Data processing method, device and server

Abstract

This specification provides a data processing method, device and server. Based on this method, in a blockchain-based data processing system, it is possible to protect the privacy and security of user data with lower data processing costs and more efficient data processing methods, while supporting regulators to effectively monitor and track risk-related accounts or users at risk, so as to maintain data security in the blockchain-based data processing system.

Description

Technical Field

[0001] This specification belongs to the field of Internet technology, and in particular to data processing methods, devices and servers. Background Art

[0002] In many transaction data processing scenarios involving blockchain, it is often difficult to strike a balance between data privacy protection and security risk supervision.

[0003] At present, there is an urgent need for a method that can protect the privacy and security of user data while supporting regulators to effectively monitor and track relevant accounts or users at risk. Summary of the invention

[0004] This specification provides a data processing method, device and server, which can protect the privacy and security of user data at a lower data processing cost and in a more efficient data processing manner, while supporting regulators to effectively monitor and track transaction risks of relevant accounts and / or users at risk.

[0005] The embodiment of this specification provides a data processing method, which is applied to an identity service provider, including:

[0006] Obtain the target sub-account instruction information provided by the regulator;

[0007] According to the indication information of the target sub-account, the saved second-category account data set is queried to obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor;

[0008] The ciphertext data of the target identity-associated data is sent to the supervisor, wherein the supervisor performs corresponding risk data processing using the supervisor's private key and the ciphertext data of the target identity-associated data.

[0009] In some embodiments, the indication information of the target sub-account includes: an identity identifier of the target sub-account and / or a sub-account public key.

[0010] In some embodiments, the ciphertext data of the target identity-associated data includes: ciphertext data of the pseudo-random number function key of the target sub-account and / or identity restoration information.

[0011] In some embodiments, when the ciphertext data of the target identity-associated data includes identity restoration information of the target sub-account, after sending the ciphertext data of the target identity-associated data to the supervisor, the method further includes:

[0012] Receive the master account public key of the target master account associated with the target sub-account sent by the supervisor; wherein the supervisor uses the supervisor private key held by the supervisor to decrypt the identity restoration information and obtain the master account public key of the target master account;

[0013] According to the master account public key of the target master account, query the saved first category account data set to determine the identity identifier of the target master account that matches the master account public key of the target master account, and / or the identity information of the target user holding the target master account;

[0014] The identity identifier of the target primary account and / or the identity information of the target user is sent to the supervisor.

[0015] In some embodiments, before obtaining the indication information of the target sub-account provided by the supervisor, the method further includes:

[0016] Receive a target master account registration request; wherein the target master account registration request carries at least a master account public key of the target master account, an identity identifier of the target master account, and identity information of a target user holding the target master account;

[0017] In response to the target master account registration request, a master account credential for the target master account is generated; and the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account are stored in the first category of account data sets.

[0018] In some embodiments, the method further comprises:

[0019] Receive a target sub-account registration request; wherein the target sub-account registration request carries at least the sub-account public key, identity identifier, and ciphertext data of target identity association data of the target sub-account;

[0020] Respond to the target sub-account registration request and perform preset verification;

[0021] When it is determined that the preset verification has passed, the ciphertext data of the sub-account public key, identity identifier, and target identity-related data of the target sub-account are saved in the second type of account data set.

[0022] In some embodiments, the preset verification includes a preset verification based on zero-knowledge proof.

[0023] In some embodiments, the target sub-account includes an account associated with on-chain transaction data that has transaction risks.

[0024] The embodiment of this specification also provides a data processing method, which is applied to a supervisor, including:

[0025] Get the instructions for the target subaccount;

[0026] Sending the indication information of the target sub-account to the identity service provider; wherein the identity service provider queries the stored second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the supervisor;

[0027] Receive the ciphertext data of the target identity-related data; and use the supervisory party's private key and the ciphertext data of the target identity-related data to perform corresponding risk data processing.

[0028] In some embodiments, the indication information of the target sub-account includes: an identity identifier of the target sub-account and / or a sub-account public key.

[0029] In some embodiments, obtaining the indication information of the target sub-account includes:

[0030] By performing risk detection on the on-chain transaction data, the on-chain transaction data with transaction risks is identified;

[0031] According to the on-chain transaction data with transaction risks, the indication information of the target sub-account is obtained.

[0032] In some embodiments, the ciphertext data of the target identity-associated data includes: ciphertext data of the pseudo-random number function key of the target sub-account and / or identity restoration information.

[0033] In some embodiments, when the ciphertext data of the target identity-associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account, the corresponding risk data processing is performed using the supervisory party private key and the ciphertext data of the target identity-associated data, including:

[0034] Decrypting the ciphertext data of the pseudo-random number function key using the supervisor's private key to obtain the pseudo-random number function key;

[0035] Generate identity identifiers of multiple pending sub-accounts according to the pseudo-random number function secret key;

[0036] By querying the on-chain records, the identities of the associated sub-accounts that are associated with the same target master account as the target sub-account and are in a valid state are selected from the identities of multiple pending sub-accounts;

[0037] According to the identity identifier of the target sub-account and the identity identifier of the associated sub-account, transaction risk monitoring is performed on the target sub-account and the associated sub-account.

[0038] In some embodiments, when the ciphertext data of the target identity-associated data includes the identity restoration information of the target sub-account, the corresponding risk data processing is performed using the private key of the supervisor and the ciphertext data of the target identity-associated data, including:

[0039] Decrypt the identity restoration information using the supervisor's private key to obtain the master account public key of the target master account associated with the target sub-account;

[0040] Sending the master account public key of the target master account to the identity service provider; wherein the identity service provider queries the saved first category account data set according to the master account public key of the target master account, and determines the identity identifier of the target master account that matches the master account public key of the target master account, and / or the identity information of the target user holding the target master account;

[0041] Receiving the identity of the target master account and / or the identity information of the target user;

[0042] Perform transaction risk monitoring on the target master account according to the identity identifier of the target master account; and / or perform transaction risk monitoring on the target user according to the identity information of the target user.

[0043] The embodiment of this specification also provides a data processing method, which is applied to the client of the target user, including:

[0044] Calling the target sub-account to generate transaction data; wherein the transaction data at least carries indication information of the target sub-account;

[0045] In a blockchain-based data processing system, the target sub-account uses the transaction data to perform corresponding transaction data processing; wherein the client completes the target main account registration and the target sub-account registration in advance by interacting with the identity service provider in the blockchain-based data processing system; the identity service provider respectively stores a first type of account data set and a second type of account data set; the second type of account data set contains at least ciphertext data of the target identity-related data of the target sub-account; the ciphertext data of the target identity-related data is the ciphertext data encrypted using the public key of the regulator.

[0046] In some embodiments, before calling the target sub-account to generate transaction data, the method further includes:

[0047] Respond to the master account creation instruction, create the target master account, and obtain the identity of the target master account;

[0048] Generate the master account public key and master account private key of the target master account.

[0049] In some embodiments, after creating the target primary account, the method further includes:

[0050] Generate a target master account registration request; wherein the target master account registration request carries at least the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account;

[0051] The target primary account registration request is sent to the identity service provider.

[0052] In some embodiments, after creating the target primary account, the method further includes:

[0053] Respond to the sub-account creation instruction and obtain the pseudo-random number function key;

[0054] According to the pseudo-random number function key, an identity identifier of a target sub-account is generated using a pseudo-random number function to create a target sub-account.

