A data authorization access method, device and medium based on blockchain

Abstract

The embodiments of this specification disclose a data authorization access method, device and medium based on blockchain, the method includes: a business service end verifies and determines data authorization data according to a data authorization request and sends it to an authorization service end; the authorization service end verifies the signature of the data authorization data, verifies the signature by requesting business data from a business system; determines first business encapsulation data, encrypted data and an encrypted symmetric key, calculates a first hash value, and sends the encrypted data, the encrypted symmetric key and the first hash value to the business service end; the business service end determines and sends the encrypted data to a user terminal for verification; if the user terminal passes the verification, determines a second temporary symmetric key, obtains second business encapsulation data, determines plaintext business data, and calculates a second hash value; generates information verification based on the second hash value and sends it to the business service end; if the business service end passes the information verification, the business data is legal, and handles business for the user based on the plaintext business data.

Description

Technical Field

[0001] This specification relates to the fields of information software systems, the Internet and blockchain technology, and in particular to a blockchain-based data authorization access method, device and medium. Background Art

[0002] The topic of data sharing and data openness is a hot topic in the current society and an inevitable trend of future social development. The sharing and opening of government data can break the information island, improve the efficiency of government work, improve the level of government services, and increase people's satisfaction. At the same time, it can also reduce the overall operating costs of the social economy and promote rapid social development. However, at present, the sharing and opening of government data are facing the difficult situation of "unwilling, unable, and dare not", one of the important reasons is the problem of data security and privacy protection. In the process of data sharing and data opening, users privately retain other people's private data, or use it for other purposes without authorization, which seriously endangers the privacy security of data holders. Therefore, how to ensure the security of data in the process of data authorization access has become an urgent problem to be solved. Summary of the invention

[0003] One or more embodiments of this specification provide a blockchain-based data authorization access method, device and medium for solving the following technical problems: problems of data security and privacy information leakage during data sharing and opening.

[0004] One or more embodiments of this specification adopt the following technical solutions:

[0005] One or more embodiments of the present specification provide a data authorization access method based on blockchain, the method comprising: a data authorization access method based on blockchain, characterized in that the method comprises: the business service end verifies according to the data authorization request and determines the data authorization data; sends the data authorization data to the authorization service end; the authorization service end verifies the signature of the data authorization data according to the user's public key, and if the verification is successful, requests business data from the business system according to the data authorization data; receives the business data and generates a first temporary symmetric key; encapsulates the business data to determine the first business encapsulation data, and encrypts the first business encapsulation data with the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key with the user's public key to determine the encrypted symmetric key, and calculates the first hash value of the first business encapsulation data, and compares the encrypted data, the encrypted symmetric key and The first hash value is sent to the business service end; the business service end determines the encrypted data verification based on the encrypted data and the encrypted symmetric key, and sends the encrypted data verification to the user terminal; if the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second business encapsulation data, and the plaintext business data is determined according to the second business encapsulation data, and the second hash value of the second business encapsulation data is calculated; information verification is generated according to the second hash value, and the information verification is sent to the business service end; if the business service end passes the information verification, the business data of the user terminal is legal, and the plaintext business data is checked, and the business is handled for the user according to the plaintext business data.

[0006] Furthermore, if the business service end passes the information verification, the business data of the user terminal is legal, specifically including: if the business service end determines that the second hash value is the same as the first hash value, the business data of the user terminal is legal.

[0007] Furthermore, the business service end determines the data authorization data based on the data authorization request verification, specifically including: the business service end sends a data authorization request verification to the user terminal, wherein the data authorization request verification includes one or more of the business name, data interface, interface parameters, access time and access content; after the user terminal passes the data authorization request verification, the data authorization request data is determined; a signature authorization instruction issued by the user is received, and the data authorization request data is signed according to the user's private key; based on the data authorization request data and the signature, the data authorization verification is determined, wherein the data authorization verification includes one or more of the user identity ID type, user identity ID, business name, data interface, interface parameters, access time, access content and signature.

