Access credential issuance method, data access method and device based on blockchain

Abstract

The present application provides a method for issuing access credentials, a data access method and device based on blockchain, which can be used in the financial field or other technical fields. The method for issuing access credentials includes: generating a target credential template corresponding to the data access control policy according to the data access control policy for the target business scenario sent by the first device; sending the business request and the data access control policy to the blockchain network according to the business request sent by the first device; generating the access credentials of the business participant according to the credential acquisition request for the target business scenario sent by the first device using the target credential template, credential generation rules and the access attributes of each business participant; and sending the access credentials of each business participant to the service gateway of the business participant. The embodiments of the present application solve the efficiency and security problems of CA centralized key distribution processing.

Description

Technical Field

[0001] The present application relates to finance or other technical fields, and specifically to a method for issuing access credentials, a data access method and device based on blockchain. Background Art

[0002] Currently, block data and world state data within a blockchain can be accessed through smart contract interfaces. Alliance members within the same channel can access all data within that channel, which inadequately protects the privacy of alliance members. To address this, the traditional approach is to obtain on-chain data and then encrypt it using the public keys of different business applications through an off-chain encryption machine or gateway. Upon receiving the data, the business application decrypts it using its own private key.

[0003] There are two problems with data processed by encryption machines or gateways. The first is that centralized processing is time-consuming. The data obtained on the processing chain requires different public keys. The same data pushed to N business applications must undergo N encryptions. In high-concurrency situations, multiple encryptions will cause greater processing pressure on the encryption machine or gateway, and the queuing encryption is time-consuming. The second is that the security of the encrypted public-private key pair cannot be guaranteed. The public-private key pair is either generated by the business application itself or by a centralized CA. If the business generates it itself, the encryption machine or gateway cannot manage the validity period of the public key. If it is generated by a centralized CA, the key distribution depends on the CA's processing efficiency and high-availability deployment.

[0004] Application Contents

[0005] In response to the problems in the prior art, the embodiments of the present application provide a method for issuing access credentials, a blockchain-based data access method and device, which can at least partially solve the problems in the prior art.

[0006] In a first aspect, the present application proposes a method for issuing an access credential, comprising:

[0007] generating, according to the data access control policy for the target business scenario sent by the first device, a target credential template corresponding to the data access control policy;

[0008] According to the service request sent by the first device, the service request and the data access control policy are sent to the blockchain network, wherein the consensus node in the blockchain network is used to endorse the smart contract according to the service request, and the accounting node in the blockchain network is used to encrypt and store the valid data generated by the smart contract according to the data access control policy;

[0009] generating, according to the credential acquisition request for the target business scenario sent by the first device, an access credential for the business participant using the target credential template, the credential generation rule, and the access attributes of each business participant, wherein the credential acquisition request includes the access attributes of at least one business participant;

[0010] The access credentials of each business participant are sent to the service gateway of the business participant.

[0011] Secondly, this application proposes a data access method based on blockchain, including:

[0012] According to the data access request for the target business scenario sent by the second device, the encrypted data for the target business scenario obtained from the blockchain network is decrypted using the access credential obtained from the service gateway of the business initiator to obtain the target data, wherein the access credential is generated by the service gateway of the business initiator according to the data access control policy for the business scenario sent by the business initiator and the access attributes of the business participants, and the encrypted data for the business scenario is obtained by encrypting the valid data for the business scenario by the accounting node in the blockchain network according to the data access control policy;

[0013] The target data is sent to the second device.

[0014] In a third aspect, the present application proposes a device for issuing an access credential, comprising:

[0015] A first generating module, configured to generate a target credential template corresponding to the data access control policy for the target business scenario according to the data access control policy sent by the first device;

[0016] a first sending module, configured to send the service request and the data access control policy to a blockchain network based on the service request sent by the first device, wherein a consensus node in the blockchain network is configured to endorse a smart contract based on the service request, and a bookkeeping node in the blockchain network is configured to encrypt and store valid data generated by the smart contract based on the data access control policy;

[0017] a second generating module, configured to generate, based on the credential acquisition request for the target business scenario sent by the first device, an access credential for the business participant using the target credential template, the credential generation rule, and the access attributes of each business participant, wherein the credential acquisition request includes the access attributes of at least one business participant;

[0018] The second sending module is used to send the access credential of each business participant to the service gateway of the business participant.

