Data management methods and related products based on blockchain

Abstract

The present invention relates to a data management method based on blockchain and related products. The data management method based on blockchain includes: obtaining shared information of the data, wherein the data is encrypted and stored under the blockchain, and the shared information at least includes metadata for describing the content of the data, data ownership information for describing the data access rights, and the access path of the data encrypted and stored under the chain; publishing the shared information on the blockchain; and in response to the access demand for the data, sending the shared information to the data user who has access rights to the data, so that the data user can achieve decrypted access to the data encrypted and stored under the chain based on the shared information. Through the scheme of the present invention, with the help of decentralized trusted data storage and sharing methods, a balance between data ownership and data security sharing is achieved.

Description

Technical Field

[0001] The present invention generally relates to the field of blockchain technology. More specifically, the present invention relates to a data management method based on blockchain, a device and a computer-readable storage medium for executing the aforementioned data management method, and a blockchain system. Background Art

[0002] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The descriptions herein may include concepts that may be explored, but not necessarily concepts that have been previously thought of or explored. Therefore, unless otherwise noted herein, the content described in this section is not prior art with respect to the specification and claims of this application, and is not admitted to be prior art by inclusion in this section.

[0003] Data is an important medium for the inheritance of human civilization and the lifeblood of the information age. With the rapid development of information technologies such as cloud computing and the Internet of Things, massive amounts of data are constantly emerging, and the value of the data contained in them is inestimable. The current data exchange and sharing methods, such as cloud computing, cloud storage, and cloud sharing, are all based on the design concept of centralized servers, which is to store all data in the server and then access and transmit data for data sharing. However, this centralized data sharing method will bring many problems such as data ownership, privacy and security, as follows:

[0004] 1. Data security. For example, a conservative attitude is taken in some data openness scenarios. The random disclosure of data may affect security issues, and there is a lack of motivation for sharing sensitive data.

[0005] 2. Privacy. Data sharers need to have the right to know, control and refuse the use of their private data. Traditional sharing methods can easily cause the sharers to lose data ownership. For example, once private data is shared, it faces the risk of unlimited dissemination. It is difficult to determine the responsibility when data infringement occurs, resulting in many data owners not being willing to participate in data exchange, resulting in a situation where they are unwilling to give data, which becomes a bottleneck restricting data sharing and interaction.

[0006] 3. Data monopoly. Centralized institutions that provide data exchange and sharing functions will hoard a large amount of confidential data, which may lead to data monopoly. For example, monopolists may use user data to do evil, such as selling user privacy and pushing targeted advertisements.

[0007] Therefore, how to find the right balance between data ownership and data security sharing is a core issue that needs to be solved in data exchange. There is currently no effective solution to this problem. Summary of the invention

[0008] In order to at least solve the technical problems described in the above background technology section, the present invention proposes a data management solution based on blockchain. Using the solution of the present invention, a balance between data ownership and data security sharing is achieved by means of a decentralized trusted data storage and sharing method.

[0009] In view of this, the present invention provides solutions in the following aspects.

[0010] The first aspect of the present invention provides a blockchain-based data management method, comprising: obtaining shared information of the data, wherein the data is encrypted and stored off-chain of the blockchain, and the shared information at least includes metadata for describing the data content, data ownership information for describing the data access rights, and an access path of the data encrypted and stored off-chain; publishing the shared information on the blockchain; and in response to a demand for access to the data, sending the shared information to a data user who has access rights to the data, so that the data user can achieve decrypted access to the data encrypted and stored off-chain based on the shared information.

[0011] In one embodiment, obtaining the shared information of the data includes: obtaining a shared data item about the data; and processing the shared data item based on the smart contract of the blockchain to obtain the shared information.

[0012] In one embodiment, the shared data item includes identification information of at least one data user who has access rights to the data and a key used to encrypt the data off-chain, wherein each data user is configured with a pair of public keys and private keys, and processing the shared data item based on the smart contract of the blockchain includes: encrypting the keys respectively using the public keys of each data user; and constructing an access control list for describing the data ownership information, wherein the access control list contains a mapping relationship between the identification information of each data user and the key encrypted by the public key of each data user.

[0013] In one embodiment, wherein the shared data item also includes an access path to the data, sending the shared information to a data user who has access rights to the data includes: determining whether there is a data user who sends the access request in the access control list; and in response to the existence of a data user who sends the access request, feeding back a key encrypted with its public key and the access path to the data to the data user who sent the access request.

