A data processing system for consortium chain

Abstract

The application discloses a kind of data processing systems for alliance chain, it is related to computer technology field, the system includes: data creation module is verified to data creation request and head node certificate, when the verification result meets preset requirement, call encryption service according to the algorithm of the organization configured to the organization ID of chain user Data plaintext is encrypted;Data update module is verified to data update request and head node certificate, when the verification result meets preset requirement, call encryption service according to the algorithm of the organization configured to the organization ID of chain user Chain data is encrypted and updated;Data query module is verified to data query request and head node certificate, when the verification result meets preset requirement, call decryption service according to the algorithm of the organization configured to the organization ID of chain user Target data is decrypted, and the data after decryption is obtained.The application can improve the security and reliability of data when alliance chain is in data storage.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a data processing system for consortium blockchains. Background Technology

[0002] With the development of consortium blockchain systems, some blockchain applications have been implemented in daily life. However, the currently implemented systems generally have the following problems: (1) Most of the current applications of consortium blockchain systems are used for data storage, that is, to use the blockchain system as a trusted database to store data. However, due to the computing power bottleneck and storage bottleneck of blockchain nodes, the efficiency of data access on the blockchain is not high. (2) Currently, most of the data stored on consortium blockchains is directly stored on the blockchain in serialized or other digital forms without any encryption. This allows any smart terminal that can access the chain to arbitrarily obtain information on the chain. The privacy of users on the chain is easily exposed.

[0003] Therefore, there is an urgent need for a data encryption storage and retrieval system that can improve the security and reliability of data during data notarization in consortium blockchains. Summary of the Invention

[0004] To address the aforementioned issues in the practical application of consortium blockchain systems, this invention provides a data processing system for consortium blockchains, which can improve the security and reliability of data during data storage.

[0005] To achieve the above objectives, the present invention provides the following solution:

[0006] A data processing system for consortium blockchains, the system comprising a data creation module, a data update module, and a data query module;

[0007] The data creation module is used to receive data creation requests from on-chain users, verify the data creation requests and header node certificates, and when the verification result meets preset requirements, receive plaintext data sent by the on-chain user, call the encryption service to encrypt the plaintext data according to the algorithm configured for the organization corresponding to the on-chain user's organization ID, store the encrypted plaintext data and the on-chain user's organization ID in the first block, receive the returned hash value of the encrypted plaintext data, and synchronize the first block to the consensus node, whereby the consensus node verifies the first block and stores the verified first block in the blockchain; the data creation request includes the on-chain user's signature, data primary key certificate information, and request timestamp;

[0008] The data update module is used to receive data update requests from on-chain users and on-chain data sent by on-chain users, and to verify the data update requests and the header node certificate. When the verification result meets the preset requirements, the module calls the encryption service to encrypt and update the on-chain data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user. The encrypted on-chain data and the organization ID of the on-chain user are stored in the second block. The module also receives the returned hash value of the encrypted on-chain data and synchronizes the second block to the consensus node. The consensus node verifies the second block and stores the verified second block in the blockchain. The data update request includes the on-chain user's signature information, data primary key certificate information, the hash value of the original ciphertext data stored in the data primary key, and the request timestamp.

[0009] The data query module is connected to both the data creation module and the data update module. The data query module receives data query requests from on-chain users and verifies the data query request and the header node certificate. When the verification result meets preset requirements, it calls the decryption service to decrypt the target data according to the algorithm configured for the organization ID corresponding to the on-chain user, obtaining the decrypted data. The query record is then stored in a third block, and the third block is sent to a consensus node for verification. The consensus node then stores the verified third block in the blockchain. The data query request includes the on-chain user's signature information, data primary key certificate information, and a request timestamp. The target data is the data record found in the blockchain based on the data primary key of the on-chain user's data primary key certificate information.

[0010] Optionally, the data creation module includes a data creation request receiving module, a data creation header node verification module, a data creation data encryption module, and a data creation block generation and on-chain module connected in sequence.

[0011] The data creation receiving request module is used to receive data creation requests from on-chain users and plaintext data sent by on-chain users, and send the data creation request and the plaintext data to the head node; the data creation request includes the on-chain user's signature, data primary key certificate information and request timestamp;

[0012] The data creation header node verification module is used to verify the data creation request and the header node certificate through the header node, and send the verification result to the data creation data encryption module.

[0013] The data creation encryption module is used to call the encryption service to encrypt the plaintext data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user when the verification result meets the preset requirements, store the encrypted plaintext data and the organization ID of the on-chain user in the first block, receive the returned hash value of the encrypted plaintext data, and send the first block to the data creation block output and on-chain module.

[0014] The data creation and blockchain module is used to synchronize the first block to the consensus node, which verifies the first block and stores the verified first block on the blockchain.

