Data processing method and device, server and storage medium

Abstract

The application provides a data processing method and device, a server and a storage medium. The method is applied to a distributed attribute authority chain and includes the following steps: receiving a data encryption key request generated by a first signature private key of a provider user terminal; sending a first signature public key request for the provider user to a distributed digital identity chain according to the encryption key request, so as to obtain the first signature public key of the provider user; obtaining the data encryption key according to the first signature public key; sending a first encryption public key request to the distributed digital identity chain, so as to obtain the first encryption public key of the provider user; encrypting the data encryption key according to the first encryption public key; and sending the encrypted data encryption key to the provider user terminal, so that the provider user terminal decrypts the encrypted data encryption key, encrypts to-be-transmitted data by using the data encryption key to generate ciphertext data, and sends the ciphertext data, thereby improving the security of data processing.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data processing method, apparatus, server and storage medium. Background Technology

[0002] Attribute-Based Encryption (ABE) is a commonly used encryption method. An ABE system requires an Attribute Authority (AA) and an Authority. The Attribute Authority is used to collect, store, and manage attribute sets and access structures, while the Authority is used to build access control policies based on the attribute sets and access structures and generate data encryption and decryption keys.

[0003] In existing technologies, the attribute authority centrally manages the required attribute set and access structure. The authorization center generates an encryption key based on the attributes and access structure, and a decryption key based on the requester's attributes. During encryption, the data subject sends a key request to the authorization center to obtain the key for encrypting the data.

[0004] However, in existing technologies, centralized authority is vulnerable to attack. Distributing data encryption keys is insecure when an authorization center enforces access control policies. Summary of the Invention

[0005] This application provides a data processing method, apparatus, server, and storage medium to solve the problem of low security of distributed data encryption keys in the prior art.

[0006] Firstly, this application provides a data processing method applied to a distributed attribute authority chain, comprising:

[0007] Receive a data encryption key request sent by the provider's user terminal, wherein the data encryption key request is generated by the provider's user terminal by signing its own first signature private key;

[0008] Based on the data encryption key request, a first signature public key request for the provider user is sent to the distributed digital identity chain, so that the distributed digital identity chain can obtain the provider user's first signature public key based on the first signature public key request;

[0009] Receive the first signed public key sent by the distributed digital identity chain;

[0010] Obtain the data encryption key based on the first signature public key;

[0011] Send a first encrypted public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the first encrypted public key of the provider user based on the first encrypted public key request;

[0012] Receive the first encrypted public key sent by the distributed digital identity chain;

[0013] The data encryption key is encrypted using the first public encryption key;

[0014] The encrypted data encryption key is sent to the provider's user terminal, so that the provider's user terminal can use its own first encryption private key to decrypt the encrypted data encryption key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user's user terminal.

[0015] In one embodiment of this application, the step of obtaining the data encryption key based on the first signing public key and sending a first encryption public key request for the provider user includes: performing signature verification on the first signing public key to determine the provider user to which the first signing public key belongs; obtaining the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user; and sending a first encryption public key query request for the provider user to the distributed digital identity chain based on the provider user.

[0016] In one embodiment of this application, after sending the encrypted data encryption key to the provider user terminal, so that the provider user terminal can decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user terminal, the method further includes: receiving a data decryption key request sent by the user client, wherein the data decryption key request is generated by the user client by signing with its own second signature private key; according to the data decryption key request, sending a second signature public key request for the user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the user's second signature public key according to the second signature public key request; receiving the second signature public key sent by the distributed digital identity chain; and obtaining the user's second signature public key according to the second signature public key. User attribute information; sending the user attribute information to the distributed digital identity chain so that the distributed digital identity chain can verify the authenticity of the user attribute information; receiving the verification result sent by the distributed digital identity chain when verifying that the user attribute information is authentic; sending a second encrypted public key query request for the user based on the verification result so that the distributed digital identity chain can obtain the user's second encrypted public key based on the second encrypted public key query request; receiving the second encrypted public key sent by the distributed digital identity chain; encrypting the data decryption key based on the second encrypted public key; sending the encrypted data decryption key to the user terminal so that the user terminal can use its own second encrypted private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0017] In one embodiment of this application, the distributed digital identity chain records a first key pair, a second key pair, and user attribute information corresponding to each user terminal; wherein the first key pair and the second key pair are key generation requests sent by each user terminal to the distributed digital identity chain; a first key pair and a second key pair are generated for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and the distributed digital identity chain sends the signing private key and encryption private key to the corresponding user terminal; wherein the user attribute information is generated by the distributed digital identity chain sending a user attribute information request to each user terminal, so that the... Each user terminal obtains its own user attribute information; receives the user attribute information sent by each user terminal; records the user attribute information on the chain; before receiving the data encryption key request sent by the provider user terminal, the method further includes: sending a data access structure request to each user terminal so that each user terminal obtains its own data access structure; receiving the data access structure sent by each user terminal; constructing an access policy based on the data access structure and recording the access policy on the chain; encapsulating the access policy into a data encryption key and a data decryption key, encrypting the data encryption key and the data decryption key with a symmetric key, and storing the data encryption key and the data decryption key on the chain.

[0018] Secondly, this application also provides a data processing method applied to a distributed digital identity chain, including:

[0019] Receives a first signature public key request for the provider user sent by the distributed attribute authority chain, wherein the first signature public key request for the provider user is generated by the distributed attribute authority chain through receiving a data encryption key request sent by the provider user; wherein the data encryption key request is generated by the provider user through its own first signature private key;

[0020] Obtain the provider's first signature public key based on the first signature public key request for the provider user;

[0021] Send the first signature public key to the distributed attribute authority chain so that the distributed attribute authority chain can obtain the data encryption key based on the first signature public key;

[0022] Receive the first encrypted public key request for the provider user sent by the distributed attribute authority chain;

[0023] Based on the first encrypted public key request, obtain the provider user's first encrypted public key;

[0024] Send the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal. The encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

[0025] In one embodiment of this application, after sending the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal, wherein the encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal, the method further includes: receiving a second signature public key request for the user terminal sent by the distributed attribute authority chain, wherein the second signature public key request for the user terminal is generated by the distributed attribute authority chain by receiving a data decryption key request sent by the user terminal; wherein the data decryption key request is generated by the user terminal by signing with its own second signature private key; and obtaining the second signature public key according to the second signature public key request for the user terminal. The system sends the second signing public key to the distributed attribute authority chain, enabling the distributed attribute authority chain to obtain user attribute information based on the second signing public key; receives a query request for user attribute information from the distributed attribute authority chain; determines the authenticity of user attribute information based on the query request; if the attributes are authentic, sends the query result to the distributed attribute authority chain; receives a query request for the second encryption public key from the distributed attribute authority chain; obtains the second encryption public key; sends the second encryption public key to the distributed attribute authority chain, enabling the distributed attribute authority chain to encrypt the data decryption key based on the second encryption public key, and sends the encrypted data decryption key to the user terminal. The encrypted data decryption key instructs the user terminal to use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and uses the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0026] In one embodiment of this application, before receiving the first signature public key request for the provider user sent by the distributed attribute authority chain, the method further includes: receiving a key generation request sent by each user terminal; generating a first key pair and a second key pair for each user terminal, wherein the first key pair includes the user terminal's signature private key and signature public key, and the second key pair includes the user terminal's encryption private key and encryption public key; sending the signature private key and encryption private key to the corresponding user terminal; sending a user attribute information request to each user terminal so that each user terminal can obtain its own user attribute information; receiving the user attribute information sent by each user terminal; and recording the user attribute information. On the chain; wherein, the distributed attribute authority chain records data encryption keys and data decryption keys, wherein the data encryption keys and data decryption keys are used by the distributed attribute authority chain to send data access structure requests to each user terminal so that each user terminal can obtain its own data access structure; and receive the data access structure sent by each user terminal; construct an access policy according to the data access structure, record the access policy on the chain; encapsulate the access policy into data encryption keys and data decryption keys, encrypt the data encryption keys and data decryption keys with a symmetric key, and store the data encryption keys and data decryption keys on the chain.

