Blockchain-based data management method, electronic device, and storage medium

Abstract

The present application provides a data management method, electronic device, and computer-readable storage medium based on blockchain. The method includes: a data center node sends an authorization request to an authorization node; the authorization request includes the user identification of the target user, feature-related data of the target biometric, and the first private key signature of the data center node; the authorization node verifies the first private key signature, and if the verification passes, determines the target user's authorization status for the target biometric to the data center node; the authorization node stores a first authorization record in the blockchain based on the authorization status; the first authorization record includes the authorization status, the user identification of the target user, feature-related data of the target biometric, and the second private key signature of the target user. The present application solution authorizes the data center node for biometrics based on blockchain, so that the biometrics can only be used by the data center node under authorized circumstances, avoiding the problems of abuse and inadequate management of biometrics.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a blockchain-based data management method, electronic device, and computer-readable storage medium. Background Art

[0002] Biometric technology combines computers with optics, acoustics, biosensors, and biostatistics to identify individuals using inherent physiological characteristics of the human body, such as fingerprints, faces, irises, and finger veins. Service providers (such as banks) that use biometric technology to identify individuals can establish their own biometric databases, which record the biometric data provided by users when they register with the service provider.

[0003] Currently, there is an increasing demand for biometric identification applications, and there are problems such as abuse of biometrics and inadequate management. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a blockchain-based data management method, electronic device, and computer-readable storage medium to address the problems of abuse and inadequate management of biometric features.

[0005] On the one hand, this application provides a blockchain-based data management method, comprising:

[0006] The data center node sends an authorization request to the authorization node; wherein the authorization request includes the user identification of the target user, feature-related data of the target biometric feature, and the first private key signature of the data center node;

[0007] The authorization node verifies the first private key signature, and if the verification is successful, determines the authorization status of the target user for the data center node with respect to the target biometric feature;

[0008] The authorization node stores a first authorization record in the blockchain based on the authorization status; wherein the first authorization record includes the authorization status, the user identification of the target user, the feature-related data of the target biometric and the second private key signature of the target user; the authorization node and the data center node are consensus nodes of the blockchain.

[0009] In one embodiment, the method further comprises:

[0010] The authorization node sends an authorization revocation request to the data center node; wherein the authorization revocation request includes the user identification of the target user, the feature-related data of the target biometric feature, and the third private key signature of the target user;

[0011] The data center node verifies the third private key signature, and if the verification passes, sends a consent withdrawal notification to the authorization node;

[0012] The authorization node stores a second authorization record in the blockchain based on the authorization withdrawal status indicated by the consent withdrawal notification; wherein the second authorization record includes the authorization withdrawal status, the user identifier of the target user, the feature-related data of the target biometric feature, and the fourth private key signature of the target user.

[0013] In one embodiment, the method further comprises:

[0014] The data center node sends a feature update instruction to the authorization node; wherein the feature update instruction includes the user identifier of the target user, feature-related data of a designated biometric feature that replaces the target biometric feature, and a fifth private key signature of the data center node;

[0015] The authorization node verifies the fifth private key signature, and if the verification passes, stores a third authorization record in the blockchain; wherein the third authorization record includes the authorization status, the user identifier of the target user, the feature-related data of the specified biometric feature, and the fifth private key signature of the target user.

[0016] In one embodiment, before the data center node sends the feature update instruction to the authorization node, the method further includes:

[0017] The data center node sends a feature update request to the authorization node; wherein the feature update request includes the user identifier of the target user, feature-related data of the target biometric feature, and the sixth private key signature of the data center node;

[0018] The authorization node verifies the sixth private key signature, and if the verification passes, determines whether the target user updates the target biometric feature;

[0019] If so, the authorization node sends an update permission notification to the data center node, so that the data center node updates the target biometric feature.

[0020] In one embodiment, the method further comprises:

[0021] When the identification result corresponding to the target biometric feature of the target user is passed, the data center node sends a first authorization transaction record to the authorization node; wherein the first authorization transaction record includes the user identifier of the target user, feature-related data of the target biometric feature, and the seventh private key signature of the data center node;

[0022] The authorization node confirms the identification result based on the user identifier, feature-related data, and the seventh private key signature in the first authorization transaction to obtain a confirmation result;

[0023] The authorization node stores a second authorization transaction record in the blockchain based on the confirmation result; wherein the second authorization transaction record includes the confirmation result, the user identifier of the target user, the feature-related data of the target biometric, and the eighth private key signature of the target user;

[0024] When the confirmation result is passed, the data center node determines that the identification result is valid.

