A method and system for authorized access to blockchain privacy data

Abstract

The present invention discloses an authorized access method and system for blockchain private data, which belongs to the field of blockchain technology, ensures that user private data is not leaked, and realizes a one-to-many data service for user data. The present invention uses an attribute-based encryption and decryption mechanism, so that only users who meet the rules can decrypt private data, avoiding the leakage of private data. The present invention can customize the access rules of private data, so that the data publisher can customize the data sharing rules, which ensures the security of private data and enables the data publisher to have higher control over its private data.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain, and in particular relates to a method and system for authorized access to blockchain privacy data. Background Art

[0002] With the rapid development of society, the degree of digitization and informatization is getting higher and higher, and data is constantly being collected and analyzed. Data is the most valuable asset in today's economic activities. Enterprises can launch customized services, optimize decision-making processes, and predict future trends through collected data. While people are enjoying the convenience brought by big data, concerns about personal privacy are also gradually growing.

[0003] Take various applications installed in smart devices as an example. Although smart devices can control the access rights of various applications through permission management, various applications will integrate third-party services (such as credit data and payment information, etc.) in the application. Under the existing permission management mechanism, third-party service providers can obtain the same user privacy information as their host application, and the same service is often integrated into multiple applications, collecting multi-dimensional information of the same user in different applications to depict a complete user portrait, thereby providing more accurate one-to-one services. However, third-party service providers can use their personal privacy data without the user's knowledge, resulting in the abuse of personal privacy data. Therefore, in the current information age, how to benefit from the services provided by third parties and ensure the privacy of user data has become a hot topic of research.

[0004] Blockchain technology has the characteristics of distributed peer-to-peer, data block chain, non-forgeable, tamper-proof, transparent and reliable, and high reliability. Therefore, existing technologies often use blockchain technology to prevent third-party service providers from abusing users' personal privacy data and ensure that users' personal privacy data will not be leaked. Although existing blockchain technology solves the problem of users' personal privacy data leakage, it still has the following problems:

[0005] 1) Data uploaded to the blockchain is visible to all participants in the blockchain, the data privacy is poor, and there is still a risk of data leakage.

[0006] 2) When encrypting user data using symmetric or asymmetric encryption technology, although the privacy of the data is guaranteed, it can only support one-to-one secure transmission and cannot meet the user's need to provide data services to multiple third parties at the same time. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the present invention provides a method and system for authorized access to blockchain privacy data to solve the problems existing in the prior art.

[0008] In a first aspect, an embodiment of the present application provides a method for authorized access to blockchain private data, comprising:

[0009] Determine the initial public key and initial secret key through the administrator module, store the initial public key on the blockchain, transmit the initial secret key to the trusted authorization service module, and store the initial secret key on the server through the trusted authorization service module. The initial public key is used for data encryption, and the initial secret key is used for data decryption;

[0010] The initial public key on the blockchain is obtained through the data publishing module, and the business data is encrypted according to the initial public key to obtain private data, where the private data includes the business ID;

[0011] Obtaining a business access list through a data publishing module, and transmitting the business access list and privacy data to the blockchain, wherein the business access list includes a mapping relationship between at least one visitor account and a business ID;

[0012] Sending a data access request to the trusted authorization service module through the data access module, wherein the data access request includes the business ID of the data to be accessed and the visitor account;

[0013] Generate access authorization information through the trusted authorization service module based on the data access request, business access list and initial key;

[0014] According to the access authorization information, the private data is decrypted to obtain the decryption result, and the decryption result is fed back to the data access module to complete the authorized access to the private data.

[0015] Furthermore, storing the initial key to the server through the trusted authorization service module includes:

[0016] The initial key is transmitted to the network access isolation module through the trusted authorization service module;

[0017] The initial key is transmitted to the server through the network access isolation module and stored.

[0018] Furthermore, encrypting the business data according to the initial public key includes: encrypting the business data according to the initial public key and using an attribute-based encryption mechanism to obtain private data.

[0019] Furthermore, after the business data is encrypted using the attribute-based encryption mechanism, a plurality of first attributes are added to the privacy data through the data publishing module.

