Cross-organizational data interaction method, system and device based on blockchain smart contract

Abstract

The embodiment of the application provides a cross-organization data interaction method, system and device based on a blockchain smart contract, which can be used in the field of artificial intelligence technology, realizes data security management and control through the blockchain smart contract, reduces the technical capability requirement for a data organization party, guarantees data availability and invisibility, prevents data leakage and abuse, improves data security, does not need to excessively depend on third-party technology, and realizes interaction based on the same simple smart contract development of both parties, realizes equality and mutual trust through the blockchain, does not exist single-party leading and thus generates a security threat to other participating parties, and thus efficiently and intuitively realizes data sharing and circulation.

Description

Technical Field

[0001] This invention relates to the field of computer technology, particularly to the field of artificial intelligence technology, and especially to a cross-organizational data interaction method, system, and apparatus based on blockchain smart contracts. Background Technology

[0002] The biggest challenge facing the circulation and sharing of data elements is how to securely manage data and prevent its leakage and misuse, given its easily replicable nature. Common technologies for data security management include federated learning, secure multi-party computation, and trusted execution environments. However, these technologies have high technical barriers, requiring significant technical capabilities from both data providers and users. Furthermore, for data with high security requirements, over-reliance on third-party technologies carries the risk of data leakage and cannot guarantee data security. Moreover, the lack of trust between data providers and users in each other's technical capabilities during data sharing creates a conflict of roles where technology plays a dominant role, ultimately hindering data sharing and circulation. Summary of the Invention

[0003] One objective of this invention is to provide a cross-organizational data interaction method based on blockchain smart contracts. This method achieves data security management through blockchain smart contracts, reducing the technical capability requirements for data organizers; ensures data availability but not visibility, preventing data leakage and misuse, and improving data security; it eliminates excessive reliance on third-party technologies, allowing both parties to interact based on the same simple smart contract development, achieving equality and mutual trust through blockchain, and preventing unilateral dominance that could pose security threats to other participants, thus achieving efficient and intuitive data sharing and circulation. Another objective of this invention is to provide a cross-organizational data interaction device based on blockchain smart contracts. A further objective of this invention is to provide a computer-readable medium. A final objective of this invention is to provide a computer device.

[0004] To achieve the above objectives, this invention discloses a cross-organizational data interaction method based on blockchain smart contracts, comprising:

[0005] In response to the data request from the first data organizer, the first smart contract is invoked through the first blockchain node to perform privacy calculations based on the data request and generate the first data message.

[0006] The first data message is security verified through the first smart contract;

[0007] If the security verification passes, the first smart contract is invoked to send the first data message and data request to the second smart contract through a pre-established virtual private network. The second smart contract then performs privacy calculations based on the first data message and data request, generates and returns the second data message.

[0008] Preferably, the first smart contract is invoked through the first blockchain node to perform privacy calculations based on the data request and generate a first data message, including:

[0009] Verify access permissions for the access port number of the first blockchain node;

[0010] If the permission verification is successful, the first smart contract is invoked according to the access port number, and the target data is obtained from the first data source according to the data request.

[0011] The target data is forwarded to the privacy computing module through the first smart contract, so that the privacy computing module can perform privacy calculations based on the target data, generate a first data message, and return the first data message to the first smart contract.

[0012] Preferably, before invoking the first smart contract according to the access port number, the following steps are also included:

[0013] The integrity of the first smart contract is verified using a trusted execution environment;

[0014] If the integrity verification passes, continue with the step of calling the first smart contract according to the access port number.

[0015] Preferably, before forwarding the target data to the privacy computing module via the first smart contract, the method further includes:

[0016] The target data is hashed using the first smart contract to obtain the target hash value;

[0017] The target hash value is stored in the blockchain network through the first blockchain node.

[0018] Preferably, before sending the first data message and data request to the second smart contract, the method further includes:

[0019] By using code obfuscation techniques, the first data packet is obfuscated to obtain the obfuscated first data packet.

[0020] Preferably, before invoking the first smart contract to send the first data packet and data request to the second smart contract via a pre-established virtual private network, the method further includes:

[0021] Broadcast the identity certificates of the various data organizations to the blockchain network;

[0022] The identity certificate of the second data organizer is obtained from the blockchain network through the first blockchain node, and the identity certificate of the second data organizer is stored in the memory of the first smart contract.

[0023] The identity certificate of the first data organization is obtained from the blockchain network through the second blockchain node of the second data organization, and the identity certificate of the first data organization is stored in the memory of the second smart contract.

[0024] Based on the identity certificates of the first data organizer and the second data organizer, a bidirectional secure transport layer protocol encrypted connection is established between the first smart contract and the second smart contract.

[0025] The present invention also discloses a cross-organizational data interaction system based on blockchain smart contracts, comprising: a first data organizer, a second data organizer, and a pre-established virtual private network;

[0026] The first data organizer is used to initiate data requests;

[0027] The first data organizer has deployed the first blockchain node and the first smart contract, and the second data organizer has deployed the second smart contract;

[0028] The first blockchain node is used to invoke the first smart contract;

[0029] The first smart contract is used to perform privacy calculations based on the data request and generate a first data message; to perform security verification on the first data message; and if the security verification is successful, to send the first data message and the data request to the second smart contract through a pre-established virtual private network.

[0030] The second smart contract is used to perform privacy calculations based on the first data message and the data request, and to generate and return the second data message.

