A method, system, apparatus, and electronic device for on-chain data processing on a blockchain

Abstract

Some embodiments of this application provide a method, system, apparatus, and electronic device for processing on-chain data in a blockchain. The method includes: sending a ciphertext request to a notarization gateway; receiving a ciphertext value of a protection key corresponding to the ciphertext request sent by the notarization gateway; and obtaining an on-chain data key based on the ciphertext value of the protection key. The on-chain data key is used to encrypt on-chain data from a business system to obtain encrypted on-chain data, which is stored in the blockchain. The data to be processed is obtained by the business system from original data divided according to a data encryption structure. Some embodiments of this application can improve the security of the on-chain data key, thereby providing security protection for blockchain data.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and more specifically, to a method, system, apparatus, and electronic device for on-chain data processing. Background Technology

[0002] For different business scenarios, blockchain typically involves the business system initiating a data upload request, transmitting the data, and finally saving it on the blockchain.

[0003] Currently, blockchain data processing solutions typically employ data isolation technology to protect on-chain data, allowing only non-isolated users to view it. Alternatively, they use asymmetric keys for double-layer encryption or encrypt attribute fields indiscriminately. However, existing encryption schemes perform both the key and the encryption computation on the same program or system, creating a single point of attack and failing to ensure encryption security, thus compromising the security of blockchain data.

[0004] Therefore, how to provide a technical solution for a highly secure method of on-chain data processing has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of some embodiments of this application is to provide a method, system, apparatus and electronic device for processing blockchain on-chain data. The technical solutions of the embodiments of this application can ensure the security of all keys in the process of storing on-chain data in the blockchain, thereby improving the security of blockchain stored data.

[0006] In a first aspect, some embodiments of this application provide a method for processing on-chain data in a blockchain, comprising: sending a ciphertext request to an evidence storage gateway; receiving a ciphertext value of a protection key corresponding to the ciphertext request sent by the evidence storage gateway; and obtaining an on-chain data key based on the ciphertext value of the protection key, wherein the on-chain data key is used to encrypt the data to be processed in a business system to obtain on-chain encrypted data, the on-chain encrypted data is stored in the blockchain, and the data to be processed is obtained by the business system from the original data according to the data encryption structure.

[0007] Some embodiments of this application obtain a ciphertext value for the protection key by sending a ciphertext request to the evidence storage gateway, and then decrypt the ciphertext value to obtain the on-chain data key, thereby encrypting and storing the on-chain data on the blockchain. Some embodiments of this application obtain the on-chain data key by understanding the relationship between the ciphertext protection key and the on-chain data key, thus achieving security protection for all keys during the process of storing on-chain data on the blockchain, and thereby improving the security of the blockchain stored data.

[0008] In some embodiments, obtaining the on-chain data key based on the ciphertext value of the protection key includes: decrypting the ciphertext value of the protection key using a private key to obtain a protection key, wherein the ciphertext value of the protection key is obtained by encrypting the protection key with the public key corresponding to the private key; and using the protection key as the on-chain data key.

[0009] In some embodiments of this application, the protection key is first encrypted using the public key to obtain a ciphertext value, and then decrypted using the private key to obtain the protection key. Finally, the protection key is used as the on-chain data key. The embodiments of this application improve the security of the protection key by using asymmetric keys for encryption and decryption, thereby enhancing the security of the on-chain data key.

[0010] In some embodiments, obtaining the on-chain data key based on the ciphertext value of the protection key includes: decrypting the ciphertext value of the protection key using a private key to obtain a protection key, wherein the ciphertext value of the protection key is obtained by encrypting the protection key using the public key corresponding to the private key; and decrypting the ciphertext of the on-chain data key using the protection key to obtain the on-chain data key.

[0011] In some embodiments of this application, the protection key is first encrypted using the public key to obtain the ciphertext value of the protection key. Then, the ciphertext value is decrypted using the private key to obtain the protection key. Finally, the protection key is used to decrypt the ciphertext of the on-chain data key to obtain the on-chain data key. This application's embodiments achieve security protection for all keys through mutual encryption and decryption between three layers of keys.

[0012] In some embodiments, before decrypting the ciphertext value of the protection key using the private key, the method further includes: obtaining the private key stored in a third-party key storage device through a third-party key platform interface; or reading the private key from a self-signed certificate of a local key platform.

[0013] Some embodiments of this application can store the private key on different devices or platforms, offering a high degree of flexibility.

[0014] In some embodiments, before sending the encrypted request to the evidence storage gateway, the method further includes: obtaining the encrypted value of the protection key and the associated parameters of the business system; sending the encrypted value of the protection key and the associated parameters to the evidence storage gateway so that the evidence storage gateway can create an account that binds the encrypted value of the protection key and the associated parameters.

[0015] Some embodiments of this application use a certificate storage gateway to bind the encrypted value of the protection key to the associated parameters of the business system, thereby ensuring the security of subsequent data upload to the blockchain.

[0016] In some embodiments, obtaining the ciphertext value of the protection key includes: generating a certificate request file; sending the certificate request file to a certificate authority to generate a digital certificate returned by the certificate authority; or, obtaining a self-signed certificate corresponding to the certificate request file and storing the private key corresponding to the self-signed certificate in a third-party key storage device or a local key platform, wherein the digital certificate or the self-signed certificate corresponds to a private key and a public key; generating a protection key and the on-chain data key, and encrypting the on-chain data key using the protection key to obtain ciphertext of the on-chain data key, wherein the ciphertext of the on-chain data key is stored in the third-party key storage device or the local key platform; and encrypting the protection key using the public key to obtain the ciphertext value of the protection key.

[0017] Some embodiments of this application obtain the corresponding private and public keys by obtaining digital certificates from certificate authorities or by obtaining self-signed certificates. This enables the encryption of the protection key and the on-chain data key, resulting in the ciphertext of the on-chain data key and the ciphertext value of the protection key, thus achieving key security protection.

