Data processing method and related equipment

Abstract

The data processing method is applied to a block chain network, at least two chain nodes in the block chain network form a private data group, each chain node in the group respectively maintains a private account book of the private data group, and the method comprises the following steps: a first chain node in a first private data group receives a data uplink request, first data and second data are obtained from the target data, the first data comprise a hash value of first field data needed to be used by a supervision contract and second field data needed to be used by the supervision contract, and the second data comprise the first field data and third field data used by supervision contract early warning; the first field data and the third field data are private data, and the first chain node stores the first data to a public account book of the block chain network, calls a software and hardware interface to obtain a key, encrypts the second data through the key, and stores the encrypted second data to a private account book. According to the method, one-number one-password is realized on a chain node side, and forward security and backward security are provided for uplink data.

Description

[0001] This application claims priority to the Chinese Patent Application No. 202410799325.4, filed on June 19, 2024, and entitled "A blockchain data processing method and related equipment", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of blockchain technology, in particular to a data processing method, a data processing device, a computing device cluster, a computer readable storage medium and a computer program product. BACKGROUND

[0003] Blockchain technology is a new distributed infrastructure and computing paradigm that uses block chain data structure to verify and store data, uses distributed node consensus algorithm to generate and update data, uses cryptography to ensure data transmission and access security, and uses smart contracts composed of automated script code to program and operate data.

[0004] In the blockchain system, there is a distributed blockchain ledger (or simply referred to as a ledger) as a storage carrier. The blockchain ledger generally stores a series of simple data structures such as key-value or relational data. With the wide application of blockchain technology in finance, energy, government affairs, aviation, agriculture, livelihood, logistics and other fields, the demand for reliable on-chain storage of related business data is increasingly high. For example, in the logistics field, it is usually required to reliably store the multi-modal content such as video, image and text of the transported goods at each transfer point on the chain.

[0005] The business data includes private data with high security requirements, such as name, contact information and other data. For the above private data, a double encryption mechanism can be used to encrypt the private data, and then chain in the form of ciphertext, so as to protect the security of the private data. For example, the data provider can use the public key of the data consumer to encrypt the symmetric key to obtain the symmetric key ciphertext, and use the symmetric key to encrypt the transaction carrying the private data to obtain the transaction ciphertext. Correspondingly, the data consumer can use its own private key to decrypt the symmetric key ciphertext to obtain the symmetric key, and use the symmetric key to decrypt the transaction ciphertext to obtain the transaction. However, in order to protect the forward security and backward security of the private data, the above symmetric key needs to be changed, for example, each symmetric key is used for encryption and decryption only once. When new private data needs to be encrypted, the changed symmetric key can be used. In this scheme, the change of the symmetric key needs to be explicitly notified to the customer, it is difficult to achieve one-time one-key, the security is poor, and it is difficult to meet the business requirements. SUMMARY

[0006] The application provides a data processing method, which provides a single-chain-based private data isolation scheme, specifically, allows organizations in a blockchain network to flexibly create a private data group that shares private data, the private data group stores private data through a private ledger, without creating a new blockchain network, and ensures the security of private data under the premise of compatible blockchain network architecture. Among them, the chain node calls the software and hardware interface to obtain the key, encrypts the private data that needs to be protected, and stores it in the private ledger. Users do not need to install management business contracts, and one number and one encryption are realized on the chain node side, providing forward and backward security for on-chain data. Users can use it out of the box, reducing the cost of management and maintenance. The application also provides a data processing device, a computing device cluster, a computer readable storage medium, and a computer program product corresponding to the above method.

[0007] In a first aspect, the application provides a data processing method. The method can be applied to a blockchain network. The blockchain network includes a plurality of chain nodes. At least two chain nodes in the plurality of chain nodes form a private data group. Each chain node in the private data group maintains a private ledger of the private data group.

[0008] Specifically, the first chain node in the first private data group receives a data on-chain request, and the data on-chain request is used to store target data to the ledger of the blockchain network. The first chain node obtains first data and second data from the target data, the first data includes a hash value of first field data required by a supervision contract and second field data required by the supervision contract, and the second data includes the first field data and third field data used by the supervision contract for early warning. The first field data and the third field data are private data. The first chain node stores the first data to the public ledger of the blockchain network, and calls the software and hardware interface to obtain the key, encrypts the second data through the key, and stores the encrypted second data to the private ledger of the first private data group.

[0009] The method provides a single-chain-based private data isolation scheme, specifically, allows organizations in a blockchain network (organizations managing chain nodes) to flexibly create a private data group that shares private data together without creating a new blockchain network, and all organizations joining the blockchain network can perform integrity checking and accounting on transactions including private data, so that the performance of the current chain can be efficiently utilized in an encrypted transaction manner relying on the performance of the blockchain system, and the security of private data is ensured under the premise of compatible blockchain network architecture. The design of the private data group can balance the efficient synchronization of private data and the point-to-point synchronization of private data, realize a flexible organization joining and exiting mechanism in the private data group, and reduce the network maintenance cost of the multi-private data group. Moreover, the method supports the chain node to call a software and hardware interface to obtain a key, encrypt private data that needs to be protected, and store the private data to a private ledger. Users do not need to install a management business contract, and a one-number-one-encryption (for example, applied to a judicial business scenario, each case data is independently encrypted once) is realized on the chain node side, which provides forward security and backward security for on-chain data, and users can use it out of the box, reducing the management and maintenance cost.

[0010] In some possible implementation manners, the first private data group includes the first chain node and the second chain node. Accordingly, the first chain node can store the encrypted second data to a private ledger of the first private data group maintained by the first chain node, and synchronize the second data to a private ledger of the first private data group maintained by the second chain node through point-to-point synchronization.

[0011] In the method, the second data is not broadcasted in the blockchain network, but is synchronized to other chain nodes of the private data group after encryption, which ensures security.

[0012] In some possible implementation manners, the first private data group includes the first chain node and the second chain node. When the supervision platform triggers a supervision request, the supervision request includes an index of the target data, and the second chain node can further obtain the first data through the supervision contract according to the index of the target data (for example, a case number or a case name). The second chain node detects whether the first data is abnormal according to the first data and the supervision business logic in the supervision contract. Then, the second chain node returns an abnormality detection result to the supervision platform.

[0013] In the method, the second chain node acts as a supervision node, obtains the first data in response to the supervision request, and automatically detects whether the first data is abnormal based on the supervision business logic in the supervision contract, thereby realizing credible supervision.

[0014] In some possible implementation manners, the first private data group includes the first chain node and the second chain node. When the supervision platform triggers the data viewing request, the data viewing request includes an index of target data requested to be viewed, and the second chain node can further acquire the first data through the supervision contract according to the index of the target data, and acquire the encrypted second data through the supervision contract. The second chain node decrypts the encrypted second data, and returns the first data and the second data to the supervision platform.

[0015] The method can meet the confidentiality and supervision requirements of the private data by acquiring the encrypted second data by using the automated supervision contract and the high-performance private data group, obtaining the private data by decrypting the encrypted second data, and returning the private data to the supervision platform.

[0016] In some possible implementation manners, the second chain node generates a private data viewing authorization request through the supervision contract. The first chain node listens to the private data viewing authorization request, and authorizes the user of the second chain node. The second chain node receives an encrypted symmetric key transmitted by the first chain node through the first private data group, and the symmetric key is used for encrypting and decrypting the second data.

[0017] In the method, the data viewer can request authorization, and the on-chain node side can return the symmetric key used for encrypting the second data after authorization, so that the data viewer can decrypt the data based on the symmetric key, thereby controlling the access permission of the private data, avoiding that the private data is viewed by unauthorized users, and preventing data abuse.

[0018] In some possible implementation manners, the first private data group is established in the following manner: the first chain node receives configuration information, the configuration information includes identification information of the second chain node that establishes the first private data group with the first chain node, and the first chain node establishes the first private data group according to the identification information of the second chain node.

[0019] The method supports flexibly creating a private data group, and stores private data in a private ledger of the private data group, to meet the security requirements of the private data. Any supervised organization can establish a chain node managed by the organization and a chain node managed by a supervision organization as a private data group, the chain node managed by the supervision organization can synchronize private data on the chain of the supervised organization based on the private data group, and perform intelligent supervision based on the private data, to meet the scene requirements of full-process data monitoring or abnormal data alarm. It should be noted that when the supervised organization specifies a chain node other than the chain node managed by the supervision organization as a backup node, the supervision node can synchronize data from the chain nodes included in the private data group to perform supervision when authorized, to realize intelligent supervision.

