Business privacy data transmission method and device, computer device and storage medium

Abstract

The application provides a business privacy data transmission method and device, computer equipment and a storage medium, which are applied to an enterprise node device on a business blockchain, and the business blockchain further includes an agency node device. The method comprises the following steps: obtaining data ciphertext of business privacy data; uploading the data ciphertext to the business blockchain for on-chain storage; uploading pre-stored identity information to an identity chain for data access verification after the agency node device analyzes the data ciphertext, and obtaining a verification result fed back by the identity chain; if the verification result is verified, generating key ciphertext of the business privacy data; uploading the key ciphertext to the business blockchain for on-chain storage, so that the agency node device decrypts the data ciphertext according to the key ciphertext and obtains the business privacy data. By using the method, the transmission security of the business privacy data can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, specifically to a method, apparatus, computer device, and storage medium for transmitting business privacy data. Background Technology

[0002] Blockchain networks are becoming an engine for technological and business model innovation, leading a new round of global technological and industrial transformation. With the rapid development of blockchain technology, it has been widely applied in various fields such as government affairs, healthcare, finance, and supply chain management to address trust issues between and within enterprises. For example, to alleviate the difficulties and high costs of financing for SMEs, core enterprises can digitize accounts receivable and use them as credit certificates to be split and circulated within the supply chain. This allows SMEs to access financing and loans from financial institutions using these credit certificates. To ensure data authenticity, the splitting, circulation, and financing lifecycle of these credit certificates are typically implemented on the blockchain.

[0003] However, the splitting of credit instruments involves sensitive data such as invoices and contracts, which can easily lead to privacy leaks. Therefore, protecting the privacy of sensitive data during the financing process has become a focus of attention in this field. While data encryption technology is mature, employing internationally recognized encryption algorithms such as 3DES, AES, and RSA, using these algorithms in financial scenarios may introduce backdoors, hindering regulation and independent control.

[0004] Therefore, existing methods for transmitting business privacy data have technical problems due to low security. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, computer device, and storage medium for transmitting business privacy data, so as to improve the security of business privacy data transmission.

[0006] Firstly, this application provides a method for transmitting business privacy data, applied to enterprise node devices on a business blockchain, which also includes institutional node devices. The method includes:

[0007] Encrypted data obtained from business privacy data;

[0008] The encrypted data is uploaded to the business blockchain for on-chain storage. After the institution's node devices parse the encrypted data, the pre-stored identity information is uploaded to the identity chain for data access verification, and the verification result is returned by the identity chain.

[0009] If the verification result is successful, then the key ciphertext of the business privacy data is generated;

[0010] The encrypted key is uploaded to the business blockchain for on-chain storage, so that the institution's node devices can decrypt the encrypted data based on the encrypted key to obtain the business privacy data.

[0011] In some embodiments of this application, obtaining the encrypted data of business privacy data includes: determining the data attributes of the business privacy data to be transmitted; determining the target key plaintext in a preset key mapping table based on the data attributes to obtain a target key identifier; the key mapping table contains at least one pair of key plaintext and key identifier that have a mapping relationship; determining the target access condition in a preset rule mapping table based on the data attributes to obtain a target condition identifier; the rule mapping table contains at least one pair of access conditions and condition identifiers that have a mapping relationship; and encrypting the business privacy data based on the target key identifier and the target condition identifier to obtain the encrypted data of the business privacy data.

[0012] In some embodiments of this application, before obtaining the encrypted data of business privacy data, the method further includes: generating plaintext keys based on a preset national cryptographic algorithm, and assigning key identifiers to each plaintext key to form a key mapping table stored in the enterprise's local database; generating access conditions according to data attributes, and assigning condition identifiers to each access condition to form a rule mapping table stored in the business blockchain; wherein, the data attributes include at least one of financial attributes, audit attributes, and supply chain attributes.

[0013] In some embodiments of this application, the encrypted data includes a target key identifier. If the verification result is successful, the encrypted key of the business privacy data is generated, including: if the verification result is successful, querying and obtaining the plaintext of the target key in the enterprise's local database according to the target key identifier; obtaining the public key information pre-stored in the institutional node device in the business blockchain; and encrypting the plaintext of the target key according to the public key information to generate the encrypted key.

[0014] Secondly, this application provides a method for transmitting business privacy data, applied to institutional node devices on a business blockchain, which also includes enterprise node devices. The method includes:

[0015] Retrieve business data from the business blockchain;

[0016] If the business data contains encrypted data of business privacy data uploaded by enterprise node devices, then the encrypted data is parsed to determine the target access conditions for the business privacy data.

[0017] Based on the target access conditions, the pre-stored identity information is uploaded to the identity chain for data access verification in order to obtain the verification result fed back by the identity chain.

[0018] If the verification result is successful, the key ciphertext uploaded by the institution node device is obtained, and the data ciphertext is decrypted according to the key ciphertext to obtain the business privacy data.

[0019] In some embodiments of this application, if the verification result is successful, the key ciphertext uploaded by the institutional node device is obtained, and the data ciphertext is decrypted according to the key ciphertext to obtain business privacy data. This includes: if the verification result is successful, obtaining the key ciphertext uploaded by the institutional node device; decrypting the key ciphertext based on the private key information pre-stored in the institutional local database to obtain the target key plaintext; and decrypting the data ciphertext according to the target key plaintext to obtain the business privacy data.

