A data sharing system based on a double alliance chain and a method thereof

Abstract

The application discloses a kind of data sharing system and method based on double alliance chain, comprising: double alliance chain structure, data sharing management center and data sharing module;The method includes uploading and obtaining data resources: the method content of uploading data resources includes: user uploads data resources, obtains the data resources uploaded by user, and data resource information is encrypted, packaged, encapsulated block, is added to directory chain;The method content of obtaining data resources includes: completing user permission verification, after verification, corresponding data resource information is obtained from directory chain and is decrypted, is returned to user, and user accesses data resources according to data resource information;If not verified, no information is obtained, and all the behavior information of user is recorded to operation chain.The application can reduce the storage requirement of blockchain node under the premise of guaranteeing that shared data cannot be tampered with, simplify data verification process, and guarantee the privacy of data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of block chain, more particularly to a data sharing system and method based on double alliance chain. BACKGROUND

[0002] At present, the application of block chain technology mainly includes block chain 1.0, block chain 2.0 represented by Ethereum and HyperLedger based on smart contract and block chain 3.0 based on token application. These applications mostly adopt single chain mode, that is, each node on the network needs to process and store all transaction data of the whole network, which will lead to the increase of the order of magnitude of the data on the chain, the increase of the storage pressure, and the processing capacity of the whole block chain system being limited by the processing capacity of a single computing node. The existing technology encrypts the data resources as a whole and publishes and shares them on the chain, so that the data resources lose privacy and the use range of the data is expanded. Influenced by the consensus algorithm, with the increase of the number of nodes, the overall processing capacity of the system decreases, and the operation time of creating, searching and other operations on the block is greatly increased. Due to the adoption of only single chain structure, the information of the operation behavior of the user on the data is not recorded separately, so that the traceability of the data operation becomes very difficult and the credibility is low.

[0003] Therefore, it is an urgent problem for those skilled in the art to provide a double alliance chain data sharing system and method capable of effectively improving the processing capacity. SUMMARY

[0004] Therefore, the present application provides a data sharing system and method based on double alliance chain, which realizes the information sharing and supervision among multiple parties, avoids the cumbersome manual recording, reduces the data storage pressure, reduces the operation time of the block, separately manages the data operation information, and facilitates the data traceability.

[0005] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0006] A data sharing system based on double alliance chain, comprising: a double alliance chain structure, a data sharing module and a data sharing management center;

[0007] The double alliance chain structure comprises a directory chain and an operation chain, the directory chain is used for recording data resource directory, the data resource directory comprises: directory structure and data resource sharing information, and the operation chain is used for recording the operation behavior information of the user on the directory;

[0008] The data sharing module is connected with the double alliance chain structure, and is configured to obtain data resource sharing information uploaded by a user, encrypt, package and encapsulate the data resource sharing information into a block, and add the data resource sharing information to the directory chain; meanwhile, the data sharing module is configured to obtain a signal of downloading data resource or using data resource by the user, complete permission verification, obtain corresponding data resource sharing information from the directory chain and decrypt the data resource sharing information after the permission verification is passed, and return the data resource sharing information to the user, so that the user accesses data resource according to the data resource sharing information; if the permission verification is not passed, the data sharing module is configured to not obtain any information and record all behavior information of the user to the operation chain.

[0009] The data sharing management center comprises a data encryption storage module and a permission management module, and the data encryption storage module and the permission management module are connected with the data sharing module.

[0010] The data encryption storage module is configured to store a data encryption key.

[0011] The permission management module is configured to store permission verification information.

[0012] Preferably, the directory structure is composed of directory nodes, and the nodes are connected through parent-child relationship to express the classification structure and hierarchical relationship of the directory.

[0013] Preferably, the directory chain and the operation chain each comprise a block header and a block body.

[0014] The storage content in the block header of the directory chain and the operation chain each comprises a version number, a previous block Hash value, a timestamp and a Hash value of the current block.

[0015] The storage content in the block body of the directory chain comprises data resource directories.

[0016] The storage content in the block body of the operation chain comprises user operation data.

[0017] Preferably, the user operation data comprises a directory ID of any data resource directory, an operation behavior, an operator identity, an operation time and an operation category.

[0018] Preferably, the data resource sharing information comprises data description information, an access address and an access strategy of the data resource.

[0019] Preferably, the storage mode of the key for encrypting the data resource information comprises centralized storage of the key and establishment of a corresponding relationship between the key and the data resource information.

