Traceability application-oriented multi-block chain interactive fusion security supervision system and method

Abstract

The invention provides a traceability application-oriented multi-block chain interactive fusion security supervision system and method. The system comprises a supervision main chain and a plurality of organization sub-chains, the organization sub-chain is deployed with a data distribution smart contract, and when the organization sub-chain receives to-be-stored data, the data distribution smart contract is triggered and used for judging whether the current data is private data or non-private data, encrypting the current data by adopting an SM4 symmetric cryptographic algorithm or a CP-ABE attribute encryption algorithm and writing the encrypted data into a target organization sub-chain; the supervision main chain is deployed with an identity verification smart contract and a tracing smart contract; when the sub-chain client initiates a write-in request, the identity verification smart contract is triggered and is used for verifying an identity authenticity proof which is uploaded by the sub-chain client and is generated based on a zero-knowledge proof technology, and data of the sub-chain client passing the verification is linked; and when the sub-chain client initiates a traceability request, the traceability smart contract is triggered and is used for integrating traceability data, converting the traceability data into a two-dimensional code and returning the two-dimensional code to the sub-chain client.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and more specifically, to a multi-blockchain interactive fusion security supervision system and method for traceability applications. Background Art

[0002] For the traceability scenario of the entire industrial chain of traditional products, as time goes by, the product traceability cycle is long, the varieties are numerous, and the situations are complicated, making its quality and safety management more difficult than other industrial systems.

[0003] At present, it is proposed to collect and encrypt the relevant data of each link of the industrial chain through the Internet of Things devices. Its main chain provides real-time query of shared information. The encrypted information needs to be queried after the chain enterprise issues a certificate. When there is a problem with the data in a certain link, it can be queried by scanning the QR code. By comparing the data, it can be determined whether there is malicious tampering with the data information, thereby realizing product information traceability. However, with the data flow of the traceability industry chain, the data of each link needs to be fully recorded and stored in the blockchain. These data not only include basic product information, but also cover historical transaction records, organizational management data, etc. At the same time, with the expansion of business scale, the amount of data grows exponentially, which brings a heavy data storage burden to the system. This not only affects the performance of the system, but also may cause the risk of data loss or damage. The ledger data storage in the blockchain is open and transparent, which facilitates each node to maintain the ledger data, but it has the risk of confidentiality data, especially in the process of ascertaining the processing and production of traceable products. Since all nodes in the blockchain can query data, it is easy to cause the leakage of private data in processing and production. To this end, it is necessary to improve the security of private data and ensure the safe storage of private data under the premise of ensuring data security and reliability. In addition, in the process of product traceability, in addition to data privacy issues that need to be paid attention to, ensuring the validity of the data is also imminent. For example, there is a possibility that malicious nodes or operators tamper with the data or falsify the data, which will seriously affect the availability of the data. Once the authenticity of the data cannot be guaranteed, traceability will lose its meaning. Summary of the invention

[0004] In order to overcome the defects of the above-mentioned prior art in the industrial chain traceability, such as heavy data storage burden, easy data loss, damage and privacy data leakage, the present invention provides a multi-blockchain interactive fusion security supervision system and method for traceability applications.

[0005] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0006] A multi-blockchain interactive fusion security supervision system for traceability applications, including a multi-chain fusion system consisting of a supervision main chain and several organizational sub-chains;

[0007] The organization subchain is deployed with a data diversion smart contract, wherein when the organization subchain receives data to be stored, the data diversion smart contract is triggered to determine whether the current data is private data or non-private data, and encrypt the data using the SM4 symmetric national encryption algorithm or the CP-ABE attribute encryption algorithm and then write it into the target organization subchain;

[0008] The regulatory main chain is deployed with identity authentication smart contracts and traceability smart contracts; among which:

[0009] When the subchain client initiates a write request to the system, the identity authentication smart contract is triggered to verify the identity authenticity certificate generated by the zero-knowledge proof technology uploaded by the subchain client. If the verification is successful, the data uploaded by the subchain client is received and transmitted to the organization subchain to perform classified encrypted storage of the data by calling the data diversion smart contract; otherwise, the current subchain client is denied access;

[0010] When the sub-chain client initiates a traceability request to the regulatory main chain, the traceability smart contract is triggered to integrate the traceability data stored in each organization's sub-chain, convert it into a first traceability QR code and return it to the sub-chain client.

