Data element library data processing method and device based on block chain and storage medium

Abstract

Embodiments of the invention relate to a block chain-based data element library data processing method and apparatus, and a storage medium. The method comprises the steps of generating a root certificate of a data element library based on a first certificate of the data element library and an installation environment parameter; generating a plurality of key fragments based on a master key of a data element library and the first certificate, wherein the plurality of key fragments correspond to a plurality of data element management accounts; encrypting each key fragment based on a second certificate of each data element management account to obtain an encrypted key fragment; encrypting backup data of a data element library by adopting the master key to obtain encrypted backup data; and uploading the plurality of encryption key fragments and the first hash value to a block chain, and storing the encrypted backup data to a backup database.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of secure computing technology, and in particular to a data processing method, device, and storage medium for a data element library based on blockchain. Background Art

[0002] A data element repository is a database that stores data elements and can be used for sharing, circulation, and value mining. Existing technologies typically use keys to encrypt, store, and back up data in the repository. Key management is relatively centralized, posing the risk that a key leak could put all data at risk. Data is also backed up to local or remote storage devices, and data integrity is verified through file comparison or verification. However, this approach offers limited reliability in complex network environments and malicious attacks. Summary of the Invention

[0003] Based on the above situation of the prior art, the purpose of the embodiments of the present invention is to provide a data processing method, device and storage medium for a data element library based on blockchain, combining the data element library with blockchain, and utilizing the tamper-proof characteristics of blockchain to achieve key security and data security.

[0004] To achieve the above-mentioned purpose, according to a first aspect of the present invention, a method for processing data in a data element library based on blockchain is provided, comprising:

[0005] Generate a root certificate of the data element library based on the first certificate of the data element library and the installation environment parameters;

[0006] generating a plurality of key shards based on the master key of the data element library and the first certificate, wherein the plurality of key shards correspond to a plurality of data element management accounts;

[0007] Encrypt each key shard based on the second certificate of each data element management account to obtain an encrypted key shard;

[0008] Encrypting the backup data of the data element library using the master key to obtain encrypted backup data;

[0009] Uploading the plurality of encryption key shards and the first hash value to the blockchain, and storing the encrypted backup data in a backup database;

[0010] Among them, the first hash value is obtained by hashing the encrypted backup data, the first certificate is obtained by registering with the blockchain through the data element library; the second certificate is obtained by registering with the blockchain through the data element management account.

[0011] Furthermore, each key shard is encrypted based on the second certificate of each data element management account to obtain an encrypted key shard, including:

[0012] encrypting each key shard using the public key of the second certificate;

[0013] The encrypted key fragment is signed using the private key of the data element management account to obtain the encrypted key fragment.

[0014] Furthermore, the method further comprises:

[0015] Download the first hash value from the blockchain;

[0016] Performing hash processing on the encrypted backup data of the backup database to obtain a second hash value;

[0017] Perform a first comparison between the first Hash value and the second Hash value.

[0018] Furthermore, the method further comprises:

[0019] Downloading multiple encryption key shards from the blockchain;

[0020] Decrypting the encryption key shards based on the second certificate of each data element management account;

[0021] Combining the decrypted key fragments to obtain the master key;

[0022] When the first comparison result is consistent, the encrypted backup data of the backup database is decrypted using the master key.

[0023] Furthermore, the method further comprises:

[0024] Verify the signature of the uploaded encryption key shard based on the blockchain contract;

[0025] The signature of the encrypted key shard to be downloaded is verified based on the blockchain contract.

[0026] Furthermore, the method further comprises:

[0027] Storing the plurality of encryption key shards in corresponding data element management accounts;

[0028] Uploading the third hash values of the plurality of encryption key shards to the blockchain.

[0029] Furthermore, the method further comprises:

[0030] Downloading a third hash value of the plurality of encryption key shards from the blockchain;

[0031] Hash the encryption key fragments of the data element management account to obtain a fourth hash value;

[0032] Performing a second comparison between the fourth Hash value and the third Hash value;

[0033] When the second comparison results are consistent, decrypting the encryption key shard based on the second certificate of each data element management account;

[0034] Combining the decrypted key fragments to obtain the master key;

[0035] When the first comparison result is consistent, the encrypted backup data of the backup database is decrypted using the master key.