[0018] In some embodiments, before sending the encrypted request to the evidence storage gateway, the method further includes: generating a certificate request file, a private key, the on-chain data key, and a protection key; encrypting the on-chain data key using the protection key to obtain encrypted on-chain data key, wherein the encrypted on-chain data key is stored in a third-party key storage device or a local key platform; sending the certificate request file, the private key, and the association parameters of the business system to the evidence storage gateway, wherein the evidence storage gateway is used to generate application information corresponding to the certificate request file, the private key, and the association parameters of the business system; the application information is used to enable the evidence storage gateway to send to a certificate authority to obtain a digital certificate from the certificate authority, and then the evidence storage gateway uses the public key corresponding to the digital certificate to encrypt the protection key to obtain encrypted protection key, and creates an account that binds the encrypted protection key and the association parameters.

[0019] Some embodiments of this application send a certificate request file, a private key, and associated parameters of the business system to the evidence storage gateway, enabling the evidence storage gateway to generate application information. Based on the application information, the gateway applies for a digital certificate from the certificate authority. After obtaining the digital certificate, the evidence storage gateway can encrypt the protection key to obtain the protection key ciphertext, thereby binding the protection key ciphertext and associated parameters, achieving key security protection and information binding.

[0020] Secondly, some embodiments of this application provide a method for on-chain data processing, comprising: acquiring data to be processed, wherein the data to be processed is obtained by the business system from original data according to a data encryption structure, the data encryption structure including at least one of plaintext blocks, encrypted field names, and encrypted key-value pairs; encrypting the data to be processed using an on-chain data key obtained by the method described in any embodiment of the first aspect, to obtain encrypted data, wherein the structure of the encrypted data includes at least one of plaintext blocks, encrypted fields, and ciphertext blocks; sending the encrypted data to an evidence storage gateway, so that the evidence storage gateway may upload the encrypted data to the blockchain, or so that the evidence storage gateway may re-encrypt the encrypted data to obtain on-chain encrypted data and upload it to the blockchain.

[0021] In some embodiments, the on-chain data key is also used to decrypt the encrypted data to obtain the original data when the business system queries the data on the blockchain.

[0022] Thirdly, some embodiments of this application provide a blockchain-based on-chain data processing system, comprising: a business system, an encryption / decryption module, an evidence storage gateway, and a blockchain. The encryption / decryption module is integrated within the business system, or the encryption / decryption module is independently deployed and connected to the business system. The business system is used to divide the original data into data to be processed according to a data encryption structure. The encryption / decryption module is used to encrypt the data to be processed using an on-chain data key obtained as described in any embodiment of the first aspect, to obtain encrypted data. The evidence storage gateway is used to upload the encrypted data to the blockchain, or to re-encrypt the encrypted data to obtain on-chain encrypted data and upload it to the blockchain.

[0023] Fourthly, some embodiments of this application provide a blockchain on-chain data processing apparatus, comprising: a sending module for sending a ciphertext request to an evidence storage gateway; a receiving module for receiving a ciphertext value of a protection key corresponding to the ciphertext request sent by the evidence storage gateway; and a key acquisition module for acquiring an on-chain data key based on the ciphertext value of the protection key, wherein the on-chain data key is used to encrypt the data to be processed in the business system to obtain on-chain encrypted data, the on-chain encrypted data is stored in the blockchain, and the data to be processed is obtained by the business system from the original data according to the data encryption structure.

[0024] Fifthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the methods described in any of the embodiments of the first or second aspect.

[0025] In a sixth aspect, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method as described in any embodiment of the first or second aspect.

[0026] In a seventh aspect, some embodiments of this application provide a computer program product comprising a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first or second aspect. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 One of the system diagrams for blockchain on-chain data processing provided for some embodiments of this application;

[0029] Figure 2 System diagram two for blockchain on-chain data processing provided for some embodiments of this application;

[0030] Figure 3 A flowchart illustrating the process of business system 110 accessing data on-chain for some embodiments of this application;

[0031] Figure 4 Flowchart of a method for obtaining the ciphertext value of a protection key provided for some embodiments of this application;

[0032] Figure 5 One of the flowcharts for blockchain on-chain data processing provided in some embodiments of this application;

[0033] Figure 6 This is the second flowchart of a method for processing on-chain data in the blockchain, provided for some embodiments of this application.

[0034] Figure 7 A schematic diagram of the data structure provided for some embodiments of this application;

[0035] Figure 8 Schematic diagrams of the structure of encrypted data provided for some embodiments of this application;

[0036] Figure 9 A flowchart illustrating the process of obtaining on-chain data keys for some embodiments of this application;

[0037] Figure 10 A schematic diagram of the original data encryption process provided for some embodiments of this application;

[0038] Figure 11 A schematic diagram of the on-chain data decryption process provided for some embodiments of this application;

[0039] Figure 12 Flowchart 3 of the method for processing on-chain data in blockchain provided for some embodiments of this application;

[0040] Figure 13 Flowchart four of the methods for processing on-chain data in blockchain provided for some embodiments of this application;

[0041] Figure 14 System architecture diagrams for blockchain on-chain data processing provided for some embodiments of this application;

[0042] Figure 15 A block diagram of an apparatus for on-chain data processing of a blockchain is provided for some embodiments of this application;

[0043] Figure 16 A schematic diagram of an electronic device provided for some embodiments of this application. Detailed Implementation

[0044] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0045] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0046] In related technologies, blockchain currently handles various scenarios by having business systems initiate data upload requests, which are then transmitted and ultimately stored on the blockchain. The uploaded data is stored in the blockchain database; storing it in plaintext can easily lead to data leakage. Existing blockchain data encryption schemes primarily utilize asymmetric keys for two-layer encryption or indiscriminately encrypt attribute fields. However, these schemes are susceptible to single-point-of-speech breaches; by obtaining a stored key file, any node in the upload process can decrypt all associated ciphertext information. To address these issues, the following approaches to encryption schemes and data encryption exist: Current blockchain data protection methods include: 1) Utilizing blockchain data isolation technology, allowing only non-isolated users to view the data; 2) Employing either asymmetric or symmetric encryption for encrypted storage of the uploaded data; 3) Combining asymmetric and symmetric encryption in smart contracts for multi-layered encryption. However, existing data protection technologies are too simplistic, or the encryption keys and computations reside within the same program or system (e.g., smart contracts), creating a single point of attack (e.g., all keys needed for decryption can be obtained locally). Furthermore, the existence of unprofessional key escrow services storing keys in plaintext in local databases poses significant security risks. Additionally, existing encryption schemes lack flexible configuration options for field encryption.