[0011] Furthermore, the present invention also proposes a multi-blockchain interactive fusion security supervision method for traceability applications, which is applied to the multi-blockchain interactive fusion security supervision system for traceability applications proposed in the present invention. The following steps are included:

[0012] Build a multi-chain integration system consisting of a regulatory main chain and several organizational sub-chains;

[0013] When the organization sub-chain receives the data to be stored, the organization sub-chain calls the data diversion smart contract to determine whether the current data is private data or non-private data, and encrypts the data using the SM4 symmetric national encryption algorithm or the CP-ABE attribute encryption algorithm and writes it into the target organization sub-chain;

[0014] When a subchain client initiates a write request, the regulatory main chain calls the identity authentication smart contract to verify the identity authenticity certificate generated by the subchain client based on zero-knowledge proof technology. If the verification is successful, the data uploaded by the subchain client is received and transmitted to the organization subchain to perform classified encryption and storage of the data by calling the data diversion smart contract; otherwise, the current subchain client is denied access;

[0015] When the sub-chain client initiates a traceability request, the regulatory main chain calls the traceability smart contract, integrates the traceability data stored in each organization's sub-chain, converts it into the first traceability QR code and returns it to the sub-chain client.

[0016] Compared with the prior art, the technical solution of the present invention has the following beneficial effects:

[0017] The present invention is a multi-chain fusion architecture composed of a supervision main chain and several organizational sub-chains, which integrates multiple blockchain interactions and data. The supervision main chain is used as the center to coordinate the interactions between the sub-chains, thereby realizing the integration of the whole traceability data, effectively alleviating the data storage pressure of a single chain, and completely isolating the interaction between the sub-chain and the client, ensuring high data security and data availability, and realizing the authenticity, immutability and traceability of the information of the whole process of the industry;

[0018] The present invention also ensures the security of private data by configuring data diversion smart contracts, using the SM4 symmetric national encryption algorithm with higher security and better performance, and the CP-ABE attribute encryption algorithm that facilitates fine-grained access control of data, to ensure the validity of non-privacy data and on-chain storage redundancy;

[0019] The present invention also uses zero-knowledge proof technology for identity authentication, which can protect the legitimacy of user identity during cross-chain data transmission, thereby granting the sub-chain client the authority to access the corresponding business, while ensuring that the privacy of the user's identity is not leaked, and effectively preventing malicious attackers from obtaining the user's personal identity data, access purpose and other important privacy information. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is an architectural diagram of a multi-blockchain interactive fusion security supervision system for traceability applications in Example 1.

[0021] Figure 2 This is a flowchart of calling a QR code to generate a smart contract in Example 1.

[0022] Figure 3 This is a flow chart of the QR code data entry of Example 1.

[0023] Figure 4 This is a flowchart of calling the data processing smart contract in Example 1.

[0024] Figure 5 This is a flow chart of calling the data diversion smart contract of Example 1.

[0025] Figure 6 This is a flow chart of the multi-blockchain interactive fusion security supervision method for traceability applications in Example 2. DETAILED DESCRIPTION

[0026] The accompanying drawings are only used for illustrative purposes and are not to be construed as limiting the present invention;

[0027] In order to better illustrate the present embodiment, some parts in the drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product;

[0028] It is understandable to those skilled in the art that some well-known descriptions may be omitted in the drawings.

[0029] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0030] Example 1

[0031] This embodiment proposes a multi-blockchain interactive fusion security supervision system for traceability applications, such as Figure 1 As shown, this is an architecture diagram of the multi-blockchain interactive fusion security supervision system for traceability applications in this embodiment.

