Multi-party consensus authentication and synchronization method and device of data and electronic equipment

Abstract

The invention provides a multi-party consensus authentication and synchronization method and device for data and electronic equipment, and the method comprises the steps: obtaining a first operation request of a first management party, generating a first certificate when the first operation request is verified to be a legal request according to an identifier of the first management party, and forwarding the first certificate to a plurality of organizations, and sending the first certificate to the plurality of organizations to enable the plurality of organizations to verify and sign the first certificate to obtain a second certificate, finally obtaining at least one second certificate, and synchronizing the first operation information to the plurality of organizations based on the at least one second certificate to enable each organization to execute a first operation in the first operation information. According to the technical scheme, the legality of the operation request is ensured by performing multi-organization verification signature on the first certificate, and the operation information data synchronization is executed based on the second certificate, so that the technical effects of ensuring the legality of the operation request, increasing the security and transparency of data synchronization and improving the data synchronization efficiency are realized.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to a multi-party consensus authentication and synchronization method, device and electronic device for data. Background Art

[0002] The certificate issuance service ensures the security of communication and identity authentication on the Internet by providing trusted digital certificates for certificate data transmission and synchronization. The distributed certificate issuance service introduces blockchain technology, especially consortium chain technology, which can enhance the reliability and security of data synchronization of the certificate issuance service system.

[0003] At present, the certificate issuance services of alliance chains are mostly based on developed tools or packaged certificate issuance services, and the certificate issuance service is a single service model, which is only responsible for the data synchronization of transactions of alliance chain nodes of a single organization in the alliance chain. There is a technical problem of low data synchronization efficiency during transaction operations. Summary of the invention

[0004] The present application provides a multi-party consensus authentication and synchronization method, device and electronic device for data to solve the technical problem of low data synchronization efficiency during transaction operations.

[0005] In a first aspect, the present application provides a data synchronization method, which is applied to a first device in a first organization among multiple organizations of a consortium chain, and the method includes:

[0006] Obtaining a first operation request from a first management party, wherein the first operation request carries an identifier of the first management party and first operation information, wherein the first operation information is operation information of at least one of adding, updating, and deregistering a user information database;

[0007] When verifying that the first operation request is a legitimate request according to the identifier of the first management party, generating a first certificate, the first certificate including: the first operation information and verification information of the first management party;

[0008] Forwarding the first certificate to the multiple organizations, so that the multiple organizations verify the signature of the first certificate to obtain a second certificate;

[0009] At least one second certificate is obtained, and based on the at least one second certificate, the first operation information is synchronized to the plurality of organizations, so that each organization performs the first operation in the first operation information.

[0010] In a possible implementation manner, when verifying that the first operation request is a legitimate request according to the identifier of the first management party, generating a first certificate includes:

[0011] Verifying whether the identifier of the first management party exists in a preset identifier set, wherein the identifier set stores identifiers of the legitimate management parties corresponding to the multiple organizations respectively;

[0012] When the identifier of the first management party exists in the identifier set, the first certificate is generated according to the first operation request.

[0013] In a possible implementation manner, forwarding the first certificate to the multiple organizations so that the multiple organizations verify the signature of the first certificate to obtain the second certificate includes:

[0014] When it is detected that the verification information of the first management party in the first certificate is verified, the second certificate is signed to obtain the second certificate, wherein the verification is whether the verification information of the first management party exists in the verification information set, and the second certificate carries the signature of the corresponding organization;

[0015] And, forwarding the first certificate to other organizations among the multiple organizations, so that the other organizations verify the signature of the first certificate to obtain the second certificate.

[0016] In a possible implementation, the acquiring at least one second certificate, and synchronizing the first operation information to the multiple organizations based on the at least one second certificate so that each organization performs the first operation in the first operation information, includes:

[0017] receiving the at least one second certificate;

[0018] When the signature information of the corresponding organization in all the received second certificates reaches a preset condition, the first operation information is synchronized to the multiple organizations, so that each organization executes the first operation in the first operation information.

[0019] In a possible implementation, the method further includes:

[0020] The at least one second certificate is stored.

[0021] In a possible implementation, the method further includes:

[0022] When it is detected that all nodes of the first organization are restarted and data loss is detected in all nodes, obtaining a certificate set from the other organizations, the certificate set including: at least one certificate from the multiple organizations;

[0023] determining, from the set of certificates, a third certificate associated with the first organization;

[0024] The data to be restored is obtained from the other organization according to the third certificate.

[0025] In a possible implementation, the method further includes:

[0026] When it is detected that some nodes of the first organization are restarted and data loss is detected in the some nodes, data to be recovered is obtained from the non-restarted nodes.

[0027] In a second aspect, the present application provides a data synchronization device, which is applied to a first device in a first organization among multiple organizations of a consortium chain, and the device includes:

[0028] an acquisition module, configured to acquire a first operation request from a first management party, wherein the first operation request carries an identifier of the first management party and first operation information, wherein the first operation information is operation information of at least one of adding, updating, and deregistering a first user information database;

[0029] a first processing module, configured to generate a first certificate when verifying that the first operation request is a legitimate request according to the identifier of the first management party, wherein the first certificate includes: the first operation information and verification information of the first management party;

[0030] A second processing module, configured to forward the first certificate to the multiple organizations, so that the multiple organizations verify the signature of the first certificate to obtain a second certificate;

[0031] The third processing module is used to obtain at least one second certificate, and based on the at least one second certificate, synchronize the first operation information to the multiple organizations, so that each organization performs the first operation in the first operation information.