[0020] Preferably, the data description information includes the source, structure, content keywords, sharing range and validity period of the data.

[0021] Preferably, the method further comprises a double alliance chain structure construction module, configured to construct the double alliance chain structure, and specifically comprising:

[0022] a directory chain construction unit, configured to construct a data resource directory, encrypt the entire data resource directory, construct a data block body, and connect the data block body to the directory chain in a chain structure;

[0023] an operation chain construction unit, configured to encapsulate and encrypt the user operation data in a time sequence, and connect the user operation data to the operation chain in a chain structure;

[0024] a data resource directory updating unit, configured to, each time the data resource directory is updated, construct a block body in the directory chain, and connect the block body to the tail end of the directory chain in a chain structure; and update the operation chain, construct a block body in the operation chain, and connect the block body to the tail end of the operation chain in a chain structure;

[0025] a double alliance chain management unit, configured to intercept the directory chain and the operation chain according to a preset threshold N.

[0026] Preferably, the double alliance chain management unit is configured to intercept the directory chain and the operation chain respectively, and specifically comprises the following contents:

[0027] when the number of nodes of the directory chain exceeds the preset threshold N, the early nodes are removed, and only the updated N nodes are retained;

[0028] for the operation chain, when the number of nodes of the operation chain exceeds the preset threshold N, the early nodes are removed, and only the updated N nodes are retained, and the user operation data content in the nodes is intercepted: the early operation packages are removed, and only the updated N operation packages are retained.

[0029] The method for uploading a data resource comprises the following steps: a user uploads data resource sharing information, acquires the data resource sharing information uploaded by the user, encrypts, packages and encapsulates the data resource sharing information into a block, and adds the block to the directory chain.

[0030] The method for acquiring data resource sharing information comprises the following steps: user permission verification is completed, after verification, corresponding data resource sharing information is acquired from the directory chain and decrypted, and returned to the user, the user accesses the data resource according to the data resource sharing information; if the verification fails, no information is acquired, and all behavior information of the user is recorded in the operation chain.

[0031] As can be seen from the above technical solutions, compared with the prior art, this invention discloses a data sharing system and method based on dual consortium blockchains. Employing consortium blockchain technology, which offers greater internal privacy compared to open blockchains, the system reduces data storage and network communication scale, achieving lightweight storage. Furthermore, it enables point-to-point data sharing and adds permission verification, limiting the scope of data dissemination and effectively protecting data privacy. The dual-chain structure effectively records resource data and behavioral data. The separation of data and operational information allows for parallel sharing and auditing, and the recording of behavioral information provides an effective traceability method for future operational tracking. Regarding resource data storage, the use of lightweight data sharing technology reduces the storage pressure on single nodes, simplifies the verification process, and effectively ensures the privacy of resource data. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0033] Figure 1 The attached figure is a schematic diagram of a data sharing system structure based on dual consortium blockchains provided by the present invention;

[0034] Figure 2 The attached figure is a schematic diagram of the directory chain structure in a data sharing system based on a dual consortium blockchain provided by the present invention;

[0035] Figure 3 The attached figure is a schematic diagram of the operation chain structure in a data sharing system based on dual consortium chains provided by the present invention;

[0036] Figure 4 The attached figure is a schematic diagram illustrating the specific process of constructing a dual consortium blockchain in a data sharing method based on dual consortium blockchains provided by the present invention;

[0037] Figure 5 The attached figure is a screenshot of the directory chain in a data sharing method based on dual consortium blockchains provided by the present invention;

[0038] Figure 6 The attached figure is a cut-out diagram of the operation chain in a data sharing method based on a dual consortium chain provided by the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] This invention discloses a data sharing system based on dual consortium blockchains, such as... Figure 1 As shown, it includes: a dual consortium blockchain structure, a data sharing module, and a data sharing management center;

[0041] The dual consortium blockchain structure includes a directory chain and an operation chain. The directory chain is used to record the data resource directory, which includes the directory structure and data resource sharing information. The operation chain is used to record user operation behavior information on the directory.

[0042] The data sharing module is connected to the dual consortium blockchain structure. It is used to obtain data resource sharing information uploaded by users, encrypt, package, and encapsulate the data resource sharing information into blocks, and add them to the directory chain. At the same time, it obtains the user's signal for downloading or using data resources, completes permission verification, and after successful verification, retrieves the corresponding data resource sharing information from the directory chain, decrypts it, and returns it to the user. The user can then access the data resources based on the data resource sharing information. If the verification fails, no information is obtained, and all user behavior information is recorded in the operation chain.