[0014] In one embodiment, the method further includes: detecting whether the data is effectively shared; and performing penalty processing or incentive processing on the data publisher of the data according to the detection result.

[0015] The second aspect of the present invention provides a blockchain-based data management method, comprising: obtaining shared information of data from the blockchain, wherein the shared information at least includes metadata for describing the data content, data ownership information for describing the data access rights, and an access path for the data encrypted and stored off-chain; and based on the shared information, obtaining the data in an encrypted state from off-chain of the blockchain and decrypting and accessing it.

[0016] In one embodiment, based on the shared information, the data in an encrypted state is obtained from off-chain of the blockchain and decrypted and accessed, including: obtaining the ciphertext of the data from off-chain of the blockchain according to the access path of the data; and decrypting the ciphertext according to the data ownership information to achieve decrypted access to the data.

[0017] In one embodiment, each data user is configured with a pair of public keys and private keys, wherein the data ownership information is described by an access control list, the access control list contains a mapping relationship between the identification information of each data user and the key encrypted by the public key of each data user, and for each data user, decrypting the ciphertext according to the data ownership information includes: obtaining the key encrypted by the public key corresponding to each data user according to the access control list; decrypting the key using the private key of each data user; and decrypting the ciphertext using the decrypted key.

[0018] The third aspect of the present invention provides a device, comprising: a processor; and a memory storing computer instructions for blockchain-based data management, wherein when the computer instructions are executed by the processor, the device executes the method described in the first aspect above and in the following multiple embodiments, or executes the method described in the second aspect above and in the following multiple embodiments.

[0019] A fourth aspect of the present invention provides a computer-readable storage medium, comprising program instructions for blockchain-based data management, which, when executed by a processor, implement the method described in the first aspect above and in multiple embodiments below, or implement the method in the second aspect above and in multiple embodiments below.

[0020] By utilizing the solution provided by the present invention, data storage and sharing can be realized based on blockchain. Specifically, the data to be shared can be encrypted and stored off-chain on the blockchain, and the shared information of the data can be published on the blockchain, so that the data user with access rights can achieve decrypted access to the encrypted and stored data off-chain through the shared information. It can be seen that the solution of the present invention, on the one hand, improves the security of the data by encrypting and storing the data off-chain, while making it impossible for the off-chain storage institution to know the specific content of the data and monopolize the data. At the same time, on the other hand, shared information such as metadata, data ownership information, and access paths are stored on the chain, so that the data publisher can achieve effective management of the data through the setting of shared information, and can ensure that only the data user with access rights can finally obtain the data. In this way, secure storage, controllable sharing, and reliable transmission of data are achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] By reading the following detailed description with reference to the accompanying drawings, the above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0022] Figure 1 is a flow chart showing a data management method based on blockchain according to one embodiment of the present invention;

[0023] Figure 2 is a flowchart showing a blockchain-based data management method according to another embodiment of the present invention;

[0024] Figure 3 is an architectural diagram showing a blockchain system according to an embodiment of the present invention;

[0025] Figure 4 is an architectural diagram showing a data sharing and exchange business model according to an embodiment of the present invention;

[0026] Figure 5 is to illustrate the interaction process between the roles in the data sharing exchange business model according to an embodiment of the present invention; and

[0027] Figure 6 is a schematic diagram showing the structure of a device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0029] It should be understood that the terms "first", "second", "third" and "fourth" etc. in the claims, specifications and drawings of the present invention are used to distinguish different objects rather than to describe a specific order. The terms "include" and "comprise" used in the specification and claims of the present invention indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections.

[0030] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the claims, the singular forms of "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in the specification of the present invention and the claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0031] As used in this specification and claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0032] In this application, blockchain can be understood as a chain data structure formed by connecting data in a chronological order in the form of blocks, and a distributed ledger that guarantees the data cannot be tampered with or forged in a cryptographic way, and can realize data storage and query through smart contract technology, thereby realizing complex business logic. In addition, blockchain uses encryption and consensus algorithms to establish a trust mechanism, making the cost of denial, tampering and fraudulent behavior huge, and ensuring that data cannot be tampered with or forged. In some embodiments, the blockchain includes multiple nodes, which can identify the nodes on the chain through addresses generated by public keys.