[0008] Furthermore, sending the data authorization data to the authorization server specifically includes: the business server generates a random number, and sends the random number and the data authorization data to the authorization server; encapsulating the business data to determine the first business encapsulation data specifically includes: the authorization server encapsulates the business data and the random number to determine the first business encapsulation data.

[0009] Furthermore, if the business service end passes the information verification, the user terminal completes the access to the business data, specifically including: if the business service end determines that the second hash value is the same as the first hash value, the business data of the user terminal is legal.

[0010] Furthermore, the generating of the first temporary symmetric key; encapsulating the business data to determine the first business encapsulation data specifically includes: generating a timestamp and the first temporary symmetric key, encapsulating the business data, the random number and the timestamp to determine the first business encapsulation data.

[0011] Furthermore, if the business service end passes the information verification, the business data of the user terminal is legal, specifically including: if the business service end determines that the difference between the timestamp in the second business encapsulation data and the timestamp in the first business encapsulation data is within a preset range, and the business service end determines that the second hash value is the same as the first hash value, then the business data of the user terminal is legal.

[0012] Furthermore, the authorization server verifies the signature of the data authorization data according to the user's public key, specifically including: the authorization server obtains the user's public key from the blockchain identity smart contract based on the user identity type and user identity ID in the data authorization data, and verifies the signature of the data authorization data according to the user's public key.

[0013] One or more embodiments of this specification provide a blockchain-based data authorization access device, including:

[0014] at least one processor; and,

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can: verify the business service end according to the data authorization request and determine the data authorization data; send the data authorization data to the authorization service end; the authorization service end verifies the signature of the data authorization data according to the user's public key, and if the verification is successful, requests business data from the business system according to the data authorization data; receives the business data and generates a first temporary symmetric key; encapsulates the business data to determine the first business encapsulation data, and encrypts the first business encapsulation data with the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key with the user's public key to determine the encrypted symmetric key, and calculates the first hash value of the first business encapsulation data, and compares the encrypted data, the encrypted symmetric key and the first hash value. The encrypted data and the encrypted symmetric key are sent to the business service end; the business service end determines the encrypted data based on the encrypted data and the encrypted symmetric key, and sends the encrypted data to the user terminal for verification; if the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second business encapsulation data, and the plaintext business data is determined according to the second business encapsulation data, and the second Hash value of the second business encapsulation data is calculated; information verification is generated according to the second Hash value, and the information verification is sent to the business service end; if the business service end passes the information verification, the business data of the user terminal is legal, and the plaintext business data is checked, and the business is handled for the user according to the plaintext business data.

[0017] One or more embodiments of the present specification provide a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to: verify the data authorization data according to the data authorization request of the business service end; send the data authorization data to the authorization service end; the authorization service end verifies the signature of the data authorization data according to the public key of the user, and if the verification is successful, requests the business data from the business system according to the data authorization data; receives the business data and generates a first temporary symmetric key; encapsulates the business data to determine the first business encapsulation data, and encrypts the first business encapsulation data by the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key by the user public key to determine the encrypted symmetric key, and calculates the first hash value of the first business encapsulation data, and compares the encrypted data, the encrypted symmetric key and the first hash value. The value is sent to the business service end; the business service end determines the encrypted data based on the encrypted data and the encrypted symmetric key, and sends the encrypted data to the user terminal for verification; if the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second business encapsulation data, and the plaintext business data is determined according to the second business encapsulation data, and the second hash value of the second business encapsulation data is calculated; information verification is generated according to the second hash value, and the information verification is sent to the business service end; if the business service end passes the information verification, the business data of the user terminal is legal, and the plaintext business data is checked, and the business is handled for the user according to the plaintext business data.