[0047] In view of this, some embodiments of this application provide a method for on-chain data processing. This method obtains the on-chain data key by acquiring the ciphertext of the protection key from the evidence storage gateway, thereby encrypting and storing the data to be processed on the blockchain. The data to be processed is divided according to a data encryption structure. Some embodiments of this application can improve the security of the ciphertext of the protection key and the on-chain data key through the association between them. Dividing the data to be processed through a data decryption structure allows for flexible encryption settings for the original data.

[0048] The following is in conjunction with the appendix Figure 1 The overall structure of a blockchain on-chain data processing system provided by some embodiments of this application is illustrated by way of example.

[0049] like Figure 1 As shown, some embodiments of this application provide a system diagram for blockchain on-chain data processing. The system for blockchain on-chain data processing includes: a business system 110, an evidence storage gateway 120, and a blockchain 130. The business system 110 may also include: an encryption / decryption module 111.

[0050] like Figure 2As shown, some other embodiments of this application provide a system diagram for blockchain on-chain data processing. The system for blockchain on-chain data processing includes: a business system 110, an encryption / decryption module 111, an evidence storage gateway 120, and a blockchain 130.

[0051] It should be noted that, Figure 1 and Figure 2 The encryption / decryption module 111 in the middle can be deployed in different locations. Figure 1 The encryption / decryption module 111 is integrated into the business system 110 to perform encryption / decryption processing on the data to be processed. Figure 2 The encryption / decryption module 111 is external to the business system 110. The business system 110 is connected to the encryption / decryption module 111 to perform encryption / decryption processing on the data to be processed. Specifically, the deployment method of the encryption / decryption module 111 can be determined according to the actual situation, and this embodiment of the application does not make specific limitations.

[0052] The specific functions of each unit are illustrated below.

[0053] In some embodiments of this application, the business system 110 is used to divide the original data into data to be processed according to the data encryption structure. The encryption / decryption module 111 is used to encrypt the data to be processed using the on-chain data key to obtain encrypted data. The evidence storage gateway 120 is used to upload the encrypted data to the blockchain 130, or to encrypt the encrypted data again to obtain on-chain encrypted data and upload it to the blockchain 130.

[0054] To ensure the security of all keys throughout the process of storing the original data on the blockchain, the following exemplary embodiments of this application provide the process for obtaining private keys, public keys, protection keys, and on-chain data keys, as well as the association between different keys.

[0055] It should be noted that for business system 110 to access the evidence storage gateway 120, an account for business system 110 needs to be created in the workbench (related configuration backend) and access configuration data for business system 110 needs to be generated. Business system 110 can use this generated configuration data to access the evidence storage gateway 120 on its own or through the front-end service (that is, through the encryption / decryption module 111).

[0056] The following is in conjunction with the appendix Figure 3 The present application provides an exemplary embodiment of the initialization and binding process of a business system 110 executed by an encryption / decryption module 111 in an evidence storage gateway 120.

[0057] Please see the appendix Figure 3 , Figure 3A flowchart illustrating a method for a business system 110 to access data on the blockchain, provided for some embodiments of this application, includes:

[0058] S310, obtain the ciphertext value of the protection key and the associated parameters of the business system.

[0059] For example, in some embodiments of this application, the associated parameters of the business system 110 include: the identity identifier and authentication method of the business system 110 and other related information.

[0060] The following is in conjunction with the appendix Figure 4 The process of obtaining the ciphertext value of the protection key in S310 is illustrated by example.

[0061] S311, Generate certificate request file.

[0062] For example, in some embodiments of this application, the encryption / decryption module 111 generates a CSR (Certificate Signing Request) file locally.

[0063] In some embodiments of this application, S312 may include: sending the certificate request file to a certificate authority and obtaining a digital certificate from the certificate authority.

[0064] For example, in some embodiments of this application, the encryption / decryption module 111 can use a CSR file as a parameter to request a third-party platform (as a specific example of a certificate authority) or a CA (Certificate Authority, as a specific example of a certificate authority) to generate an account and digital certificate (hereinafter referred to as a certificate). After receiving the application, the third-party platform or CA issues the certificate through the relevant process and binds the account and certificate to the corresponding business system. The certificate corresponds to a pair of asymmetric keys: a private key and a public key. The private key can be generated by a third-party key escrow platform and provided to the third-party platform or CA. Specifically, the configuration can be adjusted according to the actual situation, and the embodiments of this application are not limited to this.

[0065] In other embodiments of this application, S312 may include: obtaining a self-signed certificate corresponding to the certificate request file and storing the self-signed certificate to a third-party key storage device or a local key platform.

[0066] For example, in some other embodiments of this application, the encryption / decryption module 111 can use the CSR file as a parameter to issue a self-signed certificate, and save the relevant self-signed certificate and the corresponding private key and public key on a third-party escrow platform (as a specific example of a third-party key storage device) or a local storage device (as a specific example of a local key platform).

