HK40004251B - Service data access method, apparatus and system, and electronic device - Google Patents

Description

Method, device, electronic device and system for accessing business data

Technical Field

The present application relates to the field of blockchain technology, and more specifically to methods, devices, electronic devices, and systems for accessing business data.

Background Art

At present, in addition to the field of digital currency, blockchain technology has also penetrated into many industries and fields. For example, in the commercial health insurance chain project, the hospital encrypts the patient's medical records and uploads them to the blockchain. The insurance company downloads, decrypts and analyzes the patient's medical records stored on the blockchain to achieve rapid insurance compensation.

From the above examples, we can see that the current blockchain technology, through encryption technology, ensures that patient medical records are invisible to third parties, which to a certain extent guarantees the privacy of data. However, as users pay more and more attention to privacy protection, simply ensuring that data is invisible to third parties can no longer meet users' requirements for data privacy.

Therefore, a method for accessing business data is needed to overcome the above technical problems.

Summary of the Invention

One of the purposes of this application is to provide a method, device, electronic device and system for accessing business data that can meet the user's requirements for data privacy to the greatest extent.

To solve the above technical problems, the embodiments of the present application are implemented as follows:

In a first aspect, a method for accessing business data is provided, comprising:

The first service node receives an access request from a service initiator, the access request being used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. Target encrypted service data on the blockchain based on the target service is associated with the identity identifier and the service identifier, which is used to identify the access service corresponding to the access request.

The first service node sends the access request to the authorization and authentication server;

The authorization authentication server performs authorization authentication on the owner based on the identity identifier;

The authorization authentication server responds to the access request based on the result of the authorization authentication.

In a second aspect, a method for accessing business data is provided, including:

The first service node receives an access request from a service initiator, the access request being used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. Target encrypted service data on the blockchain based on the target service is associated with the identity identifier and the service identifier, which is used to identify the access service corresponding to the access request.

The first service node sends the access request to an authorization and authentication server, and the authorization and authentication server is configured to perform authorization and authentication on the owner based on the identity identifier, and respond to the access request based on a result of the authorization and authentication.

A third aspect provides a method for accessing business data, including:

The authorization and authentication server receives an access request sent by the first service node. The access request is sent by the service initiator to the first service node. The access request is used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. The target encrypted service data on the blockchain based on the target service data is associated with the identity identifier and the service identifier, and the service identifier is used to identify the access service corresponding to the access request.

The authorization authentication server performs authorization authentication on the owner based on the identity identifier;

The authorization authentication server responds to the access request based on the result of the authorization authentication.

In a fourth aspect, a business data access system is provided, comprising:

A first service node receives an access request from a service initiator, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

The first service node sends the access request to the authorization and authentication server;

The authorization authentication server performs authorization authentication on the owner based on the identity identifier;

The authorization authentication server responds to the access request based on the result of the authorization authentication.

In a fifth aspect, a device for accessing business data is provided, comprising:

A receiving unit receives an access request from a service initiator, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify a person to whom the target service data belongs, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

The sending unit sends the access request to the authorization and authentication server, and the authorization and authentication server is used to perform authorization and authentication on the owner based on the identity identifier, and respond to the access request based on the result of the authorization and authentication.

In a sixth aspect, an authorization and authentication device is provided, comprising:

A transceiver unit receives an access request sent by a first service node, the access request being sent by a service initiator to the first service node, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify a person to whom the target service data belongs, target encrypted service data on the blockchain based on the target service data being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

A processing unit, performing authorization authentication on the owner based on the identity identifier;

The processing unit responds to the access request based on the result of the authorization authentication.

According to a seventh aspect, an electronic device is provided, including:

processor; and

a memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Receive an access request from a service initiator, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

The access request is sent to an authorization and authentication server, which is used to perform authorization and authentication on the owner based on the identity identifier and respond to the access request based on the result of the authorization and authentication.

According to an eighth aspect, an electronic device is provided, including:

processor; and

a memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Receiving an access request sent by a first service node, the access request being sent by a service initiator to the first service node, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, target encrypted service data on the blockchain based on the target service data being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

Based on the identity identifier, authorization and authentication are performed on the owner;

Based on the result of the authorization authentication, respond to the access request.

In a ninth aspect, a computer-readable medium is provided, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including a plurality of application programs, the electronic device performs the following operations:

Receive an access request from a service initiator, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

The access request is sent to an authorization and authentication server, which is used to perform authorization and authentication on the owner based on the identity identifier and respond to the access request based on the result of the authorization and authentication.

In a tenth aspect, a computer-readable medium is provided, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including a plurality of application programs, the electronic device performs the following operations:

Receiving an access request sent by a first service node, the access request being sent by a service initiator to the first service node, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, target encrypted service data on the blockchain based on the target service data being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

Based on the identity identifier, authorization and authentication are performed on the owner;

Based on the result of the authorization authentication, respond to the access request.

It can be seen from the above technical solution of the present application that in the embodiment of the present application, when the business sending direction requests the first service node on the blockchain to access the target business data on the blockchain, the first service node forwards the access request to the authorization authentication server, so that the authorization authentication server performs authorization authentication on the owner of the target business data, and responds to the access request based on the result of the authorization authentication. Since the result of the authorization authentication can reflect whether the owner of the target business data is willing to share the target business data, based on the existing blockchain technology, responding to the access request based on the result of the authorization authentication can meet the user's requirements for data privacy to the greatest extent.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

FIG1 is a schematic flowchart of a method for accessing business data according to an embodiment of the present application.