[0018] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects: by using the user's public key to verify the authorization through the authorization server, the business data is inaccessible without the user's authorization; by using a temporary symmetric key to encrypt and calculate the business data, and using the user's public key to encrypt the symmetric key, the data user cannot retain the business data and cannot view the user's plaintext business data, further reducing the risk of privacy data leakage and unauthorized use for other purposes; in addition, through random numbers, timestamps and hash algorithms, data users cannot view or retain the user's plaintext business data, but can handle business for the user through the plaintext business data, further protecting the user's privacy data; the embodiments of this specification achieve the effect of data security and privacy protection that data cannot be accessed without authorization, plaintext business data cannot be retained, cannot be reused, and cannot be used for other purposes. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0020] Figure 1 A flowchart of a blockchain-based data authorization access method provided in an embodiment of this specification;

[0021] Figure 2 A flowchart of another blockchain-based data authorization access method provided in an embodiment of this specification;

[0022] Figure 3 A schematic diagram of the structure of a blockchain-based data authorization access device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0023] The embodiments of this specification provide a blockchain-based data authorization access method, device and medium.

[0024] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0025] The topic of data sharing and opening has a long history. It is not only a hot topic in the current society, but also an inevitable trend of future social development. The sharing and opening of government data can break the information island, improve the efficiency of government work, improve the level of government services, and increase people's satisfaction. At the same time, it can also reduce the overall operating costs of the social economy and promote rapid social development. However, the current government data sharing and opening faces the difficult situation of "unwilling, unable, and dare not". In the process of data sharing, there is a risk that users will privately retain other people's private data, or the data will be used for other purposes without authorization. How to share open data under the premise of ensuring data security and privacy protection is an urgent problem to be solved.

[0026] The development of blockchain technology has triggered the rapid development of cryptography, multi-party secure computing, privacy protection, consensus algorithms, blockchain ledger technology, smart contracts, and other related application technologies. At the same time, the development of blockchain technology has also brought new solutions for data security and privacy protection in data sharing and openness.

[0027] The embodiments of this specification provide a blockchain-based data authorization access method, device and medium to solve the problems of data security and privacy information leakage in the process of data sharing and opening.

[0028] Figure 1 A flowchart of a data authorization access method based on blockchain provided in an embodiment of this specification, such as Figure 1 As shown, the blockchain-based data authorization access method mainly includes the following steps:

[0029] Step S101, the business service end verifies the data authorization request and determines the data authorization data; and sends the data authorization data to the authorization service end.

[0030] Further, step S101 specifically includes: the business service end sends a data authorization request verification to the user terminal, wherein the data authorization request verification includes one or more of the business name, data interface, interface parameters, access time and access content; after the user terminal passes the data authorization request verification, the data authorization request data is determined; the signature authorization instruction issued by the user is received, and the data authorization request data is signed according to the user's private key; based on the data authorization request data and the signature, the data authorization verification is determined, wherein the data authorization verification includes one or more of the user identity ID type, user identity ID, business name, data interface, interface parameters, access time, access content and signature.

[0031] In one embodiment of the present specification, the service server presents a data authorization request verification, wherein the data authorization request verifies one or more of the following: service name, data interface, interface parameters, access time and access content. It should be noted that the data authorization request verification can be in the form of a data authorization request QR code. Figure 2 As shown, Figure 2 A flowchart of another blockchain-based data authorization access method is given, where the business service end presents a data authorization request QR code to the user terminal.

[0032] The user terminal scans the data authorization request QR code and parses the data authorization request QR code, checks the obtained data authorization request data, and displays the obtained data authorization request data to the user. The user checks the business name in the data authorization request data. If the user agrees to the corresponding business, a signature authorization instruction for this business request is issued to the user terminal. For example, if a user handles a home purchase at the Housing Authority, the Housing Authority needs to inquire about the user's home purchase qualifications, such as whether full-term social security has been paid in the city. At this time, the social security data belongs to the Social Security Bureau, and the amount of social security paid is the user's personal privacy; at this time, the Housing Authority needs to inquire about whether the user has paid full-term social security in the city for the home purchase business. The user confirms the home purchase business. If it is indeed the business that needs to be handled, a signature authorization instruction for this business request is issued to the user terminal.

