Data processing method based on block chain and related equipment

Abstract

The embodiment of the invention relates to the technical field of computers and block chains, and discloses a block chain-based data processing method and related equipment, and the method comprises the steps: carrying out the identity verification of an initiation object of a key replacement request in response to the key replacement request; if the verification is passed, acquiring a distributed identity identifier of the initiating object; wherein the resources, stored in the block chain, of the initiating object are associated with the distributed identity identifier; calling an identifier management contract, obtaining an identifier document corresponding to the distributed identity identifier, and obtaining a replacement public key of the initiating object; a resource management public key of the initiating object is stored in the identifier document; and updating the resource management public key in the identifier document to the replacement public key. According to the technical scheme provided by the embodiment of the invention, the security of resources on the block chain can be improved.

Description

Technical Field

[0001] This application relates to the fields of computer and blockchain technology, and more specifically, to blockchain-based data processing methods, apparatuses, electronic devices, computer-readable media, and computer program products. Background Technology

[0002] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. As more and more objects deploy their resources on the blockchain, the interaction between these objects and the blockchain increases significantly. This interaction primarily relies on the private keys managed by the objects. If these private keys are lost or leaked, the objects' resources on the blockchain will be lost, thus compromising resource security. Therefore, improving the security of resources on the blockchain is a pressing issue that needs to be addressed. Summary of the Invention

[0003] The embodiments of this application provide a blockchain-based data processing method, a blockchain-based data processing apparatus, an electronic device, a computer-readable medium, and a computer program product, which can improve the security of resources on the blockchain.

[0004] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0005] In a first aspect, embodiments of this application provide a blockchain-based data processing method, the method comprising:

[0006] In response to a key replacement request, authenticate the object that initiated the key replacement request;

[0007] If the verification passes, the distributed identity identifier of the initiating object is obtained; the resources stored by the initiating object in the blockchain are associated with the distributed identity identifier.

[0008] Invoke the identifier management contract to obtain the identifier document corresponding to the distributed identity identifier, and obtain the replacement public key of the initiating object; the identifier document stores the resource management of the initiating object;

[0009] Update the resource management public key in the identifier document to the replacement public key.

[0010] Secondly, embodiments of this application provide a blockchain-based data processing device, which includes a verification unit, an identifier acquisition unit, a contract invocation unit, and an update unit, wherein:

[0011] The verification unit is used to authenticate the object that initiated the key replacement request in response to the key replacement request;

[0012] The identifier acquisition unit is used to acquire the distributed identity identifier of the initiating object if the verification is successful; wherein, the resources of the initiating object stored in the blockchain are associated with the distributed identity identifier;

[0013] The contract invocation unit is used to invoke the identifier management contract, obtain the identifier document corresponding to the distributed identity identifier, and obtain the replacement public key of the initiating object; the identifier document stores the resource management public key of the initiating object;

[0014] The update unit is used to update the resource management public key in the identifier document to a replacement public key.

[0015] In one embodiment of this application, based on the aforementioned scheme, when the contract invocation unit obtains the replacement public key of the initiating object, it can specifically be used to: search for other public keys corresponding to the initiating object, other than the resource management public key, from the identifier document; if other public keys are found from the identifier document, then use the other public keys as replacement public keys; if no key pair corresponding to the initiating object is found from the identifier document, then send a public key acquisition request to the initiating object to obtain the replacement public key contained in the replacement key pair set by the initiating object.

[0016] In one embodiment of this application, based on the aforementioned scheme, when the contract calling unit obtains the replacement public key of the initiating object, it can specifically be used to: detect the public key carried in the key replacement request; if the public key is detected from the key replacement request, the detected public key is used as the replacement public key; if the public key is not detected from the key replacement request, the replacement public key set by the initiating object is obtained.

[0017] In one embodiment of this application, based on the aforementioned scheme, before the verification unit verifies the identity of the initiating object of the key replacement request in response to the key replacement request, it may further be used to: obtain the resource management public key contained in the resource management key pair set by the initiating object in response to the identity registration request of the initiating object; generate an identifier document based on the key pair corresponding to the initiating object; and associate and store the distributed identity identifier of the initiating object and the identifier document in the identifier management contract.

[0018] In one embodiment of this application, based on the foregoing scheme, the verification unit may further be used to: generate an object identifier for the initiating object based on the resource management public key corresponding to the initiating object; and call the identifier generation rule to generate a distributed identity identifier for the initiating object based on the object identifier.

[0019] In one embodiment of this application, based on the foregoing scheme, when the verification unit generates an identifier document based on the resource management public key corresponding to the initiating object, it can also be used to: generate an identifier document based on the resource management public key corresponding to the initiating object and the authentication policy of the initiating object; then, when the verification unit authenticates the initiating object of the key replacement request, it can be used to: obtain the identifier document corresponding to the initiating object and obtain the authentication policy of the initiating object from the identifier document; and authenticate the initiating object through the authentication policy.

[0020] In one embodiment of this application, based on the aforementioned scheme, the device further includes a receiving unit, which is used to receive a resource transaction initiated by an initiating object through a replacement private key corresponding to a replacement public key; the resource transaction includes a private key signature generated based on the replacement private key; the contract invocation unit can also be used to invoke an identifier management contract, obtain the replacement public key from the identifier document, and verify the signature of the private key signature contained in the resource transaction through the replacement public key; if the verification is successful, the resource transaction is executed.

[0021] In one embodiment of this application, based on the aforementioned scheme, when the contract invocation unit executes a resource transaction, it can specifically be used to obtain the number of transaction resources contained in the resource transaction and the distributed identity identifier of the resource receiving object; obtain the target resource of the transaction resource quantity from the resources associated with the distributed identity identifier of the initiating object; and associate the target resource with the distributed identity identifier of the resource receiving object.

[0022] In one embodiment of this application, based on the aforementioned scheme, when the verification unit authenticates the initiator of the key replacement request, it can specifically send the same verification information to multiple social objects of the initiator; receive the response results for the verification information; and if the number of response results matching the preset result reaches the preset number, then the verification is determined to be successful.

[0023] In one embodiment of this application, based on the aforementioned scheme, when the verification unit authenticates the initiating object of the key replacement request, it can specifically obtain the identity verification information of the initiating object and send the identity verification information to the identity management object so that the identity management object can verify the identity verification information and obtain the authentication result; receive the authentication result sent by the identity management object; if the received authentication result indicates that the verification is successful, then the verification is confirmed to be successful.

[0024] Thirdly, embodiments of this application provide an electronic device, including one or more processors; and a storage device for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the electronic device enables the blockchain-based data processing method described above.

[0025] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor of an electronic device, causes the electronic device to perform the blockchain-based data processing method as described above.