[0020] Thirdly, this application provides a business privacy data transmission device, comprising an enterprise node device set on a business blockchain, and an institutional node device on the business blockchain. The device includes:

[0021] The ciphertext acquisition module is used to acquire the ciphertext of business privacy data;

[0022] The encrypted data upload module is used to upload encrypted data to the business blockchain for on-chain storage. After the institution's node devices parse the encrypted data, they upload the pre-stored identity information to the identity chain for data access verification and obtain the verification result fed back by the identity chain.

[0023] The key generation module is used to generate the key ciphertext for business privacy data if the verification result is successful.

[0024] The key-on-chain module is used to upload the key ciphertext to the business blockchain for on-chain storage, so that the institutional node devices can decrypt the data ciphertext according to the key ciphertext to obtain the business privacy data.

[0025] Fourthly, this application provides a business privacy data transmission device, comprising an institutional node device set on a business blockchain, and an enterprise node device also being provided on the business blockchain. The device includes:

[0026] The data acquisition module is used to acquire business data from the business blockchain;

[0027] The ciphertext parsing module is used to parse the ciphertext of business privacy data uploaded by enterprise node devices if the business data contains ciphertext of the data. This allows the determination of the target access conditions for the business privacy data.

[0028] The access verification module is used to upload the pre-stored identity information to the identity chain for data access verification based on the target access conditions, so as to obtain the verification result fed back by the identity chain.

[0029] The privacy acquisition module is used to acquire the key ciphertext uploaded by the institution node device if the verification result is successful, and to decrypt the data ciphertext according to the key ciphertext to obtain the business privacy data.

[0030] Fifthly, this application also provides a computer device, comprising:

[0031] One or more processors;

[0032] The memory; and one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by a processor to implement the business privacy data transmission method of the first or second aspect described above.

[0033] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, the computer program being loaded by a processor to perform the steps in the business privacy data transmission method.

[0034] In a seventh aspect, embodiments of this application provide a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the first or second aspect described above.

[0035] The aforementioned method, apparatus, computer equipment, and storage medium for transmitting business privacy data allow enterprise node devices to acquire encrypted business privacy data and upload it to the business blockchain for on-chain storage. After parsing the encrypted data, institutional node devices upload pre-stored identity information to the identity chain for data access verification. Upon receiving a verification result from the identity chain, and if the verification is successful, a key ciphertext for the business privacy data is generated and uploaded to the business blockchain for on-chain storage. Institutional node devices can then decrypt the encrypted data using the key ciphertext to obtain the business privacy data. Because this application proposes using blockchain technology to achieve encrypted transmission of business privacy data, it effectively improves data transmission security. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1This is a schematic diagram illustrating a scenario of the business privacy data transmission method in this application embodiment;

[0038] Figure 2 This is a flowchart illustrating the business privacy data transmission method in the embodiments of this application. Figure 1 ;

[0039] Figure 3 This is a flowchart illustrating the data on-chain process of the business privacy data transmission method in this application embodiment;

[0040] Figure 4 This is a flowchart illustrating the business privacy data transmission method in the embodiments of this application. Figure 2 ;

[0041] Figure 5 The data viewing process of the business privacy data transmission method in this application embodiment Figure 1 ;

[0042] Figure 6 This is the data viewing process of the business privacy data transmission method in the embodiments of this application. Figure 2 ;

[0043] Figure 7 This is a schematic diagram of the structure of the business privacy data transmission device in the embodiments of this application. Figure 1 ;

[0044] Figure 8 This is a schematic diagram of the structure of the business privacy data transmission device in the embodiments of this application. Figure 2 ;

[0045] Figure 9 This is a schematic diagram of the structure of the computer device in the embodiments of this application. Detailed Implementation

[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0048] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0049] This application provides a method, apparatus, computer device, and storage medium for transmitting business privacy data, which will be described in detail below.

[0050] See Figure 1 , Figure 1 This is a schematic diagram illustrating a scenario for the business privacy data transmission method provided in this application embodiment. This method can be applied to a business privacy data transmission system, which includes: an identity chain, at least one business blockchain, and at least two node devices. The identity chain is used for identity authentication and permission verification between the node devices. The business blockchain, as a consortium blockchain, allows information sharing among the node devices. The node devices are terminals and / or servers in various business domains. It should be noted that if at least two business blockchains exist, cross-chain operations can be achieved between them.

[0051] For example, in financial scenarios, Figure 1 The node device 102 shown is a terminal and / or server for micro and small enterprises, node device 104 is a terminal and / or server for financial institutions, and node device 106 is a terminal and / or server for regulatory agencies. In this configuration, the business privacy data transmission system is suitable for processing business transactions between micro and small enterprises and financial institutions, while the regulatory agency can use it to monitor whether there are any irregularities in the process of these transactions.

[0052] It should be noted that the embodiments described below will use financial scenarios as examples to illustrate the working mechanism of the business privacy data transmission system. However, the embodiments of this application are not limited to financial scenarios. The business privacy data transmission system can also be applied to other scenarios, such as audit scenarios, supply chain scenarios, etc. The specific application scenarios are not limited in this application.