[0055] In some embodiments, after creating the target sub-account, the method further includes:

[0056] Generate the subaccount public key of the target subaccount;

[0057] Obtain and use the public key of the supervisor to obtain the ciphertext data of the target identity-associated data of the target sub-account through encryption; wherein the ciphertext data of the target identity-associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account and / or identity restoration information.

[0058] In some embodiments, the method further comprises:

[0059] Generate a target sub-account registration request; wherein the target sub-account registration request carries at least the sub-account public key, identity identifier, and ciphertext data of target identity-related data of the target sub-account;

[0060] Send the target sub-account registration request to the identity service provider.

[0061] The embodiment of this specification also provides a data processing device, including:

[0062] An acquisition module, used to acquire the indication information of the target sub-account provided by the regulator;

[0063] A query module, configured to query the stored second-category account data set according to the indication information of the target sub-account, and obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor;

[0064] The sending module is used to send the ciphertext data of the target identity-associated data to the supervisor; wherein the supervisor uses the supervisor private key held by the supervisor and the ciphertext data of the target identity-associated data to perform corresponding risk data processing.

[0065] The embodiment of this specification also provides a data processing device, including:

[0066] An acquisition module, used to acquire indication information of a target sub-account;

[0067] a sending module, configured to send the indication information of the target sub-account to the identity service provider; wherein the identity service provider queries the stored second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor;

[0068] The processing module is used to receive the ciphertext data of the target identity-related data; and use the supervisory party's private key and the ciphertext data of the target identity-related data to perform corresponding risk data processing.

[0069] The embodiment of the present specification also provides a server, including a processor and a memory for storing processor executable instructions, and the processor implements the relevant steps of the data processing method when executing the instructions.

[0070] The embodiments of the present specification also provide a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed, the relevant steps of the data processing method are implemented.

[0071] Based on the data processing method, device and server provided in this specification, in a data processing system based on blockchain, before specific implementation, the target user can interact with the identity service provider through the client to register the target master account; the identity service provider can save the target master account's master account public key, identity identifier, and the target user's identity information in the first type of account data set during the target master account registration process. The target user can also interact with the identity service provider through the client to register the target sub-account; the identity service provider can save the sub-account public key, identity identifier, and the ciphertext data of the target identity-related data encrypted with the public key of the regulator in the second type of account data set during the target sub-account registration process. In specific implementation, the target user can call the target sub-account to generate transaction data through the client; and call the target sub-account through the client to use the above transaction data for specific transaction data processing. Accordingly, the on-chain transaction data in the system will only carry the indication information of the target sub-account, and will not disclose the target user and the relevant information of the target master account held by the target user, thereby protecting the data privacy security of the target user in the data processing system. When the regulator finds that the on-chain transaction data related to the target sub-account has transaction risks, it can first obtain the indication information of the target sub-account; and then provide the indication information of the target sub-account to the identity service provider. The identity service provider can query the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-related data of the target sub-account; and feedback the ciphertext data of the target identity-related data to the regulator. Furthermore, the regulator can use the regulator's private key and the ciphertext data of the target identity-related data to perform corresponding risk data processing to monitor and track the transaction risks of related accounts and / or users. In this way, it can avoid introducing complex processing mechanisms, and can achieve the protection of user data privacy and security with lower data processing costs and more efficient data processing methods, while supporting regulators to conduct more effective transaction risk monitoring and tracking of risky related accounts and / or users, and maintain transaction data security in blockchain-based data processing systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. The drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0073] Figure 1 It is a schematic diagram of an embodiment of the structure of a data processing system using the data processing method provided in the embodiments of this specification;

[0074] Figure 2 is a flowchart of a data processing method provided by an embodiment of this specification;

[0075] Figure 3 is a flowchart of a data processing method provided by an embodiment of this specification;

[0076] Figure 4 is a flowchart of a data processing method provided by an embodiment of this specification;

[0077] Figure 5 It is a schematic diagram of the structure of a server provided by an embodiment of this specification;

[0078] Figure 6 It is a schematic diagram of the structural composition of a data processing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0079] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0080] The embodiment of this specification provides a data processing method, which can be specifically applied to a data processing system including a first server, a second server and a client. The data processing system can specifically be a transaction data processing system based on blockchain.

[0081] See also Figure 1 As shown, the first server is deployed on the side of the identity service provider (Identity Provider, abbreviated as IP). The second server is deployed on the side of the supervisor (Audit Party, abbreviated as AP). The client is deployed on the side of the target user (User, abbreviated as U).

[0082] In this embodiment, the first server and the second server may specifically include a background server capable of realizing functions such as data transmission and data processing. Specifically, the first server and the second server may be, for example, an electronic device having data calculation, storage and network interaction functions. Alternatively, the first server and the second server may also be software programs running in the electronic device to provide support for data processing, storage and network interaction. In this embodiment, the number of servers included in the first server and the second server is not specifically limited. The first server and the second server may specifically be one server, or several servers, or a server cluster formed by several servers.

[0083] In this embodiment, the client may specifically include a front-end electronic device applied to the target user side and capable of realizing functions such as data collection and data transmission. Specifically, the client may be, for example, a desktop computer, a tablet computer, a laptop computer, a smart phone, etc. Alternatively, the client may also be a software application that can be run in the above electronic devices. For example, it may be an APP running on a smart phone, etc.

[0084] Before specific implementation, the target user can first create a target master account through the client.

[0085] Specifically, the target user can initiate a master account creation instruction by performing corresponding operations on the client. The client receives and responds to the master account creation instruction, creates a corresponding target master account for the target user, and obtains the identity of the target master account (for example, the account name and account number of the target master account), which can be recorded as MA.

[0086] At the same time, the client can also generate the master account key pair (PK MA , S.K. MA ). Among them, PK MA The main account public key, SK MA The private key of the master account. The client holds and keeps the private key of the master account.

[0087] Next, the target user can also create one or more target sub-accounts associated with the target main account through the client. In order to protect the data privacy of the target user and the target main account, the above target sub-accounts can be used to perform specific transaction data processing in the data processing system.

[0088] Specifically, the target user can initiate a sub-account creation instruction by performing corresponding operations on the client. The client receives and responds to the above sub-account creation instruction, and first generates a pseudo-random number function (PRF) secret key for the target user, which can be recorded as K. Then, the client can combine specific needs and use the above pseudo-random number function secret key and pseudo-random number function to generate the identity of one or more target sub-accounts according to the preset protocol to create one or more target sub-accounts.

[0089] Taking the creation of a target sub-account as an example, the client can use the pseudo-random number function to generate an identity of the target sub-account according to the pseudo-random number function key K according to the following formula: SA ID =PRF K (x). x is the account index integer. In specific implementation, it can be arranged in order, or randomly selected from the integer set [1, MAX ACC ] to extract an integer value as the account index integer. ACC It can be a system constant, for example, 32. The MAX value used by the client to generate the identity of the target sub-account ACC Can be disclosed to regulators.

[0090] At the same time, the client can also generate the sub-account public key of the target sub-account based on the corresponding secret key generation algorithm (which can be recorded as PK SA ) and the subaccount private key (which can be recorded as SK SA ).

[0091] Furthermore, the client may complete the target master account registration and the target sub-account registration by interacting with the first server of the identity service provider.

[0092] Specifically, the client can first obtain the supervisor's public key by querying or by the supervisor actively providing it, which can be recorded as PK AP Among them, the second server deployed at the supervisor holds and keeps the supervisor's private key, which can be recorded as SK AP .

