Data transmission method, device and equipment

Abstract

The invention discloses a data transmission method, device and equipment, and the method comprises the steps: a first node of a block chain obtains a decentralized identity identifier which is used for indicating the authenticity of the identity attribute of the first node; the first node verifies the identity of the user based on a selective disclosure algorithm and a decentralized identity identifier, the selective disclosure algorithm indicates that the user only provides partial identity attribute information related to attribute private key generation, and data of the user is transmitted through the first node; and for the user passing verification, the first node sends second data obtained after attribute encryption of the first data of the user and a corresponding attribute private key to a second node of the block chain, and the attribute private key is used for decrypting the second data. Therefore, the decentralized identity identifier can be provided for the user on the basis of the block chain, and the user provides partial identity attribute information related to the attribute private key generation on the basis, so that the authenticity and privacy of the identity attribute information of the user can be guaranteed, and the security of data transmission is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data transmission method, device and equipment. Background Art

[0002] With the development of information technology, more and more scenarios require data transmission. For industries such as banking, there is a lot of important data that needs to be continuously transmitted, so the security and privacy protection of data transmission have become important directions that need attention and research.

[0003] At present, the security of data transmission can be improved to a certain extent by encrypting the data before transmitting it. However, when using symmetric encryption algorithms for data encryption and transmission, key leakage may occur. At the same time, the security of symmetric encryption is low and there is a risk of being cracked. When using traditional asymmetric encryption algorithms for data encryption and transmission, in the scenario of multiple data recipients, a large amount of resources are required to complete data encryption and decryption operations, which is difficult to cope with. Then, the use of attribute encryption can solve the above problems to a certain extent. However, when using attribute encryption for data transmission, it is usually necessary to provide the user's full identity attribute information, which is not conducive to protecting the user's privacy and there is a risk of privacy leakage. Moreover, the user's identity attribute information is provided by the user himself, and its authenticity is difficult to guarantee. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides a data transmission method, device and equipment, which can provide users with decentralized identity identification based on blockchain, and based on this, the user provides partial identity attribute information related to the generation of attribute private keys, thereby ensuring the authenticity and privacy of the user's identity attribute information, thereby improving the security of data transmission.

[0005] In order to achieve the above objectives, the technical solutions provided by this application are as follows:

[0006] In a first aspect, the present application provides a data transmission method, the method comprising:

[0007] The first node of the blockchain obtains a decentralized identity (DID), where the decentralized identity is used to indicate the authenticity of the identity attribute of the first node;

[0008] The first node verifies the identity of the user based on a selective disclosure algorithm and the decentralized identity identifier, the selective disclosure algorithm instructs the user to provide only part of the identity attribute information related to the generation of the attribute private key, and the user's data is transmitted through the first node;

[0009] For a user who has passed the verification, the first node sends the second data obtained by attribute-encrypting the user's first data and the corresponding attribute private key to the second node of the blockchain, and the attribute private key is used to decrypt the second data.

[0010] Optionally, the decentralized identity includes a verifiable presentation (VP) and a verifiable claim (VC).

[0011] Optionally, the selective disclosure algorithm is a Merkle tree-based selective disclosure algorithm, and the verifying the user identity includes:

[0012] The first node verifies the validity of the digital signature of the Merkle root;

[0013] The first node determines whether the Merkle root is equal to summary information of identity attribute information disclosed by the user, and the identity attribute information disclosed by the user includes the VP.

[0014] Optionally, the process of the first node obtaining the second data includes:

[0015] The first node performs attribute encryption on the first data based on the public key and the access structure of the identity attribute information disclosed by the user to obtain the second data.

[0016] Optionally, the method further comprises:

[0017] If the identity attribute information disclosed by the second node matches the access structure, the second node decrypts the second data based on the attribute private key and the public key to obtain the first data.

[0018] Optionally, the process of the first node obtaining the attribute private key includes:

[0019] The first node obtains the attribute private key by using a key generation algorithm based on the VC and a master private key corresponding to the public key.