[0015] Optionally, the process of verifying the data creation request and the header node certificate includes:

[0016] Determine whether the requested timestamp has expired;

[0017] If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node;

[0018] When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index;

[0019] If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the data primary key certificate information is in the blockchain;

[0020] The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the data primary key certificate information is not in the blockchain;

[0021] Otherwise, the verification result is "failed".

[0022] Optionally, the head node receives plaintext data sent by the on-chain user via an SSH channel.

[0023] Optionally, the invocation of the encryption service encrypts the plaintext data using the encryption public key of the head node according to the RSA algorithm configured for the organization corresponding to the organization ID of the on-chain user.

[0024] Optionally, the system further includes a database storage module;

[0025] The database storage module is connected to the data creation module, the data update module, and the data query module, respectively.

[0026] The database storage module is used to save the data stored on the blockchain to the backend database.

[0027] Optionally, the data update module includes a data update receiving request module, a data update header node verification module, a data update data encryption module, and a data update block generation and on-chain module connected in sequence.

[0028] The data update receiving request module is used to receive the data update request from the on-chain user and the on-chain data sent by the on-chain user, and send the data update request and the on-chain data to the head node; the data update request includes the on-chain user's signature information, data primary key certificate information, hash value of the original ciphertext data stored in the data primary key, and request timestamp;

[0029] The data update header node verification module is used to verify the data update request and the header node certificate through the header node, and send the verification result to the data update data encryption module.

[0030] The data update and data encryption module is used to call the encryption service to encrypt and update the on-chain data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user when the verification result meets the preset requirements. The encrypted on-chain data and the organization ID of the on-chain user are stored in the second block, and the hash value of the encrypted on-chain data is received. The second block is sent to the data update block output and on-chain module.

[0031] The data update block generation and on-chain module is used to synchronize the second block to the consensus node, whereby the consensus node verifies the second block and stores the verified second block on the blockchain.

[0032] Optionally, the data query module includes a data query request receiving module, a data query header node verification module, a data query data encryption module, and a data query block output and on-chain module connected in sequence.

[0033] The data query request receiving module is connected to the data creation module and the data update module respectively; the data query request receiving module is used to receive the data query request of the on-chain user and send the data query request to the head node; the data query request includes the on-chain user's signature information, data primary key certificate information and request timestamp;

[0034] The data query header node verification module is used to verify the data query request and the header node certificate through the header node, and send the verification result to the data query data encryption module.

[0035] The data query user data encryption module is used to call the decryption service to decrypt the target data according to the algorithm configured by the organization corresponding to the organization ID on the chain when the verification result meets the preset requirements, obtain the decrypted data, store the query record in the third block, and send the third block to the data query block output and on-chain module; the target data is the data record found in the blockchain based on the data primary key of the user's data primary key certificate information on the chain.

[0036] The data query block generation and on-chain module is used to send the third block to the consensus node, which verifies the third block and stores the verified third block on the blockchain.

[0037] Optionally, the process of verifying the data update request and the header node certificate includes:

[0038] Determine whether the requested timestamp has expired;

[0039] If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node;

[0040] When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index;

[0041] If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the data primary key certificate information is in the blockchain;

[0042] When the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the data primary key certificate information is in the blockchain, determine whether the hash value of the on-chain data stored in the data primary key matches the hash value of the encrypted on-chain data.

[0043] The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, the data primary key certificate information is in the blockchain, and the hash value of the on-chain data stored in the data primary key matches the hash value of the encrypted on-chain data.

[0044] Otherwise, the verification result is "failed".

[0045] Optionally, the process of verifying the data query request and the header node certificate includes:

[0046] Determine whether the requested timestamp has expired;

[0047] If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node;

[0048] When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index;

[0049] When the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the corresponding data record can be found in the blockchain based on the data primary key certificate information of the target data;

[0050] The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the corresponding data record can be found in the blockchain based on the data primary key certificate information of the target data;

[0051] Otherwise, the verification result is "failed".

[0052] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0053] This invention verifies data creation requests and header node certificates through a data creation module. When the verification result meets preset requirements, it calls an encryption service to encrypt the plaintext data according to the algorithm configured for the organization corresponding to the on-chain user's organization ID. It also verifies data update requests and header node certificates through a data update module. When the verification result meets preset requirements, it calls an encryption service to encrypt and update the on-chain data according to the algorithm configured for the organization corresponding to the on-chain user's organization ID. Finally, it verifies data query requests and header node certificates through a data query module. When the verification result meets preset requirements, it calls a decryption service to decrypt the target data according to the algorithm configured for the organization corresponding to the on-chain user's organization ID, thus obtaining the decrypted data. Therefore, this invention can improve the security and reliability of data during data storage in consortium blockchains. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a schematic diagram of the data processing system architecture for consortium blockchains according to the present invention. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] The purpose of this invention is to provide a data processing system for consortium blockchains that can improve the security and reliability of data during data notarization.

