Data controllable circulation method and system

Abstract

The invention provides a data controllable circulation method and system, which are suitable for a data circulation system and cover a data portal, a proxy server, a memory and a block chain node. The method comprises the following steps: a data portal obtains user data, performs hash calculation to generate a data fingerprint, encrypts the data fingerprint into a data ciphertext, and uploads the data ciphertext to a proxy server; and the proxy server stores the data ciphertext and obtains a storage code, uploads the data fingerprint to the block chain node and obtains a transaction code. The data portal receives the subscription application, generates a re-encrypted key according to the public key of the subscriber, and sends the re-encrypted key to the proxy server; and the proxy server uploads a subscription application to the block chain, retrieves the data ciphertext from the memory, re-encrypts the data ciphertext with the re-encryption key, and sends the re-encrypted data ciphertext to the subscriber. And the subscriber decodes by using the private key to obtain the user data. According to the invention, the re-encryption technology is utilized to realize safe and controllable circulation of data.

Description

Technical Field

[0001] The present application relates to the field of data transfer, and in particular to a method and system for controllable data transfer. Background Art

[0002] With the rapid development of information technology and the deepening of digital transformation, data has become a core element of modern society and economic activities. However, in the process of data circulation, how to ensure the security, privacy and controllability of data has become an important issue that needs to be solved urgently. At present, the field of data circulation faces many challenges, such as data leakage, privacy infringement, illegal transactions, etc. These problems not only threaten personal privacy and corporate security, but also hinder the healthy development of the data circulation industry.

[0003] In order to solve the above problems, the industry has begun to explore the use of advanced technical means to achieve safe and controllable data circulation. As an emerging distributed accounting technology, blockchain technology provides a new solution for data circulation with its characteristics of decentralization, immutability and transparency. Through blockchain technology, every link of data circulation can be recorded to ensure the authenticity and integrity of data, while ensuring the legitimacy and fairness of rights and interests such as data holding rights, processing and use rights, and operating rights. Summary of the invention

[0004] The purpose of this application is to overcome the defects in the above-mentioned prior art and provide a method and system for controllable data flow.

[0005] The present application provides a controllable data flow method, characterized in that it is applied in a data flow system, wherein the data flow system includes a data portal, a proxy server, a storage device, and a blockchain node, and the method includes:

[0006] The data portal obtains user data of the user, performs hash calculation on the user data to generate a data fingerprint, and encrypts the user data to generate a data ciphertext;

[0007] The data portal uploads the data fingerprint and the data ciphertext to the proxy server;

[0008] The proxy server stores the data ciphertext in a memory and obtains a storage code, uploads the data fingerprint to a blockchain node and obtains a first transaction code;

[0009] The data portal obtains a subscription application from a subscriber, generates a re-encryption key according to a public key of the subscriber, and sends the re-encryption key and the subscription application to the proxy server;

[0010] The proxy server uploads the subscription application to the blockchain node to obtain a second transaction code;

[0011] The proxy server retrieves the data ciphertext from the memory, re-encrypts the data ciphertext using the re-encryption key, and sends it to the subscriber;

[0012] The subscriber uses its own private key to decode the data ciphertext to obtain the user data.

[0013] Optionally, it also includes:

[0014] The data portal obtains a data tracing request, constructs a query message through the data fingerprint after receiving the data tracing request, and uploads the query message to the proxy server;

[0015] The proxy server queries the traceability metadata from the blockchain node according to the query message, and returns the traceability metadata to the data portal.

[0016] Optionally, performing hash calculation on the user data to generate a data fingerprint includes:

[0017] SM3 is used for hash calculation to generate data fingerprint.

[0018] Optionally, before the proxy server stores the encrypted data in a memory and obtains a storage code, the method further includes:

[0019] An integrity check is performed on the data ciphertext.

[0020] Optionally, the data portal uploads the data fingerprint and the data ciphertext to the proxy server, including:

[0021] The blockchain nodes store the ciphertext data through a consensus mechanism.

[0022] Optionally, the proxy server retrieves the data ciphertext from the memory, and re-encrypts the data ciphertext using the re-encryption key, and the method further includes:

[0023] Sign the re-encrypted user data.