[0020] Furthermore, the access authorization information includes an attribute decryption key or an access denial instruction.

[0021] Furthermore, the generating of access authorization information by a trusted authorization service module according to the data access request, the service access list and the initial key includes:

[0022] According to the data access request and the business access list, determine whether the visitor account has access rights. If so, generate the attribute decryption key according to the data access request and the initial key. Otherwise, directly generate an access denial instruction.

[0023] The access authorization information is obtained by decrypting the key or denying access instructions according to the attributes.

[0024] Furthermore, judging whether the visitor account has access rights according to the data access request and the service access list includes:

[0025] According to the business ID of the data to be accessed in the data access request, a mapping relationship is matched in the business access list;

[0026] It is determined whether the matched mapping relationship contains the visitor account in the data access request. If so, the visitor account has the permission, otherwise, the visitor account does not have the permission.

[0027] Furthermore, the data access request also includes several second attributes of the visitor account;

[0028] The generating of the attribute decryption key according to the data access request and the initial key includes:

[0029] Extracting several second attributes of the visitor account in the data access request;

[0030] The second attribute is associated with the initial key to obtain the attribute decryption key.

[0031] Furthermore, decrypting the private data according to the access authorization information includes:

[0032] If the access authorization information is an access denial instruction, the authorization access process is terminated directly;

[0033] If the access authorization information is an attribute decryption key, the number of attribute overlaps between the plurality of second attributes in the attribute decryption key and the plurality of first attributes in the privacy data is determined by the trusted authorization service module;

[0034] Determine whether the number of attribute overlaps is greater than the set threshold. If so, obtain the private data from the blockchain through the trusted authorization service module, and decrypt the private data using the initial key in the attribute decryption key to obtain the plaintext data. Otherwise, terminate the authorization access process.

[0035] Feed the plaintext data back to the data access module to complete the authorized access process.

[0036] In a second aspect, an embodiment of the present application provides an authorized access system for blockchain privacy data, including an administrator module, a data publishing module, a data access module, a trusted authorization service module, a network access isolation module, and a server;

[0037] The manager module is used to generate an initial public key and an initial secret key, publish the initial public key to the blockchain, and transmit the initial secret key to the trusted authorization service module;

[0038] The data publishing module is connected to the administrator module through the blockchain. The data publishing module is used to obtain the initial public key from the blockchain, encrypt the business data according to the initial public key, obtain the privacy data, generate a business access list, and transmit the business access list and the privacy data to the blockchain;

[0039] The data access module is connected to the data publishing module through the blockchain, and the data access module is used to obtain private data from the blockchain, generate a data access request based on the private data, and transmit the data access request to the trusted authorization service module;

[0040] The trusted authorization service module is connected to the administrator module, the data access module and the network access isolation module respectively. The trusted authorization service module is used to receive the initial key sent by the administrator module and the data access request sent by the data access module, and transmit the initial key to the network access isolation module, obtain the service access list from the blockchain, generate access authorization information through the trusted authorization service module according to the data access request, the service access list and the initial key, decrypt the private data according to the access authorization information, obtain the decryption result, and feed the decryption result back to the data access module to complete the authorized access to the private data;

[0041] The network access isolation module is connected to a server, and is used to perform network isolation between the trusted authorization service module and the server, and the server is used to store an initial key.

[0042] The beneficial effects of the present invention are:

[0043] (1) The present invention provides a method and system for authorized access to blockchain private data, which ensures that user private data is not leaked while realizing one-to-many data services for user data.

[0044] (2) The present invention uses an attribute-based encryption and decryption mechanism so that only users who meet the rules can decrypt private data, thus avoiding the leakage of private data.

[0045] (3) The present invention can customize the access rules for private data, so that the data publisher can customize the data sharing rules, which ensures the security of private data and enables the data publisher to have greater control over its private data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flowchart of a method for authorized access to blockchain private data provided in an embodiment of the present application.

[0047] Figure 2 A schematic diagram of the structure of a blockchain privacy data authorization access system provided in an embodiment of the present application.

[0048] Figure 3 A schematic diagram of the structure of a blockchain privacy data authorization access device provided in an embodiment of the present application.