[0032] In a possible implementation manner, the first processing module is specifically configured to:

[0033] Verifying whether the identifier of the first management party exists in a preset identifier set, wherein the identifier set stores identifiers of the legitimate management parties corresponding to the multiple organizations respectively;

[0034] When the identifier of the first management party exists in the identifier set, the first certificate is generated according to the first operation request.

[0035] In a possible implementation manner, the second processing module is specifically configured to:

[0036] When it is detected that the verification information of the first management party in the first certificate is verified, the second certificate is signed to obtain the second certificate, wherein the verification is whether the verification information of the first management party exists in the verification information set, and the second certificate carries the signature of the corresponding organization;

[0037] And, forwarding the first certificate to other organizations among the multiple organizations, so that the other organizations verify the signature of the first certificate to obtain the second certificate.

[0038] In a possible implementation manner, the third processing module is specifically configured to:

[0039] receiving the at least one second certificate;

[0040] When the signature information of the corresponding organization in all the received second certificates reaches a preset condition, the first operation information is synchronized to the multiple organizations, so that each organization executes the first operation in the first operation information.

[0041] In a possible implementation, the device further includes:

[0042] A storage module is used to store the at least one second certificate.

[0043] In a possible implementation manner, the third processing module is further used to:

[0044] When it is detected that all nodes of the first organization are restarted and data loss is detected in all nodes, obtaining a certificate set from the other organizations, the certificate set including: at least one certificate from the multiple organizations;

[0045] determining, from the set of certificates, a third certificate associated with the first organization;

[0046] The data to be restored is obtained from the other organization according to the third certificate.

[0047] In a possible implementation manner, the third processing module is further used to:

[0048] When it is detected that some nodes of the first organization are restarted and data loss is detected in the some nodes, data to be recovered is obtained from the non-restarted nodes.

[0049] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0050] The memory stores computer-executable instructions;

[0051] The processor executes the computer-executable instructions stored in the memory to implement the method as described in the first aspect or any one of the above methods.

[0052] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect or any one of the methods.

[0053] The multi-party consensus authentication and synchronization method, device and electronic device of data provided in the present application obtains a first operation request from a first management party, and then generates a first certificate when verifying that the first operation request is a legitimate request based on the identification of the first management party, forwards the first certificate to multiple organizations, so that multiple organizations can verify and sign the first certificate to obtain a second certificate, and finally obtain at least one second certificate, and based on at least one second certificate, synchronize the first operation information to multiple organizations, so that each organization can perform the first operation in the first operation information. This technical solution ensures the legitimacy of the operation request by performing multi-organization verification signatures on the first certificate, and performs data synchronization of the operation information based on the second certificate, thereby achieving the technical effects of ensuring the legitimacy of the operation request, increasing the security and transparency of data synchronization, and improving the efficiency of data synchronization. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0055] Figure 1 A schematic diagram of the alliance chain architecture of the data synchronization method provided in the embodiment of the present application;

[0056] Figure 2 Schematic diagram of the data synchronization method provided in the embodiment of the present application Figure 1 ;

[0057] Figure 3 Schematic diagram of the data synchronization method provided in the embodiment of the present application Figure 2 ;

[0058] Figure 4 Schematic diagram of the data synchronization method provided in the embodiment of the present application Figure 3 ;

[0059] Figure 5 A schematic diagram of a data recovery workflow provided by an embodiment of the present application;

[0060] Figure 6 A schematic diagram of the workflow of the certificate chain contract module provided in the embodiment of the present application;

[0061] Figure 7 A schematic diagram of the workflow of data cancellation provided in an embodiment of the present application;

[0062] Figure 8A schematic diagram of the structure of a data synchronization device provided in an embodiment of the present application;

[0063] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0064] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0065] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0066] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0067] Before introducing the embodiments of the present application, the terms involved in the embodiments of the present application are first explained:

[0068] Consortium chain: a blockchain network jointly maintained by multiple parties, usually used in business cooperation and multi-party consensus scenarios.

[0069] Organization: A participant in the alliance chain network. An organization can be a bank, enterprise, institution, etc.

[0070] Node: A device used to store, verify transactions, or provide computing resources (e.g., servers, computers, etc.). Each organization’s nodes jointly maintain the blockchain’s consensus mechanism, transaction verification, and ledger synchronization.

[0071] Certificate chain: A multi-party trusted certificate data chain structure formed by certificate data generated by any organization in the alliance chain after being verified and approved by other organizations in the alliance chain.

[0072] Secondly, the application background of the embodiment of the present application is explained:

[0073] The certificate issuance service ensures the security of communication and identity authentication on the Internet by providing trusted digital certificates and synchronizing certificate data. The distributed certificate issuance service introduces blockchain technology, especially consortium chain technology. Each node in the consortium chain jointly participates in the review and issuance of certificates, which enhances the reliability and security of data synchronization in the certificate issuance service system and prevents the loss or tampering of certificate data due to the failure of a single institution or node.

[0074] At present, the certificate issuance service of the alliance chain is mostly based on development tools or packaged certificate issuance services, and the certificate issuance service is a single service model, which is only responsible for the transactions of the alliance chain nodes of a single organization in the alliance chain, and cannot perform concurrent transactions of multiple related organizations. When the server in the alliance chain is single or the data is lost, it is difficult to restore the certificate service function, and it is no longer possible to cancel, update or add new certificates.