[0033] The symmetric encryption involved in this application refers to the symmetric encryption algorithm in which the data sender processes the plaintext (i.e., original data) and the encryption key together with a special encryption algorithm to transform it into a complex encrypted ciphertext and send it out. After the recipient receives the ciphertext, if he wants to interpret the original text, he needs to use the encryption key and the inverse algorithm of the same algorithm to decrypt the ciphertext to restore it to readable plaintext. It is understandable that in the symmetric encryption algorithm, there is only one key used, and both the sender and the receiver use this key to encrypt and decrypt the data, which requires the decryption party to know the encryption key in advance.

[0034] The asymmetric encryption algorithm involved in this application requires two keys: a public key (publickey, referred to as public key) and a private key (privatekey, referred to as private key). Among them, the public key and the private key are a pair. If the data is encrypted with the public key, it can only be decrypted with the corresponding private key. Since two different keys are used for encryption and decryption, this algorithm is called an asymmetric encryption algorithm. In some embodiments, the basic process of implementing confidential information exchange with an asymmetric encryption algorithm is: Party A generates a pair of keys and makes the public key public. Other roles (such as Party B) who need to send information to Party A use the key (i.e. Party A's public key) to encrypt the confidential information and then send it to Party A. Then Party A uses its own private key to decrypt the encrypted information. When Party A wants to reply to Party B, the opposite is true. Party B's public key can be used to encrypt the data. Similarly, Party B uses its own private key to decrypt.

[0035] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0036] Figure 1 1 is a flow chart showing a data management method 100 based on blockchain according to one embodiment of the present invention. Figure 1As shown, at step S101, the shared information of the data can be obtained. Among them, the data is encrypted and stored under the blockchain. For example, at least the original data content of the data can be encrypted and stored in the data storage mechanism under the chain (such as a trusted computing environment, a data service center, and a distributed file system, etc.). In some embodiments, the shared information can be set by the data publisher according to the sharing requirements of the data, and the specific setting method can be determined according to the interaction design between the user and the device. Specifically, in some implementation scenarios, the aforementioned shared information may at least include metadata for describing the data content (such as data summary, outline or directory, etc.), data ownership information for describing data access rights (such as setting which data users have access rights) and encrypted access paths for data stored under the chain (such as the address, port, etc. of the data storage mechanism). It should be noted that the detailed description of the off-chain storage of data and its shared information here is only an exemplary description, and the solution of the present invention is not limited to this. For example, the shared information may also include the data publisher identification, release time, shared data validity period, data fingerprint, other conditions for obtaining data, and pricing, etc., which can be adjusted according to the sharing requirements.

[0037] Next, at step S102, the shared information can be published on the blockchain. Since the information stored on the block is part of the chain and will be permanently saved and synchronized to each participating node to ensure integrity, if the stored data is too large, it will seriously affect the synchronization performance and occupy limited storage space. Therefore, only a small amount of shared information related to the data is stored on the blockchain, which can save the storage resources of the blockchain to the greatest extent and ensure the synchronization performance of the blockchain.

[0038] Then, at step S103, in response to the access demand for data, the shared information can be sent to the data user who has access rights to the data, so that the data user can achieve decrypted access to the encrypted data stored off-chain based on the shared information. In some embodiments, the aforementioned access demand can be initiated by the data user to the blockchain, and of course, the blockchain can also actively monitor the data user to obtain it. The scheme of the present invention does not limit the specific acquisition process of the access demand. It can be seen that the scheme of the present invention, on the one hand, improves the security of the data by encrypting and storing data off-chain, while making it impossible for the off-chain storage institution to know and monopolize the data. At the same time, on the other hand, shared information such as metadata, data ownership information, and access paths are stored on the chain, so that the data publisher can achieve effective management of the data through the setting of shared information, and can ensure that only the data user with access rights can finally obtain the data. In this way, secure storage, controllable sharing, and reliable transmission of data are achieved.

[0039] Further, in some embodiments, the shared information can be determined by the shared data items of the data. Specifically, the shared data items of the data can be obtained. Then, the shared data items can be processed based on the smart contract of the blockchain to obtain the aforementioned shared information. For example, a smart contract for data storage and shared exchange can be developed to implement the data sharing exchange control plane function. Among them, the smart contract logic can involve shared data items. Specifically, the smart contract can be coded according to business needs to complete business-related verification or other automatically executed transactions. After the smart contract is developed, it is deployed on the blockchain platform and interacts with the upper-level business system during operation.

