Systems, methods and equipment for building trusted data resources and tradable data assets

Abstract

The present invention discloses a system, method and equipment for constructing trusted data resources and tradable data assets, and relates to the fields of data elements and data governance technology. The construction system includes a network communication module, a digital rights certification module, a data policy module and a data evidence module; the data policy module includes a permission allocator, a policy configurator and a data encapsulator; the data evidence module includes a workspace, an evidence bucket, an asset bucket and a transaction bucket; the permission allocator, the policy configurator and the data encapsulator are respectively connected to the data policy module; the workspace, the evidence bucket, the asset bucket and the transaction bucket are respectively connected to the data evidence module; the benefits are that users remotely collect business data, automatically store data resources, independently construct data assets, and connect to various forensic platforms and commercial service platforms in the national data governance system, so as to achieve five basic standards such as data security and anti-tampering, traceable data source, complete and credible evidence, circulated packaging specifications, and clear and verifiable digital rights.

Description

Technical Field

[0001] The present invention relates to the field of data elements and data governance technology, and more specifically, to systems, methods and equipment for constructing trusted data resources and tradable data assets. Background Art

[0002] With the rapid development of computer and network technology, data has become the core resource and national infrastructure for contemporary economic and social progress. Artificial intelligence AI and the virtual world of the metaverse are indispensable based on data. Data is a reflection of the real world. It comes from nature, from human production, life and cultural creation. However, massive data is inevitably mixed with some erroneous data, invalid data, and data that has been tampered with unintentionally or maliciously. How to identify and exclude these unreliable data has become a difficult problem that needs to be solved urgently; the public and social institutions’ verification and verification of data rights and interests, data integrity and credibility are also the focus of general concern.

[0003] In the real world, enterprises and institutions in all walks of life are the origin of data, the most important and primary source of data and destination of data reuse, and the implementation place of data transformation into new quality productivity. Given that data elements and data assets are relatively new technical directions, there is an urgent need for user-level (enterprise-level) and easy-to-popular equipment for building trusted data resources and data assets.

[0004] However, there are many different opinions in academia and industry about what specific problems need to be solved and what basic standards should be achieved for the data resources and data assets built by users. Researchers and practitioners have summarized five common and basic problems faced by the construction and circulation of data resources and data assets:

[0005] Question 1: How to determine the credibility of data resources?

[0006] Question 2: How to ensure the integrity of data resources.

[0007] Question 3: How to trace the source of data assets.

[0008] Question 4: How to define the owner of data asset rights and interests.

[0009] Question 5: How to achieve global exchange of data resources and data assets? Summary of the invention

[0010] The purpose of the present invention is to provide a system for constructing trusted data resources and tradable data assets (backend trusted data engine) to solve the problems existing in the above-mentioned background technology and to provide specific technical implementation solutions.

[0011] The above technical objectives of the present invention are achieved through the following technical solutions:

[0012] In the first aspect, the present application provides a system for building trusted data resources and tradable data assets, including a network communication module, a digital rights certification module, a data strategy module, and a data storage module; among which:

[0013] The network communication module is used for the user intranet; the data policy module includes a permission allocator, a policy configurator, and a data encapsulator; the data evidence module includes a workspace, an evidence bucket, an asset bucket, and a transaction bucket; the digital rights visa module, the data policy module, and the data evidence module are respectively connected to the network communication module; the permission allocator, the policy configurator, and the data encapsulator are respectively connected to the data policy module; the workspace, the evidence bucket, the asset bucket, and the transaction bucket are respectively connected to the data evidence module.

[0014] Based on the above technical solution, the present invention can also be improved as follows.

[0015] Furthermore, the above-mentioned network communication module is used to connect the computer business processing system of the headquarters and the computer business processing system of the remote branch, and when the user has no remote branch, a local area network is used; when the user has a remote branch, the Internet or a software-defined wide area network is used.

[0016] Furthermore, the above-mentioned digital rights visa module receives Beidou timing and positioning information through the built-in Beidou satellite information receiving device and connects to the third-party trusted timing service platform; it also determines the user's network identification and performs password-related processing through the built-in digital identification device based on the PKI / DPKI cryptographic system.

[0017] Furthermore, in the above data strategy module,

[0018] Permission distributor, used to manage data sharing access rights of personnel in various positions;

[0019] Policy configurator, used to set and control working parameters, including periodic timing, data source point, data filtering selection conditions, data arrangement and reorganization rules, and data sensitivity level;

[0020] The data encapsulator is used to encapsulate and solidify data in a standardized format into a data bucket that is secure and reliable, easy to circulate, and supports ownership confirmation and traceability.

[0021] Furthermore, in the above data storage module,

[0022] Workspace, used to capture users’ daily business data;

[0023] The evidence bucket is used to store data that is regularly copied to the workspace and convert it into a trusted data resource;

[0024] Asset buckets are used to store data that is periodically extracted from one or more evidence buckets and convert them into tradable data assets;

[0025] The transaction bucket is used to store data that is selected from trusted data resources and / or tradable data assets from time to time and make it available for external release.

[0026] Furthermore, the above workspace is connected to the user's original business system through the computer OS layer, collects the first-hand data generated by the daily business of each position of the user, and saves it in a conventional storage medium;

[0027] The evidence bucket periodically copies the data in the workspace incrementally or in full at a set time, and uses a data encapsulator to encapsulate and solidify the copied data and save it in a WORM storage medium;

[0028] Asset buckets periodically extract data from data resources at set times, and use data encapsulators to encapsulate and solidify the extracted data and store it in WORM storage media;

[0029] Transaction buckets are used to select data from data resources and / or data assets from time to time, and to encapsulate and solidify the selected data through a data encapsulator and store it in a removable storage medium. Transaction buckets are also used for external publishing or transaction circulation.

[0030] User data in the evidence bucket, asset bucket, and transaction bucket all have a traceability locator for tracing its source. The traceability locator is a string containing the data bucket number, directory name, file name, and byte offset or KEY value.

[0031] Furthermore, the above-mentioned trusted data resources are composed of a series of evidence buckets, each of which contains data that has been encapsulated and solidified by a data encapsulator, and each of which has been added with a data lock issued by a digital rights certification module and an electronic signature of a user network identifier;

[0032] Each bucket in a series of buckets also contains a secret personal key, which is used to encrypt user data in the bucket to protect user data privacy and / or property rights;

[0033] The data authentication lock is a confidential data generated by cryptographic algorithms and trusted timing, which is used to verify the credibility and integrity of the data bucket, and supports the public to use the public key of the timing service platform and / or the public key of the electronic signer of this data bucket for self-service verification.

[0034] Furthermore, the above-mentioned tradable data assets are composed of a series of asset buckets. The data of each asset bucket contained in the series of asset buckets has been encapsulated and solidified by the data encapsulator, and each asset bucket has been added with a data certificate lock issued by the digital rights certification module and an electronic signature of the user network identifier; the data in the series of asset buckets are extracted from trusted data resources, wherein the user data file has a traceability locator;

[0035] Each asset bucket in a series of asset buckets also has a secret individual key, which is used to encrypt the key of the user data in this data bucket to protect the privacy and / or property rights of the user data;

[0036] The data authentication lock is a confidential data generated by cryptographic algorithms and trusted timing, which is used to verify the credibility and integrity of the data bucket, and supports the public to use the public key of the timing service platform and / or the public key of the electronic signer of this data bucket for self-service verification.

[0037] Furthermore, the above data buckets include evidence buckets, asset buckets and transaction buckets, and the data buckets are created by a data encapsulator with built-in standardized data bucket encapsulation specifications;

[0038] The data structure of a data bucket includes a globally unique number, name, multi-level directories, and files;

[0039] Multi-level directories, including a data bucket directory created by the data wrapper according to the specification, a data type directory under the data bucket directory, a user declaration directory, and a user data directory;

[0040] The data bucket directory is used to store the certificate lock file, password algorithm file, and data bucket header file created by the data encapsulator according to the specification;

[0041] Data type directory, used to save user data type files;

[0042] User declaration directory, used to store files that describe user data;

[0043] The user data directory is used to store user data or files of data access paths, and the user data directory can be encrypted.

