Data security and privacy management method and system based on block chain technology

Abstract

The invention discloses a data security and privacy management method and system based on a block chain technology, and the method comprises the following steps: S1, collecting original data in a target system, and carrying out the preprocessing of the original data; s2, constructing an access control strategy set; s3, converting into a structured strategy configuration file, and deploying a smart contract; s4, matching and judging the access request and a preset strategy by the intelligent contract; s5, judging whether the access request is legal or not; s6, performing structured processing on the access log, and writing the access log into a block chain account book; s7, intelligently selecting an encryption mechanism, and providing access return data to the access party; and S8, carrying out modeling prediction on the access mode by adopting a federal gradient lifting tree algorithm. The block chain intelligent contract and the federal gradient boosting tree algorithm are fused, differential privacy, zero-knowledge proof and homomorphic encryption technologies are combined, data intelligence and refined privacy protection are realized, and the method has the advantages of high credibility, high intelligence and high traceability.

Description

Technical Field

[0001] The present invention relates to the technical field of data security and privacy protection, and particularly to a data security and privacy management method and system based on blockchain technology. Background Art

[0002] With the rapid development of the digital society, in the data usage scenarios of multi-agent collaboration and cross-system interaction, how to achieve efficient sharing and authorized access while ensuring data security and privacy has become an important issue that urgently needs to be solved in current information security technology.

[0003] Currently, in data sharing and management systems, access control usually adopts a centralized access control architecture. Traditional access control mechanisms, such as access control lists, role-based access control, attribute-based access control, etc., rely on a centralized server for policy configuration and access verification. Such methods have several obvious defects: on the one hand, the policy configuration process is not transparent, and the definition, modification, and execution of access rules are often manually managed by system administrators, which is vulnerable to the risks of human errors or abuse of power; on the other hand, it is difficult to achieve full-process traceability and accountability for data access behaviors and permission changes. Especially in the data transfer across institutions and platforms, there are natural shortcomings in data responsibility definition and security auditing.

[0004] In addition, traditional data security mechanisms mostly adopt means such as static encryption and access credentials, which often cannot achieve dynamic protection of sensitive data in actual implementation. Once the data is authorized for access, the system is difficult to control the specific use of the data by the access party, and there is also a lack of in-depth analysis and judgment of access behaviors. This "let-go" management method can no longer meet the technical requirements of refined management of data assets and controllable use risks under the current background of higher requirements for data compliance, security, and privacy protection.

[0005] In recent years, due to its decentralized, tamper-proof, and traceable characteristics, blockchain technology has gradually become an important technical support in the data management system. By deploying smart contracts on the blockchain, access control rules can be solidified in the form of code logic, automatically execute access judgment logic and record operation results, effectively reducing the risks of human intervention and configuration. However, existing permission management schemes that combine blockchain and smart contracts mainly focus on the determination and recording of basic access rules, lacking the ability to dynamically identify and adapt to complex access behaviors. At the same time, most schemes fail to fully combine user behavior data for model learning and do not form an automatic evolution mechanism for access control policies, resulting in insufficient system intelligence and adaptability.

[0006] In terms of data privacy protection, although there are already multiple technical routes such as differential privacy, homomorphic encryption, and zero-knowledge proof, existing solutions generally face problems such as a single algorithm and a lack of a flexible scheduling mechanism. Most privacy protection methods are effective for specific scenarios, but they cannot dynamically select the most suitable encryption or desensitization scheme according to multi-dimensional factors such as data sensitivity, access frequency, and user attributes. At the same time, data protection technologies and access control logics are often disjointed, failing to form a unified privacy protection control chain, resulting in fragmented system architectures and limited protection capabilities.

[0007] In addition, most current access control systems rely on static configuration rules and lack the ability to model and predict based on historical access data. In large-scale distributed systems, different nodes have accumulated a large amount of user behavior, data call, and operation logs. If these data cannot be effectively utilized, potential abnormal access patterns cannot be discovered, and data-driven optimization and upgrading of access policies cannot be carried out. Moreover, existing permission learning methods generally rely on centralized data modeling and are difficult to deploy in privacy-sensitive or data-inaccessible environments, lacking a federated modeling mechanism for multi-party collaborative scenarios.

[0008] In summary, the following main problems still exist in the existing technologies when implementing data security and privacy management: First, the access control mechanism relies on centralized deployment, the rule configuration process is opaque and easy to tamper with, lacking the ability of automatic execution and on-chain recording; Second, the access control policy is static and fixed, unable to be automatically adjusted and optimized according to historical behaviors, lacking the ability of learning and evolution; Third, the privacy protection mechanism is disjointed from the access control, lacking a dynamic protection strategy that combines user characteristics and data sensitivity; Fourth, existing solutions are difficult to achieve collaborative modeling and policy sharing in a distributed data environment with multiple institutions and nodes, and cannot effectively support cross-system data security management.

[0009] Therefore, there is an urgent need to propose a comprehensive solution that combines blockchain, smart contracts, privacy protection algorithms, and federated learning to achieve automated policy configuration, adaptive privacy processing, and auditable and predictable access behaviors while ensuring the transparency and credibility of data access control, thereby constructing an intelligent, efficient, and credible data security and privacy management system. Summary of the Invention

[0010] An object of the present invention is to propose a data security and privacy management method and system based on blockchain technology. The present invention integrates blockchain smart contracts and federated gradient boosting tree algorithms to construct a decentralized and adaptable data access control mechanism, realizing the dynamic optimization and on-chain automatic execution of access policies, and combining differential privacy, zero-knowledge proof, and homomorphic encryption technologies to achieve intelligent and refined privacy protection during data sharing, with the advantages of high credibility, strong intelligence, and strong traceability.

[0011] A data security and privacy management method based on blockchain technology according to an embodiment of the present invention includes the following steps:

[0012] S1. Collect the original data in the target system, generate a dataset to be processed, and preprocess the dataset to be processed to form a standardized dataset;

[0013] S2. Construct an access control policy set based on the standardized dataset;

[0014] S3. Convert the access control policy set into a structured policy configuration file, generate contract code based on a preset contract template, and deploy it as a smart contract to each node in the blockchain network after compilation;

[0015] S4. When an access request is received, submit the access request as a transaction to the blockchain network, and the smart contract matches and judges the access request with the preset policy;

[0016] S5. Judge whether the access request is legal based on the execution result of the smart contract. If it is legal, record the access authorization event and allow access. If it is not legal, reject access and record the rejection event;

[0017] S6. Structurally process the access control result, request information, and smart contract execution log, and write them to the blockchain ledger to form a data access behavior record;

[0018] S7. According to the visitor's identity, target data type, and access frequency, intelligently select a differential privacy mechanism, a zero-knowledge proof mechanism, or a homomorphic encryption mechanism to perform privacy protection processing on the access return data and provide it to the access party;

[0019] S8. Based on the data usage behavior and data access behavior records recorded in each storage node, use the federated gradient boosting tree algorithm to model and predict the access pattern, dynamically optimize the access control policy set according to the prediction result, regenerate the contract code, and deploy the updated smart contract to the blockchain network.