[0036] Furthermore, the blockchain is Changan Chain.

[0037] According to a second aspect of the present invention, there is provided a data processing device for a data element library based on blockchain, comprising:

[0038] A root certificate generation module, configured to generate a root certificate of the data element library based on the first certificate of the data element library and installation environment parameters;

[0039] a multiple key shard generation module, configured to generate multiple key shards based on a master key of a data element library and the first certificate, the multiple key shards corresponding to multiple data element management accounts;

[0040] A key encryption module, configured to encrypt each key shard based on the second certificate of each data element management account to obtain an encrypted key shard;

[0041] A backup data encryption module, configured to encrypt the backup data of the data element library using the master key to obtain encrypted backup data;

[0042] A data uploading module, configured to upload the plurality of encryption key fragments and the first hash value to the blockchain, and store the encrypted backup data in a backup database;

[0043] Among them, the first hash value is obtained by hashing the encrypted backup data, the first certificate is obtained by registering with the blockchain through the data element library; the second certificate is obtained by registering with the blockchain through the data element management account.

[0044] According to a third aspect of the present invention, a computer-readable storage medium is provided, wherein program instructions are stored in the computer-readable storage medium. When the program instructions are executed by a processor, the blockchain-based data element library data processing method described in the first aspect of the present invention is implemented.

[0045] In summary, an embodiment of the present invention provides a data processing method, device, and storage medium for a data element library based on a blockchain. The method includes: generating a root certificate of the data element library based on a first certificate of the data element library and installation environment parameters; generating multiple key shards based on the master key of the data element library and the first certificate, wherein the multiple key shards correspond to multiple data element management accounts; encrypting each key shard based on the second certificate of each data element management account to obtain an encrypted key shard; encrypting the backup data of the data element library using the master key to obtain encrypted backup data; uploading the multiple encrypted key shards and the first hash value to the blockchain, and storing the encrypted backup data in a backup database. The technical solution provided by the embodiment of the present invention, by encrypting the key shards and backing them up to the blockchain, even if some key shards are lost or stolen, the decryption key can still be obtained by combining some key shards, greatly reducing the risk of single point failure of the key; by uploading the hash value of the backup data to the blockchain, the tamper-proof nature of the blockchain is utilized to quickly detect whether the backup data has been damaged or tampered with, thereby ensuring the integrity and authenticity of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of a data processing method for a data element library based on blockchain provided by an embodiment of the present invention.

[0047] Figure 2 This is a flowchart of an embodiment of the present invention for obtaining and verifying backup data;

[0048] Figure 3 The figure is a flow chart of decrypting and restoring encrypted backup data according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present invention.

[0050] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in one or more embodiments of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprising" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0051] The embodiment of the present invention provides a data processing method for a data element library based on blockchain, Figure 1 The flowchart of the data processing method of the data element library based on blockchain provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes the following steps:

[0052] S102. Generate a root certificate for the data element library based on the data element library's first certificate and installation environment parameters. The first certificate can be obtained by registering on the blockchain through the data element library. The first certificate represents the identity of the data element library and can also be used to generate the data element library's root certificate. The root certificate is at the top of the trust chain and serves as the foundation of the entire trust system. The trust of other certificates can ultimately be traced back to the root certificate. The data element library's root certificate is generated based on metrics such as the hardware and software environment. Changes to the environment will cause the root certificate to change, and the corresponding key or hash value data will not be provided. The data element library generates a corresponding instance upon each installation. If the data element library is upgraded or otherwise processed, a new instance is generated and recorded. If the data element library instance does not match the instance recorded on the blockchain, the corresponding data will not be returned. For example, the blockchain involved in the embodiments of the present invention is Changan Chain. Changan Chain can integrate multiple privacy-preserving computing technologies to support the trusted circulation and sharing of data while protecting data privacy.

