CN115955362B

CN115955362B - Block chain-based data storage and communication method, device, equipment and medium

Info

Publication number: CN115955362B
Application number: CN202310222462.7A
Authority: CN
Inventors: 荆博
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2023-03-09
Filing date: 2023-03-09
Publication date: 2023-06-09
Anticipated expiration: 2043-03-09
Also published as: CN115955362A

Abstract

The present disclosure provides methods, apparatus, devices, and media for blockchain-based data storage and communication, and relates to the field of computer technology, in particular to blockchain technology. The specific implementation scheme is as follows: generating a DID document of the communication node according to the blockchain address of the communication node supervised by the self and the communication key of the communication node; the communication key is used for establishing secure communication connection with other communication nodes; determining a document content identifier of the DID document; performing decentralization storage on the DID document, and obtaining a document position identification of the DID document; and storing the corresponding relation among the document content identification, the document position identification and the blockchain address of the communication node in an intelligent contract of the blockchain network for searching and verifying the DID document. In accordance with the techniques of this disclosure, security of communications between communication nodes is provided.

Description

Block chain-based data storage and communication method, device, equipment and medium

Technical Field

The present disclosure relates to the field of computer technology, and in particular, to blockchain technology, which may be used in an authentication scenario.

Background

The multiparty collaborative calculation can realize the collaborative use of data of different parties, and improve the availability of the data, thereby enhancing the use value of the data. When multiparty collaborative calculation is performed, any party has malicious nodes or communication among the nodes is unsafe, and risks of data leakage or unreliable calculation results exist.

Disclosure of Invention

The present disclosure provides a blockchain-based data storage and communication method, apparatus, device and medium.

According to an aspect of the present disclosure, there is provided a blockchain-based data storage method applied to an identity authority, including:

generating a decentralised identity DID document of the communication node according to the blockchain address of the communication node supervised by the communication node and the communication key of the communication node; the communication key is used for establishing secure communication connection with other communication nodes;

determining a document content identifier of the DID document;

performing decentralization storage on the DID document, and obtaining a document position identification of the DID document;

and storing the corresponding relation among the document content identification, the document position identification and the blockchain address of the communication node in an intelligent contract of the blockchain network for searching and verifying the DID document.

According to another aspect of the present disclosure, there is also provided a blockchain-based communication method, applied to a communication node, including:

acquiring a blockchain address of a node to be accessed and a corresponding document content identifier;

determining the identity correspondence of the nodes to be accessed in the intelligent contract of the blockchain network according to the blockchain addresses of the nodes to be accessed; the identity corresponding relation of the node to be accessed is generated based on any block chain-based data storage method provided by the embodiment of the disclosure;

Searching and verifying the decentralized identity DID document of the node to be accessed according to the document content identification of the node to be accessed and the corresponding identity correspondence;

if the authentication is passed, establishing a secure communication connection with the node to be accessed according to the communication key in the DID document of the node to be accessed.

According to another aspect of the present disclosure, there is also provided an electronic apparatus including:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform any one of the blockchain-based data storage methods provided by the embodiments of the present disclosure and/or to perform any one of the blockchain-based communication methods provided by the embodiments of the present disclosure.

According to another aspect of the present disclosure, there is also provided a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform any of the blockchain-based data storage methods provided in accordance with the embodiments of the present disclosure and/or to perform any of the blockchain-based communication methods provided in the embodiments of the present disclosure.

According to the technology disclosed by the invention, the safety of communication between communication nodes is improved.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the disclosure, nor is it intended to be used to limit the scope of the disclosure. Other features of the present disclosure will become apparent from the following specification.

Drawings

The drawings are for a better understanding of the present solution and are not to be construed as limiting the present disclosure. Wherein:

FIG. 1A is a block diagram of a data processing system provided by an embodiment of the present disclosure;

FIG. 1B is a flow chart of a blockchain-based data storage method provided by embodiments of the present disclosure;

FIG. 1C is a schematic diagram of a DID document provided by an embodiment of the disclosure;

FIG. 2 is a flow chart of a blockchain-based communication method provided by embodiments of the present disclosure;

FIG. 3A is a flow chart of a DID identity granting method for a computing node in a multiparty collaborative computing network provided by an embodiment of the present disclosure;

fig. 3B is a flowchart of a DID identity revocation method of a computing node in a multiparty collaborative computing network provided in an embodiment of the present disclosure;

FIG. 3C is a flow chart of a method for establishing a trusted connection between computing nodes in a multi-party collaborative computing network provided by an embodiment of the present disclosure;

FIG. 4 is a block chain based data storage device according to an embodiment of the present disclosure;

FIG. 5 is a block chain based communication device according to an embodiment of the present disclosure;

FIG. 6 is a block diagram of an electronic device used to implement a blockchain-based data storage method and/or a blockchain-based communication method of embodiments of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, which include various details of the embodiments of the present disclosure to facilitate understanding, and should be considered as merely exemplary. Accordingly, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

For ease of understanding, a brief description of the data processing system to which the present disclosure relates will first be provided. Referring to the data processing system shown in FIG. 1A, there is shown a data processing system including an identity authority 10 and a communication node 20, a de-centralized storage system 30, and a blockchain network 40. Wherein the identity authority 10 is in communication connection with the communication node 20; both the identity authority 10 and the communication node 20 are communicatively coupled to the de-centralized storage system 30 and the blockchain network 40.