FIG2 is another schematic flowchart of a method for accessing business data according to an embodiment of the present application.

FIG3 is a schematic flowchart of a method for accessing business data according to another embodiment of the present application.

FIG4 is a schematic flowchart of a method for accessing business data according to yet another embodiment of the present application.

FIG5 is a system for accessing business data according to an embodiment of the present application.

FIG6 is a schematic diagram of a data structure according to an embodiment of the present application.

FIG7 is a system for accessing business data according to another embodiment of the present application.

FIG8 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

FIG9 is a schematic structural diagram of an electronic device according to another embodiment of the present application.

FIG10 is a schematic structural diagram of a device for accessing business data according to an embodiment of the present application.

FIG11 is a schematic structural diagram of an authorization and authentication device according to an embodiment of the present application.

DETAILED DESCRIPTION

In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

FIG1 shows a method for accessing business data according to an embodiment of the present application. The method of FIG1 can be executed by a business data access system. As shown in FIG1 , the method includes:

S102, the first service node receives an access request from a business initiator, wherein the access request is used to request access to target business data on the blockchain, and the access request includes an identity identifier, which is used to identify the owner of the target business data. The target encrypted business data on the chain based on the target business is associated with the identity identifier and the business identifier, and the business identifier is used to identify the access business corresponding to the access request.

In S102, the service initiator can specifically be a terminal device used by a group requesting access to the target service data. For example, the service initiator can be a terminal device used by a group such as insurance agents handling specific services. Terminal devices include PCs and mobile terminals. Mobile terminals, or mobile communication terminals, refer to computer devices that can be used on the move. Broadly speaking, they include mobile phones, laptops, tablets, POS terminals, and even in-vehicle computers. However, in most cases, mobile terminals refer to mobile phones, smartphones with multiple application functions, and tablets.

In S102 , the identity identifier may be information that can uniquely identify the owner, such as the ID number of the owner of the target business data.

S104: The first service node sends the access request to an authorization and authentication server.

Optionally, in some embodiments, in S104, the first service node sends target encrypted business data to the authorization authentication server, where the target encrypted business data is obtained by encrypting the target business data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner.

For example, the first service node may send the access request and the target encrypted service data together to the authorization and authentication server.

Furthermore, the access request may also include the service initiator's identification, digital signature, and storage address of target service data. When the first service node confirms that the service initiator is legitimate based on the service initiator's identification and digital signature, it sends the access request to the authorization authentication server.

S106: The authorization authentication server performs authorization authentication on the owner based on the identity identifier.

Optionally, in some embodiments, the authorization authentication server may authenticate the owner based on the identity identifier by performing authorization authentication on the owner through a mobile terminal. The authorization authentication here may also be understood as identity authentication.

For example, the authorization authentication server sends an authorization authentication request to the mobile terminal, which includes an identity identifier, so that the mobile terminal can perform authorization authentication on the owner based on the identity identifier; the authorization authentication server receives an identity authentication response from the mobile terminal, which includes authentication record data.

It is understood that when the mobile terminal receives the authorization and authentication request, it can determine which user needs to be authorized and authenticated by parsing the authorization and authentication request, and use available authorization and authentication means to authenticate the user. The authorization and authentication means here may include conventional authentication means such as password authentication and fingerprint authentication, which are not limited in the embodiments of the present application.

Furthermore, the authorization authentication request also includes authorization authentication mode indication information, which is used to indicate the authentication mode to be used by the mobile terminal for authorization authentication. After receiving the authorization authentication request, the mobile terminal uses the authentication mode indicated by the authorization authentication mode indication information to perform authorization authentication on the owner of the target service data.

The authorization authentication record data includes at least one of the authorization authentication time, mobile terminal identification, identity identification, authorization authentication result, and information to be verified collected during the authorization authentication process. The information to be verified collected during the authorization authentication process may be, for example, a fingerprint image collected during fingerprint authentication.

Optionally, in some embodiments, the first service node sending an access request to the authorization authentication server includes: the first service node sending the access request and the service identifier to the authorization authentication server. The method shown in FIG1 further includes: the authorization authentication server establishing an association relationship between authentication record data for authorization authentication, the identity identifier, and the service identifier; the authorization authentication server determining a hash value of the authentication record data, establishing an association relationship between the hash value, the identity identifier, and the service identifier, and sending the hash value to the first service node; the first service node synchronizing the hash value to a node in the blockchain, thereby uploading the hash value to the blockchain.

Because the first service node establishes and stores the association between the authentication record data, identity identifier, and business identifier, and the hash value on the blockchain is associated with the identity identifier and business identifier, the authorization and authentication results can be traced and tamper-proof. Furthermore, the hash value of the authentication record data is uploaded to the blockchain, preserving the sharing intentions of the owner of the target business data, facilitating auditing and supervision.