[0020] Optionally, the original data includes user identity information, access requests, data types, and data resource identifiers, and the preprocessing includes format conversion, time synchronization, noise filtering, and normalization processing.

[0021] Optionally, the access control policy includes the access user, target resource, operation permission, authorization condition, and valid time range.

[0022] Optionally, the specific content of S2 includes:

[0023] S21. Extract the feature variables related to access control from the standardized dataset to construct an initial feature set F = {f1, f2,, fn}, where f n represents feature variables, including user identity identifier, user role, request time, request resource type, resource sensitivity level, and historical access status;

[0024] S22. One-hot encode the categorical variables in the initial feature set F to generate a sparse feature matrix X = {x ij}, where x ij represents the encoded value of the i-th access record on the j-th feature;

[0025] S23. Associate the sparse feature matrix X with the historical access authorization record label set Y = {y i}, where y i ∈ {0, 1}, representing the access control result of the i-th record, 1 indicating allowed access and 0 indicating denied access;

[0026] S24. Construct an access control scoring function S(i), and use a linear weighted model to score the access record:

[0027]

[0028] where S(i) represents the access control scoring function, w j represents the weight vector of the j-th feature, and x ij represents the encoded value of the i-th access record on the j-th feature;

[0029] S25. Set an access control threshold θ, and generate an access policy label based on the comparison result between the calculation result of the access control scoring function and the threshold. When the value of the access control scoring function is greater than the access control threshold, the access policy label is 1; when the value of the access control scoring function is less than the access control threshold, the access policy label is 0;

[0030] S26. Take the feature variables involved in the access control scoring function, the weight vector W = {w1, w2,, w n}, the access control threshold θ, and the access decision result as access control policy rules, and record them as a policy entry set P = {p1, p2,, p k};

[0031] S27. Generate an access control policy set according to the policy entry set P and store it as a structured configuration file, which is used as the input content for the subsequent generation and deployment of the smart contract.

[0032] Optionally, the specific content of S3 includes:

[0033] S31. Parse each policy in the access control policy set, extract the access user identifier, resource identifier, operation type, permission type, and effective time range, and construct a structured configuration item;

[0034] S32. Combine all configuration items into a configuration file data structure;

[0035] S33. Load a preset contract template, where the preset contract template includes a contract declaration area, a permission judgment function, an event trigger function, a state variable definition area, and a rule definition area;

[0036] S34. According to the configuration items in the structured policy configuration file, insert each content into the rule definition area of the preset contract template through a rule mapping logic, and automatically generate a contract code file;

[0037] S35. Compile the generated contract code file to obtain smart contract bytecode;

[0038] S36. Call the deployment function through the blockchain interface, deploy the smart contract bytecode to all predefined contract nodes in the blockchain network, generate a set of on-chain contract addresses, and establish a mapping relationship between the configuration file identifier and the corresponding contract address to complete the smart contract deployment operation.

[0039] Optionally, the S4 specifically includes:

[0040] S41. After receiving a user access request, extract access parameters and construct an access request quadruple, where the access request quadruple includes the identity identifier of the accessing user, the unique identifier of the target resource, the operation type requested by the user, and the submission time of the access request;

[0041] S42. Package the access request quadruple into a transaction data structure, define the access transaction as TX = {R, Sig, TS}, where TX represents the access request transaction object, R represents the access request quadruple, Sig represents the digital signature of the requesting user, and TS represents the timestamp of the transaction submission;

[0042] S43. Submit the access transaction TX to the blockchain network through the blockchain client interface and send it to the node containing the access control smart contract;

[0043] S44. The smart contract on the node parses the received access transaction and calls the permission judgment function;

[0044] S45. In the smart contract, load the preset access control policy set P, perform a matching operation, and determine whether there is a policy p j Satisfying the conditions:

[0045]

[0046] Among them, UID i and UID j represent the user identifiers permitted by the policy, RID i and RID j represent the corresponding resource identifiers, OP i and OP j represent the permitted operation types, represents the time interval during which the policy takes effect, Auth i represents the policy authorization result, 1 indicates permitted access, 0 indicates denied access, ∧ represents the logical "AND" operation, and it is judged whether the conditions are simultaneously satisfied. UID represents the access user identity identifier, RID represents the target resource identifier, OP represents the operation type, T represents the access request time, and p i represents the i-th access control policy;

[0047] S46. If there exists a policy p j that meets the conditions, then the matching is successful, and the smart contract outputs the access control result:

[0048] checkAccess(R) = Auth j ;

[0049] Among them, checkAcces(R) represents the access judgment result, and Auth j represents the authorization value of the matching policy, and R represents the access request quadruple.

[0050] Optionally, the S7 specifically includes:

[0051] S71. Parse the user identifier field, resource identifier field, and resource type field in the access transaction, retrieve the historical interaction records of the corresponding user and resource in the data usage log, and count the access times F;

[0052] S72. Query the sensitivity level corresponding to the resource type DT from the resource tag library and divide it into the sensitivity level set:

[0053] DT ∈ {T1, T2, T3};

[0054] Among them, DT represents the queried resource type, T1 represents ordinary data, T2 represents data containing restricted fields, and T3 represents data containing key privacy content;

[0055] S73. According to the sensitivity level and access frequency, call the rule matching logic, execute the privacy mechanism selection process, and output the protection mechanism type M based on the condition judgment. The rule matching logic includes:

[0056] When the queried resource type is ordinary data and the access times are less than the access frequency threshold, set the protection mechanism type to the differential privacy mechanism;

[0057] When the query resource type is data with restricted fields and the access frequency is greater than the access frequency threshold, set the protection mechanism type to the zero-knowledge proof mechanism;

[0058] When the query resource type is data containing critical privacy content, set the protection mechanism type to the homomorphic encryption mechanism;

[0059] S74. Execute according to the selection result, including:

[0060] When the selection result is the differential privacy mechanism, call the perturbation generation function to add a random noise term ε to the original data D and perform the noise addition calculation:

[0061] D * = D + ε, ε ~ Lap(0, λ);

[0062] where, D * represents the data after noise addition, D represents the original data, ε represents the noise variable subject to the Laplace distribution, Lap represents the Laplace distribution, and λ represents the set privacy budget parameter;

[0063] When the selection result is the zero-knowledge proof mechanism, call the zero-knowledge proof mechanism construction module to generate the proof content π, bind the original data D to the proof structure, and combine the data format:

[0064] D * = (D, π);

[0065] where, D * represents the combined data, and π represents the proof content;

[0066] When the selection result is the homomorphic encryption mechanism, load the encryption parameters PK = (n, g), and use the Paillier encryption function to perform the encryption operation:

[0067] D * = E PK (D) = g D · r n mod n 2 ;

[0068] where, D * represents the ciphertext data, D represents the original data, g and n represent the homomorphic encryption public key parameters, r represents the encryption random number, mod represents the modulo operator, and E PK represents the homomorphic encryption mechanism;

[0069] S75. After the data processing is completed, inject the scrambled data, bound proof, or ciphertext data into the response module and send it to the requesting user as an access response.