[0026] Fifthly, embodiments of this application provide a computer program product, including a computer program stored in a computer-readable storage medium, wherein a processor of an electronic device reads from and executes the computer program from the computer-readable storage medium, causing the electronic device to perform the blockchain-based data processing method as described above.

[0027] In the technical solution provided by the embodiments of this application, unified management of resources and identities is achieved by associating resources with distributed identity identifiers. The association between resources and distributed identity identifiers, and the correspondence between public and private keys, allows for the technical updating of the private key required to manage the resources associated with the distributed identity identifier by updating the resource management public key in the identifier document corresponding to the distributed identity identifier. Furthermore, by updating the resource management public key to a replacement public key, the corresponding replacement private key gains the ability to access and control resources on the blockchain. This allows the target to regain control over on-chain resources, effectively avoiding the risk of resource loss due to lost or leaked private keys, and improving the security of resources on the blockchain.

[0028] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0029] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0030] Figure 1 This is a schematic diagram of the system architecture of a blockchain system provided in an embodiment of this application;

[0031] Figure 2 This is a schematic diagram of a blockchain provided in an embodiment of this application;

[0032] Figure 3 This is a flowchart illustrating a blockchain-based data processing method provided in an embodiment of this application;

[0033] Figure 4This is a schematic diagram of the process of uploading an identifier document to the blockchain, as provided in an embodiment of this application.

[0034] Figure 5 This is a schematic diagram of a key replacement process provided in an embodiment of this application;

[0035] Figure 6 This is a flowchart illustrating another blockchain-based data processing method provided in an embodiment of this application;

[0036] Figure 7 This is a structural block diagram of a blockchain-based data processing apparatus shown in another exemplary embodiment of this application;

[0037] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0038] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0039] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0040] The flowcharts shown in the accompanying diagrams are merely illustrative and do not necessarily include all content and operations, nor do they necessarily have to be executed in the described order. For example, some operations may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0041] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0042] It should also be noted that "multiple" as mentioned in this application refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0043] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product service layer, and an application service layer. A blockchain consists of a series of blocks linked together in chronological order of their creation. Once a new block is added to the blockchain, it cannot be removed. Each block records the data packaged and submitted by the blockchain nodes within the system.

[0044] In blockchain, the consensus mechanism refers to the mechanism by which blockchain nodes reach a consensus on blocks (also known as block information or block data), ensuring that the latest block is accurately added to the blockchain. Blocks that successfully reach consensus are added to the blockchain, thus updating the world state of the blockchain. The latest data state in the blockchain after the latest block is on the chain is called the "world state."

[0045] As more and more objects deploy their resources to the blockchain, the interaction between objects and the blockchain is also increasing. This interaction is primarily achieved through Externally Owned Accounts (EOAs) created by objects on the blockchain. EOAs are controlled by the object using a private key and are used for initiating transactions, signing messages, and managing resources.

[0046] In a blockchain, an object needs to generate and store a corresponding private key for each EOA. The private key is used to sign transactions and messages to prove the object's ownership of the account. The public key is calculated from the private key and used to further generate the account address. As an object uses multiple accounts in different applications, managing its private keys becomes cumbersome and error-prone. Furthermore, the object needs to ensure the secure storage of its private keys to prevent loss or theft, thereby ensuring control over each EOA.

[0047] An account address is a string used to uniquely identify an account in a blockchain network. In a blockchain network, each object has one or more account addresses associated with its private and public keys. Account addresses are used to receive and send digital resources. Account addresses are typically generated by hashing and encoding the object's public key. Because public keys are unique, the generated account addresses are also unique.

[0048] Currently, objects primarily manage their resources stored on the blockchain using private keys. Specifically, objects can initiate resource transactions using their private keys, which are broadcast to the blockchain network and eventually packaged into blocks. Transactions can be used to transfer resources, invoke smart contract methods, or create new contract accounts. Within a smart contract, the account address of the transaction initiator can be obtained through private key signing, thereby allowing changes to the assets under that account address.

[0049] It is clear that the private key is the object's unique credential regarding its EOA. If the object's private key is lost or leaked, the corresponding resources cannot be recovered; this not only results in the loss of the object's resources in the blockchain, but may also negatively impact the trust and security of the entire blockchain network.

[0050] While related technologies can improve the security of private keys through mnemonic phrases, hardware wallets, etc., they still cannot completely solve the problem that if a private key is lost, the object cannot schedule resources, resulting in the resources being essentially lost.

[0051] Furthermore, resources in current blockchains are typically registered in the account address of the resource owner. Therefore, when initiating a resource transaction, the initiator must specify the account address of the resource recipient. However, a blockchain account address is a string of 40 hexadecimal characters, such as "0x742d35Cc6634C0532925a3b844Bc454e4438f44e", making it very difficult for most people to remember.

[0052] Based on this, this application provides a blockchain-based data processing scheme that associates resources stored in the blockchain with the distributed identity identifier of an object, and stores the object's public key in the identifier document corresponding to the object's distributed identity identifier, so as to provide the object with a way to find a replacement key after the key is lost based on the identifier document.

[0053] To address the aforementioned issues, this application provides a blockchain system, which can be found in the embodiments described above. Figure 1 , Figure 1 A schematic diagram of the system architecture of a blockchain system is shown. Figure 1The blockchain system 100 shown can specifically be a system for data sharing between nodes. This blockchain system 100 can include multiple blockchain nodes (also known as consensus nodes), such as... Figure 1 Blockchain nodes 101 to 104 are shown; among them, Figure 1 The ellipsis in the code indicates that the blockchain system 100 also includes other blockchain nodes. Blockchain nodes are the basic components of the entire blockchain system, responsible for processing transactions, storing blockchain data, and participating in consensus.

[0054] In Blockchain System 100, each blockchain node stores the same blockchain (also known as a block ledger). The block ledger is the core data structure of the blockchain system, used to store and manage all confirmed blocks. The block ledger is organized in a chain-like structure, with each block containing a set of transactions, a block header (including metadata such as the hash value and timestamp of the previous block), and other information. The block ledger provides the blockchain system with a public, immutable history of transactions, ensuring the system's transparency and consistency.

[0055] Furthermore, each blockchain node, in its normal operation, can receive input information and maintain shared data within the blockchain system 100 based on this received input information. To ensure information exchange within the blockchain system 100, such as... Figure 1 As shown, each blockchain node in the blockchain system 100 can have a wired or wireless communication connection, and information can be transmitted between the blockchain nodes through the aforementioned communication connection.

[0056] For example, when any blockchain node in blockchain system 100 responds to a transaction request and executes multiple transactions, it can package these executed transactions into a block as input information. Upon receiving this block, other blockchain nodes in blockchain system 100 process it according to a consensus algorithm. Once consensus is reached, the block is stored as part of the shared data, ensuring data consistency across all blockchain nodes in blockchain system 100.