[0019] In a fourth aspect, the present application proposes a device for issuing an access credential, comprising:

[0020] a decryption module for decrypting, based on a data access request for a target business scenario sent by a second device, encrypted data for the target business scenario obtained from the blockchain network using an access credential obtained from the service gateway of the business initiator, to obtain target data, wherein the access credential is generated by the service gateway of the business initiator based on the data access control policy for the business scenario sent by the business initiator and the access attributes of the business participants, and the encrypted data for the business scenario is obtained by encrypting valid data for the business scenario by a bookkeeping node in the blockchain network according to the data access control policy;

[0021] A sending module is used to send the target data to the second device.

[0022] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any of the above embodiments when executing the program.

[0023] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method described in any of the above embodiments when the computer program is executed by a processor.

[0024] The access credential issuance method and blockchain-based data access method and device provided in the embodiments of the present application use a one-time encryption method for on-chain data using an access control policy customized by the business initiator, register a unified attribute template related to the access control policy (target credential template), and issue access credentials according to the template, so that business participants can use the access credentials to access data to which they have access rights. In this way, based on the decentralized nature of digital identity, the efficiency and security issues of centralized CA key distribution are resolved. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0026] Figure 1 It is a structural diagram of a data authority control system provided in one embodiment of the present application.

[0027] Figure 2It is a structural diagram of a distributed service gateway provided in one embodiment of the present application.

[0028] Figure 3 This is a flowchart of a method for issuing access credentials provided in an embodiment of the present application.

[0029] Figure 4 This is a partial flow chart of a method for issuing access credentials provided in an embodiment of the present application.

[0030] Figure 5 This is a schematic diagram of the CPT template data structure provided in an embodiment of the present application.

[0031] Figure 6 This is a partial flow chart of a method for issuing access credentials provided in an embodiment of the present application.

[0032] Figure 7 This is a partial flow chart of a method for issuing access credentials provided in an embodiment of the present application.

[0033] Figure 8 This is a flowchart of a blockchain-based data access method provided in an embodiment of the present application.

[0034] Figure 9 This is a partial flow chart of a blockchain-based data access method provided in an embodiment of the present application.

[0035] Figure 10 This is a flowchart of a blockchain-based data access method provided in an embodiment of the present application.

[0036] Figure 11 This is a structural diagram of an access credential issuance device provided in one embodiment of the present application.

[0037] Figure 12 This is a structural diagram of a blockchain-based data access device provided in one embodiment of the present application.

[0038] Figure 13 This is a schematic diagram of the physical structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0039] To make the purpose, technical solutions, and advantages of the embodiments of the present application more clearly understood, the embodiments of the present application are further described in detail below with reference to the accompanying drawings. The illustrative embodiments of the present application and their descriptions are used to explain the present application but are not intended to limit the present application. It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of the present application can be arranged in any order.

[0040] The terms “first,” “second,” etc. used herein do not specifically refer to an order or sequence, nor are they intended to limit this application. They are merely used to distinguish elements or operations described with the same technical terms.

[0041] The words “include,” “including,” “have,” “contain,” etc. used in this document are open-ended terms, meaning including but not limited to.

[0042] As used herein, "and / or" includes any and all permutations of the items described.

[0043] This application introduces the CP-ABE algorithm and digital identity technology to provide a solution for access control and access policy security of on-chain data. The detailed technical solution is as follows:

[0044] Please refer to Figure 1 The implementation of this solution mainly relies on the following three parts: application server 1, distributed service gateway 2, and blockchain network 3. Application server 1 is mainly responsible for initiating transactions and receiving transaction return data. Distributed service gateway 2 belongs to the application, integrates digital identity and access control capabilities based on the CP-ABE algorithm, and is mainly responsible for digital identity registration, credential issuance and verification, and access control policy formulation. Blockchain network 3 is mainly responsible for processing business logic and ensuring the traceability, auditability, and supervision of the entire process, ensuring the implementation of business logic and the security and integrity of alliance party identities, access credentials, service gateway identities, and access policies.

[0045] The application server 1 includes an initiator application server and a participant application server. The initiator application server is the dominant party in the business scenario and is responsible for collecting and uploading data. The participant application server is mainly responsible for data acquisition and parsing. The identity information and authority control of the application server 1 are both implemented through the distributed service gateway 2.