[0053] More specifically, the terminals mentioned above can be desktop terminals or mobile terminals, and can also be one of mobile phones, tablets, or laptops. Servers can be independent servers or server networks or server clusters integrated into a central server, including but not limited to computers, network hosts, single network servers, multiple network server sets, or cloud servers composed of multiple servers. Cloud servers consist of a large number of computers or network servers based on cloud computing; networks include, but are not limited to, wide area networks (WANs), metropolitan area networks (MANs), or local area networks (LANs).

[0054] It should be noted that those skilled in the art should understand that Figure 1 The application scenarios shown are merely one applicable scenario for the solution in this application and do not constitute a limitation on the application scenarios of the solution in this application. Other application environments may include more than one. Figure 1 The illustration shows more or fewer computer devices. As will be apparent to those skilled in the art, with the evolution of business privacy data transmission systems and the emergence of new business scenarios, the technical solutions provided in these embodiments are also applicable to similar technical problems.

[0055] See Figure 2 This application provides a method for transmitting business privacy data, and the following will mainly focus on applying this method to the above-mentioned... Figure 1 Let's take node device 102 as an example. Thus, when node device 102 is an enterprise node device in a financial scenario, and node device 104 is an institutional node device, the method includes steps S201 to S204, as follows:

[0056] S201, Obtain encrypted data containing business privacy information.

[0057] The business privacy data can be sensitive data from various business areas, especially the sensitive data of a specific enterprise as illustrated in this application embodiment. For example, business privacy data could be sensitive data such as invoices and contracts in the financial sector. Invoices primarily include: the buyer's and seller's unified social credit codes, invoice code, invoice number, invoice type, invoice amount, invoice date, and the last six digits of the verification code; and the original invoice document data. Contracts primarily include: the identity information of the contract participants, contract amount, type, and other fields; and the original contract document data.

[0058] In practice, there is a scenario where micro and small enterprises (MSEs) can apply for loans from financial institutions by uploading credit certificates. These credit certificates constitute the business privacy data throughout the loan process. To enhance the security of this data transmission, the enterprise node device 102, designed for MSEs, can first obtain the encrypted data of the business privacy data to be transmitted. This encrypted data is then uploaded to the business blockchain, enabling the transmission of business privacy data based on the encrypted data. Because this encrypted data is available for sharing and viewing by various node devices after being uploaded to the business blockchain, the actual content of the business privacy data cannot be accurately obtained without a valid key capable of decrypting it.

[0059] Specifically, this application proposes to first construct a key that meets business requirements, and then use the key to encrypt business privacy data. However, it should be noted that international algorithms have drawbacks that are not conducive to supervision and control, i.e., they cannot ensure the security of data transmission. Therefore, this application proposes to prioritize the use of national cryptographic algorithms for data encryption. In addition, simply using key encryption can only initially improve the security of data transmission. Therefore, this application also proposes an identity verification mechanism. However, this mechanism requires the construction of access conditions that meet business requirements to achieve identity verification for data access objects. The key construction steps, access condition construction steps, and various judgment steps involved in this embodiment will be described in detail below.

[0060] It is understandable that, such as Figure 1 As shown, enterprise node devices and institutional node devices can both be blockchain nodes on the same business blockchain, or they can belong to different business blockchains. However, when they belong to different business blockchains, they can operate across chains. That is, this application embodiment does not limit the device differences between enterprise node devices and institutional node devices, but rather limits the role differences between the two devices. In other words, both enterprise node devices and institutional node devices can select terminals, servers, server clusters, etc., according to actual business needs. However, enterprise node devices should be devices set to be managed by the enterprise, while institutional node devices should be devices set to be managed by the institution. Since enterprises inevitably have some business operations that need to be reviewed or witnessed by institutions during operation, the business privacy data transmission method proposed in this application embodiment can be applied to this business scenario to achieve highly secure data transmission.

[0061] In one embodiment, prior to this step, the method further includes: generating plaintext keys based on a preset national cryptographic algorithm, and assigning key identifiers to each plaintext key to form a key mapping table stored in the enterprise's local database; generating access conditions based on data attributes, and assigning condition identifiers to each access condition to form a rule mapping table stored in the business blockchain; wherein the data attributes include at least one of financial attributes, audit attributes, and supply chain attributes.

[0062] Among them, the national cryptographic algorithms include, but are not limited to, domestic encryption algorithms such as SM4, SM1, SM2, and SM3. In this embodiment, the SM4 algorithm will be used as an example. The SM4 algorithm can generate at least one key plaintext.

[0063] Here, "key plaintext" can be understood as a plaintext password, that is, a password transmitted or stored in plaintext. Specifically, it means that when storing or transmitting a password over a network, plaintext characters are used and are directly displayed, rather than encrypted ciphertext. For example, if the password itself is "123", then the plaintext password will directly display the content "123". Similarly, if the key itself is "123", then the key text will directly display the content "123".

[0064] The key identifier is a character used to mark the globally uniqueness of the plaintext key. For example, if the plaintext key is "123", the key identifier is "a1". It is understood that both the plaintext key and the key identifier can have their character structures set according to actual business needs. This application embodiment does not impose specific limitations, but uniformly represents the plaintext key as "key_value_n" and the key identifier as "key_n". Thus, each plaintext key has its corresponding key identifier, and the two are related, represented as "key_n: key_value_n". Here, "n" can be a natural number including "0" or any natural number other than "0". Regardless of the value, it does not affect the implementation of the method proposed in this application.