[0044] On the second aspect, the present application provides a method for building trusted data resources and tradable data assets, using any of the methods described in M1.1-M3 of claim 9 to flexibly develop electronic computer-based functional components, software / firmware, module products or complete vertical industry practical systems according to actual business needs to achieve the construction of data resources and / or data assets.

[0045] In the third aspect, the present application provides an electronic equipment, including a network communication component, a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method described in any one of M1.1-M3 in claim 9 is used to partially or completely construct trusted data resources and / or tradable data assets.

[0046] Compared with the prior art, the present invention has at least the following beneficial effects:

[0047] 1. In this application, the proposed construction system solves the three major defects of electronic files (data) when used as judicial evidence, namely, they leave no trace of modification, are extremely easy to tamper with, and are extremely easy to lose. In the technical combination of the present invention (WORM+data bucket+solid evidence lock), the three major defects of electronic files are completely eliminated, and electronic files can be falsified, not easily tampered with, and not easily lost. This lays a solid foundation for the basic technical theory support for data factorization and data becoming the fifth productive force.

[0048] 2. In this application, through the construction system, users can remotely and automatically collect business data, automatically store data resources, independently build data assets, connect to various legal certification platforms (such as property rights confirmation and evaluation and transaction entry) in the national data governance system, and enable the data resources and data assets built by users to meet the five basic user-level (enterprise-level) standards of (A) data security and anti-deletion and modification, (B) traceability of data sources, (C) complete and credible evidence, (D) packaging specifications and circulation, and (E) clear and verifiable digital rights.

[0049] 3. In this application, since most users nowadays have realized computer informatization of internal business processing, the present invention adds four necessary modules to the user's original business processing system, without changing the original business process and employee operations, to achieve "seamless docking". "Self-contacting docking" can protect the user's original IT investment to the greatest extent, and it is also convenient for the promotion and application of this application. The digital rights visa module is the gateway for users to connect to the external network world (externally known as the "digital rights gateway"). It holds the user's global network identification and unified trusted time base, which can eliminate the data island phenomenon. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0051] Figure 1 A schematic diagram of a data management system architecture in an embodiment of the present invention;

[0052] Figure 2A schematic diagram of the deployment of a system for constructing trusted data resources and tradable data assets in an embodiment of the present invention;

[0053] Figure 3 Schematic diagram of a digital rights visa module and a data policy module in an embodiment of the present invention;

[0054] Figure 4 Schematic diagram of a data evidence storage module in an embodiment of the present invention;

[0055] Figure 5 A schematic diagram of a trusted data conversion closed loop supported by AI in an embodiment of the present invention;

[0056] Figure 6 It is a schematic diagram of a fully automatic geographical indication product supply chain management system in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0058] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0060] The following is a detailed description of the technical principles and implementation methods of the trusted data resource and tradable data asset construction system in conjunction with the accompanying drawings. To facilitate implementation and avoid confusion with common terms in the same text, explanations of terms with specific meanings in the embodiments are first given.

[0061] Terminology explanation:

[0062] Native data: First-hand business data from the front line of the industry, whose addressable or locatable reference units (reference units) of data records are electronic files. The reference unit is not the smallest data particle, and the locator can be used to further address smaller data items.

[0063] Data resources: originated from original data, reorganized, and packaged into a series of record units that comply with data governance standards.

[0064] Data assets: (one or more) record units extracted from data resources, reorganized, and packaged and solidified into a series of record units that comply with data governance specifications.

[0065] Data bucket: A single record unit with a standardized data organization structure, a general term for various buckets in this patent.

[0066] Workspace: A storage space for recording raw data. The workspace is not encapsulated or solidified, and allows addition, deletion, modification, and query.

[0067] Evidence bucket: A single record unit in a data resource. Once an evidence bucket is packaged and solidified (commonly known as sealing the bucket), it cannot be added, deleted, or modified. The evidence bucket is chronological.

[0068] Asset bucket: A single record unit in data assets. Once an asset bucket is packaged and solidified (commonly known as sealed), it cannot be added, deleted, or modified. Asset buckets are chronological.

[0069] Trading bucket: A data bucket that can be independently transmitted and used for global data circulation. The trading bucket is a secure and controllable global universal (commodity) data container. Given that the trading bucket is exposed to an unsafe environment, its integrity and credibility must be verified before use.

[0070] Chronological: refers to evidence buckets and asset buckets, which are created and solidified periodically at set times and named in chronological order.

[0071] WORM: A special data storage space (Write Once Read Many), whose physical properties protect data permanently. (Commonly known as electronic paper).

[0072] Solid Evidence Lock: A special confidential data that combines the four data asset elements of data, data creation time and space, data rights holders and their electronic signatures, and applies cryptographic protection to them. The solid evidence lock supports self-service verification by the public.

[0073] Locator: A string used to trace the source of data. All traceable data, through the locator, forms a directed acyclic graph (DAG).

[0074] Forensic platform: The national data governance system provides a compliance certification service platform for various relevant laws and regulations required by law for any data asset project, including title confirmation, evaluation, entry into tables, transactions, etc.

[0075] Embodiment 1: This embodiment provides a system for constructing trusted data resources and tradable data assets, including a network communication module, a digital rights certification module, a data policy module and a data evidence module; wherein: the network communication module is used for the user intranet; the data policy module includes a permission allocator, a policy configurator, and a data encapsulator; the data evidence module includes a workspace, an evidence bucket, an asset bucket and a transaction bucket; the digital rights certification module, the data policy module and the data evidence module are respectively connected to the network communication module; the permission allocator, the policy configurator, and the data encapsulator are respectively connected to the data policy module; the workspace, the evidence bucket, the asset bucket, and the transaction bucket are respectively connected to the data evidence module.

[0076] Optionally, the above-mentioned network communication module is used to connect the computer business processing system of the headquarters and the computer business processing system of the remote branch, and when the user has no remote branch, a local area network is used; when the user has a remote branch, the Internet or a software-defined wide area network is used.

[0077] Among them, when users have remote branches and use SD-WAN network to access these remote branches, they can choose third-party mature product SD-WAN (Software Defined Wide Area Network) because of its flexible networking, secure transmission, and data packet delivery. Through SD-WAN, users' originally scattered business data can be aggregated to the data storage module of the headquarters, and at the same time, centralized management of users' internal shared data access rights can be achieved.

[0078] Optional, the above digital rights visa module, such as Figure 3 As shown, the built-in Beidou satellite information receiving device is used to receive Beidou timing and positioning information and connect to a third-party trusted timing service platform; the built-in digital identification device based on the PKI / DPKI cryptographic system is also used to determine the user's network identification and execute corresponding password processing.

[0079] Among them, the digital rights certification module gives data credibility four objective and necessary elements: when, where, what, and who (WHEN WHERE WHAT WHO). These four objective elements are the four internationally recognized necessary conditions for the credibility of data or information (such as the field of international news agency news wires). Specifically, using cryptographic algorithms and Beidou timing positioning devices or third-party timing services, a data certificate lock for a specific data bucket is generated, and using PKI / DPKI digital identification devices, the user's network identity is determined, and a hash fingerprint and electronic signature for a specific data bucket are generated.

[0080] Specifically, the digital rights certification module is also the gateway for the user's internal computer system to connect to the external network world. The data equipment provided by the present invention does not exist in isolation. It is the user-level (enterprise or institution) basic unit of the national data governance system (called "data engine"). In addition to the various internal functions mentioned above, the digital rights certification module is also a connector for connecting to the national trusted shared data space and forensic platform and commercial platform. On the premise of ensuring user data rights and network security, it enables user data resources and data assets to be integrated into the global data circulation, sharing, verification and transaction.

[0081] Optional, such as Figure 3 As shown, in the above data strategy module,

[0082] The permission distributor is used to manage the data sharing access rights of personnel in different positions of the user; that is, different data access rights are granted to personnel in different business positions within the user or the applications they operate, so as to achieve safe and orderly data sharing;

[0083] Policy configurator, used to set and control working parameters, including periodic timing, data source point, data filtering selection conditions, data arrangement and reorganization rules, and data sensitivity level;

[0084] The data encapsulator is used to encapsulate and solidify data in a standardized format into a data bucket that is secure, reliable, easy to circulate, and supports property rights confirmation and traceability. After the data resources and data assets are formed, they are not only shared and used internally by users, but also need to be connected to various forensic platforms in the external national data governance system to obtain legally effective data rights confirmation, value assessment, transaction transfer and other statutory certifications. This requires unified standardization of the "packaging" and record structure of the data so that they can be mutually recognized and interoperable when circulated nationwide. In this embodiment, the "data bucket" is uniformly used as a package for data migration, storage and transmission. It has a standardized, normative, easy-to-exchange, secure, controllable and publicly verifiable data structure.