[0046] The distributed service gateway 2 integrates digital identity capabilities and access control capabilities based on the CP-ABE algorithm. Each alliance party has its own distributed service gateway. Please refer to Figure 2 , including digital identity registration module 2-1, credential issuance module 2-2, credential verification module 2-3, access control policy customization module 2-4, and business data processing module 2-5. Among them:

[0047] Digital identity registration module 2-1 is used to register a trusted digital identity (DID) for alliance applications and service gateways to ensure identity security for on-chain interactions and interactions with other alliance service gateways. The service gateway automatically registers the DID upon startup. Generally, alliances share the same service gateway. When an alliance application first interacts with the service gateway, it registers the trusted digital identity (DID) through the service gateway. The public key generated by the DID registration is endorsed and stored on the chain, while the private key is kept by the holder or can be uniformly hosted on the service gateway.

[0048] The certificate issuance module 2-2 is used to issue certificates for alliance applications based on the deformed certificate template CPT customized by the access control policy customization module 2-4. The data in the certificate will be filled in according to the attribute description of the system smart contract endorsement according to the following rules: valid attributes are filled in according to the business transmission message and business rules; invalid attributes are randomly generated using the snowflake algorithm if they are string types; invalid attributes are digital types and 3 digits are truncated in sequence using the public key.

[0049] The credential verification module 2-3 is used to verify the validity and non-tampering of the credential issued by the credential issuance module 2-2. It obtains the endorsed CPT template, template attribute description, and credential hash on the chain, and verifies the consistency of the CPT template, the consistency of the template value and the template attribute description, and the consistency of the credential hash.

[0050] Access control policy customization module 2-4 is used for alliance applications to flexibly customize access control policies based on the CP-ABE algorithm. This policy can control the data access rights of each alliance application chain. The control policy is determined by the business scenario. The attributes required by the control policy are uniformly extracted into a credential template CPT (original). In order to prevent brute force attacks, it is registered and transformed (adding some redundant attributes) into a new credential template through the service gateway. The transformed access control policy credential template is endorsed on the chain, and the attribute description of the template is endorsed on the chain through the system smart contract.

[0051] Business data processing modules 2-5 are responsible for signing on-chain transaction messages with the application's private key and decrypting on-chain data obtained from transactions using the user's credentials based on the CP-ABE algorithm's access policy. Encryption and decryption remain consistent with the traditional CP-ABE algorithm.

[0052] The blockchain network 3 is mainly responsible for endorsing the public key and DID of the trusted digital identity generated by the distributed service gateway, endorsing the externally exposed address of the distributed service gateway, endorsing the business data of the access control policy based on the CP-ABE algorithm, endorsing the transformed access control policy CPT template, and endorsing the detailed description of the CPT template attributes. At the same time, it is also necessary to encrypt the final on-chain storage data based on the access policy of the CP-ABE algorithm.

[0053] CP-ABE: Attribute-based encryption uses cryptographic mechanisms to protect data. The data owner specifies the policy for accessing ciphertext and associates attribute sets with access resources. Data users can access ciphertext information based on their authorized attributes. This technology is suitable for access-related applications such as private data sharing.

[0054] Digital identity: Individuals are identifiably portrayed through digital information, and real information is condensed into public and private keys in the form of digital codes, so that individuals' real-time behavioral information can be bound, queried, and verified.

[0055] The following describes in detail the method for issuing access credentials and the blockchain-based data access method provided in this application.

[0056] The execution entities of the access credential issuance method and the blockchain-based data access method provided in the embodiments of the present application include but are not limited to computers.

[0057] Figure 3 This is a flow chart of a method for issuing access credentials provided in an embodiment of the present application. Figure 3 As shown, an embodiment of the present application provides a method for issuing an access credential, including:

[0058] S101. Generate a target credential template corresponding to a data access control policy for a target business scenario sent by a first device;

[0059] In step S101, it should be noted that when the distributed service gateway of each alliance party is started, the digital identity DID is automatically registered, the public key is endorsed on the chain, and the private key is kept locally; each alliance party's application configures the service gateway address locally, and automatically registers the digital identity DID through the service gateway when it is started, the public key is endorsed on the chain, and the private key is kept on the application local server or hosted in the service gateway; the business initiator formulates the data access control policy for each alliance party application according to the business scenario, and then transmits the policy to the corresponding service gateway through the initiator's application server (first device); the service gateway parses the policy, extracts and refines the attributes involved in the policy, and forms the target credential template of the access control policy.