[0067] Specifically, the third-party hosting platform can be... Figure 1 or Figure 2 The business system 110 is connected to an independent platform. Local storage devices can be integrated into... Figure 1 or Figure 2 The sub-devices within the business system 110 are described. This application does not impose specific limitations on the embodiments described herein.

[0068] S313, Generate the protection key and the on-chain data key.

[0069] For example, in some embodiments of this application, the encryption / decryption module 111 uses a cryptographic algorithm to randomly generate two sets of symmetric keys, one set being a protection key and the other set being an on-chain data key.

[0070] S314, the on-chain data key is encrypted using the protection key to obtain the on-chain data key ciphertext, wherein the on-chain data key ciphertext is stored in the third-party key storage device or the local key platform.

[0071] For example, in some embodiments of this application, the encryption / decryption module 111 encrypts the on-chain data key using a protection key to obtain the ciphertext of the on-chain data key and stores it on a third-party hosting platform or a local storage device.

[0072] S315, the protection key is encrypted using the public key to obtain the ciphertext value of the protection key.

[0073] For example, in some embodiments of this application, if the encryption / decryption module 111 obtains a digital certificate through a third-party platform or CA, it uses the public key corresponding to the digital certificate to encrypt the protection key, obtaining the ciphertext value of the protection key. In other embodiments of this application, if the encryption / decryption module 111 obtains a self-signed certificate, it uses the public key corresponding to the self-signed certificate to encrypt the protection key, obtaining the ciphertext value of the protection key. It should be noted that, regardless of whether it is a digital certificate obtained from a third party or a self-signed certificate, the public key corresponding to both can be generated using the same key algorithm. This application does not impose specific limitations on the embodiments herein.

[0074] S320, send the ciphertext value of the protection key and the associated parameter to the evidence storage gateway so that the evidence storage gateway can create an account that binds the ciphertext value of the protection key and the associated parameter.

[0075] For example, in some embodiments of this application, the encryption / decryption module 111 uses the ciphertext value of the protection key and the relevant data of the business system 110 (as a specific example of an association parameter) as parameters to request the evidence storage gateway 120 to create an account and bind the ciphertext value of the protection key and the relevant data of the business system. After the evidence storage gateway 120 completes the account creation and binding, it completes the access process of the business system 110.

[0076] In other embodiments of this application, a method for a business system 110 to access the data uplink process is also provided, the method comprising:

[0077] S1. Generate a certificate request file, a private key, the on-chain data key, and a protection key.

[0078] For example, in some embodiments of this application, the encryption / decryption module 111 generates a CSR, a private key, and two sets of symmetric keys locally, one set being the on-chain data key and the other being the protection key.

[0079] S2. Encrypt the on-chain data key using the protection key to obtain the on-chain data key ciphertext, wherein the on-chain data key ciphertext is stored in a third-party key storage device or a local key platform.

[0080] For example, in some embodiments of this application, the encryption / decryption module 111 uses a protection key to encrypt the on-chain data key and then stores it on a third-party hosting platform or a local storage device.

[0081] S3. Send the certificate request file, the private key, and the association parameters of the business system to the evidence storage gateway. The evidence storage gateway is used to generate application information corresponding to the certificate request file, the private key, and the association parameters of the business system. The application information is used to enable the evidence storage gateway to send to the certificate authority to obtain a digital certificate from the certificate authority. Then, the evidence storage gateway uses the public key corresponding to the digital certificate to encrypt the protection key to obtain the ciphertext of the protection key, and creates an account that binds the ciphertext of the protection key and the association parameters.

[0082] For example, in some embodiments of this application, the above... Figure 3 The difference between this embodiment and the previous one is that the evidence gateway 120 in this embodiment can request a third-party platform or CA to issue a corresponding digital certificate.

[0083] Specifically, the encryption / decryption module 111 sends the generated CSR, private key, and relevant data from the business system as parameters to the evidence storage gateway 120, requesting the gateway to generate application information. Based on the application information, the evidence storage gateway 120 requests a third-party platform or CA to issue the corresponding digital certificate. Upon receiving the application, the third-party key escrow platform issues the certificate through the relevant process and returns the digital certificate and corresponding public key to the evidence storage gateway 120. The evidence storage gateway 120 uses the public key corresponding to the digital certificate to encrypt the protection key, obtaining the ciphertext value. The evidence storage gateway 120 uses the ciphertext value and relevant data from the business system as account association information to create and bind an account. After completing account creation and binding, the evidence storage gateway 120 completes the access process for the business system 110.

[0084] As can be seen from the above embodiments of this application, the embodiments of this application include three sets of keys: an asymmetric key, a protection key, and an on-chain data key. The asymmetric key is used to encrypt and decrypt the protection key, the protection key is used to decrypt and re-decrypt the on-chain data key, and the on-chain data key is used to encrypt and decrypt the data to be processed, achieving encrypted storage of the data. Through the interactive encryption and decryption of the three sets of keys in the embodiments of this application, the security of keys during the blockchain on-chain process can be improved.

[0085] The following is in conjunction with the appendix Figure 5 The present application provides an exemplary embodiment of the specific process of blockchain on-chain data processing performed by the encryption / decryption module 111.

[0086] Please see the appendix Figure 5 , Figure 5 A flowchart of a method for on-chain data processing on a blockchain, provided for some embodiments of this application, includes:

[0087] S410 sends a ciphertext request to the evidence storage gateway.

[0088] For example, in some embodiments of this application, with Figure 1 Taking the system as an example, business system 110 starts the program and then simultaneously starts the built-in encryption / decryption module 111. Furthermore, business system 110 also has a built-in key escrow module (not shown in the figure), which stores the public and private keys used for encrypting and decrypting the protection key. If we consider... Figure 2 Taking the system as an example, if the encryption / decryption module 111 is an independent module, then the startup order of the business system 110 and the encryption / decryption module 111 can be unrestricted. Furthermore, Figure 2 An independent key escrow module can also be set up (not shown in the figure).