[0032] The multi-blockchain interactive fusion security supervision system for traceability applications proposed in this embodiment includes a multi-chain fusion system consisting of a supervision main chain and several organization sub-chains, where:

[0033] The organization subchain is deployed with a data diversion smart contract. When the organization subchain receives data to be stored, the data diversion smart contract is triggered to determine whether the current data is private data or non-private data, and encrypts the data using the SM4 symmetric national encryption algorithm or the CP-ABE (Ciphertext-Policy Attribute-Based Encryption) attribute encryption algorithm and then writes it into the target organization subchain;

[0034] The regulatory main chain is deployed with identity authentication smart contracts and traceability smart contracts; among which:

[0035] When the subchain client initiates a write request to the system, the identity authentication smart contract is triggered to verify the identity authenticity certificate generated by the zero-knowledge proof technology uploaded by the subchain client. If the verification is successful, the data uploaded by the subchain client is received and transmitted to the organization subchain to perform classified encrypted storage of the data by calling the data diversion smart contract; otherwise, the current subchain client is denied access;

[0036] When the sub-chain client initiates a traceability request to the regulatory main chain, the traceability smart contract is triggered to integrate the traceability data stored in each organization's sub-chain, convert it into a first traceability QR code and return it to the sub-chain client.

[0037] In this embodiment, a multi-chain fusion architecture consisting of a regulatory main chain and several organizational sub-chains is used to interact with each other and integrate data. The regulatory main chain is used as the center to coordinate the interaction between the sub-chains, thereby realizing the integration of the entire traceability data, effectively alleviating the data storage pressure of a single chain, and completely isolating the interaction between the sub-chain and the client, ensuring high data security and data availability, and realizing the authenticity, immutability and traceability of information throughout the entire industrial process.

[0038] It should be noted that the system proposed in this embodiment is based on a multi-chain fusion architecture, and the regulatory main chain integrates the data of each organization's sub-chain through data supervision throughout the entire industrial chain. This architecture completely isolates the interaction between the organization's sub-chain and the sub-chain client. If operations such as data entry are required on the organization's sub-chain, that is, data access through the sub-chain client, the regulatory main chain must authenticate the identity of the sub-chain client and perform data backup, and then the regulatory main chain will perform data transmission operations.

[0039] Furthermore, in order to alleviate the pressure of data storage, this embodiment configures a data diversion smart contract, adopts the SM4 symmetric national encryption algorithm with higher security and better performance, and the CP-ABE attribute encryption algorithm that facilitates fine-grained access control of data to ensure the security of privacy data, the validity of non-privacy data and on-chain storage redundancy.

[0040] Furthermore, this embodiment uses zero-knowledge proof technology for identity authentication, which can effectively verify the legitimacy of the user's identity during the cross-chain data transmission process, thereby granting the sub-chain client the right to access the corresponding business. At the same time, the privacy of the user's identity is not leaked, effectively preventing malicious attackers from obtaining the user's personal identity data, access purpose and other important privacy information.

[0041] After verification, the subchain client can operate the corresponding organization subchain according to different login accounts in the organization subchain. The regulatory main chain holds the highest authority to operate all organization subchain data. Other organization subchains can only operate the data stored in their subchains, and all operations need to be supervised by the regulatory main chain before they can be stored in the corresponding organization subchain, thereby achieving high security of organization subchain data.

[0042] Exemplarily, this embodiment is applicable to the traceability of each process from the planting to the sale of traditional Chinese medicine. Among them, the traceability of traditional Chinese medicine is mainly divided into six steps: planting, transportation, processing, warehousing, sales, and supervision. In order to ensure that the information of each step can be accurately recorded and traced, the planting sub-chain, transportation sub-chain, processing sub-chain, warehousing sub-chain, sales sub-chain and supervision main chain are selected to build a multi-chain fusion system, with the supervision main chain as the center to coordinate the interaction between the sub-chains. When the sub-chain client needs to upload process data in the actual production process, a write request is initiated to the system, the supervision main chain receives the request and calls the identity authentication smart contract to authenticate the sub-chain client, and transmits the data uploaded by the verified sub-chain client to the corresponding organization sub-chain, and further classifies and encrypts the data for storage by calling the data diversion smart contract.

