A data asset full life cycle management method and system

Abstract

The present invention discloses a data asset full life cycle management method and system, which belongs to the field of data encryption technology, including: collecting user data at a collection node, generating a layout file through a smart contract, and encrypting the user data for the first time; using a node to send a transaction request to a storage node for the first time, the storage node verifies the transaction request through a smart contract, obtains the user data after the first encryption, encrypts the user data for the second time and stores it; using a node to initiate a transaction request for the second time, decrypts the user data, generates a new version of the user data and stores it, and establishes a link with the second encrypted user data; real-time monitoring is performed through a smart contract, and the access rights and encryption levels of the data are dynamically adjusted according to the monitoring results. The present invention improves the reliability and audit convenience of the system by combining alliance chain nodes with smart contracts for data encryption, verification and dynamic rights management.

Description

Technical Field

[0001] The present invention belongs to the field of data encryption, and specifically relates to a data asset full life cycle management method and system. Background Art

[0002] With the development of the information society, data assets have become an important part of the competitiveness of enterprises and even countries. The management of data assets not only involves the storage and retrieval of data, but also covers various operations in the entire life cycle of data generation, use, sharing, destruction, etc. In recent years, with the application of emerging technologies such as cloud computing, big data, and blockchain, the technical means of data asset management have been significantly improved. For example, blockchain-based data notarization technology can improve the authenticity and immutability of data; while big data analysis technology can help to explore the value of data and achieve refined management. However, although existing technologies have solved some problems in data asset management to a certain extent, there are still some challenges that need to be solved in actual application.

[0003] First, when existing data asset management technologies process large-scale data, especially when the amount of data grows dramatically, the performance of the system will be seriously affected. Since the full life cycle management of data assets involves a large amount of data interaction, how to improve the system's response speed and processing capabilities while ensuring data security has become a major problem. Secondly, in terms of data privacy protection, despite the use of a variety of encryption technologies, how to ensure data privacy and security in scenarios of data sharing and cross-domain use is still an unresolved issue. In particular, with the continuous improvement of data protection regulations, higher requirements are placed on the dynamic adjustment of data access rights and timely changes in encryption levels. Summary of the invention

[0004] To solve the above problems, the present invention provides a data asset full life cycle management method and system to solve the performance bottleneck in large-scale data processing and the privacy protection problem in data sharing scenarios.

[0005] The data asset full life cycle management method described in the present invention comprises the following steps:

[0006] Step 1: Based on the full life cycle of data assets, the alliance chain nodes are divided into collection nodes, storage nodes and usage nodes;

[0007] Step 2: The collection node collects user data, generates a layout file through a smart contract, and encrypts the user data for the first time;

[0008] Step 3: The user node sends a transaction request to the storage node for the first time. The storage node verifies the transaction request through the smart contract, obtains the user data after the first encryption, encrypts the user data for the second time, and stores it;

[0009] Step 4: Use the node to initiate a transaction request for the second time, decrypt the user data, generate and store a new version of the user data, and establish a link with the second encrypted user data;

[0010] Step 5: Real-time monitoring is carried out through smart contracts, and the access rights and encryption level of data are dynamically adjusted according to the monitoring results;

[0011] Step 6: The management system records the transaction records of user data and generates a data flow diagram to show the state changes of data at each stage in the system.

[0012] Furthermore, in step 1, the collection node is responsible for collecting user data and performing preliminary processing; the storage node is responsible for verifying transaction requests and storing encrypted user data; and the use node is responsible for processing user data and generating new versions of data.

[0013] Furthermore, step 2 is specifically as follows:

[0014] The collection node collects original user data through the API interface and digitally signs the user data using a private key , the expression is:

[0015] ,

[0016] in, is the hash value of the user data, The part of the private key used to calculate the signature. The public key corresponding to the modulus is used to verify the signature;

[0017] Generate data identifiers through smart contracts , Storage Location and digitally signed layout files ;

[0018] Use the public key to encrypt the user data for the first time. The expression is:

[0019] ,

[0020] in, For the user data after the first encryption, is the public key exponent;

[0021] The private key used for decryption is stored in the collection node.