[0020] In a second aspect, the present application further provides a data transmission device, applied to a first node of a blockchain, the device comprising:

[0021] An acquiring unit, configured to acquire a decentralized identity identifier, wherein the decentralized identity identifier is used to indicate the authenticity of the identity attribute of the first node;

[0022] a verification unit, configured to verify the identity of the user based on a selective disclosure algorithm and the decentralized identity identifier, wherein the selective disclosure algorithm instructs the user to provide only part of the identity attribute information related to the generation of the attribute private key, and the user's data is transmitted via the first node;

[0023] The sending unit is used to send, for a user who has passed the verification, second data obtained by attribute-encrypting the user's first data and a corresponding attribute private key to a second node of the blockchain, wherein the attribute private key is used to decrypt the second data.

[0024] Optionally, the decentralized identity includes VP and VC.

[0025] Optionally, the selective disclosure algorithm is a Merkle tree-based selective disclosure algorithm, and the verification unit is specifically used to:

[0026] Verify the validity of the Merkle root’s digital signature;

[0027] It is determined whether the Merkle root is equal to summary information of the identity attribute information disclosed by the user, wherein the identity attribute information disclosed by the user includes the VP.

[0028] Optionally, the device further comprises: an encryption unit;

[0029] The encryption unit is used to perform attribute encryption on the first data based on the public key and the access structure of the identity attribute information disclosed by the user to obtain the second data.

[0030] Optionally, the device further comprises: a key generating unit;

[0031] The key generation unit is used to obtain the attribute private key by adopting a key generation algorithm based on the VC and a master private key corresponding to the public key.

[0032] Optionally, the device is also applied to a second node of the blockchain, and the device further includes:

[0033] A decryption unit is used to decrypt the second data based on the attribute private key and the public key to obtain the first data if the identity attribute information disclosed by the second node matches the access structure.

[0034] It should be noted that the specific implementation method of the device and the technical effects achieved can refer to the relevant description of the method provided in the first aspect or any implementation method of the first aspect.

[0035] In a third aspect, the present application further provides an electronic device, the electronic device comprising: a processor and a memory;

[0036] The memory is used to store instructions or programs;

[0037] The processor is used to execute the instructions or programs in the memory so that the electronic device executes the method provided by the first aspect or any one of the implementations of the first aspect.

[0038] In a fourth aspect, the present application further provides a readable medium, in which instructions or programs are stored. When the instructions or programs are executed on a processor, the processor executes the method provided by the first aspect or any one of the implementations of the first aspect.

[0039] Compared with the prior art, the embodiments of the present application have at least the following advantages:

[0040] In the technical solution provided by the present application, a data transmission method is provided, which method may include, for example: first, the first node of the blockchain obtains a decentralized identity identifier, which is used to indicate the authenticity of the identity attribute of the first node; then, the first node verifies the identity of the user based on the selective disclosure algorithm and the decentralized identity identifier, and the selective disclosure algorithm instructs the user to only provide part of the identity attribute information related to the generation of the attribute private key, and the user's data is transmitted through the first node; then, for the user who has passed the verification, the first node sends the user's first data to the second node of the blockchain after the attribute encryption and the corresponding attribute private key, and the attribute private key is used to decrypt the second data. In this way, the authenticity of the user's identity attribute information can be effectively guaranteed by utilizing the characteristics of blockchain such as non-tamperability, traceability, and anti-counterfeiting, and the selective disclosure algorithm is implemented based on the decentralized identity identifier, and the user provides part of the identity attribute information related to the generation of the attribute private key, and does not need to disclose the full amount of identity attribute information, so as to avoid the leakage of the user's identity attribute information and effectively protect the privacy of the user's identity attribute information. In addition, the use of attribute encryption to encrypt the transmitted data can improve the security of data transmission in one-to-many scenarios and reduce resource and time overheads. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 A flowchart of an example of a data transmission method provided in an embodiment of the present application;

[0043] Figure 2A flowchart of a data transmission method provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of user identity management provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of user identity attribute information disclosure provided in an embodiment of the present application;

[0046] Figure 5 This is a flowchart of the current attribute encryption algorithm;

[0047] Figure 6 A flowchart of a method for generating an attribute private key provided in an embodiment of the present application;

[0048] Figure 7 A schematic diagram of the structure of a data transmission device 700 provided in an embodiment of the present application;

[0049] Figure 8 A schematic diagram of the structure of an electronic device 800 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] Taking the transmission method of important banking data as an example, this article introduces the currently used data transmission methods.