[0060] S102. Based on the service request sent by the first device, send the service request and the data access control policy to the blockchain network, wherein the consensus node in the blockchain network is used to endorse the smart contract based on the service request, and the accounting node in the blockchain network is used to encrypt and store the valid data generated by the smart contract based on the data access control policy;

[0061] In step S102, the business initiator initiates a business request to the service gateway through the application server (first device); after receiving the business request, the service gateway verifies the digital identity DID of the business initiator's application, signs the business request and access control policy with the private key of the application digital identity, and sends them to the blockchain network; the consensus node of the blockchain network verifies the validity of the business request through the public key corresponding to the application digital identity DID stored on the chain; after the consensus node endorses the smart contract, the accounting node encrypts and stores the data (valid data) that needs to be stored in the contract based on the CP-ABE algorithm according to the access control policy uploaded by the service gateway.

[0062] S103: Generate an access credential for each business participant based on the credential acquisition request for the target business scenario sent by the first device, using the target credential template, credential generation rules, and access attributes of each business participant, wherein the credential acquisition request includes the access attributes of at least one business participant;

[0063] In step S103, after the blockchain's accounting node lands the block, it notifies the service gateway that the contract call is complete; the service gateway notifies the business initiator that it can initiate a credential acquisition request; the business initiator sets the access attributes of each business participant based on the business scenario and requests the service gateway to generate access credentials for each participant;

[0064] The service gateway generates an access credential for each business party according to the target credential template CPT and the pre-set credential generation rules and the credential acquisition request of the business initiator.

[0065] S104: Send the access credentials of each business participant to the service gateway of the business participant.

[0066] In step S104, after the service gateway of the business initiator generates the access credential, it distributes the access credential of each participant to the service gateway of the participant. After the service gateways verify each other through digital identities, they receive and keep the credential.

[0067] The access credential issuance method provided in the embodiment of the present application uses a one-time encryption method for on-chain data using an access control policy customized by the business initiator, registers a unified attribute template related to the access control policy (target credential template), and issues access credentials according to the template, allowing business participants to use the access credentials to access data to which they have access rights. In this way, based on the decentralized nature of digital identity, the efficiency and security issues of centralized CA key distribution are resolved.

[0068] In some embodiments, the method further includes: sending the target voucher template and the attribute description of the target voucher template to a blockchain network for on-chain endorsement. Specifically, the target voucher template can be endorsed on-chain by invoking a digital identity smart contract, and the attribute description can be endorsed on-chain by a system smart contract.

[0069] like Figure 4 As shown, in some embodiments, generating a target credential template corresponding to the data access control policy for the target business scenario according to the data access control policy sent by the first device includes:

[0070] S1021. Generate an original voucher template corresponding to the data access control policy for the target business scenario sent by the first device;

[0071] S1022. Modify the original voucher template according to a preset template modification strategy to obtain a target voucher template.

[0072] Specifically, if Figure 5 As shown, the service gateway parses the access control policy, extracts and refines the attributes in the access control policy to form an original certificate template; then the service gateway deforms the original certificate template, disrupts the attributes, adds some redundant attributes, and generates attribute descriptions based on the attributes in the template; the service gateway uses the deformed template as the target certificate template CPT, and then endorses the CPT template on the chain by calling the digital identity smart contract, and endorses the attribute description on the chain through the system smart contract.

[0073] like Figure 6 As shown, in some embodiments, generating the access credential of the business participant according to the credential acquisition request for the target business scenario sent by the first device using the target credential template, credential generation rules, and access attributes of each business participant includes:

[0074] S1031. Acquire the target credential template and the attribute description from the blockchain network according to the credential acquisition request for the target business scenario sent by the first device, wherein the credential acquisition request includes access attributes of at least one business participant;

[0075] S1032: Generate an access credential for each business participant based on the target credential template, the attribute description, the credential generation rule, and the access attribute of each business participant.

[0076] Specifically, the business initiator sets the access attributes of each participant based on the business scenario and requests the service gateway to generate access credentials for each participant; the service gateway obtains the CPT template and attribute description from the chain, and generates access credentials for each business party according to the pre-set credential generation rules based on the credential acquisition request of the business initiator.

[0077] In some embodiments, the target voucher template includes attribute information; the attribute description is used to describe the characteristics of each attribute in the target voucher template; the voucher generation rules include: valid attributes are filled in according to the access attributes of the business participants, and invalid attributes are filled in according to preset filling rules.

