encrypted target private data;

[0254] The encrypted target private data is sent to the data consumer.

[0255] Optionally, when the computer executable instruction is executed, the smart contract deployed in the blockchain performs a preset check on the data consumption request in the trusted execution environment TEE based on the request body data corresponding to the data consumption request, and obtains a corresponding preset check result, including:

[0256] Passing the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain; wherein a second smart contract is also deployed in the blockchain;

[0257] Through the second smart contract in the trusted execution environment TEE, based on the request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

[0258] Optionally, when the computer executable instruction is executed, the request body data corresponding to the data consumption request is transmitted to the trusted execution environment TEE in the blockchain, including:

[0259] Using a fourth symmetric key, encrypting the request body data corresponding to the data consumption request to obtain ciphertext request body data;

[0260] Using the fourth public key, encrypting the fourth symmetric key to obtain a fourth ciphertext key;

[0261] The ciphertext request body data and the fourth ciphertext key are passed to the trusted execution environment TEE in the blockchain.

[0262] Optionally, when the computer executable instruction is executed, the second smart contract performs a preset check on the data consumption request based on the request body data in the trusted execution environment TEE to obtain a corresponding preset check result, including:

[0263] Decrypting the fourth ciphertext key in the trusted execution environment TEE using the fourth private key corresponding to the fourth public key through the second smart contract to obtain a fourth symmetric key; and

[0264] Decrypting the ciphertext request body data using the fourth symmetric key to obtain plaintext request body data; and

[0265] Based on the plaintext request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

[0266] Optionally, when the computer executable instruction is executed, performing a preset check on the data consumption request based on the plaintext request body data to obtain a corresponding preset check result includes:

[0267] Verifying the data privacy attribute of the user privacy data targeted by the data consumption request to obtain a first verification result;

[0268] Based on the pre-stored data trusteeship record, verify whether a trusteeship relationship exists between the data holder of the user's private data and the data trustee, and obtain a second verification result;

[0269] Based on the pre-stored data authorization record, verify whether there is an authorization relationship between the data consumer and the data holder to obtain a third verification result;

[0270] According to at least one of the first verification result, the second verification result and the third verification result, a preset verification result obtained for the data consumption request is determined.

[0271] Optionally, when the computer executable instructions are executed, the user privacy data includes: user behavior data for characterizing the educational experience of the target user.

[0272] The user privacy data providing device based on blockchain in one or more embodiments of this specification receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to the trusted execution environment TEE, and the TEE is built in the node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request of the data consumer is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain. Whether it is the data uploading stage or the data consumption stage of user privacy data, the corresponding data processing is performed with the help of the trusted execution environment TEE built in the node of the blockchain, and the data is transmitted in the form of encrypted data during the data transmission process. The user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer to provide external consumption services for user privacy data. This can not only ensure the security of user privacy data during data transmission, but also ensure the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in designated industries from the entire link, thereby improving the security level of user privacy data related to the user's personal experience in the designated industry.

[0273] It should be noted that the embodiment of the user privacy data providing device based on blockchain in this specification and the embodiment of the user privacy data providing method based on blockchain in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the corresponding user privacy data providing method based on blockchain, and the repeated parts will not be repeated.

[0274] Furthermore, corresponding to the above Figures 2 to 6 The method shown is based on the same technical concept. One or more embodiments of this specification also provide a storage medium for storing computer executable instructions. In a specific embodiment, the storage medium can be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented:

[0275] Receive a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and uploaded to a trusted execution environment TEE, which is built in a node of the blockchain;

[0276] By means of the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result;

[0277] If the preset verification result meets the verification pass condition, the target privacy data obtained for the data consumption request is obtained, and the encrypted target privacy data is sent to the data consumer; wherein, the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain.

[0278] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, before receiving the data consumption request sent by the data consumer, the computer executable instructions further include:

[0279] Receive a private data storage request of a target user sent by a data holder; wherein the storage request carries first encrypted data, and the first encrypted data is obtained by encrypting the plaintext user private data using an envelope encryption method;

[0280] Based on the first encrypted data, the user privacy data is transmitted to a trusted execution environment TEE in the blockchain; wherein a first smart contract is deployed in the blockchain;

[0281] The user privacy data is processed on-chain in the trusted execution environment TEE through the first smart contract.

[0282] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the user private data is transmitted to the trusted execution environment TEE in the blockchain based on the first encrypted data, including:

[0283] Decrypting the first encrypted data to obtain the user privacy data of the target user;

[0284] Determining whether the decrypted user privacy data passes the security verification;

[0285] If the security check passes, generating second encrypted data based on the user privacy data;

[0286] The second encrypted data is passed to the trusted execution environment TEE in the blockchain.