[0043] When the production is completed, that is, the packaging of the Chinese medicine product is completed, the supervision main chain receives the signal fed back by the corresponding organization sub-chain, and calls the traceability smart contract to integrate the traceability data, specifically including: querying and integrating the traceability data of the Chinese medicine product in the planting, processing, transportation and other sub-chains through the product traceability ID, and finally converting the integrated traceability data into the form of a QR code, namely the first traceability QR code. The staff responsible for product packaging will print the QR code containing the traceability data on the packaging of the product for consumers to scan and view the relevant traceability information of the Chinese medicine product, thus realizing the authenticity, immutability and traceability of information on the entire process of Chinese medicine from planting, harvesting, processing, storage, transportation and sales.

[0044] In an optional embodiment, a QR code generation smart contract is also deployed on the regulatory main chain, wherein when the sub-chain client that has completed identity authentication initiates a QR code generation request to the regulatory main chain, the QR code generation smart contract is triggered to parse the QR code generation request uploaded by the sub-chain client, obtain the target organization sub-chain requested by the user, query the stored traceability data in the target organization sub-chain, convert it into a second traceability QR code, and then return it to the sub-chain client.

[0045] like Figure 2 As shown, this is a flowchart of calling a QR code to generate a smart contract in this embodiment.

[0046] In this embodiment, considering that sub-chain employees need to perform some operations that require traceability during the production process, the physical isolation characteristics of the QR code are adopted. By calling the QR code generation smart contract to generate a time-limited process QR code, employees can use the QR code to perform corresponding data entry operations in subsequent specific scenarios, which not only ensures the security of some user information, but also improves production efficiency.

[0047] Furthermore, in an optional embodiment, the system also includes a QR code scanning device deployed at the data layer; wherein the QR code scanning device is used to obtain the second traceability QR code by scanning the sub-chain client, obtain the corresponding traceability data, current timestamp and terminal information, and then upload them to the target organization sub-chain, and call the data diversion smart contract to perform classified encrypted storage of data.

[0048] The terminal information includes some fixed information such as the location information of the QR code scanning device, information related to the person in charge of the link, relevant information related to the corresponding environment of the device location, and other custom information required in other specific occasions.

[0049] Optionally, the main chain of supervision is also used to collect information from all subchain clients that have completed identity authentication in all organizational subchains, and to classify and encrypt the data for storage through the data diversion smart contract. The subchain client information collected by the main chain of supervision is uploaded to the blockchain system by the user during the initialization process, and the relevant data will not be re-entered during subsequent use to ensure data privacy and security. The collected subchain client information includes basic personal information of employees, such as name, place of origin, telephone number, work number, job code, contact information, etc.

[0050] like Figure 3 As shown, it is a flow chart of QR code data entry in this embodiment.

[0051] In this embodiment, a QR code scanning device is deployed in the data layer of the organization sub-chain to scan the second traceability QR code to read the corresponding traceability data, current timestamp and other required information and upload them to the corresponding organization sub-chain to complete the update of process data. Compared with the traditional manual input method, this embodiment not only ensures the security of traceability information, but also improves production efficiency.

[0052] In another optional embodiment, a data processing smart contract is also deployed on the organization subchain. When the sensor deployed at the physical layer periodically uploads the collected data, the sensor transmits the data to the corresponding organization subchain through the MQTT server, and the data processing smart contract is triggered to judge the similarity between the current collected data and the last recorded collected data. If the similarity is higher than the preset threshold, the data storage is not executed; otherwise, the data is classified and encrypted and stored by calling the data diversion smart contract.

[0053] like Figure 4 As shown, this is a flowchart of calling a data processing smart contract in this embodiment.

[0054] In this embodiment, considering that the sensor data transmission process is affected by the environment and causes certain data fluctuations, the data is processed by calling the data processing smart contract before the data is uploaded to the chain. This embodiment processes the data similarity and specifies the cycle time for data collection and upload. After receiving the data, the corresponding organization subchain calls the data processing smart contract for processing and then calls the data diversion smart contract for classified encryption and storage of the data. This embodiment can effectively improve the validity of the data, reduce the risk of data loss or damage, reduce the system storage burden, and significantly improve the performance of the system.

