Data trusted computing framework based on alliance block chain

Abstract

The invention provides a data trusted computing framework based on an alliance block chain. An entity comprises a data demander, a data provider, a consensus node and a certificate authority; the structure is divided into a data registration layer, a data trusted layer, a data consensus layer, a data processing layer and a data delivery layer. The data registration layer adopts a data architecture normal form based on an alliance block chain to divide data into identifiers, feature data and data entities so as to standardize a data registration process, provide a unified access mode for heterogeneous, heterogenous and heterogenous data resources and integrate the data resources; the data trusted layer uses a data trusted computing mechanism, so that a data provider provides a data resource analysis processing result for a data demander on the premise that the data demander does not contact original data; the data consensus layer comprises a data credible traceability mechanism to ensure the security and integrity of data flow; according to the invention, a traditional data escrow / exchange as-a-service mode can be converted into a data processing as-a-service mode, so that'availability and invisibility 'of data is realized.

Description

Technical Field

[0001] The present invention relates to the field of big data computing technology, and in particular to a data trusted computing framework based on alliance blockchain. Background Art

[0002] With the advent of the big data era, how to achieve secure and reliable data computing on the open, dynamic, and uncontrollable Internet has become an urgent problem to be solved. At present, most centralized data trading platforms are based on the Data-as-a-Service (DaaS) model, where the original data is stored on a third-party data trading platform, and the data buyer obtains the seller's entire original data set through the third-party platform. Figure 1 As shown in , it usually consists of three parties, namely: data providers, traditional data platforms (i.e., certain middlemen) and data demanders. Specifically, the data provider sends the data set to a trusted data exchange platform and sets an appropriate sales price. The data demander will select the data products of interest and place an order online, similar to an online supermarket. After receiving the payment from the data demander, the traditional data platform will transmit the purchased data to the data demander and pay the payment to the data provider (after deducting the management fee or commission). The data demander usually obtains the entire data set from the traditional data platform. However, the data demander may only need the results of data analysis to provide information for data-driven decision-making, rather than access to the complete data set. For example, the data demander does not need to access the data provider's entire turnover data for a certain year and quarter, but may only need a summary of certain statistical data of the turnover data for that quarter. Moreover, if the entire data set is transmitted to the data demander, once the data supervision is weak, there will be risks of false data and malicious collection and resale of user data resources by the platform. In addition, it is very difficult to detect whether the user data has been tampered with or resold by the platform, and to balance the issue of responsibility and power allocation in the data sharing process.

[0003] Blockchain technology, with its decentralized and tamper-proof characteristics, provides a technical approach to building a trusted data computing mechanism. At the same time, blockchain can clarify the ownership of data resources, including data ownership and privacy protection rights, so that data providers have the motivation to become a member of the blockchain network. However, traditional public chains such as Bitcoin and Ethereum have the defects of low throughput and poor privacy, which limits their application in the big data market, which has also gradually attracted attention to the development of alliance chains. As a representative of enterprise-level alliance chains, Hyperledger Fabric has a highly modular and configurable architecture, which well meets the business needs of current big data scenarios.

[0004] Current research focuses on using alliance chains to build data computing platforms without third-party intervention, aiming to enable data resources to circulate efficiently between various data platforms and systems. At the same time, data computing participants jointly build a unified trust system to protect the privacy of participants while ensuring the data provider's control over the data. However, due to the highly redundant storage method of blockchain, as the number of blockchain nodes increases, the number of data copies and storage costs will increase simultaneously, which will cause huge waste of storage resources and intolerable performance degradation in actual application scenarios. In view of the on-chain storage pressure and system throughput considerations, some scholars have optimized the storage of on-chain data in off-chain warehouse systems by combining new standardized protocols such as IPFS and DOIP, so as to better realize the interconnection and interoperability of heterogeneous, heterogeneous, and heterogeneous data.

[0005] However, the above solutions still have certain limitations. Existing research generally focuses on how to ensure the integrity and security of data delivery / transmission, ignoring the protection of the ownership of the original data of the data provider, and does not consider the regulatory measures after the data demander obtains the data. If the dishonest data demander resells the data resources required for calculation, it will greatly affect the interests of the data provider and the motivation to share data.

[0006] To this end, the present invention proposes a data trusted computing framework based on alliance blockchain. First, a data architecture paradigm based on alliance blockchain is defined, which divides data into three parts: identification, feature data, and data entity to standardize the data registration process, providing a unified access method for heterogeneous, heterogeneous, and heterogeneous data resources, and efficiently integrating data resources; at the same time, a data trusted computing mechanism is designed, which transforms data hosting / exchange as a service into data processing as a service, that is, the data provider does not host the original data to a third party for data demanders to use for data analysis, but provides the data demanders with the results of data resource analysis and processing without touching the original data, so as to achieve the "available but invisible" data, so as to cope with the trust challenges in the data computing process. In addition, the present invention designs a data trusted traceability mechanism, which ensures the security and integrity of data flow between data demanders, computing nodes, and data providers by leaving traces on the data computing process chain. Summary of the invention

[0007] The present invention proposes a data trusted computing framework based on alliance blockchain, which transforms the traditional data hosting / exchange as a service model into a data processing as a service model, that is, the data provider does not host the original data to a third party for use by the data demander, but provides the data demander with the results of data resource analysis and processing without the data demander having access to the original data, thereby achieving the "available but invisible" data. It not only avoids the leakage of the original data of the data provider, but also does not affect the data demander's acquisition of data analysis results, reshapes the trust relationship between the two parties in the data computing process, and can alleviate the many problems that are inevitable in traditional data computing platforms, such as data barriers, data loss of control, and data rights confirmation.

[0008] The present invention adopts the following technical solutions.

[0009] A data trusted computing framework based on alliance blockchain. The entities of the data trusted computing framework DTCF (DataTrusted Computing Framework, DTCF) include data demanders, data providers, consensus nodes, and certificate authorities; Figure 2 As shown in the figure, the structure of the computing framework is divided into data registration layer, data trust layer, data consensus layer, data processing layer, and data delivery layer.

[0010] The data registration layer adopts a data architecture paradigm based on the alliance blockchain, dividing data into identification, feature data, and data entities to standardize the data registration process, providing a unified access method for heterogeneous, heterogeneous, and heterogeneous data resources, and efficiently integrating data resources;

[0011] The data trust layer uses a data trust computing mechanism to enable data providers to provide data resource analysis and processing results to data demanders without having access to the original data.

[0012] The data consensus layer includes a data trusted traceability mechanism, which ensures the security and integrity of data flow between data demanders, computing nodes, and data providers by leaving traces of the data calculation process on the chain.

[0013] The data computing process of the data trusted computing framework includes the following steps:

[0014] Step S1: The data provider converts the data resources according to the data architecture paradigm and registers them on the chain;

[0015] Step S2: The data demander discovers data through the registry query module, finds the data provider of interest and the appropriate computing node to match the demand, and then sends a data request with purchase pricing information to the alliance chain network;

[0016] Step S3: The consortium chain network sends the request to the corresponding computing node. The computing node encapsulates the data request to obtain data resources from the data provider, and then performs data analysis and processing locally. Only the execution result will be sent to the data demander, not the original data.

[0017] Step S4: The computing nodes that meet the computing requirements store the data computing result signatures of the data computing participants in the alliance chain network of the data trusted computing framework;

[0018] Step S5: Automatically pay the payment through the smart contract module; conduct a satisfaction evaluation on this data calculation process.

[0019] The data registration layer is responsible for converting data architecture rules and standardizing registration processes for heterogeneous data resources.

[0020] The data trust layer is used to ensure the security and trustworthiness of the data transmission process and record the hash summary of the calculation result data to prevent tampering;

[0021] The data consensus layer is used to ensure the consensus of the distributed ledger data on the chain, and the data processing layer is responsible for the process control of the data calculation process;

[0022] The data delivery layer is used to support the trusted delivery and evaluation of the final data processing results.