[0057] Each blockchain node in blockchain system 100 has a corresponding node identifier. Furthermore, each blockchain node in blockchain system 100 can store the node identifiers of other blockchain nodes in blockchain system 100, so that the generated block can be broadcast to other blockchain nodes in blockchain system 100 based on their node identifiers. Each blockchain node can maintain a node identifier list as shown in the table below, storing the node name and node identifier in this list. The node identifier can be an IP (Internet Protocol) address or any other information that can be used to identify the node; Table 1 only uses IP addresses as an example.

[0058] Table 1

[0059] Node Name Node identifier Blockchain Node 101 117.114.151.174 Blockchain Node 102 117.116.189.145 … … Blockchain node xxx xxx.xxx.xxx.xxx

[0060] In Blockchain System 100, each node stores an identical copy of the blockchain. A blockchain consists of multiple blocks; see [link to relevant documentation]. Figure 2 A blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores input information feature values, version number, timestamp, and difficulty value, while the block body stores the input information. The next block after the genesis block takes the genesis block as its parent block. The next block also includes a block header and a block body. The block header stores the input information feature values ​​of the current block, the block header feature values ​​of the parent block, version number, timestamp, and difficulty value, and so on. This ensures that the block data stored in each block is related to the block data stored in the parent block, guaranteeing the security of the input information in the blocks.

[0061] It should be noted that the embodiments of this application can be applied to various scenarios, including but not limited to smart finance, cloud technology, AI (Artificial Intelligence), intelligent transportation, smart healthcare, and so on, and are not limited thereto.

[0062] Furthermore, in specific embodiments of this application, if data or information such as blocks and transactions involve objects, when the embodiments of this application are applied to specific products or technologies, permission or consent from the objects is required, and the collection, use, and processing of related data or information must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0063] The following details the various implementation details of the technical solutions in the embodiments of this application:

[0064] like Figure 3 As shown, Figure 3This is a schematic flowchart illustrating a blockchain-based data processing method according to an embodiment of this application. This method can be applied to... Figure 1 The blockchain system shown can be executed by blockchain nodes, by smart contracts deployed in the blockchain system, or by both blockchain nodes and smart contracts. In this embodiment, the method is described using the execution of the method by blockchain nodes as an example. The blockchain-based data processing method may include steps S301 to S304, which are detailed below:

[0065] S301. In response to a key replacement request, authenticate the object that initiated the key replacement request.

[0066] In this embodiment, a key replacement request is used to request a new key to replace the key currently owned by the initiating object. The initiating object can initiate a key replacement request when a key it manages is lost or leaked. Specifically, the initiating object can be the key owner or a terminal device interacting with the key owner; this is not limited here.

[0067] Authenticating the object that initiates the key replacement request can effectively prevent other objects from impersonating the object that owns the resource in order to obtain the replacement key and perform improper operations on the resources stored in the blockchain by the object that owns the resource.

[0068] In one embodiment, the specific process of authentication may include: sending the same authentication information to multiple target objects associated with the initiating object; then receiving response results for the authentication information; if the number of response results matching the preset result reaches the preset number, then the authentication is determined to be successful.

[0069] In this context, the initiating object is assumed to be the resource owner object; however, it can only access the corresponding resource in the blockchain after successful authentication. Therefore, the target object associated with the initiating object is equivalent to the target object associated with the resource owner object; the target object can include objects that have interacted with the resource owner object. The target object can also be an object registered on the blockchain. For example, the target object can be an object that has had resource transactions with the resource owner object, or an object that has had social interactions with the resource owner object; there are no specific limitations here.

[0070] The verification information can be a pre-set verification question or verification number from the resource's owner, or it can be information randomly generated by blockchain nodes. The preset results and preset quantities corresponding to the verification information can be set manually or by nodes in the aforementioned blockchain system; no restrictions are imposed here.

[0071] Specifically, the preset quantity can be set based on the number of target objects, and the preset quantity can be less than or equal to the number of target objects. The preset result can be pre-set by the resource's owner for the verification information, or it can be randomly set each time for the verification information; there is no limitation here. For example, the verification information randomly generated by the blockchain node can be an input number, the preset result can be 1234, and the preset quantity can be 5. The blockchain node can send the verification information to 10 target objects while simultaneously sending the preset result to the initiating object. The initiating object can then inform each target object of the preset result via chat software or other means, so that the target objects reply with "1234" to the verification information. Thus, when the blockchain node receives 5 "1234" responses, it determines that the initiating object's identity verification is successful.

[0072] In another embodiment, the key replacement request may carry the identity verification information of the initiating party. This identity verification information may include at least one type of data that is difficult to copy and uniquely identifies the initiating party, such as fingerprint information, facial image, voiceprint information, or iris information.

[0073] The specific process of identity verification may include: obtaining the identity verification information of the initiating object and sending the identity verification information to the identity management object so that the identity management object can verify the identity verification information and obtain the identity verification result; then, receiving the identity verification result sent by the identity management object; if the received identity verification result indicates that the verification is successful, then the verification is confirmed to be successful.

[0074] The identity management object can be a person, a terminal device, or a service platform; there are no restrictions here. Specifically, the identity management object can pre-store the identity verification information of the object to which the resource belongs. If the identity verification information of the initiating object matches the pre-stored identity verification information, an authentication result indicating successful verification can be generated; if they do not match, an authentication result indicating unsuccessful verification can be generated. In one possible implementation, the initiating object can also directly send a key replacement request to the identity management object, which will then authenticate the initiating object and obtain an authentication result. The identity management object then sends the authentication result to the blockchain node.

[0075] Optionally, to further enhance the reliability of the authentication result, the identity management object signs the authentication result using its private key, and then sends the signed authentication result to the blockchain node. The blockchain node calls the identity management object's public key to authenticate the signed authentication result; only after successful authentication does it proceed with subsequent steps. In another possible implementation, a smart contract for authentication can be pre-deployed in the blockchain system, setting authentication conditions; if the authentication conditions are met, the authentication is considered successful.

[0076] Optionally, the key replacement request initiated by the initiating object may carry identity verification information. If the identity verification information meets the identity verification conditions, the verification is deemed successful; if the identity verification information does not meet the identity verification conditions, the verification is deemed unsuccessful.

[0077] For example, a smart contract for authentication could be an identifier management contract, where authentication conditions could include a reference number of private key signatures from preset objects. Then, after generating a key replacement request, the initiating object can send the request to multiple preset objects, allowing each preset object to sign the request with its private key.