[0093] The client can use the supervisor's public key to encrypt the master account public key according to the preset protocol to obtain the identity restoration information (which can be recorded as C). The identity restoration information can be generated in the following way: C = Enc PKAP (PK MA ).

[0094] At the same time, the client can also use the supervisor's public key to encrypt the pseudo-random number function key K according to the preset protocol to obtain the ciphertext data of the pseudo-random number function key (which can be recorded as E MA). Specifically, the ciphertext data of the pseudo-random number function key can be generated in the following manner: E MA =Enc PKAP (K).

[0095] Next, the client may generate a target master account registration request; and send the target master account registration request to the first server.

[0096] The target master account registration request carries at least the target master account's master account public key, the target master account's identity identifier, and the target user's identity information (e.g., the target user's name, identity ID, etc.) holding the target master account. Of course, the target master account registration request may also carry the target user's KYC (Know your customer) information such as the target user's occupation, mobile phone number, email address, etc. It should be noted that the target user's identity information and KYC information are information data authorized and agreed by the target user.

[0097] The first server receives and responds to the target master account registration request, and generates a master account credential for the target master account. Specifically, the first server can use the private key of the identity service provider it holds to sign an information set that at least contains the master account public key of the target master account, and obtain the master account credential of the target master account. The signature method used is a blind signature, which also avoids leaking relevant information of the master account.

[0098] The first server can feed back the master account credentials of the target master account to the client; at the same time, the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account are combined into a corresponding data group and stored in the first category of account data sets.

[0099] The client may also generate a target sub-account registration request; and send the target sub-account registration request to the first server.

[0100] The target sub-account registration request carries at least the target sub-account public key, identity identifier, and ciphertext data of target identity-related data. The ciphertext data of the target identity-related data may specifically include the ciphertext data of the pseudo-random number function key of the target sub-account and / or identity restoration information.

[0101] In addition, the above-mentioned target sub-account registration request may further carry verification information for subsequent preset verification. For example, verification information π based on zero-knowledge proof, etc. Among them, the above-mentioned verification information π based on zero-knowledge proof is specifically used to characterize that the identity constraint relationship of the target user holding the target sub-account satisfies the following conditions: the target user holds the sub-account private key corresponding to the sub-account public key of the target sub-account; the target user holds the master account private key corresponding to the master account public key of the target master account hidden in the identity restoration information; the identity restoration information, the identity identifier of the target sub-account, and the ciphertext data of the random number function secret key are generated based on the preset protocol.

[0102] The first server receives and responds to the target sub-account registration request, and first performs a preset verification to determine whether the target sub-account requested for registration is legal. Specifically, for example, the first server can perform a preset verification based on zero-knowledge proof according to the verification information π carried by the target sub-account registration request. Of course, the verification methods listed above are only a schematic illustration. In specific implementation, other suitable verification methods can also be used for preset verification according to specific circumstances and processing requirements. This specification does not limit this.

[0103] When it is determined that the preset verification has passed, the first server may combine the sub-account public key, identity identifier, and ciphertext data of the target sub-account's associated identity data into a corresponding data group, and save it in the second type of account data set.

[0104] It should be noted that since the first server does not have the supervisor's private key, it is unable to decrypt the ciphertext data of the target identity-related data. Therefore, the first server cannot know the target main account associated with the target sub-account, nor can it determine the target user corresponding to the target sub-account, thereby effectively protecting the transaction data privacy of the target user.

[0105] In specific implementation, the target user can generate corresponding transaction data by calling the target sub-account through the client; and complete corresponding transaction data processing by calling the target sub-account through the client using the above transaction data.

[0106] The transaction data at least carries the target sub-account indication information, which may be data information that can indicate the target sub-account, such as the target sub-account public key and / or identity identifier.

[0107] The transaction data may be, for example, order data, transfer data, or red envelope data, etc. Accordingly, the target user may call the target sub-account through the client to complete specific transaction data processing such as order payment, fund transfer, or red envelope distribution.

[0108] In the above process, each transaction data initiated by the target user through the client in the data processing system will be recorded on the blockchain (for example, consortium chain, public chain, etc.). Any third party can query the above transaction data on the blockchain.

[0109] However, the third party can only obtain the indication information of the target sub-account based on the transaction data on the chain, and cannot further obtain the target main account associated with the target sub-account, the associated sub-account, and the relevant information of the target user holding the target main account, thereby effectively protecting the transaction data privacy of the target user during the corresponding transaction data processing process of the above-mentioned data processing system and protecting the privacy data security of the target user.

[0110] The second server of the supervisor can perform risk detection on the on-chain transaction data in real time or at preset time intervals (for example, every 12 hours). When on-chain transaction data with transaction risks is detected, the on-chain transaction data can be parsed and the sub-account public key, identity identifier and other indication information of the target sub-account can be obtained.

[0111] Next, the second server may generate a first query request and send the first query request to the first server, wherein the first query request at least carries the indication information of the target sub-account.

[0112] The first server receives and responds to the first query request, and queries the saved second type of account data set according to the indication information of the target sub-account (sub-account public key or identity identifier), finds the data group that stores the same indication information of the target sub-account; and obtains the ciphertext data of the target sub-account's pseudo-random number function key and the ciphertext data of the target identity-related data such as identity restoration information from the data group. The first server can feed back the ciphertext data of the target sub-account's pseudo-random number function key and the ciphertext data of the target identity-related data such as identity restoration information to the second server.

[0113] The second server can use the private key of the supervisor it holds and the ciphertext data of the target identity-related data fed back by the first server to perform corresponding risk data processing.

[0114] Specifically, on the one hand, the second server can first use the supervisor's private key to decrypt the ciphertext data of the pseudo-random number function to obtain the pseudo-random number function secret key K. Then, the second server can query and obtain the publicly disclosed system constant MAX corresponding to the target sub-account. ACCThen, the second server can use the pseudo-random number function key and the system constant to calculate the identity of all possible pending sub-accounts by exhaustive method, and determine multiple pending sub-accounts. Furthermore, the second server can query the on-chain records based on the identity of the above-mentioned pending sub-accounts, and filter out the pending sub-account group recorded in the on-chain records, which is associated with the target sub-account and the same target main account, and is in a valid state.

[0115] Finally, the second server obtains the historical transaction data and current transaction data of multiple sub-accounts associated with the same target master account based on the sub-account dimension alone, and performs transaction risk monitoring, tracking, risk management, etc. on the above target sub-accounts and associated sub-accounts.

[0116] On the other hand, the second server can first use the supervisor's private key to decrypt the identity restoration information and obtain the master account public key PK of the target master account associated with the target sub-account. MA . Then, a second query request is generated that carries at least the master account public key of the target master account; and the second query request is sent to the first server. The first server receives and responds to the second query request, queries the saved first category account data set according to the master account public key, and finds the data group containing the same master account public key; and obtains the identity of the target master account and / or the identity information of the target user from the data group according to the preset agreement between the regulator and the supervisor; and feeds back the identity of the target master account and / or the identity information of the target user to the second server. The second service receives the identity of the target master account and / or the identity information of the target user.

[0117] Finally, the second server can obtain and perform transaction risk monitoring, tracking, and risk management on the target master account based on the historical transaction data, current transaction data, registration data, etc. of the target master account solely based on the dimension of the master account.

[0118] The second server can also obtain the target user's historical transaction data, current transaction data, user information data, etc. based on the target user's dimensions alone and perform transaction risk monitoring, tracking, risk management, etc. on the target user.