[0023] Set DP i For data providers, DR i For data demanders, CN i For computing nodes, The status information of the computing node, For data resources, UID i It is the unique identifier of the data resource, UI i The identifier of the data resource, CD i Characteristic data of data resources, DE i Data entity, CBDAO for data resources i For data schema objects, UUID i is the unique identifier of the data calculation process, RC is the registry contract, DEMC is the data request management contract, RISC is the result information storage contract, DEMC is the data evaluation management contract, SK i For private key, PK i For public key, Cert i For digital certificates, K i is a symmetric key, Sig() is a short signature function, dataProof i is the data calculation record, ω is the satisfaction evaluation index;

[0024] Data providers: Data providers are individual users or organizations that own data resources. They access this framework through FabricSDK, publish their data resources, and sell processed data resources to suitable data providers through demand matching.

[0025] Data demanders, that is, potential customers of data resources, access the framework through the Fabric SDK and perform data discovery on all nodes in the network by querying the registry to match the appropriate data provider to meet data computing needs;

[0026] Computing node CN: A device or node used to meet the computing needs in different data technology scenarios, which is assumed to be secure and reliable and able to correctly and independently perform related computing tasks.

[0027] Consensus nodes: Consensus nodes are composed of all nodes that join the data trusted computing framework, jointly maintaining the consensus of the distributed ledger data on the chain to ensure the security and consistency of the alliance chain network;

[0028] The data trusted computing framework uses a certificate authority CA: an authoritative and trusted certification authority that is responsible for authorizing data computing participants who access the framework and issuing exclusive public-private key pairs. Data computing participants will use these keys to verify their identities and encrypt data during communications in the consortium chain network.

[0029] In step S1, the Consortium Blockchain-based Data Architecture (CBDA) is used to provide a unified way to persistently identify, describe, locate and manage heterogeneous data resources. In the CBDA conversion rules, the registered data provider DP j Data resources Divided into identification, feature data, and data entity; the identification UI i It is an identification description of data resources, which is used to persistently and uniquely identify each data resource. It is described using the following definition 1:

[0030] Definition 1. UI i It is a data resource The identification part in CBDA is represented by the following four-tuple:

[0031]

[0032] Where UID i It is a data resource The unique identifier, tStamp is the generated timestamp, PK j Is the data provider DP j The public key, SK j Is the data provider DPj The private key of the data provider, M is the encrypted string customized by the data provider, Sig() is the short signature function, Is the data provider DP j Using its private key SK j Signature information of string M;

[0033] Characteristic data CD i It is the metadata information of data resources, which is used to retrieve and discover corresponding data resources. Its specific meaning is shown in the following definition 2:

[0034] Definition 2.CD i It is a data resource The feature data part in CBDA, namely metadata, is represented as the following four-tuple:

[0035]

[0036] Meta i It is a data resource metadata, Is the data provider DP j Using its private key SK j Data Resources UID i Signature information, apiInfo i It is a data resource Calling interface information;

[0037] Data Entity DE i It is a mapping of data resources processed by the registry storage module of the on-chain registry contract RC, rather than the original data, as shown in the following definition 3:

[0038] Definition 3.DE i It is a data resource The data entity part in CBDA is represented by the following five-tuple:

[0039]

[0040] Among them, AD i Representing data resources The access address of the data resource, dl indicates the effective deadline of the data resource, AS is the status flag indicating whether the data resource is available, K DTSP represents the proposed symmetric key, is the symmetric key K DTSP Data Resources Signature information of the access address;

[0041] Data Architecture Object CBDAO iIt is the formatted storage form of the data resources in the proposed framework. Its specific meaning is shown in the following definition 4:

[0042] Definition 4. CBDAO i It is a data resource The representation on the chain after conversion by CBDA rules is represented as the following triple:

[0043] CBDAO i =(UI i , CD i ,DE i ) #(4)

[0044] UI i , CD i ,DE i Data resources The identification, characteristic data, and data entity parts after conversion according to CBDA rules.

[0045] The CBDA data conversion process is as follows: The proposed framework assigns a UI of definition 1 to each data resource i , as the unique identifier of its corresponding CBDA object; at the same time, construct the CD of Definition 2 i , and use preset mapping functions and UI i One-to-one correspondence; finally, the data entity DE of definition 3 is encapsulated in a standardized format i , and provide an interface for receiving data requests;

[0046] When the data provider is ready to release its data resources, the data resources are standardized and registered according to the above data conversion process; the data registration process adopts Algorithm 1.

[0047] Algorithm 1 is expressed in pseudo code as follows:

[0048]

[0049] The initialization parameters and functional functions required in Algorithm 1 are as follows:

[0050] registerCheck is used to identify whether the data registration requirements are met, verifyId() function is used to verify the authentication information of the role identity, decrypt() function is used for decryption operation, matchStyle() function is used to verify the compliance of the data resource format, DataHashList i Collection record data resources The data hash value generated by all calculation operations, the dataCheck() function is used to verify whether it is a duplicate registration, and the register() function is used to register CBDAO iRegister on the chain, the update() function is used to update the status of the distributed ledger on the chain, registerProol is a data resource The final registration credentials on the chain are obtained through the getInfo() function;

[0051] The data registration process is as follows: First, the registry contract RC verifies the role identity through the VerifyId() function and the decrypt() function and parses the data architecture object CBDAO to be registered i Then use the matchStyle() function and dataCheck() function to check the data format and whether it is duplicated. If the above conditions are met, CBDAO i Register and return the credential information for this data registration.

[0052] The DTCF data calculation process includes the following security features:

[0053] Identity authentication: Identity authentication means that the key identity information of the data demander should not be forged by malicious participants, so as to skip the authentication and authorization of the alliance chain network to perform illegal data calculations. The privacy and security of the alliance chain network must be guaranteed;

[0054] Data autonomy: whether data is shared should be completely controlled by the data provider, that is, the data provider can decide whether to share its data resources; data security and integrity: the data provider's data is encrypted during sharing, and no one except the computing node can access the requested original data resources; the data integrity during the data calculation process is protected, that is, the data should not be tampered with during the data calculation process; security against dishonest data providers: dishonest data providers are those who provide invalid data that is not related to the established data request, or send additional data to obtain more benefits; the data trusted computing framework can identify and resist dishonest data providers;

[0055] Security against dishonest computing nodes: Dishonest computing nodes falsify data requests to obtain data resources from data providers, or data nodes that do not process data according to predetermined requirements. The data trusted computing framework can strictly monitor this phenomenon, ensure the interests of data computing participants, and avoid theft by the insiders.

[0056] Security for dishonest data demanders: Dishonest data demanders send false data requests to data providers in order to forge the identity information of other participants, or deny and refuse to pay for completed data calculation requests. The data trusted computing framework can store key data calculation records or take reliable security measures to protect the interests and reputation of data providers.

[0057] The functions of the smart contract module of the Data Trusted Computing Framework DTCF include data registration, demand matching, data calculation, and satisfaction evaluation, which are presented in the form of a registration table contract RC, a data request management contract DRMC, a result information storage contract RISC, and a data evaluation management contract DEMC, respectively. Specifically:

[0058] RC: RC stores and manages all data resources registered on the chain through the registry storage module, providing a unified access method for data resources from different sources; at the same time, RC's registry query module provides a query interface for data demanders to match appropriate data resources.

[0059] DRMC: The request information storage module of DRMC is responsible for storing and managing all data requests in the data calculation process: including data calculation requests initiated by data demanders, data calculation requests processed by the proposed framework, and data acquisition requests initiated by computing nodes; the prepayment storage module of DRMC requires data demanders to pre-deposit payments to pay data providers and computing nodes after matching the demand. RISC: RISC stores and manages key evidence information in the data calculation process through the data calculation evidence information storage module, including the data response information of the data provider and the trusted credentials of the final data calculation results on the computing node chain; the result matching module counts the data analysis and processing results of the computing nodes, and the one with the most identical results is the final result; the payment module is responsible for issuing payments to the transaction addresses of data providers and computing nodes based on the final consistent result data.