The identity authorizer 10 is configured to grant a decentralized identity, i.e., a decentralized identity (Decentralized Identification, DID) document to the supervised communication node 20, and store the DID document in the decentralized storage system 30. Wherein the number of identity authorizers 10 is at least one; an identity authority 10 may supervise at least one communication node 20. For ease of administration, one communication node 20 may correspond to only one identity authority 10.

Communication node 20 participates in distributed computing of the computing network as a member node of the computing network constructed in accordance with a convention. Mutual authentication can be performed between different communication nodes 20 through decentralizing identities, so that identity communication between the nodes is realized, and the security of distributed computation is improved.

The decentralizing storage system 30 is used as storage locations of the DID documents of different communication nodes 20, so as to realize decentralizing storage of the DID documents, improve reliability of granted identities, and provide DID document query service for each communication node.

The blockchain network 40 is used for storing the corresponding relation between different communication nodes 20 and corresponding DID documents, so that each communication node can conveniently search the DID documents of other communication nodes from the decentralised storage system 30 for verification through the corresponding relation.

Based on the data processing system shown in fig. 1A, an embodiment of the present disclosure provides a blockchain-based data storage method, which is suitable for an application scenario of distributing a decentralized identity to a communication node, where the method may be performed by a data storage device, and the device may be implemented by software and/or hardware, and specifically configured in an electronic device, where the electronic device may be deployed on an identity authorizer.

Referring to fig. 1B, the blockchain-based data storage method is applied to an identity authorizer, and includes:

s101, generating a decentralised identity DID document of the communication node according to the blockchain address of the communication node supervised by the self and the communication key of the communication node.

Wherein the communication nodes may be member nodes of a computing network constructed according to a convention for performing unified distributed computing. In a specific embodiment, the computing network may be a multiparty collaborative computing network, and the communication node may be a computing node in the multiparty collaborative computing network, accordingly, adapted to a multiparty collaborative computing scenario. Alternatively, the multiparty collaborative computing network may be used to perform at least one of multiparty data collaboration, decentralised machine learning, and the like.

The identity authority has a supervision relation with the communication node, and can grant or further withdraw identity information for the communication node through the identity authority. The blockchain address of the communication node may be declared on the blockchain network by the communication node, and the specific manner in which the blockchain address is declared by the present disclosure is not limited in any way. The communication key may be a symmetric key or an asymmetric key for establishing a secure communication connection with other communication nodes to improve the security of the communication between the nodes. In a specific implementation manner, the communication key is a communication public key in the asymmetric key, so as to improve the communication connection establishment efficiency.

Among these, the decentralised identity (Decentralized Identification, DID) can be understood as a digital identity implemented based on blockchain technology that enables users to own and govern themselves. The DID document refers to a description document of the DID for recording at least one identity attribute of the DID. Alternatively, referring to the schematic structure of the DID document shown in fig. 1C, the DID document may include at least one of a DID identification, version information, creation time, blockchain address, authentication mode, communication attribute, and the like. The DID identifier is used for uniquely representing the content of the DID document, and can be a digital abstract for example; version information for distinguishing versions of different DID documents; creation time for characterizing generation time of the DID document; the blockchain address is used for representing the account identity of the object (namely the communication node) granted by the identity authority in the blockchain network; the verification mode is used for limiting a verification mechanism of the DID document; the communication attribute, which may include a communication key, is used as a basis for establishing a communication connection with other communication nodes.

The verification manner may be set or adjusted by a technician according to needs or experience, and the specific verification manner is not limited in this disclosure. For example, the verification method may be to verify the signature of the DID document based on ECDSA (Elliptic Curve Digital Signature Algorithm ).

Notably, the update time field in the DID document in the prior art is removed from the DID document in the present disclosure, so as to ensure the non-modifiable property of the generated DID document, avoid affecting the accuracy of the DID due to the trade modification of the DID document, further affect the subsequent communication security, and improve the convenience of managing the DID document.

Referring further to fig. 1C, optionally, other attributes may be added to the DID document as an attribute extension interface of the DID document, so as to facilitate attribute extension of the DID document. By way of example, other attributes may include a declaration attribute for making additional notes to the present DID document, a previously generated DID document, or a DID document specified by a preset field by way of adding a preset declaration field. For example, the preset declaration field may be a revocation field, in which revocation declaration information is added for characterizing revocation of an authorized identity for the present DID document, the previously generated DID document, or the DID document specified by the preset field, thereby indicating that the corresponding DID document is invalid. In a specific example, a revocation field may be added in the DID document to declare that the authorized identity of the latest DID document generated in advance is revoked, so that the method of directly modifying the DID document itself is replaced by a method of newly adding the DID document, so that the granted identity is effectively revoked, the non-modifiable property of the DID document is ensured, and meanwhile, the identity revocation capability is reserved, so that timely revocation of the granted identity to the expired DID is facilitated, and the security of the DID is further improved.

