Data processing method and device based on block chain, equipment, medium and product

Abstract

The invention provides a block chain-based data processing method, apparatus and device, a medium and a product. The method comprises the steps of obtaining a service request carrying a login object and associated data; generating business data according to the associated data; the encryption signature key of the login object is inquired in a security domain set for the login object, the hardware encryption machine is used for decrypting the encryption signature key in the security domain to obtain the signature key, and the security domain is used for storing encryption hosting information of the login object; the encrypted trusteeship information is obtained by encrypting trusteeship information of the login object by using a hardware encryption machine, the trusteeship information comprises a signature key, and the object with the access authority of the security domain is the login object; carrying out signature processing on the service data by using the signature key in the security domain to obtain signed service data; and uploading the signed service data to the block chain. According to the embodiment of the invention, the signature key can be used for signature on the premise of ensuring the storage security of the signature key.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to the technical field of blockchains, and specifically to a data processing method based on a blockchain, a data processing device based on a blockchain, a computer device, a computer readable medium, and a computer program product. BACKGROUND

[0002] With the advent of the technological era and the development of mobile Internet, the pace of network revolution is also increasingly fast, and the process of realizing information fusion in the same field or multiple fields and providing customers with all-round information solutions also faces new challenges such as improvement of system architecture and transfer of support focus. Therefore, the blockchain technology, with its natural advantages in storing and managing data, has gradually become the preferred way of storing and trading data in various fields.

[0003] When interacting with a blockchain, a blockchain business usually needs to use a signature key. The specific use is to use the signature key to sign the business data to be uploaded to the blockchain in the blockchain business, and then upload the signed business data to the blockchain. At present, the management mode of the signature key is usually the front-end management mode of the blockchain business. In the front-end management mode of the blockchain business, the signature key is in the environment of the business object, the signature process needs to operate with the business object, and the security protection factor needs to be combined with the characteristics or information of the business object. That is, in the front-end management mode of the blockchain business, the security of the environment where the signature key is saved is not trusted, and the security of the signature key cannot be guaranteed. Therefore, the current management mode of the signature key cannot use the signature key for signature under the premise of ensuring the security of the signature key. SUMMARY

[0004] The embodiments of the present application provide a data processing method, device, equipment, medium and product based on a blockchain, which can use a signature key for signature under the premise of ensuring the security of the signature key.

[0005] In one aspect, the embodiments of the present application provide a data processing method based on a blockchain, which comprises:

[0006] Obtaining a business request of a business client, the business request carrying a login object and associated data associated with a requested business, the login object being an object logged on the business client;

[0007] In response to the business request, generating business data to be uploaded to the blockchain according to the associated data;

[0008] query the encrypted signature key of the login object from a security domain set for the login object, and decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain the signature key of the login object; wherein the security domain is used to store encrypted management information of the login object, the encrypted management information of the login object is obtained by encrypting the management information of the login object by using the hardware encryption machine, the management information includes the signature key, and an object having an access right of the security domain is the login object;

[0009] perform signature processing on the service data in the security domain by using the signature key of the login object to obtain signed service data;

[0010] upload the signed service data to the blockchain.

[0011] In one aspect, an embodiment of the present application provides another data processing method based on a blockchain, which comprises:

[0012] display a data input interface, and obtain associated data associated with a required requested service input for the data input interface;

[0013] generate a service request according to the associated data and a login object, wherein the login object is an object logged in a service client;

[0014] send the service request to a key management platform, wherein the service request is used to request the key management platform to generate service data according to the associated data, query an encrypted signature key of the login object from a security domain set for the login object, decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain a signature key of the login object, perform signature processing on the service data in the security domain by using the signature key to obtain signed service data, and upload the signed service data to the blockchain;

[0015] wherein the security domain is used to store encrypted management information of the login object, the encrypted management information of the login object is obtained by encrypting the management information of the login object by using the hardware encryption machine, the management information includes the signature key, and an object having an access right of the security domain is the login object.

[0016] Correspondingly, an embodiment of the present application provides a data processing apparatus based on a blockchain, which comprises:

[0017] a communication unit configured to obtain a service request of a service client, wherein the service request carries a login object and associated data associated with a required requested service, and the login object is an object logged in the service client.

[0018] a processing unit configured to generate, in response to the service request, service data to be uploaded to the blockchain according to the association data;

[0019] The processing unit is further configured to query the encrypted signature key of the login object from a security domain set for the login object, and decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain the signature key of the login object; wherein the security domain is configured to store encrypted hosting information of the login object, the encrypted hosting information is obtained by encrypting the hosting information of the login object by using the hardware encryption machine, the hosting information includes the signature key, and an object with access permission of the security domain is the login object.

[0020] The processing unit is further configured to perform signature processing on the service data in the security domain by using the signature key of the login object to obtain signed service data.

[0021] The communication unit is further configured to upload the signed service data to the blockchain.

[0022] In an implementable manner, the association data includes a contract identifier, the service request is used to request management on a target smart contract indicated by the contract identifier, and the processing unit 1302 is further configured to:

[0023] determine whether the signature key of the login object is set as a management object of the target smart contract; if the signature key of the login object is set as the management object of the target smart contract, the step of generating the service data to be uploaded to the blockchain according to the association data and subsequent steps are executed; if the signature key of the login object is not set as the management object of the target smart contract, the communication unit is triggered to return indication information indicating that the service processing fails to the service client.

[0024] In an implementable manner, the communication unit is further configured to obtain a key creation request for the login object.

[0025] The processing unit is further configured to generate the signature key for the login object in response to the key creation request, and set a security domain for the login object; encrypt the signature key by using a hardware encryption machine to obtain an encrypted signature key, and store the encrypted signature key in the security domain set for the login object.

[0026] In an implementable manner, the communication unit is further configured to obtain a key transfer request for the login object, and the key transfer request includes a transfer object.

[0027] The processing unit is further configured to: in response to the key transfer request, transfer the encrypted signature key stored in the security domain set for the login object to a security domain set for the transfer object; or, in response to the key transfer request, unbind the security domain set for the login object from the login object and bind it to the transfer object after the unbinding is completed.

[0028] In a possible implementation, the communication unit is further configured to: obtain a key deletion request for the login object;

[0029] The processing unit is further configured to: in response to the key deletion request, trigger the communication unit to send a deletion confirmation prompt to the service client; and if confirmation deletion indication information returned in response to the deletion confirmation prompt is obtained by the communication unit, delete the encrypted signature key stored in the security domain set for the login object.

[0030] Correspondingly, the embodiment of the application provides another data processing apparatus based on a block chain, which comprises:

[0031] a display unit configured to display a data input interface;

[0032] a processing unit configured to obtain associated data associated with a required requested service input in the data input interface;

[0033] The processing unit is further configured to generate a service request according to the associated data and a login object, the login object being an object logged in a service client.

[0034] a communication unit configured to send the service request to a key management platform, the service request being used to request the key management platform to generate service data according to the associated data, query an encrypted signature key of the login object from a security domain set for the login object, decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain a signature key of the login object, and perform signature processing on the service data in the security domain by using the signature key to obtain signed service data, and upload the signed service data to the block chain.

[0035] The security domain is used to store encrypted hosting information of the login object, the encrypted hosting information being obtained by encrypting hosting information of the login object by using a hardware encryption machine, the hosting information comprising the signature key, and an object having an access right of the security domain being the login object.

[0036] In a possible implementation, the processing unit is further configured to: generate a key creation request for the login object;

[0037] The communication unit is further configured to send the key creation request to the key management platform, the key creation request being used to request the key management platform to generate the signing key for the login object and to set up a security domain for the login object, and to encrypt the signing key by using a hardware encryption machine to obtain an encrypted signing key, and to store the encrypted signing key in the security domain.

[0038] In a possible implementation, the processing unit is further configured to generate a key transfer request for the login object.

[0039] The communication unit is further configured to send the key transfer request to the key management platform, the key creation request being used to request the key management platform to transfer the encrypted signing key stored in the security domain set up for the login object to a security domain set up for the transfer object, or to request the key management platform to unbind the security domain set up for the login object from the login object and to bind it to the transfer object after the unbinding is completed.

[0040] In a possible implementation, the processing unit is further configured to generate a key deletion request for the login object.

[0041] The communication unit is further configured to send the key deletion request to the key management platform, the key deletion request being used to request the key management platform to delete the signing key of the login object, and to receive a deletion confirmation prompt returned by the key management platform in response to the key deletion request.

[0042] The display unit is further configured to display the deletion confirmation prompt.

[0043] The processing unit is further configured to, if a confirmation deletion instruction input in response to the deletion confirmation prompt is obtained, trigger the communication unit to send confirmation deletion indication information to the key management platform, the confirmation deletion indication information being used to instruct the key management platform to delete the encrypted signing key stored in the security domain set up for the login object.

[0044] Accordingly, an embodiment of the present application provides a computer device, which comprises:

[0045] a processor adapted to implement a computer program;

[0046] a computer readable storage medium, the computer readable storage medium storing the computer program, the computer program being adapted to be loaded by the processor and implement the data processing method based on a block chain provided by the present application.

[0047] Accordingly, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for being loaded by a processor and implementing the blockchain-based data processing method provided in the present application.

[0048] Accordingly, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, implements the blockchain-based data processing method provided in the present application.

