Block chain technology-based trusted data source management method

Abstract

The invention provides a credible data source management method based on a block chain technology, belongs to the technical field of big data, focuses on storage credibility and processing credibility in a database management system, and realizes credible management of a data source by using the block chain technology. The storage credibility adopts a management mode of encryption privacy protection and virtual channel privacy protection; defining a plurality of virtual channels in the channel, and adding channel members into the virtual channels as required; a virtual channel is selected during private transaction, and a decryption white list is automatically generated according to virtual channel members; and the processing credibility adopts an intelligent contract and data traceability management mode. The credibility of the data source in the data hosting and data transaction service is ensured, so that the credible management of the data source is realized, and the accuracy, reliability and traceability of the data are improved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a trusted data source management method based on blockchain technology. Background Art

[0002] With the continuous development of informatization, the application of information systems has become the foundation and core of all walks of life. For example, in the power industry, the gradual construction and application of various information systems such as smart substations and power monitoring systems have generated a large amount of data with diverse structures and complex sources. These data are generated in various production and management processes during system operation. By fully mining and utilizing these data resources, they can be widely used in various fields such as market management and user services.

[0003] However, with the deepening of digitalization, the volume and complexity of data have increased dramatically, and traditional information systems have exposed more and more limitations in data management. Current data source management methods often rely on centralized data storage and verification mechanisms. This approach solves the problem of data sharing, but also brings many hidden dangers such as data ownership and privacy security. In addition, the data island phenomenon is serious, and it is difficult to achieve effective data sharing and integration between different systems, which reduces overall business efficiency and decision-making quality. Only by effectively breaking down the data island barriers between various data sources can data flow and play its value, and the reliable storage and management of these data sources is the basis for ensuring the stable operation of the system.

[0004] Blockchain can provide a decentralized, highly transparent, and tamper-resistant data storage and exchange platform, which not only enhances data security, but also promotes cross-organizational data sharing and collaboration. The application of blockchain in finance, supply chain, healthcare and other fields has achieved remarkable results, but how to effectively integrate blockchain technology with data source management in data transaction circulation, and how to improve the efficiency and security of data processing, etc., still need further research and exploration.

[0005] The service interfaces of existing blockchain systems and platforms are usually procedural, requiring users to write complex smart contracts, which are prone to errors and vulnerabilities. Secondly, most existing blockchain systems do not support complex data management, resulting in a high degree of coupling between the system and the application, making application development difficult. In addition, some blockchain platforms, especially public chain systems, use a consensus mechanism based on proof of work to ensure system scalability. In terms of performance, it cannot be compared with traditional trusted data management systems and cannot meet the needs of most mission-critical applications. Summary of the invention

[0006] In order to solve the above technical problems, the present invention provides a trusted data source management method based on blockchain technology, which aims to ensure the credibility of data sources in data hosting and data transaction services, thereby realizing trusted management of data sources, improving the accuracy, reliability and traceability of data, and providing strong support for the business development of various industries.

[0007] The technical solution of the present invention is:

[0008] A trusted data source management method based on blockchain technology focuses on storage trustworthiness and processing trustworthiness in database management systems, and uses blockchain technology to achieve trusted management of data sources;

[0009] ① Storage credibility is managed by encryption privacy protection and virtual channel privacy protection;

[0010] ② Define multiple virtual channels within the channel and add channel members to the virtual channels as needed;

[0011] ③ When conducting private transactions, select a virtual channel and automatically generate a decryption whitelist based on the virtual channel members;

[0012] ④ To ensure credibility, smart contracts and data traceability are used as management methods.

[0013] Furthermore,

[0014] The trusted management described above establishes an association between private transactions and virtual channels to facilitate subsequent management and statistics.

[0015] The encrypted privacy protection, data encryption and blockchain transactions with a whitelist can be divided into two types according to the storage location of the encrypted data: on-chain data encrypted storage and off-chain data encrypted storage.