[0025] In one embodiment, the authorization node confirms the identification result based on the user identifier, feature-related data, and the seventh private key signature in the first authorization transaction to obtain a confirmation result, including:

[0026] The authorization node verifies the seventh private key signature. If the verification is successful, the authorization node searches the blockchain for a fourth authorization record corresponding to the user identifier and the feature-related data;

[0027] The authorization node determines, based on the fourth authorization record, whether the data center node is authorized to use the target biometric feature of the target user, and obtains an authorization verification result;

[0028] If the authorization verification result is authorized, the authorization node determines whether the identification process corresponding to the identification result is initiated by the target user, and obtains an authenticity verification result of the identification process;

[0029] The authorization node determines the confirmation result based on the authorization verification result and the authenticity verification result.

[0030] In one embodiment, the method further comprises:

[0031] Before the data center node sends the authorization request, or the feature update instruction, or the feature update request, or the first authorization transaction record, or before the authorization node sends the authorization withdrawal request, the data center node and the authorization node send identity authentication requests to each other;

[0032] The recipient of the identity authentication request verifies the authenticity of the identity authentication request based on the sender's identity record in the blockchain; wherein the identity record includes an identity identifier and an identity credential.

[0033] In one embodiment, the method further comprises:

[0034] The data center node or the authorization node, as the registrant, sends a registration request to the registration node; wherein the registration request includes the eighth private key signature and identity certificate of the registrant;

[0035] The registration node verifies the signature of the eighth private key based on the identity certificate, and if the verification is successful, assigns an identity identifier to the registrant;

[0036] The registration node stores the identity record of the registrant in the blockchain; wherein the identity record includes the identity identifier and identity credentials of the registrant.

[0037] Furthermore, the present application also provides an electronic device, comprising:

[0038] processor;

[0039] a memory for storing processor-executable instructions;

[0040] The processor is configured to execute the above-mentioned blockchain-based data management method applied to the data center node, the authorization node, or the registration node.

[0041] In addition, the present application also provides a computer-readable storage medium, which stores a computer program, and the computer program can be executed by a processor to complete the above-mentioned blockchain-based data management method applied to the data center node or the authorization node or the registration node.

[0042] This application solution uses blockchain to authorize data center nodes to use biometrics, so that biometrics can only be used by data center nodes under authorized circumstances, thus avoiding the problems of biometrics being abused and inadequately managed.

[0043] In addition, relying on blockchain to manage biometrics can control processes such as authorization withdrawal and feature updates, and prevent biometric counterfeiting attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments of the present application.

[0045] Figure 1 A schematic diagram of an application scenario of a blockchain-based data management method according to an embodiment of the present application;

[0046] Figure 2 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application;

[0047] Figure 3A flowchart of a blockchain-based data management method provided in one embodiment of the present application;

[0048] Figure 4 A flowchart of a method for revoking authorization provided in one embodiment of the present application;

[0049] Figure 5 A flowchart of a feature updating method provided in one embodiment of the present application;

[0050] Figure 6 A flowchart of a feature update application method provided in one embodiment of the present application;

[0051] Figure 7 A flowchart of a method for using a feature provided in one embodiment of the present application;

[0052] Figure 8 A flowchart of a method for confirming an identification result provided in one embodiment of the present application;

[0053] Figure 9 A flowchart of an identity verification method provided in one embodiment of the present application;

[0054] Figure 10 A flowchart of a registration method provided in accordance with an embodiment of the present application. DETAILED DESCRIPTION

[0055] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0056] Similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0057] Figure 1 Schematic diagram of the application scenario of the data management method based on blockchain provided in the embodiment of this application. Figure 1As shown, the application scenario includes a user terminal 20, a data center server 30, a data center node 40, an authorization node 50, and a registration node 60; the user terminal 20 can be a host, a mobile phone, a tablet computer and other devices, which accesses the authorization node 50 through the blockchain API (Application Programming Interface) to allow users to participate in data management; the authorization node 50 can be a server, a server cluster or a cloud computing center, which is used to authorize user data on the blockchain; in one embodiment, the user terminal 20 and the authorization node 50 can be integrated into one device; the data center server 30 can be a server, a server cluster or a cloud computing center, which is used to store user data; the data center node 40 can be a server, a server cluster or a cloud computing center, which is used to initiate authorization requests for user data on the blockchain; in one embodiment, the data center server 30 and the data center node 40 can be integrated into one device; the registration node 60 can be a server, a server cluster or a cloud computing center, which is used to process registration requests from the data center node 40 and the authorization node 50; the data center node 40, the authorization node 50, and the registration node 60 are all consensus nodes of the blockchain.

[0058] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12, Figure 2 In the example, a processor 11 is used. Processor 11 and memory 12 are connected via bus 10. Memory 12 stores instructions executable by processor 11. Processor 11 executes these instructions, enabling electronic device 1 to perform all or part of the method described in the following embodiments. In one embodiment, electronic device 1 may be the aforementioned data center node 40, authorization node 50, or registration node 60, configured to execute the blockchain-based data management method applied to data center node 40, authorization node 50, or registration node 60.

[0059] The memory 12 can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0060] The present application also provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by the processor 11 to complete the blockchain-based data management method provided in the present application and applied to the data center node 40, the authorization node 50, or the registration node 60.