[0022] Furthermore, step 3 is specifically as follows:

[0023] The storage node verifies the transaction request initiated by the user node through the smart contract , and verify the validity of the transaction request through smart contracts;

[0024] After verification, the storage node obtains the first encrypted user data ;

[0025] The storage node uses the new public key to encrypt the user data for the second time. The expression is:

[0026] ,

[0027] in, It is the user data after the second encryption. is the exponent of the new public key, is the modulus part of the new public key;

[0028] The storage node stores the second encrypted data in the storage center and stores the private key for decryption in the secure key management system.

[0029] Furthermore, step 4 is specifically as follows:

[0030] Use the node to send a transaction request to the storage node , requesting permission to decrypt user data after the first encryption, the storage node verifies the validity of the transaction request through the smart contract;

[0031] After verification, the user obtains the permission to decrypt the user data, obtains the private key for decryption from the security key management system, and uses the private key to decrypt the second encrypted data in the storage center. The expression is:

[0032] ;

[0033] in, For the decrypted data, It is a component of the private key;

[0034] Use the node to decrypt the user data Process and generate new version of user data and store the new version of user data in the storage center;

[0035] Use the node to add a unique identifier to the user data encrypted for the second time in the storage center Establish a connection.

[0036] Furthermore, step 5 is specifically as follows:

[0037] Design monitoring indicators for smart contracts based on encryption strength, access control effectiveness, data leakage risk, and audit trail integrity;

[0038] The monitoring frequency is designed based on historical data analysis to ensure the timeliness of the data. The blockchain event listener is introduced to capture events in the smart contract in real time, and the security status score of each monitoring indicator is calculated. The expression is:

[0039] ,

[0040] in, The security status score of the monitoring indicator. Indicates Monitoring indicator scores, Indicates The change rate score of each monitoring indicator, Indicates the number of anomalies detected in the current time window. Indicates the score increment based on historical trends, Used to adjust the score range;

[0041] The security status is divided into high security status, medium security status and low security status, and the final security status level is calculated based on the security status score actually calculated, and the access rights and encryption level are adjusted according to the security status level;

[0042] Smart contracts update new access rights and new encryption levels into the system.

[0043] Furthermore, step 6 is specifically as follows:

[0044] The management system creates a new transaction record , and record the request transaction timestamp, initiator, target, transaction type, transaction status and transaction data identifier. The expression is:

[0045] ;

[0046] in, is the timestamp, For the initiator, For the target party, is the transaction type, is the transaction status, is the transaction identifier;

[0047] The management system stores transaction records in a database;

[0048] The management system creates an empty data flow graph and adds nodes representing each node in the data flow graph. The expression is:

[0049] ;

[0050] in, is a node in the system;

[0051] The management system adds edges to the data flow graph to represent data flow. The expression is:

[0052] ;

[0053] in, For data slave nodes Flow to Node ;

[0054] The management system marks the data status of each node in the data flow diagram, and the expression is:

[0055] ;

[0056] in, For Node The data status;

[0057] The management system displays the data flow diagram in a graphical way to visualize the data flow path and status changes in the system, thereby assisting in managing the entire life cycle of data assets.

[0058] The present invention also provides a data asset full life cycle management system for implementing the above method, the system comprising:

[0059] The node division module divides the alliance chain nodes into collection nodes, storage nodes and usage nodes based on the full life cycle of data assets; the data collection module is used to collect user data from the collection nodes, generate layout files through smart contracts, and encrypt the user data for the first time; the data storage module is used to use the node to send a transaction request to the storage node for the first time, and the storage node verifies the transaction request through the smart contract, obtains the user data after the first encryption, and encrypts and stores the user data for the second time; the data usage module is used to use the node to initiate a transaction request for the second time, decrypt the user data, generate and store a new version of the user data, and establish a link with the second encrypted user data; the permission adjustment module is used to perform real-time monitoring through smart contracts, and dynamically adjust the access rights and encryption level of the data according to the monitoring results; the data management module is used to manage the system to record the transaction records of user data, and generate a data flow diagram to show the status changes of the data at each stage in the system.