[0020] In some possible implementation manners, the first chain node can receive a data-on-chain request sent by the front-end machine, and the first data and the second data are extracted by the front-end machine from a hash value and metadata of structured data or unstructured data to be on-chained in the business system.

[0021] In the method, the front-end machine processes the business data to be on-chained, for example, extracts a hash value and metadata of unstructured data, merges the hash value and the metadata with structured data, and then extracts the first data and the second data from the merged data. On the one hand, the hash value and the metadata of the unstructured data can replace the unstructured data, so as to avoid occupying too many on-chain resources, and there is no need to update the chain code, so as to avoid the performance degradation of the blockchain. On the other hand, the front-end machine can ensure the security of the private data by processing the data.

[0022] In some possible implementation manners, the unstructured data is encrypted by calling a hard encryption interface by the front-end machine, and the encrypted unstructured data is stored in a notarization service. In this way, a large amount of unstructured data can be prevented from occupying on-chain resources, and the performance of the blockchain network can be ensured.

[0023] In some possible implementation manners, when the private ledger maintained by the first chain node has data loss or damage, the first chain node can also record an event causing the data loss or damage to the public ledger of the blockchain network. The second chain node sends, to the first chain node, data lost or damaged in the private ledger maintained by the first chain node according to the event recorded in the public ledger.

[0024] The method records the event causing the data loss or damage in the blockchain network, so that the operation traceability can be implemented, and when the event is monitored, the lost or damaged data can be recovered based on the private ledgers of other chain nodes in the private data group, so that the security, availability and accessibility of the data are improved.

[0025] In a second aspect, the present application provides a data processing apparatus. The apparatus is applied to a blockchain network, the blockchain network includes a plurality of chain nodes, at least two chain nodes in the plurality of chain nodes form a private data group, each chain node in the private data group maintains a private ledger of the private data group, and the data processing apparatus is deployed in a first chain node in a first private data group. The apparatus includes:

[0026] A communication module, configured to receive a data-on-chain request, the data-on-chain request being used to store target data to a ledger of the blockchain network;

[0027] The data processing module is configured to obtain first data and second data from the target data, the first data including a hash value of first field data required by a supervision contract and second field data required by the supervision contract, and the second data including the first field data and third field data required by the supervision contract, the first field data and the third field data being private data.

[0028] The storage module is configured to store the first data to a public ledger of the blockchain network.

[0029] The encryption module is configured to obtain a key by calling a software and hardware interface, and encrypt the second data by using the key.

[0030] The storage module is further configured to store the encrypted second data to a private ledger of the first private data group.

[0031] In some possible implementation manners, the first private data group includes the first chain node and a second chain node.

[0032] The storage module is specifically configured to:

[0033] store the encrypted second data to a private ledger of the first private data group maintained by the first chain node, and synchronize the encrypted second data to a private ledger of the first private data group maintained by the second chain node by using a peer-to-peer mode.

[0034] In some possible implementation manners, the apparatus further includes a group creation module.

[0035] The communication module is further configured to receive configuration information, the configuration information including identification information of a second chain node that forms the first private data group with the first chain node.

[0036] The group creation module is configured to form the first private data group according to the identification information of the second chain node.

[0037] In some possible implementation manners, the communication module is specifically configured to:

[0038] receive a data chaining request sent by a front-end machine, and the first data and the second data are extracted from a hash value and metadata of structured data or unstructured data to be chained in a business system by the front-end machine.

[0039] In some possible implementation manners, the apparatus further includes a recording module.

[0040] The recording module is configured to, when a private ledger maintained by the first chain node has data loss or damage, record an event causing the data loss or damage to a public ledger of the blockchain network.

[0041] The communication module is also configured to receive data indicating that the private ledger maintained by the first chain node is lost or damaged, which is sent by the second chain node according to the event recorded in the public ledger.

[0042] In a third aspect, the present application provides a computing device cluster. The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory. The at least one processor and the at least one memory are in communication with each other. The at least one processor is configured to execute instructions stored in the at least one memory, so that the computing device or the computing device cluster performs the data processing method as described in the first aspect or any implementation manner of the first aspect.

[0043] In a fourth aspect, the present application provides a computer readable storage medium, and the computer readable storage medium stores instructions. The instructions instruct the computing device or the computing device cluster to perform the data processing method as described in the first aspect or any implementation manner of the first aspect.

[0044] In a fifth aspect, the present application provides a computer program product including instructions, which, when executed on a computing device or a computing device cluster, cause the computing device or the computing device cluster to perform the data processing method as described in the first aspect or any implementation manner of the first aspect.

[0045] On the basis of the implementation manners of the aspects described above, the present application can be further combined to provide more implementation manners. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical method of the present application, the drawings required for use will be briefly introduced below.

[0047] Figure 1 An architecture schematic diagram of a blockchain network provided by the present application;

[0048] Figure 2 A schematic diagram of a public state database and a private state database provided by the present application;

[0049] Figure 3 A relationship schematic diagram of a private data group, an organization and a private state database in an organization management chain node provided by the present application;

[0050] Figure 4 A flowchart of a data processing method provided by the present application;

[0051] Figure 5 A flowchart of constructing on-chain data provided by the present application;

[0052] Figure 6 A flowchart of a transaction including private data provided for the present application;

[0053] Figure 7 A schematic diagram of data processing provided for the present application;

[0054] Figure 8 A schematic diagram of data processing by different users provided for the present application;

[0055] Figure 9 A flowchart of a data processing method on the side of a government agency provided for the present application;

[0056] Figure 10 A flowchart of a data processing method on the side of a supervisory organization provided for the present application;

[0057] Figure 11 A structural schematic diagram of a data processing apparatus provided for the present application;

[0058] Figure 12 A structural schematic diagram of a computing device provided for the present application;

[0059] Figure 13 A structural schematic diagram of a computing device cluster provided for the present application;

[0060] Figure 14 A structural schematic diagram of another computing device cluster provided for the present application;

[0061] Figure 15 A structural schematic diagram of yet another computing device cluster provided for the present application. DETAILED DESCRIPTION

[0062] The terms "first", "second", etc. in the embodiments of the present application are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features.

[0063] First, some technical terms involved in the embodiments of the present application are introduced.

[0064] A blockchain network is a peer to peer (P2P) network system that establishes and stores a large transaction data chain by means of cryptography and consensus mechanism. The blockchain network includes a plurality of blockchain nodes, which can also be referred to as chain nodes. The chain nodes can serve as accounting nodes and maintain a block-chain type blockchain ledger. The blockchain ledger can include a plurality of blocks, each of which contains an encrypted hash of a previous block, a corresponding time stamp, and transaction data (usually represented by a hash value calculated by a Merkle tree algorithm), so that the content of the block is difficult to tamper with.

[0065] As a storage carrier of the blockchain network, the blockchain ledger can usually store simple data structures such as key-value data or relational data. With the wide application of the blockchain network in the fields of finance, energy, government affairs, aviation, agriculture, livelihood, logistics, and the like, there is an increasing demand for reliable on-chain storage of multi-modal business data such as videos, images, and texts. Taking the logistics field as an example, in order to realize the tracking of goods, the multi-modal data such as videos, images, and texts of the goods at each transfer point can be reliably stored on the chain.

[0066] The business data includes private data with high security requirements. The private data can be data that is only open to access by specific users and is not publicly disclosed in a wide range. For example, the private data can include name, ID number, contact information, and the like. In the blockchain network, public data is usually needed so that each chain node can reach an agreement based on the public data, thereby realizing accounting. Therefore, the private data with high security requirements can be encrypted and then stored on the chain in the form of ciphertext, thereby ensuring the security of the private data.

[0067] Currently, a mainstream scheme is that a data provider encrypts a symmetric key using a public key of a data consumer to obtain a symmetric key ciphertext, and encrypts a transaction carrying private data using the symmetric key to obtain a transaction ciphertext. Correspondingly, the data consumer decrypts the symmetric key ciphertext using a private key of the data consumer to obtain the symmetric key, and then decrypts the transaction ciphertext using the symmetric key to obtain the transaction. In order to ensure the forward security and backward security of the private data, the symmetric key usually needs to be changed in time. However, the update of the symmetric key needs to be explicitly notified to the client, and it is difficult to implement one-time use of the key, and the security is poor.