[0016] in,

[0017] On-chain data encryption storage

[0018] Using Hyperledger FABRIC, the data on its network is transmitted in plain text in JSON format. All nodes in the channel receive the plain text data through the GOSSIP point-to-point protocol and save it locally. The on-chain data encryption storage of the big data trading platform uses symmetric encryption algorithms in the contract code to encrypt and store the plain text data. Finally, the blockchain consensus mechanism packages the encrypted data into blocks to form a blockchain.

[0019] Encryption principle: Generate a random number as the symmetric key K, use K to encrypt the plaintext data to obtain the ciphertext data; use the public keys of the users to whom the data is authorized to asymmetrically encrypt K to obtain KN, and multiple KNs are arranged in sequence to form an authorized whitelist, and the ciphertext data and the whitelist are connected and stored together.

[0020] Decryption principle: The authorized user uses his own private key to decrypt the key KN and obtains the symmetric key K; the authorized user uses the symmetric key K to decrypt the ciphertext data and obtain the plaintext data.

[0021] Off-chain data encryption storage

[0022] Off-chain data encryption storage implements data encryption through off-chain trusted and centralized services, and manages symmetric encryption keys through smart contracts. In smart contracts, the symmetric key is encrypted with the public key of the authorized user, and the result is recorded in the blockchain.

[0023] The encryption and decryption process is as follows: Generate a random number K as a symmetric encryption key, encrypt the file, and store the ciphertext file in the object storage. Perform hash calculation on the ciphertext file and obtain the hash value as the ID of the ciphertext file; use the public key of the user to whom the file is authorized to encrypt the key K, and the encrypted symmetric keys are arranged in sequence to form an authorized whitelist. The whitelist is attached to the ciphertext file ID and stored on the blockchain by the smart contract; the authorized user uses his own private key to decrypt the symmetric key, and uses the symmetric key K to decrypt the ciphertext file in the object storage to obtain the plaintext file.

[0024] Going further,

[0025] There are two ways to manage the whitelist: on-chain smart contract management and off-chain business layer management.

[0026] in

[0027] On-chain smart contract management means managing the correspondence between authorized users and keys through smart contracts, and authorized users obtain their own encryption keys through smart contracts.

[0028] Off-chain business layer management means managing the correspondence between users and keys at the off-chain business layer, and authorizing users to obtain their own encryption keys through off-chain business layer services.

[0029] After the authorized user obtains his own encryption key, he uses his own private key to decrypt the encryption key, and then uses the decryption result to decrypt the ciphertext, and finally obtains the target plaintext.

[0030] Going further,

[0031] Data resources are stored in plain text or cipher text form. Encrypted storage is located at the lower layer of data resources and provides storage services for data resources.

[0032] Going further,

[0033] Define several virtual channels in the channel, and add channel members to the virtual channels as needed; when doing private transactions, select the virtual channel, and the private transaction will automatically generate a decryption whitelist according to the virtual channel members; establish an association between private transactions and virtual channels; the addition of new members to the virtual channel or the withdrawal of members from the virtual channel will not affect the private transactions that have already occurred.

[0034] The visible scope of transaction data gradually narrows in the order of channel, virtual channel, and private transaction; in practice, the privacy control method can be selected as needed according to the actual control needs of the visible scope of transaction data.

[0035] Going further,

[0036] Smart Contracts

[0037] A smart contract refers to an automatically executable task contract implemented through information technology, which contains execution conditions and execution logic. When the conditions are met, the execution logic will be automatically executed. FABRIC provides the function of writing smart contracts in GO and JAVA. Smart contracts expand the ability of blockchain to process data.

[0038] Data traceability

[0039] Data provenance methods can be divided into two categories, namely, annotation-based methods and non-annotation methods;

[0040] The annotation-based approach transforms each data item into<S,D,I> A triplet label, where S represents the source of the data item, D represents the target data, and I represents the intermediate data result; by propagating labels during the data processing process, data connection is achieved to support data traceability.