[0027] Thirdly, this application provides a data processing apparatus for use in a distributed attribute authority chain, comprising:

[0028] The first receiving module is used to receive a data encryption key request sent by the provider's user terminal, wherein the data encryption key request is generated by the provider's user terminal through its own first signature private key;

[0029] The first sending module is used to send a first signature public key request for the provider user to the distributed digital identity chain according to the data encryption key request, so that the distributed digital identity chain can obtain the first signature public key of the provider user according to the first signature public key request.

[0030] The second receiving module is used to receive the first signature public key sent by the distributed digital identity chain;

[0031] The first acquisition module is used to acquire the data encryption key based on the first signature public key;

[0032] The second sending module is used to send a first encrypted public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the first encrypted public key of the provider user according to the first encrypted public key request;

[0033] The third receiving module is used to receive the first encrypted public key sent by the distributed digital identity chain;

[0034] The first encryption module is used to encrypt the data encryption key according to the first encryption public key;

[0035] The third sending module is used to send the encrypted data encryption key to the provider's user terminal, so that the provider's user terminal can use its own first encryption private key to decrypt the encrypted data encryption key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user's user terminal.

[0036] Fourthly, this application also provides a data processing apparatus for use in a distributed digital identity chain, comprising:

[0037] The first receiving module receives a first signature public key request for the provider user sent by the distributed attribute authority chain. The first signature public key request for the provider user is generated by the distributed attribute authority chain through receiving a data encryption key request sent by the provider user. The data encryption key request is generated by the provider user through its own first signature private key.

[0038] The first acquisition module is used to acquire the first signature public key of the provider user based on the first signature public key request for the provider user;

[0039] The first sending module is used to send the first signing public key to the distributed attribute authority chain, so that the distributed attribute authority chain can obtain the data encryption key based on the first signing public key;

[0040] The second receiving module is used to receive the first encrypted public key request for the provider user sent by the distributed attribute authority chain;

[0041] The second acquisition module is used to acquire the first encrypted public key of the provider user based on the first encrypted public key request;

[0042] The second sending module is used to send the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal. The encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

[0043] Fifthly, this application provides a distributed attribute authority chain server, comprising: at least one processor and a memory;

[0044] The memory stores instructions that the computer executes;

[0045] At least one processor executes computer execution instructions stored in memory, causing at least one processor to perform the data processing method of the first aspect above.

[0046] Sixthly, this application provides a distributed digital identity chain server, comprising: at least one processor and a memory;

[0047] The memory stores instructions that the computer executes;

[0048] At least one processor executes computer execution instructions stored in memory, causing at least one processor to perform the data processing method as described in the second aspect above.

[0049] In a seventh aspect, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the data processing method described in the first aspect above.

[0050] Eighthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the data processing method of the second aspect above.

[0051] The data processing method, apparatus, server, and storage medium provided in this application obtain a first signature public key and a first encryption public key through a distributed access strategy of a distributed attribute authority chain and a distributed digital identity chain. The first signature public key is used to obtain a data encryption key, and the first encryption public key is used to encrypt the data encryption key. This can improve the security of distributing the data encryption key and avoid the problem of low security when distributing the data encryption key when the access control policy is executed in the authorization center. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a schematic diagram illustrating an application scenario of the data processing method provided in the embodiments of this application;

[0054] Figure 2 This is a schematic flowchart of a data processing method provided in one embodiment of this application;

[0055] Figure 3 This is a schematic flowchart of a data processing method provided in another embodiment of this application;

[0056] Figure 4 This is a schematic flowchart of a data processing method provided in another embodiment of this application;

[0057] Figure 5 This is a schematic flowchart of a data processing method provided in another embodiment of this application;

[0058] Figure 6 This is a schematic flowchart of a data processing method provided in another embodiment of this application;

[0059] Figure 7 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application;

[0060] Figure 8 A schematic diagram of the structure of a data processing apparatus provided in another embodiment of this application;

[0061] Figure 9 A schematic diagram of the hardware structure of a distributed attribute authority chain server provided in one embodiment of this application;

[0062] Figure 10 A schematic diagram of the hardware structure of a distributed digital identity chain server provided in another embodiment of this application. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0064] With the continuous development of encryption technology, existing encryption methods typically use attribute encryption to encrypt data. When using attribute encryption, the system needs to be configured with an attribute authority and an authorization center. The attribute authority is used to collect, store, and manage attribute sets and access structures, while the authorization center is used to construct access control policies and generate data encryption / decryption keys based on the attribute sets and access structures. However, in existing technologies, centralized attribute authorities cannot meet the needs of large-scale distributed applications requiring collaboration between different organizations. The authenticity of the collected, stored, and managed attributes and access structures is difficult to verify, making them vulnerable to attacks and thus reducing their authority. Furthermore, the centralized authorization center faces low security in distributing data encryption / decryption keys when enforcing access control policies.

[0065] To address the aforementioned technical problems, this application proposes the following technical approach: By constructing a distributed digital identity chain, user attribute information is collected and recorded on the chain, thereby enabling verification of the authenticity of user attributes. When generating key pairs, two key pairs are generated for each user, one for data signing and the other for data encryption / decryption, separating the encryption and signing functions to achieve secure distribution of data signing and encryption / decryption keys. By constructing a distributed attribute authority chain, access control policies are generated, and data encryption / decryption keys are distributed in conjunction with the user's corresponding key pair, thereby enhancing the system's security and trustworthiness.

[0066] Figure 1 This is a schematic diagram illustrating an application scenario of the data processing method provided in the embodiments of this application. For example... Figure 1 As shown, the application scenarios of this data processing method include: provider user terminal 101, distributed attribute authority chain 102, distributed digital identity chain 103, and user user terminal 104.

[0067] Here, the provider user terminal 101 sends a data encryption key request to the distributed attribute authority chain 102. The distributed attribute authority chain 102 obtains the signature public key and encryption public key of the provider user terminal 101 from the distributed digital identity chain 103 and then sends the data encryption key to the provider user terminal 101. The provider user terminal encrypts the transmitted data using the data encryption key and sends it to the user user terminal 104. The user user terminal 104 obtains a data decryption key from the distributed attribute authority chain 102. The distributed attribute authority chain 102 obtains the signature public key and signature private key of the user user terminal 104 from the distributed digital identity chain 103 and then sends the data decryption key to the user user terminal 104. The user user terminal 104 uses the data decryption key to decrypt the encrypted data and obtain the transmitted data.