[0061] See also Figure 3 , is a flowchart of a data management method based on blockchain provided by an embodiment of the present application, such as Figure 3 As shown, the method may include the following steps 310 to 330.

[0062] Step 310: The data center node sends an authorization request to the authorization node; wherein the authorization request includes the user identification of the target user, feature-related data of the target biometric feature, and the first private key signature of the data center node.

[0063] Here, the authorization request is used to apply to the authorization node for permission to use the target biometric feature of the target user. The target user is the user indicated by the authorization request. The target biometric feature is the biometric feature indicated by the authorization request. Biometric features may include but are not limited to fingerprints, faces, irises, and finger veins. The feature-related data of the biometric feature may include a feature identifier and a feature hash. The feature identifier is used to uniquely indicate the biometric feature. For example, the feature identifier can be the serial number of the biometric feature in the database, or it can be the storage address of the biometric feature in the database. The feature hash is obtained by hashing the feature data. For example, the biometric feature is a face, and the feature hash can be the hash value of the face image.

[0064] A data center can be the data system of a service provider such as a bank, e-commerce platform, or insurance company. A data center node can be a server that serves as a consensus node on the blockchain.

[0065] The authorization node is a consensus node of the blockchain that can be connected to the user terminal. The authorization node is used to authorize the user's biometric characteristics to the data center node.

[0066] When the service provider needs to use the target biometric characteristics of the target user, the service provider's data center node can obtain the user identification of the target user and the feature-related data of the target biometric characteristics from the data center server, and can encrypt the user identification and feature-related data through the private key of the data center node in the blockchain to obtain the first private key signature.

[0067] The data center node can construct an authorization request based on the user identification, feature-related data, and the first private key signature, and send the authorization request to the authorization node.

[0068] The data center node can also add other information to the authorization request. In this case, the other information is encrypted together with the user identification and feature data to obtain the first private key signature. For example, the other information can be a timestamp, the address of the data center node in the blockchain, the address of the target user in the blockchain, etc.

[0069] Step 320: The authorization node verifies the first private key signature. If the verification is successful, the authorization status of the target user for the target biometric feature and the data center node is determined.

[0070] After receiving the authorization request, the authorization node decrypts the first private key signature using the data center node's public key and compares the decrypted result with the content of the authorization request, excluding the first private key signature. If the two differ, the authorization request has been tampered with and verification has failed. If the two are identical, verification has passed.

[0071] After the first private key signature is verified, the authorization node can push an authorization request to the target user's user terminal to obtain an authorization instruction returned by the target user through the user terminal. Based on the authorization instruction, the authorization status of the target user for the data center node with respect to the target biometric is determined. The authorization instruction may include the authorization status, the target user's private key, or the target user's second private key signature. The authorization status may include the scope of use, the authorization period, etc.

[0072] Step 330: The authorization node stores a first authorization record in the blockchain based on the authorization status; wherein the first authorization record includes the authorization status, the user identifier of the target user, feature-related data of the target biometric, and the second private key signature of the target user; the authorization node and the data center node are consensus nodes of the blockchain.

[0073] After determining the authorization status, the authorization node may construct a first authorization record based on the authorization status, the user identification of the target user, and feature-related data of the target biometric feature.

[0074] In one scenario, the authorization instruction includes the target user's private key. The authorization node may encrypt the target user's user ID, target biometric feature-related data, authorization status, and other optional information based on the private key to obtain a second private key signature. The authorization node may construct a first authorization record based on the second private key signature, user ID, feature-related data, authorization status, and other optional information.

[0075] In another case, the authorization instruction includes a second private key signature. In this case, the target user encrypts the user ID, authorization status, feature-related data, and other optional information through the user terminal. In this case, the authorization node can directly construct the first authorization record using the second private key signature, user ID, feature-related data, authorization status, and other optional information.

[0076] The authorization node may send the first authorization record to other consensus nodes of the blockchain, thereby writing the first authorization record into the blockchain. In this case, the data center node may receive the first authorization record and thereby confirm that it has obtained permission to use the target biometric feature of the target user.

[0077] In one embodiment, the authorization node may send an authorization success notification to the data center node, which may include the authorization status, the user identification of the target user, and feature-related data of the target biometric, thereby notifying the data center node of the authorization success more directly and quickly.

[0078] After confirming that the target user has authorized the target biometric feature, the data center node can mark the feature data of the target biometric feature in the database based on the authorization status so that the authorized biometric feature can be used subsequently according to the mark.

[0079] Through the above measures, biometric authorization of data center nodes is carried out based on blockchain, so that biometrics can only be used by data center nodes under authorized circumstances, avoiding the problem of abuse and inadequate management of biometrics.

[0080] In one embodiment, see Figure 4 , is a flowchart of an authorization revocation method provided in an embodiment of the present application, such as Figure 4 As shown, the method includes the following steps 410 to 430.