[0060] DEMC: DEMC stores the identity information of all data computing participants through the user information storage module; the evaluation storage module is used to store the data demander's satisfaction evaluation of the data provider and computing node after each data computing process; the evaluation query module can help the data demander better select the appropriate data provider and computing node for subsequent demand matching.

[0061] In step S2, the data discovery method is as follows: in the data trusted computing framework, the data demander initiates a query request to the registry contract RC of the alliance chain by constructing query parameters. The registry contract RC processes the request and returns the query result to the data demander. This method is based on the query function of the blockchain, such as Figure 5 A data query parameter includes a query keyword description, the public key information of the data requester, and the identification information of the data requester, which is expressed as Request=<Request_Keyinfo,Pk,Uid)> The data query result includes a complete query result information in JSON format, a timestamp, the public key information of the data requester, and the identification information of the data requester, which is expressed as Reply=<Reply_info,Pk,Uid)> The triplet of .

[0062] In step S2, the method of demand matching is specifically as follows: dividing the user registration information into two parts: user private information and user public information; as the unique identity proof of the data calculation participant, the following Definitions 11 to 12 are used to describe it:

[0063] Definition 11. User private information δS k It is the private identity information returned by the data computing participant after registration, which is specifically represented by the following seven-tuple:

[0064]

[0065] Among them, U i is the user identity, tStamp indicates the user's registration time, M indicates the random string typed by the user, which is used to encrypt and generate the identity key, PK k and SK k Indicates the public-private key pair generated by the CA for the user, Role k Indicates the user's identity status information. Represents the user's contract account address;

[0066] Definition 12. User public information δP k It is the public identity information of the data computing participants that is stored on the chain after registration, and is specifically represented by the following four-tuple:

[0067]

[0068] Among them, δP k is the user's private information δS k A desensitized version of the , hiding the relevant confidential identity information;

[0069] Data demand side DR k When matching demand, the complete demand matching process is as follows: Data demander DR A Obtain the user identity information of Definition 11 through the registration procedure provided by the proposed framework The alliance chain network defines 12 user public information Synchronize to the on-chain data evaluation management contract DEMC; after successful registration, the data demander DR k After accessing the consortium chain network through the proxy client, data discovery is performed through the RC registry query module to find the required data resources Definition 4 of the on-chain information DCAO i In addition, data demanders also need to select appropriate computing nodes and deploy data analysis codes to execute and process data resources. The evaluation criteria are based on the evaluation information recorded by the data evaluation management contract DEMC, so as to select the appropriate data provider and computing node; the demander can also further query the evidence records of specific data computing processes on the alliance chain to verify the authenticity of its information; once the two parties of the data computing reach an agreement on the data computing service and payment, the data demander DR k The advance payment is sent to the result information storage contract RISC, and deployed on the selected computing node in the form of an executable binary file and signed for anti-counterfeiting.

[0070] In step S3, assume that the data demander DR k Get data provider DP j Data resources The selected computing node is CN l , then the data calculation process is described by the following Definitions 5 to 10;

[0071] Definition 5. The calling process Train_Process of the data processing code is the deployment parameter of the computing node selected by the data demander, which is expressed as the following six-tuple:

[0072]

[0073] Among them, tStamp indicates the deployment time of the data processing code, Desc indicates the calling process description of the data processing code, checksum indicates the hash checksum of the data processing code, and prePay indicates the prepayment of the data calculation process;

[0074] Definition 6. Data processing code Process_Code can perform data analysis and processing on the calculated data to meet the data computing needs of the data demander, which is specifically expressed as the following four-tuple:

[0075] Process_Code=(PType,PMod,PDoc,PFunc)#(6)

[0076] Among them, PType is the data processing code type, PMod is the structured module of the data processing code, PDoc is the technical documentation of the data processing code, and PFunc is the functional division of the data processing code.

[0077] Definition 7. Data computing request information Train_Request is a data computing request initiated by the data demander after demand matching, expressed as the following four-tuple:

[0078]

[0079] Among them, tStamp is the initiation time of the data computing request, and the computing node selected by the demand matching is expressed as Any nodeInfo is represented as nodeInfo=(UUID i , nodeParameters), where nodeName represents the computing node identification name, nodeParameters represents the computing power parameters of the computing node; Train_Info represents the parameter information of the data resource selected by the demand matching;

[0080] Definition 8. Data computing parameter information Train_Info is the specific computing parameter information sent to the selected computing node. It can identify the identities of both parties in the data computing process and locate the required data resources. It is represented as the following six-tuple:

[0081]

[0082] The location information of the data resource is represented as Any dataInfo is represented as dataInfo=(UUID i , dataName, dataParameter, where dataName represents the name of the data resource, dataParameters represents the location parameters of the method address of the data resource, and dataProcess represents the calling process parameters of the data resource; Desc is the plain text description information of the data resource, and dl represents the effective deadline of the data calculation request;

[0083] Definition 9. Data acquisition request information Data_Request is a request from a computing node to a data provider for data resources required for data computing, specifically expressed as the following seven-tuple:

[0084]

[0085] Among them, tStamp indicates the initiation time of the data acquisition request, and Desc indicates the basic description information of the data acquisition request. Indicates an encrypted data computing request signed by the data demander;

[0086] Definition 10. Data evaluation information Train_Evaluation is the evaluation information and execution information of the data demander on the data provider and the computing nodes participating in this process after each data calculation, expressed as the following five-tuple:

[0087]

[0088] Among them, tStamp is the initiation time of data evaluation, ω DS Indicates the satisfaction evaluation information of the data demander on the data provider, ω nodeIndicates the satisfaction evaluation information of the data demander on the computing node. It is the hash value of the encrypted result data with the signature of the computing node;

[0089] In step S3, Figure 6 The detailed workflow of data calculation is shown, using<PK,SK> To represent the public and private key pairs of the data computing participants, the collection of computing node individuals is represented as CN B =CN B1 ,...CN Bi ,...,CN Bn , i∈n, the following computing nodes are CN B In general, Sig() represents a short signature function; the specific steps are as follows:

[0090] Step A1: Data demander DR A After matching the requirements, use its private key SK A After encrypting the data request Traom_Request for this data calculation, the encrypted value is obtained Send to the data request management contract DRMC;

[0091] Step A2: The alliance chain network receives the encrypted data calculation request After that, verify whether it is registered, using its public key PK A Parse the data calculation parameter information Train_Info (Definition 8) and identify the computing node CN selected for this data calculation B , and on this basis further construct the parameters of the data calculation request The tuple includes the following: the first part is the parsed data calculation parameter information Train_Info, and the second part is the DB with data demander obtained in step A1. A Signed encrypted request Then send it to all selected computing nodes CN in this data calculation process B ;

[0092] Step A3: Calculate the node CN B Find the data provider DP participating in this data calculation based on Train_Info C The address message is constructed and encrypted, and the request Data_Request in the data acquisition definition 9 is obtained. Sent to the corresponding data provider DP C ;

[0093] Step A4: Data provider DP C Obtain data demander DR from the alliance chain network A and computing node CNB The public key PK A ,PK B And decrypt and verify Verify and confirm the data demander's DR A and computing node CN B After obtaining the identity of the user, the data acquisition request Data_Request is obtained, and the specific data resource Train_Data requested is located according to dataInfo. After that, the data response is further constructed on this basis. The binary includes the following: The first part is the encrypted data resource The second part is the encrypted data resource hash value

[0094] Step A5: Calculate the node CN B Use a registered data provider DP C The public key PK C And its own private key SK B Verify and decrypt Parse and obtain the data resource Train_Data and the anti-counterfeiting hash value Train_dataHash of the data resource;

[0095] Step A6: Calculate the node CN B After verifying the data resource Train_Data, use the pre-deployed data processing code to analyze and process the result data Train_Result, and use the data demander DR A The public key PK A Encrypt to get PK A (Train_Result) and its anti-counterfeiting hash summary