[0075] Therefore, the prior art has the technical problem of low data synchronization efficiency during transaction operations.

[0076] In response to the technical problems existing in the prior art, the inventor of the present application has the following idea: in order to solve the problem of low data synchronization efficiency during transaction operations in the prior art, signatures of certificates corresponding to operation requests from multiple organizations can be obtained, and then the execution results corresponding to the operation information can be automatically synchronized to all organizations in the alliance chain to improve the efficiency of data synchronization. Specifically, whether the operation request is legal can be determined based on whether the operation information of the administrator of the first organization (that is, any organization in the alliance chain) carries the identification of the first administrator. If the operation request is legal, a first certificate is generated, and then the first certificate is sent to other organizations in the alliance chain for signature verification. The first organization performs signature verification based on the collected second certificate (that is, the signed first certificate). After the signature meets the preset conditions, the first organization sends the data corresponding to the operation information to all organizations in the alliance chain, so that the data corresponding to the operation information is synchronously updated in all organizations.

[0077] The following specific embodiments are used to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0078] Specifically, Figure 1 A schematic diagram of the alliance chain architecture of the data synchronization method provided in the embodiment of the present application, such as Figure 1 As shown, the method involved in the embodiment of the present application is briefly introduced:

[0079] Figure 1Take the example of three organizations in the alliance chain. Each organization includes an administrator, a certificate service module (including a certificate chain module), multiple nodes and a certificate chain contract module.

[0080] When any organization (for example, organization 1) needs to perform a transaction operation, the certificate service module will respond to the operation request and send the first certificate to any node (for example, node 0) in combination with the certificate chain module. Any node will send the first certificate to the certificate chain contract module of this organization and the certificate chain contract module of other organizations. Then, organization 1 collects the second certificate after the signature is verified by the certificate chain contract module of all organizations. When the certificate chain contract module of organization 1 verifies that the multi-organization signature information meets the preset conditions, organization 1 synchronizes the data corresponding to the operation information to all organizations.

[0081] Wherein, matters not elaborated in detail are disclosed by the following embodiments.

[0082] The technical solution of the present application is described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0083] It is worth noting that the application fields of the multi-party consensus authentication and synchronization method, device and electronic device of the data of this application are not limited.

[0084] Figure 2 Schematic diagram of the data synchronization method provided in the embodiment of the present application Figure 1 ,like Figure 2 As shown, the method is applied to a first device in a first organization among multiple organizations of a consortium chain, and may include the following steps:

[0085] Step 21: Obtain a first operation request from a first management party.

[0086] The first operation request carries the identifier of the first management party and first operation information, and the first operation information is operation information of at least one of adding, updating, and canceling the user information database;

[0087] In this step, the administrator of any organization in the alliance chain sends a first operation request, and the certificate service module in the organization obtains the first operation information of the first administrator.

[0088] The first organization is any organization in the alliance chain, the first device is a device (for example, a computer, a server, etc.) used for certificate issuance services in the first organization, and the first management party is a manager of the first device in the first organization.

[0089] In a possible implementation, an administrator in organization 1 sends an operation message to add a user, and a certificate service module (such as Figure 1 As shown) obtains the operation information request for an administrator in organization 1 to add a user.

[0090] Step 22: When the first operation request is verified to be a legitimate request according to the identifier of the first management party, a first certificate is generated.

[0091] The first certificate includes: first operation information and verification information of the first management party;

[0092] In this step, when the certificate chain module in the certificate service module verifies that the first operation request is a legal request according to the identifier of the first management party, the certificate service module generates a first certificate.

[0093] The identifier of the first management party may be a unique identification identifier (ID), a digital certificate, a key pair or other forms of identification identifiers, which are used to prove the identity of the management party and ensure that the identity of the first management party is legal.

[0094] Optionally, step 22 may also be implemented as follows:

[0095] Step 1: Verify whether the identifier of the first management party exists in the preset identifier set.

[0096] The identification set stores the identifications of the legal management parties corresponding to the multiple organizations respectively;

[0097] In this step, the certificate chain module verifies whether the identifier of the first management party exists in the preset identifier set.

[0098] Among them, all identification sets are stored in the database in the certificate chain module, and the identification sets in the certificate chain modules of all organizations include the identification information of the management parties corresponding to all organizations.

[0099] In a possible implementation, Figure 1 As shown, the identification set in the certificate chain module of organization 1 includes the identification information of the managers of organization 2 and organization 3.

[0100] Step 2: When the identifier of the first management party exists in the identifier set, generate a first certificate according to the first operation request.

[0101] In this step, when the certificate chain module recognizes that the identifier of the first administrator exists in the identifier set, it means that the identity authentication of the first administrator in the alliance chain is passed, and the certificate service module generates a first certificate according to the first operation request.

[0102] Among them, the first certificate includes operation information (for example, operation requester identity, request type, request time, request content, etc.) and management party verification information (for example, management party identification, request verification result, request certificate issuance date, etc.).

[0103] In a possible implementation, the content of the first certificate is: the requester's identity is the administrator of organization 1, the request type is resource addition, the request content is to add user 1's personal information, the management party is identified as the administrator of organization 1, and the request verification result is a legal request.