[0051] At present, data is mostly encrypted and transmitted using symmetric encryption algorithms or asymmetric encryption algorithms. Among them, the symmetric encryption algorithm takes the SM4 algorithm as an example. The SM4 algorithm is a block cipher algorithm that uses a 128-bit key and a 128-bit block size. It completes data encryption and decryption through 32 rounds of iterations and a series of permutations, substitutions, XOR operations, etc., where the same key is used for data encryption and decryption. The two parties involved in data transmission need to complete the key transmission while transmitting the ciphertext. It can be seen that the symmetric encryption algorithm has problems such as difficulty in key exchange and key leakage, low security, and the risk of being cracked. The asymmetric encryption algorithm takes the SM2 algorithm as an example. The SM2 algorithm is an asymmetric encryption algorithm based on elliptic curves. The two parties involved in data transmission hold encryption keys and decryption keys respectively. The encryption party uses the encryption key (also called the public key) to encrypt the data, and the decryption party uses the decryption key (also called the private key) to decrypt the data. When there are multiple data recipients, the encryption party needs to use the corresponding public key to perform encryption operations on the data, and these multiple data recipients are also required to be decryptors and obtain the corresponding private keys. Although asymmetric encryption algorithms have good security, in scenarios with multiple data recipients, a large amount of resources are required to calculate the ciphertext for each user, resulting in a serious waste of computing resources and time resources.

[0052] In the banking industry and other scenarios where there are many important data that need to be transmitted securely, such as the shared transmission of data between peer anti-fraud platforms, it is important to protect the confidentiality, integrity, and availability of important data while ensuring the authenticity and reliability of the user's identity attribute information and the privacy of the user's identity attribute information, and reducing the resource and time overhead of encryption and decryption during data transmission. These are important demand issues that need to be addressed urgently.

[0053] Based on this, an embodiment of the present application provides a data transmission method, which may include, for example: first, a first node of the blockchain obtains a decentralized identity identifier, which is used to indicate the authenticity of the identity attributes of the first node; then, the first node verifies the identity of the user based on a selective disclosure algorithm and a decentralized identity identifier, and the selective disclosure algorithm instructs the user to only provide partial identity attribute information related to the generation of an attribute private key, and the user's data is transmitted through the first node; then, for the user who has passed the verification, the first node sends the user's first data, which is the second data encrypted by attributes, and the corresponding attribute private key to the second node of the blockchain, and the attribute private key is used to decrypt the second data.

[0054] In this way, by utilizing the characteristics of blockchain such as immutability, traceability, and anti-counterfeiting, the authenticity of the user's identity attribute information can be effectively guaranteed. A selective disclosure algorithm can be implemented based on decentralized identity identification. The user provides partial identity attribute information related to the generation of attribute private keys, and there is no need to disclose the full amount of identity attribute information, thereby avoiding the leakage of the user's identity attribute information and effectively protecting the privacy of the user's identity attribute information. In addition, using attribute encryption to encrypt the transmitted data can improve the security of data transmission in one-to-many scenarios and reduce resource and time overhead.

[0055] It should be noted that the subject implementing the data transmission method may be the data transmission device provided in the embodiment of the present application. The data transmission device may be carried in an electronic device or a functional module of the electronic device.

[0056] Some technical terms involved in the embodiments of the present application are introduced and explained below.

[0057] Blockchain refers to a chain data structure formed by combining all blocks in a sequential manner according to the time of block generation. It has the characteristics of decentralization, immutability, anti-counterfeiting, and traceability. According to different requirements for the authority of participants, it can be divided into three types: public chain, consortium chain and private chain.

[0058] Decentralized identity authentication is an identity authentication method developed based on blockchain after centralized identity authentication and alliance identity authentication. The user controls the identity information by himself and completes the authentication of the user's identity based on decentralized identity identification. It has the characteristics of security, controllability and decentralization. Decentralized identity identification can be understood as a file including VP and VC.

