Blockchain-based user privacy data providing methods and apparatuses

Patent metadata

Field	Value
Publication number	US-11347888-B2
Application number	US-202117362890-A
Country	US
Kind code	B2
Filing date	Jun 29, 2021
Priority date	Sep 11, 2020
Publication date	May 31, 2022
Grant date	May 31, 2022

Abstract

A blockchain-based user privacy data providing method and apparatus is provided. The method includes receiving a data consumption request from a data consumer, where the data consumption request requests user privacy data of a target user, the user privacy data includes personal data that is pre-encrypted and uploaded to a trusted execution environment (TEE), and the TEE is constructed in a blockchain node; performing predetermined verification on the data consumption request in the TEE based on request body data corresponding to the data consumption request using a smart contract deployed in the blockchain to obtain a corresponding predetermined verification result; if the predetermined verification result satisfies a verification success condition, obtaining target privacy data for the data consumption request, and sending the encrypted target privacy data to the data consumer, where the target privacy data is obtained in the TEE based on the user privacy data stored in the blockchain.

First claim

What is claimed is:

1. A blockchain-based user privacy data providing method, comprising:
receiving a data consumption request sent by a data consumer, wherein the data consumption request is a consumption request that requests user privacy data of a target user, wherein the user privacy data comprises personal data that is pre-encrypted and is uploaded to a trusted execution environment (TEE), and the TEE is constructed in a node of a blockchain;
performing predetermined verification on the data consumption request in the TEE based on request body data that corresponds to the data consumption request by using a smart contract deployed in the blockchain, wherein performing the predetermined verification comprises performing the predetermined verification on the data consumption request based on plaintext request body data to obtain a corresponding predetermined verification result, comprising:
verifying a data privacy attribute of the user privacy data corresponding to the data consumption request to obtain a first verification result;
verifying, based on a pre-stored data hosting record, whether a hosting relationship exists between a data hoster and a data holder of the user privacy data to obtain a second verification result, wherein the data hoster hosts the user privacy data for the data holder and the data hoster is at least one member in the blockchain, and wherein the pre-stored data hosting record includes a plurality of data hosting relationship records that are uploaded to the blockchain in advance based on an authorization agreement signed by the data holder and the data hoster;
verifying, based on a pre-stored data authorization record, whether an authorization relationship exists between the data consumer and the data holder to obtain a third verification result; and
determining, based on at least one of the first verification result, the second verification result, and the third verification result, the predetermined verification result obtained for the data consumption request;

obtaining the corresponding predetermined verification result;
in responding to determining that the predetermined verification result satisfies a verification success condition, obtaining target privacy data for the data consumption request, wherein the smart contract includes a verification constraint condition used to determine whether the predetermined verification result satisfies the verification success condition; and
sending an encrypted target privacy data to the data consumer, wherein the target privacy data is obtained in the TEE based on the user privacy data stored in the blockchain.

2. The method according to claim 1 , further comprising, before receiving the data consumption request sent by the data consumer:
receiving a privacy data storage request of the target user that is sent by a data holder, wherein the privacy data storage request comprises first encrypted data, and the first encrypted data is obtained by encrypting plaintext user privacy data through envelope encryption;
transmitting the user privacy data to the TEE in the blockchain based on the first encrypted data, wherein a first smart contract is deployed in the blockchain; and
recording the user privacy data in the TEE by using the first smart contract.

3. The method according to claim 2 , wherein transmitting the user privacy data to the TEE in the blockchain based on the first encrypted data comprises:
decrypting the first encrypted data to obtain the user privacy data of the target user;
determining whether security verification of the user privacy data obtained through decryption succeeds;
in response to determining that the security verification of the user privacy data has succeeded, generating second encrypted data based on the user privacy data; and
transmitting the second encrypted data to the TEE in the blockchain.

4. The method according to claim 3 , wherein the first encrypted data comprises ciphertext privacy data obtained by encrypting the user privacy data by using a symmetric key, and a ciphertext key obtained by encrypting the symmetric key by using a public key; and
wherein decrypting the first encrypted data to obtain the user privacy data of the target user comprises:
decrypting the ciphertext key by using a private key corresponding to the public key to obtain the symmetric key; and
decrypting the ciphertext privacy data by using the symmetric key to obtain the user privacy data.

5. The method according to claim 3 , wherein generating the second encrypted data based on the user privacy data comprises:
encrypting the user privacy data of the target user by using a symmetric key to obtain ciphertext privacy data;
encrypting the symmetric key by using a public key to obtain a ciphertext key; and
generating the second encrypted data based on the ciphertext privacy data and the ciphertext key.

6. The method according to claim 5 , wherein recording the user privacy data in the TEE by using the first smart contract comprises:
decrypting the ciphertext key in the TEE by using a private key corresponding to the public key and the first smart contract to obtain the symmetric key;
decrypting the ciphertext privacy data by using the symmetric key to obtain the user privacy data; and
storing the user privacy data to the TEE in the blockchain.

7. The method according to claim 3 further comprising, after the decrypting the first encrypted data to obtain the user privacy data of the target user:
in response to determining that the security verification on the user privacy data has failed, generating data abnormality prompt information indicating that the security verification fails, and sending the data abnormality prompt information to the data holder.

8. The method according to claim 2 , after the recording the user privacy data in the TEE by using the first smart contract, further comprising:
obtaining data recording state information of the user privacy data; and
in response to determining that the data recording state information indicates that data recording has failed, re-performing the step of recording the user privacy data in the TEE by using the first smart contract, or sending recording abnormality prompt information to a specified end-user device.

9. The method according to claim 1 , wherein the request body data comprises a ciphertext key, and the ciphertext key is obtained by encrypting a symmetric key by using a public key; and
wherein sending the encrypted target privacy data to the data consumer comprises:
decrypting the ciphertext key by using a private key corresponding to the public key to obtain the symmetric key;
encrypting the target privacy data by using the symmetric key to obtain the encrypted target privacy data; and
sending the encrypted target privacy data to the data consumer.

10. The method according to claim 1 , wherein performing the predetermined verification on the data consumption request in the TEE based on the request body data corresponding to the data consumption request by using the smart contract deployed in the blockchain to obtain the corresponding predetermined verification result comprises:
transmitting the request body data corresponding to the data consumption request to the TEE in the blockchain, wherein a second smart contract is further deployed in the blockchain; and
performing the predetermined verification on the data consumption request in the TEE based on the request body data by using the second smart contract to obtain a the corresponding predetermined verification result.

11. The method according to claim 10 , wherein transmitting the request body data corresponding to the data consumption request to the TEE in the

Assignees

• Alipay Hangzhou Inf Tech Co Ltd

Inventors

• Su Dexin
• Gu Jun

Classifications

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title