Data security sharing method and device based on block chain, equipment and storage medium

Abstract

The invention discloses a data security sharing method and device based on a block chain, equipment and a storage medium, the data security sharing method based on the block chain comprises the following steps: responding to a data use request sent by a data user, and based on identity information of the data user registered in the block chain; according to the identity information of the trusted data space node corresponding to the data user and the identity information of the trusted data space node corresponding to the data user, performing identity verification on the data user; under the condition that the verification is passed, receiving a credible environment report sent by a data user, analyzing the credible environment report, and determining the credibility of the data user; and sending target data to the data user according to the credibility of the data user. Through the technical scheme, the use control of the shared data by the data owner is realized, and the data security is further improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a blockchain-based data security sharing method, device, equipment and storage medium. Background Art

[0002] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. In the blockchain system, data blocks are combined into a chain data structure in a sequential manner according to chronological order, and a distributed ledger that cannot be tampered with or forged is guaranteed by cryptography.

[0003] In traditional blockchain technology, the focus of data sharing is to facilitate the two parties involved in data sharing to discover and use shared data. Although there are security measures such as identity authentication and access control in the existing data sharing process, there is no guarantee that data control can still be exercised over the shared data after the data owner completes data sharing. Summary of the invention

[0004] The present invention provides a blockchain-based data security sharing method, device, equipment and storage medium to achieve use control of shared data after transmission, ensuring that the shared data can be used safely.

[0005] According to one aspect of the present invention, a data security sharing method based on blockchain is provided, the method comprising:

[0006] In response to a data use request sent by a data user, based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user, authenticate the data user;

[0007] If the verification is successful, a trusted environment report sent by the data user is received, and the trusted environment report is parsed to determine the credibility of the data user; wherein the trusted environment report is determined based on the data usage standard published by the data owner, and the data usage standard is used to indicate the usage rules of the data user for using the data shared by the data owner;

[0008] According to the credibility of the data user, target data is sent to the data user; wherein the target data is the data requested by the data use request.

[0009] According to another aspect of the present invention, a data security sharing device based on blockchain is provided, the device comprising:

[0010] An identity authentication module, in response to a data use request sent by a data user, authenticates the data user based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user;

[0011] A credibility confirmation module is used to receive a trustworthy environment report sent by a data user and parse the trustworthy environment report to determine the credibility of the data user when the verification is passed; wherein the trustworthy environment report is determined based on the data usage standard published by the data owner, and the data usage standard is used to indicate the usage rules of the data user for using the data shared by the data owner;

[0012] A data transmission module is used to send target data to the data user according to the credibility of the data user; wherein the target data is the data requested by the data use request.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain-based data security sharing method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the blockchain-based data security sharing method described in any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, a computer program product is provided, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the method for secure data sharing based on blockchain as described in any embodiment of the present invention is implemented.

[0019] The technical solution of the embodiment of the present invention not only uses the identity information of the data user registered in the blockchain, but also uses the identity information of the trusted data space node corresponding to the data user to authenticate the data user, which can effectively ensure the credibility of the data user's identity and the credibility generated based on the trusted environment report sent by the data user to transmit the target data, which can further ensure that the data user can use the data in accordance with the wishes of the data owner, realize the data owner's control over the use of shared data, and further improve data security.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 This is a flowchart of a blockchain-based data security sharing method provided according to Embodiment 1 of the present invention;

[0023] Figure 2 This is a flowchart of a data security sharing method based on blockchain provided according to Embodiment 2 of the present invention;

[0024] Figure 3 This is a flowchart of a data security sharing method based on blockchain provided according to Embodiment 3 of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of a data security sharing device based on blockchain provided according to Embodiment 4 of the present invention;

[0026] Figure 5 It is a structural schematic diagram of an electronic device that implements the blockchain-based data security sharing method of an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 A flowchart of a data security sharing method based on blockchain is provided for the first embodiment of the present invention. This embodiment is applicable to data sharing in blockchain. The method can be executed by a data security sharing device based on blockchain. The data security sharing device based on blockchain can be implemented in the form of hardware and / or software. The data security sharing device based on blockchain can be configured in various general computing devices, such as terminal devices participating in the blockchain network. Figure 1 As shown, the method includes:

[0031] S110. In response to a data use request sent by a data user, the data user is authenticated based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user.