S102, determining the document content identification of the DID document.

In an alternative embodiment, a preset encoding mode may be used to encode the DID document to obtain a document content identifier that uniquely characterizes the content of the DID document. The preset encoding mode can be set or adjusted by a technician according to needs or experience, and the specific encoding mode adopted for generating the document content identifier is not limited in the disclosure.

S103, performing decentralization storage on the DID document, and obtaining a document position identification of the DID document.

The decentralised storage is a storage mode for storing files or file sets in fragments on disk space provided by different providers through a distributed storage technology. By performing the decentralization storage of the DID document, the reliability of the DID document can be ensured. The document storage identification of the DID document can represent the storage address of the DID document in the decentralised storage system, so that the DID document can be conveniently accessed.

S104, storing the corresponding relation of the document content identification, the document position identification and the blockchain address of the communication node in an intelligent contract of the blockchain network for searching and verifying the DID document.

Because the intelligent contracts of the blockchain network adopt a key value pair mode to store data, the identity corresponding relation is stored in the intelligent contracts, so that the searching and the positioning of different information in the identity corresponding relation are facilitated. Meanwhile, based on the openness and traceability of the blockchain network, the identity corresponding relation of different communication nodes can be shared conveniently through the blockchain network, and then the DID document is searched from the decentralised storage system through the document position identification in the identity corresponding relation, and the searched DID document is verified based on the document content identification in the identity corresponding relation.

According to the embodiment of the disclosure, the DID document of the communication node is subjected to decentralization storage, and the identity corresponding relation of the communication node is stored in the blockchain network, so that the DID document is conveniently searched and verified in an associated mode, and the non-tamper property, durability and reliability of the DID document are improved; the identity association information is stored in the intelligent contract of the blockchain network, so that the searching convenience is improved; the security of the communication key is ensured by carrying the communication key used for establishing the secure communication connection with other communication nodes in the DID document, and the reliability of the communication key is enhanced by the DID document, so that the security and the reliability of the communication between the nodes are ensured.

On the basis of the technical schemes, the authorization identity category of the identity authorizer can be stored in the blockchain network and used for generating party identity verification on the DID document.

The authorization identity category can be realized by marking a preset identifier, or an authorization party list comprising different identity authorization parties is generated, and the non-identity authorization parties are distinguished. The specific content of the preset identifier is not limited in this disclosure.

By way of example, the DID document generally carries signature information of a generator of the DID document, and validity of the DID document is ensured by checking the DID document. However, not all nodes have the decentralized identity grant authority, that is, not all nodes have the DID document generation authority, so that an identity authority with the decentralized identity grant authority can also declare the own blockchain address in the blockchain network and mark the own authorized identity category, and the identity authority is distinguished from other blockchain addresses in the blockchain network.

Based on the technical schemes, a storage and maintenance zero knowledge proof consensus mechanism can be established in an intelligent contract of the blockchain network and used for guaranteeing the availability of DID documents. It should be noted that, here, the intelligent contracts may be the same intelligent contract or different intelligent contracts, so that for convenience in maintenance, two intelligent contracts with different functions are generally set independently to store the corresponding relationship of the identity and store the zero knowledge proof consensus mechanism.

The above, the storage process of the identity correspondence relationship between the DID document and its corresponding communication node is described in detail using the identity authority as the execution body. The following describes a technical scheme of performing inter-node communication based on the stored data, using the communication node as an execution subject.

Referring to fig. 2, the blockchain-based communication method is applied to a communication node, and includes:

s201, obtaining the blockchain address of the node to be accessed and the corresponding document content identification.

The node to be accessed is any communication node needing to be accessed.

For example, the corresponding blockchain address and the document content identifier can be directly acquired from the node to be accessed for subsequent communication; or, the blockchain address of the node to be accessed and the corresponding document content identifier are obtained in advance and stored in a storage device in communication connection with the node to be accessed, and when the node to be accessed needs to be communicated with, the blockchain address of the node to be accessed and the document content identifier are searched and obtained from the corresponding storage device.

The method comprises the steps that a blockchain address of a node to be accessed is used for representing the account identity of the node to be accessed in a blockchain network, so that relevant information of the node to be accessed is searched and positioned in the blockchain network through the blockchain address; and the document content identifier of the node to be accessed is used for acquiring data outside the chain and verifying the DID document acquired based on the blockchain network.

S202, according to the blockchain address of the node to be accessed, determining the identity corresponding relation of the node to be accessed in the intelligent contract of the blockchain network.

The identity corresponding relation of the nodes to be accessed is generated based on the blockchain-based data storage method provided by any embodiment of the disclosure.

Specifically, in the intelligent contract of the blockchain network, the identity corresponding relation carrying the blockchain address of the node to be accessed is searched and used as the basis for subsequent searching and verification of the node to be accessed.

S203, searching and verifying the DID document of the node to be accessed according to the document content identification of the node to be accessed and the corresponding identity correspondence.