[0070] Optionally, the S8 specifically includes:

[0071] S81. The system executes a data collection program on each storage node in the blockchain network, reads the data usage behavior and data access behavior records of the nodes, extracts user identifiers, resource identifiers, operation types, access times, and access determination values, and constructs a local structured training data set;

[0072] S82. Each node initializes the sub-structure of the gradient boosting tree algorithm locally according to the local modeling process of the federated gradient boosting tree algorithm, sets the number of tree rounds as G, trains the weak classifier round by round on the local structured training data set, and executes the boosting calculation process. A decision tree is generated in each round:

[0073]

[0074] Among them, represents the prediction result of the j-th sample, and α t represents the learning rate of the t-th sub-tree, represents the decision tree generated by the i-th node in the t-th round of training, represents the feature vector of the j-th sample, and G represents the total number of rounds, describing the number of tree rounds;

[0075] S83. Calculate the first-order and second-order gradient values of the samples in each round of training:

[0076]

[0077] Among them, represents the first-order gradient value, represents the second-order gradient value, represents the true label of the sample and the predicted value between the loss function, represents the derivative operation, represents the true label of the sample;

[0078] S84. Each node encrypts the local gradient information according to the collaborative training mechanism of the federated gradient boosting tree algorithm, and uploads the encrypted statistic to the federated coordination server. The coordinator aggregates the global feature gains, selects the optimal split point, and generates the global decision structure;

[0079] S85. The coordination server constructs the global tree structure of the current round according to the aggregation result, and distributes the decision parameters to all nodes. Each node synchronously updates the structure of the gradient boosting tree algorithm;

[0080] S86. Each node executes the local prediction task on the updated decision tree, scores the behavior characteristics of the new access request, and calculates the prediction result:

[0081]

[0082] Among them, represents the prediction result, and η t represents the weight of the decision tree in the t-th round, and h t (·) represents the decision tree in the t-th round obtained through global training;

[0083] S87. When the system detects that the predicted output is inconsistent with the existing access control policy set, or the current behavior pattern is not covered by the policy, the model automatically generates supplementary policy entries;

[0084] S88. The system calls the policy reconstruction program based on the supplementary policy entries, writes them into the structured configuration file, and calls the intelligent contract template rendering engine to generate new contract code, completes bytecode compilation, and deploys it to each node of the blockchain network to overwrite the old version of the intelligent contract.

[0085] A data security and privacy management system based on blockchain technology according to an embodiment of the present invention includes:

[0086] A data collection module, configured to collect raw data in the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset;

[0087] A policy generation module, configured to construct an access control policy set based on the standardized dataset, and convert the access control policy into a structured policy configuration file;

[0088] A contract construction module, configured to load a preset contract template based on the structured policy configuration file, generate a contract code file, compile it into intelligent contract bytecode, and deploy it to each node in the blockchain network through a blockchain interface;

[0089] A request processing module, configured to construct an access request quadruple when receiving an access request, encapsulate the access request as a blockchain transaction, and submit it to a blockchain node including an intelligent contract;

[0090] A contract execution module, configured to match and judge the access request and the deployed access control policy by the intelligent contract in the blockchain node, output an access judgment result, and record an access authorization event or a rejection event;

[0091] An access audit module, configured to structurally process the access control result, request information, and contract execution log, and write them into the blockchain ledger to form a traceable data access behavior record;

[0092] A privacy protection module, which is used to select a differential privacy mechanism, a zero-knowledge proof mechanism or a homomorphic encryption mechanism according to the visitor identity, the target data type and the access frequency, and provide the access return data to the access party after privacy protection processing;

[0093] A policy optimization module, which is used to model and predict the access pattern by using the federated gradient boosting tree algorithm based on the data usage behavior and data access behavior records recorded in each blockchain storage node, generate a new access control policy set according to the prediction result, call the contract construction module to regenerate the contract code, and deploy the updated smart contract to the blockchain network.

[0094] The beneficial effects of the present invention are:

[0095] A data security and privacy management method and system based on blockchain technology provided by the present invention overcomes the problems in the prior art such as access control relying on centralized configuration, opaque permission judgment process, single data protection mechanism, and inability of access policies to evolve dynamically, and constructs a data security management system with decentralized control ability, intelligent decision-making ability and multi-level privacy protection ability.

[0096] First of all, by deploying an access control smart contract in the blockchain network, the present invention migrates the permission rules traditionally judged centrally by the server to be executed on the chain, realizes the automation of the access control logic, the openness and transparency of the rule execution process, and the real-time on-chain storage of the access behavior results, effectively avoiding the risks of human configuration errors and data tampering, enhancing the credibility and security of data access control. The introduction of the smart contract not only improves the access control efficiency, but also constructs a data access infrastructure based on automatic contract adjudication, enabling the system to realize the determination and recording of permissions without relying on a third-party manager in a multi-organization collaboration scenario.

[0097] Secondly, the present invention combines the access control policy with the federated modeling mechanism for the first time, uses the access behavior data recorded in each node, conducts distributed modeling and pattern recognition through the federated gradient boosting tree algorithm, establishes a prediction model of access behavior, realizes the early discovery and recognition of potential abnormal access or rule-incompatible behaviors. This mechanism can not only improve the system's response ability to complex access behaviors, but also dynamically optimize the access control policy set accordingly, and generate the corresponding new contract code for deployment on the chain, forming a full-process adaptive closed loop of policy - contract - execution, greatly enhancing the intelligence and self-evolution ability of the system.

[0098] In addition, during the data access response phase, the present invention intelligently selects privacy protection technologies such as differential privacy, zero-knowledge proof, or homomorphic encryption based on factors such as the identity of the visitor, the type of target resource, and the access frequency, and performs multi-level and customized protection processing on the returned data as needed to ensure that the data is "usable but invisible", effectively reducing the risk of sensitive information leakage. This mechanism dynamically decides the protection method according to the privacy sensitivity of the actual application scenario, breaking the problems of fixed traditional encryption methods and insufficient protection intensity, and improving the flexibility and adaptability of the system's privacy protection.

