Multi-instance networking method, device, and electronic device based on blockchain

Abstract

Embodiments of the present specification provide a blockchain-based multi-instance networking method and device and electronic equipment. The method comprises: receiving an access request initiated by a first data collaborator; wherein the access request comprises the device identifier of at least one service device corresponding to the first data collaborator; in response to the access request, adding the at least one service device as a blockchain node to a data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaborator; and determining whether a second service program instance associated with at least one service device corresponding to a second data collaborator other than the first data collaborator in the plurality of data collaborators is created; if so, creating a data synchronization channel between the first service program instance and the second service program instance.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of blockchain technology, and in particular to a multi-instance networking method and device and electronic device based on blockchain. Background Art

[0002] When enterprises or individuals use user data required for business across domains, on the one hand, they need to implement a strict application and approval process to control and authorize the use of user data; on the other hand, they need to use technical means to ensure the secure transfer of user data.

[0003] The Data Security Blockchain (DSB), a widely used blockchain-based solution for ensuring the secure transfer of user data, allows for the cross-domain transfer of user data in encrypted form between multiple cross-domain data collaborators (data sources), without transferring control of the user data.

[0004] However, since the existing data collaboration platforms based on data security blockchain usually adopt a centralized network service architecture, as the usage scenarios of user data become increasingly diverse, they have gradually been unable to meet usage needs. Summary of the Invention

[0005] The embodiments of this specification provide a multi-instance networking method, device, and electronic device based on blockchain.

[0006] According to a first aspect of an embodiment of this specification, a multi-instance networking method based on blockchain is provided, the method being applied to a data collaboration platform based on a data security blockchain; the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively; the method comprising:

[0007] Receiving an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party;

[0008] In response to the access request, adding the at least one service device as a blockchain node to the data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaboration party; and

[0009] determining whether a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties is created; if so, creating a data synchronization channel between the first service program instance and the second service program instance;

[0010] The plurality of data cooperation parties correspond to different data domains respectively; the data synchronization channel is used for cross-domain data synchronization between the first service program instance and the second service program instance; and the service program instance is used for authorization management of cross-chain transfer of ciphertext data corresponding to user data stored on a service device associated with the service program instance.

[0011] According to a second aspect of the embodiments of the present specification, a multi-instance networking device based on a block chain is provided, which is applied to a data cooperation platform based on a data security block chain; a block chain node in the data security block chain includes service devices corresponding to a plurality of data cooperation parties respectively; and the device includes:

[0012] a receiving unit configured to receive an access request initiated by a first data cooperation party; wherein the access request includes a device identifier of at least one service device corresponding to the first data cooperation party;

[0013] a responding unit configured to, in response to the access request, add the at least one service device as a block chain node to the data security block chain, and create a first service program instance associated with the at least one service device corresponding to the first data cooperation party;

[0014] a determining unit configured to determine whether a second service program instance associated with at least one service device corresponding to a second data cooperation party other than the first data cooperation party in the plurality of data cooperation parties is created;

[0015] a networking unit configured to, in a case where the second service program instance associated with the at least one service device corresponding to the second data cooperation party other than the first data cooperation party in the plurality of data cooperation parties is created, create a data synchronization channel between the first service program instance and the second service program instance; wherein the plurality of data cooperation parties correspond to different data domains respectively; the data synchronization channel is used for cross-domain data synchronization between the first service program instance and the second service program instance; and the service program instance is used for authorization management of cross-chain transfer of ciphertext data corresponding to user data stored on a service device associated with the service program instance.

[0016] According to a third aspect of the embodiments of the present specification, an electronic device is provided, which includes:

[0017] a processor;

[0018] a memory for storing processor-executable instructions;

[0019] The processor is configured to perform any of the above multi-instance networking methods based on a block chain.

[0020] According to the embodiment of the present specification, by creating an independent service program instance for each data cooperation party accessing the data cooperation platform on the data cooperation platform, and creating a data synchronization channel between the service program instances created for each data cooperation party, when each data cooperation party accessing the data cooperation platform has the demand of cross-domain transfer of the ciphertext data of the user data to be maintained to other data cooperation parties, the data synchronization between the data cooperation party and other data cooperation parties can be realized in real time based on the data synchronization channel. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a network service architecture diagram of a multi-instance networking in a data cooperation platform provided by an embodiment of the present specification;

[0022] Figure 2 is a flowchart of a multi-instance networking method based on a block chain provided by an embodiment of the present specification;

[0023] Figure 3 is a schematic diagram of a device registration process in a service program instance provided by an embodiment of the present specification;

[0024] Figure 4 is a schematic diagram of a device update process in a service program instance provided by an embodiment of the present specification;

[0025] Figure 5 is a schematic diagram of a data registration process in a service program instance provided by an embodiment of the present specification;

[0026] Figure 6 is a schematic diagram of a data update process in a service program instance provided by an embodiment of the present specification;

[0027] Figure 7 is a schematic diagram of a data downlink process in a service program instance provided by an embodiment of the present specification;

[0028] Figure 8 is a flowchart of a data cross-domain authorization method provided by an embodiment of the present specification;

[0029] Figure 9 is a schematic diagram of data cross-domain authorization provided by an embodiment of the present specification;

[0030] Figure 10 is a schematic diagram of data cross-domain transfer provided by an embodiment of the present specification;

[0031] Figure 11 is a hardware structure diagram of a multi-instance networking or data cross-domain authorization device based on a block chain provided by an embodiment of the present specification;

[0032] Figure 12It is a module of a multi-instance networking device based on blockchain provided in an embodiment of this specification;

[0033] Figure 13 It is a module of the data cross-domain authorization device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0034] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with this specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of this specification, as detailed in the appended claims.

[0035] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0036] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information without departing from the scope of this specification. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0037] The Data Security Blockchain (DSBC) is a network service architecture that uses blockchain as an underlying service. In this network service architecture, the blockchain nodes on the underlying blockchain can typically include service devices corresponding to multiple data collaborators.

[0038] Among them, the multiple data collaboration parties usually correspond to different data domains respectively. It should be noted that the multiple data collaboration parties correspond to different data domains respectively, specifically referring to the need for cross-domain data transmission and communication between the service devices corresponding to the multiple data collaboration parties. In actual applications, different service devices can usually access the user data stored in the local database of other service devices through the domain name access address (i.e., URL address). When a service device accesses another service device through the URL address, if the URL address of the service device being accessed is different from the URL address of the service device that initiated the access, then the data transmission and communication between the two service devices is called cross-domain. In actual applications, if each data collaboration party corresponds to multiple service devices, then the multiple service devices can share the same domain name access address.

[0039] In a data security blockchain, to ensure the secure use of user data maintained by each data collaborator, the user data maintained by each data collaborator is typically stored in the local database of the service device corresponding to each data collaborator. However, as an open storage platform, the blockchain can only store the data attribute information (also known as the data directory) corresponding to the user data maintained by each data collaborator.

[0040] In this way, any data collaborator can discover user data published by other data collaborators that have joined the data security blockchain by obtaining data attribute information on the blockchain. When a data collaborator discovers user data of interest published by another data collaborator, it can also initiate a data authorization request with the other data collaborator. The owner of the user data requesting authorization will then conduct the authorization review. Once the authorization is approved, the encrypted data of the user data can be transferred across domains to the data collaborator using the data synchronization channel between the data collaborators.

[0041] Since only the ciphertext data of user data is transferred across domains during the entire process, the plaintext data of user data never leaves the domain. Therefore, the solution based on the existing data security blockchain can ensure that the control of user data is not transferred while transferring user data across domains in the form of ciphertext.

[0042] However, although the data security blockchain has greatly improved the security of user data, the existing data collaboration platforms based on the data security blockchain usually adopt a centralized network service architecture based on a single service program instance.

[0043] When the service devices corresponding to the plurality of data collaboration parties serving as data sources access the data security blockchain as blockchain nodes, in order to manage the cross-domain transfer of the ciphertext data of the user data stored in the local databases of the service devices corresponding to the plurality of data collaboration parties, the data collaboration platform can utilize the resources on the blockchain service platform, create a centralized service program instance on the data collaboration platform for the plurality of data collaboration parties, and manage the cross-domain transfer of the ciphertext data of the user data maintained by the plurality of data collaboration parties through the centralized service program instance.