[0287] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the first encrypted data includes: first ciphertext privacy data obtained by encrypting user privacy data using a first symmetric key, and a first ciphertext key obtained by encrypting the first symmetric key using a first public key;

[0288] The decrypting the first encrypted data to obtain the user privacy data of the target user includes:

[0289] Using a first private key corresponding to the first public key, decrypting the first ciphertext key to obtain the first symmetric key;

[0290] The first ciphertext private data is decrypted using the first symmetric key to obtain the user private data.

[0291] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, generating the second encrypted data based on the user privacy data includes:

[0292] Using a second symmetric key, encrypting the user privacy data of the target user to obtain second ciphertext privacy data;

[0293] Using the second public key, encrypting the second symmetric key to obtain a second ciphertext key;

[0294] Second encrypted data is generated based on the second ciphertext private data and the second ciphertext key.

[0295] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the user privacy data is processed on-chain in the trusted execution environment TEE through the first smart contract, including:

[0296] Decrypting the second ciphertext key in the trusted execution environment TEE using the second private key corresponding to the second public key through the first smart contract to obtain the second symmetric key; and

[0297] Using the second symmetric key, decrypting the second ciphertext private data to obtain the user private data; and,

[0298] The user privacy data is stored in the trusted execution environment TEE in the blockchain.

[0299] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, after decrypting the first encrypted data to obtain the user privacy data of the target user, the computer executable instructions further include:

[0300] If the security check on the user privacy data fails, data abnormality prompt information indicating that the security check fails is generated, and the data abnormality prompt information is sent to the data holder.

[0301] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, after the user privacy data is processed on the chain in the trusted execution environment TEE through the first smart contract, the computer executable instructions further include:

[0302] Obtaining the data chain status information of the user's private data;

[0303] If the data on-chain status information indicates that data on-chain has failed, the step of on-chain processing of the user's private data through the first smart contract in the trusted execution environment TEE is continued to be triggered, or an on-chain abnormality prompt message is sent to the designated terminal.

[0304] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the request body data includes a third ciphertext key, and the third ciphertext key is obtained by encrypting a third symmetric key using a third public key;

[0305] The sending the encrypted target private data to the data consumer includes:

[0306] Decrypting the third ciphertext key using a third private key corresponding to the third public key to obtain the third symmetric key;

[0307] Encrypting the target private data using the third symmetric key to obtain encrypted target private data;

[0308] The encrypted target private data is sent to the data consumer.

[0309] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the smart contract deployed in the blockchain performs a preset check on the data consumption request in the trusted execution environment TEE based on the request body data corresponding to the data consumption request, and obtains a corresponding preset check result, including:

[0310] Passing the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain; wherein a second smart contract is also deployed in the blockchain;

[0311] Through the second smart contract in the trusted execution environment TEE, based on the request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

[0312] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the request body data corresponding to the data consumption request is transmitted to the trusted execution environment TEE in the blockchain, including:

[0313] Using a fourth symmetric key, encrypting the request body data corresponding to the data consumption request to obtain ciphertext request body data;

[0314] Using the fourth public key, encrypting the fourth symmetric key to obtain a fourth ciphertext key;

[0315] The ciphertext request body data and the fourth ciphertext key are passed to the trusted execution environment TEE in the blockchain.

[0316] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the second smart contract performs a preset check on the data consumption request based on the request body data in the trusted execution environment TEE to obtain a corresponding preset check result, including:

[0317] Decrypting the fourth ciphertext key in the trusted execution environment TEE using the fourth private key corresponding to the fourth public key through the second smart contract to obtain a fourth symmetric key; and

[0318] Decrypting the ciphertext request body data using the fourth symmetric key to obtain plaintext request body data; and

[0319] Based on the plaintext request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

[0320] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the data consumption request is subjected to a preset check based on the plaintext request body data to obtain a corresponding preset check result, including:

[0321] Verifying the data privacy attribute of the user privacy data targeted by the data consumption request to obtain a first verification result;

[0322] Based on the pre-stored data trusteeship record, verify whether a trusteeship relationship exists between the data holder of the user's private data and the data trustee, and obtain a second verification result;

[0323] Based on the pre-stored data authorization record, verify whether there is an authorization relationship between the data consumer and the data holder to obtain a third verification result;

[0324] According to at least one of the first verification result, the second verification result and the third verification result, a preset verification result obtained for the data consumption request is determined.