[0060] The beneficial effects of the present invention are as follows: the method of the present invention realizes efficient and secure circulation and management of data assets throughout the entire life cycle by subdividing the alliance chain nodes into collection nodes, storage nodes and use nodes, and combines smart contracts for data encryption, verification and dynamic permission management, thereby significantly enhancing the security and integrity of the data; the use node establishes a connection with the user data that has been encrypted and stored for the second time in the storage center by adding a unique identifier, ensuring the consistency and traceability of the data, and also facilitating subsequent management and operation of the data; at the same time, the present invention further improves the reliability and audit convenience of the system through real-time monitoring and visual management, and dynamically adjusts the security level of the data according to the real-time monitoring results, ultimately achieving the beneficial effects of all-round protection of data security and improved management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a flowchart of the data asset full life cycle management method in Example 1;

[0062] Figure 2 This is a schematic diagram of the structure of the data asset full life cycle management system in Example 1;

[0063] Figure 3 Schematic diagram of the implementation of cryptographic compilation under disturbance conditions. DETAILED DESCRIPTION

[0064] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0065] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0066] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0067] Embodiment 1 is the first embodiment of the present invention, as Figure 1 As shown, this embodiment provides a data asset full life cycle management method, including the following steps:

[0068] Step 1: Based on the full life cycle of data assets, the alliance chain nodes are divided into collection nodes, storage nodes and usage nodes;

[0069] Furthermore, the collection node is responsible for collecting user data and performing preliminary processing; preliminary processing includes clarity and formatting to ensure data quality;

[0070] The storage node is responsible for verifying transaction requests and storing encrypted user data; the verified transaction requests are those from the user nodes;

[0071] Nodes are used to process user data and generate new versions of data; each node focuses on its own task, avoiding redundant operations caused by overlapping functions, ensuring efficient management and security of data assets throughout their life cycle, while also improving the flexibility, scalability and maintainability of the system.

[0072] Step 2: The collection node collects user data, generates a layout file through a smart contract, and encrypts the user data for the first time;

[0073] Furthermore, the collection node collects the original user data through the API interface and digitally signs the user data using the private key. , the expression is:

[0074] ,

[0075] in, is the hash value of the user data, The part of the private key used to calculate the signature. The public key corresponding to the modulus is used to verify the signature. It should be noted that the hash value is composed of the modulus and the public key exponent, and the part of the public key is a fixed-length summary of the original user data. Using the hash value instead of the original data itself for signing can reduce the complexity of the signature calculation, and the hash value is unique, which can effectively prevent data tampering. It means that the modulo operation ensures that the operation result is within a fixed range, prevents overflow, and makes the signing and verification process periodic. is the part of the public key consisting of the modulus and the public key exponent;

[0076] Generate data identifiers through smart contracts , Storage Location and digitally signed layout files ;

[0077] Use the public key to encrypt the user data for the first time. The expression is:

[0078] ,

[0079] in, For the user data after the first encryption, is the public key index; it should be noted that the encrypted data should be stored in the storage node;

[0080] The private key used for decryption is stored in the collection node; the above steps ensure the security and integrity of data during the collection, encryption, storage and management process. Each stage of operation is carefully designed to ensure the secure transmission and storage of data.

[0081] Step 3: The user node sends a transaction request to the storage node for the first time. The storage node verifies the transaction request through the smart contract, obtains the user data after the first encryption, encrypts the user data for the second time, and stores it;

[0082] Furthermore, the storage node verifies the transaction request initiated by the user node through the smart contract, and verifies the validity of the transaction request through the smart contract; this process involves multiple aspects of verification. First, identity authentication is performed to check whether the identity of the initiator in the request is legal, and the digital signature is verified using the public key. Secondly, the validity of the transaction request is verified from four aspects: request format, timestamp, permission, and data consistency. Finally, the smart contract verification is performed. The storage node verifies the validity of the transaction request through the logic in the smart contract, and decides whether to continue processing the transaction request based on the verification result returned by the smart contract.

[0083] After verification, the storage node obtains the first encrypted user data ;

[0084] The storage node uses the new public key to encrypt the user data for the second time. The expression is:

[0085] ,

[0086] in, It is the user data after the second encryption. is the exponent of the new public key, is the modulus part of the new public key;

[0087] The storage node stores the second encrypted data in the storage center and stores the private key used for decryption in the secure key management system; it should be noted that the secure key management system plays a vital role in the encryption and decryption process to ensure the security of sensitive data.