[0044] The service program instance can be a software service unit created on the blockchain service platform to provide services for the plurality of data collaboration parties. In actual applications, the centralized service program instance can be associated with all service devices that have joined the data security blockchain as blockchain nodes, and can manage the cross-chain transfer of the ciphertext data of the user data stored in the local databases of the associated service devices.

[0045] For example, any data collaboration party in the plurality of data collaboration parties can initiate a data authorization application to the centralized service program instance when discovering user data of interest published by other data collaboration parties, and the service program instance can authorize and approve the data authorization application.

[0046] In actual applications, as the use scenarios of data collaboration among the plurality of data collaboration parties become increasingly diverse, different data collaboration parties can have the need to form a data collaboration alliance by establishing a data collaboration relationship. Under such a demand, different data collaboration parties need to frequently synchronize data with each other.

[0047] However, the existing data collaboration platform based on the data security blockchain still adopts a centralized network service architecture with a single service program instance, and there is naturally no data synchronization channel between different data collaboration parties. Therefore, the existing data collaboration platform cannot meet such a demand.

[0048] Therefore, the present specification proposes a distributed network service architecture with multiple service program instances on a data collaboration platform based on a data security blockchain.

[0049] During implementation, in the above-mentioned data collaboration party platform, a centralized network service architecture based on a single service program instance may no longer be adopted. For each data collaboration party connected to the data collaboration platform, the resources on the data collaboration platform can be used to create a service program instance associated with at least one corresponding service device for each data collaboration party, and create a data synchronization channel between the service program instances corresponding to each data collaboration party, and synchronize data between the data collaboration parties through the data synchronization channel.

[0050] In the above technical solution, since the above-mentioned data collaboration party platform no longer adopts a centralized network service architecture based on a single service program instance, but adopts a network service architecture based on networking of multiple service program instances, the data collaboration platform will create an independent service program instance for each data collaboration party connected to the data collaboration platform, and create a data synchronization channel between the service program instances created for each data collaboration party, so that each data collaboration party connected to the data collaboration platform can synchronize data with other data collaboration parties in real time based on the data synchronization channel when there is a need to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, thereby meeting the data synchronization needs in the data collaboration alliance formed based on the data collaboration relationship.

[0051] For example, based on the existing centralized network service architecture of a single service program instance, since all data collaborators accessing the data collaboration platform share the same service program instance and lack a data synchronization channel, each data collaborator can only discover the datasets published by other data collaborators by periodically obtaining the data attribute information corresponding to the datasets published by other data collaborators from the data security chain. This approach obviously has a lag. For data collaborators who are data users, they cannot immediately perceive the latest data published by other data collaborators; similarly, for data collaborators who are data providers, they cannot promptly notify other data collaborators of the latest data they have published.

[0052] If the network service architecture based on multiple service program instances in the above technical solution is adopted, since an independent service program instance is created for each data collaborator on the data collaboration platform, and a data synchronization channel is established between the service instances corresponding to each data collaborator, after the data provider publishes the latest data on the data security blockchain, the data can be promptly synchronized with the corresponding service program instances of other data collaborators through the data synchronization channel.

[0053] See Figure 1 , Figure 1This is a network service architecture diagram using multi-instance networking in a data collaboration platform as shown in this specification.

[0054] In this specification, the data collaboration platform may no longer adopt a centralized network service architecture based on a single service program instance, but may adopt a distributed network service architecture in which multiple service program instances are networked.

[0055] like Figure 1 As shown, Figure 1 The first service program instance shown may be a service program instance created by the data collaboration platform for the first data collaboration party accessing the data collaboration platform and associated with a service device corresponding to the first data collaboration party. Figure 1 The second service program instance shown may be a service program instance created by the data collaboration platform for a second data collaboration party accessing the data collaboration platform and associated with a service device corresponding to the second data collaboration party.

[0056] It should be noted that each data collaborator connected to the data collaboration platform can correspond to one service device or multiple service devices. When a data collaborator connects to the data collaboration platform, the service device corresponding to the data collaborator will be added to the digital security blockchain as a blockchain node; for example, Figure 1 As shown, there are multiple service devices corresponding to the first data collaboration party, namely service device 1 to service device 4; there is one service device corresponding to the second data collaboration platform, namely service device 5.

[0057] Among them, the above service program example can be specifically adopted as follows Figure 1 The three-layer service architecture shown includes a first service layer, a second service layer, and a third service layer.

[0058] The first service layer can be an application service layer corresponding to the digital security blockchain.

[0059] The second service layer can be an authorization service layer corresponding to the digital security blockchain.

[0060] The third service layer can be the basic service layer corresponding to the digital security blockchain

[0061] Among them, no matter which of the above three service layers, it can include some basic service components provided on the data collaboration platform;

[0062] For example, Figure 1As shown, if the above data collaboration platform is a cloud service platform, the above three service layers may include service components such as SLB (Server Load Balancer, load balancing) and ECS (Elastic Compute Service, cloud service).

[0063] The application service layer may include a cross-domain transfer component for implementing cross-domain transfer of ciphertext data, an encryption and decryption component for implementing encryption and decryption functions for ciphertext data, and the like.

[0064] For example, Figure 1 As shown, if the above-mentioned data collaboration platform is a cloud service platform, then the above-mentioned cross-domain transfer component and encryption and decryption component can both be cloud components implemented based on cloud computing resources related to the ECS service on the cloud service platform.

[0065] The above-mentioned authorization service layer may specifically include a dataAuth (data authorization) component for implementing authorization management for cross-domain transfer of encrypted data, a DIS (Decentralized Identity Service) component for managing the blockchain digital identity of user data on the digital security blockchain, a transit service component for implementing data transfer for data stored on the digital security blockchain and the function of periodically obtaining data from the digital security blockchain, and the like.

[0066] For example, Figure 1 As shown, if the above-mentioned data collaboration platform is a cloud service platform, the above-mentioned dataAuth, DIS components and the above-mentioned transfer service can all be cloud components implemented based on cloud computing resources related to the ECS service on the cloud service platform.

[0067] The above-mentioned basic service layer can be used to implement basic service functions related to digital security blockchain; for example, service functions such as data on-chain storage.

[0068] For example, Figure 1 As shown, if the above-mentioned data collaboration platform is a cloud service platform, then each blockchain node on the data security blockchain (i.e., the service device corresponding to each data collaboration party) can be a virtual service device (such as a virtual machine) created based on the cloud computing resources related to the ECS service on the cloud service platform.

[0069] Please continue to see Figure 1 In addition to including several service components, the above-mentioned application service layer and the above-mentioned authorization service layer may also include several databases.

[0070] The database types of the database included in the application service layer and the authorization service layer are not particularly limited in the present specification. For example, as shown in Figure 1 , the database types can specifically include MySQL, Redis, OSS, SqlLite, and the like.

[0071] It should be noted that the database on the application service layer can be used as a local database on a service device corresponding to a data cooperation party, and can be used to store user data that needs to be transferred across domains. The database on the authorization service layer can include a database corresponding to each service component on the authorization service layer; for example, as shown in Figure 1 , the authorization service layer can include a database corresponding to the dataAuth component and the DIS component, and can also include a database corresponding to the relay service component.

[0072] The database corresponding to the dataAuth component and the DIS component can be specifically used to store data related to data authorization of cross-domain transfer of user data. The database corresponding to the relay service component can be specifically used to store data obtained by the component from the digital security blockchain at regular intervals.

[0073] In addition, a data synchronization channel can be created between the first service program instance and the second service program instance, for real-time data synchronization between service program instances. For example, the data synchronization channel can be a service calling channel created between service program instances based on the calling address of the service program instance (such as the domain name access address of the service device associated with the service program instance).

[0074] It should be emphasized that Figure 1 the example of the service program instance adopting a three-layer network service architecture is only an example, and in actual applications, the number of service layers of the service program instance and the components included in each service layer can be flexibly adjusted based on actual needs.