[0040] Furthermore, in some embodiments, the aforementioned shared data items may include identification information of at least one data user who has access rights to the data and a key used to encrypt the data off-chain, wherein each data user is configured with a pair of public keys and private keys. When processing the shared data items, the keys can be encrypted using the public keys of each data user, and an access control list for describing the data ownership information can be constructed. The key for encrypting the data is re-encrypted using an asymmetric encryption method, which can make key management more convenient and safer. Among them, the aforementioned access control list may contain a mapping relationship between the identification information of each data user and the key encrypted by the public key of each data user. It should be noted that the description of the shared data items here is only an exemplary description, and the scheme of the present invention is not limited to this. For example, the description of data ownership information is not limited to the access control list method, but can also be implemented through other data matching or binding methods.

[0041] Furthermore, in some embodiments, the aforementioned shared data item also includes an access path to the data. When sending the shared information to the data user, it can be determined whether there is a data user who sends an access request in the aforementioned access control list. Then, in response to the existence of a data user who sends the access request, the key encrypted by its public key and the access path to the data can be fed back to the data user who sent the access request. In this way, the controllable and reliable sharing of data is further ensured.

[0042] Furthermore, in some embodiments, it is also possible to detect whether the data is effectively shared, and to perform punishment or incentive treatment on the data publisher based on the detection result. For example, when it is determined that the data user has effectively accessed the data shared by the data publisher, the data publisher can be incentivized, for example, the points paid by the data user can be given to the data owner as an incentive. On the contrary, if it is determined that the data user provides an incorrect file key or other reasons cause the data user to be unable to effectively access, the data publisher can be punished, for example, by deducting points or freezing the account. Thus, by punishing or incentivizing the data publisher, the data publisher can be urged to share data more standardizedly and proactively.

[0043] Figure 2 2 is a flowchart showing a data management method 200 based on blockchain according to another embodiment of the present invention. It can be understood that Figure 1 The method 100 described is applicable to a data publisher, and Figure 2 The method 200 described is applicable to data users, so the above is combined with Figure 1 The same applies to the detailed description of the data users and their relationship with the data publishers. Figure 2 .

[0044] like Figure 2 As shown, at step S201, the shared information of the data can be obtained from the blockchain. In some embodiments, as described above, the shared information may at least include information such as metadata, data ownership information, and access path. Then, based on the shared information, the encrypted data can be obtained from the blockchain and decrypted for access. Thus, secure and reliable sharing of data is achieved.

[0045] Further, the ciphertext of the data can be obtained from the blockchain according to the access path of the data. In some embodiments, the access path may include the address or port information of data storage institutions such as a trusted computing environment, a data service center, and a distributed file system. Then, the ciphertext can be decrypted according to the aforementioned data ownership information to achieve decrypted access to the data. In some implementation scenarios, each data user can configure a pair of public keys and private keys, wherein the data ownership information can be described by an access control list, which can contain a mapping relationship between the identification information of each data user and the key encrypted by the public key of each data user. In practical applications, for each data user, the key encrypted by the public key corresponding to each data user can be obtained according to the aforementioned access control list. Then, the key can be decrypted using the private key of each data user. Then, the ciphertext can be decrypted using the decrypted key. It should be noted that the detailed description of the decryption process of the ciphertext here is only an exemplary description, and the scheme of the present invention is not limited thereto.

[0046] The following combination Figures 3 to 5 The solution of the present invention is further illustrated by using specific examples.

[0047] Figure 3 is an architectural diagram showing a blockchain system 300 according to an embodiment of the present invention. Figure 3 As shown, the blockchain system 300 can use blockchain as a hub for data sharing and exchange between organizations, which can develop the traditional centralized sharing model 302 (hereinafter referred to as model 302) into a weakly centralized sharing model 301 (hereinafter referred to as model 301) with blockchain as the link. Figure 3 It can be seen that the weakly centralized sharing model301 based on blockchain is far superior to the traditional centralized sharing model302 in terms of both the degree of data sharing and the degree of multilateral market participation.