[0088] Step 4: Use the node to initiate a transaction request for the second time, decrypt the user data, generate and store a new version of the user data, and establish a link with the second encrypted user data;

[0089] Furthermore, the user node sends a transaction request to the storage node. , requesting permission to decrypt user data after the first encryption, the storage node verifies the validity of the transaction request through the smart contract;

[0090] After verification, the user obtains the permission to decrypt the user data, obtains the private key for decryption from the security key management system, and uses the private key to decrypt the second encrypted data in the storage center. The expression is:

[0091] ;

[0092] in, For the decrypted data, It is a component of the private key. Through the above steps, the user node can verify the validity of the transaction request through the smart contract, and obtain the decryption permission after the verification, and then decrypt the data and generate a new version of the user data, the details of which are consistent with the first decryption;

[0093] Use the node to decrypt the user data Process and generate new version of user data , and store the new version of user data in the storage center; the process of generating the new version of user data is a process involving data processing, updating and conversion. Before starting to process the data, it is necessary to first verify whether the decrypted data is complete, accurate and in the correct format. After the verification, the data is cleaned, converted, integrated and updated, and the data is statistically, trended and predicted. The new version of data is generated through merging, formatting, verification and backup;

[0094] Use the node to add a unique identifier to the user data encrypted for the second time in the storage center Establish a connection; to ensure uniqueness, generate a unique identifier. When the data is encrypted and stored in the storage center, assign a unique identifier and associate the generated unique identifier with the encrypted data.

[0095] Step 5: Real-time monitoring is carried out through smart contracts, and the access rights and encryption level of data are dynamically adjusted according to the monitoring results;

[0096] Furthermore, the monitoring indicators of smart contracts are designed based on four aspects: encryption strength, access control effectiveness, data leakage risk and audit trail integrity. It should be noted that encryption strength is selected for the security of data during transmission and storage, encryption strength is selected to ensure that only authorized users can access specific data and resources and reduce the risk of data leakage, data leakage risk is selected to ensure data integrity, and audit trail integrity is selected to facilitate accountability.

[0097] The monitoring frequency is designed based on historical data analysis to ensure the timeliness of the data. The blockchain event listener is introduced to capture events in the smart contract in real time, and the security status score of each monitoring indicator is calculated. The expression is:

[0098] ,

[0099] in, The security status score of the monitoring indicator. Indicates Monitoring indicator scores, Indicates The change rate score of each monitoring indicator, Indicates the number of anomalies detected in the current time window. Indicates the score increment based on historical trends, Used to adjust the score range; in order to ensure the timeliness of data, it is necessary to design a reasonable monitoring frequency. The selection of monitoring frequency should take into account four factors: system complexity, data sensitivity, resource consumption and business needs. The introduction of blockchain event listeners can realize real-time capture of events in smart contracts, including but not limited to contract calls, state changes, etc. The listener can capture these events and trigger corresponding actions according to predefined rules, such as alarms, logging or automatic responses, and give a monitoring indicator score based on the actual situation of each indicator , the change rate score needs to calculate the change amount through the change amount formula, the expression is:

[0100] ;

[0101] in, For the current time The scores of the monitoring indicators, For the first evaluation The scores of the monitoring indicators;

[0102] Use real-time monitoring tools to obtain the current time score through weighted summation and the first assessment score , normalize the changes in the monitoring indicators, assign weights, and summarize all the change rates to get the change rate score ;

[0103] Abnormal data can be effectively detected and recorded through log analysis, security audit tools, automated monitoring and manual review.

[0104] Classify the security status into high security status , Medium security status and low security status , the final safety status level is calculated by the safety status score V obtained by actual calculation , the expression is:

[0105] ;

[0106] Among them, High, Medium, Low, and Unknown represent high security status level, medium security status level, low security status level, and unknown security status level respectively;

[0107] Dynamically adjust access rights and encryption levels based on the calculated security status level. The adjustment rules are:

[0108] if: ,but: ;

[0109] if: ,but: ;

[0110] if: ,but: ;

[0111] if: ,but: ;

[0112] The encryption adjustment rules are:

[0113] if: ,but: ;

[0114] if: ,but: ;

[0115] if: ,but: ;

[0116] if: ,but: ;

[0117] in, For access permissions, is the encryption level, For the highest access privileges, For medium access rights, For the lowest level of access, The default access permissions are For the strongest encryption level, For medium encryption level, The weakest encryption level. is the default encryption level;

[0118] Smart contracts update new access rights and new encryption levels into the system.

[0119] Step 6: The management system records the transaction records of user data and generates a data flow diagram to show the state changes of data at each stage in the system;

[0120] Furthermore, the management system creates a new transaction record , and record the request transaction timestamp, initiator, target, transaction type, transaction status and transaction data identifier. The expression is:

[0121] ;

[0122] in, is the timestamp, For the initiator, For the target party, is the transaction type, is the transaction status, is the transaction identifier;

[0123] The management system stores transaction records in a database.