[0099] Finally, all key operations formed during the access control and data protection process of the present invention, including access request parameters, contract determination results, data protection type selection, etc., are recorded on the chain in a structured manner, constructing a complete access behavior audit chain, which can achieve cross-node and cross-time responsibility traceability and operation verification, providing solid technical support for post-event supervision, compliance review, and behavior traceability. Compared with the existing permission system lacking automatic audit capabilities, the present invention improves the operability of the system in terms of data responsibility division and violation detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] The drawings are used to provide a further understanding of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the present invention and do not constitute a limitation to the present invention. In the drawings:

[0101] Figure 1 is a flowchart of a data security and privacy management method based on blockchain technology proposed by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0102] Now, the present invention will be further described in detail with reference to the drawings. These drawings are all simplified schematic diagrams, only illustrating the basic structure of the present invention in a schematic manner, so they only show the components related to the present invention.

[0103] Refer to Figure 1 , a data security and privacy management method based on blockchain technology, includes the following steps:

[0104] S1. Collect the original data in the target system, generate a dataset to be processed, and preprocess the dataset to be processed to form a standardized dataset;

[0105] S2. Construct an access control policy set based on the standardized dataset;

[0106] S3. Convert the access control policy set into a structured policy configuration file, generate contract code based on a preset contract template, and after compilation, deploy it as a smart contract to each node in the blockchain network;

[0107] S4. When an access request is received, submit the access request as a transaction to the blockchain network, and the smart contract matches and judges the access request with the preset policy;

[0108] S5. Judge whether the access request is legal based on the execution result of the smart contract. If it is legal, record the access authorization event and allow access; if it is not legal, reject access and record the rejection event;

[0109] S6. Structurally process the access control result, request information, and smart contract execution log, and write them to the blockchain ledger on the chain to form a data access behavior record;

[0110] S7. According to the visitor's identity, target data type, and access frequency, intelligently select the differential privacy mechanism, zero-knowledge proof mechanism, or homomorphic encryption mechanism, and perform privacy protection processing on the access return data before providing it to the access party;

[0111] S8. Based on the data usage behavior and data access behavior records recorded in each storage node, use the federated gradient boosting tree algorithm to model and predict the access pattern, dynamically optimize the access control policy set according to the prediction result, regenerate the contract code, and deploy the updated smart contract to the blockchain network.

[0112] The present invention constructs a data security and privacy management method based on blockchain technology. By converting the access control policy into a smart contract and deploying it on the blockchain, it realizes the automatic determination of access requests and the recording of results on the chain, effectively enhancing the transparency and security of the system. On this basis, the federated gradient boosting tree algorithm is introduced to perform distributed modeling and access pattern prediction on the access behavior data of each node, support the dynamic optimization and automatic evolution of access control policies, and improve the system's adaptive response ability to complex access behaviors. At the same time, combined with differential privacy, zero-knowledge proof, and homomorphic encryption mechanisms, it realizes intelligent privacy protection processing based on the access context, and finally forms a multi-party collaborative data management solution with controllable data, auditable usage, and guaranteed privacy.

[0113] In this embodiment, the original data includes user identity information, access requests, data types, and data resource identifiers, and the preprocessing includes format conversion, time synchronization, noise filtering, and normalization processing.

[0114] The present invention improves the data quality and uniformity by performing format conversion, time synchronization, noise filtering, and normalization processing on the original data, provides a high-quality input basis for subsequent access policy construction and model training, and effectively enhances the data processing accuracy and robustness of the system.

[0115] In this embodiment, the access control policy includes access users, target resources, operation permissions, authorization conditions, and valid time ranges.

[0116] By defining the access users, target resources, operation permissions, authorization conditions, and time range involved in the access control policy, the present invention realizes fine-grained and multi-dimensional access permission configuration, enhances the expressiveness and scalability of the policy, and helps to achieve flexible permission control.

[0117] In this embodiment, step S2 specifically includes:

[0118] S21. Extract feature variables related to access control from the standardized dataset to construct an initial feature set F = {f1, f2,..., f n}, where f n represents a feature variable, including user identity identifier, user role, request time, request resource type, resource sensitivity level, and historical access status;

[0119] S22. Perform one-hot encoding on the categorical variables in the initial feature set F to generate a sparse feature matrix X = {x ij}, where x ij represents the encoded value of the i-th access record on the j-th feature;

[0120] S23. Associate the sparse feature matrix X with the historical access authorization record label set Y = {y i}, where y i ∈ {0, 1}, representing the access control result of the i-th record, 1 indicating allowed access, and 0 indicating denied access;

[0121] S24. Construct an access control scoring function S(i), and use a linear weighted model to score the access records:

[0122]

[0123] Among them, S(i) represents the access control scoring function, w j represents the weight vector of the j-th feature, and x ij represents the encoded value of the i-th access record on the j-th feature;

[0124] S25. Set an access control threshold θ, and generate an access policy label according to the comparison result between the calculation result of the access control scoring function and the threshold. When the value of the access control scoring function is greater than the access control threshold, the access policy label is 1; when the value of the access control scoring function is less than the access control threshold, the access policy label is 0;

[0125] S26. The feature variables involved in the access control scoring function, the weight vector W = {w1, w2,..., w n}, the access control threshold θ, and the access decision result as access control policy rules, are recorded as a set of policy entries P = {p1, p2,, p k};

[0126] S27. Generate an access control policy set according to the set of policy entries P, and store it as a structured configuration file, which is used as the input content for the subsequent generation and deployment of smart contracts.

[0127] In the present invention, by extracting feature variables from a standardized dataset, constructing an access scoring function and automatically generating policy tags, the quantitative definition and dynamic generation of policy rules are realized based on the scoring function, which improves the intelligence level of policy construction and reduces the human configuration cost.

[0128] In this embodiment, the S3 specifically includes:

[0129] S31. Parse each policy in the access control policy set, extract the access user identifier, resource identifier, operation type, permission type, and effective time interval, and construct a structured configuration item;

[0130] S32. Combine all configuration items into a configuration file data structure;

[0131] S33. Load a preset contract template, which includes a contract declaration area, a permission judgment function, an event trigger function, a state variable definition area, and a rule definition area;

[0132] S34. According to the configuration items in the structured policy configuration file, insert each content into the rule definition area of the preset contract template through a rule mapping logic, and automatically generate a contract code file;

[0133] S35. Compile the generated contract code file to obtain the smart contract bytecode;

[0134] S36. Call the deployment function through the blockchain interface, deploy the smart contract bytecode to all predefined contract nodes in the blockchain network, generate a set of on-chain contract addresses, and establish a mapping relationship between the configuration file identifier and the corresponding contract address to complete the smart contract deployment operation.