[0058] To achieve encrypted storage, retrieval, and secure sharing of data, this invention proposes a data encryption storage and retrieval scheme for consortium blockchains. Designed based on a consortium blockchain system, it enhances the security and trustworthiness of data during data storage.

[0059] Explanation of the relevant definitions:

[0060] Definition 1: Consortium blockchain network.

[0061] Consortium blockchains are a type of blockchain categorized from an access control perspective. Unlike public blockchains such as those used for cryptocurrencies, consortium blockchains employ an access control mechanism based on cryptographic certificates and Certificate Authorities (CAs). Only organizations and nodes authorized by the CA can join the consortium blockchain network. The consortium blockchain ledger comprises two parts: a state database ledger and a historical chained database ledger. This invention designs a unique data encryption storage and retrieval method based on the consortium blockchain's unique access control mechanism. Each organization on the chain can choose a specific access control mechanism for storage according to its own needs, and queries also require a unified data decryption and retrieval method based on smart contracts, agreed upon by all organizations.

[0062] Definition 2: Smart Contracts.

[0063] A smart contract is a computer program deployed on a blockchain network that can execute correctly without relying on a centralized server. By pre-defining the contract's content, the program automatically executes the contract when the triggering conditions are met. This invention uses smart contracts for data encryption / decryption, data uploading to the blockchain, and data querying.

[0064] Definition 3: Transaction.

[0065] In a public blockchain, a transaction refers to a set of digital signatures representing the transfer of ownership of digital currency. This invention is based on a consortium blockchain, and the transactions referred to here are blockchain records used for data upload requests, encrypted data transactions, and query results interacting with consortium blockchain smart contracts, ensuring transparency in the upload process and preventing the leakage of data meaning. This invention mainly includes three types of transactions: data creation transactions, data modification transactions, and data query transactions.

[0066] Among them, data information creation transactions are blockchain interaction requests that encrypt and store data on-chain according to organizational configuration, and record the on-chain results and encrypted information on the blockchain carrier.

[0067] Data modification transactions involve modifying data according to organizational configurations, encrypting the modified data, storing it on-chain, and recording the on-chain results and encrypted information on a blockchain carrier.

[0068] Data information query transactions involve modifying data according to organizational configurations, decrypting the retrieved data, and storing the query results and process information on a blockchain platform.

[0069] Definition 4: Client.

[0070] This refers to the software or interface through which system users interact with the consortium blockchain. Its function is to send data requests to the blockchain network, trigger transactions and contract execution, and receive information returned by the blockchain network.

[0071] Definition 5: Organizational configuration.

[0072] The organization configuration is a configuration file deployed on the server where the organization node resides. It contains the keys, certificate paths, and algorithm information used for data encryption and decryption.

[0073] Definition 6: Head node.

[0074] This refers to the leader node within a consortium blockchain organization. In the system described in this invention, user interaction requests sent by clients are first processed by the leader node.

[0075] Definition 7: Data encryption / decryption contract.

[0076] Smart contracts are used for data encryption and decryption. Their characteristics include:

[0077] 1. Including contract methods related to encrypted data storage.

[0078] 2. Encryption methods can encrypt data using different methods according to user requests.

[0079] 3. The query method can decrypt on-chain data based on user requests, encryption algorithms, and organization node key information.

[0080] The encryption / decryption contract can read the organizational configuration of each organizational node and call the relevant encryption algorithm according to the organizational configuration to complete the data encryption storage and decryption query.

[0081] Definition 8: Backend database.

[0082] The backend database refers to a relational database that records the data stored on the consortium blockchain. It contains the primary key information, timestamps, and encrypted hash values ​​of the data stored on the blockchain. Its function is to query the primary key information at the time of data modification. This avoids the throughput bottleneck of the blockchain and improves the efficiency of data legitimacy verification.

[0083] Definition 9: SSH tunnel.

[0084] An SSH tunnel is an encrypted data transmission channel established between the head nodes and ordinary nodes of various organizations, used to transmit data in plaintext.

[0085] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0086] Example 1

[0087] like Figure 1 As shown, the present invention provides a data processing system for consortium blockchains, the system including a data creation module, a data update module, and a data query module.

[0088] The data creation module is used to receive data creation requests from on-chain users and verify the data creation requests and header node certificates. When the verification result meets the preset requirements, it receives the plaintext data sent by the on-chain user, calls the encryption service to encrypt the plaintext data according to the algorithm configured for the organization corresponding to the on-chain user's organization ID, stores the encrypted plaintext data and the on-chain user's organization ID in the first block, receives the returned hash value of the encrypted plaintext data, and synchronizes the first block to the consensus node. The consensus node verifies the first block and stores the verified first block in the blockchain. The data creation request includes the on-chain user's signature, data primary key certificate information, and request timestamp.