[0081] Step 410: The authorization node sends an authorization revocation request to the data center node; wherein the authorization revocation request includes the user identification of the target user, feature-related data of the target biometric feature, and the third private key signature of the target user.

[0082] Here, the authorization revocation request is used to instruct the target user to revoke the permission to use the target biometric feature to the data center node.

[0083] The authorization node can receive a revocation request from the target user from the user terminal and send it to the data center node. At this point, the user terminal has encrypted the target user's user ID, target biometric data, and other optional information using the target user's private key to obtain a third private key signature.

[0084] Alternatively, the authorization node can receive an authorization revocation instruction from a user terminal and parse it to obtain the target user's private key, user ID, target biometric feature-related data, and other optional information. The authorization node encrypts the user ID, feature-related data, and other optional information using the private key to obtain a third private key signature. Furthermore, the authorization node constructs an authorization revocation request using the third private key signature, user ID, feature-related data, and other optional information, and sends it to the data center node.

[0085] Step 420: The data center node verifies the third private key signature. If the verification passes, a consent withdrawal notification is sent to the authorization node.

[0086] After receiving the authorization withdrawal request, the data center node parses it to extract the third private key signature, user ID, feature-related data, and other optional information. The data center node can decrypt the third private key signature using the public key indicated by the user ID and compare the decrypted result with the content of the authorization withdrawal request, excluding the third private key signature. If the two differ, it indicates that the authorization withdrawal request has been tampered with and verification has failed. In this case, the data center node can ignore the authorization withdrawal request. If the two are identical, verification has passed, and the data center node can return a consent withdrawal notification.

[0087] Step 430: The authorization node stores a second authorization record in the blockchain based on the authorization revocation status indicated by the consent revocation notification; wherein the second authorization record includes the authorization revocation status, the user identifier of the target user, feature-related data of the target biometric, and the fourth private key signature of the target user.

[0088] After receiving the consent revocation notification, the authorization node may construct a second authorization record based on the authorization revocation status indicated in the consent revocation notification, the user ID of the target user, and the feature-related data of the target biometric feature. Here, the authorization revocation status may be represented by an authorization revocation identifier.

[0089] In one embodiment, the authorization node encrypts the authorization revocation status, user identification, feature-related data, and other optional information using the stored private key of the target user to obtain a fourth private key signature. The authorization node can construct a second authorization record based on the fourth private key signature, the authorization revocation status, user identification, feature-related data, and other optional information.

[0090] In another case, the authorization node may push a consent withdrawal notification to the user terminal of the target user, so that the user terminal encrypts the target user's private key to obtain a fourth private key signature, constructs a second authorization record, and returns it.

[0091] The authorization node can send the second authorization record to other consensus nodes of the blockchain, thereby writing the second authorization record to the blockchain. In this case, the data center node can receive the second authorization record and determine that the use permission of the target user's target biometric feature has been lost.

[0092] After confirming that the data center node has lost the right to use the target biometric feature, it can mark the feature data of the target biometric feature in the database based on the authorization withdrawal status, so as to filter out the unusable biometric features according to the mark in the future.

[0093] Through the above measures, the use rights of biometrics are withdrawn from data center nodes based on blockchain, so that the use of biometrics can be effectively managed to avoid abuse.

[0094] In one embodiment, see Figure 5 , is a flow chart of a feature updating method provided in an embodiment of the present application, such as Figure 5 As shown, the method may include the following steps 510 to 520.

[0095] Step 510: The data center node sends a feature update instruction to the authorization node; wherein the feature update instruction includes the user identification of the target user, feature-related data of the designated biometric feature that replaces the target biometric feature, and the fifth private key signature of the data center node.

[0096] Here, a feature update instruction is used to instruct an existing biometric feature to be updated. For example, if user A's fingerprint data exists in a bank's database, but it's not clear enough, the bank's corresponding data center node can send a feature update instruction after re-collecting user A's fingerprint data.

[0097] The designated biometric is a re-collected biometric. The designated biometric may be of the same type as the target biometric, or may be of a different type.

[0098] After the data center server corresponding to the data center node collects the designated biometric, the data center node can encrypt the target user's user ID, the designated biometric data, and other optional information using its own private key to obtain a fifth private key signature. Furthermore, the data center node can construct a feature update instruction based on the fifth private key signature, the user ID, the designated biometric data, and other optional information, and send it to the authorization node.

[0099] Step 520: The authorization node verifies the fifth private key signature. If the verification passes, the third authorization record is stored in the blockchain; wherein the third authorization record includes the authorization status, the user ID of the target user, the feature-related data of the specified biometric feature, and the fifth private key signature of the target user.

[0100] After receiving the feature update instruction, the authorization node parses it to extract the fifth private key signature, user identification, feature-related data, and other optional information. The authorization node can decrypt the fifth private key signature using the data center node's public key and compare the decrypted result with the content of the feature update instruction, excluding the fifth private key signature.