[0059] Selective disclosure means that users no longer provide all information when submitting information for security and privacy reasons, but instead provide only the necessary information based on the principle of minimization.

[0060] Attribute encryption is a type of public key encryption. It achieves one-to-many encryption and decryption by associating ciphertext and key with attribute set and access structure. It also achieves fine-grained control over data, allowing data owners to have full control over the data. Depending on the associated object, it can be divided into attribute encryption based on ciphertext policy and attribute encryption based on key policy. The user can decrypt successfully if and only if the user's attribute set meets the access structure of the ciphertext.

[0061] In order to make the method provided in the embodiment of the present application clearer, Figure 1 , introduces the units included in the data transmission device provided in the embodiment of the present application and the main implementation steps of each unit.

[0062] like Figure 1 As shown, the data transmission device may at least include: a blockchain infrastructure unit, a user identity management unit, a user attribute disclosure unit, and a privacy data protection unit. Among them, this embodiment may include, for example: S1, the blockchain infrastructure unit builds a consortium chain; S2, the user identity management unit distributes decentralized identity identification; S3, the user identity management unit grants user identity information; S4, the user attribute disclosure unit constructs a verifiable credential (i.e., VP); S5, the initialization module of the privacy data protection unit generates a public key and a master private key; S6, the encryption module of the privacy data protection unit performs attribute encryption in the embodiment of this application; S7, the attribute private key generation module of the privacy data protection unit generates an attribute private key; S8, the decryption module of the privacy data protection unit performs attribute decryption in the embodiment of this application.

[0063] Among them, the blockchain infrastructure unit, using the characteristics of blockchain such as immutability, traceability, and anti-counterfeiting, can help managers to manage user identities. For scenarios such as important banking data, considering that it often occurs between fixed institutions or personnel, the embodiment of the present application uses the alliance chain as the underlying infrastructure platform in S1.

[0064] For S2, decentralized identity is a new identity authentication method based on blockchain, which can effectively guarantee the authenticity and validity of the holder's identity attributes, and has the characteristics of decentralization. Figure 3 As shown, in the embodiment of the present application, an administrator distributes decentralized identity identifiers to participating users and grants corresponding roles (ie, user identity information in S3), and users can generate verifiable statements (ie, VCs) as needed.

[0065] For S4, in traditional attribute encryption, users need to provide complete identity attribute information to generate decryption keys. However, in this process, the authenticity of user identity information is difficult to guarantee, and there is also a risk of identity information leakage. Therefore, the embodiment of the present application adopts a selective disclosure algorithm based on the Merkle tree. Users only need to provide part of the identity attribute information required for key generation, without providing all the identity attribute information, thereby protecting the privacy of the identity attribute information. In this way, the strong collision property of the hash algorithm and the decentralized identity identification based on the blockchain can effectively prove the authenticity of the user's identity. For details, please refer to Figure 4 And relevant examples.

[0066] For S5 to S8, the privacy data protection unit mainly uses the ciphertext policy attribute-based encryption algorithm to complete the encryption and decryption of the data to be transmitted. Figure 5 as well as Figure 6 and related descriptions.

[0067] visible, Figure 1 The data transmission device shown is aimed at important data transmission in the banking industry, especially the scenario where one party sends data and multiple parties receive data. It uses blockchain as an infrastructure platform, builds a consortium chain within the scope of data knowledge, distributes decentralized identity identification to each participant, and the relevant management department endorses the identity attribute information of the participants. The attribute encryption algorithm based on the ciphertext strategy is used to encrypt the data to generate ciphertext. The participants provide their attribute information to obtain the decryption key (that is, the attribute private key mentioned in this article), and use the decryption key to decrypt the ciphertext to obtain the original data, completing the private data transmission. In this way, data security, user privacy and encryption and decryption efficiency are taken into account, and a better data transmission solution is provided for scenarios such as the secure transmission of important data in the banking industry.

[0068] Figure 2 A flow chart of a data transmission method provided in an embodiment of the present application. The method can be applied to a data transmission device, which can be, for example, Figure 1 , or Figure 7 A data transmission device 700 is shown.