[0078] Specifically, if Figure 5 As shown, the target voucher template is fixed and includes at least one attribute. The voucher description is formulated according to business rules, and the attributes defined in the template are described as valid or invalid. For example, the same template has three attributes, name, ID card and mobile phone number. When querying identity information, the name and ID card are used. Then, according to the business, the mobile phone number in this template is an invalid attribute. The type of mobile phone number is digital. When generating a voucher, for example, the mobile phone number in the voucher can be filled with 3 digits in sequence using the public key of the business participant, and the name and ID card attributes are filled in according to normal business data; for invalid attributes of string type, a string can be randomly generated using the snowflake algorithm.

[0079] like Figure 7 As shown, based on Figure 5 The target credential template and attribute description shown in the figure, the specific steps for the service gateway of the business initiator to generate access credentials for each business participant are as follows:

[0080] T1: The federation application server initiates a credential application;

[0081] T2: Obtain the CPT template and template attribute description on the service gateway chain;

[0082] T3: Generate a credential based on the obtained template and instructions, and fill in the credential content according to the following rules: valid attributes are filled in according to the business transmission message and business rules; invalid attributes of string type are randomly generated using the snowflake algorithm; invalid attributes of numeric type are sequentially truncated by 3 digits using the public key;

[0083] T4: On-chain endorsement certificate hash;

[0084] T5: The credentials are returned to the alliance party's application server for safekeeping, or hosted and stored on the service gateway.

[0085] Figure 8 This is a flowchart of a data access method based on blockchain provided by an embodiment of the present application. Figure 8 As shown, the embodiment of the present application provides a data access method based on blockchain, including:

[0086] S201. Based on a data access request for a target business scenario sent by a second device, decrypt encrypted data for the target business scenario obtained from the blockchain network using an access credential obtained from a service gateway of the business initiator to obtain target data, wherein the access credential is generated by the service gateway of the business initiator according to a data access control policy for the business scenario sent by the business initiator and access attributes of business participants, and the encrypted data for the business scenario is obtained by encrypting valid data for the business scenario by a bookkeeping node in the blockchain network according to the data access control policy;

[0087] In step S201, the business participant initiates the data access request through the application server (second device). Based on the request, its service gateway retrieves data encrypted from the blockchain using the CP-ABE algorithm in accordance with the access control policy provided by the business initiator for the business scenario. The service gateway then decrypts the encrypted data retrieved from the blockchain using the access credentials obtained from the business initiator's service gateway to obtain the target data. It is understood that only data to which the business participant has access rights can be successfully decrypted using the access credentials to obtain the target data.

[0088] S202: Send the target data to the second device.

[0089] In step S202, the business participant service gateway decrypts the accessible data and returns it to the participant's application server. The participant's application server receives the decrypted data, completing the entire business process.

[0090] The data access method based on blockchain provided in the embodiment of the present application is

[0091] On-chain data is encrypted once using the access control policy customized by the business initiator. A unified attribute template (target credential template) related to the access control policy is registered. Access credentials are issued according to this template, and business participants use these credentials to access data to which they have access rights. This decentralized nature of digital identity solves the efficiency and security issues of centralized key distribution by CAs.

[0092] like Figure 9 As shown, in some embodiments, according to the data access request for the target business scenario sent by the second device, the encrypted data for the target business scenario obtained from the blockchain network is decrypted using the access credentials obtained from the service gateway of the business initiator to obtain the target data, including:

[0093] S2011. According to the data access request for the target business scenario sent by the second device, obtain a target voucher template for the target business scenario and an attribute description of the target voucher template from the blockchain network;

[0094] S2012. Generate an original credential corresponding to the access credential based on the access credential obtained from the service gateway of the service initiator, the target credential template, the attribute description of the target credential template, and the credential generation rule;

[0095] S2013. Use the original certificate to decrypt the encrypted data in the target business scenario obtained from the blockchain network to obtain the target data.

[0096] Specifically, the service gateway of the business participant obtains the CPT template and template attribute description from the chain, and then restores the original certificate based on the access credentials, CPT template, template attribute description and certificate generation rules obtained from the service gateway of the business initiator.

[0097] Based on the request, the service gateway of the participant obtains the data encrypted by the access control policy based on the CP-ABE algorithm from the chain, and then uses the original certificate to decrypt the accessible data and return it to the application server of the participant.