[0135] In the present invention, by converting the policy configuration into a structured file and automatically generating and deploying a smart contract in combination with a preset contract template, an automatic mapping mechanism between the policy and the contract is constructed, realizing the on-chain deployment and unified execution of the access control logic, and improving the deployment efficiency and execution consistency.

[0136] In this embodiment, the S4 specifically includes:

[0137] S41. After receiving a user access request, extract the access parameters and construct an access request quadruple, where the access request quadruple includes the identity identifier of the accessing user, the unique identifier of the target resource, the operation type requested by the user, and the submission time of the access request;

[0138] S42. Pack the access request quadruple into a transaction data structure, and define the access transaction as TX = {R, Sig, TS}, where TX represents the access request transaction object, R represents the access request quadruple, Sig represents the digital signature of the requesting user, and TS represents the timestamp of the transaction submission;

[0139] S43. Submit the access transaction TX to the blockchain network through the blockchain client interface and send it to the node containing the access control smart contract;

[0140] S44. The smart contract on the node parses the received access transaction and calls the permission judgment function;

[0141] S45. In the smart contract, load the preset access control policy set P, perform a matching operation, and determine whether there is a policy p j that satisfies the conditions:

[0142]

[0143] where UID i and UID j represent the user identifiers allowed by the policy, RID i and RID j represent the corresponding resource identifiers, OP i and OP j represent the allowed operation types, represents the policy effective time interval, Auth i represents the policy authorization result, 1 means access is allowed, 0 means access is denied, ∧ represents the logical "and" operation, and determine whether the conditions are satisfied simultaneously. UID represents the access user identity identifier, RID represents the target resource identifier, OP represents the operation type, T represents the access request time, and p i represents the i-th access control policy;

[0144] S46. If there is a policy p j that satisfies the conditions, then the matching is successful, and the smart contract outputs the access control result:

[0145] checkAccess(R) = Auth j ;

[0146] where checkAcces(R) represents the access judgment result, and Auth jThe authorized value representing the matching policy, and R represents the access request quadruple.

[0147] In the present invention, by constructing an access request quadruple and submitting the access request in the form of a blockchain transaction, the smart contract performs matching judgment according to the preset policy, realizing automated permission verification and access control without manual intervention, effectively reducing the risk of manual configuration and improving the response efficiency.

[0148] In this embodiment, the S7 specifically includes:

[0149] S71. Analyze the user identification field, resource identification field, and resource type field in the access transaction, retrieve the historical interaction records of the corresponding user and resource in the data usage log, and count the access times F;

[0150] S72. Query the sensitivity level corresponding to the resource type DT from the resource tag library and divide it into the sensitivity level set:

[0151] DT ∈ {T1, T2, T3};

[0152] Among them, DT represents the queried resource type, T1 represents ordinary data, T2 represents data containing restricted fields, and T3 represents data containing key privacy content;

[0153] S73. According to the sensitivity level and access frequency, call the rule matching logic, execute the privacy mechanism selection process, and output the protection mechanism type M according to the condition judgment. The rule matching logic includes:

[0154] When the queried resource type is ordinary data and the access times are less than the access frequency threshold, set the protection mechanism type to the differential privacy mechanism;

[0155] When the queried resource type is data containing restricted fields and the access times are greater than the access frequency threshold, set the protection mechanism type to the zero-knowledge proof mechanism;

[0156] When the queried resource type is data containing key privacy content, set the protection mechanism type to the homomorphic encryption mechanism;

[0157] S74. Execute according to the selection result, including:

[0158] When the selection result is the differential privacy mechanism, call the perturbation generation function to add a random noise term ε to the original data D and perform noise addition calculation:

[0159] D * = D + ε, ε ∼ Lap(0, λ);

[0160] Among them, D *Let the data after adding noise be denoted as, \(D\) represents the original data, \(\epsilon\) represents a noise variable following the Laplace distribution, \(Lap\) represents the Laplace distribution, and \(\lambda\) represents the set privacy budget parameter;

[0161] When the selection result is the zero - knowledge proof mechanism, call the zero - knowledge proof mechanism construction module to generate the proof content \(\pi\), bind the original data \(D\) with the proof structure, and the combined data format:

[0162] D * =(D, \(\pi\));

[0163] Among them, \(D\) * represents the combined data, and \(\pi\) represents the proof content;

[0164] When the selection result is the homomorphic encryption mechanism, load the encryption parameters \(PK=(n, g)\), and perform the encryption operation using the Paillier encryption function:

[0165] D * =E PK (D)=g D ·r n mod n 2 ;

[0166] Among them, \(D\) * represents the ciphertext data, \(D\) represents the original data, \(g\) and \(n\) represent the homomorphic encryption public key parameters, \(r\) represents the encryption random number, \(mod\) represents the modulo operator, and \(E\) PK represents the homomorphic encryption mechanism;

[0167] S75. After the data processing is completed, inject the scrambled data, bound proof, or ciphertext data into the response module and send it to the requesting user as an access response.

[0168] The present invention introduces the user identity, resource sensitivity level, and access frequency as input parameters, and intelligently selects the differential privacy, zero - knowledge proof, or homomorphic encryption mechanism for customized data protection, realizing the output of the access result of "usable but invisible", and enhancing the system's response ability to changes in data sensitivity.

[0169] In this embodiment, the specific content of S8 includes:

[0170] S81. The system executes the data collection program on each storage node in the blockchain network, reads the data usage behavior and data access behavior records of the nodes, extracts the user identifier, resource identifier, operation type, access time, and access determination value, and constructs a local structured training data set;

[0171] S82. Each node initializes the substructure of the gradient boosting tree algorithm locally according to the local modeling process of the federated gradient boosting tree algorithm, sets the number of tree rounds to G, trains the weak classifier round by round on the local structured training dataset, and executes the boosting calculation process. A decision tree is generated in each round:

[0172]

[0173] Among them, represents the prediction result of the j-th sample, and α t represents the learning rate of the t-th subtree, represents the decision tree generated in the t-th round of training for the i-th node, represents the feature vector of the j-th sample, and G represents the total number of rounds, describing the number of tree rounds;

[0174] S83. Calculate the first-order and second-order gradient values of the samples in each round of training:

[0175]

[0176] Among them, represents the first-order gradient value, represents the second-order gradient value, represents the true label of the sample and the predicted value between the loss function, represents the derivative operation, represents the true label of the sample;

[0177] S84. Each node encrypts the local gradient information according to the collaborative training mechanism of the federated gradient boosting tree algorithm, and uploads the encrypted statistic to the federated coordination server. The coordinator aggregates the global feature gains, selects the optimal split point, and generates the global decision structure;

[0178] S85. The coordination server constructs the global tree structure of the current round according to the aggregation result, and distributes the decision parameters to all nodes. Each node synchronously updates the structure of the gradient boosting tree algorithm;

[0179] S86. Each node executes the local prediction task on the updated decision tree, scores the behavior features of the newly accessed request, and calculates the prediction result:

[0180]

[0181] Among them, represents the prediction result, and η t represents the weight of the decision tree in the t-th round, and h t (·) represents the decision tree in the t-th round obtained by global training;

[0182] S87. When the system detects that the predicted output is inconsistent with the existing access control policy set, or the current behavior pattern is not covered by the policy, the model automatically generates supplementary policy entries;

[0183] S88. The system calls the policy reconstruction program based on the supplementary policy entries, writes to the structured configuration file, and calls the smart contract template rendering engine to generate new contract code, completes bytecode compilation and deploys it to each node of the blockchain network, covering the old version of the smart contract.