[0024] Optionally, the data transfer system includes an application layer, a data service layer and a blockchain layer;

[0025] The application layer includes the data portal;

[0026] The data service layer includes the memory and the proxy server;

[0027] The blockchain layer includes the blockchain node.

[0028] The present application also provides a data controllable circulation system for executing the steps of the above-mentioned data controllable circulation method, including: a data portal, a proxy server, a storage device and a blockchain node:

[0029] The data portal includes a plurality of user-side data portals and a plurality of subscriber-side data portals;

[0030] The data portal is connected to the proxy server;

[0031] The proxy server connects the storage device and the blockchain node;

[0032] The proxy server sends and receives data information and data ciphertext of the data portal and re-encrypts the data ciphertext;

[0033] The proxy server interacts with the storage and the blockchain node on the data information and the data ciphertext to complete data storage, subscription and tracing.

[0034] Optionally, the proxy server includes a data flow information uplink service module;

[0035] The data flow information chain service module is used to store data fingerprints, subscription applications, and data flow information on the chain, and receive the storage transaction number from the blockchain node.

[0036] Optionally, the proxy server includes a data re-encryption service module;

[0037] The data re-encryption service module is used to generate a re-encryption key according to the public key of the subscriber, and use the re-encryption key to re-encrypt the data ciphertext read from the memory to generate data re-encrypted ciphertext for the subscriber to decrypt using the private key.

[0038] Optionally, the blockchain node includes a consensus module;

[0039] The consensus module is used to reach consensus on data flow information and generate a transaction number for evidence storage.

[0040] Optionally, the blockchain node includes a traceability query module;

[0041] The traceability query module is used to construct query information based on the data fingerprint submitted by the user, send a traceability query message to the blockchain node, receive and verify the Merkle root constructed by the traceability metadata returned by the blockchain node, and finally return the traceability metadata to the user to achieve data traceability.

[0042] Optionally, the user's data portal includes: a data encryption module, which uses the user's public key to encrypt the data ciphertext and generate a data fingerprint.

[0043] Optionally, the data encryption module includes:

[0044] The regulator's agent re-encryption key is generated based on the regulator's public key, and the encrypted data, data fingerprint, evidence transaction number, data storage code and regulator's agent re-encryption key are stored to complete data release.

[0045] Optionally, the proxy server includes an access control module:

[0046] The access control module is used to control access rights to the data stored in the storage module according to a subscription request from the subscriber's data portal.

[0047] Optionally, the blockchain node includes a smart contract module:

[0048] The smart contract module is used to define the rules and processes for data storage, subscription and tracing.

[0049] The beneficial effects of this application are:

[0050] The present application provides a method for controllable data flow, characterized in that it is applied in a data flow system, the data flow system includes a data portal, a proxy server, a memory and a blockchain node, and the method includes: the data portal obtains the user data of the user party, performs hash calculation on the user data to generate a data fingerprint, and encrypts the user data to generate a data ciphertext; the data portal uploads the data fingerprint and the data ciphertext to the proxy server; the proxy server stores the data ciphertext in the memory and obtains a storage code, uploads the data fingerprint to the blockchain node and obtains a first transaction code; the data portal obtains the subscription application of the subscriber, generates a re-encryption key according to the public key of the subscriber, and sends the re-encryption key and the subscription application to the proxy server; the proxy server uploads the subscription application to the blockchain node to obtain a second transaction code; the proxy server retrieves the data ciphertext from the memory, re-encrypts the data ciphertext using the re-encryption key, and sends it to the subscriber; the subscriber uses its own private key to decode the data ciphertext to obtain the user data. The present application realizes the secure and controllable flow of data through re-encryption technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a schematic diagram of the controllable flow of data in this application;

[0052] Figure 2 This is a schematic diagram of data upload for controllable data flow in this application;

[0053] Figure 3This is a schematic diagram of the data controllable flow subscription process in this application;

[0054] Figure 4 This is a schematic diagram of the controllable data flow traceability process in this application;

[0055] Figure 5 Schematic diagram of the controllable data flow system in this application. DETAILED DESCRIPTION

[0056] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that various forms of implementing the present disclosure should not be limited by the embodiments set forth herein. On the contrary, the embodiments are provided to more thoroughly understand the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0057] The present application provides a controllable data flow method, which is applied in a data flow system, wherein the data flow system includes a data portal, a proxy server, a storage device and a blockchain node.