[0119] Of course, it should be noted that during the specific implementation, based on the specific application scenarios and monitoring needs, the above-mentioned multiple dimensions can also be used in combination to conduct more comprehensive and accurate risk data processing.

[0120] The above-mentioned data processing system can avoid introducing complex data processing mechanisms, and can protect the privacy and security of user data while supporting regulators to effectively monitor and track transaction risks of related accounts or users at risk with lower data processing costs and more efficient data processing methods, thereby maintaining the security of transaction data in the system.

[0121] See also Figure 2 As shown, the embodiment of this specification provides a data processing method, wherein the method is specifically applied to the identity service provider side. When implemented specifically, the method may include the following contents.

[0122] S201: Obtaining instruction information of the target sub-account provided by the supervisor;

[0123] S202: According to the indication information of the target sub-account, query the saved second-category account data set to obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor;

[0124] S203: Send the ciphertext data of the target identity-associated data to the supervisor; wherein the supervisor performs corresponding risk data processing using the supervisor private key and the ciphertext data of the target identity-associated data.

[0125] In some embodiments, the above data processing method can be specifically applied to the identity service provider side. Among them, the above identity service provision method can be specifically understood as the management party in the blockchain-based data processing system that is responsible for account registration, providing identity credentials for participants, and registering and saving relevant data.

[0126] The above-mentioned blockchain-based data processing system can be specifically understood as a data processing system built on blockchain technology, which is composed of multiple participants according to corresponding protocol rules to form corresponding data processing. For example, a blockchain-based transaction data processing system responsible for transaction data processing, etc. Among them, the blockchain used can be a public chain or a consortium chain, etc.

[0127] The above-mentioned target sub-account can be specifically understood as a sub-account associated with the target main account held by the target user, and used for performing specific data processing (for example, transaction data processing) in a blockchain-based data processing system.

[0128] Usually, when the target user performs specific data processing by calling the target sub-account in the above-mentioned blockchain-based data processing system, the relevant data (for example, the transaction data involved) will be recorded on the chain. However, the on-chain data only carries the sub-account public key, identity identification and other indication information of the target sub-account. The corresponding target sub-account can be determined based on the on-chain data function alone, but the target main account associated with the target sub-account and the relevant information of the target user (physical user) holding the target main account cannot be further determined, thereby effectively protecting the data privacy security of the target user performing data processing in the above-mentioned blockchain-based data processing system, and avoiding the external disclosure of the target main account and the relevant information of the target user.

[0129] The above-mentioned blockchain-based data processing system may also specifically include a supervisor. Among them, the above-mentioned supervisor is responsible for post-supervision and / or pre-supervision of the data, accounts, or users holding accounts involved in the blockchain-based data processing system. Based on the data processing method provided in the embodiment of this specification, it can support the supervisor to conduct more effective and accurate post-supervision of the data, accounts, or users holding accounts involved in the blockchain-based data processing system.

[0130] In some embodiments, during specific implementation, the regulator may hold the regulator private key and disclose the regulator public key. The service provider may hold the service provider private key and disclose the service provider public key. The target user may hold the master account private key of the target master account and the sub-account private key of the target sub-account associated with the target master account.

[0131] In some embodiments, the target sub-account can be specifically understood as a sub-account that the regulator currently determines may have transaction risks. Specifically, the target sub-account can be a sub-account that the regulator has detected as initiating a behavior operation that has transaction risks in a blockchain-based data processing system. It can also be a sub-account related to the on-chain transaction data that is currently determined to have transaction risks. For example, the initiating account, intermediate account, or receiving account of the on-chain transaction data that has transaction risks, etc.

[0132] Among them, the above-mentioned transaction risks may specifically include: money laundering risk, gambling risk, fraud risk, etc. Of course, the transaction risks listed above are only a schematic illustration. In specific implementation, according to specific application scenarios and processing requirements, the above-mentioned transaction risks may also include other types of risks. This specification does not limit this.

[0133] In some embodiments, the indication information of the target sub-account can be specifically understood as information that can indicate the target sub-account. Specifically, the transaction data initiated or used by the target sub-account in the blockchain-based data processing system can carry the indication information of the target sub-account.

[0134] In some embodiments, during specific implementation, the supervisor may first determine and obtain the indication information of the target sub-account of interest; then generate a first query request carrying the indication information of the target sub-account; and send the first query request to the identity service provider. Accordingly, the identity service provider may obtain the indication information of the target sub-account by parsing the first query request.

[0135] In some embodiments, the indication information of the target sub-account may specifically include: an identity identifier of the target sub-account and / or a sub-account public key, etc.

[0136] In some embodiments, the second type of account data set can be understood as a data set consisting of data groups related to the sub-account recorded and saved by the identity service provider based on the registration data submitted by the user according to the preset protocol when the user registers the sub-account. Specifically, the second type of account data set can include multiple data groups. Each data group corresponds to a sub-account. Specifically, the data group can include indication information of the sub-account (including the sub-account public key and / or identity identifier of the sub-account), and ciphertext data of the sub-account identity-related data (including the ciphertext data of the pseudo-random number function key of the sub-account and / or identity restoration information), etc.

[0137] In some embodiments, the identity service provider also records and saves a first type of account data set. The above-mentioned first type of account data set can be specifically understood as a data set consisting of data groups related to the primary account recorded and saved by the identity service provider based on the registration data submitted by the user according to the preset protocol when the user registers the primary account. Specifically, the above-mentioned first type of account data set may include multiple data groups. Each data group corresponds to a primary account. Specifically, the data group may include indication information of the primary account (including the primary account public key and / or identity identifier of the primary account), as well as identity information of the entity user holding the primary account, etc.

[0138] In some embodiments, the ciphertext data of the target identity-associated data can be specifically understood as ciphertext data that is pre-encrypted using a supervisor's private key and contains relevant information of a target main account associated with a target sub-account or a target user.

[0139] In some embodiments, the ciphertext data of the target identity-associated data may specifically include: ciphertext data of the pseudo-random number function key of the target sub-account and / or identity restoration information, etc.

[0140] In some embodiments, during specific implementation, the identity service provider may query the saved second-category account data set based on the indication information of the target sub-account, find a data group containing the same indication information of the target sub-account, and then obtain the ciphertext data of the target identity-associated data of the target sub-account from the data group.

[0141] Furthermore, the first query request may also carry the processing requirements (or regulatory requirements) provided by the regulator. Accordingly, the identity service provider may, according to the processing requirements or the preset protocol, feed back the ciphertext data of the pseudo-random number function key of the target sub-account obtained in the data group and / or the identity restoration information as the ciphertext data of the target identity-related data to the regulator.

[0142] The supervisor can use the supervisor's private key to decrypt the ciphertext data of the target identity-related data and obtain the hidden target main account associated with the target sub-account or the relevant information of the target user. Furthermore, the supervisor can achieve more effective and accurate post-event supervision by performing corresponding risk data processing based on the above relevant information.

[0143] In some embodiments, when the ciphertext data of the target identity-associated data includes the identity restoration information of the target sub-account, after the ciphertext data of the target identity-associated data is sent to the supervisor, the method may further include the following when implemented:

[0144] S1: Receive the master account public key of the target master account associated with the target sub-account sent by the supervisor; wherein the supervisor uses the supervisor private key held by the supervisor to decrypt the identity restoration information and obtain the master account public key of the target master account;

[0145] S2: According to the master account public key of the target master account, query the saved first-category account data set to determine the identity identifier of the target master account that matches the master account public key of the target master account, and / or the identity information of the target user holding the target master account;

[0146] S3: Send the identity identifier of the target primary account and / or the identity information of the target user to the supervisor.