Furthermore, the authorization authentication server sending the hash value to the first service node may be as follows: the authorization authentication server sends the hash value, the owner's electronic certificate, and the authorization authentication server's electronic certificate to the first service node, wherein the owner's electronic certificate is used for node authentication and tracing the owner on the blockchain, and the authorization authentication server's electronic certificate is used for node authentication and tracing the authorization authentication server on the blockchain. Linking the owner's electronic certificate and the authorization authentication server's electronic certificate to the blockchain can prevent denial of ownership by the owner and the authorization authentication server. Here, the owner's electronic certificate can be the owner's digital certificate signature, and the authorization authentication server's electronic certificate can be the authorization authentication server's digital certificate signature.

S108: The authorization authentication server responds to the access request based on the result of the authorization authentication.

Optionally, in some embodiments, if the first service node sends the target encrypted business data to the authorization authentication server, then in S108, the authorization authentication server uses the second decryption key corresponding to the second encryption key to decrypt the target encrypted business data to obtain the target initial decrypted business data if the authorization authentication is passed; the target initial decrypted business data is sent to the first service node, so that the first service node decrypts the target initial decrypted business data to obtain the target business data and then sends it to the business initiator, and the first service node uses the first decryption key corresponding to the first encryption key to decrypt the target initial decrypted business data.

Optionally, in other embodiments, if the first service node does not send the target encrypted business data to the authorization authentication server, then in S108, the authorization authentication server sends the second decryption key corresponding to the second encryption key to the first service node if the authorization authentication is passed, so that the first service node decrypts the target encrypted business data to obtain the target business data and then sends it to the business initiator. The first service node uses the second decryption key and the first decryption key corresponding to the first encrypted data to decrypt the target encrypted business data.

The first encryption key corresponding to the first service node may be the public key of the first service node, and the first decryption key corresponding to the first encryption key may be the private key of the first service node. The second encryption key corresponding to the owner may be the public key of the owner, and the second decryption key corresponding to the second encryption key may be the private key of the owner.

Specifically, in some embodiments, the target encrypted business data based on the target business data is uploaded to the blockchain by a second service node in the blockchain. As shown in FIG2 , the method shown in FIG1 further includes:

S110: The second service node receives target service data sent by a service data provider.

In S110, the service data provider may specifically be a terminal device used by the group providing the target service data. For example, the service data provider may be a terminal device used by a group such as doctors handling specific services. Terminal devices include PCs and mobile terminals. Mobile terminals, or mobile communication terminals, refer to computer devices that can be used on the move. Broadly speaking, they include mobile phones, laptops, tablets, POS terminals, and even in-vehicle computers. However, in most cases, mobile terminals refer to mobile phones, smartphones with multiple application functions, and tablets.

S112: The second service node encrypts the target service data using the first encryption key corresponding to the first service node and the second encryption key corresponding to the owner to obtain the target encrypted service data.

Specifically, the service provider sends the target service data to the second service node, and at the same time brings its own digital signature. The second service node verifies the digital signature of the service provider by running the smart contract to verify the identity of the service provider. After the identity authentication is passed, the second service node executes the smart contract to encrypt the target service data in turn using the first encryption key corresponding to the first service node and the second encryption key corresponding to the owner to obtain the target encrypted service data.

Before encrypting the target service data, the second service node needs to obtain the second encryption key of the owner. Therefore, the second service node calls the communication interface between the second service node and the authorization authentication server to obtain the second encryption key of the owner.

S114, the second service node synchronizes the target encrypted business data to the node of the blockchain, and realizes the on-chain of the target encrypted business data.

In S114, the second service node can encapsulate the target encrypted business data into a digital envelope together with the digital signature of the business provider, the unique index of the business provider, the unique index of the business initiator, and the association between the target encrypted business data and the identity identifier and business identifier of the owner, and then synchronize the digital envelope to other nodes in the blockchain through the consensus algorithm to realize the on-chain of the target encrypted business data.

The following describes in detail a method for accessing service data according to another embodiment of the present application in conjunction with FIG3. It should be noted that the interaction between the first service node and the authorization authentication server described from the first service node side is the same as that described in FIG1. To avoid repetition, it will not be repeated here. As shown in FIG3, the method includes:

S302, the first service node receives an access request from a business initiator, where the access request is used to request access to target business data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target business data. The target encrypted business data on the chain based on the target business is associated with the identity identifier and the business identifier, and the business identifier is used to identify the access business corresponding to the access request.

S304: The first service node sends the access request to the authorization and authentication server. The authorization and authentication server is configured to perform authorization and authentication on the owner based on the identity identifier, and respond to the access request based on the result of the authorization and authentication.

Optionally, as an embodiment, the target encrypted service data is obtained by encrypting the target service data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner.

Optionally, as an embodiment, in S304, the first service node sending the access request to the authorization authentication server includes: sending the access request and target encrypted service data to the authorization authentication server. In this case, if the authorization authentication passes, the authorization authentication server decrypts the target encrypted service data using the second decryption key corresponding to the second encryption key to obtain target initial decrypted service data, and then sends the target initial decrypted service data to the first service node. After receiving the target initial decrypted service data, the first service node decrypts the target initial decrypted service data using the first decryption key corresponding to the first encryption key to obtain the target service data and sends it to the service initiator.

Optionally, as an embodiment, the method shown in Figure 3 also includes: receiving a second decryption key corresponding to a second encryption key sent by the authorization authentication server; using the first decryption key and the second decryption key corresponding to the first encryption key to decrypt the target encrypted business data to obtain the target business data and then sending it to the business initiator.