[0049] In an embodiment of the present application, the signature key of the login object is encrypted by a hardware encryption machine and stored in a security domain established for the login object, and the only object that has access rights to the security domain is the login object, so that the storage security of the signature key can be guaranteed; when responding to the business request of the login object, the encrypted signature key of the login object is queried from the security domain established for the login object, and the encrypted signature key is decrypted in the security domain using the hardware encryption machine to obtain the signature key of the login object, and the business data is signed using the signature key of the login object in the security domain, so that the decryption of the encrypted signature key and the signing of the business data can be completed in the security domain, and the signature key will not be taken out of the security domain, so that the storage security of the signature key can be guaranteed during the use of the signature key, and the signing function of the signature key can be brought into play, that is, the embodiment of the present application can use the signature key for signing under the premise of ensuring the storage security of the signature key. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0051] Figure 1 This is a schematic diagram of the architecture of a single-layer blockchain network provided by this application;

[0052] Figure 2A This is a schematic diagram of the architecture of a two-layer blockchain network provided by this application;

[0053] Figure 2B This is a schematic diagram of the architecture of another two-layer blockchain network provided by this application;

[0054] Figure 3 This is a schematic diagram of the operation mode of the main chain and local chain provided by this application;

[0055] Figure 4is a schematic diagram of an architecture of a data processing system provided by the present application;

[0056] Figure 5 is a schematic diagram of a data processing method based on a blockchain provided by the present application;

[0057] Figure 6 is a schematic diagram of another data processing method based on a blockchain provided by the present application;

[0058] Figure 7 is a schematic diagram of yet another data processing method based on a blockchain provided by the present application;

[0059] Figure 8 is a schematic diagram of yet another data processing method based on a blockchain provided by the present application;

[0060] Figure 9 is a schematic diagram of yet another data processing method based on a blockchain provided by the present application;

[0061] Figure 10 is a schematic diagram of a data input interface provided by the present application;

[0062] Figure 11 is a schematic diagram of another data input interface provided by the present application;

[0063] Figure 12 is a schematic diagram of a key management platform provided by the present application;

[0064] Figure 13 is a schematic diagram of a data processing apparatus based on a blockchain provided by the present application;

[0065] Figure 14 is a schematic diagram of another data processing apparatus based on a blockchain provided by the present application;

[0066] Figure 15 is a schematic diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0067] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0068] In order to more clearly understand the technical solutions provided by the embodiments of the present application, some technical terms involved in the technical solutions are introduced first:

[0069] Blockchain address: a blockchain account identifier formed by converting a key generated by an asymmetric encryption algorithm according to a certain rule, which can be used to receive a blockchain asset. The blockchain asset is a kind of virtual asset, or virtual resource.

[0070] Digital collectible: a unique digital certificate generated by using blockchain technology corresponding to a specific object (such as a work). The digital collectible is a kind of blockchain asset.

[0071] Smart contract: a protocol defined in digital form, which needs to run in a trusted environment such as a blockchain platform. The smart contract is a contract running in network space relying on a computer, which is spread, verified or executed in an informationized way, read and executed by a computer, and has the characteristics of self-service. Hereinafter, the contract refers to the smart contract, which will not be described in detail.

[0072] Blockchain network:

[0073] The blockchain network is a kind of point-to-point connected network. The blockchain network is based on a specific network protocol, so that each blockchain node in the blockchain network does not need a central node to maintain the network state, but each blockchain node maintains the node state of the whole network and the connection state between adjacent nodes through broadcast interaction with adjacent nodes. The blockchain network can include a single-layer blockchain network and a double-layer blockchain network (the double-layer blockchain network can also be referred to as a hierarchical blockchain network).

[0074] The single-layer blockchain network can be understood as Figure 1 The data sharing system 10 shown in FIG. 1. The data sharing system 10 refers to a system for data sharing between nodes. The data sharing system can include a plurality of (which can include two or more) blockchain nodes 101, which can be referred to as a client, a terminal device or a server in the data sharing system. Each blockchain node 101 can receive input information when working normally, and maintain shared data in the data sharing system based on the received input information. In order to ensure information interconnection in the data sharing system, each blockchain node in the data sharing system can have an information connection, and the blockchain nodes can transmit information through the information connection. For example, when any blockchain node in the data sharing system receives input information, other nodes in the data sharing system obtain the input information according to a consensus algorithm, and store the input information as data in the shared data, so that the data stored on all blockchain nodes in the data sharing system are consistent.

[0075] For each blockchain node in the data sharing system, a node identifier corresponding to the blockchain node exists, and each blockchain node in the data sharing system can store node identifiers of other blockchain nodes in the data sharing system, so as to subsequently broadcast the generated block to other blockchain nodes in the data sharing system according to the node identifiers of the other blockchain nodes. Each blockchain node can maintain a node identifier list as shown in Table 1 below, and store the node name and the node identifier in the node identifier list correspondingly. The node identifier can be an IP (Internet Protocol) address and any other information capable of identifying the blockchain node, and the IP address is taken as an example in Table 1 for illustration only:

[0076] Table 1

[0077] Node name Node identification Node 1 111.111.111.111 Node 2 222.222.222.222 … … Node N NNN.NNN.NNN.NNN

[0078] The single-layer blockchain network has some problems in actual application scenarios: for example, in the scenario of issuing electronic vouchers (the electronic vouchers can be electronic tickets, electronic invoices, etc.), not all nodes in the blockchain network need to be deployed as nodes for issuing electronic vouchers; for another example, in the data storage scenario, not all nodes in the blockchain network have sufficient resources and necessity to become nodes participating in the blockchain consensus. In order to solve the problems existing in the single-layer blockchain network, the embodiments of the present application further propose a double-layer blockchain network, and the architecture of the double-layer blockchain network is introduced as follows.

[0079] The double-layer blockchain network refers to dividing the blockchain network into a core consensus network and a business network (the business network can also be referred to as a witness network), the core consensus network can be used to execute a core consensus algorithm, and the business network can be used to synchronize data clearing and synchronization, and complete related specific businesses on the basis of business nodes in the business network. The double-layer blockchain network is shown in Figure 2A As shown in FIG. 2, the double-layer blockchain network 20 can include a core consensus network 201, a business network 202 (the business network 202 can also be referred to as a witness network 202), and a routing agent network 203. Wherein:

[0080] The core consensus network 201 may include one or more blockchain management nodes (also known as consensus nodes), which can run the blockchain consensus protocol to achieve consensus accounting for the blockchain. The business network 202 may include one or more business nodes, such as SPV (Simplified Payment Verification) nodes. Business nodes are primarily responsible for business execution and do not participate in accounting consensus. Business nodes achieve data synchronization through data clearing. Data clearing (also known as transaction clearing) refers to the process in which a consensus node in the core consensus network receives a request from a business node to synchronize transaction data. Specifically, the business node obtains block header data and partially authorized visible block data from the core consensus network. The routing proxy network 203 may include one or more proxy nodes, which can be used to isolate the core consensus network 201 from the business network 202. Communication data between the core consensus network 201 and the business network 202 needs to be forwarded by the proxy nodes in the routing proxy network 203.

[0081] Generally speaking, the core consensus network 201 and the business network 202 exist in different network environments. The business network 202 can be located in a public network, while the core consensus network 201 can be located in a private network. Because the core consensus network 201 is located in a relatively secure private network, mutual access between its blockchain management nodes is already secured by a consensus mechanism, eliminating the need for additional identity management and network control. However, the business network 202 is located in a public network and may be accessed by other, unidentified network terminals. Therefore, the access of the business network 202 and other potential nodes to the core consensus network 201 must be strictly controlled.

[0082] like Figure 2B As shown, a network architecture of a layered blockchain network applied to an electronic invoice business application scenario is shown. Figure 2B The business layer, routing proxy layer and core consensus layer correspond to Figure 2A The business network 202, routing proxy network 203 and core consensus network in the network. The business layer will submit business operation interactions to the consensus layer.

[0083] In the single-layer blockchain network and the double-layer blockchain network described above, the blockchain node, the blockchain management node, the business node and the proxy node can be any one of a client, a terminal and a server. The client can include but is not limited to any one of the following: an application program, an applet, software and a webpage. The terminal can be a smartphone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle terminal, a smart home appliance and an aircraft, but is not limited thereto. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0084] Blockchain:

[0085] The blockchain is a distributed ledger technology in the field of information technology, which generally consists of consensus, transaction blocks and state data storage, and cryptographic identity security. Since the ledger is distributed and the blocks are consensus-based, it has features such as non-tamperability, traceability and joint maintenance.

[0086] In the embodiments of the present application, the blockchain maintained in the blockchain network can specifically refer to a consortium chain. The consortium chain refers to a blockchain with an access mechanism, which has consensus nodes and other nodes (business nodes). Generally, any smart contract on a blockchain needs to be executed by all consensus nodes, and if the execution results are consistent, the consensus nodes can reach a consensus. Business nodes generally do not execute smart contracts, but synchronize the execution results of smart contracts from consensus nodes, and business nodes can also execute local smart contracts of business nodes; local smart contracts refer to smart contracts running on business nodes, which have independent local storage, and local smart contracts are only executed on a single business node, and consensus nodes do not execute local smart contracts, and the execution results of local smart contracts can be submitted to the chain by business nodes in transactions.

[0087] The blockchain can be a single blockchain composed of blocks, or the blockchain can include a mother chain and a sub-chain. The mother chain, which can also be referred to as a main chain, is a general underlying blockchain in the blockchain network. The sub-chain, which can also be referred to as a local chain, is a blockchain constructed on the basis of the underlying mother chain; when the sub-chain is created, the relevant information of the sub-chain is recorded in the mother chain, that is, data on-chain must rely on the mother chain to save, verify, and trace, etc. The sub-chain is a representative of each industry or vertical field of the blockchain, and is also a general term for subdividing various blockchain projects in each field; one sub-chain can correspond to one industry or one vertical field; in the embodiments of the present application, the industry or vertical field can be collectively referred to as a blockchain business, that is, one sub-chain can correspond to one blockchain business, and different sub-chains correspond to different blockchain businesses; for example, in the tax scenario, issuing an electronic invoice and handling a tax refund can be different blockchain businesses, and correspond to different sub-chains.

[0088] In the double-layer blockchain network, the main chain and the local chain run as shown in Figure 3 For example, in the tax scenario, the State Administration of Taxation corresponds to a core consensus network, and the core consensus network can run the main chain to provide main chain services. Each level of tax authority (for example, a first-level tax authority is a subordinate institution of the State Administration of Taxation, a second-level tax authority is a subordinate institution of the first-level tax authority, and a third-level tax authority is a subordinate institution of the second-level tax authority) corresponds to a business network. Each first-level tax authority synchronizes the relevant business data visible to the first-level authority through the form of a first-level main chain business node, and the corresponding main chain business data is also forwarded to the entrance of the core consensus network through the first-level main chain business node, and finally sent to the core consensus network for consensus execution. Figure 3 There are two first-level main chain business nodes in the State Administration of Taxation, indicating service dual-living, and the roles and data of the two first-level main chain business nodes are completely the same.

[0089] In the second-level tax authority, a local consensus network is independently run, and each second-level tax authority synchronizes the main chain data from the first-level main chain business node through a second-level local consensus business node, and forms a local consensus network to accept business data and perform local packaging and block consensus. All transactions sent to the local consensus are not forwarded to the main chain, but are completed in the local chain business processing of each second-level tax authority, and if necessary, the summary information in the local consensus can be uploaded to the main chain.