[0041] For non-annotation methods, there is no need to add additional information to the source data and target data during data processing; at this time, it is necessary to understand what kind of processing has been done to store and maintain the data. When the processing is reversible, the source data can be inferred through the target data.

[0042] The beneficial effects of the present invention are

[0043] The distributed ledger technology of blockchain ensures the immutability and transparency of data, greatly improving the credibility of data. It not only improves the efficiency and security of data management, but also provides technical support for building a trust society and digital economy. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0045] Figure 2 This is a diagram of a private transaction;

[0046] Figure 3 This is a schematic diagram of encrypted data storage on the chain;

[0047] Figure 4 This is a schematic diagram of off-chain data encryption storage;

[0048] Figure 5 is a schematic diagram of a virtual channel;

[0049] Figure 6 This is a diagram of a private transaction. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0051] From the perspective of data management, the essence of blockchain is a database system built on a peer-to-peer network that provides trusted data management functions. Figure 1 As shown, a trusted database management system ensures the trustworthiness of the system from three levels, namely, the trustworthiness of storage, the trustworthiness of processing, and the trustworthiness of external access. External access trustworthiness refers to the authentication of user access. Its implementation mechanism relies on technologies such as distributed identity authentication, and is also closely related to specific application scenarios and businesses. This invention mainly focuses on storage trustworthiness and processing trustworthiness technologies, aiming to solve the limitations of existing blockchain technologies in trusted data management in complex scenarios, and provide more secure, reliable, and efficient data management services for various industries.

[0052] From the perspective of data management, the essence of blockchain is a database system built on a peer-to-peer network that provides trusted data management functions. Figure 1 As shown, a trusted database management system ensures the system's trustworthiness from three levels, namely, storage trustworthiness, processing trustworthiness, and external access trustworthiness. External access trustworthiness refers to the authentication of user access. Its implementation mechanism relies on technologies such as distributed identity authentication and is also closely related to specific application scenarios and businesses. This invention mainly focuses on storage trustworthiness and processing trustworthiness technologies.

[0053] 1 Storage Credibility

[0054] Storage reliability means that once the data processing results are confirmed, they will not be lost or tampered with. It requires the system to provide the transaction persistence required in traditional database management systems and transaction processing, but also requires the system to ensure the correctness of data storage in the event of storage and communication failures, or even deliberate attacks.

[0055] In addition to limiting IP addresses, limiting domain names, and using VPNs, the management of trusted data sources based on blockchain technology also requires hashing the business content to obtain the business content hash value. Then, according to the results of the negotiation and agreement between the two parties, the asymmetric cryptographic algorithm and key version are set, and the private key corresponding to the key version is used to encrypt the trusted data source identifier, security factor, and business content hash value using an asymmetric cryptographic algorithm to prevent information from being illegally stolen, and to prevent the occurrence of information theft, tampering, forgery, and replay, thereby achieving trusted data source management.

[0056] Encrypted privacy protection

[0057] In public chains such as Bitcoin and Ethereum, user transaction data is not encrypted, and privacy is protected only by account anonymity. In permissioned chains represented by Hyperledger FABRIC, multiple channels can be created, each with an independent ledger to achieve data isolation between different channels. However, the privacy control granularity of channel technology is relatively large, and channel members can see each other's transaction data. Since version 1.2, FABRIC has begun to support private data, which can be used to control the privacy range in a more fine-grained manner within the channel. Transaction data can be authorized to be visible to certain channel members, and unauthorized channel members can only see the transaction hash value.

[0058] In the process of data transaction and circulation, the use of FABRIC private data to control privacy is still insufficient. Because in the big data transaction platform, multiple enterprise accounts often share data nodes and channel members, so it is necessary to use data encryption storage to accurately control privacy granularity to the user level. Figure 2 As shown in the figure, this kind of blockchain transaction with encrypted data and attached whitelist is called private transaction. According to the storage location of encrypted data, it can be divided into two types: on-chain (ON-CHAIN) data encrypted storage and off-chain (OFF-CHAIN) data encrypted storage.