[0069] like Figure 2As shown, the method may include, for example, the following S201 to S203:.

[0070] S201, a first node of the blockchain obtains a decentralized identity identifier, where the decentralized identity identifier is used to indicate the authenticity of the identity attribute of the first node.

[0071] Among them, decentralized identity identification may include but is not limited to verifiable credentials VP and verifiable claims VC. As an example, Figure 3 As shown, the first node may be, for example, a data owner, and S201 may include: a VC issued by a management staff and received by the data owner from the management staff; and a VP provided by a data user and received by the data owner from the data user.

[0072] It should be noted that the managers, data owners, data users, etc. in the embodiments of the present application are merely simple names given for easy understanding, and can all be understood as management or control devices controlled or operated by people.

[0073] S202, the first node verifies the identity of the user based on the selective disclosure algorithm and the decentralized identity identifier. The selective disclosure algorithm instructs the user to only provide partial identity attribute information related to the generation of the attribute private key, and the user's data is transmitted through the first node.

[0074] As an example, if the selective disclosure algorithm is a selective disclosure algorithm based on a Merkle tree, verifying the user identity in S202 may include: verifying the validity of the digital signature of the Merkle root; and determining whether the summary information of the Merkle root and the identity attribute information disclosed by the user are equal, wherein the identity attribute information disclosed by the user includes VP.

[0075] For example, if Figure 4 As shown, taking the decentralized identity of the user including C3 as an example, C3 can be the VP of the user, for example. Based on the selective disclosure algorithm, the user can only provide {C3, Salt3, Hash12, Hash4, MerkleRoot, Sig(T)}, and no longer needs to provide complete identity attribute information. Among them, Salt3 can be understood as the user's salt value, which is used to ensure the security of the information provided by the user, MerkleRoot is the Merkle root, and Sig(T) is the digital signature of Sig(T). Then, the verification process of S202 can include: the data owner verifies the validity of Sig(T), and determines whether MerkleRoot is equal to Hash(Hash(Hash(C3||Salt3)||Hash4)||Hash12) to verify the authenticity and correctness of the user's identity.

[0076] S203: For the user who has passed the verification, the first node sends the second data of the user's first data encrypted by attributes and the corresponding attribute private key to the second node of the blockchain. The attribute private key is used to decrypt the second data.

[0077] As an example, before S203, the method may further include: the first node obtains the second data and the corresponding attribute private key. The process of the first node obtaining the second data may include, for example, the first node encrypting the first data based on the public key and the access structure of the identity attribute information disclosed by the user to obtain the second data. The process of the first node obtaining the attribute private key may include, for example, the first node obtaining the attribute private key based on the VC and the master private key corresponding to the public key, using a key generation algorithm to obtain the attribute private key.

[0078] After S203, for the second node that receives the second data and the corresponding attribute private key, the method may further include: if the identity attribute information disclosed by the second node matches the access structure, decrypting the second data based on the attribute private key and the public key to obtain the first data.

[0079] like Figure 5 As shown in FIG. 1 , the execution process of the current traditional ciphertext policy attribute encryption algorithm may include: (1) the administrator executes Setup()→(PK, MSK), and uses implicit security parameters (which may be random numbers) as input to generate a public key PK and a master private key MSK for the data owner, wherein MSK is uniformly managed by the administrator and sent to the data owner; (2) the data owner executes the encryption algorithm Encrypt(PK, M, AS)→CT, where AS is the data owner setting an access structure for the plaintext data M as required, and uses the public key PK to encrypt M, generate a ciphertext CT, and send the ciphertext CT to the data user; (3) the administrator obtains Attr (for example, it may be the VC of the data user) from the data user, and executes the key generation algorithm KeyGen(MSK, Attr)→SK to obtain the attribute private key SK, thereby sending SK to the data user; (4) after obtaining the attribute private key SK and the ciphertext CT, the data receiver uses the decryption algorithm Decrypt(PK, CT, SK)→M to decrypt the ciphertext to obtain the original plaintext M. It can be seen that the process in which managers participate in the calculation and sending of public keys and attribute private keys is not convenient and safe enough.