[0089] Specifically, the encryption / decryption module 111 sends a ciphertext request to the evidence storage gateway 120 through the key escrow module.

[0090] S420, receive the ciphertext value of the protection key corresponding to the ciphertext request sent by the evidence storage gateway.

[0091] For example, in some embodiments of this application, the evidence storage gateway 120 can feed back the ciphertext value of the protection key corresponding to the ciphertext request to the encryption / decryption module 111. In other embodiments of this application, if the encryption / decryption module 111 does not receive the ciphertext value of the protection key from the evidence storage gateway 120 within a preset time, it needs to perform the business system 110 authentication access process. For details, please refer to the embodiments of the business system 110 access data on-chain process provided above. To avoid repetition, further details are omitted here.

[0092] In some embodiments of this application, before executing S430, the method for processing on-chain data on the blockchain further includes: obtaining the private key stored in a third-party key storage device through a third-party key platform interface; or reading the private key from a self-signed certificate of a local key platform.

[0093] For example, in some embodiments of this application, the encryption / decryption module 111 can obtain the private key corresponding to a third-party key escrow platform, other cryptographic devices, cloud services, or local self-signed certificates through the key escrow module.

[0094] S430, based on the ciphertext value of the protection key, obtain the on-chain data key, wherein the on-chain data key is used to encrypt the data to be processed in the business system to obtain on-chain encrypted data, the on-chain encrypted data is stored in the blockchain, and the data to be processed is obtained by the business system from the original data according to the data encryption structure.

[0095] In some embodiments of this application, S430 may include: decrypting the ciphertext value of the protection key using a private key to obtain a protection key; and using the protection key as the on-chain data key.

[0096] For example, in some embodiments of this application, the encryption / decryption module 111 uses the private key to decrypt the ciphertext value of the protection key to obtain the protection key, and loads the protection key into the memory of the encryption / decryption module 111 as the on-chain data key.

[0097] In some other embodiments of this application, S430 may include: decrypting the ciphertext value of the protection key using a private key to obtain a protection key; and decrypting the ciphertext of the on-chain data key using the protection key to obtain the on-chain data key.

[0098] For example, in some other embodiments of this application, the encryption / decryption module 111 uses the private key to decrypt the ciphertext value of the protection key to obtain the protection key. Then, it uses the protection key to decrypt the encrypted content of the on-chain data key stored on a third-party hosting platform or local related storage device (as a specific example of the ciphertext of the on-chain data key) to obtain the on-chain data key, and loads it into the memory of the encryption / decryption module 111.

[0099] The following is in conjunction with the appendix Figure 6 The present application provides an exemplary embodiment of the specific process of blockchain on-chain data processing performed by the encryption / decryption module 111.

[0100] Please see the appendix Figure 6 , Figure 6 A flowchart of a method for on-chain data processing on a blockchain, provided for some embodiments of this application, includes:

[0101] S510, Obtain the data to be processed, wherein the data to be processed is obtained by the business system from the original data according to the data encryption structure, and the data encryption structure includes at least one of plaintext blocks, encrypted field names and encrypted key-value pairs.

[0102] For example, in some embodiments of this application, the encryption / decryption module 111 can obtain the data to be processed after the business system 110 has processed the original data. It is understood that the data encryption structure may only include plaintext blocks, or the data encryption structure may include plaintext blocks and encrypted field names, or the data encryption structure may also include: plaintext blocks, encrypted field names, and encrypted key-value pairs. The data encryption structure can be set according to actual conditions in the embodiments of this application, and no specific limitations are made here.

[0103] Specifically, the raw data is data generated by business system 110, which is then submitted to... Figure 1 or Figure 2 When the encryption / decryption module 111 in the system is used, it can be done as follows: Figure 7 The data structure shown (as a specific example of a data encryption structure) can be used to construct or maintain the original data format. Figure 7The data structure can be established in several ways: If the original data contains fields that need encryption, place the names of the fields to be encrypted in the "Fields to be encrypted" block; if there are fields that need encryption, place the key-value pairs of the fields to be encrypted directly in the "Key-value pairs to be encrypted" block; if there are fields that need encryption, depending on the situation, place some of the field names to be encrypted in the "Fields to be encrypted" block and some of the key-value pairs directly in the "Key-value pairs to be encrypted" block; for key-value pairs of fields that do not need encryption, the above operations are not required. Alternatively, if the original data format is maintained (i.e., the field names and key-value pairs to be encrypted are not filled in), in practical applications, the fields to be encrypted can be pre-set in the encryption / decryption module 111 or the evidence storage gateway 120, and the relevant modules will perform encryption / decryption operations according to these settings.

[0104] S520, the data to be processed is encrypted using the on-chain data key to obtain encrypted data, wherein the structure of the encrypted data includes at least one of plaintext block, encrypted field and ciphertext block.

[0105] For example, in some embodiments of this application, the on-chain data key can be obtained through the above... Figure 5 The method provided is used to obtain the encrypted data. The encryption / decryption module 111 uses the on-chain data key to encrypt the data to be processed, resulting in encrypted data including: plaintext blocks, ciphertext blocks, fields to be encrypted blocks, and other content (which can be added or expanded according to actual needs). The ciphertext block is part of the encrypted data; all content in the original data that needs to be encrypted is placed in the ciphertext block. The fields to be encrypted blocks, at the same level as the ciphertext blocks, specify which fields in the plaintext need to be encrypted. If the fields to be encrypted blocks specify encrypted fields, the encryption / decryption module 111 requests these fields from the original data from the business system 110, encrypts them, and places them in the ciphertext block. Fields that do not need to be encrypted are placed in the plaintext block, ultimately forming the following structure: Figure 8 The encrypted data is shown. The field names to be encrypted are optional. If no field names are specified, all fields in the ciphertext block are encrypted. Alternatively, the entire ciphertext block can be encrypted. This application does not impose specific limitations on the embodiments described herein.