[0104] Step 23: forward the first certificate to multiple organizations, so that the multiple organizations verify the signature of the first certificate to obtain a second certificate;

[0105] In this step, the certificate service module sends the first certificate to any node within the first organization, and any node within the organization then forwards the first certificate data to other organizations among the multiple organizations in the alliance chain, so that multiple organizations can verify the signature of the first certificate respectively to obtain the second certificate.

[0106] The multiple organizations are all organizations in the alliance chain, and the second certificate includes signature information of each organization (for example, the signature and signing time of the administrator of each organization, etc.) based on the first certificate.

[0107] In one possible implementation, Figure 1 As shown, a consortium chain includes organization 1, organization 2 and organization 3, with organization 1 as the first organization, and organization 2 and organization 3 as other organizations. The certificate service module of organization 1 sends the first certificate to node 0, and node 0 sends the first certificate to nodes 0 of organization 2 and organization 3 respectively. Organization 2 and organization 3 verify the signature of the first certificate and obtain the second certificate respectively.

[0108] In a possible implementation, following the above example, the certificate service module of organization 1 sends the first certificate to node 1, node 1 sends the first certificate to nodes 3 of organization 2 and organization 3 respectively, and organization 2 and organization 3 verify the signature of the first certificate to obtain the second certificate respectively.

[0109] Step 24: Obtain at least one second certificate, and based on the at least one second certificate, synchronize the first operation information to multiple organizations, so that each organization performs the first operation in the first operation information.

[0110] In this step, any node in the organization corresponding to the first operation request obtains at least one second certificate, and the first organization synchronizes the first operation information to multiple organizations based on the at least one second certificate, so that each organization performs the first operation.

[0111] In one possible implementation, continuing with the above example, node 0 of organization 1 obtains the second certificate from organization 2 and organization 3, and organization 1 synchronizes the first operation information to organization 1, organization 2, and organization 3 based on the specific contents of the second certificate of organization 2 and the second certificate of organization 3, and each organization performs the first operation (that is, operations such as adding user information, updating user information, or canceling user information).

[0112] Optionally, after step 24, the following implementation may be performed:

[0113] Step 1: Store at least one second certificate.

[0114] In this step, each organization stores at least one second certificate.

[0115] Among them, the certificate chain module in each organization stores the verification information of the administrator in the second certificate and the signature information of each organization (the storage process of the certificate chain module can also be called chain processing), so that the certificate chain modules of all organizations have signature evidence of each organization, and each node in each organization stores the operation information in the second certificate.

[0116] The operation information includes the identity information of the operation requester and the data information corresponding to the operation (such as the corresponding user information in the operation of adding user information or the corresponding user information to be updated in the operation of updating user information).

[0117] In one possible implementation, continuing with the above example, the certificate chain modules of Organization 1, Organization 2, and Organization 3 all store the verification information of the administrator in the second certificates of all organizations and the signature information of the three organizations, and all nodes in Organization 1, Organization 2, and Organization 3 store the operation information in the second certificate.

[0118] The data synchronization method provided in the embodiment of the present application obtains a first operation request from a first management party, and then generates a first certificate when verifying that the first operation request is a legitimate request based on the identification of the first management party, forwards the first certificate to multiple organizations, so that multiple organizations verify and sign the first certificate to obtain a second certificate, and finally obtains at least one second certificate, and based on at least one second certificate, synchronizes the first operation information to multiple organizations, so that each organization executes the first operation in the first operation information. This technical solution ensures the legitimacy of the operation request by performing multi-organization verification signatures on the first certificate, and performs data synchronization of the operation information based on the second certificate, thereby achieving the technical effects of ensuring the legitimacy of the operation request, increasing the security and transparency of data synchronization, and improving the efficiency of data synchronization.

[0119] Based on the above embodiments, Figure 3 Schematic diagram of the data synchronization method provided in the embodiment of the present application Figure 2 ,like Figure 3 As shown, forwarding the first certificate to multiple organizations so that the multiple organizations verify the signature of the first certificate to obtain a second certificate includes:

[0120] Step 31: When it is detected that the verification information of the first management party in the first certificate is verified, a second certificate is signed.

[0121] The verification is whether the verification information of the first management party exists in the verification information set, and the second certificate carries the signature of the corresponding organization;

[0122] In this step, the certificate chain contract module of the organization corresponding to the first operation request detects the verification information of the first management party in the first certificate for verification. After the verification is passed, any node in the first organization will sign the first certificate to obtain the second certificate.

[0123] The verification information set refers to the various information used by all organizations in the alliance chain to check whether the certificates sent by each organization are valid during the certificate verification process. This information may include the issuer information of all organization certificates (i.e. the public key of the certificate issuing organization), certificate serial number, certificate validity period, etc.

[0124] In one possible implementation, following the above example, organization 1 compares and verifies the verification information of the first administrator in the first certificate, including the certificate issuer, certificate serial number, and certificate validity period, with the verification information set stored in the certificate chain module of this organization. If the certificate issuer and the certificate serial number are both legal and valid, and the certificate validity period is within the normal range, the verification is successful, and node 0 in organization 1 signs the first certificate to obtain the second certificate.

[0125] Step 32: forward the first certificate to other organizations in the plurality of organizations, so that the other organizations verify the signature on the first certificate to obtain a second certificate.