[0078] Then, the initiating entity sends a key replacement request, signed with at least one private key, to the blockchain node. The blockchain node can then invoke the identifier management contract to obtain the number of private key signatures in the key replacement request. If the number of private key signatures reaches a reference number, the verification is considered successful. For a detailed explanation of the preset object, please refer to the explanation of the target object above, and for a detailed explanation of the reference number, please refer to the explanation of the preset number above; further details are not provided here.

[0079] Alternatively, identity verification can be performed through other methods such as dynamic verification codes and supporting information proof, which are not limited here.

[0080] S302. If the verification is successful, obtain the distributed identity identifier of the initiating object; wherein, the resources stored by the initiating object in the blockchain are associated with the distributed identity identifier.

[0081] In this application embodiment, a Decentralized Identifier (DID) is a unique, persistent, and verifiable digital identifier. It is a decentralized digital identity recognition method used to uniquely identify entities (such as individuals, organizations, devices, etc.). DID is a self-verifiable identity management method that enables entities to own and control their digital identities without a centralized registration authority.

[0082] A Distributed Identity Identifier (DID) consists of three main parts. The first part is the DID Scheme, similar to the Hypertext Transfer Protocol (HTTP), Hypertext Transfer Security Protocol (HTTP), and Text Transfer Protocol (TPS) in a Uniform Resource Identifier (URL). The second part is the Distributed Identity Identifier Method (DID Method Name). The DID Method Name is a key component of the distributed identity identifier system, defining how to create, read, update, and delete distributed identity identifiers and identifier documents within a specific distributed ledger or network. The third part is the specific identifier, which is unique throughout the entire DID Method namespace.

[0083] In this embodiment, the resources stored on the blockchain are associated with distributed identity identifiers; that is, in this embodiment, each object's resources on the blockchain are registered under a distributed identity identifier. The distributed identity identifier is used to uniquely identify an object on the blockchain, which means that each object only needs to manage one distributed identity identifier to access and control all its resources stored on the blockchain.

[0084] The resources can be data or digital assets with value or rights; resources can include various types of data resources. For example, they can include data resources of the bill asset type (such as electronic bills, transaction vouchers, etc.), data resources of the account asset type (such as data resources that can serve as general equivalents, etc.), and data resources of the information sharing type (such as core bill information, shared account information, shared book information, shared location data information, etc.), without limitation.

[0085] In practical implementation, the resources stored on the blockchain can be digital assets representing certain values ​​or rights. These assets can represent various forms of value, such as general equivalents, equity, points, and goods, and possess characteristics such as divisibility, tradability, and programmability. The issuance and use of resources typically follow certain protocols and standards, such as ERC-20 (an application programming interface standard proposed in 2015) and ERC-721 (Ethereum Request for Comments 721, an application programming interface standard proposed in 2018).

[0086] Specifically, each resource stored on the blockchain by an object is mapped to a distributed identity identifier (DID) for that object. For example, the DID of object M could be "did:example:0x1234567890"; where "did" is the DID Scheme, "example" is the DID method name, and "0x1234567890" is the unique object identifier (i.e., a specific identifier) ​​for object M. The process of object M storing 10 Tokens (a way of representing a resource) into the blockchain establishes a mapping between object M's DID and these 10 Tokens. A string like "did:example:0x1234567890:+10Token" means that the resource associated with object M's DID has increased by 10 Tokens.

[0087] In one embodiment, the distributed identity identifier of the initiating object can be input triggered by the initiating object. Optionally, since the resources of the aforementioned objects on the blockchain are all registered under the distributed identity identifier, the distributed identity identifier of the initiating object is associated with the blockchain wallet of the initiating object; therefore, the distributed identity identifier associated with the blockchain wallet logged into by the initiating object can also be detected to obtain the distributed identity identifier of the initiating object.

[0088] Optionally, the distributed identity identifier of the initiating object can also be obtained through other means, which are not limited here.

[0089] In one possible implementation, the distributed identity identifier of the initiating object needs to be generated before obtaining it. Since the distributed identity identifier is data that identifies an identity, it can be generated when the initiating object registers its account identity on the blockchain.

[0090] In one embodiment, an object identifier for the initiating object can be generated based on the resource management public key contained in the resource management key pair set by the initiating object; then, the identifier generation rule is invoked to generate a distributed identity identifier for the initiating object based on the object identifier.

[0091] Wherein, if the initiating object is the key owner, the resource management key pair set by the initiating object can be generated by the initiating object through interaction with the terminal device; if the initiating object is the terminal device, the resource management key pair set by the initiating object can be generated by the initiating object. The number of resource management key pairs set by the initiating object can be one or more, and is not limited here. A key pair includes a public key and a private key. The object identifier of the initiating object is used to uniquely identify the initiating object; the object identifier can be a string, an address, etc. The identifier generation rule can be based on the three parts required to form the DID identifier mentioned above.

[0092] Specifically, the DID Scheme and DID method name can be set through identifier generation rules, and then the object identifier of the initiating object can be used as a specific identifier to obtain the distributed identity identifier of the initiating object.

[0093] In one possible implementation, if verification fails, it indicates that the initiating object is not the object that owns the resource, but may be another object impersonating the resource's owner using improper means. Optionally, if verification fails, a verification failure message can be generated and sent to the initiating object to prompt it to re-authenticate.

[0094] Optionally, if verification fails, a risk alert can be generated for the initiating entity to alert administrators that the initiating entity may pose a risk. Furthermore, a risk alert can be generated only when the initiating entity's identity verification fails a preset number of times. This preset number can be manually set, set by the blockchain nodes in the aforementioned blockchain system, or set by a smart contract within the blockchain system; no limitation is made here.

[0095] S303. Call the identifier management contract to obtain the identifier document corresponding to the distributed identity identifier and obtain the replacement public key of the initiating object; the identifier document stores the resource management public key of the initiating object.

[0096] In this embodiment, the identifier management contract is a smart contract used to manage distributed identity identifiers and their identifier documents, which can be simply referred to as the DID management contract. A smart contract is a set of commitments defined in digital form, and the participants in the smart contract can execute these commitments on the blockchain. Specifically, a smart contract is a program that runs on the blockchain.

[0097] Specifically, distributed identity identifiers and identifier documents can be stored together in an identifier management contract. Therefore, by using the distributed identity identifier of an initiating object, its corresponding identifier document can be retrieved from the identifier management contract.

[0098] The Distinguished Identifier Document (DID Document) is a data structure that contains metadata and service information related to a DID, used to describe the DID subject. A DID Document typically includes the DID subject's public key, authentication method, and service terminal information to support secure decentralized authentication and communication.

[0099] In one embodiment, the identifier document may store the object's public key, and the object manages the corresponding private key. Each object may have multiple key pairs set. If each key pair is used as a resource management key pair, the object can access all its resources in the blockchain using any private key from its self-generated key pair.