[0059] On-chain data encryption storage

[0060] Data on the Hyperledger FABRIC network is generally transmitted in plain text in JSON format. All nodes in the channel receive the plain text data through the GOSSIP point-to-point protocol and save it locally. The on-chain data encryption storage of the big data trading platform uses symmetric encryption algorithms (AES or SM1) in the contract code to encrypt and store the plain text data. Finally, the blockchain consensus mechanism packages the encrypted data into blocks to form a blockchain.

[0061] Encryption principle: Generate a random number as the symmetric key K, use K to encrypt the plaintext data to obtain the ciphertext data; use the public keys of the users to whom the data is authorized to asymmetrically encrypt K to obtain KN, and multiple KNs are arranged in sequence to form an authorized whitelist, and the ciphertext data and the whitelist are connected and stored together.

[0062] Decryption principle: The authorized user uses his own private key to decrypt the key KN and obtains the symmetric key K; the authorized user uses the symmetric key K to decrypt the ciphertext data and obtain the plaintext data.

[0063] As attached Figure 3 As shown, user A's private data only wants to be visible to users B and C. Assuming user B wants to decrypt the data, user B uses his own private key to parse K2, obtains the symmetric key K, and then uses K to decrypt the ciphertext data to obtain the plaintext data.

[0064] Off-chain data encryption storage

[0065] Off-chain data storage tools include: ordinary file systems, object storage systems, database systems, data lakes, etc. On-chain data encryption storage is implemented using smart contracts. In order to achieve consensus across the entire network, smart contracts need to be run on all nodes. However, encryption and decryption is an algorithm that consumes a lot of computing resources, especially when the amount of data is large, it requires a lot of computing and storage resources. Due to the limitations of blockchain computing resources, the encrypted storage of large amounts of data can consider off-chain data encryption storage.

[0066] Off-chain data encryption storage is a way of integrating multiple technologies, realizing data encryption through off-chain trusted and centralized services, and managing symmetric encryption keys (random numbers) through smart contracts. In smart contracts, the symmetric key is encrypted with the public key of the authorized user, and the result is recorded in the blockchain.

[0067] The encrypted storage of files is very suitable for using off-chain data encryption storage. The encryption and decryption process is as follows: Generate a random number K as a symmetric encryption key, encrypt the file, and store the ciphertext file in the object storage. Perform hash calculation on the ciphertext file and obtain the hash value as the ID of the ciphertext file. The key K is encrypted with the public key of the user to whom the file is authorized. The encrypted multiple symmetric keys are arranged in sequence to form an authorized whitelist. The whitelist is attached to the ciphertext file ID and stored on the blockchain by the smart contract. The authorized user uses his own private key to decrypt the symmetric key, and uses the symmetric key K to decrypt the ciphertext file in the object storage to obtain the plaintext file.

[0068] As attached Figure 4 As shown, user A's encrypted file only wants to be visible to user B and user C. Assuming user B wants to decrypt the ciphertext file, user B uses his own private key to parse K2 to obtain the symmetric key K, and then uses K to decrypt the ciphertext file in the object storage to obtain the plaintext file.

[0069] Encrypted storage and whitelisting

[0070] The above two sections describe the basic principles of data encryption storage, but omit some details of authorized whitelist management. Regardless of whether the data is encrypted and stored on the chain or off-chain, there are two ways to manage the whitelist: on-chain smart contract management and off-chain business layer management.

[0071] On-chain smart contract management means managing the correspondence between authorized users and keys through smart contracts, and authorized users obtain their own encryption keys through smart contracts. Off-chain business layer management means managing the correspondence between users and keys at the off-chain business layer, and authorized users obtain their own encryption keys through off-chain business layer services.