[0068] The following detailed embodiments will be used to illustrate the point.

[0069] Example 1

[0070] Figure 2 This is a schematic flowchart of a data processing method provided in one embodiment of this application. The execution entity of this embodiment can be... Figure 1 The distributed attribute authority chain in the illustrated embodiment is not specifically limited in this embodiment. Figure 2 As shown, the method includes:

[0071] S201: Receive a data encryption key request sent by the provider's user terminal, wherein the data encryption key request is generated by the provider's user terminal through its own first signature private key.

[0072] Specifically, the provider's client requests a data encryption key using a hash algorithm to obtain a digital digest, and then encrypts the digital digest using its own first signature private key.

[0073] S202: Based on the data encryption key request, send a first signature public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the provider user's first signature public key based on the first signature public key request.

[0074] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the first signature public key, and then obtains the first signature public key corresponding to the user based on the user attributes.

[0075] S203: Receive the first signed public key sent by the distributed digital identity chain.

[0076] S204: Obtain the data encryption key based on the first signature public key.

[0077] Specifically, step S204 includes:

[0078] S2041: Verify the signature of the first signing public key to determine the provider user to whom the first signing public key belongs.

[0079] Specifically, the distributed attribute authority chain uses the first signature public key to decrypt the digital signature, derives a digital digest, requests the data encryption key using a hash algorithm to obtain a new digital digest, and compares the new digital digest with the derived digital digest. If the results are the same, the verification is successful.

[0080] S2042: Obtain the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user.

[0081] Specifically, the distributed attribute authority chain obtains the data access structure of the provider user based on the data access structure recorded on the chain.

[0082] S205: Send a first encrypted public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the first encrypted public key of the provider user according to the first encrypted public key request.

[0083] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the first encrypted public key, and then obtains the first encrypted public key corresponding to the user based on the user attributes.

[0084] S206: Receive the first encrypted public key sent by the distributed digital identity chain.

[0085] S207: Encrypt the data encryption key according to the first encryption public key.

[0086] Specifically, the distributed attribute authority chain uses a hash algorithm to obtain a digital digest of the data encryption key, and then encrypts the digital digest using the first encryption public key.

[0087] S208: Send the encrypted data encryption key to the provider's user terminal, so that the provider's user terminal can use its own first encryption private key to decrypt the encrypted data encryption key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user's user terminal.

[0088] Specifically, the provider's client uses its own first encryption private key to decrypt the digital signature, derives a digital digest, and then uses a hash algorithm on the encrypted data encryption key to obtain a new digital digest. The new digital digest is compared with the derived digital digest; if they match, verification is successful. The provider's client obtains the data encryption key. The provider's client then uses a hash algorithm on the data to be transmitted to obtain a digital digest, encrypts the digital digest using the data encryption key, and sends the encrypted ciphertext data to the user's client.

[0089] As can be seen from the above embodiments, by using the distributed access strategy of the distributed attribute authority chain and the distributed digital identity chain, a first signature public key and a first encryption public key are obtained. The first signature public key is used to obtain the data encryption key, and the first encryption public key is used to encrypt the data encryption key. This can improve the security of distributing the data encryption key and avoid the problem of low security in distributing the data encryption key when the access control policy is executed in the authorization center.

[0090] In one embodiment of this application, in Figure 2 Based on the embodiment, after step S208, the process further includes sending the encrypted data decryption key to the user's terminal, as detailed below:

[0091] S209: Receive a data decryption key request sent by the user client, wherein the data decryption key request is generated by the user client through its own second signature private key.

[0092] Specifically, the user client requests a data decryption key using a hash algorithm to obtain a digital digest, and then encrypts the digital digest using its own second signature private key.

[0093] S210: Based on the data decryption key request, send a second signature public key request for the user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the user's second signature public key based on the second signature public key request.

[0094] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the second signature public key, and then obtains the second signature public key corresponding to the user based on the user attributes.

[0095] S211: Receive the second signature public key sent by the distributed digital identity chain.

[0096] S212: Obtain the user attribute information based on the second signature public key.

[0097] Specifically, the distributed attribute authority chain uses the second signature public key to decrypt the digital signature, derive the digital digest, and extract information from the digital digest to obtain user information.

[0098] S213: Send the user attribute information of the user to the distributed digital identity chain so that the distributed digital identity chain can verify the authenticity of the user attribute information of the user.

[0099] Specifically, the distributed digital identity chain compares the attribute information recorded on the chain with the received attribute information to verify the authenticity of the user's attribute information.

[0100] S214: Receive the verification result sent by the distributed digital identity chain when verifying that the user's attribute information is authentic.

[0101] S215: Based on the verification result, send a second encrypted public key query request for the user, so that the distributed digital identity chain can obtain the user's second encrypted public key according to the second encrypted public key query request.

[0102] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the second encrypted public key, and then obtains the second encrypted public key corresponding to the user based on the user attributes.

[0103] S216: Receive the second encrypted public key sent by the distributed digital identity chain.

[0104] S217: Encrypt the data decryption key using the second encryption public key.

[0105] Specifically, the distributed attribute authority chain uses a hash algorithm to obtain a digital digest of the data decryption key, and then encrypts the digital digest using a second encryption public key.

[0106] S218: Send the encrypted data decryption key to the user terminal, so that the user terminal can use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0107] Specifically, the user terminal uses its own second encryption private key to decrypt the digital signature, derives a digital digest, and then uses a hash algorithm on the encrypted data decryption key to obtain a new digital digest. The new digital digest is then compared with the exported digital digest; if they match, verification is successful. The user terminal obtains the data decryption key. The user terminal then uses a hash algorithm on the received data to obtain a digital digest, and then decrypts the digital digest using the data decryption key, ultimately obtaining the data sent by the provider terminal.

[0108] As can be seen from the above embodiments, by using the distributed access strategy of the distributed attribute authority chain and the distributed digital identity chain, a second signature public key and a second encryption public key are obtained. The second signature public key is used to verify user attribute information, and the second encryption public key is used to encrypt the data decryption key, which can improve the security of distributing the data decryption key.

[0109] In one embodiment of this application, the distributed digital identity chain records a first key pair, a second key pair, and user attribute information corresponding to each user terminal; the first key pair and the second key pair are generated by the distributed digital identity chain receiving key generation requests sent by each user terminal; a first key pair and a second key pair are generated for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and the distributed digital identity chain sends the signing private key and encryption private key to the corresponding user terminal; the user attribute information is obtained by the distributed digital identity chain sending user attribute information requests to each user terminal so that each user terminal can obtain its own user attribute information; the distributed digital identity chain receives the user attribute information sent by each user terminal; and records the user attribute information on the chain. Figure 2 Based on the embodiment, before step S201, the process of collecting data access structures to generate data encryption and decryption keys is also included, which is described in detail below:

[0110] S2001: Send a data access structure request to each user terminal so that each user terminal can obtain its own data access structure.