[0065] Among them, access conditions are attribute requirements imposed on the identity of the data access object. For example, access condition A is "financial institutions can view", access condition B is "regulatory institutions can view", and more specifically, access condition a1 is "financial institution a can view", access condition a2 is "financial institution b can view", and so on.

[0066] The condition identifier is a character used to mark the globally uniqueness of an access condition. For example, if the access condition is "financial institutions can view", the condition identifier is "b1". It is understood that both the access condition and the condition identifier can have their character structures set according to actual business needs. This application embodiment does not impose specific limitations, but uniformly represents the access condition as "rule_value_n" and the condition identifier as "rule_n". Each access condition has its corresponding condition identifier, and the two are related, represented as "rule_n: rule_value_n". The "n" can be a natural number including "0" or any natural number other than "0". Regardless of its value, it does not affect the implementation of the method proposed in this application.

[0067] In specific implementation, before obtaining the encrypted data of business privacy data, the enterprise node device 102 can first construct plaintext keys and access conditions that meet the business requirements, that is, obtain one or more plaintext keys and one or more access conditions. Multiple plaintext keys constitute a set of plaintext keys, represented as "key_value_1", "key_value_2", etc. Multiple access conditions constitute a set of access conditions, represented as "rule_value_1", "rule_value_2", etc.

[0068] Specifically, the method of obtaining the plaintext key can be based on the national cryptographic algorithm mentioned above, but the method of obtaining the access conditions needs to refer to the data attributes of various business privacy data. That is, the access conditions corresponding to different data attributes should be set according to the actual business scenario. For example, the access condition for the data attribute "invoice" is "financial institution A can view it", and the access condition for the data attribute "contract" is "financial institution B can view it".

[0069] Furthermore, after obtaining the plaintext key and access conditions, enterprise node device 102 can obtain the key identifier and condition identifier respectively, and synchronously or asynchronously process them to obtain the key mapping table: keys = {"key_1":"key_value_1","key_2":"key_value_2",……,"key_n":"key_value_n"}, and the rule mapping table: rules = {"rule_1":"rule_value_1","rule_2":"rule_value_2",…,"rule_n":"rule_value_n"}. The key mapping table "keys" can be stored locally on enterprise node device 102, that is, stored in the enterprise's local database as a private key to obtain encrypted data. This local database can be a MySQL database or another. The rule mapping table "rules" can be stored in the business blockchain, that is, the rule mapping table "rules" is processed on the blockchain so that all node devices on the business blockchain can view it.

[0070] In one embodiment, this step includes: determining the data attributes of the business privacy data to be transmitted; determining the target key plaintext in a preset key mapping table based on the data attributes to obtain a target key identifier; the key mapping table contains at least one pair of key plaintext and key identifiers that have a mapping relationship; determining the target access condition in a preset rule mapping table based on the data attributes to obtain a target condition identifier; the rule mapping table contains at least one pair of access conditions and condition identifiers that have a mapping relationship; and encrypting the business privacy data based on the target key identifier and the target condition identifier to obtain the ciphertext of the business privacy data.

[0071] The data type can be determined by the business scenario or by business needs. For example, if determined by the business scenario, data attributes include financial attributes, regulatory attributes, etc.; if determined by business needs, data attributes include subdivided financial attributes such as fund attributes and stock attributes, mainly depending on business needs.

[0072] In specific implementation, the above embodiments have detailed that before obtaining the encrypted data of business privacy data, the enterprise node device 102 can first construct the plaintext key and access conditions that meet the business requirements, obtain the key mapping table and rule mapping table, determine the target plaintext key and target access conditions for the data attributes of the business privacy data to be transmitted, and sequentially obtain the target key identifier and target condition identifier in the key mapping table, and then encrypt the business privacy data to obtain the encrypted data.

[0073] For example, if the data attribute of the business privacy data to be transmitted is "financial attribute", then in the key mapping table, "key_1: key_value_1" corresponds to the financial attribute, and "key_2: key_value_2" corresponds to the regulatory attribute. Therefore, the plaintext of the target key is "key_value_1", and the target key identifier is "key_1". Similarly, in the rule mapping table, "rule_1: rule_value_1" corresponds to the financial attribute, and "rule_2: rule_value_2" corresponds to the regulatory attribute. Therefore, the target access condition is "rule_value_1", and the target condition identifier is "rule_1". The final encrypted data representation is: {"key":"key_1","rule":"rule_1","cipher_data":"cipher_value_1"}, where "cipher_value_1" represents the encrypted business privacy data.

[0074] S202, the encrypted data is uploaded to the business blockchain for on-chain storage, so that the institutional node devices can parse the encrypted data and then upload the pre-stored identity information to the identity chain for data access verification, and obtain the verification result fed back by the identity chain.

[0075] The identity information can be pre-stored information that meets the access conditions, used to prove the identity of the institution currently corresponding to the institution node device 104.

[0076] For specific implementation details, please refer to [link / reference]. Figure 3 After obtaining the encrypted data, the enterprise node device 102 can upload it to the business blockchain for on-chain storage. Afterwards, the enterprise node device 102 can wait for message feedback, which refers to the verification result fed back by the identity chain. The verification result is the comparison result between the access conditions contained in the encrypted data and the identity information uploaded by the institutional node device 104. The verification result includes two results: verification passed and verification failed.