[0096] Step A7: Calculate the node CN B Using SK B The encrypted data result PK obtained in step 6 A (Train_Result) is signed and obtained And return it to the data demander DB through remote procedure call A ;

[0097] Step A8: To ensure the transparency and traceability of the data calculation process, the calculation node CN B Return the data processing results to the data demander DR A At the same time, it is necessary to construct the data calculation trusted certificate Train_Proof; Train_Proof consists of four parts, including the calculation node CN B The calling process of the signed data processing code Contains computing nodes CN B Signature data processing result hash value Contains data demander CR A Signature calculation request A data acquisition request containing the signatures of all participants in this data calculation Afterwards, the calculation node CN B Train_Proof is published to the consortium chain network in the form of a transaction, and the hash value of the data calculation result is stored in DataHashList i In the result information storage contract RISC will verify the validity of the result and send it to the correct computing node CN B and data provider DP C Payments are issued to the transaction account of the data participant; if data participants have disputes over the data calculation process, they can resolve the disputes through the trusted certificates of data calculation on the chain;

[0098] Step A9: Data demander DR A After completing this data calculation, a satisfaction evaluation is conducted, and the data evaluation information Train_Evaluation (Definition 10) is submitted to the data evaluation management contract DEMC in the form of a transaction for on-chain evidence storage.

[0099] In step S5, the hash value of the data processing result is used as the only basis for data calculation satisfaction evaluation to avoid multiple invalid abnormal evaluations by malicious data demanders;

[0100] During evaluation, matchCheck is used to indicate whether the evaluation requirements are met. The check() function is used to detect the execution status of all computing nodes in the current data calculation process to indicate whether the task has been completed. The evaluate() function evaluates the current data calculation based on the satisfaction evaluation index ω, as shown in the following definition 13:

[0101] Definition 13. The satisfaction evaluation index ω is the comprehensive evaluation score of the data providers and computing nodes involved in data calculation, expressed as the following triple:

[0102] ω=(Accuracy,Score,Efficiency)#(13)

[0103] Among them, Accuracy is the accuracy evaluation score of the data results, Score is the subjective evaluation score of the data demander on this data calculation, and Efficiency is the evaluation score of the time consumption of data delivery. For a data calculation, in order to avoid the data demander making unrealistic malicious evaluations, the satisfaction evaluation index is within a controllable range, that is, ω i =(Accuracyi , Score i , Efficiency i )∈((-ξ,ξ),(-ξ,ξ),(-ξ,ξ)),ξ is the threshold to prevent malicious data demanders from making abnormal evaluations; the satisfaction evaluation process is described in Algorithm 2, specifically: the data evaluation management contract DEMC first uses the verifyId() function to check the data provider's identifier and public key to verify whether its identity meets the requirements of data evaluation, and then checks whether all computing nodes have been executed. If the above conditions are met at the same time, the analysis() function will parse the hash value of the result data and save it in DataHashList i If the match is successful, the evaluate() function can be used to evaluate the satisfaction. The data demander will objectively evaluate the data calculation process based on the satisfaction evaluation index ω in Definition 13. After the evaluation, the data will be i Delete the hash value record of this data to ensure the accuracy and uniqueness of the evaluation.

[0104] The satisfaction evaluation part of Algorithm 2 is expressed in pseudo code as follows:

[0105]

[0106] The data trusted computing framework includes a trusted data traceability mechanism based on the alliance blockchain. It designs and builds a proposed traceability mechanism through the Hyperledger Fabric basic framework to control the entire process of data computing, aiming to support the characteristics of auditable data use, traceable data sources, and accountable data computing.

[0107] The result information storage contract RISC corresponding to the data traceability mechanism is responsible for persistently storing the records of the entire data calculation process. At the same time, through the dual protection of timestamp and key signature, it ensures that the data calculation process is transparent and traceable. The initial parameters and functions used to implement the requirements are set through Algorithm 2; among them, recordCheck is used to identify whether the requirements for calculation record storage are met, Sig j (dataProof i ) is a data resource The data calculation credential information, the analysis() function is used to parse and extract the corresponding calculated data hash value in the credential information, and the isExist() function is used to verify the uniqueness of the data hash value.

[0108] The data tracing process is described in Algorithm 2. The result information storage contract DISC verifies the identity information of the depositor through the verifyId() function and the matchStyle() function and examines the format of the calculation result record to be stored. After that, the result information storage contract RISC will use the analysis() function and isExist() function to parse out the Sig j (dataProof i ) corresponds to the data hash value dataHash i And check whether it is a duplicate certificate. If it is the first time to store the certificate, add the DTCF signature to the certificate information and store it in DataHashList i Finally, the update() function is used to write this data calculation record and return the certificate information of the successful storage of the data calculation record;

[0109] The data tracing part of Algorithm 2 is expressed in pseudo code as follows:

[0110]

[0111] The security strategy of the data trusted computing framework is as follows:

[0112] 1) Identity authentication: When a data computing participant User accesses the alliance chain network, identity authentication is required. The CA generates a private public key pair {PK user , S.K. user} and digital certificate Cert user To access the alliance chain network, all registered participants’ user public information δP user Will be stored in the alliance chain network, user private information δS user The participants themselves keep the data; only authorized participants can obtain access to resources in the Hyperledger Fabric network, thus maintaining the security and privacy of the alliance chain;

[0113] 2) Data autonomy: Data provider DP obtains encrypted data based on the request sent by computing node CN. The specific data calculation parameter information in the data determines whether to respond to the data acquisition request, which greatly avoids unfair and unreasonable data calculation tasks; Different from the traditional data exchange / hosting as a service model, by building a data trusted computing mechanism, the computing node CN needs to correctly forward the encrypted request of the data demander DR Only then can data resources be obtained, so that other data demanders DR and computing nodes CN have no right to bypass the data provider to perform data calculations. At the same time, data analysis and processing operations are performed on the computing node CN, and only the hash value of the final result data is uploaded. The data demander DR cannot obtain the original data.

[0114] 3) Data security and integrity: To ensure the security of the data delivery process, the original data resources will be computed using the public key PK of the node CN. CN and the private key SK of the data provider DP DP Encryption is performed to ensure that other participants cannot obtain the plain text of the data; at the same time, the flow of data resources always relies on digital signatures and hash summary technology to ensure that every step of data calculation has clear records and evidence, which is ultimately reflected through the data calculation trusted certificate Train_Proof, thereby realizing the monitoring and management of the entire data calculation process, and thus ensuring the integrity of the calculation result data;

[0115] 4) Security against dishonest data providers: Dishonest data providers Dp may provide irrelevant data or even fail to deliver data. The data provider DP needs to sign the original data and its hash summary to confirm the responsibility. and And construct data response In response to the data acquisition request; the data demander DR verifies the authenticity of the acquired data resources based on this hash summary to prevent the data provider from denying or repudiating when a dispute arises; in addition, when matching the demand, the data demander DR obtains the relevant evaluation information ω of the data provider DP from the data evaluation management contract DEMC for further screening;

[0116] 5) Security against dishonest computing nodes: Dishonest computing nodes CN may forge data requests Data_Request to obtain data resources from data providers DP. Data providers DP can use the data request management contract DRMC to identify whether the request is an abnormal request. Only when the request matches the signature of the data demander DR and proves that it is indeed initiated by the corresponding data demander DR, the data provider DP will deliver the data resources to the computing node CN to prevent the computing node CN from maliciously obtaining data resources. In order to prevent the computing node CN from not processing data according to the predetermined requirements to save computing power and still obtain the expected benefits, the computing node CN must upload the data calculation trusted certificate Train_Proof to the chain after delivering the data processing results to obtain the expected reward. The certificate contains the signature value of the computing node CN on the hash summary of the result data If a computing node CN commits a crime, it can be traced and punished, which effectively prevents the computing node CN from stealing from the public.