[0049] Among them, 21-administrator module, 22-data publishing module, 23-data access module, 24-trusted authorization service module, 25-network access isolation module, 26-server, 30-authorized access device, 31-memory, 32-processor, 33-bus.

[0050] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0051] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0052] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0053] Example 1

[0054] like Figure 1 As shown, a method for authorized access to blockchain private data includes:

[0055] S11. Determine the initial public key and initial secret key through the administrator module, store the initial public key on the blockchain, transmit the initial secret key to the trusted authorization service module, and store the initial secret key on the server through the trusted authorization service module. The initial public key is used for data encryption, and the initial secret key is used for data decryption.

[0056] S12. Obtain the initial public key on the blockchain through the data publishing module, and encrypt the business data according to the initial public key to obtain private data, where the private data includes the business ID.

[0057] S13. Obtain a business access list through a data publishing module, and transmit the business access list and privacy data to the blockchain, wherein the business access list includes a mapping relationship between at least one visitor account and a business ID.

[0058] S14. Send a data access request to the trusted authorization service module through the data access module, where the data access request includes the service ID of the data to be accessed and the visitor account.

[0059] S15. Generate access authorization information through a trusted authorization service module according to the data access request, the service access list and the initial key. The access authorization information includes an attribute decryption key or an access denial instruction.

[0060] S16. Decrypt the private data according to the access authorization information to obtain a decryption result, and feed the decryption result back to the data access module to complete the authorized access to the private data.

[0061] In this embodiment, all operation records involved in the entire authorized access method can be saved on the blockchain to prevent the operation records from being tampered with and facilitate traceability.

[0062] In a possible implementation manner, storing the initial key to the server through the trusted authorization service module includes:

[0063] The initial key is transmitted to the network access isolation module through the trusted authorization service module;

[0064] The initial key is transmitted to the server through the network access isolation module and stored.

[0065] Setting up the access isolation module for network isolation ensures the security of the initial key and prevents visitors from obtaining the initial key without verification.

[0066] In a possible implementation, encrypting the business data according to the initial public key includes: encrypting the business data according to the initial public key and using an attribute-based encryption mechanism to obtain private data.

[0067] By adopting the attribute-based encryption mechanism to encrypt business data, it can be encrypted once to form a unique ciphertext (privacy data), and this ciphertext can be shared with multiple users, avoiding the situation in the prior art where multiple encryption is required when sharing data with multiple users.

[0068] In a possible implementation, after the business data is encrypted using the attribute-based encryption mechanism, a plurality of first attributes are added to the privacy data through a data publishing module.

[0069] An attribute is a feature of an object or an information file. In this embodiment, the first attribute represents a feature of business data.

[0070] In a possible implementation, the data access request further includes several second attributes of the visitor account.

[0071] In a possible implementation, generating access authorization information by a trusted authorization service module according to the data access request, the service access list, and the initial key includes:

[0072] According to the data access request and the business access list, determine whether the visitor account has access rights. If so, generate the attribute decryption key according to the data access request and the initial key. Otherwise, directly generate an access denial instruction.

[0073] The access authorization information is obtained by decrypting the key or denying access instructions according to the attributes.

[0074] In a possible implementation, judging whether the visitor account has access rights according to the data access request and the service access list includes:

[0075] According to the service ID of the data to be accessed in the data access request, a mapping relationship is matched in the service access list.

[0076] It is determined whether the matched mapping relationship contains the visitor account in the data access request. If so, the visitor account has the permission, otherwise, the visitor account does not have the permission.

[0077] In a possible implementation, the data access request further includes several second attributes of the visitor account.

[0078] The method of generating the attribute decryption key according to the data access request and the initial key includes: extracting several second attributes of the visitor account in the data access request; associating the second attributes with the initial key to obtain the attribute decryption key.

[0079] In a possible implementation, decrypting the private data according to the access authorization information includes:

[0080] If the access authorization information is an access denial instruction, the authorization access process ends directly.

[0081] If the access authorization information is an attribute decryption key, the number of overlapped attributes of the plurality of second attributes in the attribute decryption key and the plurality of first attributes in the privacy data is determined through the trusted authorization service module.