[0032] Among them, the identity information of the data user may refer to a digital identity generated based on the public key information of the data user, and the identity information of the trusted data space node may refer to a digital identity generated based on the public key information of the trusted data space node.

[0033] Optionally, in an embodiment of the present invention, there may be multiple users in the blockchain network, such as data users, user owners, node operators, hardware manufacturers, etc. It should be noted that both data owners and data users can be node operators of trusted data space nodes, that is, both can run a trusted data space node system locally, or data owners and data users do not need to build their own trusted data space nodes, and use the trusted data space node system of a third-party node operator, that is, the node operator itself does not act as a data owner or data user, but only provides data services to data users and data owners.

[0034] Optionally, the node operator, data user or data owner will also upload the environment type of the trusted operating environment run by the corresponding trusted data space node to the blockchain. The environment type can include hardware virtual machines, software virtual machines, SGX (Software Guard Extensions), and the trusted operating environment can be composed of a set of software and hardware, such as BIOS, boot program, kernel, operating system, application, etc.

[0035] Optionally, after the data user's identity is authenticated, the following is also included: verifying the data user's node type, the environment type of the trusted operating environment run by the data user's corresponding trusted data space node, and the hardware manufacturer of the hardware platform running the data user's corresponding trusted data space node. By verifying the node type, environment type, and hardware manufacturer, it is further confirmed whether the data user meets the data owner's security requirements for shared data, thereby improving data security, that is, whether the data user is an object that the data owner is allowed to share, whether the hardware manufacturer is an object recognized by the data owner, and whether the environment type of the trusted operating environment run by the data user's corresponding trusted data space node meets the data owner's requirements for the environment type.

[0036] S120. When the verification is successful, a trusted environment report sent by the data user is received, and the trusted environment report is analyzed to determine the credibility of the data user.

[0037] Among them, the trusted environment report can be determined based on the data usage standards published by the data owner, the data usage standards can be used to indicate the usage rules of the data user using the data shared by the data owner, and the credibility can be used to characterize the degree of matching between the data owner and the data usage standards published by the data owner. Optionally, the data usage standards can be determined based on the node type of the data owner and the type of data shared by the data owner, and those skilled in the art can set them adaptively. For example, the data usage standards can include when to destroy shared data, which applications can only use shared data, and how many times shared data can only be used.

[0038] Optionally, in an embodiment of the present invention, the data owner and the data user may interact through a preset encrypted communication method, which may be determined based on a pair of public-private keys temporarily generated by the data owner and the node public-private keys of the trusted data space node corresponding to the data user, and the DH algorithm (Diffie-Hellman, an encryption algorithm for securely exchanging keys). In order to further ensure data security during the communication process, the data user may sign the trusted environment report based on its own node private key.

[0039] S130. Send target data to the data user according to the credibility of the data user.

[0040] The target data may be data requested by the data usage request.

[0041] In the embodiment of the present invention, the data owner can determine whether the credibility of the data user meets the credibility threshold according to a preset credibility threshold, and if so, send the target data to the data user; otherwise, do not send the target data to the data user. Optionally, the credibility threshold can be adaptively set according to those skilled in the art.

[0042] The technical solution of the embodiment of the present invention not only uses the identity information of the data user registered in the blockchain, but also uses the identity information of the trusted data space node corresponding to the data user to authenticate the data user, which can effectively ensure the credibility of the data user's identity and the credibility generated based on the trusted environment report sent by the data user to transmit the target data, which can further ensure that the data user can use the data in accordance with the wishes of the data owner, realize the data owner's control over the use of shared data, and further improve data security.

[0043] Embodiment 2

[0044] Figure 2This is a flowchart of a blockchain-based data security sharing method provided in the second embodiment of the present invention. This embodiment further refines the above embodiment and provides specific steps for authenticating the data user based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user. It should be noted that for the undetailed parts of the embodiment of the present invention, please refer to the relevant descriptions of other embodiments, which will not be repeated here. Figure 2 As shown, the method includes:

[0045] S210. According to the identification information of the data user, determine the identity information of the data user and the identity information of the hardware manufacturer corresponding to the data user in the blockchain.