Optionally, as an embodiment, the method shown in FIG3 further includes: sending an access request and a service identifier to an authorization authentication server. In this case, the authorization authentication server establishes and stores an association between the authentication record data for authorization authentication, the identity identifier, and the service identifier. After determining a hash value of the authentication record data, the server establishes an association between the hash value, the identity identifier, and the service identifier, and sends the hash value to the first service node. The first service node synchronizes the hash value with a node in the blockchain, thereby uploading the hash value to the blockchain.

Optionally, as an embodiment, the first service node receives the hash value, the electronic certificate of the owner and the electronic certificate of the authorization authentication server; the first service node synchronizes the hash value, the electronic certificate of the owner and the electronic certificate of the authorization authentication server to a node in the blockchain.

The following describes in detail a method for accessing service data according to another embodiment of the present application in conjunction with FIG4. It should be noted that the interaction between the first service node and the authorization authentication server described from the authorization authentication server side is the same as that described in FIG1. To avoid repetition, it will not be repeated here. As shown in FIG4, the method includes:

S402: The authorization authentication server receives an access request sent by a first service node. The access request is sent by a service initiator to the first service node. The access request is used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. Target encrypted service data on the blockchain based on the target service data is associated with the identity identifier and the service identifier, and the service identifier is used to identify the access service corresponding to the access request.

S404, the authorization authentication server performs authorization authentication on the owner based on the identity identifier;

S406: The authorization authentication server responds to the access request based on the authorization authentication result.

Optionally, as an embodiment, the target encrypted service data is obtained by encrypting the target service data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner.

Optionally, as an embodiment, before S404, the method shown in FIG4 further includes: receiving target encrypted service data sent by the first service node. Correspondingly, in S406, if the authorization authentication is successful, the authorization authentication server decrypts the target encrypted service data using the second decryption key corresponding to the second encryption key to obtain target initial decrypted service data; and sends the target initial decrypted service data to the first service node, so that the first service node performs a program on the target initial decrypted service data to obtain the target service data and then sends it to the service initiator, and the first service node decrypts the target initial decrypted service data using the first decryption key corresponding to the first encryption key.

Optionally, as an embodiment, in S406, when the authorization authentication is passed, the second decryption key corresponding to the second encryption key is sent to the first service node, so that the first service node decrypts the target encrypted business data to obtain the target business data and then sends it to the business initiator; wherein, the first service node uses the second decryption key and the first decryption key corresponding to the first encryption key to decrypt the target encrypted business data.

Optionally, as an embodiment, in S402, the access request and the business identifier sent by the first service node are received; correspondingly, the method shown in Figure 4 also includes: establishing and storing an association relationship between the authentication record data of the authorized authentication, the identity identifier and the business identifier; determining the hash value of the authentication record data, establishing an association relationship between the hash value and the identity identifier and the business identifier, and sending the hash value to the first service node, so that the first service node synchronizes the hash value to the node in the blockchain to realize the hash value on-chain.

Optionally, as an embodiment, the authorization authentication server sends the hash value, the electronic certificate of the owner, and the electronic certificate of the authorization authentication server to the first service node.

Optionally, as an embodiment, in S404, the authorization authentication server sends an authorization authentication request to the mobile terminal, and the authorization authentication request includes the identity identifier, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier; the authorization authentication server receives the identity authentication response of the mobile terminal, and the identity authentication response includes the authentication record data.

Optionally, as an embodiment, the authorization authentication request further includes authorization authentication mode indication information, and the authorization authentication mode indication information is used to indicate an authentication mode adopted by the mobile terminal for authorization authentication.

Optionally, as an embodiment, the authorization authentication record data includes at least one of the authorization authentication time, the identifier of the mobile terminal, the identity identifier, the authorization verification result, and the information to be verified collected during the authorization authentication process.

The following describes a method for accessing business data according to a specific embodiment of the present application, in conjunction with a business data access system according to an embodiment of the present invention. As shown in Figure 5, the system includes a business data provider, a business initiator, a blockchain, an identity authentication center, and a mobile identity authentication device. The business data provider in Figure 5 can be understood as the sender, and the business initiator can be understood as the receiver. The blockchain includes smart contracts, a communication module, and a blockchain database. The identity authentication center includes a user key encryption and decryption module, a user information management module, an authentication data index module, an identity authentication module, and an identity authentication database.

Based on the system architecture shown in Figure 5, the sender uploads the original data (data) and the sender's digital signature to the sending node in the blockchain. The sending node runs a smart contract and encrypts data using the public key of the corresponding receiving node, generating the ciphertext (data'). The node then calls the identity authentication center interface, obtains the user's public key from the user key encryption and decryption module, and uses the user's public key to encrypt data' to generate the ciphertext (data",). The sending node then packages data", along with the sender's digital signature, the sender's unique index, the receiver's unique index, and the association between data", the user's unique index, and the service's unique index, into a digital envelope. The node then synchronizes the digital envelope with the nodes in the blockchain via the communication module, storing it in the blockchain database. Through this process, the user data associated with a user stored in the blockchain database has the data structure shown in Figure 6: user data includes the user's unique index, service unique index, encrypted data, receiver's unique index, sender's unique index, and the sender's digital signature.