[0031] This invention also discloses a cross-organizational data interaction device based on blockchain smart contracts, comprising:

[0032] The privacy computing unit is used to respond to the data request from the first data organizer by calling the first smart contract through the first blockchain node, performing privacy computing according to the data request, and generating the first data message.

[0033] A security verification unit is used to verify the security of the first data message through the first smart contract;

[0034] A cross-organizational interaction unit is used to, if the security verification is successful, invoke a first smart contract to send a first data message and a data request to a second smart contract through a pre-established virtual private network, so that the second smart contract can perform privacy calculations based on the first data message and the data request, generate and return a second data message.

[0035] The present invention also discloses a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0036] The present invention also discloses a computer device, including a memory and a processor, wherein the memory is used to store information including program instructions, and the processor is used to control the execution of the program instructions, wherein the processor executes the program to implement the method described above.

[0037] The present invention also discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the method described above.

[0038] This invention responds to a data request from a first data organizer by invoking a first smart contract through a first blockchain node. The first smart contract performs privacy calculations based on the data request to generate a first data message. The first smart contract then verifies the security of the first data message. If the security verification passes, the first smart contract sends the first data message and data request to a second smart contract via a pre-established virtual private network. The second smart contract then performs privacy calculations based on the first data message and data request, generating and returning a second data message. This blockchain smart contract enables data security control, reducing the technical requirements on the data organizer. It ensures data is usable but not visible, preventing data leakage and misuse, and improving data security. It eliminates over-reliance on third-party technologies; both parties interact based on the same simple smart contract development, achieving equality and mutual trust through the blockchain. There is no unilateral dominance that could pose a security threat to other participants, thus achieving efficient and intuitive data sharing and circulation. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A schematic diagram of the structure of a cross-organizational data interaction system based on blockchain smart contracts provided in an embodiment of the present invention;

[0041] Figure 2 A flowchart illustrating a cross-organizational data interaction method based on blockchain smart contracts, provided as an embodiment of the present invention;

[0042] Figure 3 A flowchart illustrating another cross-organizational data interaction method based on blockchain smart contracts provided in this embodiment of the invention;

[0043] Figure 4 This is a schematic diagram of the structure of a cross-organizational data interaction channel provided in an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram illustrating a structure for establishing a bidirectional TLS encrypted connection between smart contracts, provided by an embodiment of the present invention.

[0045] Figure 6 A schematic diagram of the structure of a cross-organizational data interaction device based on blockchain smart contracts provided in an embodiment of the present invention;

[0046] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] It should be noted that the cross-organizational data interaction method, system and device based on blockchain smart contracts disclosed in this application can be used in the field of artificial intelligence technology, or in any field other than artificial intelligence technology. The application field of the cross-organizational data interaction method, system and device based on blockchain smart contracts disclosed in this application is not limited.

[0049] To facilitate understanding of the technical solution provided in this application, the relevant content of the technical solution will be explained below. Data is the core engine for the deepening development of the digital economy and has been clearly listed as the fifth major factor of production, alongside traditional factors such as land, labor, capital, and technology. The key to data becoming a factor of production lies in realizing its value, and data circulation and sharing are the foundation for promoting the realization of data value.

[0050] This application utilizes blockchain smart contracts to ensure data privacy and sovereignty in cross-organizational data sharing and circulation scenarios. This allows data providers and users to achieve data sharing and collaboration without relying heavily on or trusting third parties, or possessing specific technical skills, thus guaranteeing data ownership. Both parties interact based on the same simple smart contract development, and the blockchain provides an equal and trustworthy technical foundation for data interaction, eliminating the possibility of one party dominating and posing a security threat to other participants.

[0051] It is worth noting that the data organizer can be multiple parties or two parties. For ease of description, this application will use two data organizers as an example for specific explanation.

[0052] Figure 1A schematic diagram of the structure of a cross-organizational data interaction system based on blockchain smart contracts provided in an embodiment of the present invention is shown below. Figure 1 As shown, the system includes a first data organizer A, a second data organizer B, a blockchain network 100, and a virtual private network (VPN) 200.

[0053] First data organizer A and second data organizer B are the two parties involved in cross-organizational data exchange. Both first data organizer A and second data organizer B can initiate data requests.

[0054] Blockchain network 100 is used to establish a communication network for the first data organizer A and the second data organizer B to achieve peer-to-peer collaborative processing.

[0055] A Virtual Private Network (VPN) 200 is a secure tunnel for data transmission pre-built for smart contracts. VPN 200 is used for secure data transmission between smart contracts.

[0056] The first data organization A deploys the first blockchain node A01, the first smart contract A02, the first network protection facility A03, the first trusted execution environment A04, and the first database A05.

[0057] The first blockchain node A01 is a node that makes up the blockchain network 100. It is deployed within the internal network of the two parties involved in the data exchange, runs blockchain services, and can install and execute the first smart contract A02.

[0058] The first smart contract A02 is used to execute business logic, such as data checking and data interaction calculations. It is started by the service process of the first blockchain node A01 and usually runs independently as a container.

[0059] The first network protection facility A03 includes, but is not limited to, firewalls, routers, intrusion detection systems, and DMZs to achieve network isolation and security protection.

[0060] The first smart contract A02 includes a first privacy computing module A021, which is integrated inside the container of the first smart contract A02 and is called by the first smart contract A02. The first privacy computing module A021 is specifically used to perform multi-party privacy computing tasks.