[0098] like Figure 10 As shown, in some embodiments, generating the original credential corresponding to the access credential based on the access credential obtained from the service gateway of the service initiator, the target credential template, the attribute description of the target credential template, and the credential generation rule includes:

[0099] S20121. Verify the validity of the access credential obtained from the service gateway of the service initiator using the target credential template;

[0100] S20122. If the access credential is valid, generate an original credential corresponding to the access credential based on the access credential, the target credential template, the attribute description of the target credential template, and a credential generation rule.

[0101] Specifically, before generating the original credential corresponding to the access credential based on the access credential, the target credential template, the attribute description of the target credential template, and the credential generation rules, the service gateway of the business participant also verifies the validity of the access credential obtained from the service gateway of the business initiator using the target credential template obtained from the blockchain network. This means verifying the validity and non-tampering of the credential issued by the service gateway of the business initiator. Specifically, by obtaining the endorsed CPT template, template attribute description, and credential hash on the chain, the consistency of the access credential with the CPT template, the consistency of the template value with the template attribute description, and the consistency of the credential hash are verified. After verification is successful, step S20122 is executed.

[0102] The access credential issuance and access method provided in the embodiments of this application, combined with the CP-ABE algorithm and digital identity, solves the problem that access control permissions for on-chain data and the access control policy of the CP-ABE algorithm are easily cracked. The specific effects are:

[0103] 1. The decentralized nature of digital identity solves the security issues of centralized key distribution by CAs. In addition, the mutual authentication mechanism between digital identity agents can also ensure the identity security of the authority that distributes the key.

[0104] 2. Combining digital identity and the CP-ABE algorithm to solve the problem of customized permission control of on-chain data, the lead business party can write access control policies based on different business scenarios within the same channel, write the policies into ciphertext, and write the decryptable attributes into the digital identity certificate;

[0105] 3. The digital identity credential template solves the problem of CP-ABE writing attributes into the key, which is easily cracked by brute force. The credential template is designated by an authoritative organization and endorsed on the chain to ensure that the template cannot be tampered with. At the same time, the credential adds obfuscation measures to prevent the risk of the attributes required for on-chain ciphertext decryption being cracked after the credential is stolen.

[0106] Figure 11 This is a schematic diagram of the structure of an access credential issuance device provided by an embodiment of the present application. Figure 11 As shown, an access credential issuance device proposed in an embodiment of the present application includes:

[0107] A first generating module 31 is configured to generate a target credential template corresponding to the data access control policy for the target business scenario according to the data access control policy sent by the first device;

[0108] a first sending module 32 configured to send the service request and the data access control policy to a blockchain network based on the service request sent by the first device, wherein the consensus node in the blockchain network is configured to endorse the smart contract based on the service request, and the accounting node in the blockchain network is configured to encrypt and store valid data generated by the smart contract based on the data access control policy;

[0109] a second generating module 33 configured to generate, based on the credential acquisition request for the target business scenario sent by the first device, an access credential for the business participant using the target credential template, the credential generation rule, and the access attributes of each business participant, wherein the credential acquisition request includes the access attributes of at least one business participant;

[0110] The second sending module 34 is configured to send the access credentials of each business participant to the service gateway of the business participant.

[0111] The access credential issuance device provided in the embodiments of the present application encrypts on-chain data using a one-time access control policy customized for the business application, registers a unified attribute template related to the access control policy (target credential template), and issues access credentials according to this template. This not only implements access control for on-chain data, but also solves the problem of CP-ABE algorithm-based writing attributes into private keys, which can be easily brute-forced to obtain access control policies after they are stolen.

[0112] In some embodiments, the apparatus further comprises:

[0113] The third sending module is used to send the target voucher template and the attribute description of the target voucher template to the blockchain network for on-chain endorsement.

[0114] In some embodiments, the first generating module is specifically configured to:

[0115] Generate an original voucher template corresponding to the data access control policy for the target business scenario sent by the first device;

[0116] The original voucher template is modified according to a preset template modification strategy to obtain a target voucher template.

[0117] In some embodiments, the second generating module is specifically configured to:

[0118] Obtaining the target credential template and the attribute description from the blockchain network according to the credential acquisition request for the target business scenario sent by the first device, wherein the credential acquisition request includes access attributes of at least one business participant;

[0119] An access credential of the business participant is generated according to the target credential template, the attribute description, the credential generation rule and the access attribute of each business participant.