[0077] Specifically, after enterprise node device 102 uploads encrypted data to the blockchain, enabling institutional node device 104 to view the encrypted data recorded in the business blockchain, institutional node device 104 can parse the encrypted data to analyze the access conditions contained therein. In response, it can upload its pre-stored identity information to the identity chain, prompting the identity chain to analyze and verify whether the identity information matches the certificate retained by institutional node device 104 when it previously applied to join the identity chain. The identity chain then outputs a verification result, which both enterprise node device 102 and institutional node device 104, as nodes in the identity chain, can view and execute subsequent steps based on the verification result. The encrypted data parsing and data access verification steps involved in this embodiment are not performed by enterprise node device 102, and will therefore be described in detail below.

[0078] S203. If the verification result is successful, then generate the key ciphertext for the business privacy data.

[0079] In the specific implementation, enterprise node device 102, acting as both a business blockchain node and an identity chain node, can view the data recorded on the business blockchain and the identity chain in real time, including the verification results given after the identity chain verifies data access. If enterprise node device 102 receives a verification result indicating successful verification, it can then execute subsequent steps, including key ciphertext generation.

[0080] In one embodiment, the encrypted data includes a target key identifier. This step includes: if the verification result is successful, querying the enterprise's local database to obtain the plaintext of the target key based on the target key identifier; obtaining the public key information pre-stored in the institutional node device in the business blockchain; and encrypting the plaintext of the target key based on the public key information to generate the encrypted key.

[0081] Among them, the public key information refers to the key information left by the institutional node device 104 when applying to join the business blockchain. The public key and the private key constitute a key pair. The public key information is left in the business blockchain for data encryption, while the private key is left locally for data decryption. This achieves "one key for one lock", successfully reading the encrypted business privacy data and avoiding the leakage of sensitive data due to unimpeded access by other node devices.

[0082] In the specific implementation, since the key mapping table is pre-stored locally, it can still be successfully invoked after the encrypted data is obtained. After the enterprise node device 102 receives the verification result from the identity chain and finds that the verification is successful, it can parse the target key identifier "key_n" in the verified encrypted data to determine the target key plaintext "key_value_n" that has a mapping relationship with it. Then, it queries the public key information reserved by the institution node device 104 that provided the identity information when applying to join the business blockchain in the previous step, so as to use the public key information to encrypt the target key plaintext "key_value_n" to obtain the key cipher "cipher_key_n".

[0083] S204. The key ciphertext is uploaded to the business blockchain for on-chain storage, so that the institutional node devices can decrypt the data ciphertext according to the key ciphertext to obtain the business privacy data.

[0084] In the specific implementation, after the enterprise node device 102 generates the key ciphertext "cipher_key_n", it can upload it to the blockchain for verification. This allows the institutional node device 104 to use the key ciphertext "cipher_key_n" to decrypt the ciphertext "cipher_value_n" in the data ciphertext {"key":"key_n","rule":"rule_n","cipher_data":"cipher_value_n"}, obtaining the plaintext business privacy data "data_value", ultimately achieving secure data transmission between the enterprise node device and the institutional node device.

[0085] In the above-described method for transmitting business privacy data, enterprise node devices acquire encrypted business privacy data and upload it to the business blockchain for on-chain storage. After parsing the encrypted data, institutional node devices upload pre-stored identity information to the identity chain for data access verification. The identity chain provides a verification result, and if the verification is successful, a key ciphertext for the business privacy data is generated. This key ciphertext is then uploaded to the business blockchain for on-chain storage, allowing institutional node devices to decrypt the encrypted data using the key ciphertext to obtain the business privacy data. Because this application proposes encrypting business privacy data before transmission and incorporates multiple judgment mechanisms, it effectively improves data transmission security.

[0086] See Figure 4 This application also provides another method for transmitting business privacy data, which will be mainly applied to the above-mentioned method below. Figure 1Let's take node device 104 as an example. Thus, when node device 104 is an institutional node device in a financial scenario, and node device 102 is an enterprise node device, the method includes steps S401 to S404, as follows:

[0087] S401, retrieve business data from the business blockchain;

[0088] S402, If the business data contains encrypted data of business privacy data uploaded by enterprise node devices, then parse the encrypted data and determine the target access conditions for the business privacy data.

[0089] S403, based on the target access conditions, upload the pre-stored identity information to the identity chain for data access verification, and obtain the verification result fed back by the identity chain;

[0090] S404. If the verification result is successful, the key ciphertext uploaded by the institutional node device is obtained, and the data ciphertext is decrypted according to the key ciphertext to obtain the business privacy data.

[0091] The business data includes all data information recorded in the business blockchain, including but not limited to business privacy data uploaded by enterprise node device 102.

[0092] In practice, the institutional node device 104 set up by the financial institution can obtain business data in the business blockchain in real time or at regular intervals, thereby analyzing whether the business data contains encrypted data of business privacy data, and thus triggering the parsing of the encrypted data.

[0093] It should be noted that the timed acquisition of business data can be based on the scheduled time of the institution's personnel or on the data transmission request of the enterprise node device 102. For example, once the terminal or server of the financial institution receives the data transmission request sent by the micro and small enterprise, the business data analysis program can be started immediately.

[0094] For details, please refer to Figure 5 If the business data contains encrypted data containing business privacy data uploaded by enterprise node device 102, then organization node device 104 can parse the encrypted data {"key":"key_n","rule":"rule_n","cipher_data":"cipher_value_n"} to obtain the target access condition "rule_n". Then, it analyzes the target access condition "rule_n" to provide matching identity information, which is then uploaded to the identity chain. In this way, the identity chain can verify data access based on this identity information.