[0072] After the authorized user obtains his own encryption key, he uses his own private key to decrypt the encryption key, and then uses the decryption result to decrypt the ciphertext, and finally obtains the target plaintext.

[0073] Encrypted storage and data resources

[0074] Data resources can be stored in plain text or cipher text. Encrypted storage is a secure way to store data resources. From the overall architecture, encrypted storage is located at the lower layer of data resources and provides storage services for data resources.

[0075] Virtual channel privacy protection

[0076] The present invention innovatively proposes the concept of "virtual channel" based on the FABRIC channel technology, which is a data isolation solution that is more sophisticated than the channel technology and more convenient than the FABRIC private data.

[0077] FABRIC channels and private data

[0078] Hyperledger FABRIC is a blockchain technology that supports multiple channels. Each channel has an independent ledger, each ledger has an independent genesis block, and only users on this channel can access the ledger of this channel. The channel isolates the propagation of blockchain network messages. Transactions are only propagated in the P2P network of a certain channel, and the channel will not receive messages from other channels. The channel realizes the isolation of data, realizes the privacy protection of different ledgers, and ensures the confidentiality of transactions to other business alliances.

[0079] Within the channel, FABRIC also supports another more sophisticated method of controlling the scope of transaction data dissemination, namely "private data". Transaction data in the channel is unencrypted by default and can be seen by channel members. However, private data is encrypted by default, and only authorized channel members can decrypt the data. In practice, only members with private PEER nodes can use private data, because a confidential place is needed to store the decrypted data. For blockchain, the number of users is far greater than the number of nodes. For example, the number of Bitcoin users is in the tens of millions, while the number of nodes is only more than 10,000. The way FABRIC uses private data greatly limits its scope of application.

[0080] Virtual Channel

[0081] Channels are a heavy data isolation solution because it is difficult to add new channels or add members to channels. The FABRIC private data solution also has its limitations, so a lighter and more convenient data isolation solution is needed. "Encrypted privacy protection" mentions the use of "encrypted storage + decryption whitelist" to protect user privacy data, and virtual channels are also implemented based on this basic principle.

[0082] As attached Figure 5 As shown in the figure, the virtual channel was originally proposed to solve the problem of data isolation and interconnection when distributors or raw material suppliers participate in multiple supply chain collaborations. If each supply chain sets up an independent FABRIC channel, the on-chain data of distributors or raw material suppliers participating in multiple different supply chains will be completely isolated by the channel and difficult to connect. If multiple supply chains are placed in the same FABRIC channel, the transaction data of multiple competitors in the industry will become visible to each other, causing companies to be afraid to move their businesses to the blockchain. FABRIC private data cannot effectively solve this problem, because many companies cannot operate and maintain private PEER nodes due to cost or lack of technical personnel, and the plaintext storage of private data depends on private PEER nodes.

[0083] Define multiple "virtual channels" in the channel, and add channel members to the virtual channel as needed. When doing private transactions, select the virtual channel, and the private transaction will automatically generate a decryption whitelist according to the virtual channel members. Establish an association between private transactions and virtual channels for subsequent management and statistics. New members joining the virtual channel or members leaving the virtual channel will not affect the private transactions that have already occurred.

[0084] In the order of channel, virtual channel, and private transaction, the visible scope of transaction data is gradually reduced. In practice, the privacy control method can be selected as needed according to the actual control needs of the visible scope of transaction data.

[0085] Processing credibility

[0086] Processing credibility refers to the correctness of data processing on the one hand, and the auditability and traceability of the processing process and results on the other hand. The former requires concurrent control of transactions, while the latter requires the system to save not only the final state of the data, but also the process of data processing. The correctness of data processing is a basic requirement for traditional data management systems, but traditional database management systems are centralized, and there are mature and relatively efficient technologies to maintain the ACID properties of transactions. Data management in peer-to-peer network environments mostly focuses on query processing performance. Although there have been a lot of studies on consensus mechanisms in distributed systems, in data management systems, due to performance issues, consensus mechanisms and cross-node coordination are usually only used to elect master nodes, and are rarely directly applied to transaction processing or are avoided as much as possible. Therefore, in a decentralized peer-to-peer network environment such as blockchain, how to achieve efficient transaction processing while ensuring correctness has become a prominent issue.