[0082] Determine whether the number of attribute overlaps is greater than the set threshold. If so, obtain the private data from the blockchain through the trusted authorization service module, and decrypt the private data using the initial key in the attribute decryption key to obtain the plaintext data. Otherwise, terminate the authorization access process.

[0083] Feed the plaintext data back to the data access module to complete the authorized access process.

[0084] When using the attribute-based encryption mechanism for encryption, several attributes can be added to the privacy data while generating it. Decryption is allowed only when the visitor's attributes overlap with the attributes of the privacy data to a certain extent. Combined with the business access list, a double verification mechanism is formed to further ensure the security of user data and realize one-to-one data sharing.

[0085] Example 2

[0086] like Figure 2 As shown, a blockchain privacy data authorization access system includes an administrator module 21, a data publishing module 22, a data access module 23, a trusted authorization service module 24, a network access isolation module 25 and a server 26.

[0087] The administrator module 21 is used to generate an initial public key and an initial secret key, publish the initial public key to the blockchain, and transmit the initial secret key to the trusted authorization service module 24.

[0088] The data publishing module 22 is connected to the administrator module 21 through the blockchain. The data publishing module 22 is used to obtain the initial public key from the blockchain, encrypt the business data according to the initial public key, obtain the privacy data, and generate a business access list, and transmit the business access list and the privacy data to the blockchain.

[0089] The data access module 23 is connected to the data publishing module 22 through the blockchain. The data access module 23 is used to obtain private data from the blockchain, generate a data access request based on the private data, and transmit the data access request to the trusted authorization service module 24.

[0090] The trusted authorization service module 24 is connected to the administrator module 21, the data access module 23 and the network access isolation module 25 respectively. The trusted authorization service module 24 is used to receive the initial key sent by the administrator module 21 and the data access request sent by the data access module 23, and transmit the initial key to the network access isolation module 25, obtain the business access list from the blockchain, generate access authorization information through the trusted authorization service module 24 according to the data access request, the business access list and the initial key, decrypt the privacy data according to the access authorization information, obtain the decryption result, and feed the decryption result back to the data access module 23 to complete the authorized access to the privacy data.

[0091] The network access isolation module 25 is connected to a server 26 . The network access isolation module 25 is used to perform network isolation between the trusted authorization service module 24 and the server 26 . The server 26 is used to store an initial key.

[0092] Figure 2 The authorized access system for blockchain privacy data described in the embodiment can execute the technical solution described in Example 1. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0093] Example 3

[0094] like Figure 3 As shown, the present application provides an authorized access device for blockchain privacy data, the authorized access device 30 includes a memory 31 and a processor 32, and the memory 31 and the processor 32 are interconnected via a bus 33;

[0095] The memory 31 stores computer-executable instructions;

[0096] The processor 32 executes the computer execution instructions stored in the memory, so that the processor executes the authorized access method for blockchain privacy data as described in Example 1.

[0097] Example 4

[0098] This embodiment provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the authorized access method for blockchain privacy data described in Example 1.

[0099] Example 5

[0100] The embodiments of the present application may also provide a computer program product, including a computer program, which, when executed by a processor, implements the authorized access method for blockchain privacy data described in Embodiment 1.

[0101] The invention provides a method and system for authorized access to blockchain private data, which ensures that user private data is not leaked and realizes a one-to-many data service for user data. The invention uses an attribute-based encryption and decryption mechanism, so that only users who meet the rules can decrypt private data, thus avoiding the leakage of private data.

[0102] The present invention can customize the access rules of private data, so that the data publisher can customize the data sharing rules, which ensures the security of private data and enables the data publisher to have higher control over its private data.

[0103] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary technical means in the art that are not disclosed in the present application.