[0095] Furthermore, if the verification result is successful, the organization node device 104 can continue to obtain the key ciphertext "cipher_key_n" uploaded by the organization node device 102, so as to decrypt the data ciphertext according to the key ciphertext "cipher_key_n" to obtain the business privacy data.

[0096] In one embodiment, this step includes: if the verification result is successful, obtaining the key ciphertext uploaded by the institution node device; decrypting the key ciphertext based on the private key information pre-stored in the institution's local database to obtain the target key plaintext; and decrypting the data ciphertext according to the target key plaintext to obtain business privacy data.

[0097] Among them, the private key information refers to the key information stored by the institutional node device 104 when applying to join the business blockchain. It forms a key pair with the public key information. The public key information has been explained in detail above and will not be repeated here.

[0098] In practice, since the private key and public key information form a key pair, the encrypted key ciphertext can be decrypted back to the plaintext key. Then, using the decrypted plaintext key, which is consistent with the one provided by enterprise node device 102, the encrypted data can be decrypted, thus obtaining the business privacy data. In this way, other node devices without the private key information cannot obtain the accurate plaintext key and therefore cannot parse the encrypted data, ensuring the security of data transmission.

[0099] It should be noted that, in combination Figure 1 See Figure 6 If the financial scenario also includes institutional node devices 106 set up for regulatory agencies, the process by which institutional node devices 106 acquire business privacy data is largely the same as that of institutional node devices 104. Thus, the business privacy data transmission system provided in this application embodiment can be implemented by setting up more node devices according to business needs; the specific number is not limited in this application.

[0100] The business privacy data transmission method described in the above embodiments involves the institutional node device acquiring business data from the business blockchain. When the business data contains encrypted data containing business privacy data uploaded by the enterprise node device, the device parses the encrypted data and determines the target access conditions for the business privacy data. Then, based on the target access conditions, it uploads pre-stored identity information to the identity chain for data access verification, obtaining the verification result from the identity chain. Finally, if the verification result is successful, the device acquires the encrypted key uploaded by the institutional node device to decrypt the encrypted data, thus obtaining the business privacy data. Because this application proposes encrypting the business privacy data before transmission and incorporates multiple judgment mechanisms, it effectively improves data transmission security.

[0101] To better implement the business privacy data transmission method provided in the embodiments of this application, based on the business privacy data transmission method proposed in the embodiments of this application, this application also provides a business privacy data transmission device, which is an enterprise node device set on a business blockchain. The business blockchain also includes institutional node devices, such as... Figure 7 As shown, the privacy data transmission device 700 includes:

[0102] The ciphertext acquisition module 710 is used to acquire the ciphertext of business privacy data.

[0103] The encrypted data upload module 720 is used to upload encrypted data to the business blockchain for on-chain storage. After the institution's node devices parse the encrypted data, they upload the pre-stored identity information to the identity chain for data access verification and obtain the verification result fed back by the identity chain.

[0104] The key generation module 730 is used to generate the key ciphertext for business privacy data if the verification result is successful.

[0105] The key-on-chain module 740 is used to upload the key ciphertext to the business blockchain for on-chain storage, so that the institutional node devices can decrypt the data ciphertext according to the key ciphertext to obtain the business privacy data.

[0106] In one embodiment, the ciphertext acquisition module 710 is further configured to determine the data attributes of the business privacy data to be transmitted; determine the target key plaintext in a preset key mapping table according to the data attributes to obtain the target key identifier; the key mapping table contains at least one pair of key plaintext and key identifier that have a mapping relationship; determine the target access condition in a preset rule mapping table according to the data attributes to obtain the target condition identifier; the rule mapping table contains at least one pair of access conditions and condition identifiers that have a mapping relationship; and encrypt the business privacy data according to the target key identifier and the target condition identifier to obtain the ciphertext of the business privacy data.

[0107] In one embodiment, the ciphertext acquisition module 710 is further configured to generate plaintext keys based on a preset national cryptographic algorithm, and assign key identifiers to each plaintext key to form a key mapping table stored in the enterprise's local database; generate access conditions according to data attributes, and assign condition identifiers to each access condition to form a rule mapping table stored in the business blockchain; wherein, the data attributes include at least one of financial attributes, audit attributes, and supply chain attributes.

[0108] In one embodiment, the encrypted data includes a target key identifier. The key generation module 730 is further configured to, if the verification result is successful, query and obtain the plaintext of the target key from the enterprise's local database based on the target key identifier; and obtain the public key information pre-stored in the institutional node device in the business blockchain; and encrypt the plaintext of the target key based on the public key information to generate the encrypted key.

[0109] In the above embodiments, since this application proposes to encrypt business privacy data before transmission and superimposes multiple judgment mechanisms, it can effectively improve the security of data transmission.

[0110] See Figure 8 This application embodiment also provides another business privacy data transmission device, which is an institutional node device set on a business blockchain. The business blockchain also includes enterprise node devices. The business privacy data transmission device 800 includes:

[0111] Data acquisition module 810 is used to acquire business data from the business blockchain;

[0112] The ciphertext parsing module 820 is used to parse the ciphertext and determine the target access conditions for the business privacy data if the business data contains ciphertext of business privacy data uploaded by enterprise node devices.