[0089] The data update module is used to receive data update requests from on-chain users and on-chain data sent by on-chain users, and to verify the data update requests and the header node certificate. When the verification result meets the preset requirements, the module calls the encryption service to encrypt and update the on-chain data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user. The encrypted on-chain data and the organization ID of the on-chain user are stored in the second block. The module also receives the returned hash value of the encrypted on-chain data and synchronizes the second block to the consensus node. The consensus node verifies the second block and stores the verified second block in the blockchain. The data update request includes the on-chain user's signature information, data primary key certificate information, the hash value of the original ciphertext data stored in the data primary key, and the request timestamp.

[0090] The data query module is connected to both the data creation module and the data update module. The data query module receives data query requests from on-chain users and verifies the data query request and the header node certificate. When the verification result meets preset requirements, it calls the decryption service to decrypt the target data according to the algorithm configured for the organization ID corresponding to the on-chain user, obtaining the decrypted data. The query record is then stored in a third block, and the third block is sent to a consensus node for verification. The consensus node then stores the verified third block in the blockchain. The data query request includes the on-chain user's signature information, data primary key certificate information, and a request timestamp. The target data is the data record found in the blockchain based on the data primary key of the on-chain user's data primary key certificate information.

[0091] In practical applications, the data processing system for consortium blockchains includes functions such as: 1. system initialization and user registration; 2. data creation; 3. data update (modification); and 4. data query. The above processes are described in detail below.

[0092] Specifically, this embodiment elaborates on the data encryption and querying of the present invention when the base chain is Chang'an Chain, there are 4 consensus nodes, 4 organizations, 1 head node in each organization, and 3 ordinary nodes.

[0093] 1. System initialization and user registration.

[0094] 1.1 Consensus Node Deployment.

[0095] Before using the system, the blockchain code must first be deployed and started. A server that has been successfully deployed and started is called a blockchain consensus node. Based on the PBFT algorithm commonly used in consortium blockchains, which uses a 3f+1 fault-tolerant model, four consensus nodes are required to ensure the availability of the blockchain system.

[0096] Specifically, the consensus nodes required for the consortium blockchain are deployed on the selected servers. In this embodiment, four consensus nodes are deployed on a single machine using a mirroring method to handle the consensus process.

[0097] 1.2 New organizations and nodes.

[0098] Once the consensus nodes are deployed, the parties using the blockchain create organizations within the blockchain and deploy and add nodes. Each party determines the hardware device where the head node will be located based on its own circumstances and deploys it.

[0099] Specifically, the command-line tool (cmc) of Chang'an Chain is used to generate four organization root certificate files, with organization IDs of 001, 002, 003, and 004 respectively. These four organizations are then added to the blockchains of the four consensus nodes. After adding the organizations, one head node image and three ordinary node images are deployed on the server containing each organization's root certificate.

[0100] 1.3 Add organization configuration.

[0101] Once the head node is deployed, the head node maintainers will construct the organization configuration. The organization configuration includes:

[0102] Organization information: including organization ID, organization CA certificate path, and organization trusted root certificate path.

[0103] Grpc communication information: including the grpc IP address and port number of the node connection.

[0104] Header node information: includes the private key and certificate file of the head node.

[0105] Encryption service information: This includes the name of the asymmetric encryption algorithm used by the organization for encryption and decryption, and the file paths where the private and public keys are located.

[0106] Backend database information: The backend database used to record data encryption, decryption, and updates.

[0107] Specifically, once the head nodes are deployed, the head node maintenance personnel will construct and organize the configuration, which will be added to the installation package (.yml) of each head node in the form of a configuration file.

[0108] Organizational configuration includes:

[0109] Organization information: including organization ID, organization CA certificate path, and organization trusted root certificate path.

[0110] Grpc communication information: including the grpc IP address and port number of the node connection.

[0111] Header node information: includes the private key and certificate file of the head node.

[0112] Encryption service information: This includes the name of the asymmetric encryption algorithm used by the organization for encryption and decryption, and the file paths where the private and public keys are located.

[0113] Backend database information: The backend database used to record data encryption, decryption, and updates.

[0114] 1.4 Encryption service started.

[0115] After the organization configuration is added, the head node maintainer restarts the blockchain service, and the blockchain automatically starts the encryption service based on the organization configuration information.

[0116] 1.5 Client startup.

[0117] Organizations using blockchain deploy the necessary images for blockchain nodes on smart terminals, launch clients based on the image configuration information, and can call SDK methods within them.

[0118] 1.6 User registration.

[0119] Each node uses the client to generate a user's private key, public key, and certificate, and completes user registration. After registration, an SSH tunnel is established using the organization's p2p network for transmitting plaintext data.

[0120] In one specific implementation, the data creation module includes a data creation request receiving module, a data creation header node verification module, a data creation encryption module, and a data creation block generation and on-chain module connected in sequence.

[0121] The data creation receiving request module is used to receive data creation requests from on-chain users and plaintext data sent by the on-chain users, and send the data creation request and the plaintext data to the head node; the data creation request includes the on-chain user's signature, data primary key certificate information and request timestamp.