[0117] 6) Security against dishonest data demanders: Dishonest data demanders DR may not only forge their identities to send false data calculation requests, but may also deny and repudiate data calculations. When the consortium chain network processes a request, it will use the public key PK of the data demander DR to DR Identity authentication is carried out to effectively prevent identity forgery. At the same time, in order to protect the reputation and interests of the data provider DP, the result information storage contract RISC in the alliance chain network will record the trusted credential information Train_Proof signed by all participants in each data calculation, and provide data traceability function to the outside world, thereby reducing the potential risk of denial and repudiation by dishonest data demanders DR during the data calculation process.

[0118] The present invention proposes a data trusted computing solution based on alliance blockchain. First, a data architecture paradigm based on alliance blockchain is defined, which divides the data into three parts: identification, description data, and data entity to standardize the data registration process, and provides a unified access method for heterogeneous, heterogeneous and heterogeneous data resources, so as to efficiently integrate data resources.

[0119] Secondly, the present invention designs a data trusted computing mechanism, which realizes the "availability and invisibility" of data by transforming data hosting / exchange as a service into data processing as a service, so as to cope with the trust challenges in the data computing process.

[0120] Finally, the present invention designs a data trusted traceability mechanism, which ensures the security and integrity of data flow between data demanders, computing nodes and data providers by leaving traces on the data calculation process chain.

[0121] The present invention transforms the traditional data hosting / exchange as a service model into a data processing as a service model, that is, the data provider does not host the original data to a third party for use by the data demander, but provides the data demander with the results of data resource analysis and processing without the data demander having access to the original data, thereby achieving the "available but invisible" data. This not only avoids the leakage of the original data of the data provider, but also does not affect the data demander's acquisition of data analysis results, reshapes the trust relationship between the two parties in the data calculation process, and can alleviate the many problems that are inevitable in traditional data calculation platforms, such as data barriers, data loss of control, and data rights confirmation.

[0122] The present invention proposes a data trusted computing framework based on alliance blockchain. First, a data architecture paradigm based on alliance blockchain is defined, and data is divided into three parts: identification, feature data, and data entity to standardize the data registration process, providing a unified access method for heterogeneous, heterogeneous, and heterogeneous data resources, and efficiently integrating data resources; at the same time, a data trusted computing mechanism is designed, which transforms data hosting / exchange as a service into data processing as a service, that is, the data provider does not host the original data to a third party for data demanders to use for data analysis, but provides the data demanders with the results of data resource analysis and processing without touching the original data, so as to achieve the "available but invisible" data, so as to cope with the trust challenges in the data computing process. In addition, the present invention designs a data trusted traceability mechanism, which ensures the security and integrity of data flow between data demanders, computing nodes, and data providers by leaving traces on the data computing process chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0123] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0124] Attached Figure 1 This is a schematic diagram of the data hosting transaction model under traditional technology;

[0125] Attached Figure 2 It is a schematic diagram of an overview of the data trusted computing framework of the present invention;

[0126] Attached Figure 3 It is a schematic diagram of the data conversion model of the present invention (taking the medical device industry standard information data set as an example);

[0127] Attached Figure 4 It is a schematic diagram of the module design of the smart contract in the present invention;

[0128] Attached Figure 5 It is a schematic diagram of the principle of data discovery of the present invention;

[0129] Attached Figure 6 It is a schematic diagram of the flow of data trusted computing of the present invention;

[0130] Attached Figure 7 It is a schematic diagram of the results of the performance test of the method of the present invention;

[0131] Attached Figure 8 It is another schematic diagram of the results of the performance test of the method of the present invention. DETAILED DESCRIPTION

[0132] As shown in the figure, in this example, the data trusted computing framework is based on the Go language, and the alliance chain network is built based on the Hyperledger Fabric v2.3 framework. Three machines are used to simulate the data demander, data provider and computing node respectively to simulate the real data computing scenario. The network configuration includes 3 Order nodes and 3 Org organizations. Each Org is configured with 4 Peer nodes. The Raft consensus mechanism is used between nodes, and all smart contracts required by the proposed framework are deployed on all Peer nodes, including the registry contract (RC), data request management contract (DRMC), result information storage contract (RISC) and data evaluation management contract (DEMC). The detailed configuration of the equipment and the required test tools are shown in Table 2-Table 3.

[0133]

[0134] Table 2 Detailed equipment configuration

[0135]

[0136] Table 3 Test tools

[0137] The proposed framework's smart contracts are stress-tested on read and write performance by simulating 20-500 virtual client agents. Caliper, a performance benchmark tool developed by Hyperledger Foundation, and Fabric-Nodejs-SDK, an interactive tool, are used. The average execution time of the proposed smart contract is tested by generating 10 transaction requests per second. The performance stress test is divided into 5 rounds, and the number of concurrent virtual clients is gradually increased from 20 to 500 in each round. Figure 7-8 As shown in the figure, as the system throughput gradually increases, the time consumption of read and write operations will also gradually increase, and will eventually stabilize within an acceptable fluctuation range.

[0138] The data trusted computing framework in this example allows different data providers to register data, and allows different data computing demanders to discover data and find corresponding data providers and computing nodes; the main accomplishment of the present invention is to design a data architecture paradigm based on the alliance blockchain, divide the data into three parts: identification, description data, and data entity, and realize the standardized registration of metadata information on the blockchain.

[0139] The data computing process includes three key steps: demand matching, data computing, and satisfaction evaluation. First, in the demand matching stage, the data computing demander can discover data through the registry supported by the proposed data architecture to find the corresponding data provider and computing node. Second, through the proposed data computing process, the data computing demander can receive and parse the output results of the trusted processing of data computing. Finally, the data computing demander can evaluate and provide feedback on this data computing process through the satisfaction evaluation mechanism.

[0140] The data trusted traceability mechanism can persistently store records of the entire data calculation process through smart contracts, and at the same time ensure that the data calculation process is transparent and traceable through the dual protection of timestamps and key signatures.

Claims

1. A data trusted computing framework based on alliance blockchain, characterized by: The entities of the data trusted computing framework DTCF include data demanders, data providers, consensus nodes, and certificate authorities; the structure of the computing framework is divided into data registration layer, data trusted layer, data consensus layer, data processing layer, and data delivery layer. The data registration layer adopts a data architecture paradigm based on the alliance blockchain, divides data into identification, feature data, and data entities to standardize the data registration process, provide a unified access method for heterogeneous, heterogeneous, and heterogeneous data resources, and integrate data resources; The data trust layer uses a data trust computing mechanism to enable data providers to provide data resource analysis and processing results to data demanders without having access to the original data. The data consensus layer includes a data trusted traceability mechanism, which ensures the security and integrity of data flow between data demanders, computing nodes, and data providers by leaving traces of the data calculation process on the chain.

2. According to claim 1, a data trusted computing framework based on alliance blockchain is characterized in that: The data computing process of the data trusted computing framework includes the following steps: Step S1: The data provider converts the data resources according to the data architecture paradigm and registers them on the chain; Step S2: The data demander discovers data through the registry query module, finds the data provider of interest and the appropriate computing node to match the demand, and then sends a data request with purchase pricing information to the alliance chain network; Step S3: The consortium chain network sends the request to the corresponding computing node. The computing node encapsulates the data request to obtain data resources from the data provider, and then performs data analysis and processing locally. Only the execution result will be sent to the data demander, not the original data. Step S4: The computing nodes that meet the computing requirements store the data computing result signatures of the data computing participants in the alliance chain network of the data trusted computing framework; Step S5: Automatically pay the payment through the smart contract module; conduct a satisfaction evaluation on this data calculation process.

3. According to claim 2, a data trusted computing framework based on alliance blockchain is characterized in that: The data registration layer is responsible for converting data architecture rules and standardizing registration processes for heterogeneous data resources. The data trust layer is used to ensure the security and reliability of the data transmission process, and record the hash summary of the calculation result data to prevent tampering; the data consensus layer is used to ensure the consensus of the distributed ledger data on the chain, and the data processing layer is responsible for the process control of the data calculation process; The data delivery layer is used to support the trusted delivery and evaluation of the final data processing results.