[0085] Optional, such as Figure 4 As shown, in the above data storage module,

[0086] Workspace, used to capture the daily business data of users, wherein the daily business data is the business data generated by the business processing system collected through the user's intranet;

[0087] The evidence bucket is used to store data that is regularly copied to the workspace and convert it into a trusted data resource;

[0088] Asset buckets are used to store data that is periodically extracted from one or more evidence buckets and convert them into tradable data assets;

[0089] The transaction bucket is used to store data that is selected from trusted data resources and / or tradable data assets from time to time and make it available for external release.

[0090] Specifically, the data evidence module belongs to the category of computer external storage devices, but in addition to using conventional data storage media, such as hard disks HDD, solid-state disks SSD, etc., it also uses special storage media: WORM storage media. WORM (WriteOnce Read Many) storage media is a type of large-capacity storage that has the characteristics that once data is written, it cannot be added, modified, deleted, or cleared; among them, the steps for the data evidence module to build data assets include: 1) Collecting users' daily business data (saved in the workspace); 2) Converting the data in the workspace into data resources (saved in the evidence bucket); 3) Converting data resources into data assets (saved in the asset bucket); 4) Converting the selected data into secure, controllable, and publicly releasable data units (saved in the transaction bucket). For the basic data conversion closed-loop process and the subsequent scalable AI-enabled full-featured complete closed-loop process, please refer to the attached Figure 5 .

[0091] Optionally, the above workspace is connected to the user's original business system through the computer OS layer, collects the first-hand data generated by the daily business of each position of the user, and saves it in a conventional storage medium;

[0092] The evidence bucket periodically copies (incrementally or fully) the data in the working bucket at a set time, processes it through a data encapsulator, and encapsulates and solidifies it in the user's data resources. The data in the evidence bucket is stored in a WORM storage medium.

[0093] Asset buckets periodically select data from data resources (a series of evidence buckets) at a set time, and package the selected data into the user's data assets through a data encapsulator. Asset buckets are also stored in WORM storage media.

[0094] A transaction bucket selects data from data resources and / or data assets from time to time, and uses a data encapsulator to encapsulate and solidify the selected data into a storage unit (transaction bucket) for external release. The transaction bucket is stored in a removable storage medium.

[0095] Specifically, the user data in the above-mentioned evidence bucket, asset bucket and transaction bucket all have a traceability locator for tracing its source. The traceability locator is a string containing the data bucket number, directory name, file name and byte offset or KEY value.

[0096] Optionally, the above-mentioned trusted data resource is composed of a series of evidence buckets, each of which has been encapsulated and solidified by a data encapsulator, and each of which has been added with a data lock issued by a digital rights certification module and an electronic signature of a user network identifier; the data in the data resource cannot be added, deleted, altered, or deleted (later) (WORM media guarantee);

[0097] Each bucket in a series of buckets also contains a secret personal key, which is used to encrypt user data in this bucket to protect user data privacy and / or property rights; the personal key makes data "10,000 words and 10,000 secrets", which is a high-intensity cryptographic technology to prevent cracking attacks;

[0098] The data authentication lock is a confidential data generated by cryptographic algorithms and trusted timing, which is used to verify the credibility and integrity of the data bucket, and supports the public to use the public key of the timing service platform and / or the public key of the electronic signer of this data bucket for self-service verification.

[0099] Among them, considering that the generation time of data is of critical significance to its credibility and integrity, and the time must be bound to the data, this embodiment uses a data proof lock to achieve this function; the data proof lock is confidential data calculated using a cryptographic algorithm and trusted timing. The public and institutions can use the public key of the third-party timing platform and / or the public key of the electronic signer of this data bucket to verify the data proof lock by themselves to confirm that the time of the data and the data itself are complete and correct and have not been tampered with.

[0100] Optionally, the tradable data assets are composed of a series of asset buckets, the data of each asset bucket contained in the series of asset buckets has been encapsulated and solidified by a data encapsulator, and each asset bucket has been added with a data certificate lock issued by a digital rights certification module and an electronic signature of a user network identifier; the data in the series of asset buckets are selected from trusted data resources, wherein the user data file has a traceability locator;

[0101] Each asset bucket in a series of asset buckets also has a secret individual key, which is a key used to encrypt user data in this data bucket to protect user data privacy and / or property rights;

[0102] The data authentication lock is a confidential data generated by cryptographic algorithms and trusted timing, which is used to verify the credibility and integrity of the data bucket, and supports the public to use the public key of the timing service platform and / or the public key of the electronic signer of this data bucket for self-service verification.

[0103] Specifically, because the time when data is generated is of key significance to its credibility and integrity, and time must be bound to data, the present invention adopts a data authentication lock to achieve this function. The data authentication lock is confidential data calculated using a cryptographic algorithm and national trusted time synchronization. The public and institutions can use the public key of a third-party time authentication service platform and / or the public key of the electronic signer of this data bucket to verify the data authentication lock by themselves to confirm that the time of the data and the data itself are complete and correct and have not been tampered with.

[0104] Optionally, the above-mentioned data buckets include evidence buckets, asset buckets and transaction buckets, and the data buckets are created by a data encapsulator with built-in standardized data bucket encapsulation specifications; the data structure of the data bucket includes a globally unique number, name, multi-level directory and file; the multi-level directory includes a data bucket directory created by the data encapsulator according to the specification, a data type directory under the data bucket directory, a user declaration directory and a user data directory; the data bucket directory is used to store the evidence lock file, cryptographic algorithm file, and data bucket header file created by the data encapsulator according to the specification; the data type directory is used to store user data type files; the user declaration directory is used to store files that descriptively describe user data; the user data directory is used to store files of user data or data access paths, and the user data directory is allowed to be encrypted.

[0105] Among them, after the successful construction of data resources (a series of evidence buckets) and data assets (a series of asset buckets), they are not only shared and used internally by users, but also need to be connected to various forensic platforms in the external national data governance system to obtain legally effective data rights confirmation, value assessment, and transaction transfer and other legal certifications. This requires unified standardization of the "packaging" and record structure of the data so that the data can be mutually recognized and interoperable when circulated nationwide. This embodiment uniformly uses "data buckets" as data storage and circulation packaging. It is a standardized, normalized, easy-to-exchange, secure, controllable, and verifiable data storage structure.

[0106] Specifically, the transaction bucket is data selected from data resources and / or data assets, which is used for external release, sharing, trading or data migration, and is stored in a conventional removable non-volatile storage medium; the data contained in the transaction bucket has been encapsulated and solidified by the data encapsulator and the electronic signature of the data certificate lock issued by the digital rights certification module and the user network identification has been added; the files in the transaction bucket are marked with traceability locators; the transaction bucket also contains a secret personalized key and a recipient list, which enables the transaction bucket to directly support the sale and purchase of various digital products, including encrypted files, product AI reasoning models, computer software, electronic games, electronic film and television works, product data packages, products with legal electronic trademarks, goods with legal electronic geographical indications, electronic tickets, electronic publications, etc. The transaction bucket may have experienced an unsafe environment during the global data circulation process, and traders must verify its integrity and credibility before using the transaction bucket.

[0107] The present application embodiment provides a method for constructing trusted data resources and tradable data assets, including the following specific steps:

[0108] M1.1 collects business data from the user's business processing system through a computer network and saves it in a work area, which uses conventional erasable media as storage space.

[0109] M1.2 periodically copies the data in the working area to the evidence bucket, which uses WORM media with a "write once" feature as storage space.

[0110] M1.3 periodically extracts the data in the evidence bucket to the asset bucket selectively. The asset bucket uses WORM media with a "write once" feature as storage space.

[0111] M1.4 selectively copies the data in the evidence bucket or asset bucket to the transaction bucket from time to time. The transaction bucket uses removable conventional erasable media or removable WORM media as storage space.