[0106] It is understood that the structure of encrypted data may include only plaintext blocks, only plaintext blocks and ciphertext blocks, or plaintext blocks, encrypted fields, and ciphertext blocks, etc. In practical applications, the structure can be set according to the actual situation, and this application embodiment does not impose specific limitations.

[0107] S530, send the encrypted data to the evidence storage gateway so that the evidence storage gateway can upload the encrypted data to the blockchain, or so that the evidence storage gateway can re-encrypt the encrypted data to obtain on-chain encrypted data and upload it to the blockchain.

[0108] For example, in some embodiments of this application, the encryption / decryption module 111 sends encrypted data to the evidence storage gateway 120. When uploading data to the blockchain, it can be configured to encrypt all encrypted data to form the final uploaded encrypted data (or uploaded data) submitted to the blockchain. Alternatively, it can be configured to leave all encrypted data unencrypted and directly submit it to the blockchain storage.

[0109] In some embodiments of this application, the on-chain data key is also used to decrypt the encrypted data to obtain the original data when the business system queries the data of the blockchain.

[0110] The following example illustrates the process of obtaining the on-chain data key in S520.

[0111] Please see the appendix Figure 9 , Figure 9 A flowchart for obtaining on-chain data keys is provided for some embodiments of this application. The method includes:

[0112] S810, the encryption / decryption module 111 requests the ciphertext value of the protection key from the evidence storage gateway 120.

[0113] In step S820, the evidence storage gateway 120 returns the ciphertext value of the protection key to the encryption / decryption module 111. Then, steps S831 or S832 are executed.

[0114] S831, the encryption / decryption module 111 obtains the private key from the third-party key platform 112 by calling the third-party key platform interface;

[0115] S832, the encryption / decryption module 111 obtains the private key from the local key platform 113.

[0116] S840, encryption / decryption module 111 uses the private key to decrypt the ciphertext value of the protection key to obtain the protection key.

[0117] S850, encryption / decryption module 111 uses the protection key to decrypt the ciphertext of the on-chain data key, and obtains the on-chain data key.

[0118] S860 loads the on-chain data key into the memory of the encryption / decryption module 111 so that the corresponding data can be encrypted / decrypted using the on-chain data key in the future.

[0119] Specifically, both the local key platform 113 and the encryption / decryption module 111 can be integrated into the business system 110. The third-party key platform 112 is deployed independently of the business system 110. Alternatively, the encryption / decryption module 111 can also be deployed independently of the business system 110. The specific deployment can be flexibly adapted to the actual application, and this embodiment does not impose specific limitations here. Furthermore, the specific implementation details of S810 to S860 can be found in the method embodiments provided above; to avoid repetition, they will not be elaborated upon here.

[0120] The following example illustrates the specific process by which the business system 110 and the encryption / decryption module 111 encrypt and decrypt the original data.

[0121] Please see the appendix Figure 10 The original data shown undergoes an encryption process. The data structure of the original data in business system 110 includes: plaintext blocks, field names to be encrypted, and key-value pairs to be encrypted. Encryption / decryption module 111 processes the data to be processed by business system 110 according to the data structure. For example, the plaintext block data is placed into the plaintext block of the encrypted data without any processing. The field names to be encrypted, the key-value pairs to be encrypted, and the fields to be encrypted in the plaintext block are all encrypted to obtain the ciphertext block. The field names to be encrypted can also be encrypted individually to obtain the fields to be encrypted in the encrypted data. Encryption / decryption module 111 sends the encrypted data to the evidence storage gateway 120, which performs full encryption or no encryption on the encrypted data according to the configuration before uploading it to the blockchain.

[0122] Please see the appendix Figure 11 The process of decrypting on-chain data is shown. If the evidence storage gateway 120 previously fully encrypted the on-chain data, it needs to be decrypted to obtain the encrypted data from the encryption / decryption module 111. The evidence storage gateway 120 can use either a symmetric key or an asymmetric key to fully encrypt or decrypt the encrypted data; this embodiment does not specify a particular key. After obtaining the encrypted data, the encryption / decryption module 111 can use the on-chain data key to decrypt the ciphertext block and the content of the field to be encrypted to obtain the original data.

[0123] The following is in conjunction with the appendix Figure 12 The present application provides an exemplary description of the specific process of blockchain on-chain data processing provided by some embodiments.

[0124] Please see the appendix Figure 12 , Figure 12 A flowchart of a method for on-chain data processing on a blockchain is provided for some embodiments of this application. The following embodiments are implementation flows of data stored in the blockchain 130 by the business system 110. The specific method includes:

[0125] S1001. When business system 110 initiates an on-chain request and integrates the original data according to the data structure, it obtains the data to be processed.

[0126] S1002, the encryption / decryption module 111 uses the on-chain data key to encrypt the data to be processed, obtains the encrypted data, and submits it to the evidence storage gateway 120.

[0127] For example, business system 110 calls encryption / decryption module 111 to encrypt the encrypted blocks of data to be processed, including field-level and encrypted block-level encryption, and then submits it to evidence storage gateway 120.

[0128] S1003, the evidence storage gateway 120 performs full-text encryption on the encrypted data and submits it to the blockchain 130 for storage.

[0129] Please see the appendix Figure 13 , Figure 13 This application provides a flowchart of a method for processing on-chain data in a blockchain, which is part of some embodiments of the present application. The following embodiments illustrate the implementation flow when a business system 110 queries data from blockchain 130. The specific method includes:

[0130] S1004. When the business system 110 initiates a data query request, the blockchain 130 sends the on-chain data to the evidence storage gateway 120.

[0131] S1005, the evidence storage gateway 120 performs full-text decryption of the on-chain data, obtains encrypted data, and submits it to the encryption / decryption module 111.