[0046] Specifically, the identification information of the data user can be extracted from the data use request sent by the data user, and the data chain can be queried based on the identification information to determine the identity information of the data user and the identity information of the hardware manufacturer and hardware platform corresponding to the data user. Optionally, the identification information can be adaptively set according to those skilled in the art. It should be noted that in the process of generating the blockchain network, the users in the blockchain network have registered their corresponding identity information on the blockchain.

[0047] S220. Based on the identity authentication smart contract deployed in the blockchain, the first identity authentication information is verified according to the identity information of the hardware manufacturer, the second identity authentication information is verified according to the identity information of the hardware platform, and the third identity authentication information is verified according to the identity information of the data user.

[0048] In an embodiment of the present invention, if the data user does not use a third party to operate a trusted data space node, the data user's identity information is its own identity information registered in the block; otherwise, the data user's identity information is the identity information registered in the blockchain by the node operator that operates the trusted data space node.

[0049] Among them, the first identity authentication information may refer to a verifiable credential issued for the identity information of the hardware platform based on the private key information corresponding to the identity information of the hardware manufacturer; the second identity authentication information may refer to a verifiable credential issued for the identity information of the trusted data space node based on the private key information corresponding to the identity information of the hardware platform; the third identity authentication information may refer to a verifiable credential issued for the identity information of the trusted data space node based on the private key information corresponding to the identity information of the node operator.

[0050] Optionally, during the construction of the blockchain network, users participating in the blockchain must register their corresponding identity information on the blockchain. The identity information may refer to the public key information used to verify the user's identity. For example, a hardware manufacturer will build a chip private key into the hardware platform that meets the trusted operating environment. The chip private key is safely kept in the hardware platform and cannot be accessed or modified by the outside world. The hardware platform can register its own identity information on the blockchain according to the public key information corresponding to the chip private key. And the hardware manufacturer will issue a verifiable credential for the identity information of the hardware platform registered in the blockchain according to the private key information corresponding to the identity information registered in the blockchain, and upload the verifiable credential to the blockchain. When the node operator, data user or data owner purchases a hardware platform that meets the hardware requirements of the trusted execution environment, the hardware platform will execute the call initialization command, which will generate a node private key as the private key information of the trusted data space node under the hardware platform, and register the identity information of the trusted data space node on the blockchain according to the public key information corresponding to the node private key, and then use the private key information of the hardware platform to issue a verifiable credential for the identity information of the trusted data space node and upload it to the blockchain. Node operators, data users or data owners will also use the private key information corresponding to their own god information registered in the blockchain to issue verifiable credentials for the identity information of their corresponding trusted data space nodes and upload them to the blockchain. By uploading and issuing the above three types of verifiable credentials to the blockchain, subsequent identity verification is facilitated.

[0051] S230. When the verification is successful, a trusted environment report sent by the data user is received, and the trusted environment report is analyzed to determine the credibility of the data user.

[0052] S240: Send target data to the data user according to the credibility of the data user.

[0053] The technical solution of the embodiment of the present invention is based on the identity authentication smart contract deployed in the blockchain. The first identity authentication information is verified according to the identity information of the hardware manufacturer registered in the blockchain, the second identity authentication information is verified according to the identity information of the hardware platform registered in the blockchain, and the third identity authentication information is verified according to the identity information of the node operator registered in the blockchain. The credibility of the hardware platform and the trusted data space node is determined through three verification processes, and the legitimacy of the corresponding relationship between the node operator and the trusted data space node, the legitimacy of the corresponding relationship between the hardware manufacturer and the hardware platform, and the legitimacy of the corresponding relationship between the hardware platform and the trusted data space node are ensured at the same time, thereby further improving the security of data in the data sharing process.

[0054] Embodiment 3

[0055] Figure 3 This is a flowchart of a data security sharing method based on blockchain provided in the third embodiment of the present invention. This embodiment further refines the above embodiment and provides specific steps for receiving a trusted environment report sent by a data user, parsing the trusted environment report, and determining the credibility of the data user. It should be noted that for the undetailed parts of the embodiment of the present invention, please refer to the relevant descriptions of other embodiments, which will not be repeated here. Figure 3 As shown, the method includes:

[0056] S310. In response to a data usage request sent by a data user, the data user is authenticated based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user.