[0068] Therefore, the present application provides a data processing method. The method can be applied to a blockchain network. The blockchain network includes a plurality of chain nodes. At least two chain nodes in the plurality of chain nodes form a private data group. Each chain node in the private data group maintains a private ledger of the private data group.

[0069] Specifically, a first chain node in a first private data group receives a data on-chain request, the data on-chain request being used to store target data to a ledger of a blockchain network. The first chain node obtains first data and second data from the target data, the first data including a hash value of first field data required to be used by a supervision contract and second field data required to be used by the supervision contract, and the second data including the first field data and third field data required to be used by the supervision contract for early warning. Wherein, the data required to be used by the supervision contract can be data required to be used by the supervision contract for execution, and the first field data required to be used by the supervision contract for execution and the third field data required to be used by the supervision contract for early warning are private data. Then the first chain node stores the first data to a public ledger of the blockchain network, and calls a software and hardware interface to obtain a key, encrypts the second data by the key, and stores the encrypted second data to a private ledger of the first private data group.

[0070] The method provides a private data isolation scheme based on a single chain, specifically, allows organizations (organizations managing chain nodes) in a blockchain network to flexibly create a private data group sharing private data together, without the need to create a brand new blockchain network, and all organizations joining the blockchain network can perform integrity checking and accounting on transactions including private data, ensuring the security of private data under the premise of compatibility with the architecture of the blockchain network. The design of the private data group can balance the efficient synchronization of public data and the point-to-point synchronization of private data, realize a flexible organization joining and exiting mechanism within the private data group, and reduce the network maintenance cost of multiple private data groups. Moreover, the method supports the chain node to call a software and hardware interface to obtain a key, encrypt private data that needs to be secured, and store it to a private ledger. Users do not need to install a management business contract, and a one-number-one-encryption (for example, applied to a judicial business scenario, each case data is independently encrypted once) is realized on the chain node side, providing forward security and backward security for on-chain data, allowing users to use out of the box, and reducing the cost of management and maintenance.

[0071] Further, any supervised organization can form a private data group with the chain nodes managed by the organization and the chain nodes managed by the supervision organization, the chain nodes managed by the supervision organization can synchronize the private data on-chained by the supervised organization based on the private data group, and perform intelligent supervision based on the private data, meeting the scene demand of full-process data monitoring or abnormal data warning. When the supervised organization specifies a chain node other than the chain node managed by the supervision organization as a backup node, the supervision node can synchronize data from the chain nodes included in the private data group to perform supervision when authorized, realizing intelligent and credible supervision.

[0072] In order to make the technical solutions of the present application clearer and easier to understand, first, the system architecture of the blockchain network of the present application is introduced.

[0073] Referring to Figure 1 An architecture diagram of a blockchain network 10 is shown, the blockchain network 10 includes a plurality of chain nodes 100. The chain nodes 100 can be peer nodes, which can form a peer-to-peer blockchain network. The chain nodes 100 maintain a copy of a ledger after joining a channel. The channel is a private “subnet” of communication between two or more specific network members for private and confidential transactions. Each transaction in the blockchain network is executed on a channel. The transaction participants can be authenticated and authorized to conduct transactions on the channel.

[0074] As shown in Figure 1 The ledger includes a block chain storage and a world state storage. The block chain storage can be a block chain data structure that holds blocks (transactions). The world state storage can be a world state database that retains the latest state after blocks are committed. Specifically, when a chain node 100 receives a new block from an ordering service, the chain node 100 and its peers commit the new block to the ledger of the block chain when the new block is successfully validated. To illustrate the chain node 100 committing a new block to the ledger of the block chain, the chain node 100 can add the new block to the block chain data structure and update the world state according to read and write sets (RWSet) in each transaction. The read set includes a list of keys and versions of keys read by the transaction during simulation, and the write set includes new values written by the transaction to keys (which can overlap with the keys in the read set). It is noted that if the transaction is to delete a key, a deletion flag is added to the location of the new value of the key.

[0075] Due to the overall consensus mechanism, most of the contents of the ledger are the same at different chain nodes 100. Specifically, the block chain storage of the ledger is the same at different chain nodes 100. The block chain storage can specifically store proposal requests, proposal results and endorsements through a block chain structure. Among them, the proposal request includes data to be chained, for example, non-private data to be chained, and for private data that needs to be protected, it can be stored in the private state of the world state storage. The proposal result includes non-private data that updates the read-write set in the world state, or the hash value of the private data that updates the read-write set in the world state. The endorsement can include the signature of the endorsement node to the transaction. Further, the public state in the world state storage can be the same at different chain nodes 100. The public state can store the latest state, for example, the latest state of non-private data. While the private data is stored in the ledger maintained by the chain nodes 100 included in the private data group. Specifically, the world state storage includes a private state, and the chain nodes 100 included in the private data group store private data and private data hashes in the private state.

[0076] In order to meet the needs of user private data isolation, while reducing the maintenance cost of users and facilitating all organizations to check and record transactions, the blockchain network 100 can automatically build a private data group for different organizations to ensure data isolation between different organizations. For example, the blockchain network 100 can create a private data group unique to each organization (such as the business bureau, the tax bureau) for the organization, and the private data group includes the chain nodes 100 managed by the organization and the supervisory chain nodes 100 (as supervisory nodes) managed by the organization. Private data is retained in the private data group, and is not retained in the chain nodes 100 outside the private data group, meeting the security requirements. For example, the private data of the business bureau is retained in the private data group formed by the chain nodes 100 managed by the business bureau and the supervisory chain nodes 100 managed by the organization, and is not retained in the chain nodes 100 managed by the tax bureau. It should be noted that, as proof for data existence or auditing purposes, all chain nodes 100 can retain the hash value of the private data. This scheme does not need to create a completely new blockchain network, and all organizations joining the blockchain network 10 can perform integrity checking and record keeping on transactions including private data.

[0077] By configuring the private data group in the blockchain network 10, the private data within the organization can be conveniently and securely shared with other organizations in the blockchain network 10 that are authorized to access the private data, while the non-private data can still be shared with all organizations in the blockchain network 10. This solution does not require users to create a new blockchain network, but only needs to define the organizations in the private data group for data sharing, sharing strategies, etc., and then submit to the blockchain network 10 through chain configuration, thereby completing the setup.

[0078] It should be noted that, in order to protect the security of private data, the synchronization mechanism of private data is different from that of non-private data (public data). The synchronization of private data does not go through the block sorting of consensus nodes, and private data is not included in the blocks broadcasted in the entire network. Instead, the hash value of the private data is used in the block to replace the private data itself. The private data is only transmitted between the chain nodes 100 managed by the organizations authorized to access the private data through the P2P mode, and then each chain node 100 can verify the correctness and integrity of the private data through the hash value of the private data included in the block.

[0079] The storage of private data is also different from that of public data. The chain nodes 100 (ledger nodes or accounting nodes) for accounting in the blockchain network 10 can be divided into two categories according to the access rights of private data: chain nodes 100 with access rights to private data and chain nodes 100 without access rights to private data. The chain nodes 100 without access rights to private data can include block chain storage and world state storage. Among them, the world state storage includes a public state database, which is used to store the keys and values of public data (e.g., public values) and the hash values obtained by hashing the keys and values of private data (secret values). For example, the public state database can store hash(k1, secret value), (k2, public value), (k3, public value). Figure 2 For example, the public state database can store hash(k1, secret value), (k2, public value), (k3, public value). The chain nodes 100 with access rights to private data can locally create one or more private state databases (or called privacy set State Database) instances for storing private data. Among them, the private state database is used to store the keys and values of private data, for example, the private state database can store k1 and secret value. Further, the chain nodes 100 can also include transient storage, also known as transient state data storage. The transient storage is used to temporarily store private data before the private data is actually written to the private state database.