[0061] The first trusted execution environment A04 is used for confidential computing, protecting the first smart contract A02 running within it from attacks such as eavesdropping and tampering, and providing remote proof and measurement of the code.

[0062] Database A05 is a private database within the First Data Organization A, which stores the core business data of the First Data Organization A.

[0063] like Figure 1 As shown, the second data organizer B deploys a second blockchain node B01, a second smart contract B02, a second network protection facility B03, a second trusted execution environment B04, and a second database B05.

[0064] The second blockchain node B01 is a node that makes up the blockchain network 100. It is deployed within the internal network of the two parties involved in the data exchange, runs blockchain services, and can install and execute the second smart contract B02.

[0065] The second smart contract B02 is used to execute business logic, such as data checking and data interaction calculations. It is initiated by the service process of the second blockchain node B01 and usually runs independently as a container.

[0066] The second network protection facility B03 includes, but is not limited to, firewalls, routers, intrusion detection systems, and DMZs to achieve network isolation and security protection.

[0067] The second smart contract B02 includes a second privacy computing module B021, which is integrated inside the container of the second smart contract B02 and is called by the second smart contract B02. The second privacy computing module B021 is specifically used to perform multi-party privacy computing tasks.

[0068] The second trusted execution environment B04 is used for confidential computing, protecting the second smart contract B02 running within it from attacks such as eavesdropping and tampering, and providing remote proof and measurement of the code.

[0069] The second database B05 is a private database within the second data organization B, which stores the core business data of the second data organization B.

[0070] In this embodiment of the invention, a first blockchain node A01 is used to call a first smart contract A02; the first smart contract A02 is used to perform privacy calculations based on the data request and generate a first data message; to perform security verification on the first data message; if the security verification is successful, the first data message and the data request are sent to a second smart contract B02 through VPN 200; the second smart contract B02 is used to perform privacy calculations based on the first data message and the data request, and generate and return a second data message.

[0071] In this embodiment of the invention, a first smart contract A02 and a second smart contract B02, agreed upon by a first data organization A and a second data organization B, are deployed on a blockchain node. Since deploying smart contracts on the blockchain requires user authorization, users can control whether or not to deploy them. During deployment, the code of the smart contract is visible to the user, allowing them to verify the smart contract logic and even participate in the early design and development of the smart contract. Therefore, the smart contract is a completely trustworthy component for the user. Smart contracts can be developed using common programming languages.

[0072] This invention achieves data usability without visibility by restricting data to be read and used only within smart contracts. Smart contracts only return the results of data computation. Usability means that data is transmitted from the first smart contract A02 of the first data organizer A to the memory of the second smart contract B02 of the second data organizer B, supporting the second smart contract B02 of the second data organizer B to use it as agreed, including data fusion with the second data organizer B to achieve joint computation. Invisibility means that the plaintext data does not leave the smart contract, and users can only obtain the computation results but cannot infer or recover the plaintext data.

[0073] To ensure the integrity and security of the above process, a trusted data flow sandbox network is established among different users by utilizing peer-to-peer consistent smart contract logic design, network protection equipment (TEE), VPN, and other technologies. Data usage is confined to this sandbox throughout the entire process, achieving data interconnection and trusted collaboration. Trustworthiness is achieved through the joint negotiation, design, development, and peer-to-peer deployment of smart contracts. Smart contracts are only responsible for the most core security controls, while leveraging their low development threshold and programmability to allow for flexible customization and expansion according to business rules. For untrusted and complex modules, decoupling and isolation deployment enables access control and restrictions, thereby reducing complexity and ensuring security. Regarding smart contract reusability, technologies such as dynamic structured query statements (SQL) can be used to configure changeable data structures and data aggregation statements relevant to business scenarios, while security control parts unrelated to business scenarios are implemented through modules, achieving smart contract reuse in a similar manner.

[0074] The technical solution provided in this invention uses blockchain smart contracts to achieve data security management, reducing the technical capability requirements for data organizers; ensuring data availability but not visibility, preventing data leakage and abuse, and improving data security; it does not require excessive reliance on third-party technologies, as both parties interact based on the same simple smart contract development, achieving equality and mutual trust through blockchain, and eliminating the security threats to other participants caused by unilateral dominance, thereby achieving efficient and intuitive data sharing and circulation.

[0075] It is worth noting that, Figure 1 The cross-organizational data interaction system based on blockchain smart contracts shown is also applicable to Figure 2 or Figure 3 The cross-organizational data interaction method based on blockchain smart contracts will not be elaborated here.

[0076] The following example uses a cross-organizational data interaction device based on blockchain smart contracts as the execution subject to illustrate the implementation process of the cross-organizational data interaction method based on blockchain smart contracts provided in this embodiment of the invention. It is understood that the execution subject of the cross-organizational data interaction method based on blockchain smart contracts provided in this embodiment of the invention includes, but is not limited to, a cross-organizational data interaction device based on blockchain smart contracts.

[0077] It is worth noting that this application uses a data request initiated by a first data organization party and jointly processed with a second data organization party as an example to describe in detail the cross-organizational data interaction method based on blockchain smart contracts. In practical applications, the second data organization party can also initiate a data request for joint data processing with the first data organization party; if there are multiple data organizations parties, one of them can also initiate a data request for joint data processing with at least one other data organization party, and this embodiment of the invention does not limit this.

[0078] Figure 2 A flowchart illustrating a cross-organizational data interaction method based on blockchain smart contracts, as provided in this embodiment of the invention, is shown below. Figure 2 As shown, the method includes:

[0079] Step 101: In response to the data request from the first data organizer, the first smart contract is invoked through the first blockchain node to perform privacy calculations based on the data request and generate the first data message.