[0057] S320. Obtain a trusted environment report from a data user, parse the trusted environment report, and obtain software and hardware information, standard environment information, and measurement environment information of a trusted operating environment in a data space node corresponding to the data user.

[0058] The trusted environment report may include the standard environment information and measurement environment information of the trusted operating environment running in the trusted data space node; the environment information may include the hash value information generated by the operating information of each piece of software and hardware in the trusted operating environment. It should be noted that the software and hardware information may refer to the inherent information of the trusted operating environment, that is, the component information that provides hardware support and software support in the trusted operating environment, such as BIOS, boot program, kernel, operating system, application, etc.

[0059] Optionally, standard environment information may refer to environment information of a trusted operating environment that complies with the data owner's data usage security standards, and measurement environment information may refer to environment information of a trusted operating environment when a trusted data space node corresponding to the data owner is running.

[0060] The data owner can upload his own data usage security standards to the blockchain in advance, and the data user can determine the standard environment information corresponding to the data usage security standards in advance according to the data usage security standards published by the data owner. Optionally, each data user can establish standard environment information corresponding to multiple different data owners. Security verification and audit can be performed on each hardware component in the trusted operating environment corresponding to the data user to ensure that the hardware components have no security vulnerabilities, and software testing can be performed on each software component based on the data security usage standards to ensure that the data usage process of the software component complies with the data security usage standards and does not have security vulnerabilities. Furthermore, the data user who has passed the security verification and audit and software testing can calculate the hash value of the operating information of each software and hardware in the trusted operating environment corresponding to itself, sign the calculation results, and publish them to the blockchain.

[0061] Optionally, the security verification and software testing of data users can be performed by third-party users in the blockchain network. Third-party users can sign the data users who have passed the security verification and publish the signature results on the blockchain. The blockchain can further verify whether the data user meets the minimum signature requirements and determine whether the data user meets the data security use standards. Optionally, the minimum signature requirement can be whether there are a preset number of third-party users' signatures.

[0062] During the startup of the trusted data space node corresponding to the data user, the operation information of each piece of software and hardware in the trusted operating environment run by the trusted data space node can be calculated as well as the hash value, and the measurement environment information of each piece of software and hardware can be generated. The corresponding standard environment information can be obtained from the blockchain to generate a trusted environment report, which is sent to the data owner. Exemplarily, the trusted environment report carries the measurement environment information of each piece of software and hardware and the standard environment information, for example, hash (standard environment information. kernel||measurement environment information. kernel).

[0063] S330. Verify whether the standard environment information and measurement environment information corresponding to each piece of software and hardware are consistent based on the software and hardware information, and determine the credibility of the data user.

[0064] Specifically, the data owner can verify whether the standard environment information and measurement environment information corresponding to each piece of software and hardware in the software and hardware information are consistent based on the software and hardware information of the trusted operating environment in the data space node corresponding to the data user. If they are consistent, the software and hardware is determined to be trustworthy, and the credibility information corresponding to the software and hardware is set to a positive value. Otherwise, the software and hardware is untrustworthy, and the credibility information corresponding to the software and hardware is set to a negative value.

[0065] S340: Send target data to the data user based on the credibility of the data user.

[0066] In the embodiment of the present invention, the data owner can determine whether the credibility of the data user meets the credibility threshold according to the preset credibility threshold, and send the target data to the data user if it meets the credibility threshold; otherwise, the target data is not sent to the data user. Optionally, the credibility threshold can be adaptively set according to those skilled in the art, for example, the credibility information of certain software and hardware can be set to be positive.

[0067] The technical solution of the embodiment of the present invention ensures that the trusted environment of the data space node corresponding to the data user has not been tampered with by performing security measurement on the trusted operating environment in the data space node corresponding to the data user, and the data security usage standards issued by the data owner participate in the security measurement process of the data user, ensuring that the data user can use the shared data in accordance with the wishes of the data owner, realizing the data owner's control over the use of the shared data, and further improving the security of the data in the data sharing process.