[0112] M1.5 uses a policy configurator to set and control the working parameters of M1.1-M1.4, including cycle timing, data source point (data native position or application), data filtering selection conditions, data arrangement and reorganization rules, and data sensitivity level.

[0113] M1.6WORM media is a magnetic storage, electrical storage, optical storage, organic storage, or software / firmware simulated WORM storage with a "write once" characteristic.

[0114] M2.1 evidence bucket, asset bucket and transaction bucket are collectively referred to as data buckets, which are characterized by: they are created by a data encapsulator, which has built-in standardized data bucket creation specifications. The data bucket includes: a data bucket directory, subordinate sub-directories and files. The subordinate sub-directories include: a data type directory, a user declaration directory and a user data directory.

[0115] M2.2 data bucket directory, used to store the certificate lock file, password algorithm file, and data bucket header file.

[0116] M2.2.1 The data bucket directory has a globally unique number and uses the globally unique number as the directory name, and uses the periodic timing time (applicable to evidence buckets and asset buckets) or creation time (applicable to transaction buckets) set by the policy configurator as the prefix of its globally unique number.

[0117] M2.2.2 The certificate lock file records the data certificate lock, the name of the creator of this data bucket, the creator's public key, and the creator's electronic signature on each component of the bucket structure. The certificate lock file is used to verify the credibility and integrity of this data bucket.

[0118] M2.2.2.1 Data certificate lock is confidential data generated by cryptographic algorithms and trusted timing. It is bound to four credibility factors: all data in the user data directory in this data bucket, the time and space when the data certificate lock was created, the electronic signature of the creator of this data bucket, and the creator's public key. A data bucket can only obtain one data certificate lock.

[0119] M2.2.2.2 Data certificate lock, issued by the digital rights visa module. The digital rights visa module has a built-in Beidou satellite signal receiving device for receiving Beidou timing and positioning. The digital rights visa module also connects to a third-party timing service platform as a second channel for obtaining trusted time. The digital rights visa module also has a built-in digital identification device based on the PKI / DPKI cryptographic system to determine the user's network identification and perform password-related processing.

[0120] M2.2.2.3 Data authentication lock supports self-service verification by the public and institutions. When the verification is passed, the verifier confirms that the integrity and credibility of the data bucket are correct. Otherwise, the integrity of the data bucket has been destroyed and its data is unreliable.

[0121] M2.2.3 Cryptographic algorithm file, used to record the cryptographic materials (CryptoMaterials) used in this data bucket. Cryptographic materials are the cryptographic algorithm, algorithm version, key length used when the user data files in this bucket are encrypted and decrypted, the cryptographic algorithm, algorithm version, key length used when the individual key itself is encrypted and decrypted, and the cryptographic parameters such as the relevant algorithms and versions of the PKI / DPKI cryptographic system used in this data bucket.

[0122] M2.2.4 data bucket header file, used to save the data bucket parameters, including the data bucket specification version number used by this data bucket, the global unique number of this bucket, name, type, associated data bucket list and the number of user files in this bucket.

[0123] M2.3 Data type directory, used to save user data type list files. Data types include user data file name, data type number, data type name, data type specification version number, data type description, and access path of executable code segments or programs bound to this data type. Executable code segments or programs are used to check or process user data compliance.

[0124] M2.4 User declaration directory, used to store descriptive description files, keyword files and summary files provided by users for user data files. The description files, keyword files and summary files have the same name as the user data files but different suffixes. The user declaration directory is used to support special features such as data search, data view and data discovery, and the user declaration directory is open to everyone without encryption.

[0125] M2.5 User data directory, used to store user data files, user signature files, personal key files, traceability files and recipient files. Among them:

[0126] M2.5.1 User data file, used to record the user data itself or the data access path.

[0127] M2.5.2 User signature file, used to record the electronic signature attached to the user data file with the same name.

[0128] M2.5.3 Personalized key file is used to record the encrypted personalized key attached to the user data file with the same name, and the URL for obtaining the corresponding clear personalized key. The user data file itself allows the user to perform personalized encryption. Personalized encryption means that when encrypting files, the encryption keys of different files are different.

[0129] M2.5.4 Traceability file, used to record the list of traceability locators attached to user data files with the same name.

[0130] M2.5.5 Receiver file, used to record one or more receiver information attached to the user data file with the same name, the receiver information includes: when the receiver has a public key, the receiver's public key and the personal key encrypted using the public key; or when the receiver does not have a public key, the receiver's registration number in the user business system and the personal key encrypted using the reserved key under the registration number.

[0131] M2.5.6 Personalized key files, traceability files, recipient files, and user signature files have the same name as the user data file but with a different suffix.

[0132] M3: Evidence bucket, asset bucket and transaction bucket, which are also characterized in that the user data files in their user data directories are marked with traceability locators pointing to their sources. The traceability locator is a string that contains the source data bucket number, directory name, file name, byte offset or KEY value and marked sequence number. The traceability locator (list) is recorded in the traceability file with the same name as the user data file but with a different suffix.

[0133] Example 2: The data resource construction equipment provided in this example is a data governance subsystem deployed in the background, integrated into the existing computer business processing system of thousands of industries, and used to build trusted data resources and tradable data assets; it should be clear that data resources or data assets do not exist in isolation. In the overall architecture of the data governance system, it is located at the bottom third layer (application and data source layer), including a large amount of data information from thousands of industries, thereby supporting the national data governance building; see Figure 1 , Figure 1 The diagram of the overall data governance architecture is shown. It can be seen that the overall architecture is divided into three layers. The data forensic service platform, data business service platform, and national trusted shared storage space of the upper two layers are all located at the industry entity layer (enterprises, individuals, government agencies, etc.), which are used to support them in converting their data into data assets and productivity factors. Because the industry entity is the source of data generation, it is obvious that the standardized data governance within the industry should be prioritized. This embodiment discloses a construction equipment for building trusted data resources and tradable data assets. With this equipment, the industry entity can automatically build data resources, independently refine data assets, and form unified and standardized trusted data resources and data assets across the entire region with the support of the national data governance system, thereby promoting the formation of new quality productivity driven by data.

[0134] Among them, data credibility is an indisputable fundamental and fatal problem of data resources and data assets. If data is false, erroneous, or tampered with, it will lose its reuse value and even cause misleading. Subsequent data governance links, such as confirmation of ownership, evaluation, and transactions, will also completely lose their basis. Looking at the data space, data can be divided into five categories: (1) completely false and fabricated data, which is usually done by humans; (2) data that has been tampered with unintentionally or maliciously, which is usually done by humans; (3) errors or data equipment failures that occur naturally during data transmission, use, or storage, which is a common situation; (4) chaotic and disordered garbage data or time-expired data; (5) data with complete elements, complete structure, and valid time. Here we can see that the first four types of data need to be prevented, corrected, or excluded, and only the fifth type of data is needed. Among the first four types of data, types 2, 3, and 4 can generally be identified, corrected, or excluded using existing technical measures. Only type 1 is difficult to prevent and exclude, and this type of data originates from human "nature." However, no data exists in isolation. There are technical means such as tracking and tracing, multi-source mutual verification, etc., which can detect and deal with such false data. At the same time, we should not forget that the data space is not a lawless place.

[0135] Furthermore, by proposing four objective necessary conditions or elements for the credibility of data or information: when, where, what, and who (WHENWHEREWHATWHO, referred to as 4W), these four objective elements are the four "necessary conditions" for the credibility of data or information that are internationally recognized and currently in force (for example, in the field of news and telegrams of Chinese and foreign news agencies). The "necessary conditions" here are the semantics of mathematical logic. This means that even if the data or information meets the 4W, it is still not guaranteed to be completely credible, because some data or information comes from humans, or has been edited and modified by humans (second-hand data), and humans are species that lie and fabricate. For false and fabricated data, tracing the source is a simple and effective means of containment (which can be used as the fifth necessary condition for credibility). Of course, if the data is generated by nature or automated devices, such as IOT systems or smart sensors, without human intervention, the above 4W will become the "necessary and sufficient conditions" for the credibility of the data.