[0090] Outside the local consensus network, there are third-level business nodes corresponding to the third-level tax authorities, which no longer obtain the ledger of the main chain, but can obtain the main chain business data related to the business from the local consensus network; at the same time, they obtain the ledger data of the local consensus, and obtain the ledger and state data related to themselves through data clearing, and their own business transactions are also sent to the local consensus network.

[0091] Blockchain business:

[0092] Blockchain businesses refer to businesses that interact with blockchains. Blockchain businesses can store business data on the blockchain, leveraging the decentralized nature of blockchain to ensure the immutability and security of this data. For example, a blockchain business could be the issuance of electronic invoices in a tax context, where the business data could be the issued electronic invoices, and the blockchain business could store the issued electronic invoices on the blockchain. Another example could be the minting of digital collectibles, where the business data could be the minted digital collectibles, and the blockchain business could store the minted digital collectibles on the blockchain. Before uploading business data to the blockchain, it is typically signed using a signature key.

[0093] The data processing system provided in the embodiment of the present application is introduced below with reference to the accompanying drawings. The data processing system is suitable for implementing the blockchain-based data processing method provided in the embodiment of the present application.

[0094] like Figure 4 As shown, the data processing system may include a business client 401, a key management platform 402, and a blockchain node 403 in a blockchain network. The embodiment of the present application does not limit the connection method between the client 401 and the key management platform 402, and the connection method between the key management platform 402 and the blockchain node 403. The client 401 and the key management platform 402, and the key management platform 402 and the blockchain node 403 may establish a direct communication connection through wired communication, or an indirect communication connection may be established through wireless communication.

[0095] The key management platform 402 can set up different security domains for different objects (such as cloud accounts registered in the key management platform), and the security domains are used to store the signed keys of the corresponding objects encrypted by the hardware encryption machine, and only the corresponding object has access to the security domain, and other objects do not have access. For example, the hardware encryption machine can be a HSM (Hardware Security Module), which is an encryption hardware device certified by independent specifications, and can serve as a reliable encryption and key generation source, thereby maintaining appropriate encryption functions for other application programs and systems. In the data processing system, the business client 401 can initiate a business request to the key management platform 402, and the business request carries a login object and associated data associated with the required request business, and the login object is an object logged on the business client 401; the key management platform 402 responds to the business request of the business client 401, generates business data to be uploaded to the blockchain according to the associated data, and queries the encrypted signed key of the login object from the security domain set up for the login object, decrypts the encrypted signed key in the security domain using the hardware encryption machine to obtain the signed key of the login object, and signs the business data in the security domain using the signed key of the login object to obtain signed business data, and uploads the signed business data to the blockchain. The key management platform 402 can send the signed business data to the blockchain node 403, so that the blockchain node 403 uploads the signed business data to the blockchain.

[0096] It should be noted that when the blockchain network is a single-layer blockchain network, the blockchain node 403 can be any blockchain node in the single-layer blockchain network; when the blockchain network is a double-layer blockchain network, the blockchain node 403 can be any business node in the business network of the double-layer blockchain network, or any blockchain management node (or consensus node) in the core consensus network of the double-layer blockchain network.

[0097] The blockchain service can provide a blockchain service corresponding client and a blockchain service corresponding server. The service client 401 can be a blockchain service corresponding client, which can run in a terminal. The service client faces a service object (the service object refers to an object served by the blockchain service, such as a user), and the service object can initiate a service request about the blockchain service through the service client. The key management platform 402 can be a blockchain service corresponding server (also referred to as a service server), which can also be a functional module configured on the server, or other terminals or servers associated with the server. The key management platform 402 can be a platform implemented based on a cloud service. The embodiments of the present application do not limit the type of service client, which can include but is not limited to any one of the following: a service application (the service application can be referred to as a Dapp (Decentralized Application, decentralized application)), a service applet, and a service webpage. The embodiments of the present application do not limit the type of server, which can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network, content delivery network), and big data and artificial intelligence platforms, and the like. Basic cloud computing services.

[0098] The blockchain-based data processing method provided by the embodiments of the present application based on the above data processing system can provide a key security guarantee system, which can provide three levels of security guarantee for the signature key. Specifically, the first level of security guarantee in the three levels of security guarantee is to encrypt the signature key by using a hardware encryption machine; the second level of security guarantee is to set up different security domains for different objects, and the security domain is used to store the signature key of the corresponding object encrypted by using the hardware encryption machine, and only the corresponding object has access to the security domain, and other objects do not have access; the third level of security guarantee is to complete the decryption of the encrypted signature key and the signature of the business data in the security domain, and the signature key is not taken out of the security domain. Based on the three levels of security guarantee of the signature key, the security of the signature key can be guaranteed. In addition, when responding to the business request of the login object, the encrypted signature key of the login object is queried from the security domain set up for the login object, the encrypted signature key is decrypted in the security domain by using the hardware encryption machine to obtain the signature key of the login object, and the business data is signed in the security domain by using the signature key of the login object. In this way, the signature function of the signature key can be played. That is, the embodiments of the present application can use the signature key for signature under the premise of guaranteeing the security of the signature key.

[0099] It can be understood that the data processing system described in the embodiments of the present application is for more clearly illustrating the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of the blockchain network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0100] The blockchain-based data processing method provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0101] The embodiments of the present application provide a blockchain-based data processing method, which can be executed by a computer device, for example, a key management platform 402 in the data processing system shown in the Figure 4 The blockchain-based data processing method can include but is not limited to the following steps S501-S505, as shown in the Figure 5

[0102] S501, obtaining a service request of a service client, the service request carrying a login object and associated data associated with a requested service.

[0103] In the embodiments of the present application, the service request of the service client carries a login object, which is an object logged in the service client. The login object can be an object registered in the key management platform or an object registered in the cloud service platform to which the key management platform belongs. The object can be a cloud account or a cloud account, etc. which can be used to uniquely identify the identity. The service client can log in to the key management platform through the login object.

[0104] The service request of the service client also includes associated data associated with the requested service required by the service request. The service client can display a data input interface and obtain data associated with the requested service input to the data input interface. The obtained data is determined as the associated data, and the service request is generated according to the associated data.

[0105] For example, the data input interface is a contract management object adding interface, the contract management object adding interface includes an information input area and a contract management object adding control, the data input to the information input area includes a contract identifier and a to-be-added object, the contract identifier is the contract identifier of the target smart contract, and the to-be-added object can be the address of the to-be-added contract management object, which can be a blockchain address. If a trigger operation for the contract management object adding control is further detected, a service request for requesting to add a management object to the target smart contract can be generated.

[0106] ​S502, in response to the service request, generating service data to be uploaded to the blockchain according to the association data.

[0107] In the embodiments of the present application, the data uploaded to the blockchain needs to meet a certain data format, and the data meeting the data format can be referred to as service data, and the service data can also be referred to as a transaction. The key management platform can generate service data to be uploaded to the blockchain according to the association data carried by the service request and associated with the required requested service, and the service type required by the service request.

[0108] For example, in combination with the example in step S501, the association data carried by the service request can include: contract identifier X, object to be added B, and the service type required by the service request is to add a contract management object. Then, the service data generated according to the above information can be "{contract X, method: add contract management object, parameter: object to be added B}".

[0109] In a feasible implementation, the association data carried by the service request includes a contract identifier, and the service request is used to request management of a target smart contract indicated by the contract identifier. The management can include any one of adding a contract management object, transferring a contract management right, deleting a contract management object, locking a contract right, and unfreezing a contract right. After the key management platform obtains the service request of the service client, it is determined whether the signature key of the login object is set as a management object of the target smart contract. If the signature key of the login object is set as the management object of the target smart contract, the step of generating service data to be uploaded to the blockchain according to the association data and the subsequent steps are executed. If the signature key of the login object is not set as the management object of the target smart contract, the service client is returned with indication information indicating that the service processing fails. That is, only when the login object has the management right of the target smart contract, the login object can be used to manage the target smart contract indicated by the contract identifier. This can ensure the security and success of contract management.

[0110] In a feasible implementation, the service data uploaded to the blockchain can be generated by the service client according to the input data associated with the required requested service and the service type required by the service request, and the service request carrying the service data and the login object is generated. After the key management platform obtains the service request of the service client, it does not need to execute step S502, but directly executes step S503 and the subsequent steps.

[0111] S503, querying the encrypted signature key of the login object from the security domain set for the login object, and decrypting the encrypted signature key in the security domain by using a hardware encryption machine to obtain the signature key of the login object.

[0112] In the embodiments of the present application, the key management platform sets up different security domains for different objects, and the security domain is used to store the hosting information of the corresponding object encrypted by the hardware encryption machine. The hosting information includes the signature key, and only the corresponding object has the access right to the security domain, and other objects do not have the access right. That is to say, for the login object, the security domain set up for the login object is used to store the encrypted hosting information of the login object, and the encrypted hosting information is obtained by encrypting the hosting information of the login object by the hardware encryption machine. The hosting information includes the signature key of the login object, and only the login object has the access right to the security domain set up for the login object, and other objects do not have the access right to the security domain set up for the login object. Such a signature key storage method has good security.

[0113] Based on the above-mentioned signature key storage method, the way to obtain the signature key of the login object from the security domain set up for the login object can be that the key management platform queries the encrypted signature key of the login object from the security domain set up for the login object, and decrypts the encrypted signature key in the security domain by the hardware encryption machine to obtain the signature key of the login object. It should be noted that the encrypted signature key is decrypted in the security domain, that is, the decryption of the encrypted signature key is completed in the security domain, and the data stored in the security domain and the data generated in the decryption process (including the signature key obtained by decryption) cannot be taken out of the security domain during the decryption process. In this way, data leakage can be avoided, and the security of the storage of the signature key and other data can be ensured.

[0114] In a feasible implementation manner, the security domain can be an IAM domain. IAM is the abbreviation of Identity and Access Management, that is, "identity recognition and access management", which has the functions of single sign-on, powerful authentication management, centralized authorization and audit based on policy, dynamic authorization, enterprise manageability, etc. The hardware encryption machine can be a hardware security module HSM, for example.

[0115] In a feasible implementation manner, the security domain can be set up based on the storage space of the key management platform, or can be set up based on other cloud storage spaces.