[0080] Step 102: Perform security verification on the first data message through the first smart contract.

[0081] Step 103: If the security verification is successful, the first smart contract is invoked to send the first data message and data request to the second smart contract through the pre-established virtual private network, so that the second smart contract can perform privacy calculations based on the first data message and data request, generate and return the second data message.

[0082] In the technical solution provided by this invention, in response to a data request from a first data organizer, a first smart contract is invoked through a first blockchain node to perform privacy calculations based on the data request and generate a first data message. The first smart contract then performs security verification on the first data message. If the security verification passes, the first smart contract is invoked to send the first data message and data request to a second smart contract via a pre-established virtual private network. The second smart contract then performs privacy calculations based on the first data message and data request, generates and returns a second data message. This blockchain smart contract enables data security control, reducing the technical requirements on the data organizer; ensuring data is usable but not visible, preventing data leakage and misuse, and improving data security; and eliminating excessive reliance on third-party technologies. Both parties interact based on the same simple smart contract development, achieving equality and mutual trust through the blockchain. There is no unilateral dominance that could pose a security threat to other participants, thus achieving efficient and intuitive data sharing and circulation.

[0083] Figure 3 A flowchart illustrating another cross-organizational data interaction method based on blockchain smart contracts provided in this embodiment of the invention is shown below. Figure 3 As shown, the method includes:

[0084] Step 201: Verify the access port number of the first blockchain node. If the permission verification is successful, proceed to step 202; if the permission verification fails, the process ends.

[0085] In this embodiment of the invention, each step is executed by a cross-organizational data interaction device based on blockchain smart contracts.

[0086] As an optional solution, a consortium blockchain can be selected, and this invention does not limit the specific product. Open-source products can enhance trust through security scanning and code detection tools. For non-open-source products, especially blockchain products provided unilaterally by the first or second data organization, network protection facilities can restrict the communication port numbers and permissions of blockchain nodes. This ensures that the node can only access the blockchain network externally and deploy smart contracts internally, preventing access to other resources within the organization, particularly sensitive resources such as databases.

[0087] Specifically, it is determined whether the access port number of the first blockchain node is a port number restricted by the network protection facility. If yes, it indicates that the permission verification is successful and the process continues to step 202; otherwise, it indicates that the permission verification has failed and the process ends.

[0088] Furthermore, by deploying a network proxy gateway, for blockchain networks that communicate using the Transport Layer Security (TLS) protocol, the first step is to perform certificate offloading, converting network packets from ciphertext to plaintext; then, packet scanning and logging are implemented through intrusion detection and other systems, further reducing the risk of attacks on untrusted blockchain nodes that may have vulnerabilities after deployment within the organization.

[0089] Step 202: Perform integrity verification on the first smart contract through a Trusted Execution Environment (TEE). If the integrity verification passes, proceed to step 203; if the integrity verification fails, the process ends.

[0090] In this embodiment of the invention, integrity verification includes hash verification and signature verification. Specifically, the first smart contract is subjected to hash verification and signature verification using digital signature and hash algorithm. If both verifications pass, the integrity verification is successful, and step 203 continues; if at least one verification fails, the integrity verification fails, and the process ends.

[0091] In this embodiment of the invention, to prevent the smart contract and privacy computing module from being tampered with, the smart contract can be deployed in a TEE. Based on the characteristics of the TEE, during each transaction call, the TEE calculates the hash value of the smart contract deployed on it and signs it to achieve remote proof, thereby ensuring that the program and logic have not been tampered with.

[0092] Step 203: Call the first smart contract according to the access port number, and obtain the target data from the first data source according to the data request.

[0093] In this embodiment of the invention, the first blockchain node invokes the first smart contract according to the access port number, and the first smart contract retrieves the target data from the first data source according to the data request. As an optional solution, the first data source is a first database, which is a private database within the first data organizer.

[0094] In this embodiment of the invention, the smart contract is only responsible for security control, particularly the access logic to the data organizer's local database. This is also a matter of great concern and sensitivity for users during data circulation. Therefore, users only need to focus on the processing of the smart contract. The overall development technology of smart contracts is not demanding, and most organizations can handle it. Here, through collaborative development via smart contract negotiation, the aforementioned problem of both data providers and data users needing low-threshold technical capabilities without one party's technology being dominant is solved.

[0095] Furthermore, the target data is hashed using a first smart contract to obtain a target hash value; this target hash value is then stored on the blockchain network via a first blockchain node. In this embodiment of the invention, the first smart contract stores the hash value of the target data on the blockchain for verification, thereby ensuring the security and trustworthiness of the data source and usage process.

[0096] Step 204: Forward the target data to the privacy computing module through the first smart contract, so that the privacy computing module can perform privacy computing based on the target data, generate the first data message, and return the first data message to the first smart contract.

[0097] In this embodiment of the invention, the data source required by the privacy computing module can only be accessed and forwarded to the privacy computing module by a trusted smart contract, thereby ensuring the security and trustworthiness of the data source and usage process.