[0126] In this step, any node of the organization corresponding to the first operation request forwards the first certificate to other organizations in the alliance chain, so that other organizations verify the signature of the first certificate and obtain the second certificates of other organizations respectively.

[0127] In a possible implementation, following the above example, node 0 of organization 1 forwards the first certificate to organization 2 and organization 3. Organization 2 and organization 3 respectively verify the verification information of the first administrator in the first certificate. After the verification is passed, the CA of organization 2 and organization 3 respectively sign the first certificate to obtain a second certificate from organization 2 and a second certificate from organization 3.

[0128] Optionally, after step 32, the following implementation may be performed:

[0129] Step 1, receiving at least one second certificate;

[0130] In this step, any node of the organization corresponding to the first operation request in the alliance chain receives at least one second certificate and forwards it to the certificate chain contract module, and the certificate chain contract module receives at least one second certificate.

[0131] In a possible implementation, continuing with the above example, node 0 of organization 1 receives a second certificate sent by node 3 of organization 2 and a second certificate sent by node 5 of organization 3 respectively.

[0132] Step 2: When the signature information of the corresponding organization in all the received second certificates reaches a preset condition, the first operation information is synchronized to multiple organizations so that each organization executes the first operation in the first operation information.

[0133] In this step, the certificate chain contract module of the organization corresponding to the first operation request parses the signature data in all second certificates, and uses the root certificates of all organizations stored in the organization to perform signature verification. When the signature information of the corresponding organization in all received second certificates (that is, the verified signature information) meets the preset conditions, the certificate chain contract module of the first organization forwards the second certificate set (that is, the second certificates of all organizations) to the certificate chain contract modules of other organizations through any node to perform signature verification of the second certificates of multiple organizations. When the signature verification of other organizations passes (that is, the preset conditions are met), the first operation information in the first certificate is synchronized to multiple organizations through any node in the organization, so that each organization performs the first operation (that is, the certificate data corresponding to the synchronized first operation information is stored in all organizations in the alliance chain, and the operation data corresponding to the first operation is stored in each node of all organizations).

[0134] The preset conditions may be that the signature is legal, the identity of the signatory meets the requirements (i.e., whether the signatory is a manager recorded in the alliance chain), the number of signing organizations meets the requirements, etc. The operation data corresponding to the first operation may be user personal information corresponding to an add user operation, user personal information to be updated corresponding to an update user information operation, etc.

[0135] The above number of signing organizations is set in advance by the organizations in the alliance chain. The number requirement can be met only if more than half of the organizations sign, or it can be met only if all organizations sign. Each organization can pre-set it according to actual conditions.

[0136] In one possible implementation, following the above example, for the operation request of organization 1 to change the personal information of user 1, the certificate chain contract module of organization 1 parses the signature data in the second certificates of all collected organizations, and uses the signature hash value in the root certificate of all organizations stored in the organization to compare and verify with the hash value of the organization signature in the second certificate. If the verification passes, it means that the signature is legal and valid. When the verified signature information in all received second certificates meets the preset conditions, the certificate chain contract module of organization 1 forwards the second certificate set (including the second certificates of organization 2 and organization 3) to the certificate chain contract modules of organization 2 and organization 3 through node 0 for signature verification of the second certificates of multiple organizations. When the signature verifications of organization 2 and organization 3 pass, the operation information of changing the personal information of user 1 is synchronized to organization 2 and organization 3, so that organization 2 and organization 3 perform the operation of changing the personal information of user 1 and store the certificate data and multi-signature data generated during the operation.

[0137] The data synchronization method provided in the embodiment of the present application, when detecting that the verification information of the first administrator in the first certificate is verified successfully, signs to obtain a second certificate, and forwards the first certificate to other organizations in multiple organizations so that the other organizations verify and sign the first certificate to obtain the second certificate. In this technical solution, when all organizations in the alliance chain verify the verification information of the first administrator successfully, they sign the first certificate to obtain the second certificate. Through the multi-party verification and signature mechanism, the trust of each organization in data synchronization is improved, the reliability and security of data synchronization are enhanced, and the process of synchronization of certificate data changes of all organizations in the alliance chain is simplified.

[0138] Based on the above embodiments, Figure 4 Schematic diagram of the data synchronization method provided in the embodiment of the present application Figure 3 ,like Figure 4 As shown, the method also includes:

[0139] Step 41: When it is detected that all nodes of the first organization are restarted and data loss is detected in all nodes, a certificate set is obtained from other organizations.

[0140] The certificate set includes: at least one certificate from multiple organizations;

[0141] In this step, the first organization detects that all its nodes are restarted and that the data stored in all nodes are lost. The first organization can obtain a certificate set from other organizations through any node connected to the certificate chain module.

[0142] Among them, the node represents the server in the organization, which is responsible for storing and transmitting data. The stored data in each node is the same, and the data corresponding to each operation request will be synchronously stored in each node. The certificate collection is all the certificates corresponding to the historical operation requests of all organizations.

[0143] In a possible implementation, the first organization is any enterprise in the alliance chain.

[0144] In a possible implementation, continuing with the above example, all nodes of organization 1 are restarted, and the data stored in all nodes in organization 1 are lost. After the restart, organization 1 obtains the certificate set stored in organization 2 or organization 3 from node 0 of organization 2 or organization 3 through node 0 of organization 1, and sends the certificate set to the certificate chain module.