[0075] For example, in actual applications, based on the disclosed three-layer network service architecture, the plurality of service layers shown in Figure 1 may be combined into one service layer, or a certain service layer shown in Figure 1 may be further divided into a plurality of service layers, or the plurality of components shown in Figure 1 may be combined into one component according to functions, or a certain component shown in Figure 1 may be further divided into a plurality of components according to functions, and the like, which will not be exemplified one by one in the present specification. Figure 1

[0076] ​For example, in practical applications, when Figure 1 The second data collaboration party shown does not allow the ciphertext data of the user data stored on the service device corresponding to the second data collaboration party to be transferred across domains to other data collaboration parties. At this time, the second data collaboration party can only serve as a data user, but not as a data provider. In this case, since the second data collaboration party does not allow the ciphertext data of the user data stored on the service device corresponding to the second data collaboration party to be transferred across domains to other data collaboration parties, and the right to transfer the ciphertext data of the user data stored on the service device corresponding to the second data collaboration party to other data collaboration parties is not authorized to other data collaboration parties, the above-mentioned second service program instance corresponding to the second data collaboration party may not include Figure 1 The dataAuth component and the DIS component are shown above.

[0077] See Figure 2 , Figure 2 This is a flowchart of a multi-instance networking method based on blockchain according to an exemplary embodiment of this specification. This method can be applied to Figure 1 A data collaboration platform based on a data security blockchain in a network service architecture is shown; a blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties; user data maintained by each data collaboration party is stored in a local database of the service device corresponding to each data collaboration party; data attribute information corresponding to the user data maintained by each data collaboration party is stored on the data security blockchain; the method includes:

[0078] Step 210: Receive an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party.

[0079] The aforementioned data collaboration platform can be a cloud service platform; for example, in one example, the aforementioned data collaboration platform can be a blockchain cloud service platform. For example, the aforementioned blockchain cloud service platform can be a BaaS platform (also referred to as a BaaS cloud) that provides blockchain as a service (BaaS). BaaS platforms can provide pre-written software for activities occurring on the blockchain, offering easy-to-use, one-click deployment, fast verification, and flexible and customizable blockchain services to service devices coupled to the BaaS platform. This can accelerate the development, testing, and rollout of blockchain business applications, facilitating the implementation of blockchain business application scenarios across various industries.

[0080] The above-mentioned service device can be a local service device deployed by the data collaborator, or it can be a virtual service device created for the data collaborator using cloud computing resources on a cloud service platform.

[0081] For example, the service device corresponding to the data collaborator can be a VM virtual machine created for the data collaborator by the cloud service platform using cloud computing resources such as computing resources, storage resources, and transmission resources on the cloud service platform after the data collaborator pays the cloud service platform.

[0082] When the first data collaboration party wants to transfer the encrypted data of user data across domains to other data collaboration parties, or wants to obtain the encrypted data of user data maintained by other data collaboration parties that have been connected to the above-mentioned data collaboration platform across domains, it can specifically initiate an access request to the data collaboration platform; wherein, the access request can specifically include the device identification of at least one service device corresponding to the first data collaboration party.

[0083] Step 220: In response to the access request, the at least one service device is added to the data security blockchain as a blockchain node, and a first service program instance associated with the at least one service device corresponding to the first data collaboration party is created.

[0084] After receiving the access request initiated by the first data collaboration party, the data collaboration platform can respond to the access request and add at least one service device corresponding to at least one device identifier included in the access request as a blockchain node to the digital security blockchain network.

[0085] The specific process of adding at least one of the above service devices to the digital security blockchain network will not be detailed in this machine manual.

[0086] After at least one service device corresponding to the first data collaboration party successfully joins the digital security blockchain network as a blockchain node, the blockchain collaboration platform can also use the resources on the data collaboration platform to create a first service program instance on the data collaboration platform that is associated with at least one service device corresponding to the first data collaboration party.

[0087] Step 230 : Determine whether a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties except the first data collaboration party is created.

[0088] After the data collaboration platform creates a first service program instance for the first data collaboration party, the data collaboration platform can further determine whether to create a second service program instance associated with at least one service device corresponding to the second data collaboration party for the second data collaboration party connected to the data collaboration platform in the same manner.

[0089] Step 240, if yes, create a data synchronization channel between the first service program instance and the second service program instance; wherein the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used to perform authorization management on the cross-chain transfer of encrypted data corresponding to user data stored on the service device associated with it.

[0090] When the data collaboration platform determines that a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties has been created, the data collaboration platform may further create a data synchronization channel between the first service program instance and the second service program instance. The data synchronization channel may be specifically used for cross-domain data synchronization between the first service program instance and the second service program instance.

[0091] After the data synchronization channel between the above-mentioned first service program instance and the above-mentioned second service program instance is created, the networking between the first data collaboration party and the second data collaboration party is completed. Subsequently, the first service program instance and the second service program instance can perform real-time cross-domain data synchronization based on the data synchronization channel.

[0092] It should be noted that the second data collaborator here may refer to other data collaborators besides the first data collaborator, and the number of such other data collaborators may be one or more. Similarly, the second service program instance mentioned above may also refer to other service program instances created by the data collaboration platform for other data collaborators besides the first data collaborator, and the number of such other service program instances may be one or more.

[0093] For example, when the above-mentioned second data collaboration party refers to multiple other data collaboration parties other than the first data collaboration party, the data collaboration platform can respectively create data synchronization channels between the first service program instance and multiple service program instances created for the multiple other data collaboration parties to complete the networking between the first data collaboration party and the above-mentioned multiple other data collaboration parties.

[0094] It should be noted that, in actual applications, the data collaboration platform creates service program instances for each connected data collaboration party, and the roles can also be divided into master service program instances and slave service program instances.

[0095] For example, in one example, it is assumed that a data collaboration alliance is initiated by the operator of the data security blockchain. At this time, the operator can serve as the first data collaborator of the data collaboration alliance. In this case, the service program instance created for the operator and associated with at least one service device of the operator can serve as the main service program instance in the data collaboration alliance, and the service program instances created for other data collaborators (such as institutions) that subsequently join the data collaboration alliance can serve as slave service program instances in the data collaboration alliance.

[0096] Among them, it should be emphasized that the division of the service program instances created by the above-mentioned data collaboration platform for each connected data collaboration party into master instances and slave instances is only a distinction in roles. In actual applications, the master service program instance and the slave service program instance are two completely equal and independent service instances in terms of function.

[0097] In an exemplary embodiment, the data collaboration platform is a data synchronization channel between service program instances created with each data collaboration party, and specifically may be a service call channel created between service program instances based on a call address of the service program instance.

[0098] The type of the above-mentioned call address is not specifically limited in this specification;

[0099] In an exemplary embodiment, a domain name access address (ie, URL address) shared by at least one service device corresponding to each service program instance may be used as the calling address corresponding to each service program instance.

[0100] In this case, the service calling channel between each service program instance may be an http calling channel constructed between each service program instance based on a domain name access address shared by at least one service device corresponding to each service program instance.

[0101] Of course, in actual applications, the above-mentioned calling address may be in other forms such as an interface calling address, and the service calling channel between each service program instance may be an interface calling channel, which will not be listed one by one in this specification.

[0102] It should be noted that, since the call channel formed based on the call address is usually a one-way call channel, the service call channel between the first service program instance and the second service program can usually include a first service call channel formed based on the call address of the second service program instance maintained by the first service program instance, with the first service program instance as the call initiator and the second service program instance as the callee; and a second service call channel formed based on the call address of the first service program instance maintained by the second service program instance, with the second service program instance as the call initiator and the first service program instance as the callee.

[0103] For example, in one example, see Figure 1 , because for a service program instance, the dataAuth component located in the authorization service layer is functionally distinguished and is usually a core component in a service program instance; therefore, in this case, when creating a data synchronization channel between the first service program instance and the second service program instance, the URL address of the second service program instance can be added to the dataAuth component of the first service program instance for maintenance, so as to form a first http call channel between the dataAuth component of the first service program instance and the second service program instance. Correspondingly, the URL address of the first service program instance can be added to the dataAuth component of the second service program instance for maintenance, so as to form a second http call channel between the dataAuth component of the second service program instance and the first service program instance, thereby completing the creation of the data synchronization channel between the first service program instance and the second service program instance.

[0104] After a data synchronization channel is established between the first service instance and the second service instance, real-time data synchronization can be performed between the first and second service instances based on this data synchronization channel. The following describes the data synchronization process between the first and second service instances in detail, using specific data synchronization scenarios.

[0105] Data synchronization scenario 1:

[0106] In an exemplary embodiment, when the first data collaboration party needs to add a new service device, the first data collaboration party can initiate device registration to the first service program instance, associate the newly added service device with the first service program instance, and after the association is completed, the first service program instance synchronizes the device information of the newly added service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.