[0100] Considering that if all key pairs generated by an object are used as resource management key pairs, the object would manage too many private keys capable of accessing resources, increasing the likelihood of private key leakage. Therefore, to simplify private key management and ensure resource security, the object can select a specified number of key pairs from its configured key pairs as resource management key pairs. Then, the public keys of these resource management key pairs, along with the public keys of other key pairs, are stored in an identifier document. The key pairs are set by the object, which only sends the public keys to the identifier document for storage; therefore, the private keys within these key pairs are managed by the object. The specified number can be manually set, set by the blockchain nodes in the aforementioned blockchain system, or set by the smart contract in the blockchain system; no limitation is made here.

[0101] In one embodiment, based on the foregoing specific description of the identifier document, the process of obtaining the replacement public key of the initiating object may specifically include: searching for other public keys corresponding to the initiating object, other than the resource management public key, in the identifier document; if other public keys are found in the identifier document, then using the other public keys as replacement public keys; if no key pair corresponding to the initiating object is found in the identifier document, then sending a public key acquisition request to the initiating object to obtain the replacement public key contained in the replacement key pair set by the initiating object.

[0102] The initiating object can respond to a public key retrieval request and set a new key pair as a replacement key pair. Specifically, the replacement key pair can be generated by the initiating object through the key generation program in the identifier management contract, or it can be generated by the initiating object through the management platform of the identifier management contract; this is not limited here. The replacement private key in the replacement key pair is managed by the initiating object.

[0103] At the same time, if other public keys corresponding to the initiating object are found in the identifier document, it means that there are other public keys that can be used in the identifier document. Therefore, the other public keys found can be used directly as replacement public keys.

[0104] In one embodiment, considering that the initiating object may have already set up a replacement key pair before initiating the key replacement request, the key replacement request is then generated based on the public key in the replacement key pair.

[0105] Therefore, the process of obtaining the replacement public key of the initiating object may specifically include: detecting the public key carried in the key replacement request; if the public key is detected from the key replacement request, the detected public key is used as the replacement public key; if the public key is not detected from the key replacement request, the replacement public key set by the initiating object is obtained.

[0106] In one embodiment, the initiating object may have lost only a portion of multiple resource management private keys, so the initiated key replacement request is for that portion of the resource management private keys. Therefore, the key replacement request can carry the number of lost resource management private keys, allowing the identifier management contract to be invoked subsequently to obtain a replacement public key from the initiating object that matches the number of lost private keys.

[0107] In one possible implementation, step S302 mentions that a distributed identity identifier can be generated when an object registers its blockchain account identity. Correspondingly, when an object registers its blockchain account identity, the distributed identity identifier and its identifier document can also be processed on the blockchain, that is, the distributed identity identifier and its identifier document can be deployed to the identifier management contract.

[0108] Therefore, an initiating entity can initiate an identity registration request for the blockchain through a device that interacts with the blockchain node. Upon receiving the identity registration request, the blockchain node can respond by obtaining the resource management public key contained in the resource management key pair set by the initiating entity; then, it generates an identifier document based on the resource management public key corresponding to the initiating entity; finally, it associates and stores the initiating entity's distributed identity identifier and the identifier document in the identifier management contract.

[0109] Optionally, the description of the identifier document mentioned above may include information such as the authentication method, in addition to the resource management public key corresponding to the initiating object.

[0110] Therefore, an identifier document can also be generated based on the resource management public key corresponding to the initiating object and the authentication policy of the initiating object. The authentication policy can be specifically set based on the authentication process mentioned in step S301, and will not be elaborated here. In a concrete implementation, the identifier management contract can execute the above steps to generate the identifier document.

[0111] Therefore, when authenticating the initiating object, the identifier document corresponding to the initiating object can be obtained, and the authentication policy of the initiating object can be obtained from the identifier document, so as to authenticate the initiating object through the authentication policy.

[0112] For specific implementation details, please refer to the appendix. Figure 4 This diagram illustrates the process of uploading an identifier document to the blockchain. The specific implementation process is as follows:

[0113] 1) Objects can generate key pairs (including resource management key pairs) through terminal devices and upload the key pairs to their own blockchain wallet 401. For example... Figure 4 As shown, the private key in the key pair can be stored in blockchain wallet 401; this is equivalent to the object itself keeping the private key for subsequent transaction signing, management of resources on the blockchain, etc., while the public key in the key pair (i.e., Figure 4 The public key corresponding to the private key will then be sent by the blockchain wallet 401 to the identifier management platform 402. Specifically, the identifier management platform 402 can be a third-party platform that manages distributed identity identifiers and identifier management contracts.

[0114] Before the public key in the key pair is sent to the identifier management platform 402, the object or blockchain wallet 401 can generate a distributed identity identifier for the object based on the public key in the key pair, and store the distributed identity identifier in the blockchain wallet 401. This distributed identity identifier will serve as the object's unique identity on the blockchain and can be used to associate the object with all resources and resource transaction records on the blockchain.

[0115] 2) The identifier management platform 402 generates an identifier document and registers it on the blockchain based on the received public key and the distributed identity identifier of the object corresponding to the public key.

[0116] Specifically, the identifier management platform 402 creates an identifier document for an object, containing information such as its public key and authentication policy. Then, it uploads the object's distributed identity identifier and the generated identifier document to the identifier management contract 403 deployed on the blockchain. In this way, the object's public key and identity information can be associated with its distributed identity identifier.

[0117] All resources subsequently stored on the blockchain by an object will be mapped to a distributed identity identifier, thus registering the object's resources within that identifier. Compared to traditional solutions that require managing one or more account addresses, this solution effectively utilizes account abstraction to abstract multiple account addresses into a single distributed identity identifier. Consequently, an object can manage only a single private key, which allows it to access and control all resources associated with that object's distributed identity identifier.

[0118] It should be noted that account abstraction is a method that abstracts digital assets and related operations from the underlying blockchain technology, allowing objects to manage and use their digital assets more simply and intuitively without having to worry about the differences in the underlying technology.

[0119] In practical implementation, relevant smart contracts can be deployed based on the aforementioned management logic for multiple public keys. A pseudocode example of a smart contract that associates a distributed identity identifier with multiple public keys is shown below:

[0120]

[0121]

[0122] S304. Update the resource management public key in the identifier document to the replacement public key.

[0123] In this embodiment of the application, referring to the replacement public key acquisition scheme mentioned in step S303, if the replacement public key is a new public key set by the initiating object, then the specific process of updating the resource management public key to the replacement public key may include: the original resource management public key in the identifier document can be replaced with the replacement public key.

[0124] In one embodiment, if the replacement public key is another public key stored in the identifier document, then the specific process of updating the resource management public key to the replacement public key may include: directly using the replacement public key as the resource management public key.