[0055] Exemplarily, for a multi-chain fusion system constructed by a planting sub-chain, a transportation sub-chain, a processing sub-chain, a warehousing sub-chain, a sales sub-chain and a supervision main chain, the data processing smart contract is deployed on the planting sub-chain, and the planting sub-chain data layer is deployed with a number of hardware devices such as environmental sensors. During the implementation process, the cycle time for data collection and upload is specified. The hardware equipment uploads the collected environmental data to the planting sub-chain through the MQTT server in each cycle. After receiving the data, the planting sub-chain calls the data processing smart contract for processing, and determines the similarity between the currently collected environmental data and the last recorded environmental data. If it is higher than the preset threshold, the currently collected environmental data will not be stored; if it is lower, the data diversion smart contract is called to classify and encrypt the data for storage.

[0056] Furthermore, in an optional embodiment, when the data diversion smart contract is triggered, the following steps are performed:

[0057] Determine whether the current data is private data or non-private data;

[0058] For private data, the national SM4 encryption algorithm is used to encrypt and store it in the blockchain. At the same time, the basic attributes of the subchain client of the identity authentication are used as access restrictions, and the CP-ABE attribute encryption algorithm is used to encrypt the SM4 key pair and store it in the blockchain, thereby ensuring that the corresponding key cannot be obtained by attackers;

[0059] For non-privacy data, the CP-ABE attribute encryption algorithm with the system root CA (Certificate Authority) of all organization sub-chains and the system root CA of the regulatory main chain as attribute restrictions is used to encrypt the data to obtain the first data ciphertext, and the first data ciphertext is stored in the centralized database for subsequent traceability query; at the same time, the system root CA of all organization sub-chains is used as the authorization attribute set, and the CP-ABE attribute encryption algorithm is used to encrypt the data to obtain the second data ciphertext, and the second data ciphertext is stored in the IPFS file system; the hash value of the non-privacy data is calculated by the SM3 cryptographic hash algorithm, and the hash value is stored in the target organization sub-chain for periodic verification of the validity of the data in the centralized database.

[0060] like Figure 5 As shown, it is a schematic diagram of the process of calling the data diversion smart contract in this embodiment.

[0061] This embodiment adopts multi-mode encrypted storage on and off the chain, and divides the data into privacy data and non-privacy data according to the degree of importance, and designs different targeted storage methods for the two types of data.

[0062] Among them, for privacy data, in order to improve the efficiency and security of data transmission, the SM4 symmetric national encryption algorithm with higher security and better performance is adopted. In order to ensure the security of on-chain keys and ciphertexts, the CP-ABE attribute encryption algorithm with the basic attributes of users with access rights as access control is used to encrypt the SM4 keys. Compared with traditional asymmetric encryption or symmetric encryption algorithms, the CP-ABE attribute encryption algorithm can effectively avoid the risks of plaintext storage of keys on the chain and private storage off the chain, and only members who meet the attribute restrictions can decrypt and obtain the SM4 symmetric key, achieving fine-grained access control.

[0063] For non-privacy data, the more secure SM3 cryptographic hashing algorithm and the CP-ABE attribute encryption algorithm that facilitates fine-grained access control of data are adopted. In combination with various storage methods, the validity of non-privacy data is ensured, effectively reducing on-chain storage redundancy.

[0064] This embodiment adopts multiple storage methods such as blockchain, centralized database and IPFS interplanetary file system. Among them, IPFS interplanetary file system is used for backup storage of data information. If the periodic verification mechanism detects that the data in the centralized database has been tampered with, damaged or lost, the backup data in IPFS will be updated to the centralized database in time to ensure the normal operation of the system, further ensure the security of privacy data, and ensure the validity and consistency of non-privacy data.