[0107] In this scenario, the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the device information of the service device newly added in the first service program instance.

[0108] See Figure 3 A schematic diagram of a device registration process in a service program example is shown. Figure 2 Based on the above embodiment, the following may also be included:

[0109] The first service program instance receives a device registration request; wherein the device registration request includes device information of a newly added service device of the first data collaboration party;

[0110] In response to the device registration request, the first service program instance establishes an association relationship between the newly added service device and the first service program instance, and stores device information of the newly added service device and the association relationship in a database corresponding to the first service program instance;

[0111] Then, the DataAuth component in the first service program instance is further called, and the DataAuth component further calls the DIS component in the first service program instance. The DIS component creates digital identity information for the newly added service device on the data security blockchain and returns the created digital identity information to the DataAuth component.

[0112] The DataAuth component further initiates a service call for the first service program instance based on the call address of the first service program instance maintained (ie Figure 3 callback call in), to return the digital identity information of the newly added service device to the first service program instance, and store it in the database corresponding to the first service program instance, that is, to store the digital identity information;

[0113] In addition, the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the digital identity information and device information of the newly added service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, and synchronize and store them in the database corresponding to the second service program instance, that is, store the digital identity information and device information.

[0114] It should be noted that a smart contract for creating digital identities is deployed on the data security blockchain;

[0115] The DIS component creates digital identity information of the added service device on the data security blockchain, which can include:

[0116] The DIS component invokes the smart contract deployed on the data security blockchain to create digital identity information of the added service device on the data security blockchain.

[0117] Data synchronization scenario two:

[0118] In an exemplary embodiment, when the first data collaborator needs to update any target service device associated with the first service program instance, the first data collaborator can initiate a blockchain device update to the first service program instance, update the device information of the target service device in the database corresponding to the first service program instance, and synchronize the updated device information of the target service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.

[0119] In this scenario, the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the updated device information of the target service device in the first service program instance.

[0120] Please refer to Figure 4 A schematic diagram of a device update process in a service program instance is shown, in which Figure 2 Based on the embodiment, it can further include:

[0121] The first service program instance receives a blockchain device update request; wherein the blockchain device update request includes to-be-updated device information of any target service device associated with the first service program instance;

[0122] In response to the blockchain device update request, the first service program instance updates the device information of the target service device stored in the database corresponding to the first service program instance based on the to-be-updated device information;

[0123] Then, further invoke the DataAuth component in the first service program instance, further invoke the DIS component in the first service program instance by the DataAuth component, update the digital identity information of the target service device on the data security blockchain by the DIS component, and return the updated digital identity information to the DataAuth component.

[0124] The DataAuth component further initiates a service call to the first service program instance based on the maintained call address of the first service program instance, returns the updated digital identity information to the first service program instance, and stores the updated digital identity information of the target service device in a database corresponding to the first service program instance;

[0125] In addition, the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the updated device information and updated digital identity information of the target service device to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, and synchronously update the device information of the target service device stored in the database corresponding to the second service program instance, that is, store the updated device information and updated digital identity information of the target service device.

[0126] Similar to the aforementioned device registration, the DIS component updates the digital identity information of the target service device on the data security blockchain, which may include:

[0127] The DIS component invokes the smart contract deployed on the data security blockchain to create new digital identity information for the target service device on the data security blockchain and associates the new digital identity information with the target service device's old digital identity information. The created new digital identity information is the updated digital identity information of the target service device.

[0128] Data synchronization scenario three:

[0129] In an exemplary embodiment, when the first data collaborator needs to publish a data set consisting of user data stored in a local database, the first data collaborator can initiate data registration to the first service program instance, generate data attribute information corresponding to the data set, and after storing the data attribute information in the data security blockchain (the blockchain evidence identifier corresponding to the data attribute information can be obtained), the first service program instance synchronizes the blockchain evidence identifier to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain evidence identifier.

[0130] In this scenario, the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the blockchain evidence identifier corresponding to the data attribute information.

[0131] See Figure 5A schematic diagram of a data registration process in a service program example is shown. Figure 2 Based on the above embodiment, the following may also be included:

[0132] The first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes a data set requested to be registered by the target service device;

[0133] In response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information in a local database of the target service device;

[0134] Then, the DataAuth component in the first service program instance is further called, and the DataAuth component publishes the data attribute information corresponding to the data set to the data security blockchain for storage, so as to obtain a blockchain storage identifier for querying the data attribute information on the chain from the data security blockchain.

[0135] The DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the blockchain evidence identifier and the data attribute information to the first service program instance, and store them in the database corresponding to the first service program instance, that is, the blockchain evidence identifier and the data attribute information are associated and stored.

[0136] Next, the first service program instance calls the DataAuth component in the first service program instance, which in turn calls the DIS component in the first service program instance. Furthermore, the DIS component creates digital identity information on the data security blockchain that includes the corresponding blockchain evidence identifier for the data attribute information corresponding to the data set, and returns the created digital identity information to the DataAuth component. The DIS component can create digital identity information on the data security blockchain that includes the blockchain evidence identifier for the data attribute information by calling the smart contract deployed on the data security blockchain.

[0137] Furthermore, the DataAuth component initiates a service call for the first service program instance based on the maintained call address of the first service program instance, so as to return the digital identity information of the data attribute information to the first service program instance and store it in a database corresponding to the first service program instance, that is, to store the digital identity information of the data attribute information;

[0138] In addition, the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the digital identity information of the data attribute information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance; so that the second service program instance can obtain the data attribute information from the data security blockchain based on the blockchain evidence identifier contained in the digital identity information, and synchronously store the obtained data attribute information in the database corresponding to the second service program instance.

[0139] Data synchronization scenario four:

[0140] In an exemplary embodiment, when the first data collaborator needs to update the published data set, the first data collaborator can initiate a data update to the first service program instance, generate updated data attribute information corresponding to the updated data set, and after storing the updated data attribute information in the data security blockchain (the blockchain evidence identifier corresponding to the updated data attribute information can be obtained), the first service program instance synchronizes the blockchain evidence identifier corresponding to the updated data attribute information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain evidence identifier.

[0141] In this scenario, the data synchronized between the first service program instance and the second service program instance through the data synchronization channel is the blockchain evidence identifier corresponding to the updated data attribute information.

[0142] See Figure 6 A schematic diagram of a data update process in a service program example is shown. Figure 2 Based on the above embodiment, the following may also be included:

[0143] The first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes a data set requested to be updated by the target service device;

[0144] In response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in a local database of the target service device;

[0145] Then, the DataAuth component in the first service program instance is further called, and the DataAuth component publishes the updated data attribute information corresponding to the data set to the data security blockchain for storage, so as to obtain a blockchain storage identifier for querying the updated data attribute information from the data security blockchain.

[0146] The DataAuth component further initiates a service call for the first service program instance based on the maintained calling address of the first service program instance, so as to return the blockchain evidence identifier and the updated data attribute information to the first service program instance, and store them in the database corresponding to the first service program instance, that is, the blockchain evidence identifier and the updated data attribute information are associated and stored.

[0147] Next, the first service program instance calls the DataAuth component in the first service program instance, and the DataAuth component calls the DIS component in the first service program instance. The DIS component further updates the data identity information of the updated data attribute information corresponding to the data set on the data security blockchain, and returns the updated digital identity information to the DataAuth component. The DIS component can call the smart contract deployed on the data security blockchain to create new digital identity information on the data security blockchain for the updated data attribute information, and associate the new digital identity information with the old digital identity information of the data attribute information before the update. The new digital identity information created is the updated digital identity information of the data set.

[0148] Furthermore, the DataAuth component initiates a service call to the first service program instance based on the maintained call address of the first service program instance, so as to return the updated digital identity information to the first service program instance and store the updated digital identity information in a database corresponding to the first service program instance, i.e., store the updated digital identity information;

[0149] In addition, the DataAuth component can also initiate a service call for the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the updated digital identity information to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance; so that the second service program instance can obtain the updated data attribute information from the data security blockchain based on the blockchain evidence identifier contained in the updated digital identity information, and synchronize the obtained updated data attribute information in the database corresponding to the second service program instance.