[0080] When the user configures multiple private data groups, the chain node 100 can create multiple private state database instances isolated from each other for storing private data of different private data groups. The following is described in conjunction with an example. Figure 3 The relationship of the private state database in the chain node of the private data group, organization and organization management is shown, in this example, the blockchain network 10 created by the user includes the ledger node managed by organization 1 (denoted as organization 1 ledger node or Org1 ledger node), the ledger node managed by organization 2 (denoted as organization 2 ledger node or Org2 ledger node) and the ledger node managed by organization 3 (denoted as organization 3 ledger node or Org3 ledger node). In other words, the organizations joining the blockchain network 10 include organization 1 (Org1), organization 2 (Org2) and organization 3 (Org3). Among them, the Org1 ledger node and the Org2 ledger node construct a private data group, denoted as Whisper Circle #1, and the Org2 ledger node and the Org3 ledger node construct a private data group, denoted as Whisper Circle #2. For Whisper Circle #1, the Org1 ledger node and the Org2 ledger node respectively create a private state database, denoted as private state database #1, and Org1 and Org2 have access to private state database #1. For Whisper Circle #2, the Org2 ledger node and the Org3 ledger node respectively create a private state database, denoted as private state database #2, and Org2 and Org3 have access to private state database #2.

[0081] The following is an example of a first chain node (e.g., Org1 ledger node) in a first private data group (e.g., Whisper Circle #1). The first chain node is configured to receive a data on-chain request for storing target data to a ledger of the blockchain network 10, and then obtain first data and second data from the target data. The first data includes a hash value of first field data required by a supervision contract and second field data required by the supervision contract, and the second data includes the first field data and third field data used by the supervision contract for early warning. The supervision contract can be a smart contract for trusted supervision (e.g., audit) of on-chain data. The first field data and the third field data are private data. The first chain node is further configured to store the first data to a public ledger of the blockchain network 10, and to call a software and hardware interface to obtain a key, encrypt the second data by the key, and store the encrypted second data to a private ledger of the first private data group. For data that needs to be protected, the chain node side can call a software and hardware interface to obtain a key, encrypt the data by the key, and then store the data on the chain, which can achieve one number and one encryption, and ensure forward security and backward security. One number and one encryption is implemented by a smart contract on the blockchain network side, so that the blockchain network naturally has one number and one encryption underlying business management capability, and users do not need to install related business management contracts or perform additional key management, thereby reducing the cost of management and maintenance.

[0082] The first private data group includes the first chain node and a second chain node. When the encrypted second data is stored on the chain, the first chain node can first store the encrypted second data to a private ledger of the first private data group maintained by the first chain node, and synchronize the encrypted second data to a private ledger of the first private data group maintained by the second chain node through point-to-point synchronization. On the one hand, this scheme does not need to create a new blockchain network and ledger to store private data, but defines a private data group based on the blockchain network, stores private data through a private ledger of the private data group, and meets the requirement for the security of private data. On the other hand, this scheme stores the hash value of the private data in the public ledger, uses the hash value of the private data to replace the private data in the blockchain network, ensures security, and does not need to update the chain code (smart contract), which is compatible with existing smart contracts and avoids performance degradation to a very low level. In addition, this scheme uses a blockchain to ensure the storage security of private data, and when private data is mistakenly deleted, the private data can be synchronized based on the private ledger of the blockchain network to protect the security of the data.

[0083] Based on the foregoing blockchain network, the present application further provides a data processing method. The data processing method of the present application will be described in detail below with reference to the accompanying drawings.

[0084] Referring to Figure 4A flowchart of a data processing method is shown, which is applied to a blockchain network 10, the blockchain network 10 includes a plurality of chain nodes 10, at least two chain nodes 100 in the plurality of chain nodes 100 form a private data group, each chain node 100 in the private data group maintains a private ledger of the private data group, the method is exemplarily explained by taking a first chain node in a first private data group as an example, and the method includes the following steps:

[0085] S402, the first chain node receives a data on-chain request.

[0086] The data on-chain request is used to store target data to the ledger of the blockchain network. The target data can be business data, for example, structured data or unstructured data to be on-chained in a business system. Structured data is data with standardized format, which can be accessed by software and humans efficiently. Structured data is usually presented in a table form, in which rows and columns clearly define data properties. Unstructured data is data whose structure is irregular or incomplete, and has no predefined data model, which is inconvenient to represent by a two-dimensional logical table of a database. Unstructured data can include office documents, texts, pictures, audios or videos.

[0087] In some possible implementation manners, the target data can be data obtained by preprocessing business data of a business system. For example, the target data can be data obtained by preprocessing business data by a front-end machine. The preprocessing can include collection and classification, integration. The front-end machine (front-end service) is an intermediate device used in the field, which is generally located between a front-end client (referred to as a client for short, for example, a business system) and a back-end server, and plays the role of an adapter. For example, the front-end machine can convert between different communication protocols, data formats or languages.

[0088] In this application, the preprocessing of the business data by the front-end machine can be format conversion of the business data. The preprocessing process is described in detail below.

[0089] As shown in Figure 5 The front-end machine can capture business data. The business data can include at least one of structured data or unstructured data. When the business data includes unstructured data Y, the front-end machine can extract at least one of a hash value or metadata of the unstructured data. In Figure 5 the example, the front-end machine can obtain metadata Y1 of the unstructured data and the body Y2 of the unstructured data by classifying the unstructured data. The metadata Y1 of the unstructured data can include a name, a timestamp or a key value. For the body Y2 of the unstructured data, the front-end machine can perform a hash operation to obtain a hash value Y2_hash of the unstructured data.

[0090] When the business data includes structured data, the front-end machine can merge the hash value of the extracted unstructured data and the metadata with the structured data. Then the front-end machine can extract different types of data from the merged data. For example, the front-end machine can perform data classification on the merged data to obtain the following types of data: a, first field data X1 required by the supervision contract, the first field data being private data; b, second field data X2 required by the supervision contract, the second field data not including private data; and c, third field data X3 (other than X1 and X2) used by the supervision contract for early warning, the third field data being private data. Among them, the first field data X1 and the second field data X2 are data required for the operation of the supervision contract, the first field data X1 is private data, and the second field data is non-private data. The first field data X1 and the second field data X2 can be user-defined, for example, the user can define the certificate number as the first field data X1 and the name and age as the second field data X2. The third field data X3 can be field data used by the supervision contract for early warning. Similar to the first field data X1 and the second field data X2, the third field data X3 can also be user-defined, for example, the user can define the reporting time and the law enforcement time as the third field data X3.

[0091] The front-end machine can obtain first data according to the hash value of the first field data X1 required by the supervision contract and the second field data X2 required by the supervision contract, the first data being directly chainable data X-a. Among them, the front-end machine can perform a hash operation on the first field data X1 to obtain the hash value X1_hash of the first field data X1, and combine X1_hash and X2 to obtain the first data. In some examples, the front-end machine can assemble the hash value of the first field data X1 and the second field data X2 into a JavaScript Object Notation (JSON) structure to obtain the first data. Similarly, the front-end machine can obtain second data according to the first field data X1 required by the supervision contract and the third field data X3 used by the supervision contract for early warning, the second data being one-time one-way chainable data X-b. Similar to the directly chainable data X-a, the one-time one-way chainable data X-b can be in JSON format. The front-end machine can combine the directly chainable data X-a and the one-time one-way chainable data X-b into a JSON structure to obtain target data. The target data can be used as chainable data X' as a whole.

[0092] It should be noted that when the business data does not include unstructured data, the preprocessor can directly extract the first field data X1 required by the supervision contract, the second field data X2 required by the supervision contract, and the third field data X3 used by the supervision contract warning from the structured data. When the business data does not include structured data, the preprocessor can perform a hash operation on the unstructured data to obtain a hash value and extract the metadata of the unstructured data. Then the preprocessor can extract the first field data X1 required by the supervision contract, the second field data X2 required by the supervision contract, and the third field data X3 used by the supervision contract warning from the hash value and metadata of the unstructured data.

[0093] For the case where the business data includes unstructured data, the preprocessor can also call a hard encryption interface for encryption and store the encrypted unstructured data in a storage service. For example, for audio and video data, the preprocessor can call a hard encryption interface for encryption and store it in a local audio and video storage service. Considering security, the preprocessor can split unstructured data, such as rich media data such as audio and video data, into multiple unreadable data slices through a data slicing algorithm, and then distribute the multiple data slices, such as distributed storage in multiple user-managed chain nodes. It should be noted that directly accessing the data slices stored in different users cannot identify the data content, and authorized access can obtain the real data slices.