[0125] Optionally, the identifier document can set a management identifier for the resource management public key. Then, the specific process of updating the resource management public key to the replacement public key can include: deleting the association between the resource management public key and the management identifier, and establishing the association between the replacement public key and the management identifier.

[0126] Optionally, the key replacement request may be for a portion of the resource management private keys. Therefore, the specific process of updating the resource management public key in the identifier document to the replacement public key may include: finding the resource management public key corresponding to the resource management private key to be replaced in the identifier document; and updating the found resource management public key to the replacement public key.

[0127] Specifically, the resource management private key to be replaced may include a lost or leaked resource management private key. Optionally, the key replacement request may carry a key identifier of the resource management private key to be replaced, and then the resource management public key corresponding to the resource management private key to be replaced can be found by searching for a resource management public key that matches the key identifier.

[0128] For practical applications, please refer to the appendix. Figure 5 This illustrates a schematic diagram of a key replacement process. For example... Figure 5 As shown in steps 501 to 503, object M that has lost its private key (i.e., the resource management private key) can generate a new key pair (i.e., a replacement key pair). Optionally, object M can manage the new private key (i.e., the replacement private key) in the key pair itself and generate a key replacement request based on the new public key (i.e., the replacement public key) in the key pair, or generate a key replacement request based on the new public key in the key pair. Afterwards, object M sends the key replacement request to the identity management object P so that the identity management object P can authenticate object M.

[0129] As shown in steps 503 to 504, if the verification is successful, the identity management object P can send a document change request to the identifier management contract. The document change request may include the new public key from the newly generated key pair.

[0130] In response to a document change request, the identifier management contract can obtain the identifier document associated with the distributed identity identifier of object M, and update the resource management public key stored in the identifier document with the new public key carried in the document change request.

[0131] In one possible implementation, to prevent impersonation of the identity management object from updating the identifier document and thus affecting resource security, a multi-signature scheme can be used to update the identifier document.

[0132] Specifically, a multi-signature associated object list can be created for each object's distributed identity identifier. A target number of objects in this list are required to sign the document change request corresponding to that object with their private keys before responding to the document change request and updating the identifier document for that object. In this way, even if an object loses its private key, it can still reset the identifier document's public key by signing it with the private keys of other objects it designates, without going through the identity management object, thereby obtaining a replacement private key and regaining its management rights over the resource.

[0133] In this embodiment, by associating resources with distributed identity identifiers, unified management of resources and identities at the blockchain level is achieved. Compared to the traditional approach where an object needs to manage one or more account addresses, the object in this embodiment can control its resources stored on the blockchain through distributed identity identifiers, which is beneficial to improving resource management efficiency. At the same time, since distributed identity identifiers are unique, in this embodiment, all resources associated with the distributed identity identifier can be accessed and controlled by managing only one private key. Compared to the traditional approach where an object needs multiple private keys corresponding to multiple account addresses to manage all its resources in the blockchain, this embodiment simplifies private key management and improves the user experience.

[0134] Meanwhile, this application embodiment stores the public key for resource management in the identifier document corresponding to the distributed identity identifier. This allows for updating the private key required to access the resources associated with the distributed identity identifier at the technical level by updating the resource management public key in the identifier document. In this way, an object can obtain a replacement private key for a lost or leaked private key by updating the resource management public key, thereby regaining the ability to manage resources in the blockchain. This effectively reduces the risk of resource loss due to lost or leaked private keys and improves the security of resources on the blockchain.

[0135] Furthermore, by authenticating the initiator of the key replacement request, this embodiment of the application can effectively prevent other objects from impersonating the resource owner and improperly operating the resources stored in the blockchain by obtaining the replacement key, thereby further improving the security of resources on the blockchain.

[0136] In one embodiment of this application, another blockchain-based data processing method is provided, which can be applied to... Figure 1 The blockchain system illustrated can be executed by blockchain nodes, by smart contracts deployed within the blockchain system, or by both blockchain nodes and smart contracts. In this embodiment, the method is illustrated using the execution of the method by blockchain nodes as an example. Figure 6 The diagram illustrates a flowchart of another blockchain-based data processing method. Figure 3 The method shown is an extension of the one presented.

[0137] The details of S601 to S607 are as follows:

[0138] S601. In response to a key replacement request, authenticate the object that initiated the key replacement request.

[0139] In the embodiments of this application, the specific implementation of step S601 can be found in the specific implementation of step S301, and will not be repeated here.

[0140] S602. If the verification is successful, obtain the distributed identity identifier of the initiating object; wherein, the resources stored by the initiating object in the blockchain are associated with the distributed identity identifier.

[0141] In the embodiments of this application, the specific implementation of step S602 can be found in the specific implementation of step S302, and will not be repeated here.

[0142] S603. Call the identifier management contract to obtain the identifier document corresponding to the distributed identity identifier and obtain the replacement public key of the initiating object; the identifier document stores the resource management public key of the initiating object.

[0143] In the embodiments of this application, the specific implementation of step S603 can be found in the specific implementation of step S303, and will not be repeated here.

[0144] S604. Update the resource management public key in the identifier document to the replacement public key.

[0145] In the embodiments of this application, the specific implementation of step S604 can be found in the specific implementation of step S304, and will not be repeated here.

[0146] S605. Receive a resource transaction initiated by the initiating object using the replacement private key corresponding to the replacement public key; the resource transaction contains a private key signature generated based on the replacement private key.

[0147] In this embodiment of the application, the process of initiating a resource transaction may include: obtaining the distributed identity identifier of the resource receiving object triggered by the initiating object, and the quantity of transaction resources to be transferred to the resource receiving object; then, generating an initial transaction based on the distributed identity identifier of the resource receiving object and the quantity of transaction resources; and finally, using a replacement private key to sign the initial transaction to obtain the resource transaction.

[0148] S606. Call the identifier management contract, obtain the replacement public key from the identifier document, and verify the signature of the private key contained in the resource transaction using the replacement public key.

[0149] In this embodiment of the application, since the identifier document stores the replacement public key, the identifier management contract can be invoked to obtain the replacement public key from the identifier document.

[0150] In one possible implementation, since the aforementioned identifier document may store multiple public keys, but the resource transaction may only have a single private key for signing, it is necessary to determine from the multiple public keys a replacement public key corresponding to the replacement private key used for transaction signing.

[0151] In one embodiment, since step S304 mentions that the replacement public key can be associated with the management identifier, the identifier management contract can be invoked to obtain the public key associated with the management identifier from the identifier document, which is the replacement public key.

[0152] In another embodiment, objects may use different private keys to initiate different types of transactions. Therefore, the public key used for resource management in the identifier document may also be associated with a type identifier. Thus, based on the business type of the current resource transaction, a public key matching the type identifier can be obtained from the identifier document for subsequent signature verification.