[0058] Please refer to Figures 1 to 3 As shown, the controllable data transfer method includes:

[0059] Data Release:

[0060] S101. The data portal obtains user data of a user, performs hash calculation on the user data to generate a data fingerprint, and encrypts the user data to generate a data ciphertext.

[0061] Users first need to upload the data to be published to the data portal. As the interface between users and the blockchain system, the data portal is responsible for receiving and processing the data submitted by users. During the upload process, the data portal should ensure the security of data transmission, such as encrypted transmission through the HTTPS protocol.

[0062] After receiving the data uploaded by the user, the data portal uses the user's public key to encrypt the data to ensure the confidentiality of the data. At the same time, the data portal also calculates the unique fingerprint (hash value) of the data through a hash algorithm (such as SM3) for subsequent data verification and traceability. Encryption ensures the security of data during transmission and storage, while hash calculation provides a means of verifying the integrity of the data.

[0063] S102: The data portal uploads the data fingerprint and the data ciphertext to the proxy server.

[0064] The encrypted data and its fingerprint are sent to the blockchain proxy service.

[0065] The blockchain proxy service acts as a bridge between data and the blockchain network, responsible for delivering data to other nodes in the blockchain network. Data should remain encrypted during transmission to prevent unauthorized access.

[0066] S103. The proxy server stores the data ciphertext in a memory and obtains a storage code, uploads the data fingerprint to a blockchain node and obtains a first transaction code.

[0067] The blockchain proxy service stores the received encrypted data in a reliable data storage service and generates a unique data storage code. This storage code is used for subsequent data retrieval and access.

[0068] The blockchain proxy service uploads the calculated data fingerprint as evidence information to the blockchain network. The immutability of the blockchain ensures the authenticity and credibility of the evidence information. The evidence information should be ensured to be secure and traceable on the blockchain through smart contracts or other blockchain technologies.

[0069] The nodes in the blockchain network conduct consensus verification on the uploaded evidence information to ensure its authenticity and validity. Once the verification is passed, the blockchain network will generate a data evidence transaction number and return it to the blockchain proxy service. The consensus mechanism ensures the authenticity and credibility of the evidence information, and the transaction number serves as the unique identifier of the evidence information.

[0070] The blockchain proxy service returns the received evidence transaction number and data storage code to the data portal. These data will be used for subsequent data management and access control.

[0071] To meet regulatory requirements, the data portal uses the regulator's public key to generate a proxy re-encryption key. This key allows the regulator to perform specific operations or access the data without decrypting the original data. Proxy re-encryption technology ensures that regulators can access and operate data while complying with privacy protection principles.

[0072] The data portal stores all the above key information (including data fingerprint, deposit transaction number, data storage code and supervisory agent re-encryption key) in a secure location to complete the data release process. This information will be used for subsequent data retrieval, access control and regulatory audit.

[0073] Data subscription:

[0074] S104. The data portal obtains a subscription application from the subscriber, generates a re-encryption key according to the public key of the subscriber, and sends the re-encryption key and the subscription application to the proxy server.

[0075] The subscriber (i.e., the subscribing user) submits a data subscription request to the data owner through the data portal or other designated channels. The request should include information such as the description, purpose, and period of use of the required data.

[0076] After receiving the subscription request, the data owner will review the request. The review content includes but is not limited to the identity authentication of the subscriber, the rationality of the data use, and the compliance of the usage period.

[0077] If the subscription request is approved, the data owner will use the subscriber's public key to generate a proxy re-encryption key. This key allows the data to be encrypted during transmission, but can only be decrypted when the subscriber uses its private key. The data owner then sends the subscription information (including data description, expiration date, proxy re-encryption key, etc.) to the blockchain proxy service.

[0078] S105. The proxy server uploads the subscription application to the blockchain node to obtain a second transaction code.

[0079] After receiving the subscription information, the blockchain proxy service uploads it to the blockchain network as evidence information. The immutability of the blockchain ensures the authenticity and credibility of the evidence information. The evidence information should be ensured to be secure and traceable on the blockchain through smart contracts or other blockchain technologies.