[0122] The data creation header node verification module is used to verify the data creation request and the header node certificate through the header node, and send the verification result to the data creation data encryption module.

[0123] The data creation encryption module is used to call the encryption service to encrypt the plaintext data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user when the verification result meets the preset requirements, store the encrypted plaintext data and the organization ID of the on-chain user in the first block, receive the returned hash value of the encrypted plaintext data, and send the first block to the data creation block output and on-chain module.

[0124] The data creation and blockchain module is used to synchronize the first block to the consensus node, which verifies the first block and stores the verified first block on the blockchain.

[0125] As a specific implementation method, the process of verifying the data creation request and the header node certificate includes:

[0126] Determine whether the requested timestamp has expired.

[0127] If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node.

[0128] When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index.

[0129] If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the data primary key certificate information is in the blockchain.

[0130] The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the data primary key certificate information is not in the blockchain.

[0131] Otherwise, the verification result is "failed".

[0132] In one specific implementation, the head node receives plaintext data sent by the on-chain user via an SSH channel.

[0133] As a specific implementation, the invocation of the encryption service encrypts the plaintext data using the encryption public key of the head node according to the RSA algorithm configured for the organization ID corresponding to the on-chain user.

[0134] In practical applications, step 2, data creation, specifically includes the following process:

[0135] 2.1 The client sends a request.

[0136] Data creation is initiated by on-chain users, who call SDK methods to trigger the execution of the cryptographic contract. The execution status is then passed to the header node, and the request includes the on-chain user's signature, data primary key certificate information, and request timestamp.

[0137] Specifically, a user with organization ID 001 wants to encrypt and store a piece of data, so he sends a data creation request to the organization's head node, which contains the user's signature information, the primary key when the data is uploaded to the blockchain, and the timestamp information.

[0138] 2.2 Header node verification.

[0139] Upon receiving a request, the header node verifies whether the timestamp contained in the request has expired and whether the certificate information is in the expiration index. If the certificate is expired or the timestamp exceeds the specified threshold, subsequent steps are skipped.

[0140] 2.3 Data encryption.

[0141] After verification, the encrypted contract is triggered. The encryption service of the head node it calls encrypts the data according to the algorithm specified by the organization configuration, records the encrypted data and the organization ID information contained in the encryption service into the block, and returns the data hash value to the head node.

[0142] Specifically, after verification by the head node, the signature information can be verified by the node's public key, and the node certificate has not expired, the data request has not timed out, and the primary key of the data requested by the user is not found in the blockchain. At this point, the encrypted contract calls the head node's encryption service, and the user uses the client to send the plaintext data to the head node via an SSH channel. The head node encrypts the data using the RSA algorithm specified by the 001 organization, using the head node's encryption public key, and records the encrypted data and the organization ID information contained in the encryption service in the block, and returns the data hash value to the head node.

[0143] 2.4 Block generation and on-chaining.

[0144] After the head node synchronizes the block to the consensus node, the consensus node verifies it. Blocks that pass consensus are recorded on the blockchain. Once on-chain, the data primary key, data hash, and block height are stored in the backend database.

[0145] In one specific implementation, the data update module includes a data update request receiving module, a data update header node verification module, a data update data encryption module, and a data update block generation and on-chain module connected in sequence.

[0146] The data update receiving request module is used to receive the data update request from the on-chain user and the on-chain data sent by the on-chain user, and send the data update request and the on-chain data to the head node; the data update request includes the on-chain user's signature information, data primary key certificate information, hash value of the original encrypted data stored in the data primary key, and request timestamp.

[0147] The data update header node verification module is used to verify the data update request and the header node certificate through the header node, and send the verification result to the data update data encryption module.

[0148] The data update encryption module is used to call the encryption service to encrypt and update the on-chain data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user when the verification result meets the preset requirements. The encrypted on-chain data and the organization ID of the on-chain user are stored in the second block, and the hash value of the encrypted on-chain data is received. The second block is then sent to the data update block output and on-chain module.

[0149] The data update block generation and on-chain module is used to synchronize the second block to the consensus node, whereby the consensus node verifies the second block and stores the verified second block on the blockchain.

[0150] As a specific implementation method, the process of verifying the data update request and the header node certificate includes:

[0151] Determine whether the requested timestamp has expired.

[0152] If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node.

[0153] When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index.

[0154] If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the data primary key certificate information is in the blockchain.

[0155] When the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the data key certificate information is in the blockchain, determine whether the hash value of the on-chain data stored in the data key matches the hash value of the encrypted on-chain data.

[0156] The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, the data primary key certificate information is in the blockchain, and the hash value of the on-chain data stored in the data primary key matches the hash value of the encrypted on-chain data.

[0157] Otherwise, the verification result is "failed".

[0158] In practical applications, 3. Data update, the specific process includes:

[0159] 3.1 The client sends a request.