When the receiving direction sends an access request to the receiving node in the blockchain, the receiving node forwards the "data" and the access request to the identity authentication center by running the smart contract. The identity authentication module in the identity authentication center communicates with the mobile identity authentication device based on the access request and the user unique index information stored in the user information association module to complete the authentication of the owner of the data. After the authentication is completed, the identity authentication module stores the authentication result data in the identity authentication database. The authentication data index module will establish an association relationship between the authentication result data and the user unique index and the business unique index, and store the association relationship in the identity authentication database. The authentication data index module determines the hash value of the authentication result data, establishes an association relationship between the hash value and the user unique index and the business unique index, and stores the association relationship in the identity authentication database. The data is stored in the blockchain database, and the Hash value is uploaded to the chain by communicating with the receiving node. Specifically, when the Hash value is uploaded to the chain, the authentication data index module sends the Hash value, the association between the Hash and the user unique index, the business unique index, the user digital signature, and the identity authentication center digital signature to the receiving node to upload this information to the chain. Through this process, the user authentication record data related to a user stored in the blockchain database has the data structure shown in Figure 6, that is, the user authentication record data includes the user unique index, the business unique index, the authentication result data Hash value, the user digital signature, and the identity authentication center digital signature. The user data and the user authentication record data are associated through the user unique index and the business unique index, and the user authentication record data is associated with the identity authentication database through the Hash value.

When the identity authentication center confirms that the identity authentication is successful, the identity authentication center decrypts data" through the user key encryption and decryption module to obtain data' and sends it to the receiving node. The receiving node uses its own private key to decrypt data' to obtain data and sends data to the recipient.

It should be noted that the communication process between the blockchain node and the identity authentication center in FIG5 is similar to the communication process between the first service node, the second service node, and the authorization authentication server in the embodiments described in FIG1 to FIG4 , and the specific details are not repeated here. Furthermore, the communication process between the identity authentication center and the mobile identity authentication device is similar to the communication process between the authorization authentication server and the mobile terminal in the embodiments described in FIG1 to FIG4 , and the specific details are not repeated here.

As can be seen, the system architecture in Figure 5 not only ensures data privacy protection between the sending and receiving parties, but also, through the introduction of an identity authentication center and encryption and decryption mechanisms, ensures that data is shared only after the user's authorization, thus meeting the user's requirements for data security and privacy to the greatest extent possible. Furthermore, user authentication results are uploaded to the blockchain, and the user's authorization intention is retained on the blockchain, facilitating subsequent audits and oversight.

FIG7 is a system for accessing business data according to an embodiment of the present application, including a first service node and an authorization authentication server; wherein,

A first service node receives an access request from a service initiator, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request;

The first service node sends an access request to the authorization and authentication server;

The authorization and authentication server performs authorization and authentication on the owner based on the identity identifier;

The authorization and authentication server responds to the access request based on the authorization and authentication result.

It should be noted that the business data access system shown in FIG. 7 can execute the methods shown in FIG. 1 and FIG. 2 and achieve the same technical effects, which will not be described in detail here.

The electronic device according to an embodiment of the present application will be described in detail below with reference to FIG8 . Referring to FIG8 , at the hardware level, the electronic device includes a processor, and optionally, an internal bus, a network interface, and a memory. Among them, the memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

The processor, network interface, and memory can be interconnected via an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. These buses can be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG8 shows only one bidirectional arrow, but this does not imply that there is only one bus or only one type of bus.

The memory is used to store programs. Specifically, the program may include program code, which includes computer operating instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

The processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs it, forming an access device for business data at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

Receive an access request from a business initiator, where the access request is used to request access to target business data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target business data. The target encrypted business data on the chain based on the target business is associated with the identity identifier and the business identifier, and the business identifier is used to identify the access business corresponding to the access request.

The access request is sent to an authorization and authentication server, which is used to perform authorization and authentication on the owner based on the identity identifier and respond to the access request based on the result of the authorization and authentication.

The method performed by the first service node disclosed in the embodiment shown in FIG3 of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the method can be completed by hardware integrated logic circuits in the processor or by software instructions. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

The electronic device can also execute the methods of Figures 1 and 2 and implement the functions of the first service node in the embodiments shown in Figures 1 and 2, which will not be described in detail in the embodiments of the present application.

Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

The present application also provides a computer-readable storage medium that stores one or more programs. The one or more programs include instructions. When executed by an electronic device including multiple application programs, the instructions enable the electronic device to perform the method of the embodiment shown in FIG. 3 , and are specifically configured to perform the following method:

Receive an access request from a business initiator, where the access request is used to request access to target business data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target business data. The target encrypted business data on the chain based on the target business is associated with the identity identifier and the business identifier, and the business identifier is used to identify the access business corresponding to the access request.

The access request is sent to an authorization and authentication server, which is used to perform authorization and authentication on the owner based on the identity identifier and respond to the access request based on the result of the authorization and authentication.

The electronic device according to an embodiment of the present application will be described in detail below with reference to FIG9 . Referring to FIG9 , at the hardware level, the electronic device includes a processor, and optionally, an internal bus, a network interface, and a memory. Among them, the memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

The processor, network interface, and memory can be interconnected via an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. These buses can be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG8 shows only one bidirectional arrow, but this does not imply that there is only one bus or only one type of bus.