[0120] In some embodiments, the target voucher template includes attribute information; the attribute description is used to describe the characteristics of each attribute in the target voucher template; and the voucher generation rule includes:

[0121] Valid attributes are filled according to the access attributes of the business participants, and invalid attributes are filled according to the preset filling rules.

[0122] The embodiment of the device provided in the embodiment of the present application can be specifically used to execute the processing flow of the above-mentioned access credential issuance method embodiment. Its functions will not be repeated here, and reference can be made to the detailed description of the above-mentioned method embodiment.

[0123] Figure 12 This is a schematic diagram of the structure of a data access device based on blockchain provided by an embodiment of the present application. Figure 12 As shown, a data access device based on blockchain proposed in an embodiment of the present application includes:

[0124] A decryption module 41 is configured to decrypt the encrypted data for the target business scenario obtained from the blockchain network using the access credentials obtained from the service gateway of the business initiator according to the data access request for the target business scenario sent by the second device, thereby obtaining the target data. The access credentials are generated by the service gateway of the business initiator according to the data access control policy for the business scenario sent by the business initiator and the access attributes of the business participants. The encrypted data for the business scenario is obtained by encrypting the valid data for the business scenario by the accounting node in the blockchain network according to the data access control policy.

[0125] The sending module 42 sends the target data to the second device.

[0126] The blockchain-based data access device provided in this application embodiment encrypts on-chain data using a one-time access control policy customized for the business application, registers a unified attribute template (target credential template) related to the access control policy, and issues access credentials based on this template. This not only implements access control for on-chain data, but also solves the problem of CP-ABE algorithm-based access control policy access control policy easily accessible through brute force after the private key is stolen.

[0127] In some embodiments, the decryption module is specifically configured to:

[0128] Obtaining, from the blockchain network, a target voucher template for the target business scenario and an attribute description of the target voucher template according to a data access request for the target business scenario sent by the second device;

[0129] Generate an original credential corresponding to the access credential based on the access credential obtained from the service gateway of the business initiator, the target credential template, the attribute description of the target credential template, and the credential generation rule;

[0130] The encrypted data for the target business scenario obtained from the blockchain network is decrypted using the original certificate to obtain the target data.

[0131] In some embodiments, the decryption module generates the original credential corresponding to the access credential based on the access credential obtained from the service gateway of the service initiator, the target credential template, the attribute description of the target credential template, and the credential generation rule, including:

[0132] Verifying the validity of the access credential obtained from the service gateway of the service initiator using the target credential template;

[0133] If the access credential is valid, an original credential corresponding to the access credential is generated according to the access credential, the target credential template, the attribute description of the target credential template, and a credential generation rule.

[0134] The embodiments of the apparatus provided in the embodiments of the present application can be specifically used to execute the processing flow of the above-mentioned blockchain-based data access method embodiments. Its functions are not described in detail here, and reference can be made to the detailed description of the above-mentioned method embodiments.

[0135] It should be noted that the access credential issuance method, blockchain-based data access method and device provided in the embodiments of the present application can be used in the financial field, and can also be used in any technical field other than the financial field. The embodiments of the present application do not limit the application fields of the access credential issuance method, blockchain-based data access method and device.

[0136] Figure 13 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 13 As shown, the electronic device may include: a processor 501, a communication interface 502, a memory 503, and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other via the communication bus 504. The processor 501 may call the logic instructions in the memory 503 to execute the method described in any of the above embodiments.

[0137] In addition, the logic instructions in the above-mentioned memory 503 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0138] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments.

[0139] This embodiment provides a computer-readable storage medium, which stores a computer program. The computer program enables the computer to execute the methods provided by the above method embodiments.

[0140] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0141] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0144] In the description of this specification, reference to the terms "one embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any appropriate manner in any one or more embodiments or examples.

[0145] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for issuing an access credential, characterized in that: include: generating, according to the data access control policy for the target business scenario sent by the first device, a target credential template corresponding to the data access control policy; According to the service request sent by the first device, the service request and the data access control policy are sent to the blockchain network, wherein the consensus node in the blockchain network is used to endorse the smart contract according to the service request, and the accounting node in the blockchain network is used to encrypt and store the valid data generated by the smart contract according to the data access control policy; generating, according to the credential acquisition request for the target business scenario sent by the first device, an access credential for the business participant using the target credential template, the credential generation rule, and the access attributes of each business participant, wherein the credential acquisition request includes the access attributes of at least one business participant; The access credentials of each business participant are sent to the service gateway of the business participant.