[0153] In one embodiment, the signature verification process may include: using a replacement public key to decrypt the private key signature carried in the resource transaction, obtaining decrypted data; using a preset hash algorithm to process the resource transaction, obtaining a hash value; if the decrypted data matches the hash value, the private key signature is valid and the resource transaction has not been tampered with, i.e., verification passes; if the decrypted data does not match the hash value, the private key signature is invalid and the resource transaction may have been tampered with, i.e., verification fails. The preset hash algorithm is the same as the hash algorithm used by the replacement private key during signature processing.

[0154] S607. If the verification passes, the resource transaction will be executed.

[0155] In this embodiment of the application, since the resources are associated with distributed identity identifiers, the specific process of executing a resource transaction may include: obtaining the number of transaction resources contained in the resource transaction and the distributed identity identifier of the resource receiving object; then, obtaining the target resource of the transaction resource quantity from the resources associated with the distributed identity identifier of the initiating object; and finally, associating the target resource with the distributed identity identifier of the resource receiving object.

[0156] In practical implementation, based on the aforementioned resource transfer logic, relevant smart contracts for resource transfer can be deployed to achieve automatic resource transfer on the blockchain. In real-world applications, this smart contract can query the distributed identity identifier of the transaction initiator using the public key corresponding to the resource transaction, thereby changing the resource quantity corresponding to the distributed identity identifier of the transaction initiator, as well as the resource quantity corresponding to the distributed identity identifier of the resource recipient carried in the resource transaction.

[0157] Taking the Transfer function in a smart contract as an example, the pseudocode after adding the logic for transferring resources within the blockchain is as follows:

[0158]

[0159]

[0160] In this embodiment, the object that retrieves and replaces its private key can continue resource management, such as initiating resource transactions. Furthermore, when initiating a transaction, the object only needs to input the distributed identity identifier of the resource recipient. Compared to the difficult-to-remember account addresses in traditional solutions, distributed identity identifiers are readable and easy to remember. Therefore, in this embodiment, the object can more easily identify and remember its own or others' account information through distributed identity identifiers, which improves the user experience. Simultaneously, the readability of distributed identity identifiers helps avoid the risk of resource loss due to incorrect address input during resource transfers and transactions, further enhancing the security of resources on the blockchain.

[0161] This application describes an apparatus embodiment that can be used to execute the blockchain-based data processing method described in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the blockchain-based data processing method described above.

[0162] This application provides a blockchain-based data processing device, such as... Figure 7 As shown, the device includes a verification unit 701, an identifier acquisition unit 702, a contract invocation unit 703, and an update unit 704, wherein:

[0163] Verification unit 701 is used to authenticate the object that initiated the key replacement request in response to the key replacement request;

[0164] The identifier acquisition unit 702 is used to acquire the distributed identity identifier of the initiating object if the verification is successful; wherein, the resources of the initiating object stored in the blockchain are associated with the distributed identity identifier;

[0165] Contract invocation unit 703 is used to obtain the identifier document corresponding to the distributed identity identifier and to obtain the replacement public key of the initiating object; the identifier document stores the resource management of the initiating object;

[0166] Update unit 704 is used to update the resource management public key in the identifier document to a replacement public key.

[0167] In one embodiment of this application, based on the aforementioned scheme, when the contract invocation unit 703 obtains the replacement public key of the initiating object, it can specifically be used to: search for other public keys corresponding to the initiating object, other than the resource management public key, from the identifier document; if other public keys are found from the identifier document, then the other public keys are used as replacement public keys; if no key pair corresponding to the initiating object is found from the identifier document, then a public key acquisition request is sent to the initiating object to obtain the replacement public key contained in the replacement key pair set by the initiating object.

[0168] In one embodiment of this application, based on the aforementioned scheme, when the contract invocation unit 703 obtains the replacement public key of the initiating object, it can specifically be used to: detect the public key carried in the key replacement request; if the public key is detected from the key replacement request, the detected public key is used as the replacement public key; if the public key is not detected from the key replacement request, the replacement public key set by the initiating object is obtained.

[0169] In one embodiment of this application, based on the foregoing scheme, before the verification unit 701 verifies the identity of the initiating object of the key replacement request in response to the key replacement request, it may further be used to: obtain the resource management public key contained in the resource management key pair set by the initiating object in response to the identity registration request of the initiating object; generate an identifier document based on the key pair corresponding to the initiating object; and associate and store the distributed identity identifier of the initiating object and the identifier document in the identifier management contract.

[0170] In one embodiment of this application, based on the foregoing scheme, the verification unit 701 can also be used to: generate an object identifier for the initiating object according to the resource management public key corresponding to the initiating object; and call the identifier generation rule to generate a distributed identity identifier for the initiating object based on the object identifier.

[0171] In one embodiment of this application, based on the aforementioned scheme, when the verification unit 701 generates an identifier document based on the resource management public key corresponding to the initiating object, it can also be used to: generate an identifier document based on the resource management public key corresponding to the initiating object and the authentication policy of the initiating object; then, when the verification unit authenticates the initiating object of the key replacement request, it can be used to: obtain the identifier document corresponding to the initiating object, and obtain the authentication policy of the initiating object from the identifier document; and authenticate the initiating object through the authentication policy.

[0172] In one embodiment of this application, based on the foregoing scheme, the device further includes a receiving unit 705, which is used to receive a resource transaction initiated by an initiating object through a replacement private key corresponding to a replacement public key; the resource transaction includes a private key signature generated based on the replacement private key; the contract invocation unit can also be used to invoke an identifier management contract, obtain the replacement public key from the identifier document, and verify the signature of the private key signature contained in the resource transaction through the replacement public key; if the verification is successful, the resource transaction is executed.

[0173] In one embodiment of this application, based on the aforementioned scheme, when executing a resource transaction, the contract invocation unit 703 can specifically be used to obtain the number of transaction resources contained in the resource transaction and the distributed identity identifier of the resource receiving object; obtain the target resource of the transaction resource quantity from the resources associated with the distributed identity identifier of the initiating object; and associate the target resource with the distributed identity identifier of the resource receiving object.

[0174] In one embodiment of this application, based on the aforementioned scheme, when the verification unit 701 verifies the identity of the initiator of the key replacement request, it can specifically be used to send the same verification information to multiple social objects of the initiator; receive the response results for the verification information; and if the number of response results matching the preset result reaches the preset number, then the verification is determined to be successful.

[0175] In one embodiment of this application, based on the aforementioned scheme, when the verification unit 701 authenticates the initiating object of the key replacement request, it can specifically obtain the identity verification information of the initiating object and send the identity verification information to the identity management object so that the identity management object can verify the identity verification information and obtain the authentication result; receive the authentication result sent by the identity management object; if the received authentication result indicates that the verification is successful, then the verification is confirmed to be successful.