[0124] It should be noted that the management system creates a record containing the timestamp, initiator, target, transaction type, transaction status and transaction data identifier based on the details of the transaction, and saves the newly created transaction record in the database to ensure the persistence and accessibility of the data.

[0125] The management system creates an empty data flow graph and adds nodes representing each node in the data flow graph. The expression is:

[0126] ;

[0127] in, are nodes in the system; it should be noted that these nodes are individual components, servers or entities in the system;

[0128] The management system adds edges to the data flow graph to represent data flow. The expression is:

[0129] ;

[0130] in, For data slave nodes Flow to Node ;

[0131] The management system marks the data status of each node in the data flow diagram, and the expression is:

[0132] ;

[0133] in, For Node The data status;

[0134] The management system displays the data flow diagram in a graphical way to visualize the data flow path and status changes in the system, thereby assisting in managing the entire life cycle of data assets.

[0135] For example, suppose there is a simple data flow process involving three nodes: the initiator client, the intermediate processing server and the target database. The present invention creates a data flow graph according to the above steps. , add a node,

[0136] ;

[0137] in, For the client, For the intermediate processing server, is the target database;

[0138] Adding edges indicates data flow,

[0139] ;

[0140] in, Indicates that data flows from the client to the processing server. Represents the flow of data from the processing server to the database;

[0141] The data status of the label node,

[0142] ;

[0143] in, Indicates that the client has initiated a request. Indicates that the processing server is processing the request. Indicates that the database has completed storage;

[0144] Use a graphical tool to draw the above data flow diagram so that the data flow path and the status of each node are clearly visible.

[0145] This embodiment also provides a data asset full life cycle management system, such as Figure 2 As shown, including:

[0146] Node division module, which divides alliance chain nodes into collection nodes, storage nodes and usage nodes based on the full life cycle of data assets;

[0147] The data collection module is used to collect user data from the collection nodes, generate layout files through smart contracts, and encrypt user data for the first time;

[0148] The data storage module is used to use the node to send a transaction request to the storage node for the first time. The storage node verifies the transaction request through the smart contract, obtains the user data after the first encryption, and encrypts the user data for the second time and stores it;

[0149] The data usage module is used to use the node to initiate a transaction request for the second time, decrypt the user data, generate and store the new version of the user data, and establish a link with the second encrypted user data;

[0150] The permission adjustment module is used to conduct real-time monitoring through smart contracts and dynamically adjust the access rights and encryption level of data based on the monitoring results;

[0151] The data management module is used to manage the transaction records of user data in the system and generate data flow diagrams to show the status changes of data at various stages in the system.

[0152] The following is a related test experiment using the method of the present invention to illustrate the effect of the present invention.

[0153] (1) Performance testing experiments, which evaluate the system’s response time and resource consumption by simulating large-scale data processing.

[0154] First, a series of data samples of different sizes were generated, namely 1KB, 10KB, 100KB and 1MB; then, an encryption function was defined, which encrypted the data based on the SHA-256 hash algorithm to simulate the actual data processing process. Through this function, the system recorded the time required to process each data size and output these time data to evaluate the performance of the system when processing different data sizes.

[0155] The system showed fast and consistent performance when processing data of different sizes. For small data of 1KB and 10KB, the encryption processing time was close to zero seconds, showing the system's efficient processing ability for small data volumes. As the amount of data increased, the processing time increased slightly, but even when processing larger data of 1MB, the encryption time was only 0.0050 seconds, indicating that the system can still maintain good performance when processing larger data volumes. This shows that the system is highly efficient for small to medium-sized data encryption tasks, and the performance degradation is limited even when the data volume increases.

[0156] (2) Security testing experiments, verifying the system's protection capabilities by encrypting and attempting to crack data.

[0157] This experiment uses the `hashlib` and `hmac` modules in the Python standard library to implement a data processing flow based on HMAC and SHA-256 hash functions. The experimental steps first involve creating an HMAC object, and then using the object to generate a summary of sensitive data to ensure the integrity and consistency of the data. The generated summary is converted through Base64 encoding to facilitate display and storage in different application scenarios, enhancing the readability and portability of the data. In the "decryption" stage, the experiment simulates the verification process of the summary. Although this step does not truly restore the original data, it effectively verifies the accuracy of the data summary and ensures that the data has not been tampered with during transmission and storage. The entire experimental process not only simulates the dynamic permission management of data under different security states, but also verifies the system's response capabilities to security threats and automatic adjustment mechanisms, thereby proving the effectiveness of the present invention in ensuring data security and improving management efficiency.