[0098] In this embodiment of the invention, a smart contract encapsulates complex privacy computing logic within a decoupled black box, resulting in a privacy computing module. This module can be open-source, proprietary, or a product unilaterally provided by either the first or second data organization. Users can treat the privacy computing module as a black box, a component with inherent security and untrustworthiness risks, depending on their needs. Similar to solutions for untrusted blockchain nodes, the smart contract can run the privacy computing module as a secure logic sandbox. Communication is proxied through the smart contract, ensuring all external communications of the privacy computing module are forwarded via it, with message checks performed during the forwarding process. This restricts the access permissions and processing logic of the untrusted privacy computing module. Unlike running directly on a host or external environment, there is no need to worry about the privacy computing module posing security risks that could attack the user's internal network environment. Furthermore, with the deployment of a trusted execution environment and secure smart contract design, there is no need to worry about the privacy computing module's communication messages being intercepted.

[0099] It is worth noting that the operation of the privacy computing module is not logged to avoid sensitive data being leaked in the logs and to ensure data security.

[0100] Step 205: Perform security verification on the first data message through the first smart contract. If the security verification passes, proceed to step 206; if the security verification fails, the process ends.

[0101] Specifically, the hash value of the first smart contract stored on the blockchain network is obtained through the first blockchain node; the hash value of the first smart contract is obtained by performing a hash calculation on the first smart contract using a hash algorithm; the hash value of the first smart contract stored on the blockchain is compared with the hash value of the first smart contract calculated on the blockchain. If they match, it indicates that the program of the first smart contract has not been tampered with, the logic of the privacy calculation module has not been tampered with, the first data message is trustworthy, the security verification is passed, and step 206 continues; if they do not match, it indicates that the program of the first smart contract has been tampered with, the logic of the privacy calculation module has been tampered with, the first data message is untrustworthy, the security verification fails, and the process ends.

[0102] In this embodiment of the invention, a smart contract calculates a hash value for the privacy computing module and compares it with an on-chain record to ensure that the program and logic have not been tampered with, thereby achieving security verification of the first data packet.

[0103] Step 206: Obfuscate the first data packet using code obfuscation technology to obtain the obfuscated first data packet.

[0104] Specifically, the first data packet is transformed and reconstructed using code obfuscation technology to obtain the first data packet after code obfuscation.

[0105] In this embodiment of the invention, code obfuscation is an effective method for protecting smart contract code during the compilation phase. Code obfuscation transforms and refactors the code, making it difficult to understand and analyze, thereby ensuring the security of the smart contract. It also prevents eavesdropping on the computation process and avoids attackers from tracing and analyzing the code to obtain memory fields during runtime after decompilation. This method can serve as an optional supplementary measure to a TEE (Trusted Execution Environment).

[0106] Step 207: Invoke the first smart contract to send the first data packet and data request to the second smart contract via VPN.

[0107] Specifically, based on the listening port, the first smart contract sends the first data packet and data request to the second smart contract via VPN.

[0108] Figure 4 This is a schematic diagram of the structure of a cross-organizational data interaction channel provided in an embodiment of the present invention, as shown below. Figure 4 As shown, when the first privacy computing module of the first data organization needs to communicate with the second privacy computing module of the second data organization, both the first and second privacy computing modules need to listen on the port, and both the first and second privacy computing modules may also initiate connection requests to communicate with each other.

[0109] like Figure 4As shown, the first privacy computing module initiates a connection to the first smart contract and sends a first data message through the first listening port of the first smart contract; the first smart contract forwards the first data message to the second smart contract, which is exactly the same as the first smart contract; the second smart contract receives the first data message through its external communication listening port and sends the first data message to the second privacy computing module through its listening port for privacy computing, which is exactly the same as the first privacy computing module.

[0110] like Figure 4 As shown, the second privacy computing module initiates a connection to the second smart contract and sends a second data message through the second listening port of the second smart contract; the second smart contract forwards the second data message to the first smart contract, and the first smart contract is exactly the same as the second smart contract; the first smart contract receives the second data message through the listening port of external communication, and sends the second data message to the first privacy computing module through the listening port of the first privacy computing module for privacy computing, and the first privacy computing module is exactly the same as the second privacy computing module.

[0111] In this way, all traffic from the privacy computing module actually passes through the smart contract first. The smart contract can monitor the traffic and ensure the security of the data sent out by the privacy computing module. Furthermore, since communication between smart contracts uses a VPN network, the communication between smart contracts is also secure and verifiable.

[0112] In this embodiment of the invention, during the initialization process after the deployment of smart contracts by each data organization, it is necessary to establish a bidirectional TLS encrypted connection between the smart contracts. Taking a first smart contract and a second smart contract as examples, the establishment of a bidirectional TLS encrypted connection between the first smart contract and the second smart contract specifically includes:

[0113] Step a1: Broadcast the identity certificates of each data organization to the blockchain network.

[0114] In this embodiment of the invention, the identity certificate includes the public keys of each data organization. Each data organization broadcasts its own identity certificate to the blockchain network.

[0115] As an alternative, identity certificates can be distributed to the smart contract of the target data organization that needs to establish a two-way TLS encrypted connection; the target data organization stores the received identity certificates in the memory of the smart contract, thereby achieving secure distribution of identities to all participants.

[0116] Step a2: Obtain the identity certificate of the second data organizer from the blockchain network through the first blockchain node, and store the identity certificate of the second data organizer in the memory of the first smart contract.

[0117] Step a3: Obtain the identity certificate of the first data organization from the blockchain network through the second blockchain node of the second data organization, and store the identity certificate of the first data organization in the memory of the second smart contract.

[0118] In this embodiment of the invention, the first data organizer and the second data organizer obtain the identity certificates of each data organizer from the blockchain network to achieve secure distribution of identities among the participants.