[0087] Smart Contracts

[0088] Smart contracts refer to automatically executable task contracts implemented by information technology, which contain execution conditions and execution logic. When the conditions are met, the execution logic will be automatically executed. From the perspective of data management, smart contracts are similar to triggers and stored procedures in data management systems. On the other hand, unlike transactions in traditional database management systems, not only the processing results of smart contracts need to be saved in the blockchain, but the smart contracts themselves also need to be saved in the blockchain and synchronized between the nodes of the system to ensure the consistency of the smart contracts seen by different nodes and users.

[0089] The Bitcoin blockchain only provides a very simple scripting language to implement smart contracts; Ethereum provides a Turing-complete smart contract scripting language; and FABRIC provides the ability to write smart contracts in GO and JAVA. Smart contracts expand the ability of blockchain to process data, but at the same time they also place higher demands on the security of its users and systems.

[0090] Data traceability

[0091] Data provenance is an important technology in data management and is widely used in scientific data management and data warehouses. However, many data provenance technologies are only applicable to centralized databases or distributed environments where nodes are trusted. In traditional database management systems, the current state of data is stored and maintained in the database, and the historical information of the processing process and data is usually stored in the database log, which is only used for fault recovery and does not directly provide query services. In a peer-to-peer network environment where nodes are untrusted, some queries and transactions need to verify the historical state of data when processing to ensure the correctness of the current state. Therefore, traditional data management technologies cannot be directly applied to the blockchain scenario.

[0092] As a trusted data management system, tracing the source of data on the blockchain is an important issue. Similar to database logs, the blockchain maintains records of all operations and processing on the blockchain, but the data query and analysis processing functions provided by the blockchain are relatively simple. How to efficiently handle data tracing queries when more and more data is managed by the blockchain platform after the introduction of more complex smart contracts is a problem faced by the development of blockchain technology and its promotion and use in more applications.

[0093] The query expression of data traceability has a strict algebraic basis and can be implemented on relational databases. Data traceability methods can be divided into two categories, namely annotation-based methods and non-annotation methods. Annotation-based methods transform each data item into<S,D,I> A triplet label, where S represents the source of the data item, D represents the target data (current data), and I represents the intermediate data result. By propagating labels during data processing, data connection is achieved to support data traceability. Annotation-based data traceability systems include DBNOTES and MONDRIAN. For non-annotation methods, there is no need to add additional information to the source data and target data (processing results) during data processing. However, at this time, it is necessary to understand what kind of processing is performed on the stored and maintained data. When the processing is reversible, the source data can be inferred from the target data.

[0094] The above description is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A trusted data source management method based on blockchain technology, characterized in that: Focus on storage credibility and processing credibility in database management systems, and use blockchain technology to achieve trusted management of data sources; Storage credibility is managed using encryption privacy protection and virtual channel privacy protection; Define several virtual channels within the channel and add channel members to the virtual channels as needed; When performing private transactions, select a virtual channel and automatically generate a decryption whitelist based on the virtual channel members. The credibility of the process is managed using smart contracts and data traceability.

2. The method according to claim 1, characterized in that Encrypted privacy protection, data encryption and blockchain transactions with whitelists can be divided into two types according to the storage location of encrypted data: on-chain data encrypted storage and off-chain data encrypted storage.