[0111] Specifically, each user constructs an access control tree structure based on their own identity attributes.

[0112] S2002: Receive the data access structure sent by each user terminal; construct the access policy based on the data access structure and record the access policy on the chain.

[0113] Specifically, the distributed attribute authority chain generates access policies based on the data access control tree structure received from each user.

[0114] S2003: Encapsulate the access policy into a data encryption key and a data decryption key, encrypt the data encryption key and the data decryption key with a symmetric key, and store the data encryption key and the data decryption key on the chain.

[0115] Specifically, the distributed attribute authority chain uses the 3DES symmetric encryption algorithm to encrypt the data encryption key and the data decryption key.

[0116] As can be seen from the above embodiments, collecting each user's attribute information through a distributed digital identity chain ensures the authenticity and verifiability of the user attribute information; at the same time, collecting each user's data access structure through a distributed attribute authority chain and distributing data encryption and decryption keys according to different users enhances the security and trustworthiness of the system.

[0117] Example 2

[0118] Figure 3 This is a schematic flowchart of a data processing method provided in another embodiment of this application. The execution entity of this embodiment can be... Figure 1 The distributed digital identity chain in the illustrated embodiment is not specifically limited in this embodiment. Figure 3 As shown, the method includes:

[0119] S301: Receive a first signature public key request for the provider user sent by the distributed attribute authority chain, wherein the first signature public key request for the provider user is generated by the distributed attribute authority chain through receiving a data encryption key request sent by the provider user; wherein the data encryption key request is generated by the provider user through its own first signature private key.

[0120] S302: Obtain the first signature public key of the provider user based on the first signature public key request for the provider user.

[0121] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the first signature public key, and then obtains the first signature public key corresponding to the user based on the user attributes.

[0122] S303: Send the first signing public key to the distributed attribute authority chain so that the distributed attribute authority chain can obtain the data encryption key based on the first signing public key.

[0123] Specifically, the distributed attribute authority chain uses the first signature public key to decrypt the digital signature, derives the digital digest, determines the provider user information based on the digital digest content, and obtains the provider user's data access structure based on the data access structure recorded on the chain.

[0124] S304: Receive the first encrypted public key request for the provider user sent by the distributed attribute authority chain.

[0125] S305: Obtain the provider user's first encrypted public key based on the first encrypted public key request.

[0126] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the first encrypted public key, and then obtains the first encrypted public key corresponding to the user based on the user attributes.

[0127] S306: Send the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal. The encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

[0128] Specifically, the distributed attribute authority chain uses a hash algorithm to obtain a digital digest of the data encryption key, and then encrypts the digital digest using the first encryption public key. The encrypted data encryption key is sent to the provider's client. The provider's client uses its own first encryption private key to decrypt the digital signature, derives the digital digest, and uses a hash algorithm on the encrypted data encryption key to obtain a new digital digest. The new digital digest is compared with the derived digital digest; if they match, verification is successful. The provider's client receives the data encryption key. The provider's client then uses a hash algorithm to obtain a digital digest of the data to be transmitted, encrypts the digital digest using the data encryption key, and sends the encrypted ciphertext data to the user's client.

[0129] As can be seen from the above embodiments, by using the distributed access strategy of the distributed attribute authority chain and the distributed digital identity chain, a first signature public key and a first encryption public key are obtained. The first signature public key is used to obtain the data encryption key, and the first encryption public key is used to encrypt the data encryption key. This can improve the security of distributing the data encryption key and avoid the problem of low security in distributing the data encryption key when the access control policy is executed in the authorization center.

[0130] In one embodiment of this application, in Figure 3 Based on the embodiment, after step S306, the process further includes sending the encrypted data decryption key to the user's terminal, as detailed below:

[0131] S307: Receive a second signature public key request for the user sent by the distributed attribute authority chain, wherein the second signature public key request for the user is generated by the distributed attribute authority chain through receiving a data decryption key request sent by the user terminal; wherein the data decryption key request is generated by the user terminal through its own second signature private key.

[0132] S308: Obtain the second signature public key based on the second signature public key request for the user.

[0133] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the second signature public key, and then obtains the second signature public key corresponding to the user based on the user attributes.

[0134] S309: Send the second signature public key to the distributed attribute authority chain so that the distributed attribute authority chain can obtain the user attribute information of the user based on the second signature public key.

[0135] Specifically, the distributed attribute authority chain uses the second signature public key to decrypt the digital signature, derive the digital digest, and extract information from the digital digest to obtain user information.

[0136] S310: Receives query requests for user attribute information from the distributed attribute authority chain.

[0137] S311: Determine the authenticity of the user attribute information based on the query request for the user attribute information.

[0138] Specifically, the distributed digital identity chain compares the attribute information recorded on the chain with the received attribute information to verify the authenticity of the user's attribute information.

[0139] S312: If the attribute is true, send the query result to the distributed attribute authority chain.

[0140] S313: Receive a second encrypted public key query request for the user sent by the distributed attribute authority chain.

[0141] S314: Obtain the second encryption public key.

[0142] Specifically, the distributed digital identity chain requests and judges the user attributes recorded on the distributed digital identity chain based on the second encrypted public key, and then obtains the second encrypted public key corresponding to the user based on the user attributes.

[0143] S315: Send the second encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data decryption key according to the second encryption public key, and sends the encrypted data decryption key to the user terminal. The encrypted data decryption key is used to instruct the user terminal to use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0144] Specifically, the distributed attribute authority chain uses a hash algorithm to obtain a digital digest of the data decryption key, and then encrypts the digital digest using a second encryption public key. The user terminal uses its own second encryption private key to decrypt the digital signature, derives the digital digest, and uses a hash algorithm on the encrypted data decryption key to obtain a new digital digest. The new digital digest is compared with the derived digital digest; if they match, verification is successful. The user terminal obtains the data decryption key. The user terminal then uses a hash algorithm to obtain a digital digest of the received data, and then decrypts the digital digest using the data decryption key, ultimately obtaining the data sent by the provider terminal.

[0145] As can be seen from the above embodiments, by using the distributed access strategy of the distributed attribute authority chain and the distributed digital identity chain, a second signature public key and a second encryption public key are obtained. The second signature public key is used to verify user attribute information, and the second encryption public key is used to encrypt the data decryption key, which can improve the security of distributing the data decryption key.

[0146] In one embodiment of this application, in Figure 3 Based on the embodiment, before step S301, a process of collecting user attribute information is also included, which is detailed below:

[0147] S3001: Receive key generation requests sent by each user terminal.

[0148] S3002: Generate a first key pair and a second key pair for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key.

[0149] Specifically, the distributed digital identity chain generates a private key and then generates a corresponding public key based on the generated private key.

[0150] S3003: Send the signing private key and the encryption private key to the corresponding user terminal.

[0151] S3004: Send a user attribute information request to each user terminal so that each user terminal can obtain its own user attribute information.

[0152] S3005: Receives user attribute information sent by each user terminal.