Illustratively, according to the document storage identification in the identity correspondence of the node to be accessed, searching the DID document of the node to be accessed from the decentralization system; and verifying the found DID document according to the document content identification and/or the identity correspondence of the node to be accessed.

In an alternative embodiment, a document content identifier corresponding to the DID document of the node to be accessed may be generated, and the generated result is used as a reference identifier; and according to the reference identifier and the acquired document content identifier of the node to be accessed, performing content verification on the DID document of the node to be accessed. Specifically, if the reference identifier is the same as the acquired document content identifier of the node to be accessed, determining that the document content of the DID document of the node to be accessed is correct, namely that the content verification is passed; otherwise, determining that the document content of the DID document of the node to be accessed is wrong, namely that the content verification is not passed.

It can be understood that by verifying the document content of the DID document, the occurrence of the situation that the acquired DID document is wrong is avoided, so that the integrity and the accuracy of the acquired DID document are improved, the accuracy and the reliability of a communication key carried in the DID document are further ensured, and the guarantee is provided for establishing secure communication connection with the node to be accessed subsequently.

In another alternative embodiment, signature verification may be performed on the obtained DID document based on a verification manner in the DID document, so as to ensure validity of the signature carried in the DID document.

Because not all nodes have the decentralized identity grant authority, that is, not all nodes have the DID document generation authority, the identity of the generator of the DID document can be verified, so that the legality of the DID document is ensured. In yet another alternative embodiment, the generator of the DID document of the node to be accessed may also be obtained; and carrying out identity verification on the generator according to the authorized identity category of the generator in the blockchain network.

Illustratively, in a blockchain network, determining an authorized identity class of a producer based on a blockchain address of the producer; if the generating party has the authorized identity category (for example, the corresponding blockchain address is marked with a preset identifier when being declared, or the corresponding blockchain address is stored in an authorized party list, etc.), the generating party indicates that the generating party of the DID document of the node to be accessed belongs to the identity authorizing party with the decentralised identity granting authority, namely, the identity verification of the generating party is passed.

It can be understood that by performing identity verification on the obtained generator of the DID document of the node to be accessed, the generator of the DID document is ensured to be an identity authority with the authority of decentralizing identity grant, thereby ensuring the legitimacy of the DID document and further providing guarantee for the legitimacy and reliability of the communication key carried in the DID document.

Because the identity authorizer may generate at least one DID document for the node to be accessed, for example, an identity grant DID document for granting an identity to a certain decentralized identity to the node to be accessed, and an identity revocation DID document for revoking the granted identity, different identity correspondences corresponding to different DID documents are stored in the smart contract, the number of identity correspondences stored in the node to be accessed in the smart contract is also at least one.

When at least two identity corresponding relations are stored in the intelligent contract, the identity corresponding relation with the latest time in the at least two identity corresponding relations can be used as a target identity corresponding relation; and searching and verifying the DID document of the node to be accessed according to the corresponding relation of the target identity and the document content identification of the node to be accessed.

It can be understood that by using the latest identity correspondence of the node to be accessed in the intelligent contract as the target identity correspondence, the DID document of the node to be accessed is searched and verified, so that timeliness of the searched DID document is ensured, the situation that the security communication connection cannot be established with the node to be accessed based on the fact that the expired DID document is acquired is avoided, and effectiveness and security of the communication between the nodes are improved.

Further, besides performing content verification, signature verification and validity verification on the DID document in the mode, the DID document to be accessed can be subjected to time-effect verification according to the document content identification in the corresponding relation of the target identity and the document content identification of the node to be accessed, so that the validity of the DID document is ensured, the richness and diversity of the verification process of the DID document are improved, the reliability and accuracy of the obtained DID document are improved, the reliability of a communication key in the DID document is ensured, and the safety of communication between nodes is further ensured.

Specifically, the document content identifier in the corresponding relation of the target identity can be compared with the obtained document content identifier of the node to be accessed; if the two are consistent, the obtained document content identification of the node to be accessed is the latest generation identification, and the verification is passed immediately; if the two are inconsistent, the obtained document content identification of the node to be accessed is not the latest generation identification, and the identity authorization can be cancelled later, namely the aging verification is not passed.

It should be noted that, because the aging verification process does not involve the search and acquisition result of the DID document, the order of the aging verification process and the search and acquisition process of the DID document in the present disclosure is not limited.

In order to reduce irrelevant operand, verification can be performed first, only if the time-efficiency verification is passed, the DID document is searched and obtained from the decentralization system, and other dimension verification such as content verification, signature verification, validity verification and the like is performed on the obtained DID document.

And S204, if the verification is passed, establishing secure communication connection with the node to be accessed according to the communication key in the DID document of the node to be accessed.

It can be understood that only if the verification is passed, the DID document of the node to be accessed is analyzed, and the accurate and reliable communication key of the node to be accessed can be obtained; based on the communication key, a secure communication connection can be established with the node to be accessed, so that the security of data communication with the node to be accessed is ensured.