[0101] On the one hand, if the two are different, it indicates that the feature update instruction has been tampered with and verification has failed. In this case, the authorization node can ignore the feature update instruction. On the other hand, if the two are the same, verification has passed. The authorization node can use the target user's private key to encrypt the previous authorization status corresponding to the target biometric, the target user's user ID, the feature-related data of the specified biometric, and other optional information to obtain the fifth private key signature.

[0102] The authorization node can construct a third authorization record based on the fifth private key signature, the authorization status, the user identifier, the feature-related data of the designated biometric, and other optional information. The authorization node can send the third authorization record to other consensus nodes on the blockchain, thereby writing the third authorization record to the blockchain. In this case, the data center node can receive the third authorization record and determine to update the authorized target biometric to the designated biometric.

[0103] The data center node can mark the feature data of the specified biometric feature in the database based on the authorization status so that the specified biometric feature can be used subsequently according to the mark.

[0104] In one embodiment, before sending the feature update instruction, the data center node may apply to the authorization node for updating the target biometric feature of the target user. Figure 6 , is a flow chart of a feature update application method provided in an embodiment of the present application, such as Figure 6 As shown, the method may include steps 610 to 630.

[0105] Step 610: The data center node sends a feature update request to the authorization node; wherein the feature update request includes the user identification of the target user, feature-related data of the target biometric feature, and the sixth private key signature of the data center node.

[0106] Here, the feature update request is used to apply to the authorization node for updating the target biometric feature of the target user.

[0107] When the data center server corresponding to the data center node needs to update the target biometric characteristics of the target user, the data center node can encrypt the user identification of the target user, the feature-related data of the target biometric characteristics, and other optional information based on its own private key to obtain the sixth private key signature.

[0108] The data center node can construct a feature update request based on the sixth private key signature, the user identification of the target user, feature-related data of the target biometric feature, and other optional information, and send it to the authorization node.

[0109] Step 620: The authorization node verifies the sixth private key signature. If the verification passes, it determines whether the target user updates the target biometric feature.

[0110] The authorized node can parse the sixth private key signature from the feature update request, decrypt it using the data center node's public key, and compare the decrypted result with the content of the feature update request, excluding the sixth private key signature. If the two are different, it indicates that the feature update request has been tampered with, fails verification, and can be ignored. If the two are the same, verification has passed.

[0111] If the sixth private key signature verification passes, the authorization node can push the feature update request to the target user's user terminal to obtain update confirmation information or update rejection information returned by the target user through the user terminal. The update confirmation information indicates that the target biometric feature is allowed to be updated; the update rejection information indicates that the target biometric feature is rejected.

[0112] The authorization node can determine whether to update the target biometric feature based on the information returned by the user terminal. If the authorization node receives an update rejection, it can send an update rejection notification to the data center node, thereby ending the feature update process. If the authorization node receives an update confirmation, it can proceed to step 630.

[0113] Step 630: If yes, the authorization node sends an update permission notification to the data center node, so that the data center node updates the target biometric feature.

[0114] When confirming that the target user updates the target biometric feature, the authorization node may send an update permission notification to the data center node, so that the data center node executes the feature update process from step 510 to step 520 above.

[0115] Through the above measures, before updating the biometrics, the data center node needs to initiate an application to the authorization node, so that each link of the use of biometrics can be managed more finely.

[0116] In one embodiment, participating Figure 7 , is a flow chart of a feature usage method provided in an embodiment of the present application, such as Figure 7 As shown, the method may include the following steps 710 to 740.

[0117] Step 710: When the identification result corresponding to the target biometric feature of the target user is identification passed, the data center node sends a first authorization transaction record to the authorization node; wherein the first authorization transaction record includes the user identification of the target user, feature-related data of the target biometric feature and the seventh private key signature of the data center node.

[0118] When executing off-chain services, the service provider corresponding to the data center node may need to collect and identify the user's biometrics. In one case, if the collected biometrics do not match the user's previously stored biometrics, the recognition result will be "failed." In another case, if the collected biometrics match the previously stored biometrics, the recognition result will be "passed."

[0119] If the target user's target biometric feature passes the off-chain identification, the data center node can encrypt the target user's user ID, feature-related data of the target biometric feature, and other optional information based on its own private key to obtain the seventh private key signature.

[0120] The data center node can construct a first authorization transaction record based on the seventh private key signature, user identification, feature-related data, and other optional information, and send it to the authorization node. Optional information may include a timestamp and recognition result. The authorization transaction record can indicate the use of the biometric feature.

[0121] Step 720: The authorization node confirms the identification result based on the user identification, feature-related data, and the seventh private key signature in the first authorization transaction to obtain a confirmation result.