[0080] The nodes in the blockchain network conduct consensus verification on the uploaded evidence information to ensure its authenticity and validity. Once the verification is passed, the blockchain network will generate a transaction number and return it to the blockchain proxy service. This transaction number serves as the unique identifier of the evidence information. The consensus mechanism ensures the authenticity and credibility of the evidence information, and the transaction number serves as the unique identifier of the evidence information, facilitating subsequent data management and access control.

[0081] S106. The proxy server retrieves the data ciphertext from the memory, re-encrypts the data ciphertext using the re-encryption key, and sends the re-encrypted data to the subscriber.

[0082] The blockchain proxy service reads the corresponding data content from the data storage service according to the data storage code in the subscription information. The data storage code is a unique identifier generated when the data is stored and is used for subsequent data retrieval and access. The data storage service should have high availability and security to ensure the reliability and integrity of the data. At the same time, the blockchain proxy service should ensure the security of data transmission when reading data.

[0083] After the blockchain proxy node reads the data content, it re-encrypts the data using the previously generated proxy re-encryption key. In this way, the data will remain encrypted during transmission and can only be decrypted when the subscriber uses its private key. Proxy re-encryption technology ensures the security of data during transmission and prevents unauthorized access and leakage.

[0084] S107: The subscriber uses its own private key to decode the data ciphertext to obtain the user data.

[0085] The blockchain proxy node returns the transaction number and re-encrypted data to the subscriber. The transaction number is the unique identifier of the evidence information, which facilitates the subscriber to verify the authenticity and credibility of the data. During the data transmission process, the integrity and security of the transaction number and re-encrypted data should be ensured.

[0086] After receiving the transaction number and re-encrypted data, the subscriber uses its private key to decrypt the data. The decrypted data can be used by the subscriber for subsequent processing and analysis.

[0087] Please refer to Figure 4 As shown, it also includes data tracing process.

[0088] The data portal obtains a data tracing request, and after receiving the data tracing request, constructs a query message through the data fingerprint, and uploads the query message to the proxy server.

[0089] When a subscriber (or traceability user) needs to trace the history of a piece of data, he or she first constructs query information based on the known data fingerprint (a hash value that uniquely identifies the data). The data fingerprint is generated when the data is generated or first stored to ensure the uniqueness and integrity of the data.

[0090] The traceability user sends the constructed query information to the blockchain proxy service through a secure channel (such as HTTPS). The blockchain proxy service serves as the interface between the blockchain network and the user and is responsible for processing the user's query request.

[0091] The proxy server queries the traceability metadata from the blockchain node according to the query message, and returns the traceability metadata to the data portal.

[0092] After receiving the query information from the user, the blockchain proxy service parses the data fingerprint and sends a traceability query message to the node in the blockchain network. The blockchain node is the entity that stores the metadata of data evidence traceability.

[0093] After receiving the traceability query message, the blockchain node searches for the evidence traceability metadata associated with the data fingerprint in the local or distributed storage according to the data fingerprint. These metadata record the history of data generation, storage, transmission, processing and use. After finding, the blockchain node organizes multiple metadata according to the structure of the Merkle tree and calculates the Merkle root. The Merkle root is a short hash value that can uniquely represent the structure and content of the entire Merkle tree (that is, all metadata).

[0094] After receiving the Merkle root returned by the blockchain node, the blockchain proxy service first verifies its authenticity. The verification method can be consensus verification with other nodes in the blockchain network, or through other trusted mechanisms. After the verification is passed, the blockchain proxy service requests the complete traceability metadata from the blockchain node and returns this metadata to the traceability user.

[0095] After receiving the traceability metadata returned by the blockchain proxy service, the traceability user can parse the metadata to understand the complete history of the data. These metadata include information such as the data generation time, storage location, transmission path, processing process and final use.

[0096] Please refer to Figure 5 As shown, the present application provides a controllable data flow system, including: a data portal, a proxy server, a storage device and a blockchain node.

[0097] Data portal: includes a data encryption module, which is used to encrypt data using the user's public key and generate a unique data fingerprint. The encrypted data, data fingerprint, evidence transaction number (generated later), data storage code (the unique identifier of data in the storage), and the proxy re-encryption key generated for the regulator (if the regulator needs to access it) will be stored or sent to other components of the system.