[0150] Data synchronization scenario five:

[0151] In an exemplary embodiment, when the first data collaborator needs to delete the published target data set, the first data collaborator can initiate a data downlink to the first service program instance, delete the target data set and the data attribute information of the target data set stored in the local database, and the first service program instance synchronizes the deletion notification of the target data set to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so that the second service program instance synchronously deletes the target data set.

[0152] In this scenario, the data attribute information of the target data set is synchronized between the first service program instance and the second service program instance through the data synchronization channel.

[0153] See Figure 7 A schematic diagram of a data registration process in a service program example is shown. Figure 2 Based on the above embodiment, the following may also be included:

[0154] The first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes a data set identifier of a target data set requested to be deleted by the target service device;

[0155] In response to the data deletion request, the first service program instance deletes the target data set and the data attribute information of the target data set stored in the local database of the target service device;

[0156] Then, the DataAuth component in the first service program instance is further called, and the DataAuth component sets the data identity information created by the data attribute information of the data set to an invalid state on the data security chain to obtain a setting result.

[0157] The DataAuth component further initiates a service call for the first service program instance based on the maintained call address of the first service program instance, returns the setting result to the first service program instance, and switches the state of the data set and data attribute information to a third state in a database corresponding to the first service program instance;

[0158] In addition, the DataAuth component can also initiate a service call to the second service program instance based on the maintained calling address of the second service program instance, so as to synchronize the deletion notification of the target data set to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance based on the deletion notification for deletion processing, and set the data identity information maintained in the database to an invalid state.

[0159] In summary, the multi-instance networking embodiment based on blockchain provided in this specification creates an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and creates a data synchronization channel between the service program instances created for each data collaboration party. When each data collaboration party connected to the data collaboration platform has the need to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, it can synchronize data with other data collaboration parties in real time based on the data synchronization channel.

[0160] After introducing the multi-instance network based on blockchain, the following will further introduce the embodiments related to cross-domain data authorization in this multi-instance network.

[0161] See Figure 8 , Figure 8 This is a flow chart of a cross-domain data authorization method according to an exemplary embodiment of the present specification. The method can be applied to Figure 1 The network service architecture shown is a data collaboration platform based on a data security blockchain; the blockchain nodes in the data security blockchain include service devices corresponding to multiple data collaboration parties respectively; a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties; the service program instance is used to authorize the cross-domain transfer of encrypted data of user data stored on the service device associated with it; the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance; the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the method includes:

[0162] Step 310: The first service program instance receives a data authorization request initiated by the second data collaborator through the data synchronization channel for user data maintained by the first data collaborator; wherein the data authorization request includes the data identifier of the target user data that the second data collaborator requests authorization for.

[0163] This specification creates a data synchronization channel between the service program instances created by each data collaboration party, so that each data collaboration party connected to the data collaboration platform can perform cross-domain data authorization with other data collaboration parties in real time based on the data synchronization channel when there is a data authorization requirement for cross-domain transfer of encrypted data of user data.

[0164] Similar to the aforementioned embodiment, the blockchain collaboration platform includes a blockchain cloud service platform; and the service devices corresponding to the respective data collaboration parties include virtual service devices created for the respective data collaboration parties on the cloud service platform.

[0165] The data collaboration platform is a data synchronization channel between service program instances created with each data collaboration party, and specifically can be a service call channel created between service program instances based on a call address of the service program instance.

[0166] The type of the above-mentioned call address is not specifically limited in this specification;

[0167] In an exemplary embodiment, a domain name access address (ie, URL address) shared by at least one service device corresponding to each service program instance may be used as the calling address corresponding to each service program instance.

[0168] In this case, the service calling channel between each service program instance may be an http calling channel constructed between each service program instance based on a domain name access address shared by at least one service device corresponding to each service program instance.

[0169] Of course, in actual applications, the above-mentioned calling address may be in other forms such as an interface calling address, and the service calling channel between each service program instance may be an interface calling channel, which will not be listed one by one in this specification.

[0170] In an exemplary embodiment, step 310 may include:

[0171] In response to a service call initiated by the second service program instance for the first service program instance based on the first calling address of the first service program instance maintained, a data authorization request for user data maintained by the first data collaborator carried in the calling parameters corresponding to the service call is obtained.

[0172] It should be noted that, since the call channel formed based on the call address is usually a one-way call channel, the service call channel between the first service program instance and the second service program can usually include a first service call channel formed based on the call address of the second service program instance maintained by the first service program instance, with the first service program instance as the call initiator and the second service program instance as the callee; and a second service call channel formed based on the call address of the first service program instance maintained by the second service program instance, with the second service program instance as the call initiator and the first service program instance as the callee.

[0173] When the second data collaborator has a data authorization requirement for the cross-domain transfer of encrypted data of user data published by the first data collaborator, it can initiate a data authorization request for the user data maintained by the first data collaborator to the first service program instance corresponding to the first data collaborator through the data synchronization channel; wherein, the data authorization request includes the data identifier of the target user data that the second data collaborator requests authorization.

[0174] Step 320: The first service program instance responds to the data authorization request, authorizes the cross-domain transfer permission of the encrypted data of the target user data to the second data collaborator, and returns the authorization result to the second service program instance through the data synchronization channel.

[0175] The following combination Figure 9 The schematic diagram of data cross-domain authorization shown in the figure is used to illustrate that after the first service program instance receives the data authorization request, it responds to the data authorization request and calls the DataAuth component in the first service program instance. The DataAuth component authorizes the cross-domain transfer permission of the encrypted data of the target user data to the second data collaboration party and sends the authorization result (such as Figure 9 The authorization certificate in the first service program instance is returned to the second service program instance through the data synchronization channel between the first service program instance and the second service program instance.

[0176] In an exemplary embodiment, the first data collaboration party configures an authorization and approval process for the maintained user data; wherein the approval process includes at least one approver designated by the first data collaboration party;

[0177] In step 320, the first service program instance, in response to the data authorization request, authorizes the cross-domain transfer permission of the encrypted data of the target user data to the second data collaboration party, including:

[0178] The first service program instance responds to the data authorization request, obtains the authorization approval process configured by the first data collaborator for the target user data, triggers the execution of the authorization approval process, and in response to the approval of all approvers included in the authorization approval process, generates an authorization certificate for the second data collaborator to authorize the cross-domain transfer authority of the encrypted data of the target user data to the second data collaborator.

[0179] For example, each approver can generate five approval statuses: pending approval, approved, rejected, revoked, and exempt from approval; among them, revocation can be initiated by the applicant of the authorization approval process (such as the second data collaboration party) at any time before the end of the authorization approval process. The revoked authorization approval process is terminated immediately, and the approval result is revoked approval.

[0180] During authorization and approval, according to the order of the authorization and approval process, if the status of the authorization and approval process obtained by the current approver is pending approval, the authorization and approval process will be suspended and will need to wait for the current approver to upload the approval result (one of approval, rejection, and exemption) before continuing. If the uploaded result is rejection, the authorization and approval process will be terminated immediately and the applicant will be notified of the rejection result. If the uploaded result is approval or exemption, the authorization and approval process will determine whether there is another approver. If there is, the next approver will become the new current approver and switch to the pending approval status. If not, the authorization and approval process will end and the approval result will be approval by all approvers.

[0181] Among them, the first data collaborator can specify the authorization and approval process, and the application approval process may include the default process, the custom process and the approval-free process, etc.; among them, the default process may refer to the second data collaborator as the approver to approve first, and then the first data collaborator as the approver to approve; the custom process may be an approval process customized by the first data collaborator.

[0182] like Figure 9 As shown, the first service program instance calls the DataAuth component in the first service program instance, and the DataAuth component performs authorization processing to generate an authorization credential for the second data collaborator to authorize the second data collaborator to transfer the encrypted data of the target user data across domains.

[0183] The step of returning the authorization result to the second service program instance through the data synchronization channel may include:

[0184] Based on the maintained second calling address of the second service program instance, a service call for the second service program instance is initiated, and the authorization credential is synchronized to the second service program instance as a calling parameter.

[0185] In an exemplary embodiment, before synchronizing the authorization credential to the second service program instance, the method further includes:

[0186] Publishing the authorization certificate to the data security blockchain for storage;

[0187] Accordingly, synchronizing the authorization credential as a call parameter to the second service program instance includes:

[0188] The storage identifier of the authorization certificate on the data security blockchain is synchronized to the second service program instance as a calling parameter, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the storage identifier.