[0116] In an implementable embodiment, the security domain can be a created trusted execution environment (TEE). The trusted execution environment is a hardware-based privacy computing scheme, which constructs a secure area in a system (or processor, storage space) through a software and hardware method, and guarantees the confidentiality and integrity of programs and data loaded in the secure area. The TEE divides the hardware resources and software resources of the system (or processor, storage space) into two execution environments, including a trusted part and an untrusted part (ordinary part). The two environments are isolated, and the untrusted part cannot access the storage and memory of the trusted part. Optionally, the trusted execution environment TEE can be implemented based on a trusted execution environment scheme SGX.

[0117] In an implementable embodiment, based on the above-mentioned signature key storage manner, the manner of obtaining the signature key of the login object from the security domain set for the login object can also be: querying the encrypted signature key of the login object from the security domain set for the login object, decrypting the encrypted signature key by using a hardware encryption machine, and obtaining the signature key of the login object.

[0118] In an implementable embodiment, the hosting information can be directly stored in the security domain, that is, for the login object, the security domain set for the login object is used to store the hosting information of the login object, the hosting information includes the signature key of the login object, and only the login object has the access permission of the security domain set for the login object, and other objects do not have the access permission of the security domain set for the login object. Based on this, the signature key of the login object can be directly obtained from the security domain set for the login object.

[0119] In an implementable embodiment, in order to further ensure the security of the data stored in the security domain, the business object initiating the business request can be subjected to identity authentication, which can include password authentication and biometric authentication. The password involved in the password authentication is a password set for the security domain, which is different from the login password (such as a cloud account password) of the login object. The biometric authentication can include fingerprint authentication, face authentication, iris authentication, etc., and is used to identify whether the business object initiating the business request is the business object of the login object, for example, to identify whether the user initiating the business request is the real user of the cloud account. The key management platform can send an identity authentication information collection instruction to the business client, the business client collects the identity authentication information of the business object in response to the identity authentication information collection instruction, and sends the collected identity authentication information to the key management platform to perform identity authentication on the business object, and after the identity authentication is passed, step S503 and subsequent steps are executed.

[0120] S504, signing the business data by using the signature key of the login object in the security domain to obtain signed business data.

[0121] In the embodiments of the present application, the key management platform uses the signature key of the login object to perform signature processing on the service data in the security domain set for the login object, to obtain the signed service data. It should be noted that the signature processing on the service data using the signature key is performed in the security domain, that is, the signature of the service data is completed in the security domain, and the data stored in the security domain and the data used in the signature process (including the signature key used to sign the service data) cannot be taken out of the security domain during the signature process, so that data leakage can be avoided, and the security of the signature key and other data can be ensured during the use of the signature key.

[0122] In a feasible implementation, the process of using the signature key of the login object to perform signature processing on the service data can also be completed outside the security domain.

[0123] S505, upload the signed service data to the block chain.

[0124] In the embodiments of the present application, the key management platform uploads the signed service data to the block chain, that is, the signed service data is chained. In a feasible implementation, if the key management platform is a block chain node, the signed service data can be directly uploaded to the block chain; if the key management platform is not a block chain node, the signed service data can be sent to a block chain node, so that the block chain node uploads the signed service data to the block chain.

[0125] In a feasible implementation, the key management platform can obtain the chaining result of the service data, and perform subsequent operations according to the chaining result. For example, taking the service type required by the service request as adding a contract management object as an example, in combination with the examples in steps S501 and S502, the service data can be "{contract X, method: add contract management object, parameter: to-be-added object B}", the key management platform uses the signature key of the login object to perform signature processing on the service data, and uploads the signed service data to the block chain, and when the signed service data is successfully uploaded to the block chain, it indicates that the consensus nodes in the block chain network pass the consensus for the signed service data, and agree to set the to-be-added object B as the contract management object of the contract X, at this time the key management platform can record the to-be-added object B as the contract management object of the contract X. When the contract X is managed by the to-be-added object B in the subsequent contract management, the signature key of the to-be-added object B stored in the security domain set for the to-be-added object B can be used to sign the service data involved in the contract management, and the signed service data is uploaded to the block chain.

[0126] In an implementable embodiment, after obtaining the service request of the service client, the key management platform can first determine whether there is a security domain set for the login object carried by the service request, and whether the encrypted signature key of the login object is stored in the security domain. If there is a security domain set for the login object, and the encrypted signature key of the login object is stored in the security domain, steps S502-S505 are executed; otherwise, the service client is returned with indication information indicating that the service processing fails.

[0127] In an implementable embodiment, the key management platform can return the service data, the signed service data, and the on-chain result of the service data to the service client, and the service client outputs the above information for the service object to view.

[0128] In the embodiment of the application, the signature key of the login object is encrypted by a hardware encryption machine and stored in the security domain set for the login object, and only the login object has the access right to the security domain. In this way, the security of the signature key can be ensured. When responding to the service request of the login object, the encrypted signature key of the login object is queried from the security domain set for the login object, the encrypted signature key is decrypted in the security domain by the hardware encryption machine to obtain the signature key of the login object, and the signature key of the login object is used to sign the service data in the security domain. In this way, the decryption of the encrypted signature key and the signing of the service data can be completed in the security domain. The signature key will not be taken out of the security domain, and the security of the signature key can be ensured during the use of the signature key. In this way, the signature function of the signature key can be exerted, that is, the signature key can be used for signing under the premise of ensuring the security of the signature key.

[0129] The process of obtaining the signature key from the security domain, signing the service data, and on-chain processing are introduced above. Next, the key management process involved in the data processing method based on the blockchain is introduced.

[0130] The embodiment of the application provides a data processing method based on a blockchain. The data processing method based on the blockchain can be realized by interaction of a computer device. The computer device includes a service client and a key management platform. The key management platform can be a key management platform 402 in a data processing system as shown in Figure 4 The service client can be a service client 401 in a data processing system as shown in Figure 4 The service client can be a service client 401 in a data processing system as shown in Figure 6 The data processing method based on the blockchain can include but is not limited to the following steps:

[0131] S601, the business client generates a key creation request for a login object.

[0132] In the embodiments of the present application, the login object is an object logged in the business client, which can be an object registered in the key management platform or an object registered in the cloud service platform to which the key management platform belongs. The object can be, for example, a cloud account or a cloud account that can be used to uniquely identify an identity. The business client can log in the key management platform through the login object. The key creation request carries the login object, and the key creation request is used to request the key management platform to generate a signature key for the login object, set up a security domain for the login object, and encrypt the generated signature key for the login object by using a hardware encryption machine to obtain an encrypted signature key, and store the encrypted signature key in the security domain set up for the login object.

[0133] S602, the business client sends the key creation request to the key management platform.

[0134] S603, the key management platform obtains the key creation request for the login object, and generates a signature key for the login object and sets up a security domain for the login object in response to the key creation request.

[0135] In the embodiments of the present application, the key management platform can generate a pair of asymmetric keys by using an asymmetric encryption algorithm, or can apply to a PKI (Public Key Infrastructure, public key certificate system) for allocation of a pair of asymmetric keys. The asymmetric keys can include a public key (Public Key, hereinafter referred to as public key) and a private key (Private Key, hereinafter referred to as private key). The public key can be public, and the private key cannot be public and needs to be kept secret. The private key in the asymmetric key can be used as the signature key of the login object. In a feasible implementation manner, the key management platform can also generate the signature key of the login object by using a hardware encryption machine.

[0136] The key management platform sets up a security domain for the login object, which is used to store the hosting information of the login object, and the hosting information stored in the security domain can only be accessed by the login object. That is, the key management platform sets up different security domains for different objects in response to hosting requests of the different objects, and the security domain is used to store the hosting information of the corresponding object, and only the corresponding object has access authority to the security domain, and other objects do not have access authority. In a feasible implementation manner, if a security domain has been set up for the login object in advance, a new security domain does not need to be set up for the login object in response to the key creation request, and the already set up security domain can be directly used.

[0137] In a feasible implementation manner, the security domain can be an IAM domain. The hardware encryption machine can be, for example, a hardware security module HSM.

[0138] In an implementable embodiment, the security domain can be set up based on a storage space of a key management platform, or based on other cloud storage spaces.

[0139] In an implementable embodiment, the security domain can be a trusted execution environment TEE created, which is a hardware-based privacy computing solution. A secure area is constructed in a system (or a processor, a storage space) through a software and hardware method, to ensure that programs and data loaded in the secure area are protected in terms of confidentiality and integrity. The TEE divides hardware resources and software resources of the system (or the processor, the storage space) into two execution environments, including a trusted part and an untrusted part (a normal part). The two environments are isolated, and the untrusted part cannot access the storage and the memory of the trusted part. Optionally, the TEE can be implemented based on a trusted execution environment solution SGX.

[0140] In S604, the key management platform encrypts the signature key by using a hardware encryption machine to obtain an encrypted signature key, and stores the encrypted signature key in the security domain set up for the login object.

[0141] In the embodiment of the application, the signature key of the login object can be encrypted by using a root key of the hardware encryption machine to obtain an encrypted signature key, and the encrypted signature key is stored in the security domain set up for the login object. The hardware encryption machine can be, for example, a hardware security module HSM. The HSM is an encryption hardware device certified by independent specifications, and can serve as a reliable encryption and key generation source, thereby maintaining appropriate encryption functions for other application programs and systems.

[0142] In a feasible implementation, if the signature key of the login object is a private key in an asymmetric key, the key management platform can further encrypt the public key corresponding to the signature key by using the hardware encryption machine to obtain an encrypted public key, and store the encrypted public key in the security domain set for the login object. For other information of the login object that needs to be managed, such as the public key address, the information corresponding to the login object for identity authentication, such as the password set for the security domain as described above, the biological feature for identifying whether the service object initiating the service request is the service object of the login object, and the like, the key management platform should also encrypt the above information by using the hardware encryption machine and store the encrypted information in the security domain set for the login object. In this way, the security domain set for the login object is used to store the encrypted managed information of the login object, the encrypted managed information is obtained by encrypting the managed information of the login object by using the hardware encryption machine, the managed information includes the signature key of the login object, and only the login object has the access right to the security domain set for the login object, and other objects do not have the access right. That is, the key management platform sets different security domains for different objects according to the managed request of the objects, the security domain is used to store the managed information of the corresponding object encrypted by using the hardware encryption machine, and only the corresponding object has the access right to the security domain, and other objects do not have the access right.