[0145] Among them, other organizations will first verify whether the first organization's request for data recovery is legal and valid. If the verification is successful, the first organization obtains the certificate set from other organizations. If the verification fails, other organizations will reject the first organization's request for data recovery and return the reason for the failure to the first organization. After the verification is successful, the certificate data transmission between the first organization and other organizations needs to be transmitted in an encrypted manner to ensure that the data is not tampered with or leaked during the transmission process.

[0146] Optionally, step 41 may also be implemented as follows:

[0147] Step 1: When it is detected that some nodes of the first organization are restarted and data loss is detected in some nodes, data to be recovered is obtained from nodes that have not been restarted.

[0148] In this step, the first organization detects that some nodes in its own organization are restarted and the data stored in the restarted nodes are lost. The first organization can obtain the data to be restored from any non-restarted node to restore the data stored in the restarted node.

[0149] The data to be restored includes the storage data corresponding to the historical operation requests.

[0150] In a possible implementation, continuing with the above example, organization 1 detects that nodes 0 and 1 in its own organization are restarted, and the data stored in the restarted nodes is lost. Nodes 0 and 1 in organization 1 obtain the data stored in node 2 (that is, the data to be recovered) from node 2 that has not been restarted, so as to restore the data stored in node 0 and node 1.

[0151] Step 42: Determine a third certificate associated with the first organization in the certificate set;

[0152] In this step, the certificate chain module of the first organization determines the third certificate associated with the first organization in the certificate set through the organization identifier (eg, ID), issuer and other information of the certificate.

[0153] In a possible implementation, the certificate chain module of organization 1 determines, based on the identifier 00001 of organization 1, a certificate with the same identifier as the first organization in the certificate set as the third certificate.

[0154] Step 43: Obtain the data to be recovered from other organizations based on the third certificate.

[0155] In this step, the certificate chain module of the first organization restores and decrypts the root private key of the first organization based on the third certificate and saves it. The certificate service module of the first organization obtains the data to be restored from other organizations, and then restores the node database content and the certificate chain module database content based on the data to be restored, so that the first organization can be restored to the state before restart.

[0156] In one possible implementation, Figure 5 A schematic diagram of the data recovery workflow provided by the embodiment of the present application is shown in FIG. Figure 5 As shown, the process is explained in detail:

[0157] Step 501, start.

[0158] Step 502: The certificate service module is restarted.

[0159] In this step, the server in the first organization is restarted, and the certificate service module is also restarted accordingly.

[0160] Step 503: Whether to enable certificate chain.

[0161] In this step, the first organization determines whether the certificate chain needs to be enabled. If the certificate chain needs to be enabled, step 504 is executed; otherwise, step 509 is directly executed.

[0162] Step 504: Call the certificate chain module.

[0163] In this step, the certificate service module of the first organization calls the certificate chain module and sends a data recovery request to any other organization in the alliance chain.

[0164] Step 505: The node within the organization obtains the relevant certificate corresponding to its own ID.

[0165] In this step, after any other organization in the alliance chain receives a legitimate request from the organization with data to be recovered, it will send the relevant certificate to the organization with data to be recovered, and the nodes in the organization with data to be recovered will obtain the relevant certificate corresponding to their own ID.

[0166] Step 506: Restore and decrypt your own private key.

[0167] In this step, the certificate chain module of the first organization restores and decrypts its own private key according to the relevant certificate and saves it to the certificate chain module.

[0168] Step 507: Obtain the data to be recovered from other organizations based on the relevant certificates corresponding to your ID.

[0169] In this step, the first organization obtains the data to be restored from other organizations based on the relevant certificates corresponding to its own ID.

[0170] Step 508: The certificate service module restores the database to the state before the restart.

[0171] In this step, the certificate service module of the first organization restores the acquired data to be restored to the database, so that the database is restored to the state before the restart.

[0172] Step 509, End.

[0173] The data synchronization method provided in the embodiment of the present application, when it is detected that all nodes of the first organization are restarted and data loss is detected in all nodes, obtains a certificate set from other organizations, determines a third certificate associated with the first organization in the certificate set, and finally obtains the data to be recovered from other organizations based on the third certificate. In this technical solution, when all nodes of the first organization are restarted and data is lost, the data to be recovered can be obtained from other organizations for the first organization to be restored to the state before the restart, thereby realizing the technical effect of increasing the disaster recovery characteristics of the data, avoiding the impact of data loss on the operation of the organization, and ensuring that the organization can quickly resume operations.

[0174] Based on the above embodiments, Figure 6 A schematic diagram of the workflow of the certificate chain contract module provided in the embodiment of the present application is as follows: Figure 6 As shown, the process is explained in detail:

[0175] Step 601, start.

[0176] Step 602: The certificate service module issues a certificate.

[0177] In this step, the certificate service module of the first organization issues a corresponding certificate according to the operation request.

[0178] Step 603: The certificate chain module sends the certificate data to the associated organization for verification and collects signatures.

[0179] In this step, the certificate chain module of the first organization sends the certificate data to all associated organizations (ie, other organizations in the alliance chain) for verification and collection of signatures.

[0180] Step 604: After receiving the multi-signature data, the certificate chain contract module extracts the multi-signature data.

[0181] In this step, after receiving multiple signature data from all associated organizations, the certificate chain contract module of the first organization extracts the multi-signature data.

[0182] Step 605: After the certificate chain module collects the multi-signatures, it puts the certificate data and the multi-signature data on the chain.