[0043] The data sharing management center includes a data encryption storage module and an access control module, both of which are connected to the data sharing module;

[0044] A data encryption storage module is used to store data encryption keys;

[0045] The permission management module is used to store permission verification information.

[0046] It should be noted that:

[0047] Considering data privacy, encrypting, packaging, and putting the data's metadata description, access information, and access policies onto the blockchain, while keeping the data content in the hands of the resource owner, can effectively protect data privacy.

[0048] To further implement the above technical solution, the directory structure consists of directory nodes, and the classification structure and hierarchical relationship between nodes are expressed through parent-child relationships.

[0049] To further implement the above technical solutions, such as Figures 2-3 As shown, both the directory chain and the operation chain include a block header and a block body;

[0050] The storage contents in the block header of the directory chain and the operation chain include a version number, a previous block Hash value, a timestamp and a Hash value of the current block.

[0051] The storage contents in the block body of the directory chain include data resource directories.

[0052] The storage contents in the block body of the operation chain include user operation data.

[0053] To further implement the above technical solutions, the user operation data includes a directory ID of any data resource directory, an operation behavior, an operator identity, an operation time and an operation category.

[0054] To further implement the above technical solutions, the data resource sharing information includes data description information, an access address and an access policy.

[0055] It should be noted that:

[0056] The resource access policy includes resource access requirements, user permission restrictions and the like.

[0057] To further implement the above technical solutions, the storage mode of the key for encrypting the data resource sharing information includes centralized storage of the key and establishment of a corresponding relationship between the encryption key and the data resource sharing information.

[0058] To further implement the above technical solutions, the data description information includes data source, structure, content keyword, sharing range and validity period.

[0059] To further implement the above technical solutions, the method further includes a double alliance chain structure construction module configured to construct a double alliance chain structure, and specifically includes:

[0060] A directory chain construction unit configured to construct data resource directories, encrypt the entire data resource directories, construct data block bodies and connect the data block bodies to the directory chain in a chain structure.

[0061] An operation chain construction unit configured to encapsulate and encrypt user operation data in a time sequence and connect the user operation data to the operation chain in a chain structure.

[0062] A data resource directory updating unit configured to, each time the data resource directories are updated, construct block bodies in the directory chain, connect the block bodies to the tail end of the directory chain in a chain structure, update the operation chain, construct block bodies in the operation chain and connect the block bodies to the tail end of the operation chain in a chain structure.

[0063] The double alliance chain management unit is configured to intercept the directory chain and the operation chain according to a preset threshold.

[0064] To further implement the above technical solutions, the double alliance chain management unit is configured to intercept the directory chain and the operation chain, and specifically includes the following contents:

[0065] When the number of nodes of the directory chain exceeds the preset threshold N, the early nodes are removed, and only the updated N nodes are retained.

[0066] For the operation chain, when the number of nodes of the operation chain exceeds the preset threshold N, the early nodes are removed, and only the updated N nodes are retained, and the user operation data content in the nodes is intercepted: the early operation package is removed, and only the updated N operation package is retained.

[0067] It should be noted that:

[0068] The data resources of the user are stored in a resource storage system, which can be a relational database storage system, a non-relational database storage system, an IPFS system, and a cloud storage system, and the data resources uploaded by the user are accessed and obtained through an access address.

[0069] A data sharing method based on a double alliance chain includes uploading and obtaining data resources:

[0070] The method for uploading data resource sharing information includes: a user uploads data resource sharing information, obtains the data resource sharing information uploaded by the user, encrypts, packages, and encapsulates the data resource sharing information into a block, and adds the block to the directory chain.

[0071] The method for obtaining data resources includes: completing user permission verification, obtaining the corresponding data resource sharing information from the directory chain and decrypting the data resource sharing information after the verification is passed, returning the data resource sharing information to the user, and the user accessing the data resources according to the data resource information; if the verification is not passed, no information is obtained, and all behavior information of the user is recorded in the operation chain.