By way of example, the symmetric encryption key can be deduced based on the communication key, and the encrypted communication connection with the node to be accessed is established by means of the symmetric encryption key, so that the transmission bandwidth is reduced, and the communication connection establishment efficiency is improved. It should be noted that the present disclosure does not limit the derivation algorithm used to derive the symmetric encryption key, and may be implemented using at least one derivation algorithm in the prior art. For example, an ECDH (Elliptic Curve Diffie-Hellman key Exchange, elliptic curve Difei-Huffman key exchange) algorithm may be employed to derive an ECC (Elliptic curve cryptography, elliptic encryption algorithm) -based public communication key to generate a symmetric encryption key.

According to the embodiment of the disclosure, the DID document of the node to be accessed is searched and verified in the decentralised storage system through the identity correspondence relation of the node to be accessed stored in the blockchain network, so that the security and reliability of the DID document of the node to be accessed are improved; the storage and the use of the identity corresponding relation are carried out in the intelligent contract of the blockchain network, so that the convenience of the DID document searching process is improved; by verifying the DID document and using the communication key in the DID document after the DID document passes the verification, the reliability of the communication key is enhanced, and further, the safety communication connection is established with the node to be accessed based on the communication key, so that the safety and the reliability of the communication between the nodes are ensured.

On the basis of the technical schemes, after the node to be accessed establishes the secure communication connection, a communication record is generated and stored in the intelligent contract for verification; the communication record may include at least one of a blockchain address, a document content identifier, a connection time, and a connection task of both communication nodes.

The connection task is used for representing the task to be executed required by the communication connection, and can be added into the communication record in a mode of recording task identification.

It can be appreciated that by storing the communication record of the present communication in the blockchain after each communication connection is established, the communication between the nodes can be achieved, data support is provided for the examination of the subsequent communication between the nodes, the occurrence of illegal communication between the nodes is reduced, and the normalization and reliability of the communication between the nodes are ensured.

Based on the above technical solutions, the present disclosure further provides a preferred embodiment, in which a process of establishing a trusted connection between computing nodes in a multiparty collaborative computing network is described in detail.

Referring to fig. 3A, the DID identity granting method of a computing node in a multiparty cooperative computing network includes:

s301, respectively declaring the own blockchain address in the blockchain network by the computing node and the identity authority, and labeling the authorization identity category of the identity authority.

S302, the identity authority generates a DID document of the computing node according to the blockchain address of the computing node and the communication public key of the computing node which are supervised by the identity authority.

S303, the identity authority stores the DID document in the decentralised storage system, and obtains the document Identification (ID) of the DID document in the decentralised storage system.

The file ID is a document position identifier of the DID document in the decentralised storage system and is used for representing the storage position of the DID document in the decentralised storage system.

S304, the identity authority takes the data fingerprint of the DID document of the computing node as a DID identifier.

And S305, the identity authority stores the identity correspondence among the blockchain address, the DID identifier and the file ID of the computing node in an intelligent contract of the blockchain network.

According to the technical scheme, the DID document storage is performed by introducing the decentralization storage system, so that the durability and the non-tamper property of the stored DID document are ensured. By introducing the intelligent contract to store the identity corresponding relation, the convenience of the information searching process carried in the identity corresponding relation is improved, the convenience of subsequent DID document searching is improved, and meanwhile, the sharing among nodes of the identity corresponding relation of different computing nodes is realized.

Further, referring to fig. 3B, based on the DID identity granting method shown in fig. 3A, the disclosure further provides a DID identity revocation method of a computing node in a multiparty collaborative computing network, including:

s306, the identity authority generates a new DID document for declaring to cancel the authorized identity according to the blockchain address of the computing node supervised by the identity authority.

S307, the identity authority stores the new DID document in the decentralised storage system, and obtains the file ID of the new DID document in the decentralised storage system.

S308, the identity authority takes the data fingerprint of the new DID document of the computing node as a new DID identifier.

S309, the identity authority stores the identity correspondence among the blockchain address of the computing node, the new DID identifier and the new file ID in an intelligent contract of the blockchain network.

According to the scheme, the granted DID identity is revoked in a new identity granting mode, so that the granted identity is revoked on the basis of guaranteeing the non-tamper property of the DID document, and the DID identity can be effectively managed in different phases (granting phase or revocation phase). Notably, the old identity correspondence of the compute node remains in the smart contract and is not deleted.

Based on the schemes shown in fig. 3A and fig. 3B, referring to a method for establishing a trusted connection between computing nodes in a multiparty cooperative computing network shown in fig. 3C, the method includes:

s310, the DID identification and the blockchain address of each first computing node and each second computing node are interacted.

S311, the first computing node accesses an intelligent contract of the blockchain network, and searches for the latest second DID identifier according to the blockchain address of the second computing node; and the second computing node accesses the intelligent contract of the blockchain network, and searches the latest first DID identifier according to the blockchain address of the first computing node.