2. The method according to claim 1, characterized in that The method further comprises: The target voucher template and the attribute description of the target voucher template are sent to the blockchain network for on-chain endorsement.

3. The method according to claim 2, characterized in that The generating, according to the data access control policy for the target business scenario sent by the first device, a target credential template corresponding to the data access control policy includes: Generate an original voucher template corresponding to the data access control policy for the target business scenario sent by the first device; The original voucher template is modified according to a preset template modification strategy to obtain a target voucher template.

4. The method according to claim 3, characterized in that The step of generating, according to the credential acquisition request for the target business scenario sent by the first device, an access credential for each business participant by using the target credential template, credential generation rules, and access attributes of each business participant, includes: Obtaining the target credential template and the attribute description from the blockchain network according to the credential acquisition request for the target business scenario sent by the first device, wherein the credential acquisition request includes access attributes of at least one business participant; An access credential of the business participant is generated according to the target credential template, the attribute description, the credential generation rule and the access attribute of each business participant.

5. The method according to claim 4, characterized in that The target voucher template includes attribute information; the attribute description is used to describe the characteristics of each attribute in the target voucher template; the voucher generation rule includes: Valid attributes are filled according to the access attributes of the business participants, and invalid attributes are filled according to the preset filling rules.

6. A data access method based on blockchain, characterized in that: include: According to the data access request for the target business scenario sent by the second device, the encrypted data for the target business scenario obtained from the blockchain network is decrypted using the access credential obtained from the service gateway of the business initiator to obtain the target data, wherein the access credential is generated by the service gateway of the business initiator according to the data access control policy for the business scenario sent by the business initiator and the access attributes of the business participants, and the encrypted data for the business scenario is obtained by encrypting the valid data for the business scenario by the accounting node in the blockchain network according to the data access control policy; The target data is sent to the second device.

7. The method according to claim 6, characterized in that The method of decrypting the encrypted data for the target business scenario obtained from the blockchain network using the access credentials obtained from the service gateway of the business initiator according to the data access request for the target business scenario sent by the second device to obtain the target data includes: Obtaining, from the blockchain network, a target voucher template for the target business scenario and an attribute description of the target voucher template according to a data access request for the target business scenario sent by the second device; Generate an original credential corresponding to the access credential based on the access credential obtained from the service gateway of the business initiator, the target credential template, the attribute description of the target credential template, and the credential generation rule; The encrypted data for the target business scenario obtained from the blockchain network is decrypted using the original certificate to obtain the target data.

8. The method according to claim 7, characterized in that Generating the original credential corresponding to the access credential based on the access credential obtained from the service gateway of the service initiator, the target credential template, the attribute description of the target credential template, and the credential generation rule includes: Verifying the validity of the access credential obtained from the service gateway of the service initiator using the target credential template; If the access credential is valid, an original credential corresponding to the access credential is generated according to the access credential, the target credential template, the attribute description of the target credential template, and a credential generation rule.

9. A device for issuing access credentials, characterized in that: include: A first generating module, configured to generate a target credential template corresponding to the data access control policy for the target business scenario according to the data access control policy sent by the first device; a first sending module, configured to send the service request and the data access control policy to a blockchain network based on the service request sent by the first device, wherein a consensus node in the blockchain network is configured to endorse a smart contract based on the service request, and a bookkeeping node in the blockchain network is configured to encrypt and store valid data generated by the smart contract based on the data access control policy; a second generating module, configured to generate, based on the credential acquisition request for the target business scenario sent by the first device, an access credential for the business participant using the target credential template, the credential generation rule, and the access attributes of each business participant, wherein the credential acquisition request includes the access attributes of at least one business participant; The second sending module is used to send the access credential of each business participant to the service gateway of the business participant.

10. A data access device based on blockchain, characterized in that: include: a decryption module for decrypting, based on a data access request for a target business scenario sent by a second device, encrypted data for the target business scenario obtained from the blockchain network using an access credential obtained from the service gateway of the business initiator, to obtain target data, wherein the access credential is generated by the service gateway of the business initiator based on the data access control policy for the business scenario sent by the business initiator and the access attributes of the business participants, and the encrypted data for the business scenario is obtained by encrypting valid data for the business scenario by a bookkeeping node in the blockchain network according to the data access control policy; A sending module is used to send the target data to the second device.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 or 6 to 8 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 or 6 to 8 are implemented.

Images