[0136] Based on the above analysis and cognition, the following technical measures can be taken to enhance the credibility of the data:

[0137] 1. Equipped with WORM storage media (hardware) and using "data native" technology, the data (files) are captured as soon as they are generated by the computer OS, and automatically transferred to WORM media for protection by setting a time period and / or file static timing. With the help of the physical properties of WORM media, it can not only prevent tampering, but also prevent loss, virus, and extortion, approaching the ultimate data security level.

[0138] 2. Equipped with a digital rights certification module (hardware) and generate a "data certificate lock". The digital rights certification module is used to give data the necessary 4Ws for credibility. Specifically, it includes three points: (1) Using the PKI / DPKI device built into the digital rights certification module to generate the user's public-private key pair, and use the public key (or public key deformation / DID) as the user's network identifier (WHO); (2) Using Beidou satellite timing, national trusted timing, third-party timing certificate services, etc. to obtain time, unify the time benchmark of the entire network data; (3) Using timing positioning data and cryptographic algorithms or third-party timing certificate services, generate a "data certificate lock" (WHEN, WHERE, WHAT, WHO) bound to the current data. The data certificate lock is a special type of confidential data, including plaintext and ciphertext parts; data bucket-level protection must use a data certificate lock, which protects all data in the data bucket as a whole, and can also be used to protect single data (files).

[0139] 3. Use "composite verification" technology. Data credibility requires the provision of technical methods for data verification. In particular, in the scenario of global data circulation, technical methods that can be verified by third parties must be provided. "Composite verification" means multi-key and multi-level verification, and the data verification tools are open to the whole society. Composite verification technology mainly includes three points: (1) Verification of data buckets, using data lock verification; (2) Verification of single data, using electronic signature verification or data lock verification. However, since electronic signature verification may be attacked by "signature replacement", a progressive method is adopted to first verify the data lock of the "bucket" and then verify the single data in the data bucket, which can resolve this attack. (3) Verify the compliance of the data organization structure with regulations. Composite verification is still effective for data that is separated from WORM media or network transmission, because the data lock cannot be forged or tampered with under any circumstances. To verify data, the public key of the data owner (user) and / or the public key of the third-party time and security service is required, and the PKI / DPKI principle allows their public keys to be published.

[0140] Furthermore, it is also necessary to ensure the integrity of data resources. The data integrity problem includes two aspects: one is the correctness of the data, and the other is the consistency of the same data in a distributed environment. In terms of data correctness, conventional data verification, data error correction, data backup (such as RAID, hot backup in two locations, etc.) and other technologies can be used to solve the problem well, but the existing technology for distributed consistency is difficult and costly. However, in the context of data assets and data resources, it is noted that both types of data are static data that is fixed and unchanging. Through years of in-depth research, it is found that fixity is one of the basic properties of data resources and data assets. Changes in data assets are reflected on the timeline, that is, data assets are compiled in stages according to time, which is theoretically called "chronology".

[0141] In view of the basic nature of data assets and data resources, a data encapsulator (firmware or software) is provided. The encapsulator has a built-in standardized data organization structure. It packages and solidifies the data periodically at a set time to form a series of chronological data units (asset buckets or evidence buckets). At the same time, the encapsulator injects a variety of additional data that supports public verification (or validation) such as data proof locks and electronic signatures into each data unit, and the tools for executing verification are announced to the whole society. By using the "publicly verifiable" feature, the data can be "falsifiable upon modification", which effectively solves the problems of correctness and distributed consistency.

[0142] Furthermore, WORM storage media are also provided. WORM media can provide nearly perfect protection for the integrity of stored data. Its physical properties ensure that the data remains unchanged, and it has a strong ability to resist loss, which can effectively prevent malicious tampering and virus infection. Especially for malicious encryption ransomware attacks, WORM may be the only means of resistance at present. In addition, compared with the tamper-proof technology of blockchain, the cost of using WORM media is currently only slightly higher than that of conventional HDD and SSD, which is about 1 / 50 of the total cost of blockchain (TCO).

[0143] In the scenario where data leaves the WORM media or is transmitted over the network, any data that needs to be migrated can be packaged and solidified into a "transaction bucket" and a data lock can be applied. On the one hand, this meets the unified requirements of "packaging" standards for data circulation. On the other hand, the strong protection of the data lock makes it impossible for the transaction bucket to be forged or tampered with under any circumstances (including WORM media storage, data transmission, erasable storage media, and buying and selling transactions), and the public can verify the integrity and credibility of the transaction bucket by themselves;

[0144] Furthermore, "personalized encryption" is also provided to protect data (files); personalized encryption achieves "ten thousand texts and ten thousand secrets", and users do not need to "memorize" a large number of personalized keys. Its design function is mainly used to protect data privacy and property rights, but at the same time it can also completely block all data deletion and modification behaviors.

[0145] Optionally, it is also necessary to trace the source of data assets. Regarding data tracing, people know that the chain of data sources may be very long and may even be circular. As for how to determine the source of tracing, based on computer knowledge, we know that the data is usually not in a human-readable form when it first occurs. A large amount of low-level data (signal stream, bit stream, byte stream, storage block linked list) is in the form of human-unreadable data. There is no practical significance in tracing back to these data forms. Low-level data can only be displayed to humans after being organized into files in the computer. Therefore, it can be determined that the original electronic file is the end of data tracing, and the electronic file is the (locatable) benchmark unit of data tracing (but not the smallest traceable particle).

[0146] Based on this, the "data native" technology can be used to capture these files as soon as the business processing system generates them and seal them up as soon as possible. The "working bucket" is used to capture first-hand files. "First-hand" means two aspects. One is to try to avoid data being edited by humans twice; the other is that after the file is closed (Close of FileSystem), once the file is stable and static, it will be converted to "read-only". If there is a subsequent change, a new version of the file with the same name will be generated (Versionlize). At the same time, it is also periodically transferred to the "evidence bucket" (commonly known as "seal bucket") at a fixed time; in practice, the "data encapsulator" is used to automatically complete the above process. The evidence bucket already has security protection measures such as data proof lock, user electronic signature, WORM media, etc., which makes it the data source with the highest security level and the highest confidence level in the present invention. Therefore, the ultimate source of data asset tracing is the "evidence bucket". In order to facilitate tracing and traceability at a smaller granularity, a "traceability locator" can be attached to the specific data items of the files in the data "asset bucket", which indicates the accurate record location or KEY value (KVpair case) of the data item in a certain "evidence bucket". Because the traceability locators in the data bucket are automatically generated by the "data encapsulator" according to the specification, this enables the data bucket to achieve global mutual recognition and interoperability, and the data traceability chain is the shortest and has no loops (directed acyclic graph DAG).

[0147] In addition, the data traceability locator technology provided in this embodiment has a certain deterrent effect on the behavior of forging data, because "the issuer is responsible for the document, and the document is responsible for the document", and in the traceable data resource domain, all data has automatically formed a directed acyclic graph DAG, and the initial issuer cannot hide his network identity or deny responsibility. This makes the traceability of data the fifth "necessary condition" for data credibility.

[0148] Furthermore, as to how to determine the owner of data asset rights and interests, the value of data assets is usually reflected in the fact that they can be traded or used. The owner of data rights and interests may change many times, so determining who is the owner of data asset rights and interests is a multi-time event that occurs over time. Of course, the user who created this data asset is its first owner (user-level confirmation of rights or "claimed confirmation of rights"). In order to achieve this, a digital rights certification module is equipped. The circulation of data assets must have a unified time benchmark for internal and external networks, which is also a statutory requirement for national data governance. By adopting China's authoritative Beidou satellite timing and positioning or through a third-party timing and certification service, cryptographic technology is used to bind spatiotemporal data to asset data and its owner, so that it remains verifiable and cannot be tampered with under any circumstances; this is very, very important because the solid certificate lock of the bound data (which contains the creation time of the data bucket) is the ultimate (technical) basis for judgment when disputes arise over the ownership of data assets. The digital rights certification module also provides users with a globally unique network identity (PKI / DPKI public and private keys), and implements data locks, electronic signatures, and personalized encryption for the data in each asset bucket. The public and other social institutions only need to use the user's public key and / or the public key of the time-granting and certificate-certifying service platform to self-service the data assets for signature verification. If the signature verification is successful, the public key holder (who has been announced to the whole society or authenticated and exchanged by both parties of the transaction) can be identified as the owner of the data rights. "Public verifiability" is not an optional feature, but a necessary feature in the context of global circulation of data assets.