3. The method according to claim 2, characterized in that On-chain data encryption storage Using Hyperledger FABRIC, the data on its network is transmitted in plain text in JSON format. All nodes in the channel receive the plain text data through the GOSSIP point-to-point protocol and save it locally. The on-chain data encryption storage of the big data trading platform uses symmetric encryption algorithms in the contract code to encrypt and store the plain text data. Finally, the blockchain consensus mechanism packages the encrypted data into blocks to form a blockchain. Encryption principle: Generate a random number as the symmetric key K, encrypt the plaintext data with K to obtain the ciphertext data; The data is authorized to certain users. The public keys of these users are used to asymmetrically encrypt K to obtain KN. Several KNs are arranged in sequence to form an authorization whitelist. The ciphertext data and the whitelist are connected and stored together. Decryption principle: The authorized user uses his own private key to decrypt the key KN and obtains the symmetric key K; the authorized user uses the symmetric key K to decrypt the ciphertext data and obtain the plaintext data.

4. The method according to claim 2, characterized in that: Off-chain data encryption storage Off-chain data encryption storage implements data encryption through off-chain trusted and centralized services, and manages symmetric encryption keys through smart contracts. In smart contracts, the symmetric key is encrypted with the public key of the authorized user, and the result is recorded in the blockchain. The encryption and decryption process is as follows: Generate a random number K as the symmetric encryption key, encrypt the file, and store the ciphertext file in the object storage; perform hash calculation on the ciphertext file and obtain the hash value as the ID of the ciphertext file; The public keys of the users to whom the file is authorized are used to encrypt the key K. The encrypted symmetric keys are arranged in sequence to form an authorization whitelist. The whitelist is attached to the ciphertext file ID and stored on the blockchain by the smart contract. The authorized user uses his own private key to decrypt the symmetric key, and uses the symmetric key K to decrypt the ciphertext file in the object storage to obtain the plaintext file.

5. The method according to claim 2, characterized in that: There are two ways to manage the whitelist: on-chain smart contract management and off-chain business layer management On-chain smart contract management, that is, managing the correspondence between authorized users and keys through smart contracts, and authorized users obtain their own encryption keys through smart contracts; Off-chain business layer management, that is, managing the correspondence between users and keys at the off-chain business layer, and authorizing users to obtain their own encryption keys through off-chain business layer services; After the authorized user obtains his own encryption key, he uses his own private key to decrypt the encryption key, and then uses the decryption result to decrypt the ciphertext, and finally obtains the target plaintext.

6. The method according to claim 1, characterized in that The data source is stored in plain text or cipher text form. Encrypted storage is located at the lower layer of data resources and provides storage services for data resources.

7. The method according to claim 2, characterized in that Define several virtual channels in the channel, and add channel members to the virtual channels as needed; when doing private transactions, select the virtual channel, and the private transaction will automatically generate a decryption whitelist according to the virtual channel members; establish an association between private transactions and virtual channels; the addition of new members to the virtual channel or the withdrawal of members from the virtual channel will not affect the private transactions that have already occurred; The visible scope of transaction data gradually narrows in the order of channel, virtual channel, and private transaction; in practice, the privacy control method can be selected as needed according to the actual control needs of the visible scope of transaction data.

8. The method according to claim 2, characterized in that: Smart Contracts A smart contract refers to an automatically executable task contract implemented through information technology, which contains execution conditions and execution logic. When the conditions are met, the execution logic will be automatically executed. FABRIC provides the function of writing smart contracts in GO and JAVA. Smart contracts expand the ability of blockchain to process data.

9. The method according to claim 2, characterized in that: Data traceability Data provenance methods can be divided into two categories, namely, annotation-based methods and non-annotation methods; The annotation-based approach transforms each data item into<S,D,I> A triplet label, where S represents the source of the data item, D represents the target data, and I represents the intermediate data result; by propagating labels during data processing, data linkage is achieved to support data traceability; For non-annotation methods, no additional information is required to be added to the source and target data during data processing; At this point, you need to understand what kind of processing has been done on the stored and maintained data. When the processing is reversible, the source data can be obtained by inferring the target data.

Images