The memory is used to store programs. Specifically, the program may include program code, which includes computer operating instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

The processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs it, forming an authorization and authentication device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:

The authorization and authentication server receives an access request sent by the first service node. The access request is sent by the service initiator to the first service node. The access request is used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. The target encrypted service data on the blockchain based on the target service data is associated with the identity identifier and the service identifier, and the service identifier is used to identify the access service corresponding to the access request.

The authorization authentication server performs authorization authentication on the owner based on the identity identifier;

The authorization authentication server responds to the access request based on the result of the authorization authentication.

The method performed by the authorization authentication server disclosed in the embodiment shown in FIG4 of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor or by software instructions. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

The electronic device can also execute the methods of Figures 1 and 2, and implement the functions of the authorization authentication server in the embodiments shown in Figures 1 and 2, and the embodiments of this application will not be repeated here.

Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

The present application also provides a computer-readable storage medium that stores one or more programs. The one or more programs include instructions. When executed by an electronic device including multiple application programs, the instructions enable the electronic device to perform the method of the embodiment shown in FIG. 4 , and are specifically configured to perform the following method:

The authorization and authentication server receives an access request sent by the first service node. The access request is sent by the service initiator to the first service node. The access request is used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. The target encrypted service data on the blockchain based on the target service data is associated with the identity identifier and the service identifier, and the service identifier is used to identify the access service corresponding to the access request.

The authorization authentication server performs authorization authentication on the owner based on the identity identifier;

The authorization authentication server responds to the access request based on the result of the authorization authentication.

FIG10 is a schematic diagram of the structure of a device for accessing business data according to an embodiment of the present application. Referring to FIG10 , in a software implementation, the device for accessing business data 1000 may include: a receiving unit 1001 and a sending unit 1002, wherein:

Receiving unit 1001 receives an access request from a service initiator, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, target encrypted service data on the blockchain based on the target service being associated with the identity identifier and service identifier, the service identifier being used to identify the access service corresponding to the access request;

The sending unit 1002 sends the access request to the authorization and authentication server. The authorization and authentication server is configured to perform authorization and authentication on the owner based on the identity identifier and respond to the access request based on the result of the authorization and authentication.

Optionally, as an embodiment, the target encrypted service data is obtained by encrypting the target service data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner.

Optionally, as an embodiment, the sending unit 1002:

Send the access request and target encrypted service data to the authorization authentication server.

Optionally, as an embodiment, the receiving unit 1001:

Receive a second decryption key corresponding to the second encryption key sent by the authorization authentication server;

The sending unit 1002:

The target encrypted service data is decrypted using the first decryption key and the second decryption key corresponding to the first encryption key to obtain the target service data, which is then sent to the service initiator.

Optionally, as an embodiment, the sending unit 1002:

Send the access request and service ID to the authorization and authentication server.

Optionally, as an embodiment, the receiving unit 1001:

Receiving the hash value, the electronic certificate of the owner, and the electronic certificate of the authorization authentication server;

The sending unit 1002 synchronizes the hash value, the electronic certificate of the owner, and the electronic certificate of the authorization authentication server to a node in the blockchain.

The device for accessing business data in the embodiment of the present application can also execute the method executed by the first service node in Figures 1 and 2, and realize the functions of the first service node in the embodiments shown in Figures 1 and 2, which will not be repeated here.

FIG11 is a schematic diagram of the structure of an authorization and authentication device according to an embodiment of the present application. Referring to FIG11 , in a software implementation, the authorization and authentication device 1100 may include: a transceiver unit 1101 and a processing unit 1102, wherein:

The transceiver unit 1101 receives an access request sent by a first service node. The access request is sent by a service initiator to the first service node. The access request is used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. The target encrypted service data on the blockchain based on the target service data is associated with the identity identifier and the service identifier. The service identifier is used to identify the access service corresponding to the access request.

The processing unit 1102 performs authorization authentication on the owner based on the identity identifier;

The processing unit 1102 responds to the access request based on the result of the authorization authentication.

Optionally, as an embodiment, the target encrypted service data is obtained by encrypting the target service data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner.

Optionally, as an embodiment, the transceiver unit 1101 receives target encrypted service data sent by the first service node;

The processing unit 1102 decrypts the target encrypted service data using the second decryption key corresponding to the second encryption key to obtain the target initial decrypted service data when the authorization authentication is passed;

The transceiver unit 1101 sends the target initial decrypted service data to the first service node, so that the first service node performs a program on the target initial decrypted service data to obtain the target service data and then sends it to the service initiator. The first service node uses the first decryption key corresponding to the first encryption key to decrypt the target initial decrypted service data.

Optionally, as an embodiment, the transceiver unit 1101: when the authorization authentication is passed, sends the second decryption key corresponding to the second encryption key to the first service node, so that the first service node decrypts the target encrypted business data to obtain the target business data and then sends it to the business initiator; wherein, the first service node uses the second decryption key and the first decryption key corresponding to the first encryption key to decrypt the target encrypted business data.