[0098] It is also used to submit subscription requests, receive the re-encrypted ciphertext of data sent by the proxy server (data re-encrypted according to the subscriber's public key), and decrypt it using its own private key.

[0099] The proxy server includes a data flow information uplink service module, and the proxy server includes a data flow information uplink service module and an access control module.

[0100] Data flow information chain service module: responsible for storing data fingerprints, subscription information and other key information in the data flow process on the chain to ensure the information is tamper-proof and traceable. At the same time, the transaction number of the evidence is received from the blockchain node as the unique identifier of the data evidence.

[0101] Data re-encryption service module: Generates a proxy re-encryption key based on the public key of the subscriber (or subscribers), and uses the key to re-encrypt the data ciphertext read from the storage to generate data re-encrypted ciphertext. In this way, only the subscriber with the corresponding private key can decrypt and access the data.

[0102] Access control module: controls access rights to data stored in the storage according to the subscriber's subscription request and data flow rules, ensuring that data can only be accessed by authorized users or subscribers.

[0103] The blockchain node includes a consensus module, a traceability query module, and a smart contract module.

[0104] Consensus module: Consensus processing of data flow information to ensure the authenticity and consistency of information. The consensus process may involve the collaboration and verification of multiple blockchain nodes, and ultimately generate a transaction number for evidence storage.

[0105] Provenance query module: constructs query information based on the data fingerprint submitted by the user, and sends a traceability query message to the blockchain node. Receives and verifies the Merkle root (or other verification mechanism) constructed by the evidence traceability metadata returned by the blockchain node, and finally returns the complete traceability metadata to the user to achieve data traceability.

[0106] Smart contract module: defines the rules and processes for data storage, subscription and traceability. Smart contracts can automatically perform various operations in the data flow process, such as data storage, access control, data re-encryption, etc., thereby improving the automation and intelligence level of the system.

[0107] The memory is used to store encrypted data, data fingerprints, evidence transaction numbers, data storage codes, and other related data. The memory can be a distributed storage system to improve the reliability and availability of data.

[0108] A workflow of a data controllable flow system:

[0109] The user encrypts the data through the data encryption module of the data portal and generates a data fingerprint. The encrypted data, data fingerprint, evidence transaction number (subsequently generated by the proxy server and uploaded to the chain), data storage code and the supervisory agent re-encryption key (if necessary) are stored in the memory.

[0110] Subscribers submit subscription requests through the data portal to request access to specific data.

[0111] The data flow information chain service module of the proxy server stores key information such as data fingerprints and subscription information on the chain and receives the storage transaction number.

[0112] The access control module of the proxy server controls the access rights to the data stored in the memory according to the subscription request of the subscriber and the data flow rules.

[0113] The data re-encryption service module of the proxy server generates a proxy re-encryption key based on the subscriber's public key and re-encrypts the data ciphertext. The re-encrypted data ciphertext is sent to the subscriber's data portal.

[0114] The subscriber uses his own private key to decrypt the received data and obtain the original data.

[0115] When users or subscribers need to trace the source and flow of data, they can submit data fingerprints through the data portal. The traceability query module of the blockchain node constructs query information based on the data fingerprint and returns complete traceability metadata.

[0116] Although the present invention is disclosed as above by the embodiments, it is not intended to limit the protection scope of the present invention. Any changes and modifications made by any technician familiar with the technology without departing from the concept and scope of the present invention should fall within the protection scope of the present invention.

Claims

1. A method for controllable data transfer, characterized in that: Applied in a data flow system, the data flow system includes a data portal, a proxy server, a storage device and a blockchain node, and the method includes: The data portal obtains user data of the user, performs hash calculation on the user data to generate a data fingerprint, and encrypts the user data to generate a data ciphertext; The data portal uploads the data fingerprint and the data ciphertext to the proxy server; The proxy server stores the data ciphertext in a memory and obtains a storage code, uploads the data fingerprint to a blockchain node and obtains a first transaction code; The data portal obtains a subscription application from a subscriber, generates a re-encryption key according to a public key of the subscriber, and sends the re-encryption key and the subscription application to the proxy server; The proxy server uploads the subscription application to the blockchain node to obtain a second transaction code; The proxy server retrieves the data ciphertext from the memory, re-encrypts the data ciphertext using the re-encryption key, and sends it to the subscriber; The subscriber uses its own private key to decode the data ciphertext to obtain the user data.