[0094] It should be noted that the data chaining request can be a business system sending a backing proposal request and obtaining a backing result, which is sent when the backing result meets the backing strategy. Referring to Figure 6 As shown in the flowchart of a transaction including private data, as shown in ①, the client initiates a backing proposal request to the backing node (such as the first chain node) managed by the organization with private data access authority in the private data group. The backing proposal request is used to request the backing node to endorse the transaction proposal. As shown in ②, the backing node simulates the transaction, and stores the read-write set during the simulation transaction in the transient storage of the backing node, such as the transient storage #1 in Figure 6 When the backing result meets the backing strategy, such as receiving the number of signatures of the backing node being greater than a set number, the business system can submit a transaction ordering request, as shown in ④. The transaction ordering request can be submitted to the consensus node through the preprocessor. The consensus node can be the first chain node.

[0095] S404, the first chain node obtains first data and second data from the target data.

[0096] The first chain node can split the target data to obtain the first data and the second data. The first data includes a hash value of first field data X1 required by the supervision contract and second field data X2 required by the supervision contract, and the second data includes the first field data X1 and third field data X3 used by the supervision contract. The first field data X1 and the third field data X3 are private data.

[0097] S406, the first chain node stores the first data to the public ledger of the blockchain network 10.

[0098] The first chain node can call the contract interface to store the first data to the public ledger of the blockchain network 10. The first chain node can store the first data to the public ledger of the blockchain network 10 by adding a block.

[0099] S408, the first chain node calls a software and hardware interface to obtain a key and encrypt the second data by the key.

[0100] The software and hardware interface can be a software interface or a hardware interface for generating a key. The key can be of different types according to different encryption algorithms. For example, when the symmetric encryption algorithm is used to encrypt the second data, the key can be a symmetric key. The key obtained by the first chain node each time calling the software and hardware interface can be different, and encrypting the second data based on the key can achieve one number and one encryption.

[0101] S410, the first chain node stores the encrypted second data to the private ledger of the first private data group.

[0102] The first private data group includes the first chain node and a second chain node. The second chain node can be configured or specified when the user creates the first private data group. Specifically, the first chain node can receive configuration information, the configuration information including identification information of the second chain node that forms the first private data group with the first chain node, and the first chain node forms the first private data group according to the identification information of the second chain node. The second chain node can also be a public node, a backup node or a supervision node. The second chain node and other chain nodes of the blockchain network 10 form private data groups respectively, for example, the second chain node can form the first private data group with the first chain node when joining the blockchain network 10.

[0103] In a specific implementation, the first chain node can store the encrypted second data to a private ledger of the first private data group maintained by the first chain node, and synchronize the second data to the private ledger of the first private data group maintained by the second chain node through peer-to-peer synchronization. The first chain node can actively synchronize the second data to the private ledger of the first private data group maintained by the second chain node, or synchronize the second data to the private ledger of the first private data group maintained by the second chain node in response to a synchronization request of the second chain node. For example, the second chain node can generate a synchronization request at a regular time, the synchronization request being used to synchronize data from other chain nodes (such as the first chain node) of the first private data group, and the first chain node can synchronize the second data to the private ledger of the first private data group maintained by the second chain node in response to the synchronization request.

[0104] Still taking Figure 6 For example, as shown in ⑤, the consensus node (such as the first node) can broadcast the block in which the transaction is sorted to all chain nodes 100 (including endorsement nodes and ledger nodes) in the blockchain network 10. It should be noted that the block includes the hash value of the private data, but does not include the private data. As shown in ⑥, the ledger node verifies the integrity of the data of the transaction in the block according to the hash value of the private data, without knowing the complete private data. When the verification is passed, the ledger node can add the block to the block chain storage. Further, as shown in ⑦, the ledger node can determine whether the ledger node has the right to access the private data according to the sharing policy defined in the private data group. If the ledger node has the right, the ledger node can preferentially obtain the private data from the local transient storage #2, and if the local still does not have the private data, the ledger node can obtain the corresponding private data from other ledger nodes in the same private data group. Then the ledger node verifies the actual private data according to the hash value of the private data in the corresponding transaction in the synchronized block, and after the verification is passed, the private data can be submitted to the local private state database, and the private data in the local transient storage is cleared, and the state data of the entire transaction is updated to the public world state database (public state database).

[0105] In some possible implementation manners, when the private ledger maintained by the first chain node has data loss or damage, the first chain node can also record the event causing the data loss or damage to the public ledger of the blockchain network. Accordingly, the second chain node sends the data lost or damaged in the private ledger maintained by the first chain node to the first chain node according to the event causing the data loss or damage recorded in the public ledger. In this way, the storage availability detection capability is provided for the distributed storage reliability of the blockchain network 10, and when the storage medium fails or mistakenly deletes data, the event can be recorded, chained, and synchronized to the blockchain network 10 for alarm in a timely manner. In addition, the method can provide the backup recovery capability for the distributed storage reliability of the blockchain network 10, and when the storage medium fails or mistakenly deletes data, the storage medium can be automatically selected to recover the data, for example, the private data can be synchronized based on the private ledger of the blockchain network to guarantee the storage security of the private data.

[0106] Based on the above description, the data processing method provided in the application creates a private data group that can share private data among specific chain nodes by multiplexing the chain nodes of the blockchain network, without creating a new blockchain network. All organizations joining the blockchain network can perform integrity verification and accounting on transactions including private data, which guarantees the security of private data under the premise of compatibility with the blockchain network architecture. The design of the private data group can balance the efficient synchronization of private data and the point-to-point synchronization of private data, implement a flexible organization joining and exiting mechanism in the private data group, and reduce the network maintenance cost of the multi-privacy data group. In addition, the method supports the chain node to call the software and hardware interface to obtain the key, encrypt the private data that needs to be protected, store it in the private ledger, and the user does not need to install the management business contract. The method realizes one number and one encryption on the chain node side, provides forward security and backward security for the chained data, does not require the user to manage additional keys, and reduces the management and maintenance cost.

[0107] Further, the application can record events for each data chaining and storage, and record events for storage exceptions (such as accidental deletion) and storage changes (such as storage changes caused by data recovery). Based on the recorded events, the method can support backtracking to identify malicious on-chain users and behaviors, implement data synchronization and operation record tracing at the smart contract level, and thus implement big data storage version management at the blockchain application level.

[0108] In addition, the data processing method of the application can provide a unified interface for the user of the blockchain network to chain private data, shield the chain code and business code that the user needs to develop for normal private data chaining, reduce the operation complexity, and improve the application scope and ease of use of the blockchain network.

[0109] In order to make the technical solutions of the present application clearer and easier to understand, the data processing method of the present application will be introduced below in combination with a scenario.

[0110] The scenario mainly involves the administrative office and the supervision organization, and different administrative offices can provide different services. For ease of description, the present application will be illustrated by taking the administrative office as including X office and Y office. The X office, the Y office and the supervision organization include respective business systems, front-end machines and chain nodes. The business system of the supervision organization is a supervision platform. Referring to Figure 7 The X office chain node can split the on-chain data X' to obtain directly on-chain data X-a and one-time one-way data X-b when the X office performs data on-chain. The directly on-chain data X-a can be stored in a public state database, and each administrative office chain node (for example, a chain node managed by the administrative office) and the supervision organization chain node (for example, a chain node managed by the supervision organization) can access it. The one-time one-way data X-b is stored in a private state database of a private data group. Specifically, the one-time one-way data X-b is first stored in the private state database of the X office chain node, and after being authorized by the supervision organization, it is synchronized to the supervision organization chain node.

[0111] The different user usage processes can be seen from Figure 8 In the initialization phase, the management user can set the supervision node. In this scenario, the supervision node can be the supervision organization chain node, which is used to back up the private data on-chained by the administrative office and supervise based on the backed-up data. When the initialization is completed, the administrative office can store the private data on-chain to the private state database of the administrative office chain node, and the supervision node can synchronize the private data through the private data group point-to-point. The administrative office can authorize the supervision organization to specify the case data of the case, and generate authorization information using the public key of the supervision organization. The authorization information can include an encrypted symmetric key. The supervision organization reads the authorization information, decrypts the authorization information using its own private key, obtains the symmetric key, and then can decrypt the case data using the symmetric key to obtain the plaintext.

[0112] Next, the data processing method of the present application will be introduced from the perspective of the administrative office side accepting supervision and the supervision organization side performing supervision.