[0158] ① Encryption result: The output DVt++cRKWsuNpULXbVDehO4iwAMMVhpRWVPcy+r2VT4= is a Base64-encoded string. Since hash functions (such as SHA-256) are used in the encryption process, the encrypted data usually contains unprintable characters. Base64 encoding is used to convert these binary data into printable characters for easy display and storage. This encoded string is the encrypted data and appears to be a string of random characters and numbers, which shows that the encryption process effectively hides the content of the original data.

[0159] ②Decryption result: The output b'\xf3\x04\xc1\x12t\xca\xbc\x93\xab\xe7\x9f:\xbb\x84\x8b\x94\x02m>\x1c\x9aI\x07\x1e\xa9o\xbe\xce\x9b\x9f+\xb0' is the decrypted data, expressed as a byte string. This output shows the binary form of the original data, which contains unprintable characters (indicated by the beginning of \x followed by two hexadecimal digits).

[0160] like Figure 3 As shown in the figure, the simulated encrypted signal waveform shows the amplitude of the simulated encrypted signal changing over time, where the sine wave represents the original signal, and the random noise surrounding it simulates the encryption effect. By observing the waveform, it can be seen that the overall shape of the signal can still be recognized, but the presence of random noise makes the details of the signal blurred, thereby effectively hiding the original data, confirming the effectiveness of encryption. This shows that the encryption method can maintain the integrity and security of the data even when the signal is interfered with.

[0161] (3) Dynamic permission management test experiment.

[0162] In this dynamic permission management test experiment, we first defined a set of security status scoring rules, which evaluate the current security status of the system based on multiple key indicators. Then, by changing the input conditions, we simulated various security threats to reflect the various security states that the system may encounter. According to the calculated security status score, the system automatically adjusted the data access rights and encryption level to adapt to the current security environment. During the experiment, each adjustment of permissions and encryption levels was recorded in detail, and the corresponding results were output. Finally, these results were analyzed to verify whether the adjustments of permissions and encryption levels met the expected security requirements, thereby ensuring the effectiveness of the system's dynamic permission management mechanism.

[0163] The experimental results show the security status scores, permission levels, and encryption levels under different threat levels. As the threat level increases, the security status score decreases, causing the permission level and encryption level to be adjusted to a lower level accordingly. When the threat level is 3, the security score is 65, the permission level is medium, and the encryption level is medium. When the threat level rises to 7, the security score drops to 45, and both the permission level and encryption level drop to low. Similar low security scores and corresponding low permissions and encryption levels are observed at threat levels 5 and 9. In contrast, when the threat level is as low as 1, the security score is as high as 75, and both the permission level and encryption level are at a medium level. These results show that the system is able to dynamically adjust permissions and encryption measures according to changes in the security status to ensure that the security of the data matches the current security needs.

[0164] The experiment simulated a dynamic permission management test, and the system was able to automatically adjust the access rights and encryption level of the data according to the security status score to meet the adaptive protection needs under different security threats. This method enhances the flexibility and responsiveness of data protection and provides an effective strategy for the security management of data assets. In the experiment, as the threat level changes, the system accurately adjusts the permissions and encryption levels, verifying the effectiveness of the invention in practical applications and providing reliable technical support for the security management of data assets throughout their life cycle.