4. According to claim 3, a data trusted computing framework based on alliance blockchain is characterized in that: Set DP i For data providers, DR i For data demanders, CN i For computing nodes, The status information of the computing node, For data resources, UID i It is the unique identifier of the data resource, UI i The identifier of the data resource, CD i Characteristic data of data resources, DE i Data entity, CBDAO for data resources i For data schema objects, UUID i is the unique identifier of the data calculation process, RC is the registry contract, DRMC is the data request management contract, RISC is the result information storage contract, DEMC is the data evaluation management contract, SK i For private key, PK i For public key, Cert i For digital certificates, K i is a symmetric key, Sig() is a short signature function, dataProof i is the data calculation record, ω is the satisfaction evaluation index; Data providers: Data providers are individual users or organizations that own data resources. They access the framework through Fabric SDK and publish their data resources. They match demand and sell processed data resources to appropriate data providers. Data demanders, that is, potential customers of data resources, access the framework through the Fabric SDK and perform data discovery on all nodes in the network by querying the registry to match the appropriate data provider to meet data computing needs; Computing node CN: A device or node used to meet the computing needs in different data technology scenarios, which is assumed to be secure and reliable and able to correctly and independently perform related computing tasks. Consensus nodes: Consensus nodes are composed of all nodes that join the data trusted computing framework, jointly maintaining the consensus of the distributed ledger data on the chain to ensure the security and consistency of the alliance chain network; The data trusted computing framework uses a certificate authority CA: an authoritative and trusted certification authority that is responsible for authorizing data computing participants who access the framework and issuing exclusive public-private key pairs. Data computing participants will use these keys to verify their identities and encrypt data during communications in the consortium chain network.

5. According to claim 4, a data trusted computing framework based on alliance blockchain is characterized in that: In step S1, the data architecture paradigm CBDA is used to provide a unified way to persistently identify, describe, locate and manage heterogeneous data resources from different sources, domains and structures. In the CBDA conversion rule, the registered data provider DP j Data resources Divided into identification, feature data, and data entity; the identification UI i It is an identification description of data resources, which is used to persistently and uniquely identify each data resource. It is described using the following definition 1: Definition 1. UI i It is a data resource The identification part in CBDA is represented by the following four-tuple: Where UID i It is a data resource The unique identifier, tStamp is the generated timestamp, PK j Is the data provider DP j The public key, SK j Is the data provider DP j The private key of the data provider, M is the encrypted string customized by the data provider, Sig() is the short signature function, Is the data provider DP j Using its private key SK j Signature information of string M; Characteristic data CD i It is the metadata information of data resources, which is used to retrieve and discover corresponding data resources. Its specific meaning is shown in the following definition 2: Definition 2.CD i It is a data resource The feature data part in CBDA, namely metadata, is represented as the following four-tuple: Meta i It is a data resource metadata, Is the data provider DP j Using its private key SK j Data Resources UID i Signature information, apiInfo i It is a data resource Calling interface information; Data Entity DE i It is a mapping of data resources processed by the registry storage module of the on-chain registry contract RC, rather than the original data, as shown in the following definition 3: Definition 3.DE i It is a data resource The data entity part in CBDA is represented by the following five-tuple: Among them, AD i Representing data resources The access address of the data resource, dl indicates the effective deadline of the data resource, AS is the status flag indicating whether the data resource is available, K DTSP represents the proposed symmetric key, is the symmetric key K DTSP Data Resources Signature information of the access address; Data Architecture Object CBDAO i It is the formatted storage form of the data resources in the proposed framework. Its specific meaning is shown in the following definition 4: Definition 4. CBDAO i It is a data resource The representation on the chain after conversion by CBDA rules is represented as the following triple: CBDAO i =(UI i ,CD i ,THE i ) #(4) UI i , CD i ,DE i Data resources The identification, characteristic data, and data entity parts after conversion according to CBDA rules. The CBDA data conversion process is as follows: The proposed framework assigns a UI of definition 1 to each data resource i , as the unique identifier of its corresponding CBDA object; at the same time, construct the CD of Definition 2 i , and use preset mapping functions and UI i One-to-one correspondence; finally, the data entity DE of definition 3 is encapsulated in a standardized format i , and provide an interface for receiving data requests; When the data provider is ready to release its data resources, the data resources are standardized and registered according to the above data conversion process; the data registration process adopts Algorithm 1. The initialization parameters and functional functions required in Algorithm 1 are as follows: registerCheck is used to identify whether the data registration requirements are met, the werifyId() function is used to verify the authentication information of the role identity, the decrypt() function is used for decryption operations, the matchStyle() function is used to verify the compliance of the data resource format, and the DataHashList i Collection record data resources The data hash value generated by all calculation operations, the dataChech() function is used to verify whether it is a duplicate registration, and the register() function is used to register CBDAO i Register on the chain, the update() function is used to update the status of the distributed ledger on the chain, registerProoi is a data resource The final registration credentials on the chain are obtained through the getInfo() function; The data registration process is as follows: First, the registry contract RC verifies the role identity through the verifyId() function and the decrypt() function and parses the data architecture object CBDAO to be registered i Then use the matchStyle() function and dataCheck() function to check the data format and whether it is duplicated. If the above conditions are met, CBDAO i Register and return the credential information for this data registration.

6. According to claim 4, a data trusted computing framework based on alliance blockchain is characterized in that: The DTCF data calculation process includes the following security features: Identity authentication: Identity authentication means that the key identity information of the data demander should not be forged by malicious participants, so as to skip the authentication and authorization of the alliance chain network to perform illegal data calculations. The privacy and security of the alliance chain network must be guaranteed; Data autonomy: Whether data is shared should be completely controlled by the data provider, that is, the data provider can decide whether to share its data resources; Data security and integrity: The data provider's data is encrypted during sharing, and no one except the computing node can access the requested original data resources; The integrity of data during data calculation is protected, that is, data should not be tampered with during data calculation; security against dishonest data providers: dishonest data providers are those who provide invalid data that is irrelevant to the established data request, or send additional data to obtain more benefits; The data trust computing framework can identify and resist dishonest data providers; Security against dishonest computing nodes: Dishonest computing nodes falsify data requests to obtain data resources from data providers, or data nodes that do not process data according to predetermined requirements. The data trusted computing framework can strictly monitor this phenomenon, ensure the interests of data computing participants, and avoid theft by the insiders. Security for dishonest data demanders: Dishonest data demanders send false data requests to data providers in order to forge the identity information of other participants, or deny and refuse to pay for completed data calculation requests. The data trusted computing framework can store key data calculation records or take reliable security measures to protect the interests and reputation of data providers. The functions of the smart contract module of the Data Trusted Computing Framework DTCF include data registration, demand matching, data calculation, and satisfaction evaluation, which are presented in the form of a registration table contract RC, a data request management contract DRMC, a result information storage contract RISC, and a data evaluation management contract DEMC, respectively. Specifically: RC: RC stores and manages all data resources registered on the chain through the registry storage module, providing a unified access method for data resources from different sources; at the same time, RC's registry query module provides a query interface for data demanders to match appropriate data resources. DRMC: The request information storage module of DRMC is responsible for storing and managing all data requests in the data computing process: including data computing requests initiated by data demanders, data computing requests processed by the proposed framework, and data acquisition requests initiated by computing nodes; DRMC's prepayment storage module requires data demanders to pre-deposit payments to pay data providers and computing nodes after demand matching. RISC: RISC stores and manages key evidence information in the data calculation process through the data calculation evidence information storage module, including the data response information of the data provider and the trusted credentials of the final data calculation results on the computing node chain; the result matching module counts the data analysis and processing results of the computing nodes, and the one with the most identical results is the final result; The payment module is responsible for issuing payments to the transaction addresses of data providers and computing nodes based on the final consistent result data. DE MC: DEMC stores the identity information of all data computing participants through the user information storage module; The evaluation storage module is used to store the data demander's satisfaction evaluation of the data provider and computing node after each data calculation process; the evaluation query module can help the data demander better select appropriate data providers and computing nodes for subsequent demand matching.