[0033] After the user terminal receives the user's signature authorization instruction, the user terminal uses the user's private key to sign the data authorization request data, and determines the data authorization verification based on the data authorization request data and the signature. Further, the data authorization verification is displayed to the business service end. Among them, it should be noted that the data authorization verification includes one or more of the following: user identity ID type, user identity ID, business name, data interface, interface parameters, access time, access content and signature; it should also be noted that the user identity ID can be an ID number or a passport number or an officer's ID number.

[0034] In one embodiment of the present specification, the business server scans the data authorization verification and parses the data authorization verification to obtain the data authorization data. It should be noted that the data authorization verification can be in the form of a data authorization QR code. Figure 2 As shown, the business server scans the data authorization QR code to obtain the data authorization data.

[0035] Furthermore, step S101 also includes: generating a random number, and sending the random number and the data authorization data to the authorization server.

[0036] In one embodiment of the present specification, when the business service end obtains the data authorization data, it generates a random number R, and sends the data authorization data and the random number R to the authorization service end, and the authorization service end temporarily saves the random number R. The reason for generating the random number R is that although the business service end trusts the authorization service end, it does not trust the user terminal. Therefore, the business terminal generates a random number and sends it to the authorization service end for encryption, so as to verify whether the random number generated by the business service end after decryption by the user terminal is the same as that generated by the business service end.

[0037] In step S102, the authorization server verifies the signature of the data authorization data according to the user's public key. If the verification is successful, the server requests business data from the business system according to the data authorization data; receives the business data and generates a first temporary symmetric key; encapsulates the business data to determine the first business encapsulation data, and encrypts the first business encapsulation data by the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key by the user's public key to determine the encrypted symmetric key, calculates the first hash value of the first business encapsulation data, and sends the encrypted data, the encrypted symmetric key and the first hash value to the business server.

[0038] Step S102 may specifically include: the authorization server obtains the public key of the user from the blockchain identity smart contract based on the user identity type and user identity ID in the data authorization data, and verifies the signature of the data authorization data based on the user public key.

[0039] In one embodiment of the present specification, the authorization server receives data authorization data and a random number R and temporarily stores the random number R; obtains the corresponding user public key from the blockchain identity smart contract according to the user identity ID type and user identity ID in the data authorization data, and uses the user public key to verify the signature of the data authorization data. By obtaining the corresponding user public key from the blockchain identity smart contract, the authenticity and legitimacy of the user identity are ensured; through user digital signature authorization, it is ensured that the data cannot be accessed without authorization.

[0040] If the signature verification is successful, the authorization server verifies whether the access time of the data authorization data is within an acceptable range, such as within 60 seconds of the current system time. The purpose of verifying the access time is to prevent replay attacks. If the access time verification is successful, the authorization server requests business data from the business system based on the user identity ID type, user identity ID, data interface, and interface parameters of the data authorization data. Based on the request of the authorization server, the business system queries the business data according to the user identity ID type, user identity ID, data interface, and interface parameters, and sends the business data to the authorization server. For example, the Housing Authority requests the Social Security Bureau to query the social security data of user A. The Social Security Bureau queries the social security data of user A based on the ID number of user A, and sends all social security data related to user A to the authorization server.

[0041] Furthermore, step S102 also includes: the authorization server encapsulates the business data and the random number to determine the first business encapsulation data; generates a timestamp and the first temporary symmetric key, encapsulates the business data, the random number and the timestamp, and determines the first business encapsulation data.

[0042] In one embodiment of the present specification, the authorization server encapsulates the queried service data to obtain first service encapsulation data CD.

[0043] In one embodiment of the present specification, the authorization service end generates a timestamp and a temporary symmetric key, and encapsulates the queried service data, the timestamp, and the temporarily stored random number to obtain first service encapsulation data CD.

[0044] The authorization server encrypts the data. Specifically, the first temporary symmetric key is used to encrypt the first service encapsulation data CD1 to obtain the encrypted data ED; the first temporary symmetric key is encrypted with the user public key to obtain the encrypted symmetric key EK. Next, the authorization server performs a hash calculation on the first service encapsulation data CD1 to obtain a first hash value H1. In other words, the authorization server performs a hash calculation on the service data, the random number R and the timestamp to obtain the first hash value H1.