[0132] S1006, the encryption / decryption module 111 uses the on-chain data key to decrypt the encrypted data and obtain the original data.

[0133] Some embodiments of this application also provide Figure 14 The diagram shows a system architecture diagram for on-chain data processing on a blockchain. The system architecture diagram includes: a key custody device 140, a business system 110 in the business layer, a gateway terminal 121 in the middle layer, and a blockchain 130 in the storage layer.

[0134] Specifically, business system 110 performs basic encryption logic, and its keys are stored and managed through a key management device. Gateway 121 (middle layer) acts as the evidence storage gateway 120, performing configurable encryption operations. Blockchain (storage layer) 130 serves as the data storage endpoint. For the network architecture in blockchain application scenarios (as shown in the diagram), business system 110 can either introduce its own encryption / decryption module 111 or use a standalone encryption / decryption module 111 (also known as a front-end service). Key management devices include dedicated key devices such as signature verification servers and key management devices, as well as secure file storage systems.

[0135] From the embodiments provided above, the following advantages of this application can be observed:

[0136] 1) Improve key security. The business system's key is a pair of asymmetric keys, which are stored in a dedicated device and cross-encrypted for storage. The public key of the business system key encrypts the protection key, and the private key is used to decrypt it during loading. The on-chain data key is encrypted and decrypted using the protection key. This is different from storing the key in plaintext, which would allow the key to be directly encrypted and decrypted after being stolen, greatly preventing key leakage.

[0137] 2) To prevent single-point attacks, keys are stored in different environments. Based on the cross-locking formed by mutual encryption of keys, it is impossible to directly obtain the plaintext key at a single point (system or device) (because of the cross-encryption of keys as mentioned in point 1). Furthermore, even if the plaintext key is obtained, it cannot be directly decrypted from the encrypted data, thus protecting data security. For example, encrypted data is obtained on the blockchain, but the on-chain data key is stored in the business system. This on-chain data key is encrypted with a protection key, which is stored in the repository corresponding to the evidence storage gateway. The protection key is encrypted using the public key of the business system key, which is stored in a professional key hosting device. Therefore, to crack the encryption key of the data, all services in the entire on-chain process must be cracked before decryption can be performed.

[0138] 3) Based on multi-service environment cross-multi-layer encryption, at the business system layer, two layers of encryption are performed: field-level encryption and ciphertext block encryption (optional, one, two, or more layers, depending on the number of on-chain data keys). Plaintext is shielded starting from the business layer, and all plaintext information can only exist in the business system. The business layer data is transmitted to the gateway layer, which encrypts the on-chain data (including plaintext blocks and ciphertext blocks) (optional), and finally submits it to the blockchain database.

[0139] 4) The optimized data structure enables optional field encryption. Since the on-chain data contains metadata or publicly available data, it may be displayed on public service platforms (such as portals) or provided to authoritative institutional systems for data calculation and statistics. This invention's solution allows for flexible field selection, specifying ciphertext block fields to define the content to be encrypted while retaining metadata and plaintext fields. This offers greater flexibility, and the specification is done by the business system. Each on-chain data entry can contain different content to be encrypted, unlike typical encryption schemes that encrypt all content, resulting in lower flexibility and scalability.

[0140] Please refer to Figure 15 , Figure 15The diagram illustrates a block diagram of an apparatus for on-chain data processing of a blockchain, provided in some embodiments of this application. It should be understood that this apparatus corresponds to the method embodiments described above and is capable of performing the various steps involved in the method embodiments. The specific functions of this apparatus can be found in the description above; detailed descriptions are omitted here to avoid repetition.

[0141] Figure 15 The blockchain on-chain data processing device includes at least one software functional module that can be stored in a memory or embedded in the blockchain on-chain data processing device in the form of software or firmware. The blockchain on-chain data processing device includes: a sending module 1410, used to send a ciphertext request to the evidence storage gateway; a receiving module 1420, used to receive a ciphertext value of a protection key corresponding to the ciphertext request sent by the evidence storage gateway; and a key acquisition module 1430, used to acquire an on-chain data key based on the ciphertext value of the protection key. The on-chain data key is used to encrypt the data to be processed in the business system to obtain on-chain encrypted data. The on-chain encrypted data is stored in the blockchain. The data to be processed is obtained by the business system from the original data according to the data encryption structure.

[0142] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0143] Some embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the methods provided in the above embodiments.

[0144] Some embodiments of this application also provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the above embodiments provided in the above embodiments.

[0145] like Figure 16 As shown, some embodiments of this application provide an electronic device 1500, which includes: a memory 1510, a processor 1520, and a computer program stored in the memory 1510 and executable on the processor 1520, wherein the processor 1520 can implement the methods of any of the above embodiments when it reads the program from the memory 1510 via a bus 1530 and executes the program.

[0146] Processor 1520 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 1520 can be a microprocessor.