[0189] like Figure 9 As shown in , the authorization certificate can be published to the data security blockchain for storage by calling the DataAuth component; by storing the authorization certificate in the data security blockchain, it is ensured that the authorization certificate is not tampered with.

[0190] Since the data stored in the data security blockchain has a unique storage identifier, synchronizing the authorization credential to the second service program instance may include:

[0191] The storage identifier of the authorization certificate on the data security blockchain is synchronized to the second service program instance, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the storage identifier.

[0192] In an exemplary embodiment, Figure 9 As shown in , before synchronizing the authorization credential to the second service program instance, the method may further include:

[0193] The DataAuth component generates an authorization record for the cross-domain transfer permission of the encrypted data of the target user data, and publishes the generated authorization record to the data security blockchain for evidence storage.

[0194] In an exemplary embodiment, the first data collaboration party configures data usage rules for the maintained user data; wherein the data usage rules define restriction rules for the use of the user data;

[0195] The method further comprises:

[0196] In response to the triggered transfer task of transferring the ciphertext data of the target user data across domains to the second data collaborator, a use procedure for using the target user data is generated based on the data use rule, and the use procedure and the ciphertext data of the target user data are transferred to the second service program instance through the data synchronization channel, so that the use procedure is run by the second service program instance, and ciphertext calculation is performed on the ciphertext data of the target user data based on the data use rule contained in the use procedure.

[0197] The transferring of the use procedure and the ciphertext data of the target user data to the second service program instance through the data synchronization channel comprises:

[0198] Based on the maintained second calling address of the second service program instance, a service call to the second service program instance is initiated, and the use procedure and the ciphertext data of the target user data are transferred to the second service program instance as calling parameters.

[0199] As shown in Figure 9 When the DataAuth component in the first service program instance listens to the authorization record or the cross-domain transfer record on the data security chain for the target user data, the above-mentioned transfer task can be triggered immediately.

[0200] In the specification, the transfer task can be triggered when the DataAuth component listens to the authorization record stored on the chain, or it can be triggered when the DataAuth component listens to the transfer record stored on the chain.

[0201] As with the foregoing authorization record type, the DataAuth component can generate a cross-domain transfer record corresponding to the ciphertext data of the target user data, and publish the generated cross-domain transfer record to the data security chain for storage. The ciphertext data transfer can be performed after the transfer record is successfully chained, or the ciphertext data transfer can be performed before the transfer record is chained and stored. Generally, the former method is relatively more secure.

[0202] In the specification, the data use rule can include any one or a combination of the following:

[0203] The use mode restriction rule defines the operation types that are restricted for use when operating on the ciphertext data of the target user data. The operation types can include allowed calculation methods and processing methods, such as allowing exact query, allowing fuzzy query, allowing string concatenation, allowing string length size, allowing substring extraction, allowing string conversion to lowercase, allowing string conversion to uppercase, etc.

[0204] The usage limit rule defines the usage limit for the ciphertext data of the target user data when performing operations.

[0205] Desensitization restriction rules: wherein the desensitization restriction rules define a desensitization strategy for the plaintext content corresponding to the ciphertext result obtained by performing ciphertext calculation on the ciphertext data of the target user data. The desensitization strategy may include hash desensitization, veiled desensitization, pseudonym desensitization, etc.

[0206] Wherein, the application program includes an SDK program package.

[0207] In this specification, the SDK package contains functions related to the aforementioned data usage rules. These functions restrict the use of the encrypted data of the target user data. For example, if it is stipulated that only operation A can be performed on the encrypted data, then the SDK package only contains calculation functions (operators) related to operation A.

[0208] In an exemplary embodiment, the method may further include:

[0209] The first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel; wherein the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the authorization certificate;

[0210] The first service program instance responds to the decryption request, verifies the authorization credential, and in response to successful verification of the authorization credential, decrypts the ciphertext calculation result to obtain a plaintext calculation result, and desensitizes the plaintext calculation result based on the desensitization policy defined in the desensitization restriction rules included in the data usage rules, and synchronizes the desensitized plaintext calculation result to the second service program instance through the data synchronization channel.

[0211] Further references Figure 10The schematic diagram of cross-domain data transfer shown in the figure shows that after the first service program instance sends the ciphertext data corresponding to the user program and the target user data to the second service program instance through the data synchronization channel, the second service program instance can perform ciphertext calculations on the ciphertext data for related business under the restrictions of the data usage rules specified by the user program. Since the ciphertext calculation is performed on the ciphertext data, the calculation result obtained is also a ciphertext calculation result; since the calculation result is ciphertext, the second service program instance also needs to call the DataAuth component in the second service program instance, and the DataAuth component sends the ciphertext calculation result and authorization certificate to the first service program instance through the data synchronization channel; the DataAuth component in the first service program instance then verifies the authorization certificate, and after the verification is passed, the DataAuth component further decrypts the ciphertext calculation result and returns the decrypted plaintext calculation result to the second service program instance through the data synchronization channel.

[0212] The step of receiving, by the first service program instance, a decryption request initiated by the second service program instance through the data synchronization channel includes:

[0213] In response to a service call initiated by the second service program instance for the first service program instance based on the maintained first call address of the first service program instance, obtaining a decryption request carried in a call parameter corresponding to the service call;

[0214] Synchronizing the desensitized plaintext calculation result to the second service program instance through the data synchronization channel includes:

[0215] Based on the maintained second calling address of the second service program instance, a service call for the second service program instance is initiated, and the plaintext calculation result after the desensitization processing is synchronized to the second service program instance as a calling parameter.

[0216] In summary, the data cross-domain authorization embodiment provided in this specification creates an independent service program instance on the data collaboration platform for each data collaboration party connected to the data collaboration platform, and creates a data synchronization channel between the service program instances created for each data collaboration party. When each data collaboration party connected to the data collaboration platform has the need to transfer the encrypted data of the maintained user data across domains to other data collaboration parties, it can synchronize data with other data collaboration parties in real time based on the data synchronization channel.

[0217] Corresponding to the aforementioned multi-instance networking method embodiment based on blockchain, this specification also provides an embodiment of a multi-instance networking device based on blockchain. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer program in the non-volatile memory into the memory and running it. From the hardware level, if Figure 11 The following is a hardware structure diagram of the device where the multi-instance networking device of the blockchain is located. Figure 11 In addition to the processor, network interface, memory and non-volatile memory shown, the device in the embodiment where the apparatus is located may also include other hardware according to the actual function of data synchronization, which will not be described in detail.

[0218] See Figure 12 , is a module diagram of a multi-instance networking device based on blockchain provided in an embodiment of this specification, the device corresponds to Figure 2 The device is applied to a data collaboration platform based on a data security blockchain; the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties; the device includes:

[0219] The receiving unit 410 receives an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party;

[0220] The responding unit 420 adds the at least one service device as a blockchain node to the data security blockchain in response to the access request, and creates a first service program instance associated with the at least one service device corresponding to the first data collaboration party;

[0221] The determining unit 430 determines whether a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties is created;

[0222] The networking unit 440 creates a data synchronization channel between the first service program instance and the second service program instance when a second service program instance is created that is associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties; wherein the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used to perform authorization management on the cross-chain transfer of encrypted data corresponding to user data stored on the service device associated with it.

[0223] In an exemplary embodiment, the data synchronization channel includes a service call channel created between the service program instances based on a call address of the service program instance.

[0224] In an exemplary embodiment, the calling address corresponding to the service program instance includes a domain name access address of a service device associated with the service program instance; and the calling channel includes an http calling channel.

[0225] In an exemplary embodiment, the apparatus further comprises:

[0226] A first receiving subunit, the first service program instance receives a device registration request; wherein the device registration request includes device information of a newly added service device of the first data collaboration party;

[0227] a first responding subunit, in response to the device registration request, establishing an association between the newly added service device and the first service program instance by the first service program instance, and storing the device information of the newly added service device and the association in a database corresponding to the first service program instance; and

[0228] The first synchronization sub-unit initiates a service call for the second service program instance based on the maintained calling address corresponding to the second service program instance, synchronizes the device information of the newly added service device to the second service program instance, and synchronizes and stores it in the database corresponding to the second service program instance.