[0104] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for authorized access to blockchain private data, characterized in that: include: Determine the initial public key and initial secret key through the administrator module, store the initial public key on the blockchain, transmit the initial secret key to the trusted authorization service module, and store the initial secret key on the server through the trusted authorization service module. The initial public key is used for data encryption, and the initial secret key is used for data decryption; The initial public key on the blockchain is obtained through the data publishing module, and the business data is encrypted according to the initial public key to obtain private data, wherein the private data includes the business ID; the business data is encrypted according to the initial public key, including: according to the initial public key, the business data is encrypted by using an attribute-based encryption mechanism to obtain private data; Obtaining a business access list through a data publishing module, and transmitting the business access list and privacy data to the blockchain, wherein the business access list includes a mapping relationship between at least one visitor account and a business ID; Sending a data access request to the trusted authorization service module through the data access module, wherein the data access request includes the business ID of the data to be accessed and the visitor account; Generate access authorization information through the trusted authorization service module based on the data access request, business access list and initial key; According to the access authorization information, the private data is decrypted to obtain the decryption result, and the decryption result is fed back to the data access module to complete the authorized access to the private data; After the business data is encrypted by the attribute-based encryption mechanism, a plurality of first attributes are added to the privacy data through the data publishing module; the access authorization information includes an attribute decryption key or an access denial instruction; The step of generating access authorization information through a trusted authorization service module according to the data access request, the service access list and the initial key includes: According to the data access request and the business access list, determine whether the visitor account has access rights. If so, generate the attribute decryption key according to the data access request and the initial key. Otherwise, directly generate an access denial instruction. Decrypt the key or deny access instructions according to the attributes to obtain access authorization information; The step of determining whether the visitor account has access rights according to the data access request and the service access list includes: According to the business ID of the data to be accessed in the data access request, a mapping relationship is matched in the business access list; Determine whether the matched mapping relationship contains the visitor account in the data access request. If so, the visitor account has permission, otherwise, the visitor account does not have permission; The data access request also includes several second attributes of the visitor account; The step of generating the attribute decryption key according to the data access request and the initial key includes: Extracting several second attributes of the visitor account in the data access request; Associating the second attribute with the initial key to obtain an attribute decryption key; The decrypting of the private data according to the access authorization information includes: If the access authorization information is an access denial instruction, the authorization access process is terminated directly; If the access authorization information is an attribute decryption key, the number of attribute overlaps between the plurality of second attributes in the attribute decryption key and the plurality of first attributes in the privacy data is determined by the trusted authorization service module; Determine whether the number of attribute overlaps is greater than the set threshold. If so, obtain the private data from the blockchain through the trusted authorization service module, and decrypt the private data using the initial key in the attribute decryption key to obtain the plaintext data. Otherwise, terminate the authorization access process. Feed the plaintext data back to the data access module to complete the authorized access process.

2. The method for authorized access to blockchain private data according to claim 1, characterized in that: The storing of the initial key to the server through the trusted authorization service module includes: The initial key is transmitted to the network access isolation module through the trusted authorization service module; The initial key is transmitted to the server through the network access isolation module and stored.

3. A blockchain private data authorization access system, the system is used to implement the blockchain private data authorization access method described in claim 1 or 2, characterized in that: It includes an administrator module, a data publishing module, a data access module, a trusted authorization service module, a network access isolation module and a server; The manager module is used to generate an initial public key and an initial secret key, publish the initial public key to the blockchain, and transmit the initial secret key to the trusted authorization service module; The data publishing module is connected to the administrator module through the blockchain. The data publishing module is used to obtain the initial public key from the blockchain, encrypt the business data according to the initial public key, obtain the privacy data, generate a business access list, and transmit the business access list and the privacy data to the blockchain; The data access module is connected to the data publishing module through the blockchain, and the data access module is used to obtain private data from the blockchain, generate a data access request based on the private data, and transmit the data access request to the trusted authorization service module; The trusted authorization service module is connected to the administrator module, the data access module and the network access isolation module respectively. The trusted authorization service module is used to receive the initial key sent by the administrator module and the data access request sent by the data access module, and transmit the initial key to the network access isolation module, obtain the service access list from the blockchain, generate access authorization information through the trusted authorization service module according to the data access request, the service access list and the initial key, decrypt the private data according to the access authorization information, obtain the decryption result, and feed the decryption result back to the data access module to complete the authorized access to the private data; The network access isolation module is connected to a server, and is used to perform network isolation between the trusted authorization service module and the server, and the server is used to store an initial key.

Images