[0122] Here, the confirmation results may include illegal, abnormal, and passed; illegal refers to the data center node (the service provider corresponding to the data center node) that has no authority to use the target biometric features of the target user; abnormal refers to the data center node (the service provider corresponding to the data center node) that has authority to use the target biometric features of the target user, but the off-chain biometric identification process is not initiated by the target user himself. In other words, there is a problem of feature counterfeiting attack; passed refers to the data center node (the service provider corresponding to the data center node) that has authority to use the target biometric features of the target user, and the off-chain biometric identification process is initiated by the target user himself.

[0123] Step 730: The authorization node stores a second authorization transaction record in the blockchain based on the confirmation result; wherein the second authorization transaction record includes the confirmation result, the user identifier of the target user, feature-related data of the target biometric, and the eighth private key signature of the target user.

[0124] After obtaining the confirmation result, the authorization node may encrypt the confirmation result, user identification, feature-related data, and other optional information based on the private key of the target user to obtain an eighth private key signature.

[0125] The authorization node can construct a second authorization transaction record based on the eighth private key signature, the confirmation result, the user identifier, the feature-related data, and other optional information. The authorization node can send the second authorization transaction record to other consensus nodes on the blockchain, thereby writing the second authorization transaction record to the blockchain. In this case, the data center node can receive the second authorization transaction record and determine the confirmation result corresponding to the current identification result.

[0126] In one embodiment, the authorization node may send an identification result confirmation notification to the data center node, which may include the confirmation result, the user identification of the target user, and feature-related data of the target biometric, thereby informing the data center node of the confirmation result more quickly.

[0127] Step 740: When the confirmation result is passed, the data center node determines that the identification result is valid.

[0128] When the data center node receives the second authorization transaction record or the recognition result confirmation notification and determines that the confirmation result is passed, the data center node can determine that the recognition result is valid. In this case, the service provider corresponding to the data center node can continue to perform subsequent business.

[0129] Through the above measures, when the recognition result is passed, the authorization node confirms the recognition result, thereby ensuring that in the recognition process corresponding to the recognition result, the data center node corresponds to the service provider and uses the target biometric feature legally, and the recognition process is initiated by the target user, avoiding problems such as illegal use of biometric features and feature counterfeiting attacks.

[0130] In one embodiment, see Figure 8 , is a flow chart of a recognition result confirmation method provided by an embodiment of the present application, such as Figure 8 As shown, when executing step 720, the method may include the following steps 721 to 724.

[0131] Step 721: The authorization node verifies the seventh private key signature. If the verification is successful, the authorization node searches the blockchain for the fourth authorization record corresponding to the user identification and feature-related data.

[0132] The authorization node can decrypt the seventh private key signature using the data center node's public key to obtain a decryption result. The authorization node can compare the decryption result with the content of the first authorized transaction, excluding the seventh private key signature. If the two differ, it indicates that the first authorized transaction has been tampered with, fails verification, and can be ignored. If the two are identical, verification has passed.

[0133] If the seventh private key signature is verified, the authorization node can search the blockchain for the corresponding fourth authorization record based on the user ID and feature-related data. Here, the fourth authorization record can be the first authorization record stored in the authorization process above.

[0134] Step 722: The authorization node determines whether the data center node is authorized to use the target biometric feature of the target user based on the fourth authorization record, and obtains an authorization verification result.

[0135] The authorization node can determine the authorization status from the fourth authorization record and, based on the authorization status, determine whether the data center node is authorized to use the target user's target biometric feature, thereby obtaining an authorization verification result. If the authorization verification result indicates that the data center node is unauthorized, the authorization node can determine that the confirmation result is illegal. If the authorization verification result indicates that the data center node is authorized, the process can proceed to step 723.

[0136] Step 723: If the authorization verification result is authorized, the authorization node determines whether the identification process corresponding to the identification result is initiated by the target user and obtains the authenticity verification result of the identification process;

[0137] The authorization node can push a confirmation notification of the identification process to the target user's user terminal, causing the user terminal to display the confirmation notification. After the target user verifies the confirmation notification on their user terminal, they can return information indicating the authenticity of the identification process to the authorization node via their user terminal. Based on this information, the authorization node can determine whether the identification process was initiated by the target user and obtain an authenticity verification result. The authenticity verification result can be either authentic or forged.

[0138] Step 724: The authorization node determines a confirmation result based on the authorization verification result and the authenticity verification result.

[0139] If the authorization verification result is illegal, the authorization node can directly determine that the confirmation result is illegal. If the authorization verification result is legal and the authenticity verification result is forged, the authorization node can determine that the confirmation result is abnormal. If the authorization verification result is legal and the authenticity verification result is authentic, the authorization node can determine that the confirmation result is passed.

[0140] In one embodiment, see Figure 9 , is a flow chart of an identity authentication method provided in an embodiment of the present application, such as Figure 9 As shown, the method may include the following steps 810 to 820.

[0141] Step 810: Before the data center node sends an authorization request, or a feature update instruction, or a feature update request, or a first authorization transaction record, or before the authorization node sends an authorization withdrawal request, the data center node and the authorization node send identity authentication requests to each other.