[0147] In some embodiments, before specific implementation, the identity service provider and the regulator may also interact to generate a first interactive key pair, wherein the identity service provider holds and keeps the first interactive public key, and the regulator holds and keeps the first interactive private key.

[0148] Accordingly, in specific implementation, the identity service provider can use the first interactive public key to encrypt the identity of the target master account and / or the identity information of the target user to obtain the first encrypted data; and then send the first encrypted data to the regulator. The regulator receives the first encrypted data and decrypts it using the first interactive private key to obtain the identity of the target master account and / or the identity information of the target user. This can effectively prevent the identity of the target master account and / or the identity information of the target user from being stolen by a third party during the transmission process, and better protect the data security in the system.

[0149] In some embodiments, before obtaining the indication information of the target sub-account provided by the supervisor, the method may further include the following when implemented:

[0150] S1: receiving a target master account registration request; wherein the target master account registration request carries at least a master account public key of the target master account, an identity identifier of the target master account, and identity information of a target user holding the target master account;

[0151] S2: Respond to the target master account registration request, generate the master account credentials for the target master account; and save the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account in the first category of account data set.

[0152] Through the above embodiments, the target user can complete the registration of the target master account by interacting with the identity service provider in the system; accordingly, the identity service provider can register and save the master account public key, identity identifier, and identity information of the target user.

[0153] In some embodiments, when registering a target master account, the target user may also provide the identity service provider with the target user's KYC (Know your customer) information, such as the target user's occupation, mobile phone number, email address, etc. Accordingly, the identity service provider may store the above KYC information, together with the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account in the first category of account data set.

[0154] Among them, the identity information and KYC information of the target user mentioned above may specifically be information data that has been authorized and agreed by the target user in advance.

[0155] In some embodiments, before specific implementation, the target user and the regulator may also interact to generate a second interactive key pair, wherein the target user holds and keeps the second interactive public key, and the regulator holds and keeps the second interactive private key.

[0156] Correspondingly, during specific implementation, the target user can first use the second interactive public key to encrypt the target user's identity information to obtain the ciphertext data of the target user's identity information; then when registering the target account, the ciphertext data of the target user's identity information, the primary account public key and identity identifier of the target primary account are provided to the identity service provider to be stored in the first category of account data sets.

[0157] In this way, only when it is determined that there may be transaction risks in the target sub-account associated with the target main account, the regulator can use the second interactive private key it holds to obtain the identity information of the target user after obtaining the ciphertext data of the identity information of the target user holding the target main account through the identity service provider. In this way, the identity service provider cannot know the relevant information of the target user holding the target main account, thereby better protecting data privacy and security.

[0158] In some embodiments, the method may further include the following when implemented:

[0159] S1: receiving a target sub-account registration request; wherein the target sub-account registration request carries at least the sub-account public key, identity identifier, and ciphertext data of target identity-related data of the target sub-account;

[0160] S2: responding to the target sub-account registration request and performing preset verification;

[0161] S3: When it is determined that the preset verification has passed, the ciphertext data of the sub-account public key, identity identifier, and target identity-related data of the target sub-account are saved in the second type of account data set.

[0162] Through the above embodiments, the target user can complete the target sub-account registration by interacting with the identity service provider in the system; accordingly, the identity service provider can register and save the sub-account public key, identity identifier, and ciphertext data of the target sub-account's associated data.

[0163] In some embodiments, when registering the target master account, the target user may also provide the identity service provider with verification information such as information π based on zero-knowledge proof. Accordingly, when the identity service provider implements the specific implementation, it may first perform a preset verification on the target sub-account registration request based on the above verification information. If the verification passes and it is determined that the target sub-account meets the protocol requirements, the sub-account public key, identity identifier, and ciphertext data of the target identity-related data of the target sub-account are saved in the second type of account data set. This ensures that the data in the saved second type of account data set is safe and reliable.

[0164] In some embodiments, the above-mentioned preset verification may specifically include preset verification based on zero-knowledge proof. Of course, the verification methods listed above are only a schematic illustration. During specific implementation, other types of verification methods may also be used for preset verification according to specific circumstances and processing requirements. This specification does not limit this.

[0165] In some embodiments, the target sub-account may include an account related to the on-chain transaction data with transaction risks, etc. Specifically, for example, an initiating account, a transfer account, a receiving account, etc. of the on-chain transaction data with transaction risks.

[0166] As can be seen from the above, based on the data processing method provided in the embodiment of this specification, in the data processing system based on blockchain, before specific implementation, the target user can interact with the identity service provider through the client to register the target master account; the identity service provider saves the master account public key, identity identifier, and identity information of the target user in the first type of account data set. The target user can also interact with the identity service provider through the client to register the target sub-account; the identity service provider saves the sub-account public key, identity identifier, and ciphertext data of the target identity-related data encrypted by the public key of the regulator in the second type of account data set. In specific implementation, the target user can call the target sub-account through the client to generate transaction data; and call the target sub-account through the client to use the above transaction data for specific transaction data processing. Correspondingly, the on-chain transaction data in the system only carries the indication information of the target sub-account, and will not disclose the target user and the relevant information of the target master account held by the target user, so as to protect the transaction privacy of the target user. When the regulator finds that there is a transaction risk in the on-chain transaction data related to the target sub-account, it can first obtain the indication information of the target sub-account; and then provide the indication information of the target sub-account to the identity service provider. The identity service provider can query the saved second type of account data set according to the indication information of the target sub-account, obtain the ciphertext data of the target identity associated data of the target sub-account, and feedback the ciphertext data of the target identity associated data to the regulator. The regulator can use the regulator's private key and the ciphertext data of the target identity associated data to perform corresponding risk data processing to monitor and track the transaction risks of related accounts or users.

[0167] See also Figure 3 As shown, the embodiment of this specification also provides a data processing method. Among them, the method is specifically applied to the supervisor side. When implemented specifically, the method may include the following contents.

[0168] S301: Obtain instruction information of the target sub-account.

[0169] S302: Send the indication information of the target sub-account to the identity service provider; wherein the identity service provider queries the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the supervisor.

[0170] S303: Receive the ciphertext data of the target identity-related data; and use the supervisory party's private key and the ciphertext data of the target identity-related data to perform corresponding risk data processing.

[0171] In some embodiments, the indication information of the target sub-account may specifically include: an identity identifier of the target sub-account and / or a sub-account public key, etc.

[0172] In some embodiments, the above-mentioned acquisition of indication information of the target sub-account may include the following contents when implemented: determining on-chain transaction data with transaction risks by performing risk detection on the on-chain transaction data; and acquiring indication information of the target sub-account based on the on-chain transaction data with transaction risks.

[0173] Among them, the above-mentioned on-chain transaction data can at least carry indication information of relevant accounts (for example, initiating account, transit account, receiving account, etc.).

[0174] In some embodiments, the ciphertext data of the target identity-associated data may specifically include: ciphertext data of the pseudo-random number function key of the target sub-account and / or identity restoration information, etc.

[0175] In some embodiments, when the ciphertext data of the target identity-associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account, the above-mentioned risk data processing using the supervisory party private key and the ciphertext data of the target identity-associated data may include the following contents during specific implementation:

[0176] S1: Decrypt the ciphertext data of the pseudo-random number function key using the supervisor's private key to obtain the pseudo-random number function key;

[0177] S2: Generate identity identifiers of multiple pending sub-accounts according to the pseudo-random number function secret key;

[0178] S3: By querying the on-chain records, the identities of the associated sub-accounts that are associated with the same target master account as the target sub-account and are in a valid state are selected from the identities of the multiple pending sub-accounts;

[0179] S4: According to the identity identifier of the target sub-account and the identity identifier of the associated sub-account, transaction risk monitoring is performed on the target sub-account and the associated sub-account.