[0149] However, user-level "claim confirmation" is only the first necessary level of confirmation, which does not have legal recognition and protection. Data assets need to go through the external "forensic" process of registration confirmation, value assessment, etc. stipulated by the national data governance system before they can be legally established. This means that data assets need to be submitted to the national licensed forensic service platform outside the user's computer system (with a trading bucket as a "package") to obtain relevant certificates (documents). However, the trading bucket has been packaged and solidified, and new files cannot be added. In order to solve the actual need for multiple certifications in different forensic institutions, the solution of establishing a "link" of data buckets is adopted, that is, the forensic service platform creates a new trading bucket, and adds the certificate, certification documents provided by the certification platform, and the number / directory / file name (i.e. storage path) pointing to the certified trading bucket as a data file to the user data directory of the new bucket; for subsequent multiple data rights changes, the authenticator still creates a new bucket and links the certified trading bucket.

[0150] Furthermore, regarding the issue of how to achieve global exchange of data resources and data assets, after the successful construction of data assets (a series of asset buckets), they are not only shared and used among users, but also need to be connected to the external national forensic platform to obtain legally effective data rights confirmation, value assessment and transaction transfer, etc. This requires unified standardization of data transmission "packaging" so that data can enter the national data circulation without obstacles. Provide a data encapsulator (firmware or software) with built-in standard data bucket specifications, which compulsorily generates the file directory structure of the data bucket and a part of "metafiles" to ensure that all data bucket data meets the specifications. Specifically, a trading bucket specially used for data circulation is provided. The trading bucket has a data structure that complies with the specifications and is injected with a data proof lock, so that the public can verify its integrity and credibility. The user data of the trading bucket adopts personalized encryption and recipient list technology to achieve high-intensity protection of "thousands of faces for thousands of people, thousands of documents and thousands of secrets". The trading bucket can not only be used to migrate data safely, but also directly support the buying and selling transactions of any data commodity. That is, the user packages the data commodity in the trading bucket, and transmits it to the buyer of the data commodity through the network or removable storage media as an ordinary file package.

[0151] Through the above detailed analysis and technical implementation principles, this application comprehensively solves the five common and fundamental problems faced by the creation and circulation of data resources and data assets: Problem 1: How to determine the credibility of data resources. Problem 2: How to ensure the integrity of data resources. Problem 3: How to trace the source of data assets. Problem 4: How to define the owner of data asset rights. Problem 5: How to achieve full-domain exchange of data resources and data assets. The following continues to give implementation cases from equipment manufacturing, to application deployment, to innovative development of industry application systems.

[0152] For data resource and data asset equipment manufacturing enterprises or installation service enterprises, the construction system may include: network communication module, digital rights certification module, data strategy module and data evidence module, such as Figure 2 As shown, where:

[0153] The network communication module uses mature commercial SD-WAN software-defined wide area network. The digital rights certification module is self-developed and produced or purchased from professional products provided by data equipment component manufacturers. The data policy module is self-developed and produced or purchased from professional products provided by data equipment component manufacturers. The data storage module uses large-capacity commercial NAS or FileServer, but some of the storage devices need to be replaced with WORM media.

[0154] Furthermore, the network communication module is the user's internal intranet; this embodiment assumes that the user has remote branches and uses the SD-WAN network to access the computer business processing systems of these remote branches. A mature product SD-WAN provided by a third party can be selected. SD-WAN equipment mainly includes a central controller deployed at the user's headquarters and an edge device CPE deployed at the user's remote branch.

[0155] Specifically, the digital rights visa module can be in the form of a PCIe card to reduce manufacturing costs, or in the form of an independent digital rights visa host to meet the needs of large users, such as Figure 3 As shown in the figure, it contains a Beidou satellite information receiving device and a digital identification device based on the PKI / DPKI cryptographic system. The digital rights visa module also connects to the third-party timing service platform of the external network as the second acquisition channel for trusted time and data certificate locks. Because data certificate locks are key technical means for data trust and data integrity, they are very important and need to be protected by dual channels. The digital rights visa module has a communication port specifically used to connect to the external Internet.

[0156] Specifically, the data strategy module, such as Figure 3 As shown, the self-developed and self-produced products or the integrated hardware and software products (dedicated servers) provided by the data equipment component manufacturers are used. The permission distributor, policy configurator, and data encapsulator are all built-in dedicated software or built-in firmware boards of the manufacturer's products. In order to ensure that the software program is not infected by viruses or damaged by hacker attacks, the data policy module should be equipped with self-use WORM storage media to protect the program code and key parameters (using a trusted computing host certified by an authoritative testing agency).

[0157] Furthermore, for the data storage module, Figure 4 As shown in the figure, the workspace is used to capture the user's daily business data; the evidence bucket is used to convert the data in the work bucket into data resources; the asset bucket is used to convert the data in the evidence bucket into data assets; and the transaction bucket is used to publish or buy and sell data assets. The data evidence module belongs to the computer external storage device category, but in addition to conventional data storage media such as hard disks HDD, solid-state disks SSD, optical disks, etc., it also contains special storage media WORM storage media. The work bucket is implemented using conventional SSD storage, the evidence bucket and asset bucket are implemented using WORM storage, and the transaction bucket uses any removable storage. If the data evidence module is built using third-party products, it must support the loading of user-developed and self-produced special software (such as support for Docker).

[0158] The data asset construction equipment and components provided in this embodiment are basic (backend data engine) data asset equipment. Through appropriate data strategies and configurations, as well as supporting or connected business front-end systems, they can be applicable to most modern material production users or service users, including industry, commerce, agriculture, transportation, medical and other industries. They are also suitable for cultural creation users, including users of metaverse creation, digital human creation, animation and film and television creation (their data assets are often manifested as directly saleable "data works" or service platforms), and can also be used for the security management of sensitive data resources of government or non-operating institutions.

[0159] For a specific enterprise or institution, the purpose of using its data should be clarified first. In government agencies or other non-profit non-profit institutions, the purpose of using data is usually to protect data integrity, existence and control data access rights (especially to reduce the "system privileges" of internal personnel), such as managing the circulation of documents of different levels of confidentiality or managing personnel files; such institutions generally do not need to build data assets, but only need to build data resources. In production and operation enterprises, the purpose of using data is usually to assist enterprise business decisions (or feed user-specific AI), reduce costs and increase efficiency, improve production technology or optimize processes, and accumulate trusted data as commodity data shared by the industry (published in a trusted shared data space) to promote the formation of new quality productivity; however, the large amount of data resources and data assets accumulated by enterprises over a long period of time are not directly used by enterprise managers or employees, and the workload is too heavy for human capabilities to bear. Therefore, it should be very clear that the direct user or processor of data resources is the modern computer AI system, and data is the "energy" or "food" of the AI ​​system. This type of complex data analysis system has already appeared abroad, such as PalantirFoundry in the United States. The era of AI reasoning model popularization is accelerating. Enterprises lacking data resources will find it difficult to use AI, and their market competitiveness will be greatly reduced. For the closed-loop process of data resource conversion supported by AI, please refer to the attached Figure 5 .

[0160] The following takes a relatively simple trade-type chain supermarket as an example to illustrate its specific deployment and usage:

[0161] 1. Formulate the enterprise data resource construction strategy;

[0162] 1) Determine the commodity sales order, purchase order, loss report, return order, and storage and transportation fees as data resources;

[0163] 2) Determine employee payroll, bonuses, penalties, training fees and other labor costs as data resources;

[0164] 3) Determine the operating expenses such as purchased consumables, water, electricity, rent, office communication, travel, etc. as data resources;

[0165] 4) Identify various documents, contracts, meeting minutes, and financial statements generated within the enterprise as data resources;

[0166] 5) Determine various external documents, materials and other traceable second-hand data (with transaction buckets as data units) as reference data resources, and use conventional storage for second-hand data;

[0167] 6) Determine that the data resource collection cycle is one day (the bucket is sealed at 24:00 every day); given that trusted data resources are required to be based on user behavior data (first-hand data that has not been processed by humans), all of the above data shall be based on computer original files or actual transaction credentials or signed documents (pictures) of the person handling the transaction.