[0142] Before initiating authorization requests, feature update instructions, feature update requests, and authorization transaction records, consensus nodes in the blockchain can first verify each other's identities. In this application solution, only messages sent by registered consensus nodes should be processed.

[0143] The data center node can send an authentication request to the authorization node, so that the authorization node can verify the identity of the data center node. The authorization node can send an authentication request to the data center node, so that the data center node can verify the identity of the target user.

[0144] Step 820: The recipient of the identity authentication request verifies the authenticity of the identity authentication request based on the sender's identity record in the blockchain; the identity record includes the identity identifier and identity credentials.

[0145] Identity records are used to verify the identities of entities in the blockchain (including data center nodes and users with blockchain addresses). Each entity can correspond to an identity record. Identity records can include blockchain addresses, public keys, identifiers, and other optional information. Optional information can include name, creation time, and expiration date.

[0146] The receiver can parse the sender's private key signature from the authentication request and find the corresponding identity record based on the sender's blockchain address.

[0147] On the one hand, if no identity record is found, it means that the sender is not registered. In this case, subsequent messages sent by the sender can be ignored.

[0148] On the other hand, if the identity record is found, the private key signature can be decrypted using the public key in the identity record. The decrypted result can then be compared with the content in the authentication request, excluding the private key signature, to ensure consistency. If the two do not match, the sender's identity can be determined to be forged. If the two match, the recipient can further compare the identity identifier in the identity record with the identity identifier in the authentication request to ensure consistency. If the two identifiers match, the sender's identity can be determined to be authentic; otherwise, the sender's identity is forged.

[0149] In one embodiment, see Figure 10 , is a flowchart of a registration method provided in an embodiment of the present application, such as Figure 10 As shown, the method may include the following steps 910 to 930.

[0150] Step 910: The data center node or the authorization node, as the registrant, sends a registration request to the registration node; wherein the registration request includes the registrant's eighth private key signature and identity certificate.

[0151] Here, the registrant is the entity that initiates the registration request. Identity credentials may include blockchain address, name, public key, etc.

[0152] The registration node is used to process registration requests and complete the registration for the registrant. The registration node is the consensus node of the blockchain.

[0153] The data center node can encrypt its own identity certificate based on its own private key, obtain the eighth private key signature, and construct a registration request based on the eighth private key signature and the identity certificate and send it to the registration node.

[0154] In response to a registration instruction initiated by a target user via a user terminal, the authorization node may initiate a registration request using the target user as the registrant. In this case, the authorization node may encrypt the target user's identity credentials using the target user's private key, obtain the eighth private key signature, and construct a registration request based on the eighth private key signature and the target user's identity credentials, which is then sent to the registration node.

[0155] Step 920: The registration node verifies the eighth private key signature based on the identity certificate. If the verification passes, an identity identifier is assigned to the registrant.

[0156] The registration node can parse the public key from the identity credential and use it to decrypt the eighth private key signature to obtain a decrypted result. The registration node can compare the decrypted result with the identity credential. If the two match, an identity identifier can be assigned to the registrant. If they differ, the registration request has been tampered with and no action can be taken.

[0157] Step 930: The registration node stores the registrant’s identity record in the blockchain; wherein the identity record includes the registrant’s identity identifier and identity credentials.

[0158] After assigning an identity to the registrant, the registration node can generate an identity record for the registrant based on the identity and identity credentials. This record is then sent to other consensus nodes on the blockchain, where it is stored. Upon receiving the identity record, the registrant can confirm that the registration is complete.

[0159] In one embodiment, the registration node may directly send a registration success notification to the registrant, thereby more quickly and directly notifying the registrant of the completion of the registration. The registrant may record the identity identifier, identity credentials, etc. locally.

[0160] In one embodiment, to facilitate the query and aggregation of various data types, the data center nodes, authorization nodes, and registration nodes can maintain three blockchains. One blockchain is an identity ledger, used to store identity records. One blockchain is a biometric authorization ledger, used to store authorization records including authorization status and authorization revocation status. One blockchain is a biometric transaction confirmation ledger, used to store authorization transaction records. Authorization transaction records can indicate whether the feature recognition process is illegal, abnormal, or passed.