[0065] Example 2

[0066] This embodiment proposes a multi-blockchain interactive fusion security supervision method for traceability applications, and applies the multi-blockchain interactive fusion security supervision system for traceability applications proposed in Example 1. Figure 6 Shown is a flow chart of the multi-blockchain interactive fusion security supervision method for traceability applications in this embodiment.

[0067] The multi-blockchain interactive fusion security supervision method for traceability applications proposed in this embodiment includes the following steps:

[0068] Build a multi-chain integration system consisting of a regulatory main chain and several organizational sub-chains;

[0069] When the organization sub-chain receives the data to be stored, the organization sub-chain calls the data diversion smart contract to determine whether the current data is private data or non-private data, and encrypts the data using the SM4 symmetric national encryption algorithm or the CP-ABE attribute encryption algorithm and writes it into the target organization sub-chain;

[0070] When a subchain client initiates a write request, the regulatory main chain calls the identity authentication smart contract to verify the identity authenticity certificate generated by the subchain client based on zero-knowledge proof technology. If the verification is successful, the data uploaded by the subchain client is received and transmitted to the organization subchain to perform classified encryption and storage of the data by calling the data diversion smart contract; otherwise, the current subchain client is denied access;

[0071] When the sub-chain client initiates a traceability request, the regulatory main chain calls the traceability smart contract, integrates the traceability data stored in each organization's sub-chain, converts it into the first traceability QR code and returns it to the sub-chain client.

[0072] In an optional embodiment, the method further comprises the following steps:

[0073] When the sub-chain client that has completed identity authentication initiates a QR code generation request to the regulatory main chain, the regulatory main chain calls the QR code generation smart contract, parses the QR code generation request uploaded by the sub-chain client, obtains the target organization sub-chain requested by the user, and queries the stored traceability data in the target organization sub-chain, converts it into a second traceability QR code, and then returns it to the sub-chain client.

[0074] Furthermore, in an optional embodiment, the method further comprises the following steps:

[0075] When the second traceability QR code obtained by the subchain client is scanned by a QR code scanning device deployed at the data layer, the QR code scanning device parses and obtains the corresponding traceability data, current timestamp and terminal information and uploads them to the target organization subchain;

[0076] The target organization subchain calls the data diversion smart contract to perform classified encrypted storage of data.

[0077] In an optional embodiment, the method further comprises the following steps:

[0078] When the sensors deployed at the physical layer periodically upload collected data, the sensors transmit the data to the corresponding organization subchain through the MQTT server;

[0079] The organization subchain calls the data processing smart contract to determine the similarity between the current collected data and the last recorded collected data:

[0080] If the similarity is higher than the preset threshold, data storage is not performed;

[0081] In an optional embodiment, when the data diversion smart contract is called, the following steps are performed:

[0082] Determine whether the current data is private data or non-private data;

[0083] For private data, the national secret SM4 encryption algorithm is used to encrypt and store it in the blockchain. At the same time, the basic attributes of the subchain client of the identity authentication are used as access restrictions, and the CP-ABE attribute encryption algorithm is used to encrypt the SM4 key pair and store it in the blockchain;

[0084] For non-privacy data, the CP-ABE attribute encryption algorithm with the system root CA of all organization sub-chains and the system root CA of the regulatory main chain as attribute restrictions is used to encrypt the data to obtain the first data ciphertext, and the first data ciphertext is stored in the centralized database; at the same time, the system root CA of all organization sub-chains is used as the authorization attribute set, and the CP-ABE attribute encryption algorithm is used to encrypt the data to obtain the second data ciphertext, and the second data ciphertext is stored in the IPFS file system; the hash value of the non-privacy data is calculated by the national secret SM4 encryption algorithm, and the hash value is stored in the target organization sub-chain.

[0085] It can be understood that the method of this embodiment is applied to the system of the above-mentioned embodiment 1, and the options in the above-mentioned embodiment 1 are also applicable to this embodiment, so they will not be described repeatedly here.

[0086] Example 3

[0087] This embodiment proposes a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the multi-blockchain interactive fusion security supervision method proposed in Example 2.

