Blockchain-based data authorization method and apparatus
One or more implementations of the present specification provide a blockchain-based data authorization method and apparatus. The method can include receiving, by a blockchain node, an authentication transaction submitted by a privacy computing platform, where the authentication transaction queries whether a data user has obtained authorization of target data possessed by a data owner, and in response to determining that the data user has obtained authorization of the target data, executing, by the blockchain node, a smart contract invoked by the authentication transaction to provide an authorization token to the privacy computing platform that instructs the privacy computing platform to obtain the target data, and send a computational result of one or more predetermined computational operations based on the target data to the data user.
1. A computer-implemented method comprising:
receiving, by one or more computers that are associated with an off-chain platform that provides a private key hosting service for an institution, a private key for the institution;
receiving, by the one or more computers that are associated with the off-chain platform that provides the private key hosting service for the institution, a request that is initiated by a data user and that requests to obtain target data whose access is controlled by the institution;
transmitting, by the one or more computers that are associated with the off-chain platform and to a blockchain, an authentication request transaction that queries whether the data user has obtained authorization for the target data;
after (i) the blockchain invokes a data authorization smart contract using information identifying the data user and the institution that is included in the authentication request transaction, (ii) the blockchain generates an authorization request event that includes information identifying the data user and the institution, in response to the blockchain invoking the data authorization smart contract, and (iii) the institution which controls access to the target data transmitting, in response to the blockchain generating the authorization request event, an authorization confirmation transaction to the blockchain to indicate that the institution agrees to provide the data user with access to the target data, obtaining, by the one or more computers that are associated with the off-chain platform, a transaction execution result event indicating that the institution has agreed to provide the data user with access to the target data;
obtaining, by the one or more computers that are associated with the off-chain platform, an authorization token from the transaction execution result event;
in response to obtaining the authorization token, obtaining, by the one or more computers that are associated with the off-chain platform, encrypted target data from the blockchain;
decrypting, by the one or more computers that are associated with the off-chain platform, the encrypted target data using the previously received private key for the institution, to generate the target data; and
providing, by the one or more computers that are associated with the off-chain platform the target data to the data user.
2. The method of claim 1 , wherein the data authorization smart contract is associated with an authorizer list.
3. The method of claim 1 , comprising:
obtaining the transaction execution result event from a transaction log of the blockchain using an event listening mechanism.
4. The method of claim 1 , comprising providing the authorization token to the data user.
5. The method of claim 1 , comprising providing the authorization token to the data user based on a user ID associated with the data user.
6. The method of claim 1 , comprising providing the target data based on a privacy level associated with the target data.
7. The method of claim 1 , wherein the authorization token comprises a temporary session key.
8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
receiving, by one or more computers that are associated with an off-chain platform that provides a private key hosting service for an institution, a private key for the institution;
receiving, by the one or more computers that are associated with the off-chain platform that provides the private key hosting service for the institution, a request that is initiated by a data user and that requests to obtain target data whose access is controlled by the institution;
transmitting, by the one or more computers that are associated with the off-chain platform and to a blockchain, an authentication request transaction that queries whether the data user has obtained authorization for the target data;
after (i) the blockchain invokes a data authorization smart contract using information identifying the data user and the institution that is included in the authentication request transaction, (ii) the blockchain generates an authorization request event that includes information identifying the data user and the institution, in response to the blockchain invoking the data authorization smart contract, and (iii) the institution which controls access to the target data transmitting, in response to the blockchain generating the authorization request event, an authorization confirmation transaction to the blockchain to indicate that the institution agrees to provide the data user with access to the target data, obtaining, by the one or more computers that are associated with the off-chain platform, a transaction execution result event indicating that the institution has agreed to provide the data user with access to the target data;
obtaining, by the one or more computers that are associated with the off-chain platform, an authorization token from the transaction execution result event;
in response to obtaining the authorization token, obtaining, by the one or more computers that are associated with the off-chain platform, encrypted target data from the blockchain;
decrypting, by the one or more computers that are associated with the off-chain platform, the encrypted target data using the previously received private key for the institution, to generate the target data; and
providing, by the one or more computers that are associated with the off-chain platform the target data to the data user.
9. The medium of claim 8 , wherein the data authorization smart contract is associated with an authorizer list.
10. The medium of claim 8 , wherein the operations comprise:
obtaining the transaction execution result event from a transaction log of the blockchain using an event listening mechanism.
11. The medium of claim 8 , wherein the operations comprise providing the authorization token to the data user.
12. The medium of claim 8 , wherein the operations comprise providing the authorization token to the data user based on a user ID associated with the data user.
13. The medium of claim 8 , wherein the operations comprise providing, by the one or more computers, the target data based on a privacy level associated with the target data.
14. The medium of claim 8 , wherein the authorization token comprises a temporary session key.
15. A computer-implemented system comprising:
one or more processors; and
one or more computer-readable memories coupled to the one or more processors and having instructions stored thereon that are executable by the one or more processors to perform operations comprising:
receiving, by one or more computers that are associated with an off-chain platform that provides a private key hosting service for an institution, a private key for the institution;
receiving, by the one or more computers that are associated with the off-chain platform that provides the private key hosting service for the institution, a request that is initiated by a data user and that requests to obtain target data whose access is controlled by the institution;
transmitting, by the one or more computers that are associated with the off-chain platform and to a blockchain, an authentication request transaction that queries whether the data user has obtained authorization for the target data;
after (i) the blockchain invokes a data authorization smart contract using information identifying the data user and the institution that is included in the authentication request transaction, (ii) the blockchain generates an authorization request event that includes information identifying the data user and the institution, in response to the blockchain invoking the data authorization smart contract, and (iii) the institution which controls access to the target data transmitting, in response to the blockchain generating the authorization request event, an authorization confirmation transaction to the blockchain to indicate that the institution agrees to provide the data user with access to the target data, obtaining, by the one or more computers that are associated with the off-chain platform, a transaction execution result event indicating that the institution has agreed to provide the data user with access to the target data;
obtaining, by the one or more computers that are associated with the off-chain platform, an authorization token from the transaction execution result event;
in response to obtaining the authorization token, obtaining, by the one or more computers that are associated with the off-chain platform, encrypted target data from the blockchain;
decrypting, by the one or more computers that are associated with the off-chain platform, the encrypted target data using the previously received private key for the institution, to generate the target data; and
providing, by the one or more computers that are associated with the off-chain platform the target data to the data user.
16. The system of claim 15 , wherein the data authorization smart contract is associated with an authorizer list.
17. The system of claim 15 , wherein the operations comprise:
obtaining the transaction execution result event from a transaction log of the blockchain using an event listening mechanism.
18. The system of claim 15 , wherein the operations comprise providing the authorization token to the data user.
19. The system of claim 15 , wherein the operations comprise providing the authorization token to the data user based on a user ID associated with the data user.
20. The system of claim 15 , wherein the operations comprise providing, by the one or more computers, the target data based on a privacy level associated with the target data.