Claims

1. A data management method based on blockchain, characterized in that: include: The data center node sends an authorization request to the authorization node; wherein the authorization request includes the user identification of the target user, feature-related data of the target biometric feature, and the first private key signature of the data center node; The authorization node verifies the first private key signature, and if the verification is successful, determines the authorization status of the target user for the data center node with respect to the target biometric feature; The authorization node stores a first authorization record in the blockchain based on the authorization status; wherein the first authorization record includes the authorization status, the user identifier of the target user, feature-related data of the target biometric, and the second private key signature of the target user; the authorization node and the data center node are consensus nodes of the blockchain; When the identification result corresponding to the target biometric feature of the target user is passed, the data center node sends a first authorization transaction record to the authorization node; wherein the first authorization transaction record includes the user identifier of the target user, feature-related data of the target biometric feature, and the eighth private key signature of the data center node; The authorization node confirms the identification result based on the user identifier, feature-related data, and the eighth private key signature in the first authorization transaction record to obtain a confirmation result; The authorization node stores a second authorization transaction record in the blockchain based on the confirmation result; wherein the second authorization transaction record includes the confirmation result, the user identifier of the target user, the feature-related data of the target biometric, and the ninth private key signature of the target user; When the confirmation result is passed, the data center node determines that the identification result is valid; The authorization node confirms the identification result based on the user identifier, feature-related data, and the eighth private key signature in the first authorization transaction record to obtain a confirmation result, including: The authorization node verifies the eighth private key signature. If the verification is successful, the authorization node searches the blockchain for a first authorization record corresponding to the user identifier and the feature-related data; The authorization node determines, based on the first authorization record, whether the data center node is authorized to use the target biometric feature of the target user, and obtains an authorization verification result; If the authorization verification result is authorized, the authorization node determines whether the identification process corresponding to the identification result is initiated by the target user, and obtains an authenticity verification result of the identification process; The authorization node determines the confirmation result based on the authorization verification result and the authenticity verification result.

2. The method according to claim 1, characterized in that The method further comprises: The authorization node sends an authorization revocation request to the data center node; wherein the authorization revocation request includes the user identification of the target user, the feature-related data of the target biometric feature, and the third private key signature of the target user; The data center node verifies the third private key signature, and if the verification passes, sends a consent withdrawal notification to the authorization node; The authorization node stores a second authorization record in the blockchain based on the authorization withdrawal status indicated by the consent withdrawal notification; wherein the second authorization record includes the authorization withdrawal status, the user identifier of the target user, the feature-related data of the target biometric feature, and the fourth private key signature of the target user.

3. The method according to claim 1, characterized in that The method further comprises: The data center node sends a feature update instruction to the authorization node; wherein the feature update instruction includes the user identifier of the target user, feature-related data of a designated biometric feature that replaces the target biometric feature, and a fifth private key signature of the data center node; The authorization node verifies the fifth private key signature, and if the verification passes, stores a third authorization record in the blockchain; wherein the third authorization record includes the authorization status, the user identifier of the target user, the feature-related data of the specified biometric feature, and the sixth private key signature of the target user.

4. The method according to claim 3, characterized in that Before the data center node sends the feature update instruction to the authorization node, the method further includes: The data center node sends a feature update request to the authorization node; wherein the feature update request includes the user identifier of the target user, feature-related data of the target biometric feature, and the seventh private key signature of the data center node; The authorization node verifies the seventh private key signature, and if the verification passes, determines whether the target user updates the target biometric feature; If so, the authorization node sends an update permission notification to the data center node, so that the data center node updates the target biometric feature.

5. The method according to claim 1, characterized in that The method further comprises: Before the data center node sends the authorization request or the first authorization transaction record, the data center node and the authorization node send identity authentication requests to each other; The recipient of the identity authentication request verifies the authenticity of the identity authentication request based on the sender's identity record in the blockchain; wherein the identity record includes an identity identifier and an identity credential.

6. The method according to claim 2, characterized in that The method further comprises: Before the data center node sends the authorization request or the first authorization transaction record, or before the authorization node sends the authorization withdrawal request, the data center node and the authorization node send identity authentication requests to each other; The recipient of the identity authentication request verifies the authenticity of the identity authentication request based on the sender's identity record in the blockchain; wherein the identity record includes an identity identifier and an identity credential.

7. The method according to claim 3, characterized in that The method further comprises: Before the data center node sends the authorization request, the feature update instruction, or the first authorization transaction record, the data center node and the authorization node send identity authentication requests to each other; The recipient of the identity authentication request verifies the authenticity of the identity authentication request based on the sender's identity record in the blockchain; wherein the identity record includes an identity identifier and an identity credential.

8. The method according to claim 4, characterized in that The method further comprises: Before the data center node sends the authorization request, or the feature update instruction, or the feature update request, or the first authorization transaction record, the data center node and the authorization node send identity authentication requests to each other; The recipient of the identity authentication request verifies the authenticity of the identity authentication request based on the sender's identity record in the blockchain; wherein the identity record includes an identity identifier and an identity credential.

9. The method according to claim 8, characterized in that The method further comprises: The data center node or the authorization node, as the registrant, sends a registration request to the registration node; wherein the registration request includes the tenth private key signature and identity certificate of the registrant; The registration node verifies the tenth private key signature based on the identity certificate, and if the verification is successful, assigns an identity identifier to the registrant; The registration node stores the identity record of the registrant in the blockchain; wherein the identity record includes the identity identifier and identity credentials of the registrant.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the blockchain-based data management method according to any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which can be executed by a processor to complete the blockchain-based data management method described in any one of claims 1 to 9.

Images