[0184] The present invention collects access behavior data through distributed nodes, combines the federated gradient boosting tree algorithm for modeling and prediction, realizes policy optimization and adaptive update without sharing raw data, and effectively enhances the system's perception ability of access patterns and policy evolution ability.

[0185] A data security and privacy management system based on blockchain technology, comprising:

[0186] A data collection module, used to collect raw data in the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset;

[0187] A policy generation module, used to construct an access control policy set based on the standardized dataset and convert the access control policy into a structured policy configuration file;

[0188] A contract construction module, used to load a preset contract template based on the structured policy configuration file, generate a contract code file, compile it into smart contract bytecode, and deploy it to each node in the blockchain network through a blockchain interface;

[0189] A request processing module, used to construct an access request quadruple when receiving an access request, encapsulate the access request as a blockchain transaction, and submit it to a blockchain node containing a smart contract;

[0190] A contract execution module, used to match and judge the access request and the deployed access control policy by the smart contract in the blockchain node, output an access judgment result, and record an access authorization event or a rejection event;

[0191] An access audit module, used to structurally process the access control result, request information, and contract execution log, and write them into the blockchain ledger to form a traceable data access behavior record;

[0192] A privacy protection module, used to select a differential privacy mechanism, a zero-knowledge proof mechanism, or a homomorphic encryption mechanism according to the visitor's identity, the target data type, and the access frequency, and perform privacy protection processing on the access return data and provide it to the access party;

[0193] The policy optimization module is used to model and predict access patterns based on the data usage behavior and data access behavior records recorded in each blockchain storage node using the federated gradient boosting tree algorithm, generate a new access control policy set based on the prediction results, call the contract construction module to regenerate the contract code, and deploy the updated smart contract to the blockchain network.

[0194] Embodiment 1:

[0195] In order to verify the feasibility of the present invention in data governance within an enterprise, the present invention is applied to a data sharing management platform within a large Internet technology company. The company has multiple business departments such as R&D, operations, marketing, finance and legal affairs. Internal data resources include user behavior logs, market analysis reports, financial flow data, contract files, employee information, etc. Since a large amount of commercially sensitive and personal privacy data is involved, the company always faces problems such as low efficiency of authority control, difficulty in holding accountable for data abuse, and a single privacy protection mechanism when using data between different business lines.

[0196] Before the deployment of the present invention, the company used a combination of static access permission lists and role-based permission control to manage data access. The operation and maintenance department manually configured access policies. After users submitted access requests, they had to wait for review, which usually took 1-3 days. Access records were only saved in local server logs, which posed risks such as human deletion and missing information. It lacked trustworthy and auditable capabilities, especially when cross-departmental calls involving financial data and user analysis data were involved. Access conflicts and permission errors frequently occurred.

[0197] The company deploys eight main functional modules included in the method of the present invention in its unified data platform. In the data collection stage, user access request records, data resource identifiers, request operation types, user identities and other information are collected from the internal system. Taking August 2024 as an example, the company has accumulated 62,215 cross-departmental data access requests, of which the marketing department accessed 14,328 user behavior logs and the operations department accessed 9,504 financial flow records.

[0198] The system automatically performs format conversion, time synchronization, noise filtering and normalization on the data to form a unified standardized data set. On this basis, the platform builds an access control policy set and automatically generates a structured configuration file. It automatically generates contract code through smart contract templates and deploys it to multiple business nodes in the company's internal blockchain network. After the user initiates an access request, the request is encapsulated as a transaction and broadcast to the on-chain nodes. The node contract determines the access rights based on the configured policy and immediately returns the authorization or rejection result.

[0199] In the data return phase, the system dynamically selects differential privacy, zero-knowledge proof, or homomorphic encryption technology for data protection processing based on the visitor's identity, resource sensitivity level, and access frequency. For example, when the marketing department accesses financial transactions, if the access behavior is frequent and the resource fields include tax fields, the company's system will automatically apply the Paillier homomorphic encryption algorithm to encrypt the data and return the operable ciphertext data through the permission calculation module. Conversely, if the access content is statistical analysis results, perturbation processing will be performed through the differential privacy mechanism to meet the dual requirements of analysis accuracy and privacy protection.

[0200] During operation, each node automatically records access requests and processing results. The system collects an average of 2,300 data access records per day and performs modeling training based on the federated gradient boosting tree algorithm every 48 hours. The system performs local modeling on the access behavior data within 7 days. Each node constructs a decision sub-tree locally and sends the intermediate results to the coordination node through encrypted transmission. The coordination node integrates the information to generate a global model, predicts the strategy adaptation situation, and automatically identifies abnormal access patterns and policy weaknesses, triggering the policy entry generation module for optimization and iteration.

[0201] Table 1 Comparison Table of Experimental Data

[0202]

[0203] From the overall comparison data, the deployment of the present invention in the enterprise data platform significantly improves the deficiencies of traditional data access control methods in terms of efficiency, accuracy, and privacy protection.

[0204] In terms of access response efficiency, the present invention submits access requests as transactions to the blockchain network and is automatically executed by smart contracts, replacing the original method that relied on manual approval. The average access processing time is significantly shortened from 47,520 seconds (about 13.2 hours) before implementation to 0.49 seconds, and the access response time almost realizes real-time feedback, improving the business collaboration efficiency.

[0205] In terms of the accuracy of permission control, since the present invention introduces structured policy configuration, scoring function modeling, and federated learning algorithms to dynamically optimize the policy, the policy misjudgment rate of the system has decreased from the original 1.6% to 0.2%, a decrease of 87.5%, significantly reducing the risks of data misauthorization and unauthorized omission, and enhancing the access security of the system.