[0048] In practical applications, mode 301 can adopt a design that decouples the data plane and the control plane. Among them, the on-chain storage of mode 301 stores data sharing metadata and access permission information, and the off-chain can achieve secure storage, controllable sharing, and reliable transmission of data by building autonomous, controllable, secure and reliable data storage institutions (such as data service centers) and data transmission channels and other platforms. Among them, blockchain, as the control plane of the trusted data storage and sharing exchange platform, firstly, in order to ensure the integrity and immutability of the data, the fingerprint (such as file hash value) and metadata of the published data are stored on the blockchain; secondly, in order to achieve controlled data sharing, data attributes, access permissions and access methods are put on the chain and controlled by smart contracts; thirdly, transparent auditing and incentives, through the blockchain to record the entire process of data access control authorization, audit the data sharing process, and reward and punish data publishers through pricing and points.

[0049] In some embodiments, in the data plane, the data service center completes the storage and transmission of the shared data body through a file safe. The data publisher can randomly generate a key locally or manually specify a key to encrypt the data using a symmetric encryption method, and specify the node with file access rights (that is, the data user) to use its public key to asymmetrically encrypt the data, which is equivalent to providing the key to open the file safe for the authorized visitor. By storing the encrypted files in the file safe of the data service center, only a small amount of data index and permission information and shared information such as keys are submitted to the blockchain. In some embodiments, the key for encrypting data should be one secret for each thing and replaced immediately after use. It is understandable that the key for encrypting data can also be changed periodically, or multiple data can be encrypted using the same key, which can be set according to the data publisher's data sharing needs.

[0050] In some embodiments, when a data publisher publishes data (such as a file), a key can be randomly generated or manually entered locally (such as through a client) to symmetrically encrypt the file. As mentioned above, different files can be encrypted with different keys, and the key of one file cannot decrypt another file. In addition, the user who has access to the file can be determined according to the specific business scenario, so that the key of the file can be asymmetrically encrypted using the public key on the user chain. The ciphertext generated can only be decrypted by the corresponding user with access rights. During the whole process, only the file publisher and the authorized accessor have the file decryption key, which ensures the privacy of the publisher. Then, the data publisher can submit the encrypted file to the data service center. The data service center only stores the encrypted file and does not have the file plaintext, which is equivalent to a file safe. When the data publisher submits the user list (Access Control List) with access rights and the corresponding asymmetric encrypted ciphertext to the blockchain through a smart contract, the asymmetric encrypted ciphertext is equivalent to the key to open the file safe for the user with access rights, and the user without access rights can only see the encrypted file. The concept of file safe in the data service center provides file storage, management, privacy protection and data security for data publishers. Files are uploaded by data publishers locally using symmetric encryption, ensuring that the file service center does not possess user privacy data and avoids the emergence of data monopoly. At the same time, file encryption also ensures data security.

[0051] In actual applications, mode 301 may be refined according to specific business scenarios. Figure 4 FIG. 4 is a diagram showing a feasible business model 400 that can realize data sharing and exchange. It can be understood that Figure 4 The business model 400 is Figure 3 A specific implementation form of the model 301, so the above text combines Figure 3 The relevant detailed description in also applies to Figure 4 .

[0052] like Figure 4 As shown, business model 400 mainly includes four types of roles: data publisher, data user, data regulator and trusted computing environment. Among them, data regulator can be understood as a role on the blockchain that can participate in the review to prevent data publishers from engaging in illegal activities, uploading illegal information, etc. on the chain. The trusted computing environment as a data storage agency can also be replaced by a data service center, a distributed file system, etc. Business model 400 provides access permission management and data decentralization of each role on the chain, multi-party mutual trust, multi-party collaborative writing, multi-party verification, and reward and punishment mechanisms. Among them, the specific working process of the above business model 400 involves:

[0053] (1) Data release

[0054] The data publisher publishes the shared data item on the chain. The data publisher publishes the metadata of the shared data (such as summary, directory and other file description information), access control information, etc. on the blockchain, and establishes a shared data item on the chain. The shared data item can be directly used as the aforementioned shared information, or it can be further processed to obtain the aforementioned shared information. Through the shared data item, the data resource is bound to the identity information and registered and stored, the data ownership information and its validity are clarified, and the permission setting and other condition requirements for the shared data item are completed.

[0055] (2) Apply for authorization

[0056] The data user initiates a data access request, and the data publisher authorizes it on the chain. Specifically, the data user searches for the required data in the published data and initiates a data request to apply for data access rights.