[0119] Step a4: Based on the identity certificates of the first data organizer and the second data organizer, establish a two-way TLS encrypted connection between the first smart contract and the second smart contract.

[0120] In this embodiment of the invention, the identity certificate of the first data organizer is used to authenticate the first data organizer. If the authentication is successful, a one-way TLS encrypted connection is established between the first data organizer and the second data organizer. Similarly, the identity certificate of the second data organizer is used to authenticate the second data organizer. If the authentication is successful, a one-way TLS encrypted connection is established between the second data organizer and the first data organizer. This establishes a bidirectional TLS encrypted connection between the first smart contract and the second smart contract, further improving the communication security between smart contracts and enabling encrypted data transmission between smart contracts.

[0121] Figure 5 This is a schematic diagram illustrating a structure for establishing a bidirectional TLS encrypted connection between smart contracts, as provided in an embodiment of the present invention. Figure 5 As shown, the identity certificates of the first data organizer and the second data organizer are distributed to the first smart contract of the first data organizer and the second smart contract of the second data organizer; based on the identity certificates of the first data organizer and the second data organizer, a two-way TLS encrypted connection is established between the first smart contract and the second smart contract to realize encrypted communication between the first smart contract and the second smart contract.

[0122] Step 208: Perform privacy calculations based on the first data message and data request through the second smart contract, generate and return the second data message.

[0123] In this embodiment of the invention, after the first data message and data request are delivered by the first data organizer to the second data organizer, since the original plaintext of the data is in the smart contract, the smart contract can perform agreed processing before outputting it to the requester. The processing includes privacy computing module processing or other data set processing. In this way, data is made available but not visible, protecting data security while providing programmable and customizable maximum versatility for data use.

[0124] In this embodiment of the invention, the second smart contract is exactly the same as the first smart contract, and the second privacy computing module is exactly the same as the first privacy computing module. The specific process of performing privacy computing through the second smart contract based on the first data message and data request is the same as the privacy computing process of the first smart contract described above, and will not be repeated here in this embodiment of the invention.

[0125] In this embodiment of the invention, the smart contract design fully leverages the characteristic of smart contract code being deployed uniformly and peer-to-peer across all nodes. Based on the characteristics of blockchain peer-to-peer nodes, the logic of different nodes and the smart contracts deployed on them are identical. Therefore, in the above scenario, the verification of one party's own deployed contract is simultaneously a verification of the other party's. In other words, the process of one party calling the privacy computing module for joint computation through a smart contract effectively restricts the other party in the communication to a smart contract with completely identical logic. Therefore, the user not only trusts its own deployed smart contract but also the smart contracts deployed by the other party, thus establishing a foundation of mutual trust.

[0126] Furthermore, security testing is conducted on data interactions. To prevent backdoors in the privacy computing module—for example, backdoors that could perform unauthorized operations under certain parameter calls, with only one party aware of the backdoor while the other remains unaware—the characteristics of blockchain peer-to-peer nodes are also needed. Since all data organizers running the contract receive consistent call parameters, each can log all call details. By replaying these calls, especially transactions not initiated by themselves, all transaction data can be obtained from the other party's perspective, thus verifying the existence of such backdoor attacks. Specifically, if both parties obtain the same result after replaying the transaction, it indicates that no backdoor attack exists; if the results differ, it indicates that a backdoor attack exists.

[0127] For example, when the first data organizer initiates a transaction requesting the calculation of the sum of transaction records for a certain customer in both the first and second data organizer databases under a specific condition, the result is returned to the first data organizer. Similarly, the second data organizer can find the transaction message in the logs, initiate a transaction using the exact same parameters, and request the result to be returned to the second data organizer. This allows them to obtain the exact same process and result as the transaction initiated by the first data organizer, thus verifying that there is no backdoor attack.

[0128] This invention is user-friendly for both data providers and users using blockchain smart contracts, lowering the barrier for users to achieve data availability without visibility using specific technologies. The data interaction process is secure and efficient, without relying on third parties. Both parties can interact based on their signed agreement, and the restricted use of data is achieved through smart contracts, eliminating the risk of data leakage. It is applicable to diverse data interaction and collaboration scenarios in different business settings, and has high practicality, flexibility, and versatility.

[0129] It is worth noting that the acquisition, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. The user information in the embodiments of this application was obtained through legal and compliant means, and the acquisition, storage, use, and processing of user information have been authorized and agreed upon by the client.

[0130] It is worth noting that the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0131] It is worth noting that the technical solution provided in this application provides users with a corresponding operation entry point, allowing users to choose to agree to or reject the automated decision-making result; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0132] In the technical solution of the cross-organizational data interaction method based on blockchain smart contracts provided in this invention embodiment, in response to a data request from a first data organization, a first smart contract is invoked through a first blockchain node to perform privacy calculations based on the data request and generate a first data message. The first smart contract then performs security verification on the first data message. If the security verification passes, the first smart contract is invoked to send the first data message and data request to a second smart contract via a pre-established virtual private network. The second smart contract then performs privacy calculations based on the first data message and data request, generates and returns a second data message. This method achieves data security control through blockchain smart contracts, reducing the technical capability requirements for data organizations; ensuring data is usable but not visible, preventing data leakage and misuse, and improving data security; and eliminating excessive reliance on third-party technologies. Both parties interact based on the same simple smart contract development, achieving equality and mutual trust through blockchain. There is no unilateral dominance that could pose a security threat to other participants, thus achieving efficient and intuitive data sharing and circulation.