[0153] S3006: Record user attribute information on the blockchain.

[0154] The distributed attribute authority chain records data encryption keys and data decryption keys. These keys are used by the distributed attribute authority chain to send data access structure requests to each user terminal, enabling each user terminal to obtain its own data access structure; receive the data access structure sent by each user terminal; construct an access policy based on the data access structure; record the access policy on the chain; encapsulate the access policy into data encryption keys and data decryption keys; encrypt the data encryption keys and data decryption keys using a symmetric key; and store the data encryption keys and data decryption keys on the chain.

[0155] As can be seen from the above embodiments, collecting each user's attribute information through a distributed digital identity chain ensures the authenticity and verifiability of the user attribute information; at the same time, collecting each user's data access structure through a distributed attribute authority chain and distributing data encryption and decryption keys according to different users enhances the security and trustworthiness of the system.

[0156] Example 3

[0157] refer to Figures 4-6 This is an example of an interaction process executed by a user terminal (provider user terminal and user user terminal), a distributed attribute authority chain, and a distributed digital identity chain.

[0158] in, Figure 4 This is a schematic flowchart of a data processing method provided in another embodiment of this application. This embodiment uses the interaction process executed by the user terminal, the distributed attribute authority chain, and the distributed digital identity chain as an example to illustrate the process of generating each key. Figure 4 As shown, the details are as follows:

[0159] S401: Each client sends a key generation request to the distributed digital identity chain.

[0160] S402: The distributed digital identity chain generates a first key pair and a second key pair for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key.

[0161] S403: The distributed digital identity chain sends the signing private key and the encryption private key to the corresponding user terminal.

[0162] S404: The distributed digital identity chain sends a user attribute information request to each user terminal.

[0163] S405: Each user terminal obtains its own user attribute information.

[0164] S406: Each user terminal sends its own user attribute information to the distributed digital identity chain.

[0165] S407: Distributed digital identity link receives user attribute information sent by each user terminal and records the user attribute information on the chain.

[0166] S408: The distributed attribute authority chain sends data access structure requests to each user terminal.

[0167] S409: Each user terminal obtains its own data access structure.

[0168] S410: Each user terminal sends its own data access structure to the distributed attribute authority chain.

[0169] S411: The distributed attribute authoritative link receives the data access structure sent by each user terminal, constructs an access policy based on the data access structure, and records the access policy on the chain.

[0170] S412: The distributed attribute authority chain encapsulates the access policy into a data encryption key and a data decryption key, encrypts the data encryption key and the data decryption key with a symmetric key, and stores the data encryption key and the data decryption key on the chain.

[0171] in, Figure 5 This is a schematic flowchart of a data processing method provided in another embodiment of this application. This embodiment uses the interaction process executed by the provider's user terminal and the user terminal, the distributed attribute authority chain, and the distributed digital identity chain as an example to illustrate the process of encrypting and transmitting data to be transmitted using a data encryption key. Figure 5 As shown, the details are as follows:

[0172] S413: The provider user requests a data encryption key by signing it with its own first signature private key.

[0173] S414: The provider client sends a data encryption key request to the distributed attribute authority chain.

[0174] S415: The distributed attribute authority chain sends a first-signature public key request for the provider user to the distributed digital identity chain based on the encryption key request.

[0175] S416: The distributed digital identity chain requests the provider user's first signature public key based on the first signature public key.

[0176] S417: The distributed digital identity chain sends the provider user's first-signed public key to the distributed attribute authority chain.

[0177] S418: The distributed attribute authority chain obtains the data encryption key based on the first signature public key.

[0178] S419: The distributed attribute authority chain sends the first encrypted public key request for the provider user to the distributed digital identity chain.

[0179] S420: The distributed digital identity chain requests the provider user's first encrypted public key based on the first encrypted public key.

[0180] S421: The distributed digital identity chain sends the provider user's first encrypted public key to the distributed attribute authority chain.

[0181] S422: The distributed attribute authority chain encrypts the data encryption key based on the first encryption public key.

[0182] S423: The distributed attribute authority chain sends the encrypted data encryption key to the provider user terminal.

[0183] S424: The provider user terminal uses its own first encryption private key to decrypt the encrypted data encryption key to obtain the data encryption key, and uses the data encryption key to encrypt the data to be transmitted to generate ciphertext data.

[0184] S425: The provider's client sends encrypted ciphertext data to the user's client.

[0185] in, Figure 6 This is a schematic flowchart of a data processing method provided in another embodiment of this application. This embodiment uses the interaction process executed by the provider's user terminal and the user terminal, the distributed attribute authority chain, and the distributed digital identity chain as an example to illustrate the process of decrypting encrypted ciphertext data using a data decryption key. Figure 6 As shown, the details are as follows:

[0186] S426: The user terminal receives encrypted ciphertext data sent by the provider terminal.

[0187] S427: The user client sends a data decryption key request to the distributed attribute authority chain.

[0188] S428: The Distributed Attribute Authority Chain sends a request for a second-signature public key for the user to the Distributed Digital Identity Chain.

[0189] S429: The distributed digital identity chain requests the user's second signature public key based on the second signature public key.

[0190] S430: The distributed digital identity chain sends the user's second-signature public key to the distributed attribute authority chain.

[0191] S431: The distributed attribute authority chain obtains the user attribute information of the user based on the second signature public key.

[0192] S432: The distributed attribute authority chain sends a query request for user attribute information of the user to the distributed digital identity chain.

[0193] S433: Distributed digital identity chain queries the authenticity of user attribute information of users.

[0194] S434: The distributed digital identity chain sends the verification result when the user's attribute information is true to the distributed attribute authority chain.

[0195] S435: The distributed attribute authority chain sends a second encrypted public key query request for the user to the distributed digital identity chain.

[0196] S436: The distributed digital identity chain obtains the user's second encrypted public key based on the second encrypted public key query request.

[0197] S437: The distributed digital identity chain sends the user's second encrypted public key to the distributed attribute authority chain.

[0198] S438: The distributed attribute authority chain encrypts the data decryption key based on the second encryption public key.

[0199] S439: The distributed attribute authority chain sends the encrypted data decryption key to the user's terminal.

[0200] S440: The user terminal uses its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and uses the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0201] Example 4

[0202] Figure 7 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application. Figure 7 As shown, the data processing device 70 includes: a first receiving module 701, a first sending module 702, a second receiving module 703, a first acquiring module 704, a second sending module 705, a third receiving module 706, a first encryption module 707, and a third sending module 708.

[0203] The first receiving module 701 is used to receive a data encryption key request sent by the provider user terminal, wherein the data encryption key request is generated by the provider user terminal through its own first signature private key;

[0204] The first sending module 702 is used to send a first signature public key request for the provider user to the distributed digital identity chain according to the data encryption key request, so that the distributed digital identity chain can obtain the first signature public key of the provider user according to the first signature public key request.

[0205] The second receiving module 703 is used to receive the first signature public key sent by the distributed digital identity chain;

[0206] The first acquisition module 704 is used to acquire the data encryption key based on the first signature public key;

[0207] The second sending module 705 is used to send a first encrypted public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the first encrypted public key of the provider user according to the first encrypted public key request.