[0229] In an exemplary embodiment, the apparatus further comprises:

[0230] A second receiving subunit, wherein the first service program instance receives a blockchain device update request; wherein the blockchain device update request includes device information to be updated of any target service device associated with the first service program instance;

[0231] A second responding subunit, in response to the blockchain device update request, updates the device information of the target service device stored in the database corresponding to the first service program instance based on the device information to be updated; and

[0232] The second synchronization sub-unit initiates a service call for the second service program instance based on the maintained calling address corresponding to the second service program instance, synchronizes the updated device information of the target service device to the second service program instance, and synchronously updates the device information of the target service device stored in the database corresponding to the second service program instance.

[0233] In an exemplary embodiment, the apparatus further comprises:

[0234] A third receiving subunit, wherein the first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes a data set requested to be registered by the target service device;

[0235] A third responding subunit, in response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information in a local database of the target service device; and

[0236] The third synchronization sub-unit publishes the data attribute information corresponding to the data set to the data security blockchain for attestation, and based on the maintained calling address of the second service program instance, initiates a service call for the second service program instance, and synchronizes the blockchain attestation identifier corresponding to the data attribute information to the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain attestation identifier, and synchronously stores the obtained data attribute information in the database corresponding to the second service program instance.

[0237] In an exemplary embodiment, the apparatus further comprises:

[0238] a fourth receiving subunit, wherein the first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes a data set requested to be updated by the target service device;

[0239] a fourth responding subunit, in response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in the local database of the target service device; and

[0240] The fourth synchronization sub-unit, the first service program instance publishes the updated data attribute information corresponding to the data set to the data security blockchain for attestation, and based on the maintained calling address of the second service program instance, initiates a service call for the second service program instance, and synchronizes the blockchain attestation identifier of the updated data attribute information to the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain attestation identifier, and based on the obtained updated data attribute information, synchronizes the data attribute information corresponding to the data set stored in the database corresponding to the second service program instance.

[0241] In an exemplary embodiment, the apparatus further comprises:

[0242] a fifth receiving subunit, wherein the first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes a data set identifier of a target data set requested to be deleted by the target service device;

[0243] a fifth responding subunit, in response to the data deletion request, the first service program instance deleting the target data set and the data attribute information of the target data set stored in the local database of the target service device;

[0244] The fifth synchronization sub-unit initiates a service call to the second service program instance based on the maintained calling address of the second service program instance to synchronize the deletion notification of the target data set to the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance for deletion processing based on the deletion notification.

[0245] In an exemplary embodiment, the apparatus further comprises:

[0246] The data collaboration platform includes a blockchain cloud service platform; the service devices corresponding to each data collaboration party include virtual service devices created for each data collaboration party on the cloud service platform.

[0247] See Figure 13 , is a module diagram of a data cross-domain authorization device provided in an embodiment of this specification, the device corresponds to Figure 8The embodiment shown. The device is applied to a data collaboration platform based on a data security blockchain; the blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively; a first service program instance associated with at least one service device corresponding to a first data collaboration party among the multiple data collaboration parties is created on the blockchain collaboration platform; and a second service program instance associated with at least one service device corresponding to a second data collaboration party among the multiple data collaboration parties; the service program instance is used to perform authorization management on the cross-domain transfer of encrypted data of user data stored on the service device associated with it; the data collaboration platform creates a data synchronization channel between the first service program instance and the second service program instance; the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the device includes:

[0248] Receiving unit 510, the first service program instance receives a data authorization request initiated by the second data collaboration party through the data synchronization channel for user data maintained by the first data collaboration party; wherein the data authorization request includes a data identifier of the target user data requested to be authorized by the second data collaboration party;

[0249] Authorization unit 520, the first service program instance responds to the data authorization request, authorizes the cross-domain transfer permission of the encrypted data of the target user data to the second data collaboration party, and returns the authorization result to the second service program instance through the data synchronization channel.

[0250] In an exemplary embodiment, the data synchronization channel includes a service call channel created between the service program instances based on a call address of the service program instance.

[0251] In an exemplary embodiment, the calling address corresponding to the service program instance includes a domain name access address of a service device associated with the service program instance; and the calling channel includes an http calling channel.

[0252] In an exemplary embodiment, the receiving unit 510 includes:

[0253] In response to a service call initiated by the second service program instance for the first service program instance based on the first calling address of the first service program instance maintained, a data authorization request for user data maintained by the first data collaborator carried in the calling parameters corresponding to the service call is obtained.

[0254] In an exemplary embodiment, the first data collaboration party configures an authorization and approval process for the maintained user data; wherein the approval process includes at least one approver designated by the first data collaboration party;

[0255] The first service program instance in the authorization unit 520 authorizes the second data collaboration party to transfer the cross-domain transfer permission of the encrypted data of the target user data in response to the data authorization request, including:

[0256] The first service program instance responds to the data authorization request, obtains the authorization approval process configured by the first data collaborator for the target user data, triggers the execution of the authorization approval process, and in response to the approval of all approvers included in the authorization approval process, generates an authorization certificate for the second data collaborator to authorize the cross-domain transfer authority of the encrypted data of the target user data to the second data collaborator.

[0257] In an exemplary embodiment, the authorization unit 520 returns the authorization result to the second service program instance through the data synchronization channel, including:

[0258] Based on the maintained second calling address of the second service program instance, a service call for the second service program instance is initiated, and the authorization credential is synchronized to the second service program instance as a calling parameter.

[0259] In an exemplary embodiment, in returning the authorization result to the second service program instance through the data synchronization channel, the authorization unit 520 further includes:

[0260] Publishing the authorization certificate to the data security blockchain for storage;

[0261] The step of synchronizing the authorization credential to the second service program instance in the authorization unit 520 includes:

[0262] The storage identifier of the authorization certificate on the data security blockchain is synchronized to the second service program instance as a calling parameter, so that the second service program instance obtains the authorization certificate from the data security blockchain based on the storage identifier.

[0263] In an exemplary embodiment, before synchronizing the authorization credential to the second service program instance, the authorization unit 520 further includes:

[0264] Generate an authorization record for the cross-domain transfer authority of the ciphertext data of the target user data, and publish the generated authorization record to the data security blockchain for evidence storage.

[0265] In an exemplary embodiment, the first data collaboration party configures data usage rules for the maintained user data; wherein the data usage rules define restriction rules for the use of the user data;

[0266] The device further comprises:

[0267] The computing unit, in response to a triggered transfer task of transferring the ciphertext data of the target user data across domains to the second data collaboration party, generates a usage program for using the target user data based on the data usage rules, and transfers the usage program and the ciphertext data of the target user data to the second service program instance through the data synchronization channel, so that the usage program is run by the second service program instance, and ciphertext calculation is performed on the ciphertext data of the target user data based on the data usage rules contained in the usage program.

[0268] In an exemplary embodiment, the transferring of the encrypted data of the use program and the target user data to the second service program instance through the data synchronization channel in the computing unit includes:

[0269] Based on the maintained second calling address of the second service program instance, a service call for the second service program instance is initiated, and the encrypted data of the use program and the target user data are transferred to the second service program instance as calling parameters.

[0270] In an exemplary embodiment, the method further includes:

[0271] The evidence storage sub-unit generates a cross-domain transfer record corresponding to the ciphertext data of the target user data, and publishes the generated cross-domain transfer record to the data security blockchain for evidence storage.

[0272] In an exemplary embodiment, the data usage rules include any one or more combinations of the following:

[0273] Usage mode restriction rules; wherein the usage mode restriction rules define the types of operations that are restricted when operating on the ciphertext data of the target user data;

[0274] Usage limit rule; wherein the usage limit rule defines the number of times the target user data is restricted when performing operations on the ciphertext data;

[0275] Desensitization restriction rules; wherein, the desensitization restriction rules define a desensitization strategy for the plaintext content corresponding to the ciphertext result obtained by performing ciphertext calculation on the ciphertext data of the target user data.

[0276] In an exemplary embodiment, the application includes an SDK package.