[0088] Example 4

[0089] This embodiment proposes a storage medium on which computer-readable instructions are stored, wherein the computer-readable instructions, when executed by a processor, implement the steps of the multi-blockchain interactive fusion security supervision method proposed in Example 2.

[0090] Exemplarily, the storage medium includes, but is not limited to, a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0091] Exemplarily, the instructions, programs, code sets or instruction sets may be implemented using conventional programming languages.

[0092] Exemplarily, the processor includes but is not limited to a smart phone, a personal computer, a server, a network device, etc., and is used to execute all or part of the steps of the multi-blockchain interactive fusion security supervision method described in Example 2.

[0093] The terms in the drawings are only used for illustrative purposes and are not to be construed as limiting the present invention;

[0094] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A multi-blockchain interactive fusion security supervision system for traceability applications, characterized by: It includes a multi-chain integration system consisting of a regulatory main chain and several organizational sub-chains; The organization subchain is deployed with a data diversion smart contract, wherein when the organization subchain receives data to be stored, the data diversion smart contract is triggered to determine whether the current data is private data or non-private data, and encrypt the data using the SM4 symmetric national encryption algorithm or the CP-ABE attribute encryption algorithm and then write it into the target organization subchain; The regulatory main chain is deployed with identity authentication smart contracts and traceability smart contracts; among which: When the subchain client initiates a write request to the system, the identity authentication smart contract is triggered to verify the identity authenticity certificate generated by the zero-knowledge proof technology uploaded by the subchain client. If the verification is successful, the data uploaded by the subchain client is received and transmitted to the organization subchain to perform classified encrypted storage of the data by calling the data diversion smart contract; otherwise, the current subchain client is denied access; When the sub-chain client initiates a traceability request to the regulatory main chain, the traceability smart contract is triggered to integrate the traceability data stored in each organization's sub-chain, convert it into a first traceability QR code and return it to the sub-chain client.

2. The multi-blockchain interactive fusion security supervision system according to claim 1 is characterized in that: A QR code generation smart contract is also deployed on the regulatory main chain; When the sub-chain client that has completed identity authentication initiates a QR code generation request to the regulatory main chain, the QR code generation smart contract is triggered to parse the QR code generation request uploaded by the sub-chain client, obtain the target organization sub-chain requested by the user, and query the stored traceability data in the target organization sub-chain to convert it into a second traceability QR code and return it to the sub-chain client.

3. The multi-blockchain interactive fusion security supervision system according to claim 2 is characterized in that: The system also includes a QR code scanning device deployed at the data layer; The QR code scanning device is used to scan the second traceability QR code obtained by the sub-chain client, obtain the corresponding traceability data, current timestamp and terminal information, and then upload them to the target organization sub-chain, and call the data diversion smart contract to perform classified encrypted storage of data.

4. The multi-blockchain interactive fusion security supervision system according to claim 1 is characterized in that: A data processing smart contract is also deployed on the organization subchain; When the sensor deployed at the physical layer periodically uploads the collected data, the sensor transmits the data to the corresponding organization subchain through the MQTT server, and the data processing smart contract is triggered to determine the similarity between the current collected data and the last recorded collected data. If the similarity is higher than the preset threshold, the data storage is not performed; Otherwise, the data is classified and encrypted and stored by calling the data diversion smart contract.

5. The multi-blockchain interactive fusion security supervision system according to any one of claims 1 to 4 is characterized in that: When the data diversion smart contract is triggered, the following steps are performed: Determine whether the current data is private data or non-private data; For private data, the national secret SM4 encryption algorithm is used to encrypt and store it in the blockchain. At the same time, the basic attributes of the subchain client of the identity authentication are used as access restrictions, and the CP-ABE attribute encryption algorithm is used to encrypt the SM4 key pair and store it in the blockchain; For non-privacy data, the CP-ABE attribute encryption algorithm with the system root CA of all organization sub-chains and the system root CA of the regulatory main chain as attribute restrictions is used to encrypt the data to obtain the first data ciphertext, and the first data ciphertext is stored in the centralized database; at the same time, the system root CA of all organization sub-chains is used as the authorization attribute set, and the CP-ABE attribute encryption algorithm is used to encrypt the data to obtain the second data ciphertext, and the second data ciphertext is stored in the IPFS file system; the hash value of the non-privacy data is calculated by the SM3 cryptographic hash algorithm, and the hash value is stored in the target organization sub-chain.