[0113] Referring to Figure 9 A flowchart of an administrative office side data processing method is shown. The method includes the following steps:

[0114] S902, the administrative office front-end service obtains the business data to be chained in the administrative office business system.

[0115] The business data can include at least one of structured data or unstructured data.

[0116] S904, for unstructured data in the business data, the bureau front-end service extracts the metadata of the unstructured data, and performs a hash operation on the unstructured data to obtain a hash value of the unstructured data.

[0117] S906, the bureau front-end service encrypts the unstructured data, and stores the encrypted unstructured data in the evidence storage service.

[0118] The encryption and decryption service platform can provide encryption and decryption interfaces. Specifically, the encryption and decryption service platform can expose a hard encryption interface, a hard decryption interface, a soft encryption interface, and a soft decryption interface to the outside. The above interfaces exposed by the encryption and decryption service platform can be an application programming interface (application programming interface, API), for example, a hard encryption API. The bureau front-end service can call the hard encryption API provided by the encryption and decryption service platform to encrypt the unstructured data, and then store the encrypted unstructured data in the evidence storage service. Wherein, when the unstructured data is audio and video data, the bureau front-end service can store the encrypted unstructured data in the audio and video evidence storage service.

[0119] S908, the bureau front-end service merges the metadata and the hash value of the unstructured data with the structured data, processes the merged data, and obtains the on-chain data X'.

[0120] Wherein, the bureau front-end service can classify the merged data to obtain the following types of data: a, first field data X1 required by the supervision contract; b, second field data X2 required by the supervision contract, the second field data does not include private data; c, third field data X3 (in addition to X1 and X2) used by the supervision contract warning. The first field data X1 and the third field data X3 are private data.

[0121] The bureau front-end service can perform a hash operation on the first field data X1 to obtain a hash value X1_hash of the first field data X1, combine X1_hash and X2 to obtain directly on-chain data X-a, and combine the first field data X1 and the third field data X3 to obtain one number and one secret on-chain data X-b.

[0122] S910, before on-chain, the bureau front-end service sets a private data viewing authorization event.

[0123] S912, the bureau front-end service calls the contract interface and sends a data on-chain request to the bureau chain node.

[0124] The contract interface can be a blockchain software development kit (SDK) interface, and the supervisory contract deployed in the blockchain network 10 can be developed based on the SDK interface. The bureau front-end service can call the blockchain SDK interface, and pass the on-chain data X' and the called contract business interface method as interface parameters to the supervisory contract.

[0125] S914, the bureau chain node splits the on-chain data X' into directly on-chain data X-a and one-number-one-math on-chain data X-b.

[0126] S916, for the directly on-chain data X-a, the bureau chain node calls the contract interface and on-chains to the public ledger.

[0127] S918, for the one-number-one-math on-chain data X-b, the bureau chain node calls the soft encryption interface to obtain the symmetric key, encrypts the data using the symmetric key, and saves it to the private state database.

[0128] S920, the bureau chain node can synchronize the encrypted one-number-one-math on-chain data X-b to the supervisory organization chain node.

[0129] It should be noted that, Figure 9 The supervisory organization chain node is taken as an example of a backup node. In some examples, the supervisory organization chain node and the backup chain node can also be different nodes, and accordingly, the bureau chain node can synchronize the encrypted one-number-one-math on-chain data X-b to the backup node.

[0130] The business system of the regulatory node can be a supervision platform. When the supervision platform triggers a supervision request, the supervision request includes the index of the target data, the regulatory node (such as the second chain node) can obtain the first data through the supervision contract according to the index of the target data, and then detect whether the first data is abnormal according to the first data and the supervision business logic in the supervision contract, and return the abnormal detection result to the supervision platform. The abnormal detection result is used to indicate whether the first data is abnormal. For the first data with abnormality or the data applying for review, the supervision platform supports viewing the complete data. Specifically, when the supervision platform triggers a data viewing request, the data viewing request includes the index of the target data to be viewed, the regulatory node can obtain the first data through the supervision contract according to the index of the target data, and obtain the encrypted second data through the supervision contract. The regulatory node can decrypt the encrypted second data, and return the first data and the second data to the supervision platform.

[0131] The supervisory node can request authorization of the supervisory node when obtaining the encrypted second data. Specifically, the supervisory node generates a private data viewing authorization request through the supervision contract, the first chain node (such as the bureau chain node) listens to the private data viewing authorization request, and authorizes the user of the second chain node. The first chain node can authorize the user through the front-end service. Then the second chain node receives the encrypted symmetric key transmitted by the first chain node through the first private data group, and the symmetric key is a key for encrypting and decrypting the second data.

[0132] The following is an example of a supervisory node as a supervisory organization chain node.

[0133] Referring to Figure 10 The flowchart of the method for processing data on the side of the supervisory organization, the method comprising the following steps:

[0134] S1002, the supervision platform sets a case supervision rule. When the supervision rule is triggered, the supervision platform sends a supervision request to the supervision organization front-end service.

[0135] The supervision request includes the case number that needs to be supervised. In other possible implementations, other indexes of the case can also be used instead of the case number in the supervision request.

[0136] S1004, the supervision organization front-end service calls the blockchain SDK interface and passes the case number that needs to be supervised to the supervision organization chain node.

[0137] Specifically, the supervision organization front-end service calls the blockchain SDK interface and passes the case number that needs to be supervised as a parameter to the supervision contract deployed by the supervision organization chain node.

[0138] S1006, the supervision organization chain node obtains the directly chainable data X-a according to the case number, and judges whether the case is abnormal through the supervision business logic written in the supervision contract.

[0139] S1008, the supervision organization chain node returns the abnormality detection result to the supervision organization front-end service.

[0140] S1010, the supervision organization front-end service returns the abnormality detection result to the supervision platform.

[0141] S1012, when the abnormality detection result indicates that the case is abnormal, the supervision platform sends a data viewing request.

[0142] S1014, the supervision organization front-end service calls the blockchain SDK interface and passes the case number that needs to be viewed to the supervision organization chain node.

[0143] Similar to S1004, the supervision organization pre-service calls the blockchain SDK interface, passes the case number that needs to be viewed as a parameter to the supervision contract deployed by the supervision organization chain node.

[0144] S1016, the supervision organization chain node retrieves the case data in plaintext according to the case number.

[0145] S1018, the supervision organization chain node generates a private data viewing authorization request through the supervision contract according to the case number.

[0146] S1020, the delegation bureau chain node listens to the private data viewing authorization request and pushes the private data viewing authorization request to the delegation bureau pre-service.

[0147] S1022, the delegation bureau pre-service automatically authorizes the supervision organization to view the private data of the case.

[0148] S1024, the delegation bureau chain node encrypts the symmetric key using the supervision organization public key to obtain the encrypted symmetric key.

[0149] The symmetric key refers to the key for encrypting the private data.

[0150] S1026, the delegation bureau chain node synchronizes the encrypted symmetric key and the encrypted private data to the supervision organization chain node through the private data group.

[0151] It should be noted that when the delegation bureau chain node and the supervision organization chain node are in the same private data group, the private ledger of the supervision organization chain node can store the encrypted private data, and the delegation bureau chain node does not need to synchronize the encrypted private data to the supervision organization chain node. In other words, when the delegation bureau chain node and the supervision organization chain node are in the same private data group, the delegation bureau chain node can synchronize the encrypted symmetric key to the supervision organization chain node through the private data group, so that after the supervision organization chain node decrypts the symmetric key, it decrypts the locally stored encrypted private data through the symmetric key to obtain the private data.

[0152] S1028, the supervision organization chain node calls the supervision organization private key to decrypt the symmetric key and calls the symmetric key to decrypt the private data.

[0153] S1030, the supervision organization chain node returns the decrypted private data and the retrieved plaintext case data to the supervision organization pre-service.

[0154] S1032, the supervision organization pre-service assembles the private data and the plaintext case data into complete data.

[0155] S1034, the supervision organization pre-service calls the hard decryption interface to obtain the key, and the encrypted unstructured data stored in the audio / video evidence service is decrypted to obtain the audio / video.

[0156] S1036, the supervision organization pre-service returns the assembled complete data and the audio / video to the supervision platform.