[0208] The third receiving module 706 is used to receive the first encrypted public key sent by the distributed digital identity chain;

[0209] The first encryption module 707 is used to encrypt the data encryption key according to the first encryption public key;

[0210] The third sending module 708 is used to send the encrypted data encryption key to the provider user terminal, so that the provider user terminal can use its own first encryption private key to decrypt the encrypted data encryption key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

[0211] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0212] In one embodiment of this application, the first acquisition module 704 is specifically used to perform signature verification on the first signing public key to determine the provider user to which the first signing public key belongs; and to acquire the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user;

[0213] The second sending module 705 is specifically used to send a first encrypted public key query request for the provider user to the distributed digital identity chain based on the provider user's request.

[0214] In one embodiment of this application, the device 70 further includes:

[0215] The fourth receiving module 709 is used to receive a data decryption key request sent by the user client, wherein the data decryption key request is generated by the user client through its own second signature private key;

[0216] The fourth sending module 710 is used to send a second signature public key request for the user to the distributed digital identity chain according to the data decryption key request, so that the distributed digital identity chain can obtain the user's second signature public key according to the second signature public key request.

[0217] The fifth receiving module 711 is used to receive the second signature public key sent by the distributed digital identity chain;

[0218] The second acquisition module 712 is used to obtain the user attribute information of the user based on the second signature public key;

[0219] The fifth sending module 713 is used to send the user attribute information of the user to the distributed digital identity chain so that the distributed digital identity chain can verify the authenticity of the user attribute information of the user.

[0220] The sixth receiving module 714 is used to receive the verification result sent by the distributed digital identity chain when verifying that the user attribute information of the user is genuine;

[0221] The sixth sending module 715 is used to send a second encrypted public key query request for the user based on the verification result, so that the distributed digital identity chain can obtain the user's second encrypted public key based on the second encrypted public key query request;

[0222] The seventh receiving module 716 is used to receive the second encrypted public key sent by the distributed digital identity chain;

[0223] The second encryption module 717 is used to encrypt the data decryption key according to the second encryption public key;

[0224] The seventh sending module 718 is used to send the encrypted data decryption key to the user terminal, so that the user terminal can use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0225] In one embodiment of this application, the distributed digital identity chain records a first key pair and a second key pair corresponding to each user terminal, as well as user attribute information; wherein the first key pair and the second key pair are key generation requests sent by each user terminal to the distributed digital identity chain; a first key pair and a second key pair are generated for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and the distributed digital identity chain sends the signing private key and encryption private key to the corresponding user terminal; wherein the user attribute information is obtained by the distributed digital identity chain sending a user attribute information request to each user terminal so that each user terminal can obtain its own user attribute information; receiving the user attribute information sent by each user terminal; and recording the user attribute information on the chain, the device 70 further includes:

[0226] The eighth sending module 719 is used to send a data access structure request to each user terminal so that each user terminal can obtain its own data access structure;

[0227] The eighth receiving module 720 is used to receive the data access structure sent by each user terminal; construct an access policy based on the data access structure; and record the access policy in the chain.

[0228] Encapsulation module 721 is used to encapsulate the access policy into a data encryption key and a data decryption key, encrypt the data encryption key and the data decryption key with a symmetric key, and store the data encryption key and the data decryption key on the chain.

[0229] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0230] Figure 8 This is a schematic diagram of the structure of a data processing apparatus provided in another embodiment of this application. Figure 8 As shown, the data processing device 80 includes: a first receiving module 801, a first acquiring module 802, a first sending module 803, a second receiving module 804, a second acquiring module 805, and a second sending module 806.

[0231] The first receiving module 801 receives a first signature public key request for the provider user sent by the distributed attribute authority chain. The first signature public key request for the provider user is generated by the distributed attribute authority chain through receiving a data encryption key request sent by the provider user. The data encryption key request is generated by the provider user through its own first signature private key.

[0232] The first acquisition module 802 is used to acquire the first signature public key of the provider user based on the first signature public key request for the provider user;

[0233] The first sending module 803 is used to send the first signing public key to the distributed attribute authority chain, so that the distributed attribute authority chain can obtain the data encryption key based on the first signing public key;

[0234] The second receiving module 804 is used to receive the first encrypted public key request for the provider user sent by the distributed attribute authority chain;

[0235] The second acquisition module 805 is used to acquire the first encrypted public key of the provider user according to the first encrypted public key request;

[0236] The second sending module 806 is used to send the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal. The encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

[0237] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0238] In one embodiment of this application, the device 80 further includes:

[0239] The third receiving module 807 is used to receive a second signature public key request for the user sent by the distributed attribute authority chain. The second signature public key request for the user is generated by the distributed attribute authority chain through receiving a data decryption key request sent by the user terminal. The data decryption key request is generated by the user terminal through its own second signature private key.

[0240] The third acquisition module 808 is used to acquire the second signature public key based on the second signature public key request for the user.

[0241] The third sending module 809 is used to send the second signature public key to the distributed attribute authority chain, so that the distributed attribute authority chain can obtain the user attribute information of the user based on the second signature public key.

[0242] The fourth receiving module 810 is used to receive query requests for user attribute information sent by the distributed attribute authority chain.

[0243] The judgment module 811 is used to judge the authenticity of the user attribute information based on the query request for the user attribute information of the user.

[0244] The fourth sending module 812, if the attribute is true, is used to send the query result to the distributed attribute authority chain;

[0245] The fifth receiving module 813 is used to receive the second encrypted public key query request for the user sent by the distributed attribute authority chain;

[0246] The fourth acquisition module 814 is used to acquire the second encryption public key;

[0247] The fifth sending module 815 is used to send the second encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data decryption key according to the second encryption public key, and sends the encrypted data decryption key to the user terminal. The encrypted data decryption key is used to instruct the user terminal to use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

[0248] In one embodiment of this application, the device 80 further includes:

[0249] The sixth receiving module 816 is used to receive key generation requests sent by each user terminal;

[0250] The generation module 817 is used to generate a first key pair and a second key pair for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key.

[0251] The sixth sending module 818 is used to send the signing private key and the encryption private key to the corresponding user terminal;

[0252] The seventh sending module 819 is used to send user attribute information requests to each user terminal so that each user terminal can obtain its own user attribute information;

[0253] The seventh receiving module 820 is used to receive user attribute information sent by each user terminal;

[0254] Recording module 821 is used to record user attribute information on the chain;

[0255] The distributed attribute authority chain records data encryption keys and data decryption keys. These keys are used by the distributed attribute authority chain to send data access structure requests to each user terminal, enabling each user terminal to obtain its own data access structure; receive the data access structure sent by each user terminal; construct an access policy based on the data access structure; record the access policy on the chain; encapsulate the access policy into data encryption keys and data decryption keys; encrypt the data encryption keys and data decryption keys using a symmetric key; and store the data encryption keys and data decryption keys on the chain.