[0080] The execution process of the ciphertext policy attribute encryption algorithm provided in the embodiment of the present application can be seen, for example, in Figure 6As shown, the process may include: 1. The data user provides VP to the data owner; 2. The data owner verifies; 3. After the verification is passed, the data owner executes the key generation algorithm KeyGen(MSK, Attr)→SK to obtain the attribute private key SK; 4. The data owner sends SK to the data user. It can be seen that in traditional attribute encryption, (3) this link requires the data user to provide his or her complete identity attribute information to the data owner or manager to generate an attribute private key for himself or herself, and the authenticity and privacy of the user's identity attribute information are difficult to guarantee; in the embodiment of the present application, the user generates a verifiable statement VC based on the selective disclosure algorithm and submits it to the data owner. The data owner uses the blockchain to verify the VC submitted by the user and generate an attribute private key for it. It should be noted that the user in the embodiment of the present application can be understood as a data user or a second node, or an account that carries information and interacts with the outside world.

[0081] It should be noted that only when the identity attribute information provided by the data user meets the access structure set by the data owner can the data user correctly decrypt to obtain the original ciphertext. Therefore, it can be understood that the embodiment of the present application also has the function of access control.

[0082] It can be seen that in this method, a user identity management platform is built based on blockchain, and decentralized identity identification is distributed to users through the platform, and the corresponding identity information is declared; the decentralized identity identification is combined with the ciphertext policy attribute-based encryption algorithm, and a selective disclosure algorithm is used to generate a decryption key (i.e., attribute private key) for the user on the basis of protecting the privacy of the user's identity attribute information, so as to complete the data security transmission. In the case of secure transmission of important data in the banking industry, for example, especially in the scenario of secure transmission of important data with multiple data recipients (also understood as data users), the embodiment of the present application solves the problem of high resource consumption caused by multiple encryption in traditional encryption algorithms, which not only protects data confidentiality, security and availability, but also ensures the authenticity and privacy of the user's identity attribute information.

[0083] Accordingly, the embodiment of the present application further provides a data transmission device 700, such as Figure 7 The device 700 is applied to the first node of the blockchain, and the device 700 may include:

[0084] An acquiring unit 701 is used to acquire a decentralized identity identifier, where the decentralized identity identifier is used to indicate the authenticity of the identity attribute of the first node;

[0085] A verification unit 702, configured to verify the identity of the user based on a selective disclosure algorithm and the decentralized identity identifier, wherein the selective disclosure algorithm instructs the user to provide only part of the identity attribute information related to the generation of the attribute private key, and the user's data is transmitted via the first node;

[0086] The sending unit 703 is used to send the second data of the user whose first data is attribute-encrypted and the corresponding attribute private key to the second node of the blockchain for the user who has passed the verification, and the attribute private key is used to decrypt the second data.

[0087] Optionally, the decentralized identity includes VP and VC.

[0088] Optionally, the selective disclosure algorithm is a Merkle tree-based selective disclosure algorithm, and the verification unit 702 is specifically used to:

[0089] Verify the validity of the Merkle root’s digital signature;

[0090] It is determined whether the Merkle root is equal to summary information of the identity attribute information disclosed by the user, wherein the identity attribute information disclosed by the user includes the VP.

[0091] Optionally, the device 700 further includes: an encryption unit;

[0092] The encryption unit is used to perform attribute encryption on the first data based on the public key and the access structure of the identity attribute information disclosed by the user to obtain the second data.

[0093] Optionally, the device 700 further includes: a key generating unit;

[0094] The key generation unit is used to obtain the attribute private key by adopting a key generation algorithm based on the VC and a master private key corresponding to the public key.

[0095] Optionally, the device 700 is also applied to a second node of the blockchain, and the device 700 further includes:

[0096] A decryption unit is used to decrypt the second data based on the attribute private key and the public key to obtain the first data if the identity attribute information disclosed by the second node matches the access structure.

[0097] It should be noted that the specific implementation method of the device 700 and the technical effect achieved can refer to the relevant description of the method provided in the embodiment of the present application.

[0098] In addition, an embodiment of the present application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device executes any implementation of the method provided in the embodiment of the present application.