[0160] Data creation is initiated by on-chain users, who call SDK methods to trigger the execution of the update contract. The execution status is then passed to the header node, and the request includes the on-chain user's signature and certificate information, the request timestamp, the data primary key, and the plaintext of the updated data.

[0161] Specifically, a user with organization ID 001 encrypts a piece of data already on the blockchain and sends a data creation request to the organization's head node. This request includes the user's signature, the primary key used when the data was uploaded to the blockchain, the hash value of the original encrypted data stored in the primary key, and a timestamp. In this invention, the data already on the blockchain refers to encrypted data, meaning data that has already been encrypted and stored in the blockchain. Encrypting a piece of data already on the blockchain means re-encrypting the original, unencrypted data and updating the original data stored in the blockchain with the encrypted version.

[0162] 3.2 Header node verification.

[0163] Upon receiving a request, the header node verifies whether the timestamp contained in the request has expired, whether the certificate information is in the expired index, and whether the data primary key exists. If the certificate is expired, the timestamp exceeds the specified threshold, or the data primary key does not exist, subsequent steps are skipped.

[0164] Specifically, after receiving a request, the head node verifies whether the timestamp contained in the request has expired, whether the signature information is correct, whether the data key and hash value match the hash value of the ciphertext stored in the data key, whether the record can be found in the blockchain, and whether the node certificate is in the expired certificate index.

[0165] Furthermore, the data primary key and hash value need to match the hash value of the ciphertext stored in the data primary key, and the record must be searchable in the blockchain, and the node certificate must not be in the expired certificate index.

[0166] 3.3 Data update.

[0167] After verification, the update contract is triggered. The update contract first retrieves the block height and hash value from the backend database, calculates the encrypted data hash, and checks if it matches the original hash. If they do not match, the subsequent steps end. Upon successful verification, the contract calls the encryption service of the header node to encrypt and update the data according to the algorithm specified in the organization's configuration. The encrypted plaintext data and the organization ID information contained in the encryption service are recorded in the block. The hash value is then returned to the header node.

[0168] The update process specifically includes: The signature information is verified by the head node to be verifiable by its public key, the node certificate is not expired, the data request has not timed out, and the user's requested data primary key is found in the blockchain with a matching hash value. At this point, the encrypted contract calls the head node's encryption service. The user, using a client, sends the plaintext data to the head node via an SSH channel. The head node encrypts the new data using its public key according to the RSA algorithm specified by the 001 organization, records the encrypted data and the organization ID information contained in the encryption service in the block, and returns the new data hash value to the head node.

[0169] 3.4 Block generation and on-chaining.

[0170] After the head nodes synchronize the blocks to the consensus nodes, the consensus nodes verify them. Blocks that pass consensus are recorded on the blockchain. Once on-chain, the data's hash and block height are stored in the backend database.

[0171] Specifically, after the head node synchronizes the block to the consensus node, the consensus node verifies it. Blocks that pass consensus are recorded on the blockchain, and the primary keys in the backend database are updated.

[0172] In one specific implementation, the data query module includes a data query request receiving module, a data query header node verification module, a data query data encryption module, and a data query block output and on-chain module connected in sequence.

[0173] The data query receiving request module is connected to the data creation module and the data update module respectively; the data query receiving request module is used to receive the data query request of the on-chain user and send the data query request to the head node; the data query request includes the on-chain user's signature information, data primary key certificate information and request timestamp.

[0174] The data query header node verification module is used to verify the data query request and the header node certificate through the header node, and send the verification result to the data query data encryption module.

[0175] The data query user data encryption module is used to call the decryption service to decrypt the target data according to the algorithm configured by the organization corresponding to the organization ID on the chain when the verification result meets the preset requirements, obtain the decrypted data, store the query record in the third block, and send the third block to the data query block output and on-chain module; the target data is the data record found in the blockchain based on the data primary key of the user's data primary key certificate information on the chain.

[0176] The data query block generation and on-chain module is used to send the third block to the consensus node, which verifies the third block and stores the verified third block on the blockchain.

[0177] As a specific implementation method, the process of verifying the data query request and the header node certificate includes:

[0178] Determine whether the requested timestamp has expired.

[0179] If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node.

[0180] When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index.

[0181] If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the corresponding data record can be found in the blockchain based on the data primary key certificate information of the target data.

[0182] The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the corresponding data record can be found in the blockchain based on the data primary key certificate information of the target data.

[0183] Otherwise, the verification result is "failed".

[0184] In one specific implementation, the system also includes a database storage module.

[0185] The database storage module is connected to the data creation module, the data update module, and the data query module, respectively.

[0186] The database storage module is used to save the data stored on the blockchain to the backend database.

[0187] In practical applications, 4. Data query, the specific process includes:

[0188] 4.1 The client sends a request.