[0206] The data behavior auditing ability has also been significantly enhanced. By structuring and processing access control results, request parameters, and contract execution logs and writing them into the blockchain ledger, the complete recording rate of access logs has been increased from 76.2% to 99.5%, realizing full-process traceability of access behavior and cross-departmental traceability, meeting the enterprise's auditing requirements for clear data responsibility chains.

[0207] In terms of privacy protection, the present invention introduces a multi-mechanism intelligent selection logic based on data types and access behaviors, which increases the matching accuracy rate of privacy mechanisms from the original 70.3% to 95.7%, an increase of approximately 25.4%. The system can flexibly invoke differential privacy, zero-knowledge proof, or homomorphic encryption mechanisms for different types of sensitive information, effectively achieving the data usage goal of "usable but invisible" and ensuring the compliant sharing of enterprise data.

[0208] The present invention also constructs an access behavior modeling mechanism based on the federated gradient boosting tree, realizing the automatic learning and evolution of access policies. The policy update response cycle is shortened from the original 3.8 days to 0.9 days, improving the adaptation speed of the policy to new access patterns. At the same time, the average F1-score of the model prediction reaches 0.936, indicating that the system has high stability and accuracy and can support the continuous online optimization of access policies.

[0209] In terms of coverage ability, the policy response rate of the system to new access patterns is increased from 81.5% to 97.2%, significantly reducing the blind and gray areas of access policies and laying a foundation for ensuring the safe operation of the data system. In addition, after the system is deployed, the misexposure rate of sensitive data is decreased from 2.3% to 0.4%, showing a significant enhancement in privacy protection capabilities.

[0210] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, making equivalent substitutions or changes should be covered within the protection scope of the present invention.

Claims

1. A data security and privacy management method based on blockchain technology, characterized in that: The steps include: S1. Collect the original data in the target system, generate a data set to be processed, pre-process the data set to be processed, and form a standardized data set; S2, build access control policy set based on standardized data set; S3, converting the access control policy set into a structured policy configuration file, generating contract code based on a preset contract template, and deploying it as a smart contract to each node in the blockchain network after compilation; S4. When an access request is received, the access request is submitted to the blockchain network as a transaction, and the smart contract matches and judges the access request with the preset policy; S5. Determine whether the access request is legal based on the smart contract execution result. If it is legal, record the access authorization event and allow access. If it is illegal, deny access and record the denial event. S6. Structural processing of access control results, request information and smart contract execution logs, and writing them into the blockchain ledger to form a record of data access behavior; S7. Intelligently select differential privacy mechanism, zero-knowledge proof mechanism or homomorphic encryption mechanism according to the visitor's identity, target data type and access frequency, and provide the access return data to the visitor after privacy protection processing; S8. Based on the data usage behavior and data access behavior records recorded in each storage node, the federated gradient boosting tree algorithm is used to model and predict the access pattern. The access control policy set is dynamically optimized according to the prediction results, the contract code is regenerated and the updated smart contract is deployed to the blockchain network.

2. According to a data security and privacy management method based on blockchain technology according to claim 1, it is characterized in that: The original data includes user identity information, access request, data type and data resource identification, and the preprocessing includes format conversion, time synchronization, noise filtering and normalization processing.

3. According to a data security and privacy management method based on blockchain technology according to claim 1, it is characterized in that: The access control policy includes access users, target resources, operation permissions, authorization conditions and effective time range.

4. According to a data security and privacy management method based on blockchain technology according to claim 1, it is characterized in that: The S2 specifically includes: S21. Extract feature variables related to access control from the standardized data set and construct an initial feature set F = {f1, f2,, f n }, where f n Represents characteristic variables, including user identity, user role, request time, requested resource type, resource sensitivity level, and historical access status; S22, perform one-hot encoding on the categorical variables in the initial feature set F to generate a sparse feature matrix X = {x ij }, where x ij Represents the encoding value of the i-th access record on the j-th feature; S23, the sparse feature matrix X and the historical access authorization record label set Y = {y i } to associate, where y i ∈{0,1}, represents the access control result of the i-th record, 1 means access is allowed, 0 means access is denied; S24. Construct access control scoring function S(i) and use a linear weighted model to score access records: Where S(i) represents the access control scoring function, w j represents the weight vector of the jth feature, x ij Represents the encoding value of the i-th access record on the j-th feature; S25, setting an access control threshold θ, and generating an access policy label according to the comparison result between the access control scoring function calculation result and the threshold. When the access control scoring function value is greater than the access control threshold, the access policy label is 1, and when the access control scoring function value is less than the access control threshold, the access policy label is 0; S26, the feature variables and weight vector W involved in the access control scoring function are converted into {w1,w2,,w n }, the access control threshold θ and the access decision result are used as the access control policy rules and recorded as the policy entry set P = {p1, p2,, p k }; S27. Generate an access control policy set based on the policy entry set P and store it as a structured configuration file as input content for subsequent smart contract generation and deployment.

5. According to a data security and privacy management method based on blockchain technology according to claim 1, it is characterized in that: The S3 specifically includes: S31, perform field parsing on each policy in the access control policy set, extract the access user ID, resource ID, operation type, permission type and effective time interval, and construct a structured configuration item; S32, composing all configuration items into a configuration file data structure; S33, loading a preset contract template, wherein the preset contract template includes a contract declaration area, an authority judgment function, an event trigger function, a state variable definition area, and a rule definition area; S34. According to the configuration items in the structured policy configuration file, each item is inserted into the rule definition area in the preset contract template through the rule mapping logic, and the contract code file is automatically generated; S35. Compile the generated contract code file to obtain the smart contract bytecode; S36. Call the deployment function through the blockchain interface to deploy the smart contract bytecode to all predefined contract nodes in the blockchain network, generate a set of on-chain contract addresses, and establish a mapping relationship between the configuration file identifier and the corresponding contract address to complete the smart contract deployment operation.

6. According to a data security and privacy management method based on blockchain technology as described in claim 1, it is characterized in that: The S4 specifically includes: S41, after receiving the user access request, extract access parameters and construct an access request quadruple, wherein the access request quadruple includes the identity of the accessing user, the unique identifier of the target resource, the operation type requested by the user and the submission time of the access request; S42, packaging the access request quadruple into a transaction data structure, defining the access transaction as TX = {R, Sig, TS}, where TX represents the access request transaction object, R represents the access request quadruple, Sig represents the digital signature of the requesting user, and TS represents the timestamp of transaction submission; S43, submitting the access transaction TX to the blockchain network through the blockchain client interface and sending it to the node containing the access control smart contract; S44. The smart contract on the node parses the received access transaction and calls the permission judgment function; S45. In the smart contract, load the preset access control policy set P, perform matching operations, and determine whether policy p exists. j Requirements: Among them, UID i and UID j Indicates the user ID allowed by the policy, RID i and RID j Indicates the corresponding resource identifier, OP i and OP j Indicates the type of operation allowed. Indicates the policy effective time interval, Auth i Indicates the policy authorization result, 1 means access is allowed, 0 means access is denied, ∧ indicates the logical "and" operation, judging whether the conditions are met at the same time, UID indicates the access user identity, RID indicates the target resource identifier, OP indicates the operation type, T indicates the access request time, p i represents the i-th access control policy; S46. If there is a strategy p that satisfies the conditions j , the match is successful, and the smart contract outputs the access control result: checkAccess(R)=Auth j ; Among them, checkAcces(R) indicates the access judgment result, Auth j Represents the authorization value of the matching policy, and R represents the access request quadruple.