[0277] In an exemplary embodiment, the apparatus further comprises:

[0278] A receiving subunit, wherein the first service program instance receives a decryption request initiated by the second service program instance through the data synchronization channel; wherein the decryption request includes a ciphertext calculation result obtained by performing ciphertext calculation on the ciphertext data of the target user data and the authorization certificate;

[0279] The decryption sub-unit verifies the authorization credential in response to the decryption request, and decrypts the ciphertext calculation result to obtain a plaintext calculation result in response to the verification of the authorization credential, and desensitizes the plaintext calculation result based on the desensitization policy defined in the desensitization restriction rules included in the data usage rules, and synchronizes the desensitized plaintext calculation result to the second service program instance through the data synchronization channel.

[0280] In an exemplary embodiment, the receiving subunit includes:

[0281] In response to a service call initiated by the second service program instance for the first service program instance based on the maintained first call address of the first service program instance, obtaining a decryption request carried in a call parameter corresponding to the service call;

[0282] Synchronizing the desensitized plaintext calculation result to the second service program instance through the data synchronization channel includes:

[0283] Based on the maintained second calling address of the second service program instance, a service call for the second service program instance is initiated, and the plaintext calculation result after the desensitization processing is synchronized to the second service program instance as a calling parameter.

[0284] In an exemplary embodiment, the blockchain collaboration platform includes a blockchain cloud service platform; the service devices corresponding to the respective data collaboration parties include virtual service devices created for the respective data collaboration parties on the cloud service platform.

[0285] The systems, apparatuses, modules or units disclosed in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, and the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transmitting and receiving device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0286] The implementation process of the functions and roles of each unit in the above apparatus is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0287] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be referred to the part of the method embodiment. The device embodiments described above are only schematic, and the units shown as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. Some or all of the modules can be selected to achieve the purpose of the scheme of the present specification according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0288] The above Figure 12 The described blockchain-based multi-instance networking device and Figure 13 The internal functional modules and structural diagrams of the data cross-domain authorization described above can be an electronic device in essence, including:

[0289] A processor;

[0290] A memory for storing processor-executable instructions;

[0291] The processor is configured to execute any of the above embodiments of the blockchain-based multi-instance networking method.

[0292] The above Figure 13 The internal functional modules and structural diagrams of the data cross-domain authorization described above can be an electronic device in essence, including:

[0293] A processor;

[0294] A memory for storing processor-executable instructions;

[0295] The processor is configured to execute any of the above embodiments of the data cross-domain authorization method.

[0296] In the embodiment of the above-mentioned electronic device, it should be understood that the processor can be a CPU, or other general-purpose processors, digital signal processors (English: Digital Signal Processor, abbreviated: DSP), application-specific integrated circuits (English: Application Specific Integrated Circuit, abbreviated: ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., and the aforementioned memory can be a read-only memory (English: read-only memory, abbreviated: ROM), random access memory (English: random access memory, abbreviated: RAM), flash memory, hard disk or solid-state drive. The steps of the method disclosed in conjunction with the embodiment of the present invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0297] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the electronic device embodiment is generally similar to the method embodiment, so the description is relatively simple. For relevant parts, refer to the partial description of the method embodiment.

[0298] Other embodiments of the present invention will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This specification is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of this specification and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present invention being indicated by the following claims.

[0299] It should be understood that the present description is not limited to the exact structure that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

Claims

1. A multi-instance networking method based on blockchain, which is applied to a data collaboration platform based on data security blockchain; The blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively; the method includes: Receiving an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party; In response to the access request, adding the at least one service device as a blockchain node to the data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaboration party; and determining whether a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties is created; if so, creating a data synchronization channel between the first service program instance and the second service program instance; Among them, the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used to authorize the cross-chain transfer of encrypted data corresponding to user data stored on the service device associated with it. 2 . The method according to claim 1 , wherein the data synchronization channel comprises a service call channel created between the service program instances based on a call address of the service program instance.

3. The method according to claim 2, wherein the calling address corresponding to the service program instance comprises a domain name access address of a service device associated with the service program instance; and the calling channel comprises an http calling channel.

4. The method according to claim 2, further comprising: The first service program instance receives a device registration request; wherein the device registration request includes device information of a newly added service device of the first data collaboration party; In response to the device registration request, the first service program instance establishes an association relationship between the newly added service device and the first service program instance, and stores the device information of the newly added service device and the association relationship in a database corresponding to the first service program instance; and Based on the maintained calling address corresponding to the second service program instance, a service call for the second service program instance is initiated, the device information of the newly added service device is synchronized to the second service program instance, and is synchronously stored in the database corresponding to the second service program instance.

5. The method according to claim 4, further comprising: The first service program instance receives a blockchain device update request; wherein the blockchain device update request includes device information to be updated of any target service device associated with the first service program instance; In response to the blockchain device update request, the first service program instance updates the device information of the target service device stored in the database corresponding to the first service program instance based on the device information to be updated; and Based on the maintained calling address corresponding to the second service program instance, a service call for the second service program instance is initiated, the updated device information of the target service device is synchronized to the second service program instance, and the device information of the target service device stored in the database corresponding to the second service program instance is synchronously updated.

6. The method according to claim 2, further comprising: The first service program instance receives a data registration request sent by any target service device associated with the first service program instance; wherein the data registration request includes a data set requested to be registered by the target service device; In response to the data registration request, the first service program instance generates data attribute information corresponding to the data set, and stores the data set and the data attribute information in a local database of the target service device; and The data attribute information corresponding to the data set is published to the data security blockchain for attestation, and based on the maintained calling address of the second service program instance, a service call for the second service program instance is initiated, and the blockchain attestation identifier corresponding to the data attribute information is synchronized to the second service program instance, so that the second service program instance obtains the data attribute information from the data security blockchain based on the blockchain attestation identifier, and synchronously stores the obtained data attribute information in the database corresponding to the second service program instance.

7. The method according to claim 6, further comprising: The first service program instance receives a data update request from any target service device associated with the first service program instance; wherein the data update request includes a data set requested to be updated by the target service device; In response to the data update request, the first service program instance regenerates updated data attribute information corresponding to the data set, and updates the data set and the data attribute information of the data set stored in a local database of the target service device; and The first service program instance publishes the updated data attribute information corresponding to the data set to the data security blockchain for attestation, initiates a service call to the second service program instance based on the maintained calling address of the second service program instance, and synchronizes the blockchain attestation identifier of the updated data attribute information to the second service program instance, so that the second service program instance obtains the updated data attribute information from the data security blockchain based on the blockchain attestation identifier, and synchronously updates the data attribute information corresponding to the data set stored in the database corresponding to the second service program instance based on the obtained updated data attribute information.

8. The method according to claim 7, further comprising: The first service program instance receives a data deletion request sent by any target service device associated with the first service program instance; wherein the data deletion request includes a data set identifier of a target data set requested to be deleted by the target service device; In response to the data deletion request, the first service program instance deletes the target data set and the data attribute information of the target data set stored in the local database of the target service device, and initiates a service call to the second service program instance based on the maintained calling address of the second service program instance to synchronize the deletion notification of the target data set to the second service program instance, so as to trigger the second service program instance to synchronize the data attribute information of the target data set stored in the database corresponding to the second service program instance for deletion processing based on the deletion notification.

9. According to the method according to claim 1, the data collaboration platform includes a blockchain cloud service platform; the service equipment corresponding to each data collaboration party includes a virtual service equipment created for each data collaboration party on the cloud service platform.

10. A multi-instance networking device based on blockchain, which is applied to a data collaboration platform based on data security blockchain; The blockchain node in the data security blockchain includes service devices corresponding to multiple data collaboration parties respectively; the device includes: A receiving unit, configured to receive an access request initiated by a first data collaboration party; wherein the access request includes a device identifier of at least one service device corresponding to the first data collaboration party; a responding unit, in response to the access request, adding the at least one service device as a blockchain node to the data security blockchain, and creating a first service program instance associated with the at least one service device corresponding to the first data collaboration party; a determining unit, determining whether a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties is created; A networking unit, which creates a data synchronization channel between the first service program instance and the second service program instance when a second service program instance associated with at least one service device corresponding to a second data collaboration party other than the first data collaboration party among the multiple data collaboration parties is created; wherein the multiple data collaboration parties correspond to different data domains respectively; the data synchronization channel is used to perform cross-domain data synchronization between the first service program instance and the second service program instance; the service program instance is used to perform authorization management on the cross-chain transfer of encrypted data corresponding to user data stored on the service device associated with it.

11. An electronic device comprising: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 9. 12 . A computer-readable storage medium, wherein when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method according to claim 1 .

Images