[0053] After obtaining the first certificate, the Data Element Library generates and protects a root certificate based on the installation environment parameters of the Data Element Library itself. The installation environment parameters may include installed software and hardware parameters, allowing the root certificate to uniquely identify the software and hardware environment of the Data Element Library at the time of installation. By generating a root certificate for the Data Element Library, the unique identity of the Data Element Library can be indicated. Based on this root certificate, other stakeholders of the Data Element Library can verify through contracts whether the software and hardware environment of the Data Element Library's installation meets pre-defined requirements.

[0054] S104. Multiple key shards are generated based on the master key of the data element repository and the first certificate. The multiple key shards correspond to multiple data element management accounts. The master key of the data element repository can be used to encrypt backup data in the data element repository. Multiple key shards are generated based on the master key and the first certificate. The multiple key shards correspond to multiple data element management accounts. The data element management accounts can be managed by, for example, an administrator of the data element repository. These multiple key shards can be combined to form a master key for data decryption. If some of the multiple key shards generated are damaged or lost, the remaining encryption key shards can still be combined to form the master key. By storing multiple key shards separately, the risk of single-point key failure can be reduced. For example, three key shards can be generated. If some of the key shards are lost or damaged, any two of the three key shards can be used to restore the master key. The multiple key shards can be generated using a secret sharing algorithm, such as the Shamir secret sharing algorithm. In the Shamir secret sharing algorithm, the total number of key shards generated is greater than or equal to the minimum number of key shards required to form the master key.

[0055] S106. Encrypt each key shard based on the second certificate of each data element management account to obtain an encrypted key shard. Each key shard can be encrypted using the public key of the second certificate, and the encrypted key shard can be signed using the private key of the data element management account to obtain an encrypted key shard. The second certificate can be obtained by registering with the blockchain through the data element management account. The second certificate can represent the identity of the data element management account and also has functions such as public key encryption, private key decryption, and private key signing.

[0056] S108. Use the master key to encrypt the backup data of the data element library to obtain encrypted backup data.

[0057] S110: Upload multiple encryption key shards and a first hash value to the blockchain, and store the encrypted backup data in a backup database. The first hash value is obtained by hashing the encrypted backup data. For example, if the data in the data element library includes multiple data tables, the data tables can be hashed to obtain a first hash value, which is then uploaded to the blockchain. The first hash value on the blockchain can then be used to identify whether the data tables stored in the backup database have been tampered with. Simultaneously uploading the encryption key shards to the blockchain improves the security and reliability of the encryption key shards. The backup database can be a disaster recovery device located in a secure location.

[0058] According to certain optional embodiments, multiple encryption key shards may be hashed to obtain a third hash value; the multiple encryption key shards may be stored locally in corresponding data element management accounts, and the third hash values of the multiple encryption key shards may be uploaded to the blockchain. When the encryption key shards are needed to decrypt data, the third hash values stored on the blockchain may be used to verify the encryption key shards.

[0059] According to certain optional embodiments, when uploading multiple encryption key shards to the blockchain, a blockchain contract can be called to verify the signature of the encryption key shard based on the blockchain contract to verify whether the uploaded encryption key shard is generated based on the data element management account authorized by the blockchain. When the verification is successful, the encryption key shard is allowed to be uploaded.

[0060] In the above-mentioned embodiments, the encrypted backup data is stored in a backup database, for example, a backup database with a trusted execution environment. When the backup database is damaged, the data therein can be restored and the trusted execution environment can be rebuilt, and the backup data can be restored and stored in the rebuilt trusted execution environment. When data recovery is required, the backup data can be obtained and verified. Figure 2 FIG. 4 is a flowchart of an embodiment of the present invention for obtaining backup data and performing verification. Figure 2 As shown, the following steps are included:

[0061] S202. Download the first hash value from the blockchain, that is, the hash value of the encrypted backup data.

[0062] S204: Perform hash processing on the encrypted backup data of the backup database to obtain a second hash value.