[0068] Embodiment 4

[0069] Figure 4 This is a schematic diagram of the structure of a data security sharing device based on blockchain provided in Embodiment 4 of the present invention. Figure 4 As shown, the device comprises:

[0070] The identity authentication module 410 performs identity authentication on the data user based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user in response to the data use request sent by the data user;

[0071] The credibility confirmation module 420 is used to receive the trusted environment report sent by the data user when the verification is passed, and parse the trusted environment report to determine the credibility of the data user; wherein the trusted environment report is determined based on the data usage standard issued by the data owner, and the data usage standard is used to indicate the usage rules of the data user using the data shared by the data owner;

[0072] The data transmission module 430 is used to send target data to the data user according to the credibility of the data user; wherein the target data is the data requested by the data use request.

[0073] The technical solution of the embodiment of the present invention not only uses the identity information of the data user registered in the blockchain, but also uses the identity information of the trusted data space node corresponding to the data user to authenticate the data user, which can effectively ensure the credibility of the data user's identity and the credibility generated based on the trusted environment report sent by the data user to transmit the target data, which can further ensure that the data user can use the data in accordance with the wishes of the data owner, realize the data owner's control over the use of shared data, and further improve data security.

[0074] Optionally, the identity authentication module 410 includes:

[0075] An identity information determination unit, used to determine the identity information of the data user and the identity information of the hardware manufacturer corresponding to the data user in the blockchain according to the identification information of the data user; wherein the identity information of the data user refers to a digital identity generated according to the public key information of the data user;

[0076] The identity information verification unit is used to verify the first identity authentication information according to the identity information of the hardware manufacturer, verify the second identity authentication information according to the identity information of the hardware platform, and verify the third identity authentication information according to the identity information of the data user based on the identity authentication smart contract deployed in the blockchain.

[0077] Optionally, the first identity authentication information refers to a verifiable credential issued for the identity information of the hardware platform based on the private key information corresponding to the identity information of the hardware manufacturer; the second identity authentication information refers to a verifiable credential issued for the identity information of the trusted data space node based on the private key information corresponding to the identity information of the hardware platform; the third identity authentication information refers to a verifiable credential issued for the identity information of the trusted data space node based on the private key information corresponding to the identity information of the node operator.

[0078] Optionally, the trusted environment report may include standard environment information and measurement environment information of the trusted operating environment running in the trusted data space node.

[0079] Optionally, the credibility confirmation module 420 includes:

[0080] An environment information determination unit is used to obtain a trusted environment report from a data user, parse the trusted environment report, and obtain the software and hardware information of the trusted operating environment in the data space node corresponding to the data user, the standard environment information, and the measurement environment information; wherein the environment information refers to the hash value information generated by the operating information of each software and hardware in the trusted operating environment;

[0081] A credibility determination unit is used to verify the matching degree of the standard environment information and the measurement environment information corresponding to each piece of software and hardware according to the software and hardware information, and determine the credibility of the data user according to the matching degree and a preset matching degree threshold.

[0082] Optionally, the standard environment information may refer to environment information of a trusted operating environment that complies with the data owner's data usage security standards, and the measurement environment information may refer to environment information of a trusted operating environment when a trusted data space node corresponding to the data owner is running.

[0083] Optionally, the device further comprises:

[0084] The type verification module is used to verify the node type of the data user, the environment type of the trusted operating environment in which the trusted data space node corresponding to the data user runs, and the hardware manufacturer of the hardware platform that runs the trusted data space node corresponding to the data user.

[0085] The blockchain-based data security sharing device provided in the embodiment of the present invention can execute the blockchain-based data security sharing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0086] Embodiment 5

[0087] Figure 5 A schematic diagram of an electronic device 510 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0088] like Figure 5As shown, the electronic device 510 includes at least one processor 511, and a memory connected to the at least one processor 511 in communication, such as a read-only memory (ROM) 512, a random access memory (RAM) 513, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 511 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 512 or the computer program loaded from the storage unit 518 to the random access memory (RAM) 513. In the RAM 513, various programs and data required for the operation of the electronic device 510 can also be stored. The processor 511, the ROM 512, and the RAM 513 are connected to each other via a bus 514. An input / output (I / O) interface 515 is also connected to the bus 514.

[0089] A number of components in the electronic device 510 are connected to the I / O interface 515, including: an input unit 516, such as a keyboard, a mouse, etc.; an output unit 517, such as various types of displays, speakers, etc.; a storage unit 518, such as a disk, an optical disk, etc.; and a communication unit 519, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 519 allows the electronic device 510 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0090] The processor 511 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 511 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 511 executes the various methods and processes described above, such as a data security sharing method based on blockchain.