6. A multi-blockchain interactive fusion security supervision method for traceability application, applied to the multi-blockchain interactive fusion security supervision system according to any one of claims 1 to 5, characterized in that: The following steps are involved: Build a multi-chain integration system consisting of a regulatory main chain and several organizational sub-chains; When the organization sub-chain receives the data to be stored, the organization sub-chain calls the data diversion smart contract to determine whether the current data is private data or non-private data, and encrypts the data using the SM4 symmetric national encryption algorithm or the CP-ABE attribute encryption algorithm and writes it into the target organization sub-chain; When a subchain client initiates a write request, the regulatory main chain calls the identity authentication smart contract to verify the identity authenticity certificate generated by the subchain client based on zero-knowledge proof technology. If the verification is successful, the data uploaded by the subchain client is received and transmitted to the organization subchain to perform classified encryption and storage of the data by calling the data diversion smart contract; otherwise, the current subchain client is denied access; When the sub-chain client initiates a traceability request, the regulatory main chain calls the traceability smart contract, integrates the traceability data stored in each organization's sub-chain, converts it into the first traceability QR code and returns it to the sub-chain client.

7. The multi-blockchain interactive fusion security supervision method according to claim 6 is characterized in that: The method further comprises the following steps: When the sub-chain client that has completed identity authentication initiates a QR code generation request to the regulatory main chain, the regulatory main chain calls the QR code generation smart contract, parses the QR code generation request uploaded by the sub-chain client, obtains the target organization sub-chain requested by the user, and queries the stored traceability data in the target organization sub-chain, converts it into a second traceability QR code, and then returns it to the sub-chain client.

8. The multi-blockchain interactive fusion security supervision method according to claim 7 is characterized in that: The method further comprises the following steps: When the second traceability QR code obtained by the subchain client is scanned by a QR code scanning device deployed at the data layer, the QR code scanning device parses and obtains the corresponding traceability data, current timestamp and terminal information and uploads them to the target organization subchain; The target organization subchain calls the data diversion smart contract to perform classified encrypted storage of data.

9. The multi-blockchain interactive fusion security supervision method according to claim 6 is characterized in that: The method further comprises the following steps: When the sensors deployed at the physical layer periodically upload collected data, the sensors transmit the data to the corresponding organization subchain through the MQTT server; The organization subchain calls the data processing smart contract to determine the similarity between the current collected data and the last recorded collected data: If the similarity is higher than the preset threshold, data storage is not performed; Otherwise, the data is classified and encrypted and stored by calling the data diversion smart contract.

10. The multi-blockchain interactive fusion security supervision method according to any one of claims 6 to 9 is characterized in that: When the data diversion smart contract is called, the following steps are performed: Determine whether the current data is private data or non-private data; For private data, the national secret SM4 encryption algorithm is used to encrypt and store it in the blockchain. At the same time, the basic attributes of the subchain client of the identity authentication are used as access restrictions, and the CP-ABE attribute encryption algorithm is used to encrypt the SM4 key pair and store it in the blockchain; For non-privacy data, the CP-ABE attribute encryption algorithm with the system root CA of all organization sub-chains and the system root CA of the regulatory main chain as attribute restrictions is used to encrypt the data to obtain the first data ciphertext, and the first data ciphertext is stored in the centralized database; at the same time, the system root CA of all organization sub-chains is used as the authorization attribute set, and the CP-ABE attribute encryption algorithm is used to encrypt the data to obtain the second data ciphertext, and the second data ciphertext is stored in the IPFS file system; the hash value of the non-privacy data is calculated by the national secret SM4 encryption algorithm, and the hash value is stored in the target organization sub-chain.

Images