[0063] S206: Perform a first comparison between the first Hash value and the second Hash value. If the first comparison result is consistent, it indicates that the encrypted backup data of the backup database has not been damaged or tampered with.

[0064] Figure 3 FIG. 4 shows a flowchart of decrypting and restoring encrypted backup data according to an embodiment of the present invention. Figure 3 As shown, the following steps are included:

[0065] S302. Download multiple encryption key shards from the blockchain. The encryption key shards corresponding to each data element management account can be downloaded through each data element management account. According to certain optional embodiments, when downloading multiple encryption key shards, a blockchain contract can be invoked to verify the data element management account based on the blockchain contract. If verification is successful, the download of the encryption key shard is allowed.

[0066] If multiple encryption key shards are stored locally in the data element management account, the third hash values of the multiple encryption key shards are downloaded from the blockchain, the encryption key shards stored locally in the data element management account are hashed to obtain a fourth hash value, and the fourth hash value is compared with the third hash value for a second time. If the second comparison result is consistent, it indicates that the encryption key shards have not been tampered with. If some of the multiple stored encryption key shards are damaged or lost, the remaining encryption key shards can still be combined to obtain the master key.

[0067] S304. Decrypt the encryption key fragments based on the second certificate of each data element management account.

[0068] S306: Combine the decrypted key fragments to obtain a master key.

[0069] S308: Decrypt the encrypted backup data of the backup database using the master key.

[0070] An embodiment of the present invention further provides a data element library data processing device based on blockchain, the device comprising:

[0071] A root certificate generation module, configured to generate a root certificate of the data element library based on the first certificate of the data element library and installation environment parameters;

[0072] a multiple key shard generation module, configured to generate multiple key shards based on a master key of a data element library and the first certificate, the multiple key shards corresponding to multiple data element management accounts;

[0073] A key encryption module, configured to encrypt each key shard based on the second certificate of each data element management account to obtain an encrypted key shard;

[0074] A backup data encryption module, configured to encrypt the backup data of the data element library using the master key to obtain encrypted backup data;

[0075] A data uploading module, configured to upload the plurality of encryption key fragments and the first hash value to the blockchain, and store the encrypted backup data in a backup database;

[0076] Among them, the first hash value is obtained by hashing the encrypted backup data, the first certificate is obtained by registering with the blockchain through the data element library; the second certificate is obtained by registering with the blockchain through the data element management account.

[0077] In the blockchain-based data element library data processing device provided by the above embodiment of the present invention, the specific process of each module realizing its function is the same as the steps of the blockchain-based data element library data processing method provided by the above embodiment of the present invention, and its repeated description will be omitted here.

[0078] In addition, an embodiment of the present invention may also be a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the processor executes the steps of the blockchain-based data element library data processing method of each embodiment of the present invention.

[0079] Computer readable storage media can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can, for example, include but is not limited to a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0080] It should be understood that the processor in the embodiments of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0081] In summary, embodiments of the present invention relate to a data processing method, device, and storage medium for a data element library based on a blockchain. The method comprises: generating a root certificate of the data element library based on a first certificate of the data element library and installation environment parameters; generating multiple key shards based on a master key of the data element library and the first certificate, wherein the multiple key shards correspond to multiple data element management accounts; encrypting each key shard based on a second certificate of each data element management account to obtain an encrypted key shard; encrypting backup data of the data element library using the master key to obtain encrypted backup data; uploading the multiple encrypted key shards and a first hash value to the blockchain, and storing the encrypted backup data in a backup database. The technical solution provided by the embodiments of the present invention, by encrypting the key shards and backing them up to the blockchain, even if some key shards are lost or stolen, the decryption key can still be obtained by combining some key shards, thereby greatly reducing the risk of single point failure of the key; by uploading the hash value of the backup data to the blockchain, the tamper-proof nature of the blockchain is utilized to quickly detect whether the backup data has been damaged or tampered with, thereby ensuring the integrity and authenticity of the data.