[0057] (3) Authorization and approval

[0058] If the access permission is approved, the data resource access method and the key to open the file safe will be returned to the data user on the chain.

[0059] (4) Data Acquisition

[0060] Data users can remotely access encrypted files and analyze and process them. Specifically, data users use their own private key to decrypt the key to obtain the symmetric key of the encrypted file, and decrypt it to obtain the plaintext of the file.

[0061] (5) Punishment for Evil

[0062] If the file key obtained by the data user is incorrect or other reasons lead to inability to effectively access the file, the data user can expose his private key and other nodes on the chain (such as data regulators) participate in the verification. Once the data publisher is found to have done something malicious, he can be punished (such as deducting points, freezing the account, etc.). In some implementation scenarios, the private key of the data user should also be kept secret for each transaction, and the public-private key pair should be regenerated.

[0063] Taking the business scenario of the loan application review platform for science and technology enterprises in the government affairs system as an example, a blockchain trusted data storage and sharing exchange platform (i.e., business model 400) can be built based on the underlying blockchain platform xchain. Among them, the enterprise privacy information, loan application information, etc. involved are sensitive information, and it should be stipulated that they can only be accessed by the department responsible for review, and access permission control is required.

[0064] In some implementation scenarios, one address on the blockchain identifies one user. When a user registers information on the platform, a transaction is sent to the blockchain to call a smart contract to put the user information on the chain. In some embodiments, the smart contract logic mainly involves two types of data, namely shared data items and user data items. Among them, the shared data items can specify information such as shared data identification, metadata, data fingerprint, data provider, data release time, validity period, data access rights, data acquisition method, and additional conditions. An exemplary data structure of shared data is shown in Table 1:

[0065] Data Item Logo Remark Shared data identification dataItem Unique number of the data Metadata metaData Description of the data content, such as data schema Data Fingerprint dataHash Hash value of shared data Data Provider userId Data provider ID Data release time pubTime Shared data release time Validity validTime Validity period of shared data Data access permissions permission Access control lists for shared data Data acquisition method accessInfo Data access method, including the server address and port of the data Additional conditions addCond Other conditions for characterizing data acquisition and corresponding pricing requirements

[0066] Table 1

[0067] Among them, the access control list item in Table 1 can be a mapping table Map, each record in the mapping table is a key-value pair, each key is the address of a user with access rights (specifically, it can be calculated from the blockchain public key and can be used as a node identifier), and the value is the key corresponding to the user provided by the data publisher (that is, the ciphertext of the asymmetric encryption key).

[0068] In some embodiments, the user data item may store a collection of shared data items related to the user. An exemplary structure of the user data item is as described in Table 2:

[0069] Data Item Logo Remark User ID userId User unique number Release data list pubList[] Publishing data records Accessing the data list comList[] Usage data logging integral balance User Points

[0070] Table 2

[0071] In some embodiments, the user's on-chain storage structure may include:

[0072]

[0073] Among them, user roles may include system administrators, enterprise users, government users, bank users, etc., and user roles may determine their responsibilities and powers.

[0074] In some embodiments, the enterprise registration information submitted by the enterprise user on the platform may include basic enterprise information, enterprise legal person information, enterprise rental information, enterprise tax payment certificate, annual audit report, enterprise employee information, etc. Among them, the sensitive information involved can only be seen by authorized persons.

[0075] In some embodiments, when applying for various loans, corporate users fill in materials, submit relevant documents, send transactions to the blockchain to call smart contracts, and upload application information to the chain. Among them, an exemplary storage structure of the application submitted by the enterprise on the chain is:

[0076]

[0077]

[0078] An exemplary storage structure of the aforementioned data entry is:

[0079]

[0080] After completing the registration of relevant information, the various roles in the platform interact with each other to achieve data sharing. Figure 5 FIG. 1 is a diagram showing an exemplary interaction process between the roles in the above business model. Figure 5 As shown in the figure, the interaction process between the roles involves steps ① to ⑦:

[0081] ①The data publisher (such as an enterprise user) uploads the symmetrically encrypted ciphertext to the data service center.

[0082] ② The data publisher uses the public key of each user in the access list (such as user A, user B, ..., user G) to encrypt the symmetric encryption key and store it in the smart contract of the blockchain.

[0083] ③When a data user accesses a smart contract, if it exists in the access control list, the corresponding public key encryption key is obtained.