[0072] It should be noted that:

[0073] The data sharing takes the description of the data resource directory as the core, uploads the resource data to the chain by the resource owner, and records the operation behavior, accesses the directory chain by the resource requester, analyzes the required data resource node information, verifies the resource access strategy, and obtains the resource access address. In the whole process, the data is still safely saved in the storage system, and the content is not propagated on the chain, effectively protecting the data from being spread and illegally obtained. The resource requester directly obtains the resource data content from the resource storage system in a peer-to-peer manner, preventing data leakage.

[0074] The roles of data sharing are divided into data resource owners and data resource users. The resource description information is uploaded by the data resource owners, and the data resource users request to use the resources on demand.

[0075] In the specific implementation process, when data is shared, the resource owner stores the data privately in the source end, and registers the metadata description and access information of the data resource to the shared directory through software UI interface interaction. The data sharing system packages and encapsulates the data resource sharing information into blocks, adds them to the directory chain, and automatically records the user's operation behavior and adds it to the operation chain.

[0076] When the data is used, the resource user issues a download or use demand for the resource data, and the system verifies whether the user has the relevant permissions of the resource data through the permission verification module. If the verification is passed, the system obtains the access information of the resource data from the directory chain and decrypts it, and returns it to the requester. The requester obtains the data resource content according to the resource access address. If the verification is not passed, the system will refuse the user's access request this time, and all the user's behavior information will be recorded in the operation chain.

[0077] The specific process of constructing the double alliance chain is as shown in Figure 4 , which includes steps S01 to S04:

[0078] S01, constructing a data resource directory. The data resource directory includes a directory classification structure and a data resource node. The directory classification structure is composed of directory nodes, and the nodes express the classification structure and hierarchical relationship of the directory through parent-child relationship; the data resource node contains the metadata of the data resource (including the source, structure, content keyword, sharing range, validity period, etc.), data resource access address, access strategy and other information, and is hung under the directory node.

[0079] S02, constructing a directory block chain. The entire data resource directory is encrypted using an asymmetric encryption algorithm, a data block body is constructed, and a chain structure is connected to the directory chain.

[0080] S03, constructing an operation chain. The operator, operation time, operation category, operation content and other information of the data resource directory are encapsulated in time sequence, encrypted using an asymmetric encryption algorithm, and connected to the operation chain using a chain structure.

[0081] S04, updating the data resource directory. Each time the directory is changed or the resource node is added or reduced, the directory block body construction operation is performed, and a chain structure is connected to the tail end of the directory chain. With the increase of data, the directory chain nodes are constantly increasing. When the directory chain is updated, the operation block body construction operation is performed, and a chain structure is connected to the tail end of the operation chain. With the increase of data, the operation chain nodes are constantly increasing.

[0082] S05, managing the double alliance chain. When the resource directory data continues to increase or frequently changes the directory, the length of the double chain continues to increase. Since the entire resource directory data is saved in the directory block, in order to improve the efficiency of the block chain, the directory block a period of time ago will no longer be valid, therefore, the alliance chain needs to be "pruned".

[0083] The method of setting a threshold value is used to intercept the directory chain. When the number of directory chain nodes exceeds the threshold value, the earliest constructed block node will no longer be retained in the chain, as shown in Figure 5 .

[0084] Since the user operation information in the operation chain is stored in time sequence, the interception of the operation chain includes two parts of the interception of the chain node and the interception of the data content. First, according to the threshold value, the earliest constructed node is intercepted, and then the operation data packet content in the data block is intercepted, as shown in Figure 6 .

[0085] The present application proposes a double alliance chain structure, which is divided into a directory chain and an operation chain. The operation behavior information is recorded and separated from the directory chain which shares the data resource, which guarantees the single function of the single chain, reduces the storage pressure of the single chain, and improves the query speed.

[0086] Data sharing lightweight block chain technology. Based on the traditional block chain data sharing, the data is distributed in each node, the data privacy is difficult to guarantee, the data entity is frequently transmitted in the network, as the block chain gradually becomes longer, the data size on the chain is large, and the network load is difficult to bear. The present application does not encrypt the data itself and chain it like the traditional data sharing system, but chains the directory data. This technology can reduce the storage requirement of the block chain node under the premise of guaranteeing the unforgeable sharing data, simplify the data verification process, and guarantee the privacy of the data.

[0087] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts are referred to the method part description.