[0325] Optionally, when the computer executable instructions stored in the storage medium are executed by the processor, the user privacy data includes: user behavior data for characterizing the educational experience of the target user.

[0326] When the computer executable instructions stored in the storage medium in one or more embodiments of this specification are executed by the processor, a data consumption request sent by a data consumer is received; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data includes personal data that is pre-encrypted and in a trusted execution environment TEE, and the TEE is built in a node of the blockchain. Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, a preset check is performed on the data consumption request based on the request body data corresponding to the data consumption request, and a corresponding preset check result is obtained. If the preset check result meets the check pass condition, the target privacy data obtained for the data consumption request of the data consumer is obtained, and the encrypted target privacy data is sent to the data consumer; wherein the target privacy data is obtained in the trusted execution environment TEE based on the user privacy data stored in the blockchain. Whether it is the data uploading stage or the data consumption stage of user privacy data, the corresponding data processing is performed with the help of the trusted execution environment TEE built in the node of the blockchain, and the data is transmitted in the form of encrypted data during the data transmission process. The user privacy data is uploaded to the trusted execution environment TEE of the blockchain, and the target privacy data is returned to the data consumer to provide external consumption services for user privacy data. This can not only ensure the security of user privacy data during data transmission, but also ensure the security of user privacy data processed on the blockchain, thereby ensuring the security of user privacy data generated by users in designated industries from the entire link, thereby improving the security level of user privacy data related to the user's personal experience in the designated industry.

[0327] It should be noted that the embodiment of the storage medium in this specification and the embodiment of the method for providing user privacy data based on blockchain in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the aforementioned corresponding implementation of the method for providing user privacy data based on blockchain, and the repeated parts will not be repeated.

[0328] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0329] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0330] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0331] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0332] For the convenience of description, the above devices are described in various units according to their functions. Of course, when implementing one or more of the present specification, the functions of each unit can be implemented in the same or more software and / or hardware.

[0333] It will be appreciated by those skilled in the art that one or more embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more of this specification may be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0334] One or more of the present specification is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to one or more embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0335] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0336] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0337] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0338] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0339] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0340] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0341] It should be understood by those skilled in the art that one or more embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more of this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0342] One or more of the present descriptions may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more of the present descriptions may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0343] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0344] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of one or more claims of this specification.

Claims

1. A method for providing user privacy data based on blockchain, applied to a data providing node communicating with at least one blockchain node in a blockchain, the method comprising: Receive a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data is uploaded to the trusted execution environment TEE built in the blockchain node after the data providing node performs a security check and passes it; Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, the data consumption request is subjected to a preset check to obtain a corresponding preset check result; the data privacy level of the user's private data targeted by the data consumption request is obtained; if the data privacy level is lower than or equal to the first preset privacy level, the preset check includes: data privacy attribute check and data trusteeship relationship check; if the data privacy level is higher than the first preset privacy level and lower than the second preset privacy level, the preset check includes: data privacy attribute check, data trusteeship relationship check and data authorization relationship check; if the data privacy level is higher than or equal to the second preset privacy level, the preset check includes: data privacy attribute check, data trusteeship relationship check, data authorization relationship check and consumption request type check; If the preset verification result meets the verification pass condition, the target private data obtained in response to the data consumption request is obtained, and the encrypted target private data is sent to the data consumer.

2. The method according to claim 1, wherein: The user privacy data includes personal data of the target user generated in a specified industry that is pre-encrypted and uploaded to the trusted execution environment TEE by multiple data holders. The data holders are relevant service agencies in which the target user participates in the specified industry.

3. The method according to claim 1, wherein: The target private data is obtained in the trusted execution environment TEE based on the user private data stored in the blockchain.

4. The method according to claim 1, wherein: Before receiving the data consumption request sent by the data consumer, it also includes: Receive a private data storage request of a target user sent by a data holder; wherein the storage request carries first encrypted data, and the first encrypted data is obtained by encrypting the plaintext user private data using an envelope encryption method; Based on the first encrypted data, the user privacy data is transmitted to a trusted execution environment TEE in the blockchain; wherein a first smart contract is deployed in the blockchain; The user privacy data is processed on-chain in the trusted execution environment TEE through the first smart contract.

5. The method according to claim 4, wherein: The method of transmitting the user private data to a trusted execution environment TEE in the blockchain based on the first encrypted data includes: Decrypting the first encrypted data to obtain the user privacy data of the target user; Determining whether the decrypted user privacy data passes the security verification; If the security check passes, generating second encrypted data based on the user privacy data; The second encrypted data is passed to the trusted execution environment TEE in the blockchain.