[0045] Step S103: the business service end determines encrypted data verification based on the encrypted data and the encrypted symmetric key, and sends the encrypted data verification to the user terminal.

[0046] In one embodiment of the present specification, the authorization server sends the encrypted data ED, the encrypted symmetric key EK, and the first hash value H1 to the business server, which receives the above data and temporarily saves the first hash value H1. The business server determines the encrypted data verification based on the encrypted data ED and the encrypted symmetric key EK, and sends the encrypted data verification to the user terminal. It should be noted that the encrypted data verification can be in the form of an encrypted data QR code, and the encrypted data QR code is displayed to the user terminal to facilitate the user to obtain the encrypted data after scanning.

[0047] like Figure 2As shown, the business service end receives the encrypted data ED, the encrypted symmetric key EK and the first hash value H1, generates the encrypted data QR code of the encrypted data ED and the encrypted symmetric key EK, and displays it to the user terminal. Here, the data received by the business service end is the encrypted data and the first hash value H1. It should be noted that although the first hash value H1 is obtained by hashing the business data, random number and timestamp, the business service end cannot view the specific business data, random number and timestamp, ensuring that the business service end cannot retain the user's private data or spy on the private data content. Step S104, if the user terminal passes the encrypted data verification, determines the encrypted data and the encrypted symmetric key, and decrypts the encrypted symmetric key through the user's private key, determines the second temporary symmetric key; decrypts the encrypted data through the second temporary symmetric key, obtains the second business encapsulation data, and determines the plaintext business data according to the second business encapsulation data, and calculates the second hash value of the second business encapsulation data; generates information verification according to the second hash value, and sends the information verification to the business service end.

[0048] In one embodiment of the present specification, the user terminal obtains the encrypted data ED and the encrypted symmetric key EK by scanning the encrypted data QR code, parsing the encrypted data QR code, and decrypting the data. First, the encrypted symmetric key EK is decrypted using the user's private key to obtain a second temporary symmetric key; then the encrypted data ED is decrypted using the second temporary symmetric key to obtain the second service encapsulation data CD2. The second service encapsulation data CD2 may include plaintext service data and may also include plaintext service data, a random number R, and a timestamp. After obtaining the second service encapsulation data, the second hash value H2 of the second service encapsulation data CD2 is calculated. Figure 2 As shown, the user terminal calculates the second hash value H2 according to the service data, the random number R and the timestamp, and displays the service data, the random number R and the timestamp. It should be noted that the user terminal generates information verification based on the random number R, the timestamp and the second hash value H2 in the service encapsulation data CD2. The information verification can be in the form of a verification QR code, that is, the user terminal generates a verification QR code of the second hash value H2, the random number R and the timestamp.

[0049] In one embodiment of the present specification, the user terminal decrypts the encrypted data to obtain plaintext business data. It should be noted that the plaintext business data is the data required to be displayed to the business service end. For example, the business data about user A in the Social Security Bureau may include the specific amount of social security paid by user A, the payment object, company name and other data information containing personal privacy, while the data required by the Housing Authority (business service end) is whether user A has paid social security for six consecutive months. At this time, the plaintext business data is "yes" or "no" for user A to have paid social security for six consecutive months. After obtaining the plaintext business data, user A uses a mobile phone to show it to the window staff of the Housing Authority. At this time, the window staff of the Housing Authority can determine whether user A has paid social security for six consecutive months based on the plaintext business data displayed by the user, but cannot view the business data of user A.

[0050] The business server generates a random number, the authorization server generates a timestamp, the authorization server encapsulates the business data, random number, timestamp, and further calculates the hash value of the encapsulation result. This enables the business server to obtain the result it wants to prove without knowing the business data.

[0051] Step S105: If the service service end passes the information verification, the service data of the user terminal is legal, and the plain text service data is checked, and the service is processed for the user according to the plain text service data.

[0052] In one embodiment of this specification, Figure 2 As shown, the business server scans the verification QR code displayed by the user terminal, parses the verification QR code and obtains a random number R, a timestamp and a second hash value H2.