[0082] It should be understood that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the present invention (including the claims) is limited to these examples; under the thinking of the present invention, the technical features in the above embodiments or different embodiments may also be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity. The above specific embodiments of the present invention are merely used to illustrate or explain the principles of the present invention and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the scope of protection of the present invention. In addition, the claims appended to the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the appended claims, or the equivalent forms of such scope and boundaries.

Claims

1. A data processing method for a data element library based on blockchain, characterized in that: include: Generate a root certificate of the data element library based on the first certificate of the data element library and the installation environment parameters; generating a plurality of key shards based on the master key of the data element library and the first certificate, wherein the plurality of key shards correspond to a plurality of data element management accounts; Encrypt each key shard based on the second certificate of each data element management account to obtain an encrypted key shard; Encrypting the backup data of the data element library using the master key to obtain encrypted backup data; Uploading the plurality of encryption key shards and the first hash value to the blockchain, and storing the encrypted backup data in a backup database; Among them, the first hash value is obtained by hashing the encrypted backup data, the first certificate is obtained by registering with the blockchain through the data element library; the second certificate is obtained by registering with the blockchain through the data element management account.

2. The method according to claim 1, characterized in that Each key shard is encrypted based on the second certificate of each data element management account to obtain an encrypted key shard, including: encrypting each key shard using the public key of the second certificate; The encrypted key fragment is signed using the private key of the data element management account to obtain the encrypted key fragment.

3. The method according to claim 2, characterized in that The method further comprises: Download the first hash value from the blockchain; Performing hash processing on the encrypted backup data of the backup database to obtain a second hash value; Perform a first comparison between the first Hash value and the second Hash value.

4. The method according to claim 3, characterized in that The method further comprises: Downloading multiple encryption key shards from the blockchain; Decrypting the encryption key shards based on the second certificate of each data element management account; Combining the decrypted key fragments to obtain the master key; When the first comparison result is consistent, the encrypted backup data of the backup database is decrypted using the master key.

5. The method according to claim 4, characterized in that The method further comprises: Verify the signature of the uploaded encryption key shard based on the blockchain contract; The signature of the encrypted key shard to be downloaded is verified based on the blockchain contract.

6. The method according to claim 3, characterized in that The method further comprises: Storing the plurality of encryption key shards in corresponding data element management accounts; Uploading the third hash values of the plurality of encryption key shards to the blockchain.

7. The method according to claim 6, characterized in that The method further comprises: Downloading a third hash value of the plurality of encryption key shards from the blockchain; Hash the encryption key fragments of the data element management account to obtain a fourth hash value; Performing a second comparison between the fourth Hash value and the third Hash value; When the second comparison results are consistent, decrypting the encryption key shard based on the second certificate of each data element management account; Combining the decrypted key fragments to obtain the master key; When the first comparison result is consistent, the encrypted backup data of the backup database is decrypted using the master key.

8. The method according to any one of claims 1 to 7, characterized in that The blockchain mentioned is Changan Chain.

9. A data element database data processing device based on blockchain, characterized in that: include: A root certificate generation module, configured to generate a root certificate of the data element library based on the first certificate of the data element library and installation environment parameters; a multiple key shard generation module, configured to generate multiple key shards based on a master key of a data element library and the first certificate, the multiple key shards corresponding to multiple data element management accounts; A key encryption module, configured to encrypt each key shard based on the second certificate of each data element management account to obtain an encrypted key shard; A backup data encryption module, configured to encrypt the backup data of the data element library using the master key to obtain encrypted backup data; A data uploading module, configured to upload the plurality of encryption key fragments and the first hash value to the blockchain, and store the encrypted backup data in a backup database; Among them, the first hash value is obtained by hashing the encrypted backup data, the first certificate is obtained by registering with the blockchain through the data element library; the second certificate is obtained by registering with the blockchain through the data element management account.

10. A readable storage medium, characterized in that: The computer-readable storage medium stores program instructions. When the program instructions are executed by the processor, the blockchain-based data element library data processing method described in any one of claims 1 to 8 is implemented.

Images