[0091] In some embodiments, the data security sharing method based on blockchain can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 518. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 510 via the ROM 512 and / or the communication unit 519. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data security sharing method based on blockchain described above can be performed. Alternatively, in other embodiments, the processor 511 can be configured to perform the data security sharing method based on blockchain in any other appropriate manner (for example, by means of firmware).

[0092] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0093] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0094] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0095] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0096] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0097] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0098] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0099] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security sharing method based on blockchain, characterized in that: Applied to data owners, the participants in data security sharing include data owners and data users, and both data owners and data users have their own corresponding trusted data space nodes; the method includes: In response to a data use request sent by a data user, based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user, authenticate the data user; If the verification is successful, a trusted environment report sent by the data user is received, and the trusted environment report is parsed to determine the credibility of the data user; wherein the trusted environment report is determined based on the data usage standard published by the data owner, and the data usage standard is used to indicate the usage rules of the data user for using the data shared by the data owner; According to the credibility of the data user, target data is sent to the data user; wherein the target data is the data requested by the data use request.

2. The method according to claim 1, characterized in that Based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user, the data user is authenticated, including: According to the identification information of the data user, the identity information of the data user and the identity information of the hardware manufacturer corresponding to the data user are determined in the blockchain; wherein the identity information of the data user refers to the digital identity generated according to the public key information of the data user; Based on the identity authentication smart contract deployed in the blockchain, the first identity authentication information is verified according to the identity information of the hardware manufacturer, the second identity authentication information is verified according to the identity information of the hardware platform, and the third identity authentication information is verified according to the identity information of the data user.

3. The method according to claim 2, characterized in that The first identity authentication information refers to a verifiable credential issued for the identity information of the hardware platform based on the private key information corresponding to the identity information of the hardware manufacturer; the second identity authentication information refers to a verifiable credential issued for the identity information of the trusted data space node based on the private key information corresponding to the identity information of the hardware platform; the third identity authentication information refers to a verifiable credential issued for the identity information of the trusted data space node based on the private key information corresponding to the identity information of the node operator.

4. The method according to claim 1, characterized in that: The trusted environment report includes standard environment information and measurement environment information of the trusted operating environment running in the trusted data space node. Accordingly, the receiving of the trusted environment report sent by the data user and parsing the trusted environment report to determine the credibility of the data user include: Obtain a trusted environment report from a data user, parse the trusted environment report, and obtain the software and hardware information, the standard environment information, and the measurement environment information of the trusted operating environment in the data space node corresponding to the data user; wherein the environment information includes hash value information generated by the operating information of each software and hardware in the trusted operating environment; Based on the software and hardware information, check whether the standard environment information and measurement environment information corresponding to each software and hardware are consistent, and determine the credibility of the data user.

5. The method according to claim 4, characterized in that The standard environment information refers to the environment information of the trusted operating environment that complies with the data owner's data usage security standards, and the measurement environment information refers to the environment information of the trusted operating environment when the trusted data space node corresponding to the data owner is running.

6. The method according to claim 1, characterized in that After the data user is authenticated, it also includes: Verify the node type of the data user, the environment type of the trusted operating environment in which the trusted data space node corresponding to the data user runs, and the hardware manufacturer of the hardware platform that runs the trusted data space node corresponding to the data user.

7. A data security sharing device based on blockchain, characterized in that: Applied to data owners, data security sharing participants include data owners and data users, and data owners and data users each have their own corresponding trusted data space nodes; the device includes: An identity authentication module, in response to a data use request sent by a data user, authenticates the data user based on the identity information of the data user registered in the blockchain and the identity information of the trusted data space node corresponding to the data user; A credibility confirmation module is used to receive a trustworthy environment report sent by a data user and parse the trustworthy environment report to determine the credibility of the data user when the verification is passed; wherein the trustworthy environment report is determined based on the data usage standard published by the data owner, and the data usage standard is used to indicate the usage rules of the data user for using the data shared by the data owner; A data transmission module is used to send target data to the data user according to the credibility of the data user; wherein the target data is the data requested by the data use request.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain-based data security sharing method described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the blockchain-based data security sharing method described in any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the blockchain-based data security sharing method described in any one of claims 1 to 6.

Images