[0113] The access verification module 830 is used to upload the pre-stored identity information to the identity chain for data access verification based on the target access conditions, so as to obtain the verification result fed back by the identity chain.

[0114] The privacy acquisition module 840 is used to acquire the key ciphertext uploaded by the institution node device if the verification result is successful, so as to decrypt the data ciphertext according to the key ciphertext and obtain the business privacy data.

[0115] In one embodiment, the privacy acquisition module 840 is further configured to, if the verification result is successful, acquire the key ciphertext uploaded by the organization node device; decrypt the key ciphertext based on the private key information pre-stored in the organization's local database to obtain the target key plaintext; and decrypt the data ciphertext according to the target key plaintext to obtain business privacy data.

[0116] In the above embodiments, since this application proposes to encrypt business privacy data before transmission and superimposes multiple judgment mechanisms, it can effectively improve the security of data transmission.

[0117] In some embodiments of this application, the business privacy data transmission device 700 and the business privacy data transmission device 800 can be implemented as a computer program, and the computer program can be implemented in the form of, for example, Figure 9The computer device shown operates on this device. The computer device's memory can store various program modules that make up the business privacy data transmission device 700 and the business privacy data transmission device 800, for example, Figure 7 The diagram shows the ciphertext acquisition module 710, the ciphertext upload module 720, the key generation module 730, and the key upload module 740; for example, Figure 8 The data acquisition module 810, ciphertext parsing module 820, access verification module 830, and privacy acquisition module 840 are shown. The computer program comprised of these modules causes the processor to execute the steps in the business privacy data transmission methods of the various embodiments of this application described in this specification.

[0118] For example, Figure 9 The computer equipment shown can be used as follows Figure 7 The encrypted text acquisition module 710 in the business privacy data transmission device 700 shown executes step S201. The computer device can execute step S202 through the encrypted text upload module 720. The computer device can execute step S203 through the key generation module 730. The computer device can execute step S204 through the key upload module 740.

[0119] For example, Figure 9 The computer equipment shown can be used as follows Figure 8 The data acquisition module 810 in the business privacy data transmission device 800 shown executes step S401. The computer device can execute step S402 through the ciphertext parsing module 820. The computer device can execute step S403 through the access verification module 830. The computer device can execute step S404 through the privacy acquisition module 840.

[0120] The computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external computer devices via a network connection. When the computer program is executed by the processor, it implements a method for transmitting business-private data.

[0121] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0122] In some embodiments of this application, a computer device is provided, including one or more processors; a memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processor as described in the business privacy data transmission method. The steps of the business privacy data transmission method here may be steps from the business privacy data transmission methods of the various embodiments described above.

[0123] In some embodiments of this application, a computer-readable storage medium is provided, storing a computer program. The computer program is loaded by a processor, causing the processor to execute the steps of the aforementioned business privacy data transmission method. The steps of this business privacy data transmission method may be those found in the business privacy data transmission methods of the various embodiments described above.

[0124] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0125] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0126] The above provides a detailed description of a business privacy data transmission method, apparatus, computer device, and storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for transmitting business privacy data, characterized in that, The method, which applies to enterprise node devices on a business blockchain, which also includes institutional node devices, comprises: Based on a preset national cryptographic algorithm, key plaintext is generated, and key identifiers are assigned to each key plaintext to form a key mapping table stored in the enterprise's local database; the key mapping table contains at least one pair of key plaintext and key identifiers that have a mapping relationship. Based on the data attributes, access conditions are generated, and condition identifiers are assigned to each access condition to form a rule mapping table stored in the business blockchain; the rule mapping table contains at least one pair of access conditions and condition identifiers that have a mapping relationship; wherein, the data attributes include at least one of financial attributes, audit attributes, and supply chain attributes; The encrypted data of the business privacy data is obtained; the encrypted data is obtained by encrypting the business privacy data based on the target key identifier in the key mapping table and the target condition identifier in the rule mapping table. The encrypted data is uploaded to the business blockchain for on-chain storage. After the institution node device parses the encrypted data, it determines the target condition identifier in the encrypted data, uploads the pre-stored identity information to the identity chain for data access verification, and obtains the verification result fed back by the identity chain. The verification result is a comparison between the access conditions contained in the encrypted data and the identity information uploaded by the institution node device. If the verification result is successful, then the key ciphertext of the business privacy data is generated; The encrypted key is uploaded to the business blockchain for on-chain storage, so that the institutional node device can decrypt the encrypted data based on the encrypted key to obtain the business privacy data.

2. The method as described in claim 1, characterized in that, The encrypted data used to obtain business privacy data includes: Determine the data attributes of the business privacy data to be transmitted; Based on the data attributes, the target key plaintext is determined in a preset key mapping table to obtain the target key identifier; Based on the data attributes, the target access conditions are determined in a preset rule mapping table to obtain the target condition identifier; The business privacy data is encrypted based on the target key identifier and the target condition identifier to obtain the encrypted data of the business privacy data.

3. The method as described in claim 1 or 2, characterized in that, The encrypted data includes a target key identifier. If the verification result is successful, the key encrypted data of the business privacy data is generated, including: If the verification result is successful, then the plaintext of the target key is retrieved from the enterprise's local database based on the target key identifier; and Obtain the public key information pre-stored in the institutional node device from the business blockchain; The target key plaintext is encrypted based on the public key information to generate the key ciphertext.