2. A method for controllable data transfer according to claim 1, characterized in that: Also includes: The data portal obtains a data tracing request, constructs a query message through the data fingerprint after receiving the data tracing request, and uploads the query message to the proxy server; The proxy server queries the traceability metadata from the blockchain node according to the query message, and returns the traceability metadata to the data portal.

3. A method for controllable data transfer according to claim 1, characterized in that: Performing hash calculation on the user data to generate a data fingerprint includes: SM3 is used for hash calculation to generate data fingerprint.

4. A method for controllable data transfer according to claim 1, characterized in that: Before the proxy server stores the encrypted data in a memory and obtains a storage code, the method further includes: An integrity check is performed on the data ciphertext.

5. A method for controllable data transfer according to claim 1, characterized in that: The data portal uploads the data fingerprint and the data ciphertext to the proxy server, including: The blockchain nodes store the ciphertext data through a consensus mechanism.

6. A method for controllable data transfer according to claim 1, characterized in that: The proxy server retrieves the data ciphertext from the memory, and re-encrypts the data ciphertext using the re-encryption key, and the method further includes: Sign the re-encrypted user data.

7. A method for controllable data transfer according to claim 1, characterized in that: The data transfer system includes an application layer, a data service layer and a blockchain layer; The application layer includes the data portal; The data service layer includes the memory and the proxy server; The blockchain layer includes the blockchain node.

8. A data controllable circulation system, characterized in that: The steps for executing the method for controllable data transfer described in any one of claims 1 to 7 above include: a data portal, a proxy server, a storage device and a blockchain node: The data portal includes a plurality of user-side data portals and a plurality of subscriber-side data portals; The data portal is connected to the proxy server; The proxy server connects the storage device and the blockchain node; The proxy server sends and receives data information and data ciphertext of the data portal and re-encrypts the data ciphertext; The proxy server interacts with the storage and the blockchain node on the data information and the data ciphertext to complete data storage, subscription and tracing.

9. A data controllable circulation system according to claim 8, characterized in that: The proxy server includes a data flow information uplink service module; The data flow information chain service module is used to store data fingerprints, subscription applications, and data flow information on the chain, and receive the storage transaction number from the blockchain node.

10. A controllable data transfer system according to claim 8, characterized in that: The proxy server includes a data re-encryption service module; The data re-encryption service module is used to generate a re-encryption key according to the public key of the subscriber, and use the re-encryption key to re-encrypt the data ciphertext read from the memory to generate data re-encrypted ciphertext for the subscriber to decrypt using the private key.

11. A data controllable circulation system according to claim 10, characterized in that: The blockchain node includes a consensus module; The consensus module is used to reach consensus on data flow information and generate a transaction number for evidence storage.

12. A controllable data transfer system according to claim 8, characterized in that: The blockchain node includes a traceability query module; The traceability query module is used to construct query information based on the data fingerprint submitted by the user, send a traceability query message to the blockchain node, receive and verify the Merkle root constructed by the traceability metadata returned by the blockchain node, and finally return the traceability metadata to the user to achieve data traceability.

13. A data controllable circulation system according to claim 8, characterized in that: The user's data portal includes: a data encryption module, which uses the user's public key to encrypt the data ciphertext and generate a data fingerprint.

14. A data controllable circulation system according to claim 13, characterized in that: The data encryption module comprises: The regulator's agent re-encryption key is generated based on the regulator's public key, and the encrypted data, data fingerprint, evidence transaction number, data storage code and regulator's agent re-encryption key are stored to complete data release.

15. A controllable data transfer system according to claim 8, characterized in that: The proxy server includes an access control module: The access control module is used to control access rights to the data stored in the storage module according to a subscription request from the subscriber's data portal.

16. A data controllable circulation system according to claim 8, characterized in that: The blockchain node includes a smart contract module: The smart contract module is used to define the rules and processes for data storage, subscription and tracing.

Images