6. The method according to claim 5, wherein: The first encrypted data includes: first ciphertext privacy data obtained by encrypting user privacy data using a first symmetric key, and a first ciphertext key obtained by encrypting the first symmetric key using a first public key; The decrypting the first encrypted data to obtain the user privacy data of the target user includes: Using a first private key corresponding to the first public key, decrypting the first ciphertext key to obtain the first symmetric key; The first ciphertext private data is decrypted using the first symmetric key to obtain the user private data.

7. The method according to claim 5, wherein: The step of generating second encrypted data based on the user privacy data comprises: Using a second symmetric key, encrypting the user private data of the target user to obtain second ciphertext private data; Using the second public key, encrypting the second symmetric key to obtain a second ciphertext key; Second encrypted data is generated based on the second ciphertext private data and the second ciphertext key.

8. The method according to claim 7, wherein: The method of performing on-chain processing of the user privacy data in the trusted execution environment TEE through the first smart contract includes: Decrypting the second ciphertext key in the trusted execution environment TEE using the second private key corresponding to the second public key through the first smart contract to obtain the second symmetric key; and Using the second symmetric key, decrypting the second ciphertext private data to obtain the user private data; and, The user privacy data is stored in the trusted execution environment TEE in the blockchain.

9. The method according to claim 5, wherein: After decrypting the first encrypted data to obtain the user privacy data of the target user, the method further includes: If the security check on the user privacy data fails, data abnormality prompt information indicating that the security check fails is generated, and the data abnormality prompt information is sent to the data holder.

10. The method according to claim 4, wherein: After the user's private data is processed on-chain in the trusted execution environment TEE through the first smart contract, the method further includes: Obtaining the data chain status information of the user's private data; If the data on-chain status information indicates that data on-chain has failed, the step of on-chain processing of the user's private data through the first smart contract in the trusted execution environment TEE is continued to be triggered, or an on-chain abnormality prompt message is sent to the designated terminal.

11. The method according to claim 1, wherein: The request body data includes a third ciphertext key, where the third ciphertext key is obtained by encrypting the third symmetric key using the third public key; The sending the encrypted target private data to the data consumer includes: Decrypting the third ciphertext key using a third private key corresponding to the third public key to obtain the third symmetric key; Encrypting the target private data using the third symmetric key to obtain encrypted target private data; The encrypted target private data is sent to the data consumer.

12. The method according to claim 1, wherein: The method of performing a preset check on the data consumption request in the trusted execution environment TEE based on the request body data corresponding to the data consumption request through the blockchain to obtain a corresponding preset check result includes: Passing the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain; wherein a second smart contract is also deployed in the blockchain; Through the second smart contract in the trusted execution environment TEE, based on the request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

13. The method according to claim 12, wherein: The step of transmitting the request body data corresponding to the data consumption request to the trusted execution environment TEE in the blockchain includes: Using a fourth symmetric key, encrypting the request body data corresponding to the data consumption request to obtain ciphertext request body data; Using the fourth public key, encrypting the fourth symmetric key to obtain a fourth ciphertext key; The ciphertext request body data and the fourth ciphertext key are passed to the trusted execution environment TEE in the blockchain.

14. The method according to claim 13, wherein: The step of performing a preset check on the data consumption request based on the request body data in the trusted execution environment TEE by the second smart contract to obtain a corresponding preset check result includes: Decrypting the fourth ciphertext key in the trusted execution environment TEE using the fourth private key corresponding to the fourth public key through the second smart contract to obtain a fourth symmetric key; and Decrypting the ciphertext request body data using the fourth symmetric key to obtain plaintext request body data; and Based on the plaintext request body data, a preset check is performed on the data consumption request to obtain a corresponding preset check result.

15. The method according to claim 14, wherein: The step of performing a preset check on the data consumption request based on the plaintext request body data to obtain a corresponding preset check result includes: Verifying the data privacy attribute of the user privacy data targeted by the data consumption request to obtain a first verification result; Based on the pre-stored data trusteeship record, verify whether a trusteeship relationship exists between the data holder of the user's private data and the data trustee, and obtain a second verification result; Based on the pre-stored data authorization record, verify whether there is an authorization relationship between the data consumer and the data holder to obtain a third verification result; A preset verification result obtained for the data consumption request is determined according to at least one of the first verification result, the second verification result, the third verification result and a request type verification result of the data consumption request.