[0189] Data creation is initiated by on-chain users, who call SDK methods to trigger the execution of the update contract. The execution status is then passed to the header node, and the request includes the on-chain user's signature information, request timestamp, and data primary key.

[0190] Specifically, a user with organization ID 001 wants to query a piece of data, so he sends a data query request to the organization's head node, which contains the user's signature information, the primary key when the data was uploaded to the blockchain, and the timestamp information.

[0191] 4.2 Header node verification.

[0192] Upon receiving a request, the header node verifies whether the timestamp contained in the request has expired, whether the certificate information is in the expired index, and whether the data primary key exists. If the certificate is expired, the timestamp exceeds the specified threshold, or the data primary key does not exist, subsequent steps are skipped.

[0193] Specifically, after receiving a request, the head node verifies whether the timestamp in the request has expired, whether the signature information is correct, whether the node certificate is in the expired certificate index, and whether the data primary key can be found in the blockchain and the backend database.

[0194] 4.3 Data Decryption.

[0195] After verification, the decryption contract is triggered. The decryption contract uses the encryption service to decrypt the primary key data and returns it to the client. It also packages the query record into a block and sends it to the consensus node.

[0196] Specifically, after verification by the head node, the signature information can be verified by the node's public key, and the node certificate has not expired, the data request has not timed out, and the primary key of the data requested by the user can be found in the blockchain and database. At this point, the decryption contract triggers the head node to decrypt the data. The head node decrypts the data using its public key according to the RSA algorithm specified by the 001 organization, and transmits the plaintext data to the user client via the SSH channel, recording the timestamp of the contract and the queried data, as well as the user's signature in the block.

[0197] 4.4 Block generation and on-chaining.

[0198] After the head nodes synchronize the blocks to the consensus nodes, the consensus nodes verify them. Blocks that pass consensus are recorded on the blockchain. Once on-chain, the data's hash and block height are stored in the backend database.

[0199] Compared with the prior art, the method of the present invention has the following advantages:

[0200] 1. This invention offers better data privacy, security, and usability: Based on consortium blockchain smart contracts, this invention features an access authentication mechanism, and users of each organization can only decrypt and query data uploaded to the blockchain by their own organization, thus improving data privacy.

[0201] 2. This invention supports encryption using various asymmetric encryption algorithms and the SHA256 hash algorithm, including non-Chinese national standard AES, RSA, ECC, and DH; and the Chinese national standard SM series. Organizations can utilize organizational configurations to implement custom encryption of their data.

[0202] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0203] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A data processing system for consortium blockchains, characterized in that, The system includes a data creation module, a data update module, and a data query module; The data creation module is used to receive data creation requests from on-chain users, verify the data creation requests and header node certificates, and when the verification result meets preset requirements, receive plaintext data sent by the on-chain user, call the encryption service to encrypt the plaintext data according to the algorithm configured for the organization corresponding to the on-chain user's organization ID, store the encrypted plaintext data and the on-chain user's organization ID in the first block, receive the returned hash value of the encrypted plaintext data, and synchronize the first block to the consensus node, whereby the consensus node verifies the first block and stores the verified first block in the blockchain; the data creation request includes the on-chain user's signature, data primary key certificate information, and request timestamp; The data update module is used to receive data update requests from on-chain users and on-chain data sent by on-chain users, and to verify the data update requests and the header node certificate. When the verification result meets the preset requirements, the module calls the encryption service to encrypt and update the on-chain data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user. The encrypted on-chain data and the organization ID of the on-chain user are stored in the second block. The module also receives the returned hash value of the encrypted on-chain data and synchronizes the second block to the consensus node. The consensus node verifies the second block and stores the verified second block in the blockchain. The data update request includes the on-chain user's signature information, data primary key certificate information, the hash value of the original ciphertext data stored in the data primary key, and the request timestamp. The data query module is connected to both the data creation module and the data update module. The data query module receives data query requests from on-chain users and verifies the data query request and the header node certificate. When the verification result meets preset requirements, it calls the decryption service to decrypt the target data according to the algorithm configured for the organization ID corresponding to the on-chain user, obtaining the decrypted data. The query record is then stored in a third block, and the third block is sent to a consensus node for verification. The consensus node then stores the verified third block in the blockchain. The data query request includes the on-chain user's signature information, data primary key certificate information, and a request timestamp. The target data is the data record found in the blockchain based on the data primary key of the on-chain user's data primary key certificate information. The process of verifying the data creation request and the header node certificate includes: Determine whether the requested timestamp has expired; If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node; When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index; If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the data primary key certificate information is in the blockchain; The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the data primary key certificate information is not in the blockchain; Otherwise, the verification result is "failed".