[0168] 2. Establish the intranet of the enterprise:

[0169] Establish an SD-WAN network to cover thousands of remote business outlets of the company. Since all remote outlets have established internal LANs (front-end POS systems), each outlet only needs to add one edge device CPE.

[0170] 3. Configure headquarters data asset equipment:

[0171] 1) The corporate headquarters purchases a digital rights certification host, a data policy server, a data evidence server, and an SDW central controller. The data evidence server is equipped with at least 20TB HDD storage units and at least 20TB+20TB WORM storage units, which serve as storage media for the workspace, evidence bucket, and asset bucket respectively. These equipments are used to build the enterprise backend data resource system.

[0172] 2) In the permission management interface on the policy server, configure data access permissions, set a list of all departments in the enterprise, and set a work directory for each department in the workspace. Set access permissions for each department to the workspace, evidence bucket, asset bucket, and transaction bucket.

[0173] 3) In the policy configuration interface on the policy server, set the data storage cycle (buckets are sealed at 24:00 every day), data source point, data category, data filtering conditions and data storage path according to the data asset strategy formulated by the enterprise.

[0174] 4) In the management interface of the digital rights visa host, configure the enterprise PKI / DPKI network identity, timing service URL and its public key, digital rights visa cryptographic algorithm parameters, etc.

[0175] 5) On the data encapsulation interface of the policy server, configure the data asset extraction tool software (or third-party AI service), connect to the legal data asset confirmation, value assessment, capital verification and other service platforms, and designate the internal management department for external data migration, release or trading operations.

[0176] 4. Connect with the original business system of the enterprise (front-end business POS system):

[0177] For the various computer application software (that generate data resources) originally used in various business positions of the enterprise, change their working directories (WorkingDirectory) and use OS-level tools such as disk mapping, network sharing, and virtual devices provided by the operating system to point to the "workspace" configured for this system.

[0178] 5. Start system trial operation:

[0179] In order not to affect the daily production and operation of the enterprise, a phased and gradual opening plan can be adopted, first opening up some data resources and gradually expanding to all data resources.

[0180] Example 3: This example uses trusted data resource equipment to innovatively construct a fully automatic geographical indication product supply chain management system (including front-end business system and back-end data asset system). Geographical indications are special marks granted by the state to local famous and high-quality products, which have legal protection for famous and high-quality products. However, conventional paper or printed geographical indication icons are difficult to identify authenticity and difficult to quantify management. This example maps the physical geographical indication attached to the product into an electronic geographical indication, and makes the electronic geographical indication equivalent to the product, so as to achieve precise management in the computer supply chain system.

[0181] The business process of the fully automatic electronic geographical indication supply chain management system is briefly described as follows:

[0182] According to the supply quantity of a certain famous and high-quality product by a compliant producer, the number of licenses for the right to use the geographical indication is granted in accordance with laws and regulations, and the same amount of electronic geographical indications are mapped. The electronic indications are recorded in the electronic supply order of the producer in the supply chain account book as virtual products corresponding to the physical objects. The physical products are put into the wholesale market by the producers. The physical products are still attached with the physical geographical indications.

[0183] When the distributor purchases the famous and high-quality products in the wholesale market, he submits an electronic purchase order to the supply chain. The supply chain system verifies the electronic mark inventory quantity of the relevant producers. If the quantity required by the purchase order is met, the payment between the buyer and the seller is settled, the producer is notified to ship the goods, and the electronic mark icon (with quantity) is sent online to the distributor to confirm the successful purchase. On the other hand, the distributor's purchase order is automatically generated in the supply chain account book at the same time. The purchase order records the electronic mark quantity of the purchased products, realizing the limited inheritance of legal geographical indications for further sales.

[0184] When consumers purchase the famous and high-quality products at the dealer's store, they submit an electronic consumer order to the supply chain system. The supply chain system checks the electronic logo inventory of the relevant dealer. If the order quantity is met, the payment between the buyer and the seller is settled, the dealer is notified to ship the goods, and the electronic logo icon (with quantity) is sent to the consumer online to indicate that the payment for the goods is successful and complies with the national regulations on the right to use geographical indications. The above process continues until the seller's electronic logo inventory is exhausted.

[0185] According to the supply chain business process, it is obvious that the fully automatic supply chain system needs to establish a credible, reliable, and tamper-proof electronic account book. The credible data resource equipment provided by this patent is fully competent for such work. Figure 6 , which includes a supporting front-end business processing system and a back-end electronic account book system. As can be seen from the schematic diagram, the supply chain of this embodiment operates under the drive of electronic orders initiated by various business roles.

[0186] Among them, the first electronic order is issued by the producer. After being verified by the front end (manually), this supply order is mapped into an equivalent electronic mark by the background mark mapping server and recorded in the producer's supply order in the electronic account book.

[0187] The second electronic order is issued by the distributor. This purchase order is processed by the background account verification server and the order splitting server. The account verification server checks whether the electronically marked inventory quantity of the relevant producer meets the purchase order requirement. If it does, the order splitting server is further activated to automatically generate the distributor's purchase order and record it in the electronic account book. Since the trusted electronic account book prohibits data modification (WORM media guarantee), only new orders can be added (in accordance with accounting standards). The distributor's purchase order is automatically generated by splitting its parent order (the supply order held by the relevant producer). This method keeps all electronic orders in the account book unchanged (this is the basic feature of data assets).

[0188] The third electronic order is issued by the consumer. This consumption order is processed collaboratively by the background account verification server and the order splitting server. The process is similar to the second electronic order. However, the "consumer purchase order" obtained by the consumer will withdraw from further circulation. It is prohibited by the built-in rules of the server, and the server executable code is uploaded to the WORM media to prevent the background personnel from arbitrarily tampering with the business rules.

[0189] For the sake of brevity, the above description does not include details of how electronic geographical indications actually flow through the supply chain.

[0190] This embodiment can achieve the following effects:

[0191] 1. It is unmanned or runs automatically with few people, and no one, including the system administrator (eliminating the threat of embezzlement and secret manipulation), can interfere with or tamper with the electronic ledger (the tree data structure with complex order constraints in the ledger, the standardized data bucket structure, the cryptographic data lock and the physical WORM media and other multiple protections).

[0192] 2. Automatically generate credible and falsifiable data resources (storage buckets and asset buckets), including four types of credible data: account book orders, business roles, geographical indications, and famous and high-quality products. The physical properties of WORM storage ensure that business data cannot be tampered with or deleted. Based on this credible data source (as a credible shared data space), data subscribers can always master the history and market status of famous and high-quality products to assist in production and operation decision-making.

[0193] 3. Consumers and dealers no longer have to worry about infringement by counterfeit geographical indication products, and the market is completely cleansed of counterfeit and deceptive behaviors.

[0194] 4. This case uses trusted data to simplify business processes, reduce costs and increase efficiency. In the trusted data space, starting from mathematical constraints (sales volume <= input volume), it solves the "hard-to-solve" practical problems that are difficult to solve at the physical level, demonstrating the extraordinary ability of trusted data in the economic field, which belongs to the new quality of productivity.