7. According to claim 5, a data trusted computing framework based on alliance blockchain is characterized in that: In step S2, the data discovery method is specifically as follows: in the data trusted computing framework, the data demander initiates a query request to the registry contract RC of the alliance chain by constructing a query parameter. The registry contract RC processes the request and returns the query result to the data demander. This method is based on the query function of the blockchain. A data query parameter includes a query keyword description, the public key information of the data demander, and the identification information of the data demander, which is expressed as Request =<Request_Keyinfo,Pk,Uid)> The data query result includes a complete query result information in JSON format, a timestamp, the public key information of the data requester, and the identification information of the data requester, which is expressed as Reply=<Reply_info,Pk,Uid)> The triplet of . In step S2, the method of demand matching is specifically as follows: dividing the user registration information into two parts: user private information and user public information; as the unique identity proof of the data calculation participant, the following Definitions 11 to 12 are used to describe it: Definition 11. User private information δS k It is the private identity information returned by the data computing participant after registration, which is specifically represented by the following seven-tuple: Among them, U i is the user identity, tStamp indicates the user's registration time, M indicates the random string typed by the user, which is used to encrypt and generate the identity key, PK k and SK k Indicates the public-private key pair generated by the CA for the user, Role k Indicates the user's identity status information. Indicates the user's contract account address; Definition 12. User public information δP k It is the public identity information of the data computing participants that is stored on the chain after registration, and is specifically represented by the following four-tuple: Among them, δP k is the user's private information δS k A desensitized version of the , hiding the relevant confidential identity information; Data demand side DR k When matching demand, the complete demand matching process is as follows: Data demander DR A Obtain the user identity information of Definition 11 through the registration procedure provided by the proposed framework The alliance chain network defines 12 user public information Synchronize to the on-chain data evaluation management contract DEMC; after successful registration, the data demander DR k After accessing the consortium chain network through the proxy client, data discovery is performed through the RC registry query module to find the required data resources Definition 4 of the on-chain information DCAO i In addition, data demanders also need to select appropriate computing nodes and deploy data analysis codes to execute and process data resources. The evaluation criteria are based on the evaluation information recorded by the data evaluation management contract DEMC, so as to select the appropriate data provider and computing node; the demander can also further query the evidence records of specific data computing processes on the alliance chain to verify the authenticity of its information; once the two parties of the data computing reach an agreement on the data computing service and payment, the data demander DR k The advance payment is sent to the result information storage contract RISC, and deployed on the selected computing node in the form of an executable binary file and signed for anti-counterfeiting.

8. According to claim 7, a data trusted computing framework based on alliance blockchain is characterized in that: In step S3, assume that the data demander DR k Get data provider DP j Data resources The selected computing node is CN l , then the data calculation process is described by the following Definitions 5 to 10; Definition 5. The calling process Train_Process of the data processing code is the deployment parameter of the computing node selected by the data demander, which is expressed as the following six-tuple: Among them, tStamp indicates the deployment time of the data processing code, Desc indicates the calling process description of the data processing code, checksum indicates the hash checksum of the data processing code, and prePay indicates the prepayment of the data calculation process; Definition 6. Data processing code Process_Code can perform data analysis and processing on the calculated data to meet the data computing needs of the data demander, which is specifically expressed as the following four-tuple: Process_Code=(PType,PMod,PDoc,PFunc)#(6) Among them, PType is the data processing code type, PMod is the structured module of the data processing code, PDoc is the technical documentation of the data processing code, and PFunc is the functional division of the data processing code. Definition 7. Data computing request information Train_Request is a data computing request initiated by the data demander after demand matching, expressed as the following four-tuple: Among them, tStamp is the initiation time of the data computing request, and the computing node selected by the demand matching is expressed as Any nodeInfo is represented as nodeInfo=(UUID i , nodeParameters), where nodeName represents the computing node identification name, nodeParameters represents the computing power parameters of the computing node; Train_Info represents the parameter information of the data resource selected by the demand matching; Definition 8. Data computing parameter information Train_Info is the specific computing parameter information sent to the selected computing node. It can identify the identities of both parties in the data computing process and locate the required data resources. It is represented as the following six-tuple: The location information of the data resource is represented as Any dataInfo is represented as dataInfo=(UUID i , data Name, data Parameters, dataProcess), where Data Name represents the name of the data resource, Data Parameters represents the location parameters of the method address of the data resource, and dataProcess represents the calling process parameters of the data resource; Desc is the plain text description information of the data resource, and dl represents the effective deadline of the data computing request; Definition 9. Data acquisition request information Data_Request is a request from the computing node to the data provider for the data resources required for data computing, specifically expressed as the following seven-tuple: Among them, tStamp indicates the initiation time of the data acquisition request, and Desc indicates the basic description information of the data acquisition request. Indicates an encrypted data computing request signed by the data demander; Definition 10. Data evaluation information Train_Evaluation is the evaluation information and execution information of the data demander on the data provider and the computing nodes participating in this process after each data calculation, expressed as the following five-tuple: Among them, tStamp is the initiation time of data evaluation, ω DS Indicates the satisfaction evaluation information of the data demander on the data provider, ω node Indicates the satisfaction evaluation information of the data demander on the computing node. It is the hash value of the encrypted result data with the signature of the computing node; In step S3, the detailed workflow of data calculation is as follows:<PK,SK> To represent the public and private key pairs of the data computing participants, the collection of computing node individuals is represented as CN B =CN B1 ,...CN Bi ,...,CN Bn , i∈n, the following computing nodes are CN B In general, Sig() represents a short signature function; the specific steps are as follows: Step A1: Data demander DR A After matching the requirements, use its private key SK A After encrypting the data request Traom_Request for this data calculation, the encrypted value is obtained Send to the data request management contract DRMC; Step A2: The alliance chain network receives the encrypted data calculation request After that, verify whether it is registered, using its public key PK A Parse the data calculation parameter information Train_Info (Definition 8) and identify the calculation node CN selected for this data calculation B , and on this basis further construct the parameters of the data calculation request The binary group includes the following contents: the first part is the data calculation parameter information Train_Info obtained from the analysis, and the second part is the DB with data demander obtained in step A1. A Signed encrypted request Then send it to all selected computing nodes CN in this data calculation process B ; Step A3: Calculate the node CN B Find the data provider DP participating in this data calculation based on Train_Info C The address message is constructed and encrypted, and the request Data_Request in the data acquisition definition 9 is obtained. Sent to the corresponding data provider DP C ; Step A4: Data provider DP C Obtain data demander DR from the alliance chain network A and computing node CN B The public key PK A ,PK B And decrypt and verify Verify and confirm the data demander's DR A and computing node CN B After obtaining the identity of the data acquisition request Data_Request, and locating the specific data resource Trian_Data requested according to dataInfo. Then, further construct the data response based on this The binary includes the following: The first part is the encrypted data resource The second part is the encrypted data resource hash value Step A5: Calculate the node CN B Use a registered data provider DP C The public key PK C And its own private key SK B Verify and decrypt Parse and obtain the data resource Train_Data and the anti-counterfeiting hash value Train_dataHash of the data resource; Step A6: Calculate the node CN B After verifying the data resource Train_Data, use the pre-deployed data processing code to analyze and process the result data Train_Result, and use the data demander DR A The public key PK A Encrypt to get PK A (Train_Result) and its anti-counterfeiting hash summary Step A7: Calculate the node CN B Using SK B The encrypted data result PK obtained in step 6 A (Train_Result) is signed and obtained And return it to the data demander DB through remote procedure call A ; Step A8: To ensure the transparency and traceability of the data calculation process, the calculation node CN B Return the data processing results to the data demander DR A At the same time, it is necessary to construct the data calculation trusted certificate Train_Proof; Train_Proof consists of four parts, including the calculation node CN B The calling process of the signed data processing code Contains compute node CN B Signature data processing result hash value Including data demand side DR A Signature calculation request A data acquisition request containing the signatures of all participants in this data calculation Afterwards, the calculation node CN B Train_Proof is published to the consortium chain network in the form of a transaction, and the hash value of the data calculation result is stored in DataHashList i In the result information storage contract RISC will verify the validity of the result and send it to the correct computing node CN B and data provider DP C Payments are issued to the transaction account of the data participant; if data participants have disputes over the data calculation process, they can resolve the disputes through the trusted certificates of data calculation on the chain; Step A9: Data demander DR A After completing this data calculation, a satisfaction evaluation is conducted, and the data evaluation information Train_Evaluation defined in 10 is submitted to the data evaluation management contract DEMC in the form of a transaction for on-chain evidence storage.