S312, if the first computing node determines that the second DID identifier is the same as the DID identifier sent by the second computing node, determining a second file ID in the identity association relationship corresponding to the second DID identifier in the intelligent contract; and if the second computing node determines that the first DID identifier is the same as the DID identifier sent by the first computing node, determining a first file ID in the identity association relationship corresponding to the first DID identifier in the intelligent contract.

S313, the first computing node acquires a second DID document from the decentralization system according to the second file ID; and the second computing node acquires the first DID document from the decentralization system according to the first file ID.

S314, the first computing node compares the digital fingerprint of the second DID document with the second DID identifier, and performs content integrity verification on the second DID document; and comparing the digital fingerprint of the first DID document with the first DID identifier by the second computing node, and verifying the content integrity of the first DID document.

S315, the first computing node adopts a verification mode in the second DID document to carry out signature verification on the second DID document; and the second computing node adopts a verification mode in the first DID document to carry out signature verification on the first DID document.

S316, the first computing node searches the authorization identity category of the generator of the second DID document from the blockchain network; and the second computing node searches the blockchain network for the authorized identity category of the producer of the first DID document.

S317, the first computing node verifies the validity of the generator of the second DID document according to the authorization identity class of the generator of the second DID document; and the second computing node adopts the authorization identity category of the generator of the first DID document to verify the validity of the generator of the first DID document.

S318, if the verification is passed, the first computing node acquires a second communication public key in the second DID document; and the second communication node obtains a first communication public key in the first DID document.

S319, the first computing node derives a symmetric encryption key from the second communication public key, and the second computing node derives the symmetric encryption key from the first communication public key.

S320, the first computing node and the second computing node establish encrypted communication connection between the nodes based on the symmetric encryption keys derived by the first computing node and the second computing node.

S321, the first computing node and/or the second computing node generate the communication record and upload the communication record to an intelligent contract of the blockchain network for examination by an examination party.

The communication record comprises the block chain address of each computing node, the DID identification, the connection time and the computing task identification.

According to the technical scheme, through introducing the decentralised storage and blockchain network, the non-tamper property and the verifiability of the DID document are realized, so that the safety and the verifiability of the DID document are ensured. By introducing the communication record, the communication censorability among the computing nodes is ensured, so that the security of cooperative computing among the computing nodes in the multiparty cooperative computing network is ensured.

As an implementation of each of the above-described blockchain-based data storage methods, the present disclosure further provides an optional embodiment of an execution apparatus that implements each of the above-described blockchain-based data storage methods.

Referring to the blockchain-based data storage device 400 shown in fig. 4, configured for an identity authority, comprising: the DID document generation module 401, the document content identification determination module 402, the document location identification determination module 403, and the identity correspondence storage module 404. Wherein,,

The DID document generation module 401 is configured to generate a decentralised identity DID document of the communication node according to a blockchain address of the communication node that is supervised by itself and a communication key of the communication node; the communication key is used for establishing secure communication connection with other communication nodes;

a document content identification determining module 402, configured to determine a document content identification of the DID document;

the document location identification determining module 403 is configured to perform decentralization storage on the DID document, and obtain a document location identification of the DID document;

and the identity correspondence storage module 404 is configured to store the identity correspondence between the document content identifier, the document location identifier and the blockchain address of the communication node in an intelligent contract of a blockchain network, and is used to search and verify the DID document.

In an alternative embodiment, the DID document further includes revocation declaration information indicating that the previously generated history DID document is invalid.

In an alternative embodiment, the blockchain network stores an authorized identity class of the identity authorizer for generating party identity verification on the DID document.

In an alternative embodiment, the communication node is a computing node in a multiparty collaborative computing network.

The data storage device based on the block chain can execute the data storage method based on the block chain provided by any embodiment of the disclosure, and has the corresponding functional modules and beneficial effects of executing the data storage method based on the block chain.

As an implementation of each of the above-described blockchain-based communication methods, the present disclosure further provides an optional embodiment of an execution apparatus that implements each of the above-described blockchain-based communication methods.

Referring to the blockchain-based communication device 500 shown in fig. 5, configured at a communication node, comprising: a data acquisition module 501, an identity correspondence determination module 502, a DID document verification module 503, and a communication connection establishment module 504. Wherein,,

the data acquisition module 501 is configured to acquire a blockchain address of a node to be accessed and a corresponding document content identifier;

The identity correspondence determining module 502 is configured to determine an identity correspondence of the node to be accessed in an intelligent contract of a blockchain network according to a blockchain address of the node to be accessed; the identity corresponding relation of the node to be accessed is generated based on any block chain-based data storage device provided by the embodiment of the disclosure;

the DID document verification module 503 is configured to search and verify a decentralised identity DID document of the node to be accessed according to a document content identifier of the node to be accessed and a corresponding identity correspondence;

and the communication connection establishment module 504 is configured to establish a secure communication connection with the node to be accessed according to the communication key in the DID document of the node to be accessed if the authentication is passed.