[0133] Figure 6This is a schematic diagram of a cross-organizational data interaction device based on blockchain smart contracts, provided in an embodiment of the present invention. This device is used to execute the aforementioned cross-organizational data interaction method based on blockchain smart contracts, such as... Figure 6 As shown, the device includes: a privacy computing unit 11, a security verification unit 12, and a cross-organizational interaction unit 13.

[0134] The privacy computing unit 11 is used to respond to the data request from the first data organizer by calling the first smart contract through the first blockchain node, performing privacy computing according to the data request, and generating the first data message.

[0135] The security verification unit 12 is used to perform security verification on the first data message through the first smart contract.

[0136] If the security verification is successful, the cross-organizational interaction unit 13 is used to call the first smart contract to send the first data message and data request to the second smart contract through a pre-established virtual private network, so that the second smart contract can perform privacy calculations based on the first data message and data request, generate and return the second data message.

[0137] In this embodiment of the invention, the privacy computing unit 11 is specifically used to verify the access port number of the first blockchain node; if the permission verification is successful, the first smart contract is invoked according to the access port number, and the target data is obtained from the first data source according to the data request; the target data is forwarded to the privacy computing module through the first smart contract, so that the privacy computing module can perform privacy calculations based on the target data, generate a first data message, and return the first data message to the first smart contract.

[0138] In this embodiment of the invention, the device further includes an integrity verification unit 14.

[0139] The integrity verification unit 14 is used to perform integrity verification on the first smart contract through a trusted execution environment; if the integrity verification passes, the privacy computing unit 11 is triggered to continue executing the step of calling the first smart contract according to the access port number.

[0140] In this embodiment of the invention, the device further includes a hash calculation unit 15 and an on-chain unit 16.

[0141] The hash calculation unit 15 is used to perform hash calculation on the target data through the first smart contract to obtain the target hash value.

[0142] The on-chain unit 16 is used to store the target hash value to the blockchain network through the first blockchain node.

[0143] In this embodiment of the invention, the device further includes a code obfuscation unit 17.

[0144] The code obfuscation unit 17 is used to obfuscate the code of the first data packet using code obfuscation technology to obtain the first data packet after code obfuscation.

[0145] In this embodiment of the invention, the device further includes: a broadcast unit 18, a first storage unit 19, a second storage unit 20, and a communication connection establishment unit 21.

[0146] Broadcast unit 18 is used to broadcast the identity certificates of the acquired data organizers to the blockchain network.

[0147] The first storage unit 19 is used to obtain the identity certificate of the second data organizer from the blockchain network through the first blockchain node, and store the identity certificate of the second data organizer in the memory of the first smart contract.

[0148] The second storage unit 20 is used to obtain the identity certificate of the first data organizer from the blockchain network through the second blockchain node of the second data organizer, and store the identity certificate of the first data organizer in the memory of the second smart contract.

[0149] The communication connection establishment unit 21 is used to establish a bidirectional secure transport layer protocol encrypted connection between the first smart contract and the second smart contract based on the identity certificate of the first data organizer and the identity certificate of the second data organizer.

[0150] In the solution of this invention embodiment, in response to a data request from a first data organizer, a first smart contract is invoked through a first blockchain node to perform privacy calculations based on the data request and generate a first data message. The first smart contract then performs security verification on the first data message. If the security verification passes, the first smart contract is invoked to send the first data message and data request to a second smart contract via a pre-established virtual private network. The second smart contract then performs privacy calculations based on the first data message and data request, generates and returns a second data message. This blockchain smart contract achieves data security control, reducing the technical capability requirements for the data organizer; it ensures data is usable but not visible, prevents data leakage and misuse, and improves data security; it does not rely excessively on third-party technologies, as both parties interact based on the same simple smart contract development, achieving equality and mutual trust through the blockchain. There is no unilateral dominance that could pose a security threat to other participants, thus achieving efficient and intuitive data sharing and circulation.

[0151] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer device, specifically, a computer device can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0152] This invention provides a computer device, including a memory and a processor. The memory stores information including program instructions, and the processor controls the execution of the program instructions. When the program instructions are loaded and executed by the processor, they implement the steps of the above-described embodiment of the cross-organizational data interaction method based on blockchain smart contracts. For a detailed description, please refer to the above-described embodiment of the cross-organizational data interaction method based on blockchain smart contracts.

[0153] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer device 600 suitable for implementing the embodiments of this application.

[0154] like Figure 7 As shown, the computer device 600 includes a central processing unit (CPU) 601, which can perform various appropriate tasks and processes based on programs stored in read-only memory (ROM) 602 or programs loaded from storage section 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the computer device 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0155] The following components are connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal feedback (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 610 as needed so that computer programs read from it can be installed in storage section 608 as needed.

[0156] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program including program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611.