[0088] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data sharing system based on a double alliance chain, characterized in that, The application relates to a data sharing method based on a double alliance chain structure. The double alliance chain structure comprises a directory chain and an operation chain, the directory chain is used for recording data resource directories, the data resource directories comprise a directory structure and data resource information, and the operation chain is used for recording user operation behavior information on the directories. The data sharing module is connected with the double alliance chain structure, is used for acquiring data resources uploaded by users, and is used for encrypting, packing and encapsulating blocks of the data resource information and adding the blocks to the directory chain; meanwhile, the data sharing module is used for acquiring a user data resource downloading signal or a user data resource using signal, completing permission verification, acquiring corresponding data resource information from the directory chain and decrypting the data resource information after verification, and returning the data resource information to the user, so that the user can access the data resource according to the data resource sharing information; if the verification fails, no information is acquired, and all behavior information of the user is recorded in the operation chain. The data sharing management center comprises a data encryption storage module and a permission management module and is connected with the data sharing module. The data encryption storage module is used for storing data encryption keys. The permission management module is used for storing permission verification information. The application further relates to a double alliance chain structure construction module which is used for constructing the double alliance chain structure and specifically comprises the following units: a directory chain construction unit which is used for constructing data resource directories, encrypting the entire data resource directories, constructing data block bodies and connecting the data block bodies to the directory chain in a chain structure; an operation chain construction unit which is used for encapsulating and encrypting user operation data in a time sequence and connecting the user operation data to the operation chain in a chain structure; a data resource directory updating unit which is used for constructing block bodies in the directory chain and connecting the block bodies to the tail end of the directory chain in a chain structure when the data resource directories are updated, and is used for constructing block bodies in the operation chain and connecting the block bodies to the tail end of the operation chain in a chain structure when the operation chain is updated; a double alliance chain management unit which is used for intercepting the directory chain and the operation chain according to a preset threshold N. The directory structure is composed of directory nodes, and the nodes are connected through parent-child relationships to express the classification structure and hierarchical relationship of the directories.

2. The data sharing system based on double alliance chain according to claim 1, characterized in that, The directory chain and the operation chain both comprise block headers and block bodies. 3.The data sharing system based on double alliance chain of claim 1, wherein, The storage contents in the block headers of the directory chain and the operation chain both comprise a version number, a previous block Hash value, a timestamp and a Hash value of the current block. The storage contents in the block bodies of the directory chain comprise data resource directories. The storage contents in the block bodies of the operation chain comprise user operation data. The user operation data comprises a directory ID of any data resource directory, operation behavior, operator identity, operation time and operation category.

4. The data sharing system based on double alliance chain of claim 2, wherein, The data resource information comprises data description information, an access address and an access strategy of the data resource. 5.The data sharing system based on double alliance chain of claim 1, wherein, After the user is verified by the data sharing module, the data sharing module is used for parsing required data resource node information, verifying the access strategy, acquiring the access address and directing the user to acquire data resource contents according to the access address.

6. The data sharing system based on double alliance chain of claim 1, wherein, The storage mode of the key for encrypting the data resource information comprises: centrally storing the key and establishing a corresponding relationship between the encryption key and the data resource information.

7. The data sharing system based on double alliance chain of claim 1, wherein, The data description information comprises a source, a structure, a content keyword, a sharing range and a validity period of the data. 8.The data sharing system based on double alliance chain of claim 1, wherein, The double alliance chain management unit is respectively used for intercepting the directory chain and the operation chain, and specifically comprises the following contents: When the number of nodes of the directory chain exceeds the preset threshold N, the early nodes are removed, and only the updated N nodes are reserved. For the operation chain, when the number of nodes of the operation chain exceeds the preset threshold N, the early nodes are removed, and only the updated N nodes are reserved, and the user operation data content in the nodes is intercepted: the early operation package is removed, and only the updated N operation packages are reserved. 9.A data sharing method based on a double alliance chain, characterized in that, The application is applied to a double alliance chain-based data sharing system as claimed in claim 1, comprising uploading and obtaining data resources: the method content of uploading data resources comprises: a user uploads data resource sharing information, obtains the data resource sharing information uploaded by the user, and encrypts, packages and encapsulates the data resource sharing information into a block, and adds the block to a directory chain; The method content of obtaining data resource sharing information comprises: completing user permission verification, obtaining corresponding data resource sharing information from the directory chain and decrypting the data resource sharing information after verification, returning the data resource sharing information to the user, and the user accessing data resources according to the data resource sharing information; if the verification fails, no information is obtained, and all behavior information of the user is recorded to an operation chain.

Images