[0053] Step S105 may include: if the business service end determines that the second hash value is the same as the first hash value, then the business data of the user terminal is legal; and also includes: the difference between the timestamp in the second business encapsulation data and the timestamp in the first business encapsulation data is within a preset range, and the business service end determines that the second hash value is the same as the first hash value, then the business data of the user terminal is legal.

[0054] In one embodiment of the present specification, the business service end determines whether the second hash value H2 of the user terminal is the same as the first hash value H1 temporarily saved by the business service end, and determines whether the business data belongs to the user through the hash value. If it belongs to the user, it is legal data. If it is the same, the business data of the user terminal belongs to the user. It should be noted that the hash value is obtained by hashing the encapsulated business data, and the encapsulated business data can be obtained by encapsulating only the business data, or by encapsulating the business data and random numbers. Therefore, the hash value can be related to the business data, or it can be related to the business data, timestamp and random number. After that, the business service end handles the business for the user according to the plaintext business data of the user terminal. For example, the Housing Authority obtains that user A has paid social security for six consecutive months in this city, and the plaintext business data obtained is "yes". At this time, the Housing Authority checks the certificate of eligibility for purchasing a house displayed by user A on the user terminal, and the business data of user A is legal and usable data. The Housing Authority can handle the purchase approval business for user A.

[0055] In one embodiment of the present specification, the business service end determines that the difference between the timestamp in the second business encapsulation data CD2 and the timestamp in the first business encapsulation data CD1 is within a preset range and the second hash value H2 is the same as the first hash value H1, and the business data of the user terminal is legal and usable data. The hash value here is related to the business data, timestamp and random number, because the encapsulated business data is hashed, and the encapsulated business data is obtained by encapsulating the business data, timestamp and random number. For example, the Housing Authority obtains that user A has paid social security for six consecutive months in this city, and the plaintext business data received by the Housing Authority is "yes". At this time, the Housing Authority checks the certificate of eligibility for purchasing a house displayed by user A, and the business data of user A is indeed his own business data, and the timestamp is within the preset range. The Housing Authority can handle the purchase approval business for user A.

[0056] Figure 3A structural diagram of a blockchain-based data authorization access device provided for one embodiment of the present specification. The device includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can: the business service end verifies the data authorization data according to the data authorization request; sends the data authorization data to the authorization service end; the authorization service end verifies the signature of the data authorization data according to the user's public key, and if the verification passes, requests business data from the business system according to the data authorization data; receives the business data and generates a first temporary symmetric key; encapsulates the business data to determine the first business encapsulation data, and encrypts the first business encapsulation data by the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key by the user's public key to determine the encrypted symmetric key, and calculates the first hash value of the first business encapsulation data, and sends the encrypted symmetric key to the business system. The encrypted data, the encrypted symmetric key and the first Hash value are sent to the business service end; the business service end determines the encrypted data verification based on the encrypted data and the encrypted symmetric key, and sends the encrypted data verification to the user terminal; if the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second business encapsulation data, and the plaintext business data is determined according to the second business encapsulation data, and the second Hash value of the second business encapsulation data is calculated; information verification is generated according to the second Hash value, and the information verification is sent to the business service end; if the business service end passes the information verification, the business data of the user terminal is legal, and the plaintext business data is checked, and the business is handled for the user according to the plaintext business data.

[0057] One or more embodiments of the present specification provide a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to: verify the data authorization data according to the data authorization request of the business service end; send the data authorization data to the authorization service end; the authorization service end verifies the signature of the data authorization data according to the public key of the user, and if the verification is successful, requests the business data from the business system according to the data authorization data; receives the business data and generates a first temporary symmetric key; encapsulates the business data to determine the first business encapsulation data, and encrypts the first business encapsulation data by the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key by the user public key to determine the encrypted symmetric key, and calculates the first hash value of the first business encapsulation data, and compares the encrypted data, the encrypted symmetric key and the first hash value. The value is sent to the business service end; the business service end determines the encrypted data based on the encrypted data and the encrypted symmetric key, and sends the encrypted data to the user terminal for verification; if the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second business encapsulation data, and the plaintext business data is determined according to the second business encapsulation data, and the second hash value of the second business encapsulation data is calculated; information verification is generated according to the second hash value, and the information verification is sent to the business service end; if the business service end passes the information verification, the business data of the user terminal is legal, and the plaintext business data is checked, and the business is handled for the user according to the plaintext business data.