Optionally, as an embodiment, the transceiver unit 1101 receives the access request and the service identifier sent by the first service node;

The processing unit 1102 establishes and stores an association relationship between the authentication record data, identity identifier, and business identifier of the authorized authentication; determines a hash value of the authentication record data, establishes an association relationship between the hash value and the identity identifier and the business identifier, and sends the hash value to the first service node through the transceiver unit 1101, so that the first service node synchronizes the hash value to the node in the blockchain, thereby realizing the hash value on-chain.

Optionally, as an embodiment, the transceiver unit 1101 sends the hash value, the electronic certificate of the owner, and the electronic certificate of the authorization and authentication server to the first service node.

Optionally, as an embodiment, the transceiver unit 1101 sends an authorization authentication request to the mobile terminal, wherein the authorization authentication request includes the identity identifier, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier, and receives an identity authentication response from the mobile terminal, wherein the identity authentication response includes the authentication record data.

Optionally, as an embodiment, the authorization authentication request further includes authorization authentication mode indication information, and the authorization authentication mode indication information is used to indicate an authentication mode adopted by the mobile terminal for authorization authentication.

Optionally, as an embodiment, the authorization authentication record data includes at least one of the authorization authentication time, the identifier of the mobile terminal, the identity identifier, the authorization verification result, and the information to be verified collected during the authorization authentication process.

The authorization and authentication device of the embodiment of the present application can also execute the method executed by the authorization and authentication server in Figures 1 and 2, and realize the functions of the authorization and authentication server in the embodiments shown in Figures 1 and 2, which will not be repeated here.

In short, the above description is only a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

Claims (19)