7. According to a data security and privacy management method based on blockchain technology according to claim 1, it is characterized in that: The S7 specifically includes: S71, parsing the user identification field, resource identification field and resource type field in the access transaction, and retrieving the historical interaction records between the corresponding user and the resource in the data usage log, and counting the number of accesses F; S72. Query the sensitivity level corresponding to the resource type DT from the resource tag library and classify it into a sensitivity level set: DT∈{T1,T2,T3}; Among them, DT represents the query resource type, T1 represents ordinary data, T2 represents data with restricted fields, and T3 represents data containing key privacy content; S73. According to the sensitivity level and access frequency, the rule matching logic is called to execute the privacy mechanism selection process, and the protection mechanism type M is output according to the condition judgment. The rule matching logic includes: When the query resource type is common data and the number of accesses is less than the access frequency threshold, the protection mechanism type is set to differential privacy mechanism; When the query resource type is data with restricted fields and the number of accesses is greater than the access frequency threshold, the protection mechanism type is set to zero-knowledge proof mechanism; When the query resource type is data containing key privacy content, set the protection mechanism type to homomorphic encryption mechanism; S74, executing according to the selection result, including: When the selection result is the differential privacy mechanism, the perturbation generation function is called to add a random noise term ε to the original data D and perform the noise addition calculation: D * =D+ε,ε~Lap(0,λ); Among them, D * represents the data after noise addition, D represents the original data, ε represents the noise variable that obeys the Laplace distribution, Lap represents the Laplace distribution, and λ represents the set privacy budget parameter; When the selection result is the zero-knowledge proof mechanism, the zero-knowledge proof mechanism construction module is called to generate the proof content π, bind the original data D to the proof structure, and combine the data format: D * =(D,π); Among them, D * represents the combined data, and π represents the proof content; When the result is a homomorphic encryption mechanism, the encryption parameter PK=(n,g) is loaded and the encryption operation is performed using the Paillier encryption function: D * =E PK (D)=g D ·r n mod n 2 ; Among them, D * represents ciphertext data, D represents original data, g and n represent homomorphic encryption public key parameters, r represents encrypted random number, mod represents modulus operator, E PK Represents the homomorphic encryption mechanism; S75. After the data processing is completed, the scrambled data, binding certificate or ciphertext data is injected into the response module and sent to the requesting user as an access response.

8. According to a data security and privacy management method based on blockchain technology as described in claim 1, it is characterized in that: The S8 specifically includes: S81. The system executes a data collection program on each storage node in the blockchain network, reads the data usage behavior and data access behavior records of the node, extracts the user identifier, resource identifier, operation type, access time and access judgment value, and constructs a local structured training data set; S82. Each node initializes the substructure of the gradient boosting tree algorithm locally according to the local modeling process of the federated gradient boosting tree algorithm, sets the number of tree rounds to G, trains the weak classifiers round by round on the local structured training data set, executes the boosting calculation process, and generates a decision tree in each round: in, Represents the prediction result of the jth sample, α t represents the learning rate of the t-th subtree, represents the decision tree generated by the tth round of training for the i-th node, represents the feature vector of the jth sample, G represents the total number of rounds, describing the number of tree rings; S83. Calculate the first-order and second-order gradient values ​​of the sample in each round of training: in, represents the first-order gradient value, represents the second-order gradient value, Represents the true label of the sample With the predicted value The loss function between represents the derivative operation, Represents the true label of the sample; S84, each node uses the collaborative training mechanism of the federated gradient boosting tree algorithm to train local gradient information Encryption is performed and the encrypted statistics are uploaded to the federated coordination server, where the coordinator summarizes the global feature gains, selects the optimal split point and generates a global decision structure. S85. The coordination server builds the global tree structure of the current round according to the aggregation results, and distributes the decision parameters to all nodes, and each node synchronously updates the structure of the gradient boosting tree algorithm; S86. Each node performs a local prediction task on the updated decision tree, scores the behavior characteristics of the new access request, and calculates the prediction result: in, represents the prediction result, η t represents the weight of the t-th round decision tree, h t (·) represents the t-th round decision tree obtained by global training; S87, when the system detects the predicted output When there is inconsistency with the existing access control policy set, or the current behavior pattern is not covered by the policy, the model automatically generates supplementary policy entries; S88. The system calls the policy reconstruction program based on the supplementary policy entries, writes the structured configuration file, and calls the smart contract template rendering engine to generate new contract code, completes bytecode compilation and deploys it to each node of the blockchain network, overwriting the old version of the smart contract.

9. A data security and privacy management system based on blockchain technology, which implements the data security and privacy management method based on blockchain technology according to any one of claims 1 to 8, characterized in that: include: The data acquisition module is used to collect the raw data in the target system, generate a data set to be processed, pre-process the data set to be processed, and form a standardized data set; A policy generation module, used to construct an access control policy set based on a standardized data set and convert the access control policy into a structured policy configuration file; The contract building module is used to load the preset contract template based on the structured policy configuration file, generate the contract code file, compile it into smart contract bytecode, and deploy it to each node in the blockchain network through the blockchain interface; A request processing module, which is used to construct an access request quadruple upon receiving an access request, encapsulate the access request into a blockchain transaction, and submit it to the blockchain node containing the smart contract; The contract execution module is used for the smart contract in the blockchain node to match and judge the access request with the deployed access control policy, output the access judgment result, and record the access authorization event or the access rejection event; The access audit module is used to perform structured processing on access control results, request information, and contract execution logs, and write them into the blockchain ledger to form a traceable record of data access behavior; The privacy protection module is used to select a differential privacy mechanism, a zero-knowledge proof mechanism, or a homomorphic encryption mechanism according to the visitor's identity, target data type, and access frequency, and to perform privacy protection processing on the access return data before providing it to the visitor; The policy optimization module is used to model and predict access patterns based on the data usage behavior and data access behavior records recorded in each blockchain storage node using the federated gradient boosting tree algorithm, generate a new access control policy set based on the prediction results, call the contract construction module to regenerate the contract code, and deploy the updated smart contract to the blockchain network.

Images