[0256] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0257] Example 5

[0258] Figure 9 This is a schematic diagram of the hardware structure of a distributed attribute authority chain server provided in one embodiment of this application. Figure 9 As shown, the distributed attribute authority chain server 90 includes a processor 901 and a memory 902.

[0259] Memory 902 is used to store computer-executed instructions.

[0260] The processor 901 is used to execute computer execution instructions stored in the memory to implement the various steps performed in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0261] Alternatively, the memory 902 can be either standalone or integrated with the processor 901.

[0262] When the memory 902 is set up independently, the distributed attribute authority chain server also includes a bus 903 for connecting the memory 902 and the processor 901.

[0263] Figure 10 This is a schematic diagram of the hardware structure of a distributed digital identity chain server provided in another embodiment of this application. Figure 10 As shown, the distributed digital identity chain server 100 includes a processor 1001 and a memory 1002.

[0264] Memory 1002 is used to store computer-executed instructions.

[0265] The processor 1001 is used to execute computer execution instructions stored in the memory to implement the various steps performed in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0266] Alternatively, the memory 1002 can be either standalone or integrated with the processor 1001.

[0267] When the memory 1002 is set up independently, the distributed digital identity chain server also includes a bus 1003 for connecting the memory 1002 and the processor 1001.

[0268] Example 6

[0269] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the data processing method described above.

[0270] Example 7

[0271] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the data processing method described above.

[0272] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0273] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0274] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0275] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0276] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0277] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0278] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0279] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0280] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0281] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0282] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A data processing method, characterized in that, This method is applied to a distributed attribute authority chain, which records data encryption keys and data decryption keys. The data encryption keys and data decryption keys are used by the distributed attribute authority chain to send data access structure requests to each user terminal so that each user terminal can obtain its own data access structure; and to receive the data access structure sent by each user terminal; to construct an access policy based on the data access structure; and to record the access policy in the chain. The method includes encapsulating the access policy into a data encryption key and a data decryption key, encrypting the data encryption key and the data decryption key with a symmetric key, and storing the data encryption key and the data decryption key on a blockchain. Receive a data encryption key request sent by the provider's user terminal, wherein the data encryption key request is generated by the provider's user terminal by signing its own first signature private key; According to the data encryption key request, a first signature public key request for the provider user is sent to the distributed digital identity chain, so that the distributed digital identity chain obtains the first signature public key of the provider user based on the first signature public key request; wherein, the distributed digital identity chain records a first key pair and a second key pair and user attribute information corresponding to each user terminal; wherein the first key pair and the second key pair are key generation requests sent by each user terminal to the distributed digital identity chain; a first key pair and a second key pair are generated for each user terminal, wherein the first key pair includes the user terminal's signature private key and signature public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and the distributed digital identity chain sends the signature private key and encryption private key to the corresponding user terminal; wherein the user attribute information is obtained by the distributed digital identity chain sending a user attribute information request to each user terminal, so that each user terminal obtains its own user attribute information; receiving the user attribute information sent by each user terminal; and recording the user attribute information on the chain; Receive the first signature public key sent by the distributed digital identity chain; The data encryption key is obtained based on the first signature public key; Send a first encrypted public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the first encrypted public key of the provider user according to the first encrypted public key request; Receive the first encrypted public key sent by the distributed digital identity chain; The data encryption key is encrypted using the first public encryption key; The encrypted data encryption key is sent to the provider's user terminal, so that the provider's user terminal can decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user's user terminal. The step of obtaining the data encryption key based on the first signing public key and sending a first encryption public key request for the provider user includes: The first signing public key is verified to determine the provider user to whom the first signing public key belongs; Obtain the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user; The provider user sends a first encrypted public key query request to the distributed digital identity chain.

2. The method according to claim 1, characterized in that, After sending the encrypted data encryption key to the provider's user terminal, so that the provider's user terminal can decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user's user terminal, the method further includes: Receive a data decryption key request sent by the user client, wherein the data decryption key request is generated by the user client through its own second signature private key; Based on the data decryption key request, a second signature public key request for the user is sent to the distributed digital identity chain, so that the distributed digital identity chain can obtain the user's second signature public key according to the second signature public key request. Receive the second signature public key sent by the distributed digital identity chain; The user attribute information of the user is obtained based on the second signature public key; The user attribute information of the user is sent to the distributed digital identity chain so that the distributed digital identity chain can verify the authenticity of the user attribute information of the user; Receive the verification result sent by the distributed digital identity chain when verifying that the user attribute information of the user is genuine; Based on the verification result, a second encrypted public key query request is sent to the user, so that the distributed digital identity chain can obtain the user's second encrypted public key according to the second encrypted public key query request. Receive the second encrypted public key sent by the distributed digital identity chain; The data decryption key is encrypted using the second encryption public key; The encrypted data decryption key is sent to the user terminal, so that the user terminal can use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

3. The method according to claim 1, characterized in that, Before receiving the data encryption key request sent by the provider's user terminal, the method further includes: Send a data access structure request to each user terminal so that each user terminal can obtain its own data access structure; Receive the data access structure sent by each user terminal; construct an access policy based on the data access structure, and record the access policy in the chain; The access policy is encapsulated into a data encryption key and a data decryption key, and the data encryption key and the data decryption key are encrypted with a symmetric key and stored on the blockchain.

4. A data processing method, characterized in that, This is applied to a distributed digital identity chain, which records a first key pair and a second key pair corresponding to each user terminal, as well as user attribute information; wherein the first key pair and the second key pair are key generation requests sent by each user terminal to the distributed digital identity chain. For each user terminal, a first key pair and a second key pair are generated, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and the distributed digital identity chain sends the signing private key and encryption private key to the corresponding user terminal; wherein the user attribute information is obtained by the distributed digital identity chain sending a user attribute information request to each user terminal so that each user terminal can obtain its own user attribute information; Receive the user attribute information sent by each user terminal; The method for recording the user attribute information on the chain includes: The system receives a first signature public key request for a provider user from a distributed attribute authority chain. This first signature public key request is generated by the distributed attribute authority chain upon receiving a data encryption key request from the provider user. The data encryption key request is generated by the provider user using its own first signature private key. The distributed attribute authority chain records data encryption keys and data decryption keys, which are obtained by the distributed attribute authority chain sending data access structure requests to each user to enable each user to obtain its own data access structure. The system also receives the data access structure from each user. Based on the data access structure, an access policy is constructed and recorded on the chain. The access policy is encapsulated into a data encryption key and a data decryption key, which are then encrypted using a symmetric key and stored on the chain. Based on the first signature public key request for the provider user, obtain the first signature public key of the provider user; Send the first signing public key to the distributed attribute authority chain so that the distributed attribute authority chain can verify the first signing public key to determine the provider user to which the first signing public key belongs, and obtain the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user; Receive the first encrypted public key request for the provider user sent by the distributed attribute authority chain; Based on the first encrypted public key request, obtain the first encrypted public key of the provider user; The first encryption public key is sent to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal. The encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

5. The method according to claim 4, characterized in that, After sending the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal, the encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal, the method further includes: The system receives a second signature public key request for a user from the distributed attribute authority chain, wherein the second signature public key request for the user is generated by the distributed attribute authority chain through receiving a data decryption key request sent by the user terminal; wherein the data decryption key request is generated by the user terminal through its own second signature private key. Obtain the second signature public key based on the second signature public key request for the user; Send the second signing public key to the distributed attribute authority chain so that the distributed attribute authority chain can obtain the user attribute information of the user based on the second signing public key; Receive a query request for user attribute information sent by the distributed attribute authority chain; The authenticity of the user attribute information is determined based on the query request for the user's attribute information. If the attribute is true, send the query result to the distributed attribute authority chain; Receive the second encrypted public key query request for the user sent by the distributed attribute authority chain; Obtain the second public encryption key; The second encryption public key is sent to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data decryption key according to the second encryption public key, and sends the encrypted data decryption key to the user terminal. The encrypted data decryption key is used to instruct the user terminal to use its own second encryption private key to decrypt the encrypted data decryption key to obtain the data decryption key, and use the data decryption key to decrypt the ciphertext data to obtain the transmitted data.