[0147] Memory 1510 can be used to store instructions executed by processor 1520 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. Processor 1520 of this disclosure embodiment can be used to execute instructions in memory 1510 to implement the methods shown above. Memory 1510 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0148] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0149] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0150] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for processing on-chain data in a blockchain, characterized in that, include: Send a encrypted request to the evidence storage gateway; Receive the ciphertext value of the protection key corresponding to the ciphertext request sent by the evidence storage gateway; Based on the ciphertext value of the protection key, an on-chain data key is obtained, wherein the on-chain data key is used to encrypt the data to be processed in the business system to obtain on-chain encrypted data, the on-chain encrypted data is stored in the blockchain, and the data to be processed is obtained by the business system from the original data according to the data encryption structure; The step of obtaining the on-chain data key based on the ciphertext value of the protection key includes: decrypting the ciphertext value of the protection key using a private key to obtain a protection key, wherein the ciphertext value of the protection key is obtained by encrypting the protection key using the public key corresponding to the private key, and the private key is read from a self-signed certificate of a local key platform; or, receiving the protection key sent by a third-party key storage device, wherein the protection key is obtained by decrypting the ciphertext value of the protection key using the private key of the third-party key storage device; and decrypting the ciphertext of the on-chain data key using the protection key to obtain the on-chain data key; wherein the private key is read from a self-signed certificate of the local key platform or obtained from the third-party key storage device, and the ciphertext value of the protection key is stored in the evidence storage gateway; Before sending the encrypted request to the evidence storage gateway, the method further includes: generating a certificate request file, the on-chain data key, and a protection key; encrypting the on-chain data key using the protection key to obtain encrypted on-chain data key, wherein the encrypted on-chain data key is stored in a third-party key storage device or a local key platform; sending the certificate request file and the association parameters of the business system to the evidence storage gateway, wherein the evidence storage gateway is used to generate application information corresponding to the certificate request file and the association parameters of the business system; the application information is used to enable the evidence storage gateway to send to a certificate authority to obtain a digital certificate from the certificate authority, and then the evidence storage gateway uses the public key corresponding to the digital certificate to encrypt the protection key to obtain encrypted protection key, and creates an account that binds the encrypted protection key and the association parameters.

2. The method as described in claim 1, characterized in that, Before sending the encrypted request to the evidence storage gateway, the method further includes: Obtain the ciphertext value of the protection key and the associated parameters of the business system; The protection key ciphertext value and the associated parameter are sent to the evidence storage gateway so that the evidence storage gateway can create an account that binds the protection key ciphertext value and the associated parameter.

3. The method as described in claim 2, characterized in that, The step of obtaining the ciphertext value of the protection key includes: Generate a certificate request file; Send the certificate request file to the certificate authority to obtain the digital certificate and key pair returned by the certificate authority; or, generate a self-signed certificate and key pair corresponding to the certificate request file and store the private key corresponding to the self-signed certificate to a third-party key storage device or local key platform. The key pair includes the on-chain data key and the protection key, and the digital certificate or the self-signed certificate has a private key and a public key. The on-chain data key is encrypted using the protection key to obtain the on-chain data key ciphertext, wherein the on-chain data key ciphertext is stored in the third-party key storage device or the local key platform; The protection key is encrypted using the public key to obtain the ciphertext value of the protection key.

4. A method for processing on-chain data in a blockchain, characterized in that, include: Read data from the raw data, wherein the data includes at least one of: plaintext blocks, encrypted field names, and encrypted key-value pairs; The encrypted field name and the encrypted key-value pair are encrypted using the on-chain data key obtained by the method described in any one of claims 1 to 3 to obtain encrypted data. Send the encrypted data and the plaintext block to the evidence storage gateway so that the evidence storage gateway can upload the encrypted data and the plaintext block to the blockchain, or so that the evidence storage gateway can re-encrypt the encrypted data and the plaintext block to obtain on-chain encrypted data and upload it to the blockchain; The on-chain data key is also used to decrypt the encrypted data to obtain the original data when the business system queries the data on the blockchain.

5. A system for on-chain data processing on a blockchain, characterized in that, include: The system includes a business system, an encryption / decryption module, an evidence storage gateway, and a blockchain. The encryption / decryption module is integrated within the business system, or the encryption / decryption module is deployed and connected independently to the business system. The business system is used to divide the raw data into data to be processed according to the data encryption structure. The encryption / decryption module is used to encrypt the data to be processed using the on-chain data key obtained by the method described in any one of claims 1 to 3, thereby obtaining encrypted data; The evidence storage gateway is used to upload the encrypted data to the blockchain, or to encrypt the encrypted data again to obtain on-chain encrypted data and upload it to the blockchain.

6. A device for on-chain data processing on a blockchain, characterized in that, include: The sending module is used to send encrypted requests to the evidence storage gateway; The receiving module is used to receive the ciphertext value of the protection key corresponding to the ciphertext request sent by the evidence storage gateway; The key acquisition module is used to acquire the on-chain data key based on the protection key ciphertext value. The on-chain data key is used to encrypt the data to be processed in the business system to obtain on-chain encrypted data. The on-chain encrypted data is stored in the blockchain. The data to be processed is obtained by the business system from the original data according to the data encryption structure. The step of obtaining the on-chain data key based on the ciphertext value of the protection key includes: decrypting the ciphertext value of the protection key using a private key to obtain a protection key, wherein the ciphertext value of the protection key is obtained by encrypting the protection key using the public key corresponding to the private key, and the private key is read from a self-signed certificate of a local key platform; or, receiving the protection key sent by a third-party key storage device, wherein the protection key is obtained by decrypting the ciphertext value of the protection key using the private key of the third-party key storage device; and decrypting the ciphertext of the on-chain data key using the protection key to obtain the on-chain data key; wherein the private key is read from a self-signed certificate of the local key platform or obtained from the third-party key storage device, and the ciphertext value of the protection key is stored in the evidence storage gateway; Before sending the encrypted request to the evidence storage gateway, a certificate request file, the on-chain data key, and a protection key are generated. The on-chain data key is encrypted using the protection key to obtain encrypted on-chain data key, which is stored in a third-party key storage device or a local key platform. The certificate request file and the associated parameters of the business system are sent to the evidence storage gateway, whereby the evidence storage gateway generates application information corresponding to the certificate request file and the associated parameters of the business system. The application information is used to enable the evidence storage gateway to send to a certificate authority to obtain a digital certificate from the certificate authority. Then, the evidence storage gateway uses the public key corresponding to the digital certificate to encrypt the protection key to obtain encrypted protection key, and creates an account that binds the encrypted protection key and the associated parameters.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, performs the method as described in any one of claims 1-4.

8. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the computer program is executed by the processor to perform the method as described in any one of claims 1-4.

Images