1. A method for accessing business data, comprising: The first service node receives an access request from a service initiator, the access request being used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. Target encrypted service data on the blockchain based on the target service is associated with the identity identifier and the service identifier, which is used to identify the access service corresponding to the access request. The first service node sends the access request to the authorization and authentication server; The authorization authentication server performs authorization authentication on the owner based on the identity identifier; The authorization authentication server responds to the access request based on the result of the authorization authentication; The authorization authentication server performs authorization authentication on the owner based on the identity identifier, including: the authorization authentication server sends an authorization authentication request including the identity identifier to the mobile terminal, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier; the authorization authentication server receives the identity authentication response including authentication record data from the mobile terminal. 2. The method according to claim 1, wherein the target encrypted service data is obtained by encrypting the target service data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner. 3. The method according to claim 2, before the authorization and authentication server performs authorization and authentication on the owner based on the identity identifier, further comprising: The first service node sends the target encrypted service data to the authorization and authentication server; The authorization authentication server responds to the access request based on the result of the authorization authentication, including: If the authorization authentication is passed, decrypting the target encrypted service data using the second decryption key corresponding to the second encryption key to obtain the target initial decrypted service data; The target initial decrypted business data is sent to the first service node, so that the first service node decrypts the target initial decrypted business data to obtain the target business data and then sends it to the business initiator, and the first service node uses the first decryption key corresponding to the first encryption key to decrypt the target initial decrypted business data. 4. The method according to claim 2, wherein the authorization authentication server responds to the access request based on the result of the authorization authentication, comprising: If the authorization authentication is successful, sending the second decryption key corresponding to the second encryption key to the first service node, so that the first service node decrypts the target encrypted service data to obtain the target service data and then sends it to the service initiator; The first service node decrypts the target encrypted service data using the second decryption key and the first decryption key corresponding to the first encrypted data. 5. The method according to any one of claims 1 to 4, wherein the first service node sends the access request to the authorization and authentication server, comprising: The first service node sends the access request and the service identifier to the authorization and authentication server; The method further comprises: The authorization authentication server establishes and stores the authentication record data of the authorization authentication, the association relationship between the identity identifier and the service identifier; The authorization authentication server determines a hash value of the authentication record data, establishes an association relationship between the hash value and the identity identifier and the service identifier, and sends the hash value to the first service node; The first service node synchronizes the hash value to a node in the blockchain to implement on-chain storage of the hash value. 6. The method according to claim 5, wherein sending the hash value to the first service node comprises: Sending the hash value, the electronic certificate of the owner, and the electronic certificate of the authorization authentication server to the first service node; The first service node synchronizing the hash value to a node in the blockchain includes: The first service node synchronizes the hash value, the electronic certificate of the owner, and the electronic certificate of the authorization authentication server to a node in the blockchain. 7. The method according to claim 1, wherein the authorization authentication request further includes authorization authentication mode indication information, and the authorization authentication mode indication information is used to indicate the authentication mode adopted by the mobile terminal for authorization authentication. 8. The method according to claim 7, wherein the authentication record data includes at least one of the authorization authentication time, the identifier of the mobile terminal, the identity identifier, the authorization verification result, and the information to be verified collected during the authorization authentication process. 9. The method according to any one of claims 1 to 4, further comprising: The second service node receives the target service data sent by the service data provider; The second service node encrypts the target service data using a first encryption key corresponding to the first service node and a second encryption key corresponding to the owner to obtain the target encrypted service data; The second service node synchronizes the target encrypted business data to the node of the blockchain to achieve the on-chain of the target encrypted business data. 10. The method according to claim 9, further comprising: The second service node invokes a communication interface between the second service node and the authorization authentication server to obtain a second encryption key corresponding to the owner. 11. A method for accessing business data, comprising: The first service node receives an access request from a service initiator, the access request being used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. Target encrypted service data on the blockchain based on the target service is associated with the identity identifier and the service identifier, which is used to identify the access service corresponding to the access request. The first service node sends the access request to the authorization and authentication server, and the authorization and authentication server is used to send the authorization and authentication request including the identity identifier to the mobile terminal, so that the mobile terminal authorizes and authenticates the owner based on the identity identifier, and receives the identity authentication response including the authentication record data from the mobile terminal. 12. A method for accessing business data, comprising: The authorization and authentication server receives an access request sent by the first service node. The access request is sent by the service initiator to the first service node. The access request is used to request access to target service data on the blockchain. The access request includes an identity identifier, which is used to identify the owner of the target service data. The target encrypted service data on the blockchain based on the target service data is associated with the identity identifier and the service identifier, and the service identifier is used to identify the access service corresponding to the access request. The authorization authentication server performs authorization authentication on the owner based on the identity identifier; The authorization authentication server responds to the access request based on the result of the authorization authentication; The authorization authentication server performs authorization authentication on the owner based on the identity identifier, including: the authorization authentication server sends an authorization authentication request including the identity identifier to the mobile terminal, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier; the authorization authentication server receives the identity authentication response including authentication record data from the mobile terminal. 13. A business data access system comprising: A first service node receives an access request from a service initiator, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; The first service node sends the access request to the authorization and authentication server; The authorization authentication server performs authorization authentication on the owner based on the identity identifier; The authorization authentication server responds to the access request based on the result of the authorization authentication; The authorization authentication server performs authorization authentication on the owner based on the identity identifier, including: the authorization authentication server sends an authorization authentication request including the identity identifier to the mobile terminal, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier; the authorization authentication server receives the identity authentication response including authentication record data from the mobile terminal. 14. A device for accessing business data, comprising: A receiving unit receives an access request from a service initiator, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify a person to whom the target service data belongs, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; The sending unit sends the access request to the authorization authentication server, and the authorization authentication server is used to send the authorization authentication request including the identity identifier to the mobile terminal, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier, and receives the identity authentication response including the authentication record data from the mobile terminal. 15. An authorization authentication device, comprising: A transceiver unit receives an access request sent by a first service node, the access request being sent by a service initiator to the first service node, the access request being used to request access to target service data on a blockchain, the access request including an identity identifier, the identity identifier being used to identify a person to whom the target service data belongs, target encrypted service data on the blockchain based on the target service data being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; A processing unit, performing authorization authentication on the owner based on the identity identifier; The processing unit responds to the access request based on the result of the authorization authentication; Among them, the processing unit authorizes and authenticates the owner based on the identity identifier, including: the processing unit sends an authorization and authentication request including the identity identifier to the mobile terminal, so that the mobile terminal authorizes and authenticates the owner based on the identity identifier; the processing unit receives the identity authentication response including authentication record data from the mobile terminal. 16. An electronic device comprising: processor; and a memory arranged to store computer-executable instructions which, when executed, cause the processor to: Receive an access request from a service initiator, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; The access request is sent to the authorization authentication server, which is used to send the authorization authentication request including the identity identifier to the mobile terminal, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier, and receives the identity authentication response including the authentication record data from the mobile terminal. 17. An electronic device comprising: processor; and a memory arranged to store computer-executable instructions which, when executed, cause the processor to: Receiving an access request sent by a first service node, the access request being sent by a service initiator to the first service node, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, target encrypted service data on the blockchain based on the target service data being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; Based on the identity identifier, authorization and authentication are performed on the owner; Respond to the access request based on the result of the authorization authentication; Among them, based on the identity identifier, authorizing and authenticating the owner includes: sending an authorization and authentication request including the identity identifier to the mobile terminal, so that the mobile terminal authorizes and authenticates the owner based on the identity identifier; and receiving an identity authentication response including authentication record data from the mobile terminal. 18. A computer-readable medium storing one or more programs that, when executed by an electronic device including a plurality of application programs, causes the electronic device to perform the following operations: Receive an access request from a service initiator, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, and the target encrypted service data on the blockchain based on the target service being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; The access request is sent to the authorization authentication server, which is used to send the authorization authentication request including the identity identifier to the mobile terminal, so that the mobile terminal performs authorization authentication on the owner based on the identity identifier, and receives the identity authentication response including the authentication record data from the mobile terminal. 19. A computer-readable medium storing one or more programs that, when executed by an electronic device including a plurality of application programs, causes the electronic device to perform the following operations: Receiving an access request sent by a first service node, the access request being sent by a service initiator to the first service node, the access request being used to request access to target service data on the blockchain, the access request including an identity identifier, the identity identifier being used to identify the owner of the target service data, target encrypted service data on the blockchain based on the target service data being associated with the identity identifier and the service identifier, the service identifier being used to identify the access service corresponding to the access request; Based on the identity identifier, authorization and authentication are performed on the owner; Respond to the access request based on the result of the authorization authentication; Among them, based on the identity identifier, authorizing and authenticating the owner includes: sending an authorization and authentication request including the identity identifier to the mobile terminal, so that the mobile terminal authorizes and authenticates the owner based on the identity identifier; and receiving an identity authentication response including authentication record data from the mobile terminal.