[0157] In the method, the supervised administrative office receives the case data and chains the case data, the supervision organization supervision platform can trigger the supervision request, and the supervision organization chain node can automatically check whether the case is abnormal according to the on-chain data through the supervision business logic of the supervision contract. For the case with abnormality or the case applying for reconsideration, the supervision organization chain node can case data, and push to the supervision platform after decryption for viewing. Since the case data of each case is independently encrypted once, the security of the private data in the case data is guaranteed, and the supervision node can only view the private data after authorization, further guaranteeing the security. Moreover, the method provides a private ledger isolated from the public ledger, stores the private data ontology in the private ledger, and guarantees the security of the private data. Among them, all interactions with the private ledger can pass through the private data protection engine (a data processing device in the chain node for processing private data), and the private data protection engine records the interaction history, maintains the group information, saves the key rotation information, and negotiates the key. And the interaction history, group information, etc. can be stored on the chain, so that the traceability of private data can be realized.

[0158] Further, when the data is lost or damaged, the local private data can be reconstructed by reading the block information one by one, and reading the lost or damaged data from the private ledger based on the block information. It should be noted that when reconstructing the local private data, the gossip mode can be used to improve the efficiency of the overall process, and the security, availability, accessibility and operation traceability of the data can be improved.

[0159] Moreover, the method supports providing private data encryption capabilities for all participants in the blockchain network, and each distributed node synchronously verifies, so as to guarantee that all data are consistent and tamper-proof by means of the consensus mechanism of the blockchain network, realize the construction of one number and one secret capability in the blockchain system, combine the decentralized system of the blockchain, improve the credibility of private data protection of each chain node, and avoid the trust problem in each centralized encryption system.

[0160] It should be noted that the storage mode based on the blockchain can not only be applied to the construction of various large infrastructures such as the blockchain open alliance chain and the city chain network, but also can be used as a new type of distributed storage technology for various cloud service storage bottoms to achieve different types of storage backup and recovery capabilities, and the operation can be audited. When the performance is optimized to a certain extent, based on the specific blockchain incentive system, the purpose of replacing all current storage systems can be achieved.

[0161] Based on Figures 4 to 10 According to the method embodiment shown in the application, a data processing device is also provided. The data processing device can be a software device, for example, a private data protection engine, an on-chain component or middleware deployed on a chain node. Alternatively, the data processing device can also be a hardware device, for example, a chain node. The data processing device is introduced from the perspective of functional modularization as follows.

[0162] Referring to Figure 11 As shown in a structural schematic diagram of a data processing device, the data processing device 1100 is applied to a blockchain network 10, the blockchain network 10 includes a plurality of chain nodes 100, at least two chain nodes 100 in the plurality of chain nodes 100 form a private data group, each chain node 100 in the private data group maintains a private ledger of the private data group, the data processing device 1100 is deployed in a first chain node in a first private data group, and the data processing device 1100 includes:

[0163] A communication module 1102 is configured to receive a data chaining request, the data chaining request being used to store target data to a ledger of the blockchain network;

[0164] A data processing module 1104 is configured to obtain first data and second data from the target data, the first data including a hash value of first field data required by a supervision contract and second field data required by the supervision contract, and the second data including the first field data and third field data required by the supervision contract, the first field data and the third field data being private data;

[0165] A storage module 1106 is configured to store the first data to a public ledger of the blockchain network;

[0166] An encryption module 1108 is configured to obtain a key by calling a software and hardware interface, and encrypt the second data by using the key;

[0167] The storage module 1106 is further configured to store the encrypted second data to a private ledger of the first private data group.

[0168] The communication module 1102, the data processing module 1104, the storage module 1106, and the encryption module 1108 can be implemented by software. When implemented by software, the communication module 1102, the data processing module 1104, the storage module 1106, and the encryption module 1108 can be application programs running on a computing device. The above application programs can also be virtualized to provide users with virtualized services. The virtualized services can include virtual machine (VM) services, bare metal server (BMS) services, or container services. The VM services can be services that provide users with VMs for use on demand by virtualizing a VM resource pool on multiple physical hosts through a virtualization technology. The BMS services are services that provide users with BMSs for use on demand by virtualizing a BMS resource pool on multiple physical hosts. The container services are services that provide users with containers for use on demand by virtualizing a container resource pool on multiple physical hosts. A VM is a virtual computer simulated, that is, a logical computer. A BMS is a high-performance computing service that can be elastically scaled, has no difference in computing performance from a traditional physical machine, and has the feature of secure physical isolation. A container is a kernel virtualization technology that can provide light virtualization to achieve the purpose of isolating user spaces, processes, and resources. It should be understood that the VM services, the BMS services, and the container services in the above virtualized services are only specific examples. In actual applications, the virtualized services can also be other light or heavy virtualized services, which are not specifically limited here.

[0169] In some possible implementation manners, the first private data group includes the first chain node and the second chain node.

[0170] The storage module 1106 is specifically configured to:

[0171] The encrypted second data is stored to a private ledger of the first private data group maintained by the first chain node, and is synchronized to a private ledger of the first private data group maintained by the second chain node through peer-to-peer.

[0172] In some possible implementation manners, the data processing apparatus 1100 further includes a group creation module 1107.

[0173] The communication module 1102 is further configured to receive configuration information, and the configuration information includes identification information of the second chain node that forms the first private data group with the first chain node.

[0174] The group creation module 1107 is configured to form the first private data group according to the identification information of the second chain node.

[0175] The group creation module 1107 can be implemented by software. When implemented by software, the group creation module 1107 can be an application program running on a computing device. Further, the application program also supports virtualization, for example, virtualization as a VM service, a BMS service, or a container service provided to a user.

[0176] In some possible implementation manners, the communication module 1102 is specifically configured to:

[0177] receive a data on-chain request sent by the preprocessor, the first data and the second data being extracted from a hash value, metadata of structured data or unstructured data to be on-chained by the preprocessor from a business system.

[0178] In some possible implementation manners, the data processing apparatus 1100 further includes a recording module 1109.

[0179] The recording module 1109 is configured to, when there is data loss or damage in the private ledger maintained by the first chain node, record an event causing the data loss or damage to the public ledger of the block chain network.

[0180] The communication module 1102 is further configured to receive data of the private ledger maintained by the first chain node lost or damaged sent by the second chain node according to the event recorded in the public ledger.

[0181] Similar to the group creation module 1107, the recording module 1109 can be implemented by software. When implemented by software, the recording module 1109 can be an application program running on a computing device. Further, the application program also supports virtualization, for example, virtualization as a VM service, a BMS service, or a container service provided to a user.

[0182] The application also provides a computing device 1200. As shown in Figure 12 The computing device 1200 includes a bus 1202, a processor 1204, a memory 1206, and a communication interface 1208. The processor 1204, the memory 1206, and the communication interface 1208 communicate through the bus 1202. The computing device 1200 can be a server or a terminal device. It should be understood that the number of processors and memories in the computing device 1200 is not limited in the application.

[0183] The bus 1202 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 12Only one bus is shown for simplicity, but there can be more than one bus. Furthermore, the bus 1202 can be implemented by different types of buses or other connections, such as a Peripheral Component Interconnect (PCI) bus, a HyperTransport® bus, Industry Standard Architecture (ISA) bus, etc.

[0184] The processor 1204 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor, a digital signal processor (DSP), a controller, a microcontroller, a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very large instruction word (VLIW) microprocessor, a microprocessor implementing other instruction sets, or any other processor. The processor 1204 can also be implemented with application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), or other programmable logic devices, or a combination of these elements.

[0185] The memory 1206 can include a volatile memory, such as random access memory (RAM), and / or a non-volatile memory, such as read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory, a mechanical hard drive, a solid-state drive, or other memory. The memory 1206 can store instructions executable by the processor 1204 to implement the data processing method. Specifically, the memory 1206 can store instructions for implementing the data processing apparatus 1100. For example, the memory 1206 can store instructions for implementing the communication module 1102, the data processing module 1104, the storage module 1106, and the encryption module 1108. Further, the memory 1206 can also store instructions for implementing the group creation module 1107 and the record module 1109.

[0186] The communication interface 1208 enables communication among the computing devices 1200 and other devices or communication networks using, for example but not limited to, a transceiver module such as a network interface card, a transceiver, etc.

[0187] The embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, for example, a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a notebook computer, or a smart phone.