[0099] See also Figure 5 , which shows a schematic diagram of the structure of an electronic device 800 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0100] like Figure 8 As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 are also stored. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0101] Typically, the following devices may be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 809. The communication device 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 The electronic device 800 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0102] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 809, or installed from the storage device 808, or installed from the ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0103] The electronic device provided by the embodiment of the present disclosure and the method provided by the above embodiment belong to the same inventive concept, and the technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0104] The embodiment of the present application also provides a computer-readable medium, in which instructions or computer programs are stored. When the instructions or computer programs are executed on a device, the device executes any implementation of the method provided in the embodiment of the present application.

[0105] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0106] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0107] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0108] The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device can execute the method.

[0109] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0110] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0112] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0113] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0114] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0115] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0116] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0117] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0118] It should be noted that in the embodiments of the present application, user sensitive information is not involved, and user-related information is obtained, used and determined after user authorization. In one example, before obtaining user-related information, the corresponding interface displays prompt information related to obtaining data use authorization. The prompt information is based on relevant laws and regulations in an appropriate manner to inform the user of the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure, so that the user can determine whether to agree to the authorization based on the prompt information. It can be understood that the above notification and the process of obtaining user authorization are only illustrative and do not constitute a limitation on the implementation method of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation method of the present disclosure.

[0119] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data transmission method, characterized in that: The method comprises: The first node of the blockchain obtains a decentralized identity identifier, where the decentralized identity identifier is used to indicate the authenticity of the identity attribute of the first node; The first node verifies the identity of the user based on a selective disclosure algorithm and the decentralized identity identifier, the selective disclosure algorithm instructs the user to provide only part of the identity attribute information related to the generation of the attribute private key, and the user's data is transmitted through the first node; For a user who has passed the verification, the first node sends the second data obtained by attribute-encrypting the user's first data and the corresponding attribute private key to the second node of the blockchain, and the attribute private key is used to decrypt the second data.

2. The method according to claim 1, characterized in that The decentralized identity includes a verifiable credential VP and a verifiable claim VC.

3. The method according to claim 2, characterized in that The selective disclosure algorithm is a selective disclosure algorithm based on a Merkle tree, and the verification of user identity includes: The first node verifies the validity of the digital signature of the Merkle root; The first node determines whether the Merkle root is equal to summary information of identity attribute information disclosed by the user, and the identity attribute information disclosed by the user includes the VP.

4. The method according to claim 2, characterized in that: The process of the first node obtaining the second data includes: The first node performs attribute encryption on the first data based on the public key and the access structure of the identity attribute information disclosed by the user to obtain the second data.

5. The method according to claim 4, characterized in that The method further comprises: If the identity attribute information disclosed by the second node matches the access structure, the second data is decrypted based on the attribute private key and the public key to obtain the first data.

6. The method according to claim 4 or 5, characterized in that: The process of the first node obtaining the attribute private key includes: The first node obtains the attribute private key by using a key generation algorithm based on the VC and a master private key corresponding to the public key.

7. A data transmission device, characterized in that: Applied to a first node of a blockchain, the device comprises: An acquiring unit, configured to acquire a decentralized identity identifier, wherein the decentralized identity identifier is used to indicate the authenticity of the identity attribute of the first node; a verification unit, configured to verify the identity of the user based on a selective disclosure algorithm and the decentralized identity identifier, wherein the selective disclosure algorithm instructs the user to provide only part of the identity attribute information related to the generation of the attribute private key, and the user's data is transmitted via the first node; The sending unit is used to send, for a user who has passed the verification, second data obtained by attribute-encrypting the user's first data and a corresponding attribute private key to a second node of the blockchain, wherein the attribute private key is used to decrypt the second data.

8. The device according to claim 7, characterized in that The decentralized identity includes a verifiable credential VP and a verifiable claim VC.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; The memory is used to store instructions or programs; The processor is used to execute the instructions or programs in the memory so that the electronic device executes the method according to any one of claims 1 to 6.

10. A readable medium, characterized in that: The readable medium stores instructions or programs, and when the instructions or programs are executed on a processor, the processor is enabled to execute the method according to any one of claims 1 to 6.

Images