6. The method according to claim 4, characterized in that, Before receiving the first signature public key request for the provider user sent by the distributed attribute authority chain, the process also includes: Receive key generation requests from each user client; For each user terminal, a first key pair and a second key pair are generated, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; Send the signing private key and encryption private key to the corresponding user terminal; Send a user attribute information request to each user terminal so that each user terminal can obtain its own user attribute information; Receive the user attribute information sent by each user terminal; The user attribute information is recorded on the chain.

7. A data processing apparatus, characterized in that, This method is applied to a distributed attribute authority chain, which records data encryption keys and data decryption keys. The data encryption keys and data decryption keys are used by the distributed attribute authority chain to send data access structure requests to each user terminal so that each user terminal can obtain its own data access structure; and to receive the data access structure sent by each user terminal; to construct an access policy based on the data access structure; and to record the access policy in the chain. The access policy is encapsulated into a data encryption key and a data decryption key, and the data encryption key and the data decryption key are encrypted with a symmetric key. The data encryption key and the data decryption key are then stored on a blockchain. The device includes: The first receiving module is used to receive a data encryption key request sent by the provider user terminal, wherein the data encryption key request is generated by the provider user terminal through its own first signature private key; The first sending module is configured to send a first signature public key request for the provider user to the distributed digital identity chain according to the data encryption key request, so that the distributed digital identity chain can obtain the first signature public key of the provider user according to the first signature public key request. The second receiving module is configured to receive the first signing public key sent by the distributed digital identity chain; wherein the distributed digital identity chain records a first key pair and a second key pair and user attribute information corresponding to each user terminal; wherein the first key pair and the second key pair are generated by the distributed digital identity chain receiving key generation requests sent by each user terminal; generating a first key pair and a second key pair for each user terminal, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and sending the signing private key and encryption private key to the corresponding user terminal; wherein the user attribute information is obtained by the distributed digital identity chain sending user attribute information requests to each user terminal so that each user terminal can obtain its own user attribute information; receiving the user attribute information sent by each user terminal; and recording the user attribute information on the chain; The first acquisition module is used to acquire the data encryption key based on the first signature public key; The second sending module is used to send a first encrypted public key request for the provider user to the distributed digital identity chain, so that the distributed digital identity chain can obtain the first encrypted public key of the provider user according to the first encrypted public key request; The third receiving module is used to receive the first encrypted public key sent by the distributed digital identity chain; The first encryption module is used to encrypt the data encryption key according to the first encryption public key; The third sending module is used to send the encrypted data encryption key to the provider user terminal, so that the provider user terminal can use its own first encryption private key to decrypt the encrypted data encryption key to obtain the data encryption key, and use the data encryption key to encrypt the data to be transmitted to generate ciphertext data, and send the encrypted ciphertext data to the user terminal. The first acquisition module is specifically used to perform signature verification on the first signing public key to determine the provider user to which the first signing public key belongs; and to acquire the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user; The second sending module is specifically used to send a first encrypted public key query request for the provider user to the distributed digital identity chain based on the provider user.

8. A data processing apparatus, characterized in that, This is applied to a distributed digital identity chain, which records a first key pair and a second key pair corresponding to each user terminal, as well as user attribute information; wherein the first key pair and the second key pair are key generation requests sent by each user terminal to the distributed digital identity chain. For each user terminal, a first key pair and a second key pair are generated, wherein the first key pair includes the user terminal's signing private key and signing public key, and the second key pair includes the user terminal's encryption private key and encryption public key; and the distributed digital identity chain sends the signing private key and encryption private key to the corresponding user terminal; wherein the user attribute information is obtained by the distributed digital identity chain sending a user attribute information request to each user terminal so that each user terminal can obtain its own user attribute information; Receive the user attribute information sent by each user terminal; The device for recording the user attribute information on the chain includes: The first receiving module receives a first signature public key request for a provider user sent by the distributed attribute authority chain. This first signature public key request is generated by the distributed attribute authority chain upon receiving a data encryption key request sent by the provider user. The data encryption key request is generated by the provider user using its own first signature private key. The distributed attribute authority chain records data encryption keys and data decryption keys. These keys are obtained by the distributed attribute authority chain sending data access structure requests to each user, enabling each user to obtain its own data access structure. The module also receives the data access structure sent by each user. Based on the data access structure, the module constructs an access policy and records the access policy on the chain. The module encapsulates the access policy into a data encryption key and a data decryption key, encrypts the data encryption key and the data decryption key using a symmetric key, and stores the data encryption key and the data decryption key on the chain. The first acquisition module is used to acquire the first signature public key of the provider user according to the first signature public key request for the provider user; A first sending module is configured to send the first signing public key to the distributed attribute authority chain, so that the distributed attribute authority chain can perform signature verification on the first signing public key to determine the provider user to which the first signing public key belongs, and obtain the data access structure of the provider user, wherein the data access structure contains the data encryption key of the provider user; The second receiving module is used to receive the first encrypted public key request for the provider user sent by the distributed attribute authority chain; The second acquisition module is used to acquire the first encrypted public key of the provider user according to the first encrypted public key request; The second sending module is used to send the first encryption public key to the distributed attribute authority chain, so that the distributed attribute authority chain encrypts the data encryption key according to the first encryption public key, and sends the encrypted data encryption key to the provider user terminal. The encrypted data encryption key is used to instruct the provider user terminal to decrypt the encrypted data encryption key using its own first encryption private key to obtain the data encryption key, and to encrypt the transmitted data with the data encryption key to generate ciphertext data, and send the encrypted ciphertext data to the user terminal.

9. A distributed attribute authority chain server, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the data processing method as described in any one of claims 1 to 3.

10. A distributed digital identity chain server, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the data processing method as described in any one of claims 4 to 6.

11. A computer-readable storage medium, characterized in that, The computer storage medium stores computer execution instructions, and when the processor executes the computer execution instructions, it implements the data processing method as described in any one of claims 1 to 3.

12. A computer-readable storage medium, characterized in that, The computer storage medium stores computer execution instructions, and when the processor executes the computer execution instructions, it implements the data processing method as described in any one of claims 4 to 6.

Images