[0143] Based on the manners shown in steps S601-S604, the key security guarantee system can be provided by the data processing method based on the block chain provided by the embodiments of the present application, and the key security guarantee system can provide double security guarantee for the managed information such as the signature key. Specifically, the first security guarantee in the double security guarantee is to encrypt the managed information such as the signature key by using the hardware encryption machine, and the second security guarantee is to set different security domains for different objects, the security domain is used to store the managed information such as the signature key of the corresponding object encrypted by using the hardware encryption machine, and only the corresponding object has the access right to the security domain, and other objects do not have the access right. Based on the double security guarantee of the signature key, the security of the signature key can be ensured.

[0144] In a feasible implementation, after step S604, that is, after the encrypted signature key of the login object is stored in the security domain set for the login object, the data processing method based on the block chain provided by the embodiments of the present application can further include the following steps as shown in Figure 7

[0145] S611, the service client generates a key transfer request for the login object.

[0146] ​In the embodiments of the present application, the key creation request carries a login object and a transfer object (or a key transfer object). The transfer object and the login object can be an object registered in the key management platform or an object registered in a cloud service platform to which the key management platform belongs. The object can be a cloud account or a cloud account and the like, which can be used to uniquely identify an identity and can be used to log in to the key management platform.

[0147] The key creation request is used to request the key management platform to transfer the signature key of the login object to the transfer object. For example, the encrypted signature key stored in the security domain set for the login object can be requested to be transferred to the security domain set for the transfer object. The security domain set for the login object can be requested to be unbound from the login object, and after the unbinding is completed, the security domain set for the login object is bound to the transfer object.

[0148] In S612, the business client sends a key transfer request to the key management platform.

[0149] In S613, the key management platform obtains the key transfer request for the login object, and in response to the key transfer request, transfers the signature key of the login object to the transfer object.

[0150] In the embodiments of the present application, the key management platform can transfer the encrypted signature key stored in the security domain set for the login object to the security domain set for the transfer object. If the security domain set for the transfer object already exists, the key transfer is directly performed. If the security domain set for the transfer object does not exist, the security domain is set for the transfer object, and after the security domain is set, the key transfer is performed. In this way, the transfer object obtains the use permission of the signature key of the login object.

[0151] If only the signature key of the login object is stored in the security domain set for the login object, the key management platform can unbind the security domain set for the login object from the login object, and after the unbinding is completed, bind the security domain set for the login object to the transfer object. In this way, the transfer object obtains the access permission of the security domain set for the login object, and can obtain the signature key of the login object from the security domain set for the login object for use, thereby realizing the transfer of the signature key, that is, the transfer of the use permission of the signature key.

[0152] It should be noted that other information of the login object stored in the security domain of the login object can also be transferred in the above-mentioned similar manner, which will not be described herein.

[0153] In a feasible implementation manner, if the signature key is a private key in an asymmetric key, the key transfer request can be a request to transfer the signature key and the public key corresponding to the signature key together. The specific transfer manner is similar to the above-mentioned manner.

[0154] In an implementable embodiment, to further ensure the security of the data stored in the security domain, identity authentication can be performed on the service object that initiates the key transfer request, which can include password authentication, biometric authentication. The password involved in the password authentication is a password set for the security domain, which is different from the login password (such as a cloud account password) of the login object. The biometric authentication can include fingerprint authentication, face authentication, iris authentication, etc., for identifying whether the service object that initiates the key transfer request is the service object of the login object, for example, identifying whether the user that initiates the key transfer request is the real user of the cloud account. The key management platform can send an identity authentication information collection instruction to the service client, the service client collects the identity authentication information of the service object in response to the identity authentication information collection instruction, and sends the collected identity authentication information to the key management platform for identity authentication of the service object, and after the identity authentication is passed, the step of transferring the signature key of the login object to the transfer object is executed.

[0155] In another implementable embodiment, after step S604, that is, after storing the encrypted signature key of the login object into the security domain set for the login object, the blockchain-based data processing method provided by the embodiments of the present application can further include the following steps as shown in Figure 8

[0156] S621, the service client generates a key deletion request for the login object.

[0157] In the embodiments of the present application, the key deletion request carries the login object, and the key deletion request is used to request the key management platform to delete the signature key of the login object.

[0158] S622, the service client sends the key deletion request to the key management platform.

[0159] S623, the key management platform obtains the key deletion request for the login object, and in response to the key deletion request, sends a deletion confirmation prompt information to the service client.

[0160] In the embodiments of the present application, since the signature key is deleted, the service object cannot use the signature key again through the login object, and the signature key deletion operation is risky, therefore, the key management platform does not directly delete the signature key of the login object after obtaining the key deletion request of the service client, but sends a deletion confirmation prompt information to the client first, so as to facilitate the service object to make a second confirmation of the signature key deletion.

[0161] S624, the service client receives the deletion confirmation prompt information returned by the key management platform in response to the key deletion request, and outputs the deletion confirmation prompt information.

[0162] ​In the embodiments of the present application, the service client outputs the deletion confirmation prompt information, so as to facilitate the secondary confirmation of the signature key deletion of the service object.

[0163] In the embodiments of the present application, the service client outputs the deletion confirmation prompt information, so as to facilitate the secondary confirmation of the signature key deletion of the service object.

[0164] In the embodiments of the present application, the confirmation deletion indication information is used to instruct the key management platform to delete the encrypted signature key stored in the security domain set for the login object.

[0165] In the embodiments of the present application, the confirmation deletion indication information is used to instruct the key management platform to delete the encrypted signature key stored in the security domain set for the login object.

[0166] It should be noted that other information of the login object stored in the security domain thereof can also be deleted in the above-mentioned similar manner, which will not be described herein.

[0167] In the feasible implementation, if the signature key is a private key in an asymmetric key, the key deletion request can be a request to delete the signature key and the public key corresponding to the signature key together, and the specific deletion manner is similar to the above-mentioned manner.

[0168] In the feasible implementation, in order to further ensure the security of the data stored in the security domain, the service object initiating the key deletion request can be subjected to identity authentication, which can include password authentication and biometric authentication. The password involved in the password authentication is a password set for the security domain, which is different from the login password (such as a cloud account password) of the login object. The biometric authentication can include fingerprint authentication, face authentication, iris authentication, etc., and is used to identify whether the service object initiating the key deletion request is the service object of the login object, for example, to identify whether the user initiating the key deletion request is the real user of the cloud account. The key management platform can send an identity authentication information collection instruction to the service client, the service client collects the identity authentication information of the service object in response to the identity authentication information collection instruction, and sends the collected identity authentication information to the key management platform to perform identity authentication on the service object, and after the identity authentication is passed, the step of sending the deletion confirmation prompt information to the service client and the subsequent steps are executed.

[0169] The embodiments of the present application provide a data processing method based on a block chain. The data processing method based on the block chain can be realized by interaction of a computer device. The computer device includes a service client and a key management platform. The key management platform can be a key management platform 402 in a data processing system as shown in the drawings. The service client can be a service client 401 in the data processing system as shown in the drawings. Figure 4 The embodiments of the present application provide a data processing method based on a block chain. The data processing method based on the block chain can be realized by interaction of a computer device. The computer device includes a service client and a key management platform. The key management platform can be a key management platform 402 in a data processing system as shown in the drawings. The service client can be a service client 401 in the data processing system as shown in the drawings. Figure 4The business client 401 in the data processing system shown can also be other business clients associated with the key management platform 402. As shown Figure 9 The blockchain-based data processing method shown can include but is not limited to the following steps:

[0170] S901, the business client displays a data input interface and obtains associated data associated with the requested business input to the data input interface.

[0171] In the embodiments of the present application, the data input interface is associated with the requested business. In a feasible implementation manner, the requested business can be storing electronic resources, and the electronic resources can be electronic tickets, digital collectibles, virtual resources, etc. Taking the requested business as storing electronic tickets as an example, the data input interface can be, for example, as shown in Figure 10 As shown, it includes an electronic ticket upload area 102 and an electronic ticket storage control 104, and the electronic ticket uploaded to the electronic ticket upload area 102 is the associated data associated with the requested business. Optionally, the data input interface can also include an electronic ticket preview area 103, and after the electronic ticket is successfully uploaded, the electronic ticket is previewed and displayed in the electronic ticket preview area 103, so that the business object can check whether the uploaded electronic ticket is the electronic ticket that needs to be stored, avoiding the misstorage of the electronic ticket.

[0172] In a feasible implementation manner, the requested business can be contract management, and the contract management can be adding a contract management object, transferring contract management authority, deleting a contract management object, locking contract authority, and unfreezing contract authority. Taking the requested business as adding a contract management object as an example, the data input interface can be, for example, as shown in Figure 11 As shown, it includes a contract identifier input area 112, a to-be-added object input area 113, and a contract management object adding control 114, and the "contract X" input to the contract identifier input area 112 and the "object B" input to the to-be-added object input area 113 are both associated data associated with the requested business. Object B can be the address of the contract management object to be added, which can be a blockchain address. Optionally, the contract identifier input area 112 can be associated with a drop-down option, which can be used to display the contract identifiers of the smart contracts that the login object has management authority over, and the contract identifier that needs to be managed can be selected from it. The to-be-added object input area 113 can also be associated with a drop-down option (as shown in Figure 11 ), which can be used to display the objects that can be added as contract management objects of the selected smart contract, and the object that needs to be added as a contract management object can be selected from it.

[0173] S902, the business client generates a business request according to the associated data and the login object.

[0174] In the embodiments of the present application, the login object is an object logged in on the business client. The login object can be an object registered in the key management platform, or an object registered in the cloud service platform to which the key management platform belongs. The object can be, for example, a cloud account or a cloud account, and the like, which can be used to uniquely identify an identity. The business client can log in to the key management platform through the login object.

[0175] For example, taking the request business of storing electronic tickets as an example, in combination with the corresponding example in step S901, after obtaining the electronic ticket uploaded by the electronic ticket upload area 102, if it is further detected that the trigger operation of the electronic ticket storage control 104 is detected, a business request carrying the electronic ticket and used to request to store the electronic ticket can be generated. The way of generating a storage business request for other electronic resources is similar, and will not be described here.

[0176] For example, taking the request business of adding a contract management object as an example, in combination with the corresponding example in step S901, after obtaining the "contract X" input by the contract identifier input area 112 and the "object B" input by the object to be added input area 113, if it is further detected that the trigger operation of the contract management object adding control 114 is detected, a business request carrying the information "contract X" and "object B" and used to request to add a contract management object can be generated. The way of generating a business request for other contract management is similar, and will not be described here.