[0084] ④ The data user uses his own private key to decrypt the key encrypted by the public key to obtain the file encryption key.

[0085] ⑤Data users visit the data service center to obtain files.

[0086] ⑥The data service center feeds back the ciphertext of the file to the data user

[0087] ⑦ The data user uses the file’s key to decrypt the ciphertext to obtain the file’s plaintext.

[0088] In the above process, after completing the relevant information registration and uploading to the chain, the submitted files can be stored in the platform file service center, and the file metadata, access method and access permission control are stored by the smart contract. In the Applicaion structure, permission can store the file access whitelist, and only users on the whitelist can access it, thereby realizing precise control of file access permissions. The data item hash stored on the chain ensures that the files submitted by the enterprise have not been tampered with or forged. In addition, the loan application submitted by the data publisher (such as the enterprise user) needs to be reviewed by the relevant government department (that is, the regulatory agency), and the corresponding file whitelist should add government users to ensure that irrelevant users cannot access sensitive data. When the government user reviews the loan application on the platform, it sends a transaction to the blockchain to call the smart contract. The smart contract determines whether the user is in the corresponding application access whitelist. If not, it prohibits access. If it is, it provides its file access method such as the data service center link, and the user will be able to access it. In addition, each access data record is recorded on the chain to leave a trace, realizing a shared responsibility mechanism of who reviews and who is responsible. Finally, the bank user provides the loan to the enterprise after receiving the notification of the application approval.

[0089] Therefore, using the data service center to store the encrypted files of the data publisher is equivalent to locking the user's files in a file safe, and the file service center does not have the decryption key, which fundamentally ensures that the user's private data will not be abused by the centralized server, avoids data monopoly, and ensures the security of private data. In addition, the roles of data publishers and data users are not fixed. Data users may also become data publishers, and data users may also use and write data at multiple levels and stages. At the same time, other roles participate in verification. This scenario of multi-party collaborative writing is very consistent with the characteristics of blockchain. Furthermore, cryptographic hash algorithms (Hash) and digital signatures (DigitalSignature) can be used to ensure that the initiator of the transaction cannot be impersonated, and the chain hash structure of the block ensures that historical transactions are permanently recorded and cannot be easily tampered with. Therefore, based on this feature of mutual trust in the blockchain, it can ensure that data publishing and access are traceable and traceable and accountable. In addition, the data stored on the blockchain as part of the chain will be permanently saved and synchronized to each participating node to ensure integrity. If the stored data is too large, it will seriously affect the synchronization performance and occupy limited storage space. Therefore, data that is too large is not suitable for chaining and the efficiency of asymmetric encryption of large data is also very low. In this regard, the present invention innovatively uses the design of a file safe, which can specifically store symmetrically encrypted files in the data service center, and then store the file encryption key on the chain through asymmetric encryption through smart contracts, and integrate it with access control to achieve secure storage, controllable sharing and reliable transmission of data.

[0090] Figure 6 A schematic block diagram of a device 600 according to an embodiment of the present invention is schematically shown. Figure 6 As shown, the device 600 may include a processor 601 and a memory 602. The memory 602 stores computer instructions for blockchain-based data management. When the computer instructions are executed by the processor 601, the device 600 executes the above-mentioned Figure 1 , Figure 2 and Figure 5 For example, in some embodiments, the device 600 may perform acquisition, publication, and transmission of shared information or decryption access to data. Based on this, the device 600 may achieve a balance between data ownership and data security sharing by means of a decentralized trusted data storage and sharing method.

[0091] In addition, the present application also proposes a blockchain system, comprising: a plurality of nodes, wherein the plurality of nodes include a data publisher and a data user, wherein the data publisher is configured to execute Figure 1 The method is to realize the publication of shared information of data in off-chain encrypted storage on the blockchain; the data user is configured to execute Figure 2 The method is to achieve decryption access to the data stored in off-chain encrypted storage based on the shared information. Further, in some embodiments, the aforementioned multiple nodes also include a data supervisor for supervising on-chain business, wherein the data supervisor participates in verifying whether the data is effectively shared.