[0165] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data asset full life cycle management method, characterized in that: The following steps are involved: Step 1: Based on the full life cycle of data assets, the alliance chain nodes are divided into collection nodes, storage nodes and usage nodes; Step 2: The collection node collects user data, generates a layout file through a smart contract, and encrypts the user data for the first time; specifically: The collection node collects original user data through the API interface and digitally signs the user data using a private key , the expression is: ， in, is the hash value of the user data, The part of the private key used to calculate the signature. The public key corresponding to the modulus is used to verify the signature; Generate data identifiers through smart contracts , Storage Location and digitally signed layout files; Use the public key to encrypt the user data for the first time. The expression is: ， in, For the user data after the first encryption, is the public key exponent; The private key used for decryption is stored in the collection node; Step 3: The user node sends a transaction request to the storage node for the first time. The storage node verifies the transaction request through the smart contract, obtains the user data after the first encryption, encrypts the user data for the second time and stores it. Specifically: The storage node verifies the transaction request initiated by the user node through the smart contract, and verifies the validity of the transaction request through the smart contract; After verification, the storage node obtains the first encrypted user data ; The storage node uses the new public key to encrypt the user data for the second time. The expression is: ， in, It is the user data after the second encryption. is the exponent of the new public key, is the modulus part of the new public key; The storage node stores the second encrypted data in the storage center and stores the private key for decryption in the secure key management system; Step 4: Use the node to initiate a second transaction request, decrypt the user data, generate and store a new version of the user data, and establish a link with the second encrypted user data; specifically: The user node sends a transaction request to the storage node, requesting the permission to decrypt the user data after the first encryption. The storage node verifies the validity of the transaction request through the smart contract. After verification, the user obtains the permission to decrypt the user data, obtains the private key for decryption from the security key management system, and uses the private key to decrypt the second encrypted data in the storage center. The expression is: ； in, For the decrypted data, It is a component of the private key; Use the node to decrypt the user data Process and generate new version of user data and store the new version of user data in the storage center; Use the node to add a unique identifier to the user data encrypted for the second time in the storage center Establish a connection; Step 5: Real-time monitoring is performed through smart contracts, and the access rights and encryption level of the data are dynamically adjusted according to the monitoring results. Specifically: Design monitoring indicators for smart contracts based on encryption strength, access control effectiveness, data leakage risk, and audit trail integrity; The monitoring frequency is designed based on historical data analysis to ensure the timeliness of the data. The blockchain event listener is introduced to capture events in the smart contract in real time, and the security status score of each monitoring indicator is calculated. The expression is: ， in, The security status score of the monitoring indicator. Indicates Monitoring indicator scores, Indicates The change rate score of each monitoring indicator, Indicates the number of anomalies detected in the current time window. Indicates the score increment based on historical trends, Used to adjust the score range; The security status is divided into high security status, medium security status and low security status, and the final security status level is calculated based on the security status score actually calculated, and the access rights and encryption level are adjusted according to the security status level; Smart contracts update new access rights and new encryption levels to the system; Step 6: The management system records the transaction records of user data and generates a data flow diagram to show the state changes of data at each stage in the system; specifically: The management system creates a new transaction record , and record the request transaction timestamp, initiator, target, transaction type, transaction status and transaction data identifier. The expression is: ； in, is the timestamp, For the initiator, For the target party, is the transaction type, is the transaction status, is the transaction identifier; The management system stores transaction records in a database; The management system creates an empty data flow graph and adds nodes representing each node in the data flow graph. The expression is: ； in, is a node in the system; The management system adds edges to the data flow graph to represent data flow. The expression is: ； in, For data slave nodes Flow to Node ; The management system marks the data status of each node in the data flow diagram, and the expression is: ； in, For Node The data status; The management system displays data flow diagrams in a graphical way to visualize the flow path and status changes of data in the system, thereby assisting in managing the entire life cycle of data assets.

2. A data asset full life cycle management method according to claim 1, characterized in that: In step 1, the collection node is responsible for collecting user data and performing preliminary processing; The storage node is responsible for verifying transaction requests and storing encrypted user data; The user node is responsible for processing user data and generating new version data.

3. A data asset full life cycle management system, characterized in that: Used to implement any one of claims 1 to 2, comprising: Node division module, which divides alliance chain nodes into collection nodes, storage nodes and usage nodes based on the full life cycle of data assets; The data collection module is used to collect user data from the collection nodes, generate layout files through smart contracts, and encrypt user data for the first time; The data storage module is used to use the node to send a transaction request to the storage node for the first time. The storage node verifies the transaction request through the smart contract, obtains the user data after the first encryption, and encrypts the user data for the second time and stores it; The data usage module is used to use the node to initiate a transaction request for the second time, decrypt the user data, generate and store the new version of the user data, and establish a link with the second encrypted user data; The permission adjustment module is used to conduct real-time monitoring through smart contracts and dynamically adjust the access rights and encryption level of data based on the monitoring results; The data management module is used to manage the transaction records of user data in the system and generate data flow diagrams to show the status changes of data at various stages in the system.

Images