[0177] S903, the business client sends a business request to the key management platform.

[0178] S904, the key management platform obtains the business request of the business client, and in response to the business request, generates business data to be uploaded to the blockchain according to the association data.

[0179] In the embodiments of the present application, the data uploaded to the blockchain needs to meet a certain data format. The data meeting the data format can be referred to as business data, and the business data can also be referred to as a transaction. The key management platform can generate business data to be uploaded to the blockchain according to the association data associated with the required request business carried by the business request, and the type of business required by the business request.

[0180] For example, taking the request business of storing electronic tickets as an example, in combination with the corresponding example in steps S901 and S902, the association data carried by the business request includes: the electronic ticket to be stored, and the type of business required by the business request is to store the electronic ticket. Therefore, the business data generated according to the above information can be "{method: electronic ticket storage, data: electronic ticket to be stored}".

[0181] For example, taking the contract management object adding service as an example, in combination with the corresponding examples in steps S901 and S902, the associated data carried by the service request includes: contract X, object B, and the service type required by the service request is adding a contract management object. Therefore, the service data generated according to the above information can be "{contract X, method: add contract management object, parameter: object B}".

[0182] It should be noted that the specific implementation of step S904 and other possible ways associated with step S904 can refer to the relevant description in step S502 in the foregoing embodiments, and will not be repeated here.

[0183] S905, the key management platform queries the encryption signature key of the login object from the security domain set for the login object, and decrypts the encryption signature key in the security domain by using the hardware encryption machine to obtain the signature key of the login object.

[0184] It should be noted that the specific implementation of step S905 and other possible ways associated with step S905 can refer to the relevant description in step S503 in the foregoing embodiments, and will not be repeated here.

[0185] S906, the key management platform performs signature processing on the service data in the security domain by using the signature key of the login object to obtain the signed service data.

[0186] It should be noted that the specific implementation of step S906 and other possible ways associated with step S906 can refer to the relevant description in step S504 in the foregoing embodiments, and will not be repeated here.

[0187] S907, the key management platform uploads the signed service data to the block chain.

[0188] It should be noted that the specific implementation of step S907 and other possible ways associated with step S907 can refer to the relevant description in step S505 in the foregoing embodiments, and will not be repeated here.

[0189] Based on the above description, it can be seen that the data processing method based on the blockchain provided by the embodiments of the present application realizes a UI (User Interface)-based completion of a business such as electronic resource storage, contract management, etc. (or the on-chain completion of the above business), which can simplify user operations and improve the efficiency of business completion (or the on-chain efficiency of business data). In addition, the signature key of the login object is stored in the security domain set for the login object after being encrypted by the hardware encryption machine, and the security domain can only be accessed by the login object, so that the secure hosting of the signature key can be realized. In addition, the business object inputs data through the data input interface of the business client, and sends a business request to the key management platform in response to the triggering of a business request control (such as an electronic bill storage control, a contract management object adding control, etc.) in the data input interface, the key management platform queries the encrypted signature key of the login object from the security domain set for the login object, decrypts the encrypted signature key in the security domain using the hardware encryption machine to obtain the signature key of the login object, signs the business data in the security domain using the signature key of the login object to obtain signed business data, and uploads the signed business data to the blockchain, so that the signature function of the signature key can be played. That is, the embodiments of the present application can complete a business such as electronic resource storage, contract management, etc. with one key without touching the signature key.

[0190] The implementation mode of the data processing method based on the blockchain provided by the embodiments of the present application is introduced in detail above, and the key management platform involved in the data processing method based on the blockchain is further introduced below.

[0191] The key management platform provided by the embodiments of the present application can be a hardware-based key security service in a cloud service. On the basis of the key management platform, two ways for users (or cloud accounts, the user can refer to the business object described above, and the cloud account can refer to the login object described above, etc.) to use the managed key (the managed key can refer to the signature key described above, which will not be described again) are packaged, one is to submit the data signed by the managed key as a normal key to the chain, and the other is to use the managed key as the administrator of the contract (such as EIP5982 contract) to perform automatic contract management. The main modules included in the key management platform are as shown in Figure 12 As shown in the figure, the modules and the process description are as follows:

[0192] Account login: Since the key management platform system relies on a hardware key management system on the cloud, users can log in to the key management platform through a cloud account. The account DB (DB means database) maintains the account information (or user information) of the key management platform.

[0193] Key management platform function, after logging into the key management platform, the functions of the key management platform such as key usage, key management, etc. can be used.

[0194] Key usage: use the key that has been hosted on the key management platform (i.e. hosted key) to complete data signature (or user signature), and subsequently use the signature in external services, including on-chain services, hosted administrator services (see description below), etc.

[0195] Key management: keys can be created, deleted, transferred, etc. The user can only see the public key and address corresponding to the key after creating the key, and cannot obtain the private key. The private key exists in the IAM of each user (the user can be referred to as a cloud account, which will not be described in detail later). The IAM is described in detail below). After deleting the key, the user can no longer use the key, and this operation requires user confirmation. Key transfer is to transfer the control (or usage permission) of the key to another user, and the user can no longer see the key in the platform interface after the key is transferred.

[0196] Key management also includes the function of creating a contract administrator: the contract administrator (which can refer to the contract management object described above) can be created using this function, i.e. after creating a key, the key (or the key used as a signature key) can be randomly or according to certain rules set as the administrator of certain contracts.

[0197] The background design of the key management platform, i.e. the principle, the background of the key management platform mainly relies on the following two main components on the cloud service:

[0198] IAM: Identity and Access Management, with single sign-on, powerful authentication management, centralized authorization and audit based on policy, dynamic authorization, enterprise manageability, etc. Each user can be given an IAM domain based on cloud services, and the files in the user's IAM domain can only be accessed by the user himself. The user's hosted key is stored in the storage under the IAM domain, and the hosted key stored in the IAM domain can be a text encrypted by the root key of the hardware encryption machine. The IAM mechanism can ensure the independence and security of user key storage.

[0199] Key management system and HSM: a hardware-based key management service configured on the cloud service, that is, the key management system is based on the HSM as the root key, and all secondary keys are based on hardware security encryption. The key management system itself is responsible for communication with the HSM and can access all IAMs, creates and hosts keys for each user, and when the user needs to use it, accesses the HSM again to decrypt the hosted key in the user's IAM in the security domain and completes the signature, and returns it to the user. The key management system is mainly responsible for the generation and use of keys, and the entire key system is secured through the hardware root.

[0200] On-chain service and managed administrator service:

[0201] On-chain service: a more general mode that provides users with general on-chain transaction signature and submission services. Mainly, after the key management platform returns the signature of the data entered by the user, it finds the blockchain node according to the user's request for business type and submits it to the chain.

[0202] Managed administrator service: a more specific but simple and practical service. It is mainly based on the EIP5982 contract, that is, the permission model implemented by most contracts to adapt to the corresponding management functions, that is, after the user creates a managed key and sets it as a contract administrator, it can no longer need to construct a transaction text (transaction text can refer to the business data described above) and signature, but directly in the form of an interface button, exercise management operations on the contract, such as adding or recycling minting asset permissions, locking or unfreezing contract permissions, etc.

[0203] For example, user A presses the page button and fills in parameters X and B, that is, adds an administrator to contract X with address B. At this time, based on the user A's managed key P for the X contract in the key management platform, the key management platform can be directly called with the managed key P to sign the business (or transaction) T{contract X, method: add contract administrator, parameter: B}, and after obtaining the signature in the key management platform, it is directly submitted to the chain.

[0204] Based on the key management platform, a key escrow service can be implemented, and the smart contract role permission management protocol can be used as a standard to enable a user to create a non-exportable escrow key based on a web front end of the service, and the access control (Access Control) protocol can be used to provide a permission lifecycle management of the bound contract for an administrator. Due to the unified protocol, all standard buttons on the interface can be provided, and the user can experience the codeless simple experience. In the underlying implementation, an IAM domain is independently set for each cloud account in the cloud service, and the signature key of each cloud account is encrypted by using the HSM and placed in the corresponding IAM domain, so that the secure escrow of the signature key can be implemented. The blockchain-based data processing method provided by the embodiment of the application based on the key management platform can implement the contract management and electronic resource storage of the service and other businesses through the whole UI, and can implement the contract management and electronic resource storage and other businesses without contacting the signature key.

[0205] It should be noted that the execution subject for implementing each step in the above method embodiment can be constituted by hardware, software, or a combination of software and hardware.

[0206] The above describes the method of the embodiment of the application in detail. In order to better implement the above scheme of the embodiment of the application, the device of the embodiment of the application is provided accordingly.

[0207] Please refer to Figure 13 , Figure 13 is a structural schematic diagram of a blockchain-based data processing device provided by the embodiment of the application. The blockchain-based data processing device can be arranged in the computer device provided by the embodiment of the application. The computer device can be the key management platform 402 in the data processing system shown in the above Figure 4 . The blockchain-based data processing device shown in the above Figure 13 may be a computer program running in the computer device. The data processing device can be used to execute part or all of the steps in the method embodiment shown in the above Figure 5- Figure 9 . Please refer to Figure 13 , the blockchain-based data processing device can include the following units:

[0208] The communication unit 1301 is configured to obtain a service request of a service client, wherein the service request carries a login object and associated data associated with a required service request; the login object is an object logged on the service client;

[0209] The processing unit 1302 is configured to generate service data to be uploaded to the blockchain according to the associated data in response to the service request;

[0210] The processing unit 1302 is further configured to query an encrypted signature key of the login object from a security domain set for the login object, and decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain a signature key of the login object; wherein the security domain is configured to store encrypted hosting information of the login object, the encrypted hosting information is obtained by encrypting hosting information of the login object by using the hardware encryption machine, the hosting information includes the signature key, and an object having an access right of the security domain is the login object.

[0211] The processing unit 1302 is further configured to perform signature processing on the service data in the security domain by using the signature key of the login object to obtain signed service data.

[0212] The communication unit 1301 is further configured to upload the signed service data to the blockchain.

[0213] In a possible implementation, the associated data includes a contract identifier, the service request is configured to request management on a target smart contract indicated by the contract identifier, and the processing unit 1302 is further configured to perform the following steps:

[0214] Determine whether the signature key of the login object is set as a management object of the target smart contract.