[0183] In this step, after the certificate chain module of the first organization collects the multiple signatures, it sets the certificate data and the multiple signature data to the chain status (ie, the ready-to-store status).

[0184] Step 606: Multi-signature verification.

[0185] In this step, the first organization verifies whether the multi-signature data obtained in step 604 meets the preset conditions. If the verification is successful, it means that the above operation can be performed in all organizations in the alliance chain, and step 607 is executed. If the verification fails, the reason (for example, the number of first certificate signatures of multiple organizations does not meet the preset conditions) is returned to the organization corresponding to the operation request, and step 608 is executed.

[0186] Step 607: Store the certificate data and multi-signature data verification results.

[0187] In this step, the verification information and multi-signature data in the certificate data are saved in the certificate chain modules of all organizations, and the operation request data in the certificate data are saved in all nodes of all organizations.

[0188] Step 608, End.

[0189] In one possible implementation, Figure 7 A schematic diagram of the data cancellation workflow provided in the embodiment of the present application is as follows: Figure 7 As shown, the process is explained in detail:

[0190] Step 701, start.

[0191] Step 702: The administrator issues a logout operation request.

[0192] In this step, the administrator of the first organization sends a logout operation request.

[0193] Step 703: The certificate service module issues a certificate.

[0194] In this step, in response to the cancellation operation request, the certificate service module of the first organization issues a certificate corresponding to the cancellation operation request.

[0195] Step 704: Enable certificate chaining.

[0196] In this step, if the first organization enables the certificate chain, then execute step 705; if the first organization does not enable the certificate chain, then execute step 7012.

[0197] Step 705: Issue a certificate revocation list.

[0198] In this step, the certificate service module of the first organization issues a certificate revocation list.

[0199] Step 706: Call the certificate chain module.

[0200] In this step, the certificate service module of the first organization calls the certificate chain module, and sends the certificate revocation list to any node in the organization through the certificate chain module.

[0201] Step 707: Send the cancellation operation request corresponding to the certificate to other organizations.

[0202] In this step, any node of the first organization sends a cancellation operation request corresponding to the certificate to other organizations.

[0203] Step 708: Other organizations verify and sign the received certificate.

[0204] Step 709: Signature verification.

[0205] In this step, the first organization collects signatures of other organizations and verifies them. If the verification is successful, step 7010 is executed. If the verification is not successful, the failure reason is returned and step 7013 is executed.

[0206] Step 7010: Call the certificate chain module to cancel the certificate data.

[0207] In this step, all organizations call the certificate chain module to perform the operation of revoking certificate data.

[0208] Step 7011, update the database.

[0209] In this step, the certificate chain module database of all organizations and the database of each node are updated.

[0210] Step 7012: Issue the certificate revocation list to the organization.

[0211] In this step, the first organization issues a certificate revocation list and performs certificate revocation within the first organization.

[0212] Step 7013, end.

[0213] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0214] Figure 8 A schematic diagram of the structure of a data synchronization device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the apparatus is applied to a first device in a first organization among multiple organizations of a consortium chain, including:

[0215] The acquisition module 801 is used to acquire a first operation request from a first management party, where the first operation request carries an identifier of the first management party and first operation information, where the first operation information is operation information of at least one of adding, updating, and canceling a first user information database;

[0216] The first processing module 802 is used to generate a first certificate when verifying that the first operation request is a legal request according to the identifier of the first management party, where the first certificate includes: first operation information and verification information of the first management party;

[0217] The second processing module 803 is used to forward the first certificate to multiple organizations, so that the multiple organizations verify the signature of the first certificate to obtain a second certificate;

[0218] The third processing module 804 is used to obtain at least one second certificate, and synchronize the first operation information to multiple organizations based on the at least one second certificate, so that each organization performs the first operation in the first operation information.

[0219] In a possible implementation, the first processing module 802 is specifically configured to:

[0220] Verify whether the identifier of the first management party exists in a preset identifier set, wherein the identifier set stores identifiers of legal management parties corresponding to a plurality of organizations respectively;

[0221] When the identifier of the first management party exists in the identifier set, a first certificate is generated according to the first operation request.

[0222] In a possible implementation manner, the second processing module 803 is specifically configured to:

[0223] When it is detected that the verification information of the first management party in the first certificate is verified, a second certificate is signed to obtain the second certificate, and the verification is whether the verification information of the first management party exists in the verification information set, and the second certificate carries the signature of the corresponding organization;

[0224] And, forwarding the first certificate to other organizations among the multiple organizations, so that the other organizations verify the signature of the first certificate to obtain the second certificate.

[0225] In a possible implementation, the third processing module 804 is specifically configured to:

[0226] receiving at least one second certificate;

[0227] When the signature information of the corresponding organization in all the received second certificates reaches a preset condition, the first operation information is synchronized to the multiple organizations so that each organization executes the first operation in the first operation information.

[0228] In a possible implementation, the device further includes:

[0229] The storage module is used to store at least one second certificate.

[0230] In a possible implementation manner, the third processing module 804 is further configured to:

[0231] When it is detected that all nodes of the first organization are restarted and data loss is detected in all nodes, a certificate set is obtained from other organizations, the certificate set including: at least one certificate from multiple organizations;

[0232] determining, from the set of certificates, a third certificate associated with the first organization;

[0233] Based on the third certificate, the data to be recovered is obtained from other organizations.