[0058] The embodiments of this specification combine blockchain and cryptographic technology to propose a method and device for authorized data access based on blockchain, so that data cannot be accessed without authorization and private data cannot be retained. It aims to solve the problems of data security and privacy information leakage in the process of data sharing and opening, provide a safe technical environment for data sharing and opening, promote the development of data sharing and opening services, and further promote the rapid and healthy development of the country and even the entire human society.

[0059] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0060] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0061] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.

Claims

1. A data authorization access method based on blockchain, characterized in that: The method comprises: The business service end verifies the data authorization request and determines the data authorization data; and sends the data authorization data to the authorization service end; The authorization service end verifies the signature of the data authorization data according to the user's public key. If the verification is successful, the service system is requested to provide service data according to the data authorization data; receives the service data, generates a first temporary symmetric key, encapsulates the service data, determines the first service encapsulation data, and encrypts the first service encapsulation data by using the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key by using the user's public key, determines the encrypted symmetric key, calculates the first hash value of the first service encapsulation data, and sends the encrypted data, the encrypted symmetric key and the first hash value to the service service end; The business service end determines the encrypted data verification based on the encrypted data and the encrypted symmetric key, and sends the encrypted data verification to the user terminal; if the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second business encapsulation data, and the plaintext business data is determined according to the second business encapsulation data, and the second hash value of the second business encapsulation data is calculated; information verification is generated according to the second hash value, and the information verification is sent to the business service end; If the business service end passes the information verification, the business data of the user terminal is legal, and checks the plaintext business data, and handles the business for the user according to the plaintext business data; The business service end verifies the data authorization request and determines the data authorization data, specifically including: The service server sends a data authorization request verification to the user terminal, wherein the data authorization request verification includes the service name, data interface, interface parameters, access time and access content; After the user terminal passes the data authorization request verification, the data authorization request data is determined; the signature authorization instruction issued by the user is received, and the data authorization request data is signed according to the user's private key; according to the data authorization request data and the signature, the data authorization verification is determined, wherein the data authorization verification includes user identity ID type, user identity ID, service name, data interface, interface parameters, access time, access content and signature; The business service end scans the data authorization verification and parses the data authorization verification to obtain data authorization data.

2. The data authorization access method based on blockchain according to claim 1 is characterized in that: If the service server passes the information verification, then the service data of the user terminal is legal, which specifically includes: If the service server determines that the second hash value is the same as the first hash value, the service data of the user terminal is legal.

3. The blockchain-based data authorization access method according to claim 1 is characterized in that: The sending of the data authorization data to the authorization server specifically includes: The business service end generates a random number, and sends the random number and the data authorization data to the authorization service end; The encapsulating the service data to determine the first service encapsulation data specifically includes: The authorization server encapsulates the service data and the random number to determine first service encapsulation data.

4. The blockchain-based data authorization access method according to claim 3 is characterized in that: The generating of the first temporary symmetric key, encapsulating the service data, and determining the first service encapsulation data specifically includes: Generate a timestamp and the first temporary symmetric key, encapsulate the business data, the random number and the timestamp, and determine the first business encapsulation data.

5. The blockchain-based data authorization access method according to claim 4 is characterized in that: If the service server passes the information verification, then the service data of the user terminal is legal, which specifically includes: If the service server determines that the difference between the timestamp in the second service encapsulation data and the timestamp in the first service encapsulation data is within a preset range, and the service server determines that the second hash value is the same as the first hash value, then the service data of the user terminal is legal.