[0215] If the signature key of the login object is set as the management object of the target smart contract, the step of generating the service data to be uploaded to the blockchain according to the associated data and subsequent steps are performed.

[0216] If the signature key of the login object is not set as the management object of the target smart contract, the communication unit 1301 is triggered to return indication information indicating that the service processing fails to the service client.

[0217] In a possible implementation, the communication unit 1301 is further configured to obtain a key creation request for the login object.

[0218] The processing unit 1302 is further configured to generate the signature key for the login object in response to the key creation request, and set a security domain for the login object.

[0219] The processing unit 1302 is further configured to encrypt the signature key by using a hardware encryption machine to obtain an encrypted signature key, and store the encrypted signature key in the security domain set for the login object.

[0220] In a possible implementation, the communication unit 1301 is further configured to obtain a key transfer request for the login object, and the key transfer request includes a transfer object.

[0221] The processing unit 1302 is further configured to, in response to the key transfer request, transfer the encrypted signature key stored in the security domain set for the login object to the security domain set for the transfer object, or, in response to the key transfer request, unbind the security domain set for the login object from the login object and bind it to the transfer object after the unbinding is completed.

[0222] In an implementation, the communication unit 1301 is further configured to acquire a key deletion request for the login object.

[0223] The processing unit 1302 is further configured to, in response to the key deletion request, trigger the communication unit 1301 to send a deletion confirmation prompt to the service client.

[0224] The processing unit 1302 is further configured to, if the confirmation deletion indication information returned in response to the deletion confirmation prompt is acquired by the communication unit 1301, delete the encrypted signature key stored in the security domain set for the login object.

[0225] Please refer to Figure 14 , Figure 14 is a structural schematic diagram of another data processing apparatus based on a block chain provided by an embodiment of the present application. The data processing apparatus based on a block chain can be arranged in a computer device provided by an embodiment of the present application. The computer device can be a service client 401 in the data processing system shown in Figure 4 , or can be another service client having an association relationship with the key management platform 402. Figure 14 The data processing apparatus based on a block chain shown in Figure 5- Figure 9 may be a computer program running in the computer device. The data processing apparatus can be used to execute part or all of the steps in the method embodiment shown in Figure 14 . Please refer to

[0226] The display unit 1401 is configured to display a data input interface.

[0227] The processing unit 1402 is configured to acquire association data associated with a required service request input in the data input interface.

[0228] The processing unit 1402 is further configured to generate a service request according to the association data and a login object, the login object being an object logged in the service client.

[0229] The communication unit 1403 is configured to send the service request to the key management platform, where the service request is used to request the key management platform to generate service data according to the association data, query the encrypted signature key of the login object from a security domain set for the login object, decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain the signature key of the login object, and perform signature processing on the service data in the security domain by using the signature key to obtain signed service data, and upload the signed service data to the block chain.

[0230] The security domain is configured to store encrypted hosting information of the login object, where the encrypted hosting information is obtained by encrypting the hosting information of the login object by using a hardware encryption machine, and the hosting information includes the signature key. An object having an access right of the security domain is the login object.

[0231] In a feasible implementation, the processing unit 1402 is further configured to generate a key creation request for the login object.

[0232] The communication unit 1403 is further configured to send the key creation request to the key management platform, where the key creation request is used to request the key management platform to generate the signature key for the login object, set a security domain for the login object, and encrypt the signature key by using a hardware encryption machine to obtain an encrypted signature key, and store the encrypted signature key in the security domain.

[0233] In a feasible implementation, the processing unit 1402 is further configured to generate a key transfer request for the login object.

[0234] The communication unit 1403 is further configured to send the key transfer request to the key management platform, where the key creation request is used to request the key management platform to transfer the encrypted signature key stored in the security domain set for the login object to a security domain set for the transfer object, or the key creation request is used to request the key management platform to unbind the security domain set for the login object from the login object, and bind the security domain to the transfer object after the unbinding is completed.

[0235] In a feasible implementation, the processing unit 1402 is further configured to generate a key deletion request for the login object.

[0236] The communication unit 1403 is further configured to send the key deletion request to the key management platform, where the key deletion request is used to request the key management platform to delete the signature key of the login object.

[0237] The communication unit 1403 is further configured to receive a deletion confirmation prompt message returned by the key management platform in response to the key deletion request;

[0238] The display unit 1401 is further configured to output the deletion confirmation prompt information;

[0239] The processing unit 1402 is also used to trigger the communication unit 1403 to send a confirmation deletion instruction message to the key management platform if a confirmation deletion instruction is input for the deletion confirmation prompt information. The confirmation deletion instruction message is used to instruct the key management platform to delete the encryption signature key stored in the security domain established for the login object.

[0240] According to another embodiment of the present application, Figure 13 and Figure 14 The various units in the blockchain-based data processing device shown can be individually or fully combined into one or several other units to form, or one (or some) of the units can be further divided into multiple functionally smaller units to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above-mentioned units are divided based on logical functions. In actual applications, the functions of one unit can also be implemented by multiple units, or the functions of multiple units can be implemented by one unit. In other embodiments of the present application, the blockchain-based data processing device may also include other units. In actual applications, these functions can also be implemented with the assistance of other units and can be implemented by collaboration of multiple units.

[0241] According to another embodiment of the present application, the program can be executed by running on a general computing device such as a computer including a central processing unit (CPU), a random access memory (RAM), a read-only memory (ROM) and other processing elements and storage elements. Figure 5- Figure 9 A computer program for each step involved in part or all of the method shown is constructed as follows Figure 13 or Figure 14 The blockchain-based data processing device shown in the embodiment of the present application is used to implement the blockchain-based data processing method. The computer program can be recorded on a computer-readable storage medium, for example, and loaded into the computing device via the computer-readable storage medium and executed therein.

[0242] According to another embodiment of the present application, the blockchain-based data processing device provided by the embodiment of the present application can be implemented in software. The blockchain-based data processing device can be stored in a memory, which can be software in the form of programs and plug-ins.

[0243] According to another embodiment of the present application, the blockchain-based data processing apparatus provided by the embodiments of the present application can also be implemented in a combination of software and hardware. For example, the blockchain processing apparatus provided by the embodiments of the present application can be a processor in the form of a hardware decoding processor programmed to execute the blockchain-based data processing method provided by the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can use one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic elements.

[0244] In the embodiments of the present application, the signature key of the login object is encrypted by a hardware encryption machine and stored in a security domain set for the login object, and only the login object has the access right to the security domain, so that the security of the signature key can be ensured. When responding to the service request of the login object, the encrypted signature key of the login object is queried from the security domain set for the login object, the encrypted signature key is decrypted in the security domain by the hardware encryption machine to obtain the signature key of the login object, and the service data is signed in the security domain by using the signature key of the login object. In this way, the decryption of the encrypted signature key and the signature of the service data can be completed in the security domain, the signature key will not be taken out of the security domain, the security of the signature key can be ensured during the use of the signature key, and the signature function of the signature key can be exerted. That is, the embodiments of the present application can use the signature key for signature under the premise of ensuring the security of the signature key.

[0245] Based on the above method and apparatus embodiments, the embodiments of the present application provide a computer device. Please refer to Figure 15 , Figure 15 is a structural schematic diagram of a computer device provided by the embodiments of the present application. Figure 15 The computer device shown in FIG. 15 at least includes a processor 1501, an input interface 1502, an output interface 1503, and a computer readable storage medium 1504. The processor 1501, the input interface 1502, the output interface 1503, and the computer readable storage medium 1504 can be connected by a bus or other means.

[0246] The computer readable storage medium 1504 can be stored in the memory of the computer device, and is used to store a computer program including computer instructions. The processor 1501 is used to execute the computer program stored in the computer readable storage medium 1504. The processor 1501 (or CPU (Central Processing Unit, Central Processing Unit)) is the computing core and control core of the computer device, which is suitable for implementing the computer program, and specifically suitable for loading and executing the computer program to implement the corresponding method process or corresponding function.

[0247] The embodiment of the present application further provides a computer readable storage medium (Memory). The computer readable storage medium is a memory device in the computer device, and is used to store programs and data. It can be understood that the computer readable storage medium herein can include an internal storage medium in the computer device, and of course can include an extended storage medium supported by the computer device. The computer readable storage medium provides a storage space, and the storage space stores an operating system of the computer device. In addition, the storage space also stores a computer program suitable for being loaded and executed by the processor. It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory (Non-Volatile Memory), such as at least one disk memory; optionally, the computer readable storage medium can also be at least one computer readable storage medium located away from the aforementioned processor.

[0248] In an embodiment, the computer device can be the key management platform 402 in the data processing system shown in the above Figure 4 In a specific implementation, the computer program stored in the computer readable storage medium 1504 can be loaded and executed by the processor 1501 to implement the corresponding steps in the above-mentioned blockchain-based data processing method. Figure 5 to Figure 9 In a specific implementation, the computer program in the computer readable storage medium 1504 is loaded and executed by the processor 1501 to implement the following steps:

[0249] Obtaining a service request of a service client, the service request carrying a login object and associated data associated with a required service request, the login object being an object logged on the service client;

[0250] In response to the service request, generating service data to be uploaded to the blockchain according to the associated data;

[0251] query the encrypted signature key of the login object from a security domain set for the login object, and decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain the signature key of the login object; wherein the security domain is used to store encrypted hosting information of the login object, the encrypted hosting information is obtained by encrypting the hosting information of the login object by using a hardware encryption machine, the hosting information includes the signature key, and an object with an access permission of the security domain is the login object;

[0252] perform signature processing on the service data in the security domain by using the signature key of the login object to obtain signed service data;

[0253] upload the signed service data to the blockchain.

[0254] In a feasible implementation manner, the associated data includes a contract identifier, the service request is used to request management on a target smart contract indicated by the contract identifier, and the computer program in the computer readable storage medium 1504 is loaded and executed by the processor 1501 to perform the following steps:

[0255] determine whether the signature key of the login object is set as a management object of the target smart contract;

[0256] if the signature key of the login object is set as the management object of the target smart contract, perform the step of generating service data to be uploaded to the blockchain according to the associated data and subsequent steps;

[0257] if the signature key of the login object is not set as the management object of the target smart contract, return indication information indicating that service processing fails to the service client.

[0258] In a feasible implementation manner, the computer program in the computer readable storage medium 1504 is loaded and executed by the processor 1501 to perform the following steps:

[0259] obtain a key creation request for the login object;

[0260] generate the signature key for the login object in response to the key creation request, and set a security domain for the login object;

[0261] encrypt the signature key by using a hardware encryption machine to obtain an encrypted signature key, and store the encrypted signature key in the security domain set for the login object.