[0188] As shown in Figure 13 The computing device cluster includes at least one computing device 1200. The memory 1206 in one or more computing devices 1200 in the computing device cluster can store the same software development platform 200 for executing instructions of the data processing method.

[0189] In some possible implementations, one or more computing devices 1200 in the computing device cluster can also be used to execute part of the instructions of the software development platform 200 for executing the data processing method. In other words, the combination of one or more computing devices 1200 can collectively execute the instructions of the software development platform 200 for executing the data processing method.

[0190] It should be noted that the memory 1206 in different computing devices 1200 in the computing device cluster can store different instructions for executing part of the functions of the software development platform 200.

[0191] Figure 14 A possible implementation is shown. As shown in Figure 14 The two computing devices 1200A and 1200B are connected through the communication interface 1208. The memory in the computing device 1200A stores instructions for executing the functions of the communication module 1102 and the data processing module 1104. The memory in the computing device 1200B stores instructions for executing the functions of the storage module 1106 and the encryption module 1108. Further, the memory in the computing device 1200A also stores instructions for executing the functions of the group creation module 1107. The memory in the computing device 1200B also stores instructions for executing the functions of the record module 1109. In other words, the memories 1206 of the computing devices 1200A and 1200B collectively store the instructions of the data processing apparatus 1100 for executing the data processing method.

[0192] Figure 14The connection method between the computing device clusters shown can be based on the fact that the data processing method provided in this application requires a lot of resources to store data in the ledger of the blockchain network. For example, the first data is stored in a public ledger, and the encrypted second data is stored in a private ledger. Therefore, it is considered that the functions implemented by the storage module 1106 and the encryption module 1108 are performed by independent computing devices, such as computing device 1200B.

[0193] It should be understood that Figure 14 The functions of the computing device 1200A shown can also be performed by multiple computing devices 1200. Similarly, the functions of the computing device 1200B can also be performed by multiple computing devices 1200.

[0194] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 15 One possible implementation is shown. For example... Figure 15 As shown, the two computing devices 1200C and 1200D are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this possible implementation, the memory 1206 in computing device 1200C stores instructions for performing the functions of the communication module 1102 and the data processing module 1104. Simultaneously, the memory 1206 in computing device 1200D stores instructions for performing the functions of the storage module 1106 and the encryption module 1108.

[0195] Figure 15 The connection method between the computing device clusters shown can be such that, considering the data processing method provided in this application requires a large amount of resources for data encryption and data storage, the functions implemented by the storage module 1106 and the encryption module 1108 are delegated to the computing device 1200D for execution.

[0196] It should be understood that Figure 15 The functions of the computing device 1200C shown can also be performed by multiple computing devices 1200. Similarly, the functions of the computing device 1200D can also be performed by multiple computing devices 1200.

[0197] This application embodiment also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform the data processing method described above applied to the data processing apparatus 1100.

[0198] The embodiments of the present application further provide a computer program product containing instructions. The computer program product can be software or program product containing instructions, which can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, the at least one computing device is caused to perform the above data processing method.

[0199] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A data processing method, characterized by, The application is applied to a blockchain network, the blockchain network comprises a plurality of chain nodes, at least two chain nodes in the plurality of chain nodes form a private data group, each chain node in the private data group respectively maintains a private ledger of the private data group, and the method comprises: A first chain node in a first private data group receives a data on-chain request, the data on-chain request is used to store target data to a ledger of the blockchain network; The first chain node obtains first data and second data from the target data, the first data comprises a hash value of first field data required to be used by a supervision contract and second field data required to be used by the supervision contract, the second data comprises the first field data and third field data required to be used by the supervision contract, and the first field data and the third field data are private data; The first chain node stores the first data to a public ledger of the blockchain network, and calls a software and hardware interface to obtain a key, encrypts the second data through the key, and stores the encrypted second data to a private ledger of the first private data group.

2. The method of claim 1, wherein, The first private data group comprises the first chain node and a second chain node; The first chain node stores the encrypted second data to the private ledger of the first private data group, comprising: The first chain node stores the encrypted second data to the private ledger of the first private data group maintained by the first chain node, and synchronizes to the private ledger of the first private data group maintained by the second chain node through point-to-point.

3. The method according to claim 1 or 2, characterized in that, The first private data group comprises the first chain node and a second chain node; The method further comprises: When a supervision platform triggers a supervision request, the supervision request comprises an index of the target data, and the second chain node obtains the first data through the supervision contract according to the index of the target data; The second chain node detects whether the first data is abnormal according to the first data and supervision business logic in the supervision contract; The second chain node returns an abnormal detection result to the supervision platform.

4. The method according to claim 1 or 2, characterized in that, The first private data group comprises the first chain node and a second chain node; The method further comprises: When a supervision platform triggers a data viewing request, the data viewing request comprises an index of target data to be viewed, the second chain node obtains the first data through the supervision contract according to the index of the target data, and obtains the encrypted second data through the supervision contract; The second chain node decrypts the encrypted second data, and returns the first data and the second data to the supervision platform.

5. The method according to any one of claims 1 to 4, characterized in that, The first private data group is formed in the following way: The first chain node receives configuration information, the configuration information comprises identification information of a second chain node which forms the first private data group with the first chain node; The first chain node forms the first private data group according to the identification information of the second chain node.

6. The method according to any one of claims 1 to 5, characterized in that, The first chain node receives a data on-chain request, comprising: The first chain node receives a data on-chain request sent by a front-end machine, and the first data and the second data are extracted by the front-end machine from a hash value, metadata of structured data or unstructured data to be on-chained from a business system.

7. The method according to any one of claims 1 to 6, characterized in that, The method further comprises: When the private ledger maintained by the first chain node has data loss or damage, the first chain node records an event causing the data loss or damage to the public ledger of the blockchain network; The second chain node sends the data lost or damaged in the private ledger maintained by the first chain node to the first chain node according to the event recorded in the public ledger.

8. A data processing apparatus, characterized by, The data processing device is deployed in a first chain node in a first private data group, and the device comprises: A communication module for receiving a data on-chain request for storing target data to a ledger of the blockchain network; A data processing module for obtaining first data and second data from the target data, the first data including a hash value of first field data required by a supervision contract and second field data required by the supervision contract, and the second data including the first field data and third field data for early warning use of the supervision contract, the first field data and the third field data being private data; A storage module for storing the first data to a public ledger of the blockchain network; An encryption module for calling a software and hardware interface to obtain a key and encrypting the second data by the key; The storage module is further configured to store the encrypted second data to a private ledger of the first private data group.

9. The apparatus of claim 8, wherein, The first private data group includes the first chain node and a second chain node; The storage module is specifically configured to: store the encrypted second data to the private ledger of the first private data group maintained by the first chain node, and synchronize to the private ledger of the first private data group maintained by the second chain node through point-to-point.

10. The apparatus of claim 8 or 9, wherein, The device further comprises a group creation module; The communication module is further configured to receive configuration information including identification information of a second chain node for forming the first private data group with the first chain node; The group creation module is configured to form the first private data group according to the identification information of the second chain node.

11. The apparatus of any one of claims 8 to 10, wherein, The communication module is specifically configured to: receive a data on-chain request sent by a front-end machine, and the first data and the second data are extracted by the front-end machine from a hash value, metadata of structured data or unstructured data to be on-chained from a business system.

12. The apparatus of any one of claims 8 to 11, wherein, The device further comprises a recording module; The recording module is configured to record an event causing data loss or damage to a public ledger of the blockchain network when a private ledger maintained by the first chain node has data loss or damage; The communication module is further configured to receive data of a private ledger maintained by the first chain node sent by the second chain node according to the event recorded in the public ledger, the data indicating that the private ledger is lost or damaged.

13. A cluster of computing devices, characterized in that, The computing device cluster comprises at least one computing device, the at least one computing device comprising at least one processor and at least one memory, the at least one memory storing computer readable instructions; the at least one processor executes the computer readable instructions to enable the computing device cluster to perform the data processing method according to any one of claims 1 to 7.

14. A computer-readable storage medium, characterized in that, The computer program product comprises computer readable instructions; the computer readable instructions are used to implement the data processing method according to any one of claims 1 to 7.

15. A computer program product, characterised in that, The computer program product comprises computer readable instructions; the computer readable instructions are used to implement the data processing method according to any one of claims 1 to 7.

Images