[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0158] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0159] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0160] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0161] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0162] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0163] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0164] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0165] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0166] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0167] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0168] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A cross-organizational data interaction method based on blockchain smart contracts, characterized in that, The method includes: In response to a data request from the first data organizer, the first smart contract is invoked through the first blockchain node to perform privacy calculations based on the data request and generate a first data message. The first data message is verified for security through the first smart contract; If the security verification passes, the first smart contract is invoked to send the first data packet and data request to the second smart contract through a pre-established virtual private network. The second smart contract then performs privacy calculations based on the first data packet and data request, generates and returns a second data packet. The virtual private network is implemented through a bidirectional secure transport layer protocol encrypted connection established between the first smart contract and the second smart contract. The method further includes, before invoking the first smart contract to send the first data packet and data request to the second smart contract via a pre-established virtual private network: Broadcast the identity certificates of the various data organizations to the blockchain network; The identity certificate of the second data organizer is obtained from the blockchain network through the first blockchain node, and the identity certificate of the second data organizer is stored in the memory of the first smart contract. The identity certificate of the first data organizer is obtained from the blockchain network through the second blockchain node of the second data organizer, and the identity certificate of the first data organizer is stored in the memory of the second smart contract. Based on the identity certificates of the first data organizer and the second data organizer, a bidirectional secure transport layer protocol encrypted connection is established between the first smart contract and the second smart contract.

2. The cross-organizational data interaction method based on blockchain smart contracts according to claim 1, characterized in that, The step of calling the first smart contract through the first blockchain node, performing privacy calculations based on the data request, and generating a first data message includes: Perform permission verification on the access port number of the first blockchain node; If the permission verification is successful, the first smart contract is invoked according to the access port number, and the target data is obtained from the first data source according to the data request. The target data is forwarded to the privacy computing module through the first smart contract, so that the privacy computing module can perform privacy calculations based on the target data, generate a first data message, and return the first data message to the first smart contract.

3. The cross-organizational data interaction method based on blockchain smart contracts according to claim 2, characterized in that, Before invoking the first smart contract according to the access port number, the method further includes: The integrity of the first smart contract is verified using a trusted execution environment; If the integrity verification passes, continue with the step of calling the first smart contract according to the access port number.

4. The cross-organizational data interaction method based on blockchain smart contracts according to claim 2, characterized in that, Before forwarding the target data to the privacy computing module via the first smart contract, the method further includes: The target data is hashed using the first smart contract to obtain the target hash value; The target hash value is stored in the blockchain network through the first blockchain node.

5. The cross-organizational data interaction method based on blockchain smart contracts according to claim 2, characterized in that, Before sending the first data message and data request to the second smart contract, the method further includes: The first data packet is obfuscated using code obfuscation techniques to obtain an obfuscated first data packet.

6. A cross-organizational data interaction system based on blockchain smart contracts, characterized in that, The system includes: a first data organizer, a second data organizer, and a pre-established virtual private network; The first data organizer is used to initiate a data request; The first data organizer deploys a first blockchain node and a first smart contract, and the second data organizer deploys a second smart contract; The first blockchain node is used to invoke the first smart contract; The first smart contract is used to perform privacy calculations based on the data request to generate a first data message; to perform security verification on the first data message; and if the security verification is successful, to send the first data message and the data request to the second smart contract through a pre-established virtual private network, wherein the virtual private network is implemented through a bidirectional secure transport layer protocol encrypted connection established between the first smart contract and the second smart contract. The second smart contract is used to perform privacy calculations based on the first data message and the data request, and to generate and return a second data message; Before sending the first data packet and data request to the second smart contract via a pre-established virtual private network, the method further includes: Broadcast the identity certificates of the various data organizations to the blockchain network; The identity certificate of the second data organizer is obtained from the blockchain network through the first blockchain node, and the identity certificate of the second data organizer is stored in the memory of the first smart contract. The identity certificate of the first data organizer is obtained from the blockchain network through the second blockchain node of the second data organizer, and the identity certificate of the first data organizer is stored in the memory of the second smart contract. Based on the identity certificates of the first data organizer and the second data organizer, a bidirectional secure transport layer protocol encrypted connection is established between the first smart contract and the second smart contract.

7. A cross-organizational data interaction device based on blockchain smart contracts, characterized in that, The device includes: A privacy computing unit is used to respond to a data request from a first data organizer by calling a first smart contract through a first blockchain node, performing privacy computing based on the data request, and generating a first data message. A security verification unit is used to verify the security of the first data packet through the first smart contract; The broadcast unit is used to broadcast the identity certificates of the various data organizers to the blockchain network. The first storage unit is used to obtain the identity certificate of the second data organizer from the blockchain network through the first blockchain node, and store the identity certificate of the second data organizer in the memory of the first smart contract; The second storage unit is used to obtain the identity certificate of the first data organizer from the blockchain network through the second blockchain node of the second data organizer, and store the identity certificate of the first data organizer in the memory of the second smart contract. The communication connection establishment unit is used to establish a bidirectional secure transport layer protocol encrypted connection between the first smart contract and the second smart contract based on the identity certificate of the first data organizer and the identity certificate of the second data organizer. A cross-organizational interaction unit is used, if the security verification passes, to invoke the first smart contract to send the first data packet and data request to the second smart contract through a pre-established virtual private network, so that the second smart contract can perform privacy calculations based on the first data packet and data request, generate and return a second data packet, wherein the virtual private network is implemented through a bidirectional secure transport layer protocol encrypted connection established between the first smart contract and the second smart contract.

8. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the cross-organizational data interaction method based on blockchain smart contracts as described in any one of claims 1 to 5.

9. A computer device comprising a memory and a processor, the memory for storing information including program instructions, and the processor for controlling the execution of the program instructions, characterized in that, When the program instructions are loaded and executed by the processor, they implement the cross-organizational data interaction method based on blockchain smart contracts as described in any one of claims 1 to 5.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the cross-organizational data interaction method based on blockchain smart contracts as described in any one of claims 1 to 5.

Images