[0262] In a feasible implementation manner, the computer program in the computer readable storage medium 1504 is loaded and executed by the processor 1501 to perform the following steps:

[0263] obtaining a key transfer request for the login object, the key transfer request including a transfer object;

[0264] in response to the key transfer request, transferring the encryption signature key stored in the security domain set up for the login object to a security domain set up for the transfer object;

[0265] alternatively,

[0266] in response to the key transfer request, unbinding the security domain set up for the login object from the login object and binding it to the transfer object after unbinding is completed.

[0267] In an implementable manner, the computer program in the computer readable storage medium 1504 is loaded by the processor 1501 and performs the following steps:

[0268] obtaining a key deletion request for the login object;

[0269] in response to the key deletion request, sending a deletion confirmation prompt to the service client;

[0270] if the confirmation deletion indication information returned in response to the deletion confirmation prompt is obtained, the encryption signature key stored in the security domain set up for the login object is deleted.

[0271] In another embodiment, the computer device can be the service client 401 in the data processing system shown in the above Figure 4 In a specific implementation, the computer program stored in the computer readable storage medium 1504 can be loaded by the processor 1501 and executed to implement the corresponding steps in the above-mentioned data processing method based on block chain. Figure 5 to Figure 9 In a specific implementation, the computer program in the computer readable storage medium 1504 is loaded by the processor 1501 and performs the following steps:

[0272] displaying a data input interface and obtaining associated data associated with a required service request input in the data input interface;

[0273] generating a service request according to the associated data and a login object, the login object being an object logged in the service client;

[0274] sending the service request to the key management platform, the service request being used to request the key management platform to generate service data according to the association data, and to query an encrypted signature key of the login object from a security domain set up for the login object, to decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain a signature key of the login object, and to perform signature processing on the service data in the security domain by using the signature key to obtain signed service data, and to upload the signed service data to the blockchain;

[0275] The security domain is used to store encrypted hosting information of the login object, the encrypted hosting information being obtained by encrypting hosting information of the login object by using a hardware encryption machine, and the hosting information including the signature key. An object having an access right of the security domain is the login object.

[0276] In a feasible implementation, the computer program in the computer readable storage medium 1504 is loaded by the processor 1501 and performs the following steps:

[0277] generating a key creation request for the login object;

[0278] sending the key creation request to the key management platform, the key creation request being used to request the key management platform to generate the signature key for the login object, to set up a security domain for the login object, and to encrypt the signature key by using a hardware encryption machine to obtain an encrypted signature key, and to store the encrypted signature key in the security domain.

[0279] In a feasible implementation, the computer program in the computer readable storage medium 1504 is loaded by the processor 1501 and performs the following steps:

[0280] generating a key transfer request for the login object;

[0281] sending the key transfer request to the key management platform, the key creation request being used to request the key management platform to transfer the encrypted signature key stored in the security domain set up for the login object to a security domain set up for the transfer object, or the key creation request being used to request the key management platform to unbind the security domain set up for the login object from the login object, and to bind the security domain to the transfer object after the unbinding is completed.

[0282] In a feasible implementation, the computer program in the computer readable storage medium 1504 is loaded by the processor 1501 and performs the following steps:

[0283] generating a key deletion request for the login object, and sending the key deletion request to the key management platform; the key deletion request is used to request the key management platform to delete the signature key of the login object;

[0284] receiving a deletion confirmation prompt returned by the key management platform in response to the key deletion request, and outputting the deletion confirmation prompt;

[0285] if a confirmation deletion instruction input in response to the deletion confirmation prompt is obtained, sending confirmation deletion indication information to the key management platform, the confirmation deletion indication information being used to instruct the key management platform to delete the encrypted signature key stored in the security domain set for the login object.

[0286] In the embodiments of the present application, the signature key of the login object is stored in the security domain set for the login object after being encrypted by the hardware encryption machine, and the only object having the access right to the security domain is the login object, so that the security of the signature key can be ensured; when responding to the service request of the login object, the encrypted signature key of the login object is queried from the security domain set for the login object, the encrypted signature key is decrypted in the security domain by the hardware encryption machine to obtain the signature key of the login object, and the service data is signed in the security domain by using the signature key of the login object, so that the decryption of the encrypted signature key and the signature of the service data can be completed in the security domain, the signature key will not be taken out of the security domain, the security of the signature key can be ensured during the use of the signature key, and the signature function of the signature key can be exerted, that is, the embodiments of the present application can use the signature key for signature under the premise of ensuring the security of the signature key.

[0287] The embodiments of the present application also provide a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the data processing method based on the block chain provided by the present application. The specific implementation manner can refer to the related description in the foregoing description, and will not be described here.

[0288] It should be noted that the collection and processing of related data in the embodiments of the present application should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing behavior within the scope of authorization of laws and regulations and the personal information subject.

[0289] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are implemented in hardware or software depends on specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0290] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0291] In the above embodiments, all or part can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium or transmitted by a computer-readable storage medium. Computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that the computer can access or a data storage device such as a server, data center, etc. that includes one or more available media sets. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0292] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any skilled person in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A blockchain-based data processing method, characterized in that, The method comprises: obtaining a service request of a service client, the service request carrying a login object and associated data associated with a required requested service, the login object being an object logged on the service client; in response to the service request, generating service data to be uploaded to the blockchain according to the associated data; querying an encrypted signature key of the login object from a security domain set for the login object, and decrypting the encrypted signature key in the security domain by using a hardware encryption machine to obtain a signature key of the login object; wherein the security domain is used to store encrypted hosting information of the login object, the encrypted hosting information being obtained by encrypting hosting information of the login object by using a hardware encryption machine, the hosting information including the signature key, and an object having access authority of the security domain being the login object; performing signature processing on the service data in the security domain by using the signature key of the login object to obtain signed service data; uploading the signed service data to the blockchain.

2. The method of claim 1, wherein, The associated data includes a contract identifier, the service request is used to request management of a target smart contract indicated by the contract identifier, and the method further comprises: determining whether the signature key of the login object is set as a management object of the target smart contract; if the signature key of the login object is set as the management object of the target smart contract, performing the step of generating the service data to be uploaded to the blockchain according to the associated data and subsequent steps; if the signature key of the login object is not set as the management object of the target smart contract, returning indication information indicating that the service processing fails to the service client.

3. The method of claim 1, wherein, The method further comprises: obtaining a key creation request for the login object; generating the signature key for the login object in response to the key creation request, and setting a security domain for the login object; encrypting the signature key by using a hardware encryption machine to obtain an encrypted signature key, and storing the encrypted signature key in the security domain set for the login object.

4. The method of claim 3, wherein, The method further comprises: obtaining a key transfer request for the login object, the key transfer request including a transfer object; in response to the key transfer request, transferring the encrypted signature key stored in the security domain set for the login object to a security domain set for the transfer object; or, in response to the key transfer request, unbinding the security domain set for the login object from the login object, and binding it to the transfer object after unbinding is completed.

5. The method of claim 3, wherein, The method further comprises: obtaining a key deletion request for the login object; in response to the key deletion request, sending deletion confirmation prompt information to the service client; if confirmation deletion indication information returned in response to the deletion confirmation prompt information is obtained, deleting the encrypted signature key stored in the security domain set for the login object. 6.A data processing method based on a blockchain, characterized in that, The method comprises: displaying a data input interface, obtaining associated data associated with a required service request input to the data input interface; generating a service request according to the associated data and a login object, the login object being an object logged on a service client; sending the service request to a key management platform, the service request being used to request the key management platform to generate service data according to the associated data, and to query an encrypted signature key of the login object from a security domain set up for the login object, to decrypt the encrypted signature key in the security domain by using a hardware encryption machine to obtain a signature key of the login object, and to perform signature processing on the service data in the security domain by using the signature key to obtain signed service data, and to upload the signed service data to the blockchain; wherein the security domain is used to store encrypted hosting information of the login object, the encrypted hosting information being obtained by encrypting hosting information of the login object by using a hardware encryption machine, the hosting information including the signature key, and an object having access permission of the security domain being the login object.

7. The method of claim 6, wherein, The method further comprises: generating a key creation request for the login object; sending the key creation request to the key management platform, the key creation request being used to request the key management platform to generate the signature key for the login object, to set up a security domain for the login object, and to encrypt the signature key by using a hardware encryption machine to obtain an encrypted signature key, and to store the encrypted signature key in the security domain.

8. The method of claim 7, wherein, The method further comprises: generating a key transfer request for the login object; sending the key transfer request to the key management platform, the key creation request being used to request the key management platform to transfer the encrypted signature key stored in the security domain set up for the login object to a security domain set up for a transfer object, or the key creation request being used to request the key management platform to unbind the security domain set up for the login object from the login object, and to bind the security domain to the transfer object after unbinding is completed.

9. The method of claim 7, wherein, The method further comprises: generating a key deletion request for the login object, and sending the key deletion request to the key management platform, the key deletion request being used to request the key management platform to delete the signature key of the login object; receiving deletion confirmation prompt information returned by the key management platform for the key deletion request, and outputting the deletion confirmation prompt information; if a confirmation deletion instruction input for the deletion confirmation prompt information is obtained, sending confirmation deletion indication information to the key management platform, the confirmation deletion indication information being used to instruct the key management platform to delete the encrypted signature key stored in the security domain set up for the login object. 10.A blockchain-based data processing apparatus, characterized by comprising: The method comprises units for implementing the blockchain-based data processing method according to any one of claims 1-5, or units for implementing the blockchain-based data processing method according to any one of claims 6-9.

11. A computer device, comprising: The computer device comprises: a processor adapted to implement a computer program; a computer readable storage medium storing a computer program adapted to be loaded by the processor and implement the blockchain-based data processing method according to any one of claims 1-5, or implement the blockchain-based data processing method according to any one of claims 6-9.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program adapted to be loaded by the processor and implement the blockchain-based data processing method according to any one of claims 1-5, or implement the blockchain-based data processing method according to any one of claims 6-9.

13. A computer program product, characterised in that, The computer program product comprises a computer program which, when executed by a processor, implements the blockchain-based data processing method according to any one of claims 1-5, or implements the blockchain-based data processing method according to any one of claims 6-9.

Images