[0180] Through the above embodiments, the regulator can more effectively and accurately monitor and track the transaction risks of the target sub-accounts and associated sub-accounts based on the sub-account dimension, thereby achieving transaction risk management.

[0181] In some embodiments, when the ciphertext data of the target identity-associated data includes the identity restoration information of the target sub-account, the above-mentioned risk data processing using the supervisory party's private key and the ciphertext data of the target identity-associated data may include the following contents during specific implementation:

[0182] S1: Use the supervisor's private key to decrypt the identity restoration information and obtain the master account public key of the target master account associated with the target sub-account;

[0183] S2: Sending the master account public key of the target master account to the identity service provider; wherein the identity service provider queries the saved first category account data set according to the master account public key of the target master account, and determines the identity identifier of the target master account that matches the master account public key of the target master account, and / or the identity information of the target user holding the target master account;

[0184] S3: receiving the identity of the target master account and / or the identity information of the target user;

[0185] S4: monitoring the transaction risk of the target master account according to the identity identifier of the target master account; and / or monitoring the transaction risk of the target user according to the identity information of the target user.

[0186] Through the above embodiments, the regulator can more effectively and accurately monitor and track the transaction risks of the target master account and / or target user based on the master account dimension and / or user dimension to achieve transaction risk management.

[0187] In some embodiments, during specific implementation, the regulator may also obtain and comprehensively utilize the identity of the target main account, the identity information of the target user, and the identity of the target sub-account and associated sub-accounts based on multiple dimensions to conduct more comprehensive and accurate transaction risk monitoring and tracking, so as to better protect the data security of the data processing system.

[0188] See also Figure 4 As shown, the embodiment of this specification also provides a data processing method. Among them, the method is specifically applied to the client side held by the target user. When implemented specifically, the method may include the following contents.

[0189] S401: Call the target sub-account to generate transaction data; wherein the transaction data at least carries the indication information of the target sub-account (for example, the sub-account public key PK of the target sub-account); SAand / or identification);

[0190] S402: In a blockchain-based data processing system, the target sub-account uses the transaction data to perform corresponding transaction data processing; wherein the client completes the target master account registration and the target sub-account registration in advance by interacting with the identity service provider in the blockchain-based data processing system; the identity service provider saves the first type of account data set and the second type of account data set respectively; the second type of account data set contains at least the ciphertext data of the target identity-related data of the target sub-account; the ciphertext data of the target identity-related data is the ciphertext data encrypted using the public key of the regulator.

[0191] In some embodiments, before calling the target sub-account to generate transaction data, the method may further include the following when implemented: responding to the master account creation instruction, creating the target master account, and obtaining the identity of the target master account (e.g., MA); generating the master account public key of the target master account (e.g., PK MA ) and the master account private key (e.g., SK MA ).

[0192] In some embodiments, after the target master account is created, the method may also include the following when implemented: generating a target master account registration request; wherein the target master account registration request carries at least the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account; and sending the target master account registration request to the identity service provider.

[0193] In some embodiments, after the target master account is created, the method may further include the following when implemented: responding to the sub-account creation instruction, obtaining a pseudo-random number function key (e.g., K); generating the identity of the target sub-account using a pseudo-random number function according to the pseudo-random number function key to create the target sub-account. For example, the identity of the target sub-account is generated in the following manner: SA ID =PRF K (x). Where x is the number of cells in the data set [1, MAX ACC ], the index integer extracted from ACC is a system constant.

[0194] In some embodiments, after creating the target sub-account, the method may further include the following when implemented:

[0195] S1: Generate the subaccount public key of the target subaccount (e.g., PK SA );

[0196] S2: Obtain and use the supervisor's public key (e.g., PKAP ), and obtain the ciphertext data of the target identity associated data of the target sub-account through encryption processing; wherein the ciphertext data of the target identity associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account (for example, E MA =Enc PKAP (K)) and / or identity restoration information (e.g., C=Enc PKAP (PK MA )).

[0197] In some embodiments, during implementation, the method may further include the following:

[0198] S1: Generate a target sub-account registration request; wherein the target sub-account registration request carries at least the sub-account public key, identity identifier, and ciphertext data of target identity-related data of the target sub-account;

[0199] S2: Send the target sub-account registration request to the identity service provider.

[0200] As can be seen from the above, the data processing method provided in the embodiments of this specification can avoid introducing complex data processing mechanisms in the blockchain-based data processing system, and can protect the privacy and security of user data at a lower data processing cost and a more efficient data processing method. At the same time, it can support regulators to effectively monitor and track transaction risks of related accounts or users at risk, and maintain the security of transaction data in the system.

[0201] The embodiments of this specification also provide a server, including a processor and a memory for storing processor executable instructions. When the processor is implemented, it can perform the following steps according to the instructions: obtain the indication information of the target sub-account provided by the regulator; query the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the regulator; send the ciphertext data of the target identity-associated data to the regulator; wherein the regulator uses the private key of the regulator held and the ciphertext data of the target identity-associated data to perform corresponding risk data processing.

[0202] In order to complete the above instructions more accurately, refer to Figure 5 As shown, the embodiment of this specification also provides another specific server, wherein the server includes a network communication port 501, a processor 502 and a memory 503, and the above structures are connected through internal cables so that each structure can perform specific data interaction.

[0203] The network communication port 501 may be specifically used to obtain indication information of the target sub-account provided by the regulator.

[0204] The processor 502 can be specifically used to query the saved second-category account data set according to the indication information of the target sub-account, and obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the regulator; the ciphertext data of the target identity-associated data is sent to the regulator; wherein the regulator uses the regulator's private key and the ciphertext data of the target identity-associated data to perform corresponding risk data processing.

[0205] The memory 503 may be specifically used to store corresponding instruction programs.

[0206] In this embodiment, the network communication port 501 can be a virtual port that is bound to different communication protocols so that different data can be sent or received. For example, the network communication port can be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for email data communication. In addition, the network communication port can also be a physical communication interface or communication chip. For example, it can be a wireless mobile network communication chip, such as GSM, CDMA, etc.; it can also be a Wifi chip; it can also be a Bluetooth chip.

[0207] In this embodiment, the processor 502 may be implemented in any appropriate manner. For example, the processor may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, etc. This specification does not limit this.

[0208] In this embodiment, the memory 503 may include multiple levels. In a digital system, anything that can store binary data can be a memory; in an integrated circuit, a circuit with a storage function but no physical form is also called a memory, such as RAM, FIFO, etc.; in a system, a storage device with a physical form is also called a memory, such as a memory stick, TF card, etc.

[0209] The embodiments of the present specification also provide another server, including a processor and a memory for storing processor executable instructions. When the processor is implemented, it can perform the following steps according to the instructions: obtain the indication information of the target sub-account; send the indication information of the target sub-account to the identity service provider; wherein the identity service provider queries the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity associated data of the target sub-account; the ciphertext data of the target identity associated data is the ciphertext data encrypted by using the public key of the regulator; receive the ciphertext data of the target identity associated data; and use the private key of the regulator and the ciphertext data of the target identity associated data held by the provider to perform corresponding risk data processing.