According to the embodiment of the disclosure, the DID document of the node to be accessed is searched and verified through the identity correspondence relation of the node to be accessed stored in the blockchain network, so that the security and reliability of the DID document of the node to be accessed are improved; the storage and the use of the identity corresponding relation are carried out in the intelligent contract of the blockchain network, so that the convenience of the DID document searching process is improved; by verifying the DID document and using the communication key in the DID document after the DID document passes the verification, the reliability of the communication key is enhanced, and further, the safety communication connection is established with the node to be accessed based on the communication key, so that the safety and the reliability of the communication between the nodes are ensured.

In an alternative embodiment, if at least two identity correspondences of the node to be accessed are stored in the smart contract, the DID document verification module 503 includes:

the target identity corresponding relation determining unit is used for taking the identity corresponding relation with the latest time in the at least two identity corresponding relations as a target identity corresponding relation;

and the DID document verification unit is used for searching and verifying the DID document of the node to be accessed according to the corresponding relation of the target identity and the document content identifier of the node to be accessed.

In an alternative embodiment, the DID document authentication unit is specifically configured to:

and performing aging verification on the DID document of the node to be accessed according to the document content identification in the target identity corresponding relation and the document content identification of the node to be accessed.

In an alternative embodiment, the DID document verification module 503 includes:

the reference identifier determining unit is used for generating a document content identifier corresponding to the DID document of the node to be accessed, and taking the generated result as a reference identifier;

and the content verification unit is used for carrying out content verification on the DID document of the node to be accessed according to the reference identifier and the document content identifier of the node to be accessed.

In an alternative embodiment, the apparatus 500 further comprises:

the generator acquisition module is used for acquiring a generator of the DID document of the node to be accessed;

and the generator identity verification module is used for carrying out identity verification on the generator according to the authorized identity category of the generator in the blockchain network.

In an alternative embodiment, the apparatus 500 further comprises:

the communication record storage module is used for generating a communication record after the safety communication connection is established with the node to be accessed, and storing the communication record into the intelligent contract for verification;

the communication record comprises at least one of a blockchain address, a document content identifier, a connection time and a connection task of both communication nodes.

The communication device based on the block chain can execute the communication method based on the block chain provided by any embodiment of the disclosure, and has the corresponding functional modules and beneficial effects of executing the communication method based on the block chain.

In the technical scheme of the disclosure, the related DID documents, document content identifiers, document position identifiers, identity correspondence and other processes such as collection, storage, use, processing, transmission, provision, disclosure and the like all conform to the regulations of related laws and regulations and do not violate the popular regulations of the public order.

According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

Fig. 6 illustrates a schematic block diagram of an example electronic device 600 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.

As shown in fig. 6, the apparatus 600 includes a computing unit 601 that can perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 602 or a computer program loaded from a storage unit 608 into a Random Access Memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 may also be stored. The computing unit 601, ROM 602, and RAM 603 are connected to each other by a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.

Various components in the device 600 are connected to the I/O interface 605, including: an input unit 606 such as a keyboard, mouse, etc.; an output unit 607 such as various types of displays, speakers, and the like; a storage unit 608, such as a magnetic disk, optical disk, or the like; and a communication unit 609 such as a network card, modem, wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.

The computing unit 601 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 601 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as at least one of a blockchain-based data storage method and a blockchain-based communication method. For example, in some embodiments, at least one of the blockchain-based data storage method and the blockchain-based communication method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program may be loaded and/or installed onto the device 600 via the ROM 602 and/or the communication unit 609. When the computer program is loaded into RAM 603 and executed by computing unit 601, one or more steps of at least one of the blockchain-based data storage method and the blockchain-based communication method described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform at least one of a blockchain-based data storage method and a blockchain-based communication method in any other suitable manner (e.g., by means of firmware).

Various implementations of the systems and techniques described here above can be implemented in digital electronic circuitry, integrated circuit systems, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems On Chip (SOCs), complex Programmable Logic Devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.

The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service are overcome. The server may also be a server of a distributed system or a server that incorporates a blockchain.

Artificial intelligence is the discipline of studying the process of making a computer mimic certain mental processes and intelligent behaviors (e.g., learning, reasoning, thinking, planning, etc.) of a person, both hardware-level and software-level techniques. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing, and the like; the artificial intelligent software technology mainly comprises a computer vision technology, a voice recognition technology, a natural language processing technology, a machine learning/deep learning technology, a big data processing technology, a knowledge graph technology and the like.

Cloud computing (cloud computing) refers to a technical system that a shared physical or virtual resource pool which is elastically extensible is accessed through a network, resources can comprise servers, operating systems, networks, software, applications, storage devices and the like, and resources can be deployed and managed in an on-demand and self-service mode. Through cloud computing technology, high-efficiency and powerful data processing capability can be provided for technical application such as artificial intelligence and blockchain, and model training.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps recited in the present disclosure may be performed in parallel, sequentially, or in a different order, provided that the desired results of the technical solutions provided by the present disclosure are achieved, and are not limited herein.

The above detailed description should not be taken as limiting the scope of the present disclosure. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present disclosure are intended to be included within the scope of the present disclosure.