4. A method for transmitting business privacy data, characterized in that, The method, which applies to institutional node devices on a business blockchain, including enterprise node devices, comprises: Obtain business data from the business blockchain; If the business data contains encrypted data of business privacy data uploaded by the enterprise node device, the encrypted data is parsed to determine the target access conditions for the business privacy data. The encrypted data is obtained by encrypting the business privacy data based on the target key identifier in the key mapping table and the target condition identifier in the rule mapping table. The key mapping table contains at least one pair of plaintext keys and key identifiers with a mapping relationship. The plaintext keys are generated based on a preset national cryptographic algorithm, and each plaintext key is assigned a corresponding key identifier. The key mapping table is stored in the enterprise's local database. The rule mapping table contains at least one pair of access conditions and condition identifiers with a mapping relationship. The access conditions are generated based on data attributes, and each access condition is assigned a corresponding condition identifier. The rule mapping table is stored in the business blockchain. The data attributes include at least one of financial attributes, audit attributes, and supply chain attributes. According to the target access conditions, the pre-stored identity information is uploaded to the identity chain for data access verification, so as to obtain the verification result fed back by the identity chain; the verification result is a comparison result between the access conditions contained in the data ciphertext and the identity information uploaded by the institution node device. If the verification result is successful, the key ciphertext uploaded by the institution node device is obtained, and the data ciphertext is decrypted according to the key ciphertext to obtain the business privacy data.

5. The method as described in claim 4, characterized in that, If the verification result is successful, the key ciphertext uploaded by the institutional node device is obtained, and the data ciphertext is decrypted based on the key ciphertext to obtain the business privacy data, including: If the verification result is successful, then the key ciphertext uploaded by the institution node device is obtained; Based on the private key information pre-stored in the organization's local database, the encrypted key is decrypted to obtain the plaintext target key; Based on the plaintext of the target key, the ciphertext of the data is decrypted to obtain the business privacy data.

6. A business privacy data transmission device, characterized in that, Enterprise node devices configured on a business blockchain, which also includes institutional node devices, the device comprising: Based on a preset national cryptographic algorithm, key plaintext is generated, and key identifiers are assigned to each key plaintext to form a key mapping table stored in the enterprise's local database; the key mapping table contains at least one pair of key plaintext and key identifiers that have a mapping relationship. Based on the data attributes, access conditions are generated, and condition identifiers are assigned to each access condition to form a rule mapping table stored in the business blockchain; the rule mapping table contains at least one pair of access conditions and condition identifiers that have a mapping relationship; wherein, the data attributes include at least one of financial attributes, audit attributes, and supply chain attributes; The ciphertext acquisition module is used to acquire the ciphertext of business privacy data; the ciphertext is obtained by encrypting the business privacy data based on the target key identifier in the key mapping table and the target condition identifier in the rule mapping table. The encrypted data upload module is used to upload the encrypted data to the business blockchain for on-chain storage. After the institution node device parses the encrypted data, it determines the target condition identifier in the encrypted data, uploads the pre-stored identity information to the identity chain for data access verification, and obtains the verification result fed back by the identity chain. The verification result is a comparison between the access conditions contained in the encrypted data and the identity information uploaded by the institution node device. The key generation module is used to generate the key ciphertext of the business privacy data if the verification result is successful. The key-on-chain module is used to upload the key ciphertext to the business blockchain for on-chain storage, so that the institution node device can decrypt the data ciphertext according to the key ciphertext to obtain the business privacy data.

7. A business privacy data transmission device, characterized in that, Institutional node devices configured on a business blockchain, the business blockchain also including enterprise node devices, the device comprising: The data acquisition module is used to acquire business data from the business blockchain; The ciphertext parsing module is used to parse the ciphertext of business privacy data uploaded by the enterprise node device if the business data contains ciphertext of such data to determine the target access conditions for the business privacy data. The ciphertext is obtained by encrypting the business privacy data based on a target key identifier in a key mapping table and a target condition identifier in a rule mapping table. The key mapping table contains at least one pair of plaintext keys and key identifiers with a mapping relationship. The plaintext keys are generated based on a preset national cryptographic algorithm, and each plaintext key is assigned a corresponding key identifier. The key mapping table is stored in the enterprise's local database. The rule mapping table contains at least one pair of access conditions and condition identifiers with a mapping relationship. The access conditions are generated based on data attributes, and each access condition is assigned a corresponding condition identifier. The rule mapping table is stored in the business blockchain. The data attributes include at least one of financial attributes, audit attributes, and supply chain attributes. The access verification module is used to upload pre-stored identity information to the identity chain for data access verification according to the target access conditions, so as to obtain the verification result fed back by the identity chain; the verification result is a comparison result between the access conditions contained in the data ciphertext and the identity information uploaded by the institution node device. The privacy acquisition module is used to acquire the key ciphertext uploaded by the institution node device if the verification result is successful, and to decrypt the data ciphertext according to the key ciphertext to obtain the business privacy data.

8. A computer device, characterized in that, The computer device includes: One or more processors; The memory; and one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the business privacy data transmission method of any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, It stores a computer program, which is loaded by a processor to perform the steps of the business privacy data transmission method according to any one of claims 1 to 5.

Images