[0234] In a possible implementation manner, the third processing module 804 is further configured to:

[0235] When it is detected that some nodes of the first organization are restarted and data loss is detected in some nodes, data to be recovered is obtained from nodes that have not been restarted.

[0236] The device provided in the embodiments of the present application can be used to execute the determination method in any of the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0237] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0238] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Fig. 9As shown, the electronic device may include: a processor 91, a memory 92, and computer program instructions stored in the memory 92 and executable on the processor 91. When the processor 91 executes the computer program instructions, the method provided in any of the aforementioned embodiments is implemented.

[0239] Optionally, the above-mentioned components of the electronic device may be connected via a system bus.

[0240] The memory 92 may be a separate storage unit or a storage unit integrated in the processor 91. The number of the processor 91 may be one or more.

[0241] It should be understood that the processor 91 may be a central processing unit (CPU), or other general-purpose processors 91, digital signal processors 91 (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor 91 may be a microprocessor 91 or the processor 91 may be any conventional processor 91, etc. The steps of the method disclosed in the present application may be directly embodied as being executed by the hardware processor 91, or may be executed by a combination of hardware and software modules in the processor 91.

[0242] The system bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The memory 92 may include a random access memory 92 (RAM), and may also include a non-volatile memory 92 (NVM), such as at least one disk memory 92.

[0243] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The above-mentioned program can be stored in a readable memory 92. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the above-mentioned memory 92 (storage medium) includes: read-only memory 92 (ROM), RAM, flash memory 92, hard disk, solid state hard disk, magnetic tape, floppy disk, optical disc and any combination thereof.

[0244] The electronic device provided in the embodiment of the present application can be used to execute the method provided in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0245] An embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the above method.

[0246] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0247] Optionally, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0248] An embodiment of the present application also provides a computer program product, which includes a computer program. The computer program is stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the above method can be implemented.

[0249] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0250] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0251] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0252] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0253] In the above embodiments, the description of each embodiment has its own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0254] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0255] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A data synchronization method, characterized in that: Applied to a first device in a first organization among multiple organizations of a consortium chain, the method includes: Obtaining a first operation request from a first management party, wherein the first operation request carries an identifier of the first management party and first operation information, wherein the first operation information is operation information of at least one of adding, updating, and deregistering a user information database; When verifying that the first operation request is a legitimate request according to the identifier of the first management party, generating a first certificate, the first certificate including: the first operation information and verification information of the first management party; Forwarding the first certificate to the multiple organizations, so that the multiple organizations verify the signature of the first certificate to obtain a second certificate; Acquire at least one second certificate, and synchronize the first operation information to the multiple organizations based on the at least one second certificate, so that each organization performs the first operation in the first operation information.

2. The method according to claim 1, characterized in that The generating of a first certificate when verifying that the first operation request is a legitimate request according to the identifier of the first management party includes: Verifying whether the identifier of the first management party exists in a preset identifier set, wherein the identifier set stores identifiers of the legitimate management parties corresponding to the multiple organizations respectively; When the identifier of the first management party exists in the identifier set, the first certificate is generated according to the first operation request.

3. The method according to claim 2, characterized in that The forwarding of the first certificate to the multiple organizations so that the multiple organizations verify the signature of the first certificate to obtain a second certificate includes: When it is detected that the verification information of the first management party in the first certificate is verified, the second certificate is signed to obtain the second certificate, wherein the verification is whether the verification information of the first management party exists in the verification information set, and the second certificate carries the signature of the corresponding organization; And, forwarding the first certificate to other organizations among the multiple organizations, so that the other organizations verify the signature of the first certificate to obtain the second certificate.

4. The method according to claim 3, characterized in that The obtaining of at least one second certificate, and synchronizing the first operation information to the plurality of organizations based on the at least one second certificate so that each organization performs the first operation in the first operation information, includes: receiving the at least one second certificate; When the signature information of the corresponding organization in all the received second certificates reaches a preset condition, the first operation information is synchronized to the multiple organizations, so that each organization executes the first operation in the first operation information.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The at least one second certificate is stored.

6. The method according to claim 5, characterized in that The method further comprises: When it is detected that all nodes of the first organization are restarted and data loss is detected in all the nodes, obtaining a certificate set from other organizations, the certificate set including: at least one certificate from the multiple organizations; determining, from the set of certificates, a third certificate associated with the first organization; The data to be restored is obtained from the other organization according to the third certificate.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: When it is detected that some nodes of the first organization are restarted and data loss is detected in the some nodes, data to be recovered is obtained from the non-restarted nodes.

8. A data synchronization device, characterized in that: The device is applied to a first device in a first organization among multiple organizations of a consortium chain, and the device includes: an acquisition module, configured to acquire a first operation request from a first management party, wherein the first operation request carries an identifier of the first management party and first operation information, wherein the first operation information is operation information of at least one of adding, updating, and deregistering a first user information database; a first processing module, configured to generate a first certificate when verifying that the first operation request is a legitimate request according to the identifier of the first management party, wherein the first certificate includes: the first operation information and verification information of the first management party; A second processing module, configured to forward the first certificate to the multiple organizations, so that the multiple organizations verify the signature of the first certificate to obtain a second certificate; The third processing module is used to obtain at least one second certificate, and based on the at least one second certificate, synchronize the first operation information to the multiple organizations, so that each organization performs the first operation in the first operation information.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images