[0195] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A system for building trusted data resources and tradable data assets, characterized by: It includes network communication module, digital rights certification module, data strategy module and data evidence storage module; among which: The network communication module includes various devices of the user's intranet, which connect the computer business processing system of the user's headquarters and the computer business processing system of the remote branch; the data policy module includes a permission distributor, a policy configurator, and a data encapsulator; the data evidence module includes a workspace, an evidence bucket, an asset bucket, and a transaction bucket; the digital rights certification module, the data policy module, and the data evidence module are respectively connected to the network communication module; the permission distributor, the policy configurator, and the data encapsulator are respectively connected to the data policy module; the workspace, the evidence bucket, the asset bucket, and the transaction bucket are respectively connected to the data evidence module; The workspace is connected to the user's original business system through the computer OS layer, collects the first-hand data generated by the daily business of each position of the user, and stores it in a conventional storage medium; The evidence storage bucket periodically incrementally or fully copies the data in the workspace at a set time, and encapsulates and solidifies the copied data through a data encapsulator and stores it in a WORM storage medium; The asset bucket periodically extracts data from the data resource at a set time, and encapsulates and solidifies the extracted data through a data encapsulator and stores it in a WORM storage medium; The transaction bucket selects data from data resources and / or data assets from time to time, and encapsulates and solidifies the selected data through a data encapsulator, and stores it in a removable storage medium. The transaction bucket is also used for external release or transaction circulation; The user data in the evidence bucket, the asset bucket, and the transaction bucket all have a traceability locator for tracing their sources. The traceability locator is a string containing a data bucket number, a directory name, a file name, and a byte offset or a KEY value; The trusted data resources are composed of a series of evidence buckets, and the tradable data assets are composed of a series of asset buckets, wherein the data contained in each evidence bucket or asset bucket has been encapsulated and solidified by the data encapsulator, and each evidence bucket or asset bucket has been added with a data solid lock issued by the digital rights certification module and an electronic signature of the user's network identity; In the trusted data resources and tradable data assets, each evidence bucket or asset bucket also contains a secret individual key, which is a key used to encrypt user data in the data bucket to protect user data privacy and / or property rights; the transaction bucket is also encapsulated and solidified by the data encapsulator, and has a data evidence lock, a user electronic signature and a secret individual key; The data certificate lock is a confidential data generated by cryptographic algorithms and trusted timing, which is used to verify the credibility and integrity of the data bucket, and supports the public to use the public key of the timing service platform and / or the public key of the electronic signer of this data bucket for self-service verification.

2. The system for constructing trusted data resources and tradable data assets according to claim 1, characterized in that: The digital rights visa module receives Beidou timing and positioning information through a built-in Beidou satellite information receiving device and connects to a third-party trusted timing service platform; it also determines the user's network identification and performs password-related processing through a built-in digital identification device based on the PKI / DPKI cryptographic system.

3. The system for constructing trusted data resources and tradable data assets according to claim 1, characterized in that: In the data strategy module, Permission distributor, used to manage data sharing access rights of personnel in various positions; Policy configurator, used to set and control working parameters, including periodic timing, data source point, data filtering selection conditions, data arrangement and reorganization rules, and data sensitivity level; The data encapsulator is used to encapsulate and solidify data in a standardized format into a data bucket that is secure and reliable, easy to circulate, and supports ownership confirmation and traceability.

4. The system for constructing trusted data resources and tradable data assets according to claim 1, characterized in that: Data buckets include evidence buckets, asset buckets, and transaction buckets. Data buckets are created through a data encapsulator with built-in standardized data bucket encapsulation specifications. The data structure of the data bucket includes a globally unique number, a name, multi-level directories and files; The multi-level directory includes a data bucket directory created by the data encapsulator according to the specification, a data type directory under the data bucket directory, a user declaration directory, and a user data directory; The data bucket directory is used to store the certificate lock file, password algorithm file, and data bucket header file created by the data encapsulator according to the specification; The data type directory is used to store user data type files; The user declaration directory is used to store files that describe user data; The user data directory is used to store files of user data or data access paths, and allows users to perform personalized encryption on data files.

5. A method for constructing trusted data resources and tradable data assets, characterized in that: The specific steps include: M1.1 collects business data from the user's business processing system through a computer network and saves it in a work area, which uses conventional erasable media as storage space; M1.2 periodically copies the data in the work area to the evidence bucket, which uses a WORM medium with a write-once feature as storage space; M1.3 Periodically and regularly extracts the data in the evidence bucket to the asset bucket selectively. The asset bucket uses WORM media with write-once characteristics as storage space; M1.4 The data in the evidence bucket or asset bucket is selectively copied to the transaction bucket from time to time. The transaction bucket uses removable conventional erasable media or removable WORM media as storage space; M1.5 uses a policy configurator to set and control the working parameters of M1.1-M1.4, including cycle timing, data source point, data filtering selection conditions, data arrangement and reorganization rules, and data sensitivity level; M1.6WORM media is a magnetic memory, electrical memory, optical memory, organic memory, or software / firmware simulated WORM memory with write-once characteristics; M2.1 Evidence bucket, asset bucket and transaction bucket are collectively referred to as data buckets, which are created by data wrappers. Data wrappers have built-in standardized data bucket creation specifications. Data buckets include: data bucket directories, subordinate subdirectories and files. Subdirectories include: data type directories, user declaration directories and user data directories. M2.2 Data bucket directory, used to store the certificate lock file, password algorithm file, and data bucket header file; M2.2.1 Data bucket directory, which has a globally unique number and uses the globally unique number as the directory name, and uses the periodic timing time or creation time set by the policy configurator as the prefix of its globally unique number; M2.2.2 Evidence lock file, which records the data evidence lock, the name of the creator of this data bucket, the creator's public key, and the creator's electronic signature on each component of the bucket structure. The evidence lock file is used to verify the credibility and integrity of this data bucket; M2.2.2.1 Data proof lock is a confidential data generated by cryptographic algorithm and trusted timing. It is bound to all data in the user data directory in this data bucket, the time and space of data proof lock creation, the electronic signature of the creator of this data bucket and the creator's public key. Only one data proof lock can be obtained for a data bucket. M2.2.2.2 Data certificate lock, issued by the digital rights visa module; the digital rights visa module has a built-in Beidou satellite signal receiving device for receiving Beidou timing and positioning. The digital rights visa module is also connected to a third-party timing service platform as a second channel for obtaining trusted time. The digital rights visa module also has a built-in digital identification device based on the PKI / DPKI cryptographic system for determining the user's network identification and performing password-related processing; M2.2.2.3 Data authentication lock supports self-service verification by the public and institutions. When the verification is passed, the verifier confirms that the integrity and credibility of the data bucket are correct. Otherwise, the integrity of the data bucket has been destroyed and its data is unreliable. M2.2.3 Cryptographic algorithm file, used to record the cryptographic materials used in this data bucket. The cryptographic materials are the cryptographic algorithm, algorithm version, key length used when the user data files in this bucket are encrypted and decrypted, the cryptographic algorithm, algorithm version, key length used when the personal key itself is encrypted and decrypted, and the relevant algorithm and version cryptographic parameters of the PKI / DPKI cryptographic system used in this data bucket; M2.2.4 Bucket header file, used to store the data bucket parameters, including the bucket specification version number used by the data bucket, the bucket's global unique number, name, type, associated bucket list, and the number of user files in the bucket; M2.3 Data type directory, used to save user data type list files. Data types include user data file name, data type number, data type name, data type specification version number, data type description, and access path of executable code segments or programs bound to this data type; executable code segments or programs are used to check or process user data compliance; M2.4 User declaration directory, used to store descriptive description files, keyword files and summary files of user data files provided by users. The description files, keyword files and summary files have the same name as the user data files but different suffixes. The user declaration directory is used to support data search, data view and data discovery features, and the user declaration directory is open to everyone without encryption. M2.5 User data directory, used to store user data files, user signature files, personal key files, traceability files and recipient files; among them: M2.5.1 User data file, used to record the user data itself or the data access path; M2.5.2 User signature file, used to record the electronic signature attached to the user data file with the same name; M2.5.3 Personalized key file, used to record the encrypted personalized key attached to the user data file with the same name, and the URL for obtaining the corresponding clear personalized key. The user data file itself allows the user to perform personalized encryption. Personalized encryption means that when encrypting a file, the encryption keys of different files are different; M2.5.4 Tracing file, used to record the traceability locator list attached to the user data file with the same name; M2.5.5 Receiver file, used to record one or more receiver information attached to the user data file with the same name, the receiver information includes: when the receiver has a public key, the receiver's public key and the personal key encrypted using the public key; or when the receiver does not have a public key, the receiver's registration number in the user service system and the personal key encrypted using the reserved key under the registration number; M2.5.6 Personal key files, traceability files, recipient files, and user signature files have the same name as the user data file but with a different suffix; M3: The user data files in the user data directory of the evidence bucket, asset bucket and transaction bucket are marked with a traceability locator pointing to their source. The traceability locator is a string that contains the source data bucket number, directory name, file name, byte offset or KEY value and marked serial number; the traceability locator is recorded in the traceability file with the same name as the user data file but with a different suffix.

6. An electronic device, characterized in that: The method comprises a network communication component, a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method described in claim 5 is used to partially or completely construct a trusted data resource and / or a tradable data asset.

Images