[0210] The embodiments of this specification also provide a client, including a processor and a memory for storing instructions executable by the processor. When the processor is implemented, it can perform the following steps according to the instructions: calling a target sub-account to generate transaction data; wherein the transaction data at least carries indication information of the target sub-account; in a blockchain-based data processing system, using the transaction data through the target sub-account to perform corresponding transaction data processing.

[0211] The embodiments of this specification also provide a computer storage medium based on the above-mentioned data processing method, wherein the computer storage medium stores computer program instructions, which, when executed, implement: obtaining the indication information of the target sub-account provided by the regulator; querying the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the regulator; sending the ciphertext data of the target identity-associated data to the regulator; wherein the regulator uses the private key of the regulator held by the regulator and the ciphertext data of the target identity-associated data to perform corresponding risk data processing.

[0212] The embodiments of this specification also provide a computer storage medium based on the above-mentioned data processing method, wherein the computer storage medium stores computer program instructions, and when the computer program instructions are executed, the following are achieved: obtaining the indication information of the target sub-account; sending the indication information of the target sub-account to the identity service provider; wherein the identity service provider queries the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the regulator; receiving the ciphertext data of the target identity-associated data; and performing corresponding risk data processing using the private key of the regulator and the ciphertext data of the target identity-associated data.

[0213] The embodiment of the specification also provides a computer storage medium based on the above-mentioned data processing method, wherein the computer storage medium stores computer program instructions, and when the computer program instructions are executed, the following are achieved: calling a target sub-account to generate transaction data; wherein the transaction data at least carries indication information of the target sub-account; in a blockchain-based data processing system, the transaction data is used by the target sub-account to perform corresponding transaction data processing; wherein the client interacts with the identity service provider in the blockchain-based data processing system in advance to complete the target main account registration and the target sub-account registration; the identity service provider respectively saves a first type of account data set and a second type of account data set; the second type of account data set contains at least ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the regulator.

[0214] In this embodiment, the storage medium includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a cache, a hard disk (HDD), or a memory card. The memory may be used to store computer program instructions. The network communication unit may be an interface for network connection communication set in accordance with the standard specified by the communication protocol.

[0215] In this embodiment, the functions and effects specifically implemented by the program instructions stored in the computer storage medium can be explained in comparison with other implementations and will not be described in detail here.

[0216] See also Figure 6 As shown, at the software level, the embodiment of this specification also provides a data processing device, which may specifically include the following structural modules:

[0217] The acquisition module 601 may be specifically used to acquire the indication information of the target sub-account provided by the supervisor;

[0218] The query module 602 may be specifically configured to query the stored second-category account data set according to the indication information of the target sub-account, and obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor;

[0219] The sending module 603 may be specifically used to send the ciphertext data of the target identity associated data to the supervisor; wherein the supervisor performs corresponding risk data processing using the supervisor private key and the ciphertext data of the target identity associated data.

[0220] The embodiments of this specification also provide a data processing device, including: an acquisition module, which can be specifically used to acquire the indication information of the target sub-account; a sending module, which can be specifically used to send the indication information of the target sub-account to the identity service provider; wherein the identity service provider queries the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted using the public key of the regulator; a processing module, which can be specifically used to receive the ciphertext data of the target identity-associated data; and use the private key of the regulator held and the ciphertext data of the target identity-associated data to perform corresponding risk data processing.

[0221] The embodiments of this specification also provide a data processing device, including: a generation module, which can be specifically used to call a target sub-account to generate transaction data; wherein the transaction data at least carries indication information of the target sub-account; a processing module, which can be specifically used to perform corresponding transaction data processing using the transaction data through the target sub-account in a blockchain-based data processing system; wherein the client interacts with the identity service provider in the blockchain-based data processing system in advance to complete the target main account registration and the target sub-account registration; the identity service provider respectively saves a first type of account data set and a second type of account data set; the second type of account data set contains at least ciphertext data of the target identity-related data of the target sub-account; the ciphertext data of the target identity-related data is the ciphertext data encrypted using the public key of the regulator.

[0222] It should be noted that the units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this specification, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0223] As can be seen from the above, the data processing device provided in the embodiments of this specification can avoid introducing complex data processing mechanisms in the blockchain-based data processing system, and can protect the privacy and security of user data at a lower data processing cost and a more efficient data processing method. At the same time, it can support regulators to effectively monitor and track transaction risks of related accounts or users at risk, and maintain the security of transaction data in the system.

[0224] Although the present specification provides method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent a unique execution order. When the device or client product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. The first, second, etc. words are used to represent the name, and do not represent any particular order.

[0225] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0226] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media including storage devices.

[0227] Through the description of the above embodiments, it can be known that those skilled in the art can clearly understand that the present specification can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present specification can essentially be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in each embodiment of the present specification or some parts of the embodiments.

[0228] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. This specification can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0229] Although the present specification is described through embodiments, those skilled in the art will appreciate that there are many modifications and changes to the present specification without departing from the spirit of the present specification, and it is intended that the appended claims include these modifications and changes without departing from the spirit of the present specification.

Claims

1. A data processing method, characterized in that: Applicable to identity service providers, including: Obtaining the indication information of the target sub-account provided by the regulator; the target sub-account is the account of the on-chain transaction data with transaction risks discovered by the regulator when performing risk detection on the on-chain transaction data; According to the indication information of the target sub-account, the saved second type of account data set is queried to obtain the ciphertext data of the target identity associated data of the target sub-account; wherein the ciphertext data of the target identity associated data is the ciphertext data encrypted by using the public key of the supervisor; the ciphertext data of the target identity associated data includes: the ciphertext data of the pseudo-random number function key of the target sub-account and / or the identity restoration information; the ciphertext data of the target identity associated data is obtained by the client encrypting the public key of the master account or the pseudo-random function key by using the public key of the supervisor; the ciphertext data of the target identity associated data is provided by the client to the identity service provider for safekeeping when registering the target sub-account; Sending the ciphertext data of the target identity-associated data to the supervisor; wherein the supervisor uses the supervisor private key held by the supervisor and the ciphertext data of the target identity-associated data to perform corresponding risk data processing; Among them, the regulator uses the regulator's private key and the ciphertext data of the target identity-associated data to perform corresponding risk data processing, including: when the ciphertext data of the target identity-associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account, use the regulator's private key to decrypt the ciphertext data of the pseudo-random number function key to obtain the pseudo-random number function key; generate multiple identity identifiers of pending sub-accounts based on the pseudo-random number function key; by querying the on-chain records, filter out the identity identifiers of the associated sub-accounts that are associated with the same target main account as the target sub-account and are in a valid state from the identity identifiers of the multiple pending sub-accounts; based on the identity identifier of the target sub-account and the identity identifier of the associated sub-account, monitor the transaction risks of the target sub-account and the associated sub-account; in the target identity associated When the ciphertext data of the data includes the identity restoration information of the target sub-account, the identity restoration information is decrypted using the private key of the supervisor to obtain the master account public key of the target master account associated with the target sub-account; the master account public key of the target master account is sent to the identity service provider; wherein the identity service provider queries the saved first-category account data set according to the master account public key of the target master account, determines the identity identifier of the target master account that matches the master account public key of the target master account, and / or, the identity information of the target user holding the target master account; receives the identity identifier of the target master account and / or the identity information of the target user; performs transaction risk monitoring on the target master account according to the identity identifier of the target master account; and / or, performs transaction risk monitoring on the target user according to the identity information of the target user.