Claims

1. The data storage method based on the block chain is applied to an identity authority and comprises the following steps:

determining a document content identifier of the DID document;

storing the identity correspondence between the document content identifier, the document position identifier and the blockchain address of the communication node in an intelligent contract of a blockchain network, so that the communication node can determine the identity correspondence of the node to be accessed in the intelligent contract according to the blockchain address of the node to be accessed after acquiring the blockchain address of the node to be accessed and the corresponding document content identifier, and find and verify the DID document of the node to be accessed according to the document content identifier of the node to be accessed and the latest identity correspondence of the corresponding time, and establish secure communication connection with the node to be accessed according to a communication key in the DID document of the node to be accessed under the condition that verification is passed;

The DID document also comprises revocation statement information, wherein the revocation statement information is used for indicating that a previously generated historical DID document is invalid.

2. The method of claim 1, wherein the blockchain network has stored therein an authorized identity category of the identity authorizer for generating party identity verification of the DID document.

3. The method of any of claims 1-2, wherein the communication node is a computing node in a multi-party collaborative computing network.

4. The communication method based on the block chain is applied to the communication node and comprises the following steps:

determining the identity corresponding relation of the node to be accessed in the intelligent contract of the blockchain network according to the blockchain address of the node to be accessed; wherein the identity correspondence of the node to be accessed is generated based on the method of any one of claims 1-3;

searching and verifying a decentralised identity DID document of the node to be accessed according to the document content identification of the node to be accessed and the corresponding time latest identity correspondence;

and if the authentication is passed, establishing secure communication connection with the node to be accessed according to the communication key in the DID document of the node to be accessed.

5. The method of claim 4, wherein the validating the DID document of the node to be accessed comprises:

and performing aging verification on the DID document of the node to be accessed according to the document content identification in the latest identity corresponding relation of the node to be accessed and the document content identification of the node to be accessed.

6. The method of any of claims 4-5, wherein the validating the DID document of the node to be accessed comprises:

generating a document content identifier corresponding to the DID document of the node to be accessed, and taking the generated result as a reference identifier;

and carrying out content verification on the DID document of the node to be accessed according to the reference identifier and the document content identifier of the node to be accessed.

7. The method of any of claims 4-5, wherein the method further comprises:

acquiring a generator of the DID document of the node to be accessed;

and carrying out identity verification on the generator according to the authorized identity category of the generator in the blockchain network.

8. The method according to any of claims 4-5, further comprising, after establishing a secure communication connection with the node to be accessed:

Generating a communication record and storing the communication record in the intelligent contract for verification;

9. A blockchain-based data storage device configured at an identity authority comprising:

the DID document generation module is used for generating a decentralised identity DID document of the communication node according to the blockchain address of the communication node supervised by the DID document generation module and the communication key of the communication node; the communication key is used for establishing secure communication connection with other communication nodes;

the document content identification determining module is used for determining the document content identification of the DID document;

the document position identification determining module is used for carrying out decentralization storage on the DID document and obtaining the document position identification of the DID document;

the identity correspondence storage module is used for storing the identity correspondence between the document content identifier, the document position identifier and the blockchain address of the communication node in an intelligent contract of a blockchain network, so that the communication node can determine the identity correspondence of the node to be accessed in the intelligent contract according to the blockchain address of the node to be accessed after acquiring the blockchain address of the node to be accessed and the corresponding document content identifier, search and verify the DID document of the node to be accessed according to the document content identifier of the node to be accessed and the latest identity correspondence at the corresponding time, and establish secure communication connection with the node to be accessed according to the communication key in the DID document of the node to be accessed under the condition that verification is passed;

10. The apparatus of claim 9, wherein the blockchain network has stored therein an authorized identity category of the identity authorizer for generating party identity verification for the DID document.

11. The apparatus of any of claims 9-10, wherein the communication node is a computing node in a multiparty collaborative computing network.

12. A blockchain-based communication device configured at a communication node, comprising:

the data acquisition module is used for acquiring the blockchain address of the node to be accessed and the corresponding document content identifier;

the identity correspondence determining module is used for determining the identity correspondence of the node to be accessed in the intelligent contract of the blockchain network according to the blockchain address of the node to be accessed; wherein the identity correspondence of the node to be accessed is generated based on the apparatus of any one of claims 9-11;

the DID document verification module is used for searching and verifying the decentralized identity DID document of the node to be accessed according to the document content identification of the node to be accessed and the corresponding relationship of the latest identity in corresponding time;

And the communication connection establishment module is used for establishing secure communication connection with the node to be accessed according to the communication key in the DID document of the node to be accessed if the authentication is passed.

13. The apparatus of claim 12, wherein the DID document verification unit is specifically configured to:

14. The apparatus of any of claims 12-13, wherein the DID document verification module comprises:

15. The apparatus according to any one of claims 12-13, wherein the apparatus further comprises:

16. The apparatus according to any one of claims 12-13, further comprising:

17. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the blockchain-based data storage method of any of claims 1-3 and/or to perform the blockchain-based communication method of any of claims 4-8.

18. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the blockchain-based data storage method of any of claims 1-3 and/or to perform the blockchain-based communication method of any of claims 4-8.