[0092] As can be seen from the above description of the modular design of the present invention, the system of the present invention can be flexibly arranged according to the application scenario or demand without being limited to the architecture shown in the accompanying drawings. Further, it should also be understood that any module, unit, component, server, computer or device that performs the operation of the example of the present invention may include or otherwise access a computer-readable medium, such as a storage medium, a computer storage medium or a data storage device (removable) and / or non-removable) such as a disk, an optical disk or a tape. Computer storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules or other data. Based on this, the present invention also discloses a computer-readable storage medium having computer-readable instructions for blockchain-based data management stored thereon, which, when executed by one or more processors, implements the methods and operations described in conjunction with the accompanying drawings.

[0093] Although this specification has shown and described a plurality of embodiments of the present invention, it is obvious to those skilled in the art that such embodiments are provided by way of example only. Those skilled in the art will appreciate many changes, modifications and alternatives without departing from the thought and spirit of the present invention. It should be understood that in the process of practicing the present invention, various alternatives to the embodiments of the present invention described herein may be adopted. The attached claims are intended to define the scope of protection of the present invention, and therefore cover the modular compositions, equivalents or alternatives within the scope of these claims.

Claims

1. A data management method based on blockchain, characterized in that: include: Acquire shared information of the data, wherein the data is encrypted and stored off-chain of the blockchain, and the shared information at least includes metadata for describing data content, data ownership information for describing data access rights, and an access path to the data encrypted and stored off-chain; The shared information of the data includes: obtaining a shared data item about the data; and Processing the shared data item based on the smart contract of the blockchain to obtain the shared information; The shared data item includes identification information of at least one data user having access rights to the data and a key used to encrypt the data off-chain, wherein each data user is configured with a pair of public keys and private keys, and processing the shared data item based on the smart contract of the blockchain includes: Using the public key of each data user to encrypt the secret key respectively; and Constructing an access control list for describing the data ownership information, wherein the access control list includes a mapping relationship between the identification information of each data user and a key encrypted by the public key of each data user; Publishing the shared information to the blockchain; and In response to a demand for access to the data, the shared information is sent to a data user who has access rights to the data, so that the data user can achieve decrypted access to the data encrypted and stored off-chain based on the shared information; detecting whether the data is effectively shared; and Punishment or incentive processing is performed on the data publisher of the data according to the detection result.

2. The data management method according to claim 1, characterized in that: The shared data item further includes an access path to the data, and sending the shared information to a data user having access rights to the data includes: Determining whether there is a data user who sends the access request in the access control list; and In response to the existence of a data user who sends the access request, the key encrypted with its public key and the access path to the data are fed back to the data user who sends the access request.

3. A data management method based on blockchain, characterized in that: include: Acquire shared information of the data from the blockchain, wherein the shared information includes at least metadata for describing the content of the data, data ownership information for describing the access rights to the data, and an access path to the data encrypted and stored off-chain; as well as Based on the shared information, the encrypted data is obtained from off-chain of the blockchain and decrypted and accessed; The obtaining the encrypted data from the blockchain based on the shared information and decrypting and accessing the data includes: Obtaining the ciphertext of the data from off-chain of the blockchain according to the access path of the data; and Decrypting the ciphertext according to the data ownership information to achieve decrypted access to the data; Each data user is configured with a pair of public keys and private keys, wherein the data ownership information is described by an access control list, and the access control list contains a mapping relationship between the identification information of each data user and the key encrypted by the public key of each data user. For each data user, decrypting the ciphertext according to the data ownership information includes: According to the access control list, obtaining a public key encrypted key corresponding to each data user; Decrypting the secret key using the private key of each data user; and The ciphertext is decrypted using the decrypted key.

4. A device, characterized in that: include: processor; as well as A memory storing computer instructions for blockchain-based data management, wherein when the computer instructions are executed by the processor, the device executes the method according to any one of claims 1-2, or executes the method according to claim 3.

5. A computer program product, characterized in that The method comprises program instructions for blockchain-based data management, which, when executed by a processor, implement the method according to any one of claims 1 to 2, or execute the method according to claim 3.

6. A blockchain system, characterized in that: include: A plurality of nodes, wherein the plurality of nodes include a data publisher and a data user, wherein the data publisher is configured to execute the data management method according to any one of claims 1 to 2, so as to realize publishing the shared information of the data in the off-chain encrypted storage on the blockchain; The data user is configured to execute the data management method according to claim 3 to achieve decryption access to the data encrypted and stored off-chain based on the shared information; The multiple nodes also include a data supervisor for supervising on-chain business, wherein the data supervisor participates in verifying whether the data is effectively shared.

Images