6. The blockchain-based data authorization access method according to claim 1 is characterized in that: The authorization server verifies the signature of the data authorization data according to the user's public key, specifically including: the authorization server obtains the user's public key from the blockchain identity smart contract based on the user identity ID type and user identity ID in the data authorization data, and verifies the signature of the data authorization data according to the user's public key.

7. A data authorization access device based on blockchain, comprising: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: The business service end verifies the data authorization request and determines the data authorization data; and sends the data authorization data to the authorization service end; The authorization service end verifies the signature of the data authorization data according to the user's public key. If the verification is successful, the service system is requested to provide service data according to the data authorization data; receives the service data, generates a first temporary symmetric key, encapsulates the service data, determines the first service encapsulation data, and encrypts the first service encapsulation data by using the first temporary symmetric key to determine the encrypted data; encrypts the first temporary symmetric key by using the user's public key, determines the encrypted symmetric key, calculates the first hash value of the first service encapsulation data, and sends the encrypted data, the encrypted symmetric key and the first hash value to the service service end; The business service end determines the encrypted data based on the encrypted data and the encrypted symmetric key, and sends the encrypted data to the user terminal for verification; If the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second service encapsulation data, and the plaintext service data is determined according to the second service encapsulation data, and the second hash value of the second service encapsulation data is calculated; information verification is generated according to the second hash value, and the information verification is sent to the service service end; If the business service end passes the information verification, the business data of the user terminal is legal, and checks the plaintext business data, and handles the business for the user according to the plaintext business data; The business service end verifies the data authorization request and determines the data authorization data, specifically including: The service server sends a data authorization request verification to the user terminal, wherein the data authorization request verification includes the service name, data interface, interface parameters, access time and access content; After the user terminal passes the data authorization request verification, the data authorization request data is determined; the signature authorization instruction issued by the user is received, and the data authorization request data is signed according to the user's private key; according to the data authorization request data and the signature, the data authorization verification is determined, wherein the data authorization verification includes user identity ID type, user identity ID, service name, data interface, interface parameters, access time, access content and signature; The business service end scans the data authorization verification and parses the data authorization verification to obtain data authorization data.

8. A non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to: The business service end verifies the data authorization request and determines the data authorization data; and sends the data authorization data to the authorization service end; The authorization server verifies the signature of the data authorization data according to the public key of the user, and if the verification is successful, requests the business data from the business system according to the data authorization data; receives the business data, generates a first temporary symmetric key, encapsulates the business data, determines the first business encapsulation data, and encrypts the first business encapsulation data by using the first temporary symmetric key to determine the encrypted data; Encrypting the first temporary symmetric key by using the user public key, determining the encrypted symmetric key, calculating the first hash value of the first service encapsulated data, and sending the encrypted data, the encrypted symmetric key and the first hash value to the service server; The business service end determines the encrypted data based on the encrypted data and the encrypted symmetric key, and sends the encrypted data to the user terminal for verification; If the user terminal passes the encrypted data verification, the encrypted data and the encrypted symmetric key are determined, and the encrypted symmetric key is decrypted by the user private key to determine the second temporary symmetric key; the encrypted data is decrypted by the second temporary symmetric key to obtain the second service encapsulation data, and the plaintext service data is determined according to the second service encapsulation data, and the second hash value of the second service encapsulation data is calculated; Generate information verification according to the second hash value, and send the information verification to the business service end; If the business service end passes the information verification, the business data of the user terminal is legal, and checks the plaintext business data, and handles the business for the user according to the plaintext business data; The business service end verifies the data authorization request and determines the data authorization data, specifically including: The service server sends a data authorization request verification to the user terminal, wherein the data authorization request verification includes the service name, data interface, interface parameters, access time and access content; After the user terminal passes the data authorization request verification, the data authorization request data is determined; the signature authorization instruction issued by the user is received, and the data authorization request data is signed according to the user's private key; according to the data authorization request data and the signature, the data authorization verification is determined, wherein the data authorization verification includes user identity ID type, user identity ID, service name, data interface, interface parameters, access time, access content and signature; The business service end scans the data authorization verification and parses the data authorization verification to obtain data authorization data.

Images