2. The method according to claim 1, characterized in that The indication information of the target sub-account includes: the identity identifier of the target sub-account and / or the sub-account public key.

3. The method according to claim 1, characterized in that In a case where the ciphertext data of the target identity-associated data includes identity restoration information of the target sub-account, after sending the ciphertext data of the target identity-associated data to the supervisor, the method further includes: Receive the master account public key of the target master account associated with the target sub-account sent by the supervisor; wherein the supervisor uses the supervisor private key held by the supervisor to decrypt the identity restoration information and obtain the master account public key of the target master account; According to the master account public key of the target master account, query the saved first category account data set to determine the identity identifier of the target master account that matches the master account public key of the target master account, and / or the identity information of the target user holding the target master account; The identity identifier of the target primary account and / or the identity information of the target user is sent to the supervisor.

4. The method according to claim 1, characterized in that: Before obtaining the indication information of the target sub-account provided by the supervisor, the method further includes: Receive a target master account registration request; wherein the target master account registration request carries at least a master account public key of the target master account, an identity identifier of the target master account, and identity information of a target user holding the target master account; In response to the target master account registration request, a master account credential for the target master account is generated; and the master account public key of the target master account, the identity identifier of the target master account, and the identity information of the target user holding the target master account are stored in the first category of account data sets.

5. The method according to claim 4, characterized in that The method further comprises: Receive a target sub-account registration request; wherein the target sub-account registration request carries at least a sub-account public key of the target sub-account, an identity identifier of the target sub-account, and ciphertext data of target identity-related data; Respond to the target sub-account registration request and perform preset verification; When it is determined that the preset verification has passed, the sub-account public key of the target sub-account, the identity identifier of the target sub-account, and the ciphertext data of the target identity-related data are saved in the second type of account data set.

6. The method according to claim 5, characterized in that The preset verification includes a preset verification based on zero-knowledge proof.

7. The method according to claim 1, characterized in that The target sub-account includes an account related to on-chain transaction data that has transaction risks.

8. A data processing method, characterized in that: Application to regulators, including: Obtaining instruction information of a target sub-account; the target sub-account is an account of on-chain transaction data that is found to have transaction risks when the regulator performs risk detection on the on-chain transaction data; The indication information of the target sub-account is sent to the identity service provider; wherein the identity service provider queries the saved second-category account data set according to the indication information of the target sub-account to obtain the ciphertext data of the target identity-associated data of the target sub-account; the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor; the ciphertext data of the target identity-associated data includes: the ciphertext data of the pseudo-random number function key of the target sub-account and / or the identity restoration information; the ciphertext data of the target identity-associated data is obtained by the client encrypting the public key of the master account or the pseudo-random function key by using the public key of the supervisor; the ciphertext data of the target identity-associated data is provided by the client to the identity service provider for safekeeping when registering the target sub-account; Receive the ciphertext data of the target identity-related data; and use the supervisory party's private key and the ciphertext data of the target identity-related data to perform corresponding risk data processing; Among them, the corresponding risk data processing is performed using the private key of the supervisor and the ciphertext data of the target identity-associated data, including: when the ciphertext data of the target identity-associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account, using the private key of the supervisor to decrypt the ciphertext data of the pseudo-random number function key to obtain the pseudo-random number function key; generating multiple identity identifiers of pending sub-accounts according to the pseudo-random number function key; by querying the on-chain records, screening out the identity identifiers of the associated sub-accounts that are associated with the same target main account as the target sub-account and are in a valid state from the identity identifiers of the multiple pending sub-accounts; based on the identity identifier of the target sub-account and the identity identifier of the associated sub-account, monitoring the transaction risks of the target sub-account and the associated sub-account; in the target identity-associated data In the case where the ciphertext data includes the identity restoration information of the target sub-account, the identity restoration information is decrypted using the private key of the supervisor to obtain the master account public key of the target master account associated with the target sub-account; the master account public key of the target master account is sent to the identity service provider; wherein the identity service provider queries the saved first category account data set according to the master account public key of the target master account, determines the identity identifier of the target master account that matches the master account public key of the target master account, and / or the identity information of the target user holding the target master account; receives the identity identifier of the target master account and / or the identity information of the target user; performs transaction risk monitoring on the target master account according to the identity identifier of the target master account; and / or performs transaction risk monitoring on the target user according to the identity information of the target user.

9. The method according to claim 8, characterized in that The indication information of the target sub-account includes: the identity identifier of the target sub-account and / or the sub-account public key.

10. The method according to claim 9, characterized in that Get instructions for the target subaccount, including: By performing risk detection on the on-chain transaction data, the on-chain transaction data with transaction risks is identified; According to the on-chain transaction data with transaction risks, the indication information of the target sub-account is obtained.

11. A data processing device, characterized in that: include: An acquisition module, used to acquire the indication information of the target sub-account provided by the regulator; The target sub-account is the account of on-chain transaction data that the regulator finds to have transaction risks when performing risk detection on the on-chain transaction data; A query module, used to query the saved second-category account data set according to the indication information of the target sub-account, and obtain the ciphertext data of the target identity-associated data of the target sub-account; wherein the ciphertext data of the target identity-associated data is the ciphertext data encrypted by using the public key of the supervisor; the ciphertext data of the target identity-associated data includes: the ciphertext data of the pseudo-random number function key of the target sub-account and / or the identity restoration information; the ciphertext data of the target identity-associated data is obtained by the client encrypting the public key of the master account or the pseudo-random function key by using the public key of the supervisor; the ciphertext data of the target identity-associated data is provided by the client to the identity service provider for safekeeping when registering the target sub-account; A sending module, used to send the ciphertext data of the target identity-associated data to a supervisor; wherein the supervisor uses the supervisor private key held by the supervisor and the ciphertext data of the target identity-associated data to perform corresponding risk data processing; Among them, the regulator uses the regulator's private key and the ciphertext data of the target identity-associated data to perform corresponding risk data processing, including: when the ciphertext data of the target identity-associated data includes the ciphertext data of the pseudo-random number function key of the target sub-account, use the regulator's private key to decrypt the ciphertext data of the pseudo-random number function key to obtain the pseudo-random number function key; generate multiple identity identifiers of pending sub-accounts based on the pseudo-random number function key; by querying the on-chain records, filter out the identity identifiers of the associated sub-accounts that are associated with the same target main account as the target sub-account and are in a valid state from the identity identifiers of the multiple pending sub-accounts; based on the identity identifier of the target sub-account and the identity identifier of the associated sub-account, monitor the transaction risks of the target sub-account and the associated sub-account; in the target identity associated When the ciphertext data of the data includes the identity restoration information of the target sub-account, the identity restoration information is decrypted using the private key of the supervisor to obtain the master account public key of the target master account associated with the target sub-account; the master account public key of the target master account is sent to the identity service provider; wherein the identity service provider queries the saved first-category account data set according to the master account public key of the target master account, determines the identity identifier of the target master account that matches the master account public key of the target master account, and / or, the identity information of the target user holding the target master account; receives the identity identifier of the target master account and / or the identity information of the target user; performs transaction risk monitoring on the target master account according to the identity identifier of the target master account; and / or, performs transaction risk monitoring on the target user according to the identity information of the target user.

12. A server, characterized in that: The invention comprises a processor and a memory for storing instructions executable by the processor, wherein the steps of the method according to any one of claims 1 to 10 are implemented when the processor executes the instructions.

13. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the instructions are executed, the steps of the method according to any one of claims 1 to 10 are implemented.

Images