16. The method according to any one of claims 1 to 15, wherein: The user privacy data includes: user behavior data for characterizing the educational experience of the target user.

17. A user privacy data providing device based on blockchain, arranged at a data providing node communicating with at least one blockchain node in the blockchain, the device comprising: A consumption request acquisition module receives a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data is uploaded to the trusted execution environment TEE built in the blockchain node after the data providing node performs a security check and passes it; An information verification module, which performs a preset verification on the data consumption request in the trusted execution environment TEE through the smart contract deployed in the blockchain, based on the request body data corresponding to the data consumption request, and obtains a corresponding preset verification result; obtains the data privacy level of the user privacy data targeted by the data consumption request; if the data privacy level is lower than or equal to the first preset privacy level, the preset verification includes: data privacy attribute verification, data trusteeship relationship verification; if the data privacy level is higher than the first preset privacy level and lower than the second preset privacy level, the preset verification includes: data privacy attribute verification, data trusteeship relationship verification and data authorization relationship verification; if the data privacy level is higher than or equal to the second preset privacy level, the preset verification includes: data privacy attribute verification, data trusteeship relationship verification, data authorization relationship verification and consumption request type verification; The data providing module obtains the target private data obtained in response to the data consumption request if the preset verification result meets the verification pass condition, and sends the encrypted target private data to the data consumer.

18. The device according to claim 17, wherein: The information verification module: Verifying the data privacy attribute of the user privacy data targeted by the data consumption request to obtain a first verification result; Based on the pre-stored data trusteeship record, verify whether a trusteeship relationship exists between the data holder of the user's private data and the data trustee, and obtain a second verification result; Based on the pre-stored data authorization record, verify whether there is an authorization relationship between the data consumer and the data holder to obtain a third verification result; A preset verification result obtained for the data consumption request is determined according to at least one of the first verification result, the second verification result, the third verification result and a request type verification result of the data consumption request.

19. The device according to claim 17, wherein: The user privacy data includes personal data of the target user generated in a specified industry that is pre-encrypted and uploaded to the trusted execution environment TEE by multiple data holders. The data holders are relevant service agencies in which the target user participates in the specified industry.

20. A user privacy data providing device based on blockchain, comprising: processor; as well as a memory arranged to store computer executable instructions which, when executed, cause the processor to: Receive a data consumption request sent by a data consumer; wherein the data consumption request is a consumption request for the user privacy data of the target user, and the user privacy data is uploaded to the trusted execution environment TEE built in the blockchain node after the data providing node performs a security check and passes it; Through the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, the data consumption request is subjected to a preset check to obtain a corresponding preset check result; the data privacy level of the user's private data targeted by the data consumption request is obtained; if the data privacy level is lower than or equal to the first preset privacy level, the preset check includes: data privacy attribute check and data trusteeship relationship check; if the data privacy level is higher than the first preset privacy level and lower than the second preset privacy level, the preset check includes: data privacy attribute check, data trusteeship relationship check and data authorization relationship check; if the data privacy level is higher than or equal to the second preset privacy level, the preset check includes: data privacy attribute check, data trusteeship relationship check, data authorization relationship check and consumption request type check; If the preset verification result meets the verification pass condition, the target private data obtained in response to the data consumption request is obtained, and the encrypted target private data is sent to the data consumer.

21. A storage medium for storing computer executable instructions, wherein the executable instructions, when executed by a processor, implement the following method: Receive a data consumption request sent by a data consumer; wherein, The data consumption request is a consumption request for the user privacy data of the target user. The user privacy data is uploaded to the trusted execution environment TEE built in the blockchain node after the data providing node performs a security check and passes it; By means of the smart contract deployed in the blockchain, in the trusted execution environment TEE, based on the request body data corresponding to the data consumption request, a preset check is performed on the data consumption request to obtain a corresponding preset check result; Obtaining a data privacy level of the user private data targeted by the data consumption request; If the data privacy level is lower than or equal to the first preset privacy level, the preset verification includes: data privacy attribute verification and data trusteeship relationship verification; if the data privacy level is higher than the first preset privacy level and lower than the second preset privacy level, the preset verification includes: data privacy attribute verification, data trusteeship relationship verification and data authorization relationship verification; if the data privacy level is higher than or equal to the second preset privacy level, the preset verification includes: data privacy attribute verification, data trusteeship relationship verification, data authorization relationship verification and consumption request type verification; If the preset verification result meets the verification pass condition, the target private data obtained in response to the data consumption request is obtained, and the encrypted target private data is sent to the data consumer.

Images