[0176] It should be noted that the apparatus provided in the above embodiments and the method provided in the above embodiments belong to the same concept, and the specific way in which each module and unit performs operations has been described in detail in the method embodiments, and will not be repeated here.

[0177] The apparatus provided in the above embodiments can be located within a terminal device or a server. By associating resources with distributed identity identifiers, the apparatus provided in this application achieves unified management of resources and identities. The association between resources and distributed identity identifiers also allows for the technical updating of the private key required to access resources associated with the distributed identity identifier by updating the resource management public key in the identifier document corresponding to the distributed identity identifier. Thus, an object can obtain a replacement key for a lost or leaked private key by updating the resource management public key, thereby regaining its ability to manage resources in the blockchain. This effectively reduces the risk of resource loss due to lost or leaked private keys, and improves the security of resources on the blockchain.

[0178] Embodiments of this application also provide an electronic device, including one or more processors and a storage device, wherein the storage device is used to store one or more computer programs, which, when executed by one or more processors, cause the electronic device to implement the blockchain-based data processing method described above.

[0179] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0180] It should be noted that, Figure 8 The computer system 800 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0181] like Figure 8 As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on a program stored in read-only memory (ROM) 802 or a program loaded from storage portion 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0182] In some embodiments, the following components are connected to the I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0183] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by processor (CPU) 801, it performs various functions defined in the system of this application.

[0184] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory, flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0185] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and a computer program.

[0186] The units or modules described in the embodiments of this application can be implemented in software or hardware, and can also be located in a processor. The names of these units or modules do not necessarily limit the specific unit or module itself.

[0187] Another aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned blockchain-based data processing method. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not incorporated into the electronic device.

[0188] Another aspect of this application provides a computer program product comprising a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the blockchain-based data processing method described above in the various embodiments.

[0189] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0190] Other embodiments of this application will readily conceive of by considering the specification and practicing the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0191] The above content is merely a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application. Therefore, the scope of protection of this application should be determined by the scope of protection claimed in the claims.

Claims

1. A data processing method based on blockchain, characterized in that, include: In response to a key replacement request, the object that initiated the key replacement request is authenticated; If the verification is successful, the distributed identity identifier of the initiating object is obtained; wherein, the resources of the initiating object stored in the blockchain are associated with the distributed identity identifier; Invoke the identifier management contract to obtain the identifier document corresponding to the distributed identity identifier, and obtain the replacement public key of the initiating object; the identifier document stores the resource management public key of the initiating object; Update the resource management public key in the identifier document to the replacement public key.

2. The method according to claim 1, characterized in that, Obtaining the replacement public key of the initiating object includes: Find the public key other than the resource management public key corresponding to the initiating object from the identifier document; If another public key is found in the identifier document, then that other public key is used as the replacement public key; If the key pair corresponding to the initiating object is not found in the identifier document, a public key retrieval request is sent to the initiating object to obtain the replacement public key contained in the replacement key pair set by the initiating object.

3. The method according to claim 1, characterized in that, Obtaining the replacement public key of the initiating object includes: Detect the public key carried in the key replacement request; If a public key is detected from the key replacement request, the detected public key is used as the replacement public key; If no public key is detected from the key replacement request, then the replacement public key set by the initiating object is obtained.

4. The method according to claim 1, characterized in that, Before authenticating the object initiating the key replacement request in response to the key replacement request, the method further includes: In response to the identity registration request of the initiating object, obtain the resource management public key contained in the resource management key pair set by the initiating object; Generate an identifier document based on the resource management public key corresponding to the initiating object; The distributed identity identifier of the initiating object, along with the identifier document, is stored in the identifier management contract.

5. The method according to claim 4, characterized in that, The method further includes: Based on the resource management public key corresponding to the initiating object, an object identifier for the initiating object is generated; Invoke the identifier generation rules to generate a distributed identity identifier for the initiating object based on the object identifier.

6. The method according to claim 4, characterized in that, The step of generating an identifier document based on the resource management public key corresponding to the initiating object includes: Based on the resource management public key corresponding to the initiating object and the authentication policy of the initiating object, an identifier document is generated; The authentication of the object initiating the key replacement request includes: Obtain the identifier document corresponding to the initiating object, and obtain the authentication policy of the initiating object from the identifier document; The initiating object is authenticated using the authentication policy.

7. The method according to claim 1, characterized in that, After updating the resource management public key in the identifier document to the replacement public key, the method further includes: Receive resource transactions initiated by the initiating object using the replacement private key corresponding to the replacement public key; the resource transaction includes a private key signature generated based on the replacement private key; The identifier management contract is invoked to obtain the replacement public key from the identifier document, and the replacement public key is used to verify the signature of the private key contained in the resource transaction. If the verification passes, the resource transaction will be executed.

8. The method according to claim 7, characterized in that, The execution of the resource transaction includes: Obtain the quantity of transaction resources contained in the resource transaction, and the distributed identity identifier of the resource receiving object; Obtain the target number of transaction resources from the resources associated with the distributed identity identifier of the initiating object; Associate the target resource with the distributed identity identifier of the resource receiving object.

9. The method according to any one of claims 1 to 8, characterized in that, The authentication of the object initiating the key replacement request includes: Send the same verification information to multiple target objects associated with the initiating object; Receive a response to the verification information; If the number of responses matching the preset result reaches the preset number, the verification is considered successful.

10. The method according to any one of claims 1 to 8, characterized in that, The authentication of the object initiating the key replacement request includes: Obtain the identity verification information of the initiating object and send the identity verification information to the identity management object so that the identity management object can verify the identity verification information and obtain the identity verification result; Receive the authentication result sent by the identity management object; If the received authentication result indicates that the authentication has passed, then the authentication is considered successful.

11. A data processing device based on blockchain, characterized in that, The device includes a verification unit, an identifier acquisition unit, a contract invocation unit, and an update unit, wherein: The verification unit is used to authenticate the object that initiated the key replacement request in response to the key replacement request; The identifier acquisition unit is used to acquire the distributed identity identifier of the initiating object if the verification is successful; wherein the resources of the initiating object stored in the blockchain are associated with the distributed identity identifier; The contract invocation unit is used to invoke the identifier management contract, obtain the identifier document corresponding to the distributed identity identifier, and obtain the replacement public key of the initiating object; the identifier document stores the resource management public key of the initiating object; The update unit is used to update the resource management public key in the identifier document to the replacement public key.

12. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the blockchain-based data processing method as described in any one of claims 1 to 10.

13. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the blockchain-based data processing method as described in any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product includes a computer program adapted to be loaded by a processor and executed as described in any one of claims 1 to 10.

Images