2. The data processing system for consortium blockchains according to claim 1, characterized in that, The data creation module includes a data creation request receiving module, a data creation header node verification module, a data creation encryption module, and a data creation block generation and on-chain module connected in sequence. The data creation receiving request module is used to receive the data creation request from the on-chain user and the plaintext data sent by the on-chain user, and send the data creation request and the plaintext data to the head node; The data creation request includes the on-chain user's signature, data primary key certificate information, and request timestamp; The data creation header node verification module is used to verify the data creation request and the header node certificate through the header node, and send the verification result to the data creation data encryption module. The data creation encryption module is used to call the encryption service to encrypt the plaintext data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user when the verification result meets the preset requirements, store the encrypted plaintext data and the organization ID of the on-chain user in the first block, receive the returned hash value of the encrypted plaintext data, and send the first block to the data creation block output and on-chain module. The data creation and blockchain module is used to synchronize the first block to the consensus node, which verifies the first block and stores the verified first block on the blockchain.

3. The data processing system for consortium blockchains according to claim 1, characterized in that, The head node receives plaintext data sent by the on-chain user via an SSH channel.

4. The data processing system for consortium blockchains according to claim 1, characterized in that, The invocation of the encryption service encrypts the plaintext data using the encryption public key of the head node, according to the RSA algorithm configured for the organization corresponding to the organization ID of the on-chain user.

5. The data processing system for consortium blockchains according to claim 1, characterized in that, The system also includes a database storage module; The database storage module is connected to the data creation module, the data update module, and the data query module, respectively. The database storage module is used to save the data stored on the blockchain to the backend database.

6. The data processing system for consortium blockchains according to claim 1, characterized in that, The data update module includes a data update request receiving module, a data update header node verification module, a data update data encryption module, and a data update block generation and on-chain module connected in sequence. The data update receiving request module is used to receive the data update request from the on-chain user and the on-chain data sent by the on-chain user, and send the data update request and the on-chain data to the head node; the data update request includes the on-chain user's signature information, data primary key certificate information, hash value of the original ciphertext data stored in the data primary key, and request timestamp; The data update header node verification module is used to verify the data update request and the header node certificate through the header node, and send the verification result to the data update data encryption module. The data update and data encryption module is used to call the encryption service to encrypt and update the on-chain data according to the algorithm configured by the organization corresponding to the organization ID of the on-chain user when the verification result meets the preset requirements. The encrypted on-chain data and the organization ID of the on-chain user are stored in the second block, and the hash value of the encrypted on-chain data is received. The second block is sent to the data update block output and on-chain module. The data update block generation and on-chain module is used to synchronize the second block to the consensus node, whereby the consensus node verifies the second block and stores the verified second block on the blockchain.

7. The data processing system for consortium blockchains according to claim 1, characterized in that, The data query module includes a data query request receiving module, a data query header node verification module, a data query data encryption module, and a data query block output and on-chain module connected in sequence. The data query request receiving module is connected to the data creation module and the data update module respectively; the data query request receiving module is used to receive the data query request of the on-chain user and send the data query request to the head node; the data query request includes the on-chain user's signature information, data primary key certificate information and request timestamp; The data query header node verification module is used to verify the data query request and the header node certificate through the header node, and send the verification result to the data query data encryption module. The data query user data encryption module is used to call the decryption service to decrypt the target data according to the algorithm configured by the organization corresponding to the organization ID on the chain when the verification result meets the preset requirements, obtain the decrypted data, store the query record in the third block, and send the third block to the data query block output and on-chain module; the target data is the data record found in the blockchain based on the data primary key of the user's data primary key certificate information on the chain. The data query block generation and on-chain module is used to send the third block to the consensus node, which verifies the third block and stores the verified third block on the blockchain.

8. The data processing system for consortium blockchains according to claim 1, characterized in that, The process of verifying the data update request and the header node certificate includes: Determine whether the requested timestamp has expired; If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node; When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index; If the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the data primary key certificate information is in the blockchain; When the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the data primary key certificate information is in the blockchain, determine whether the hash value of the on-chain data stored in the data primary key matches the hash value of the encrypted on-chain data. The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, the data primary key certificate information is in the blockchain, and the hash value of the on-chain data stored in the data primary key matches the hash value of the encrypted on-chain data. Otherwise, the verification result is "failed".

9. The data processing system for consortium blockchains according to claim 1, characterized in that, The process of verifying the data query request and the header node certificate includes: Determine whether the requested timestamp has expired; If the request timestamp has not expired, determine whether the signature of the on-chain user has been verified by the public key of the head node; When the request timestamp has not expired and the signature is verified by the public key of the header node, determine whether the header node certificate is in the expired certificate index; When the request timestamp has not expired, the signature is verified by the public key of the header node, and the header node certificate is not in the expired certificate index, determine whether the corresponding data record can be found in the blockchain based on the data primary key certificate information of the target data; The verification result is passed when the request timestamp has not expired, the signature is verified by the public key of the header node, the header node certificate is not in the expired certificate index, and the corresponding data record can be found in the blockchain based on the data primary key certificate information of the target data; Otherwise, the verification result is "failed".

Images