9. A data trusted computing framework based on alliance blockchain according to claim 8, characterized in that: In step S5, the hash value of the data processing result is used as the only basis for data calculation satisfaction evaluation to avoid multiple invalid abnormal evaluations by malicious data demanders; During evaluation, matchCheck is used to indicate whether the evaluation requirements are met. The check() function is used to detect the execution status of all computing nodes in the current data calculation process to indicate whether the task has been completed. The evaluate() function evaluates the current data calculation based on the satisfaction evaluation index ω, as shown in the following definition 13: Definition 13. The satisfaction evaluation index ω is the comprehensive evaluation score of the data providers and computing nodes involved in data calculation, expressed as the following triple: ω=(Accuracy, Score, Efficiency) #(13) Among them, Accuracy is the accuracy evaluation score of the data results, Score is the subjective evaluation score of the data demander on this data calculation, and Efficiency is the evaluation score of the time consumption of data delivery. For a data calculation, in order to avoid the data demander making unrealistic malicious evaluations, the satisfaction evaluation index is within a controllable range, that is, ω i =(Accuracy i , Score i , Efficiency i )∈((-ξ,ξ),(-ξ,ξ),(-ξ,ξ)),ξ is the threshold to prevent malicious data demanders from making abnormal evaluations; The satisfaction evaluation process is described in Algorithm 2, specifically: the data evaluation management contract DEMC first uses the verifyId() function to check the data provider's ID and public key to verify whether its identity meets the requirements of data evaluation, and then checks whether all computing nodes have been executed. If the above conditions are met at the same time, the analysis() function will parse the hash value of the result data and store it in DataHashList i If the match is successful, the evaluate() function can be used to evaluate the satisfaction. The data demander will objectively evaluate the data calculation process based on the satisfaction evaluation index ω in Definition 13. After the evaluation, the data will be i Delete the hash value record of this data to ensure the accuracy and uniqueness of the evaluation.

10. A data trusted computing framework based on alliance blockchain according to claim 8, characterized in that: The data trusted computing framework includes a trusted data traceability mechanism based on the alliance blockchain. It designs and builds a proposed traceability mechanism through the Hyperledger Fabric basic framework to control the entire process of data computing, aiming to support the characteristics of auditable data use, traceable data sources, and accountable data computing. The result information storage contract RISC corresponding to the data traceability mechanism is responsible for persistently storing the records of the entire data calculation process. At the same time, through the dual protection of timestamp and key signature, it ensures that the data calculation process is transparent and traceable. The initial parameters and functions used to implement the requirements are set through Algorithm 2; among them, recordCheck is used to identify whether the requirements for calculation record storage are met, Sig j (dataProof i ) is a data resource The data calculation credential information, the analysis() function is used to parse and extract the corresponding calculated data hash value in the credential information, and the isExist() function is used to verify the uniqueness of the data hash value. The data tracing process is described in Algorithm 2. The result information storage contract RISC verifies the identity information of the depositor through the verifyId() function and the matchStyle() function and examines the format of the calculation result record to be stored. After that, the result information storage contract RISC will use the analysis() function and isExist() function to parse out the Sig j (dataProof i ) corresponds to the data hash value dataHash i And check whether it is a duplicate certificate. If it is the first time to store the certificate, add the DTCF signature to the certificate information and store it in DataHashList i Finally, the update() function is used to write this data calculation record and return the certificate information of the successful storage of the data calculation record; The security strategy of the data trusted computing framework is as follows: 1) Identity authentication: When a data computing participant User accesses the alliance chain network, identity authentication is required. The CA generates a private public key pair {PK user , S.K. user } and digital certificate Cert user To access the alliance chain network, all registered participants’ user public information δP user Will be stored in the alliance chain network, user private information δS user The participants themselves keep the data; only authorized participants can obtain access to resources in the Hyperledger Fabric network, thus maintaining the security and privacy of the alliance chain; 2) Data autonomy: Data provider DP obtains encrypted data based on the request sent by computing node CN. The specific data calculation parameter information in the data determines whether to respond to the data acquisition request, which greatly avoids unfair and unreasonable data calculation tasks; Different from the traditional data exchange / hosting as a service model, by building a data trusted computing mechanism, the computing node CN needs to correctly forward the encrypted request of the data demander DR Only then can data resources be obtained, so that other data demanders DR and computing nodes CN have no right to bypass the data provider to perform data calculations. At the same time, data analysis and processing operations are performed on the computing node CN, and only the hash value of the final result data is uploaded. The data demander DR cannot obtain the original data. 3) Data security and integrity: To ensure the security of the data delivery process, the original data resources will be computed using the public key PK of the node CN. CN and the private key SK of the data provider DP DP Encryption is performed to ensure that other participants cannot obtain the plain text of the data; at the same time, the flow of data resources always relies on digital signatures and hash summary technology to ensure that every step of data calculation has clear records and evidence, which is ultimately reflected through the data calculation trusted certificate Train_Proof, thereby realizing the monitoring and management of the entire data calculation process, and thus ensuring the integrity of the calculation result data; 4) Security against dishonest data providers: Dishonest data providers DP may provide irrelevant data or even fail to deliver data. The data provider DP needs to sign the original data and its hash summary to confirm the responsibility. and And construct data response In response to the data acquisition request; the data demander DR verifies the authenticity of the acquired data resources based on this hash summary to prevent the data provider from denying or repudiating when a dispute arises; in addition, when matching the demand, the data demander DR obtains the relevant evaluation information ω of the data provider DP from the data evaluation management contract DEMC for further screening; 5) Security against dishonest computing nodes: Dishonest computing nodes CN may forge data requests Data_Request to obtain data resources from data providers DP. Data providers DP can use the data request management contract DRMC to identify whether the request is an abnormal request. Only when the request matches the signature of the data demander DR and proves that it is indeed initiated by the corresponding data demander DR, the data provider DP will deliver the data resources to the computing node CN to prevent the computing node CN from maliciously obtaining data resources. In order to prevent the computing node CN from not processing data according to the predetermined requirements to save computing power and still obtain the expected benefits, the computing node CN must upload the data calculation trusted certificate Train_Proof to the chain after delivering the data processing results to obtain the expected reward. The certificate contains the signature value of the computing node CN on the hash summary of the result data If a computing node CN commits a crime, it can be traced and punished, which effectively prevents the computing node CN from stealing from the public. 6) Security against dishonest data demanders: Dishonest data demanders DR may not only forge their identities to send false data calculation requests, but may also deny and repudiate data calculations. When the consortium chain network processes a request, it will use the public key PK of the data demander DR to DR Identity authentication is carried out to effectively prevent identity forgery. At the same time, in order to protect the reputation and interests of the data provider DP, the result information storage contract RISC in the alliance chain network will record the trusted credential information Train_Proof signed by all participants in each data calculation, and provide data traceability function to the outside world, thereby reducing the potential risk of denial and repudiation by dishonest data demanders DR during the data calculation process.

Images