E-commerce operation data security protection system and method based on block chain

Abstract

The invention provides an e-commerce operation data security protection system and method based on a block chain. The method comprises the following steps: performing distributed storage on e-commerce operation data after homomorphic encryption processing through each node of a block chain network; determining trust attributes of each user access behavior according to the historical behavior data, performing fuzzy mapping on all the trust attributes to obtain a fuzzy membership degree of each user access behavior, and further determining the behavior trust degree of the e-commerce cloud platform to the user access process through all the fuzzy membership degrees; determining an encrypted identity certificate of the target user according to the behavior score and the initial access level of the target user; and performing minimum permission constraint on the access permission of the target user through the analysis result of the intelligent contract on the encrypted identity credential and the behavior credibility to obtain an encrypted access permission, and limiting the authorization range of the target user for accessing the encrypted data according to the encrypted access permission. By adopting the scheme provided by the invention, the minimum permission constraint on the e-commerce operation data access authorization range can be realized.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and more specifically, to a blockchain-based e-commerce operation data security protection system and method. Background Art

[0002] Blockchain is widely used in identity authentication, supply chain management, financial transactions and other scenarios. The application of blockchain in data security protection is mainly reflected in enhancing data security through decentralized structure, encryption technology and tamper-proof characteristics. Blockchain stores data on multiple nodes through distributed ledger technology to ensure that data will not be lost or tampered with due to single point failure or tampering. At the same time, every data exchange in the blockchain is encrypted to ensure the privacy of data during transmission and storage. Only authorized users can decrypt and access relevant data. In addition, the consensus mechanism of blockchain ensures consistency between all nodes, avoids malicious operations or tampering, and improves data integrity.

[0003] In the prior art, under the traditional identity- and role-based blockchain access control model, user access rights are usually statically assigned and authorized based on their roles or identities. For example, a user may have too many permissions because he is classified as a certain role (such as "administrator" or "business manager"), including access to sensitive data or performing important operations. The traditional permission allocation method ignores the specific behavior and actual needs of users, which easily leads to users having access rights that exceed their actual work needs, thereby posing the risk of abuse or malicious behavior, especially when the user's behavior changes, the original role permissions are not adjusted in time. Therefore, how to implement the minimum permission constraint on the scope of authorization for access to e-commerce operation data has become a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides a blockchain-based e-commerce operation data security protection system and method, which can implement minimum permission constraints on the scope of authorization for access to e-commerce operation data.

[0005] In the first aspect, the present application provides a blockchain-based e-commerce operation data security protection method, comprising the following steps:

[0006] Perform homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform to obtain the encrypted data of the e-commerce cloud platform, and then distribute and store the encrypted data through various nodes of the blockchain network;

[0007] Obtain the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attribute of each user's access behavior based on the historical behavior data, perform fuzzy mapping on all trust attributes, obtain the fuzzy membership of each user's access behavior, and then determine the behavioral trust of the e-commerce cloud platform in the user's access process through all the fuzzy memberships;

[0008] Determine a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and an initial access level of the target user;

[0009] When the target user applies for access to the encrypted data, the encrypted identity credential is parsed through the smart contract in the blockchain network, and the target user's access rights are subject to minimum permission constraints based on the parsing result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorized scope of the target user's access to the encrypted data based on the encrypted access rights.

[0010] Preferably, the e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted to obtain the encrypted data of the e-commerce cloud platform, which specifically includes:

[0011] Select a homomorphic encryption algorithm based on the encryption requirements of the e-commerce operation data;

[0012] Generate a public key according to the homomorphic encryption algorithm;

[0013] The e-commerce operation data is encrypted by the public key to obtain encrypted data of the e-commerce cloud platform.

[0014] Preferably, distributing and storing the encrypted data through various nodes of the blockchain network specifically includes:

[0015] Dividing the encrypted data into blocks according to the order of recording time to obtain multiple data blocks;

[0016] Multiple blocks are generated based on the consensus mechanism of the blockchain network, and each data block is stored in each block.

[0017] Preferably, determining the trust attribute of each user's access behavior according to the historical behavior data specifically includes:

[0018] Obtaining each user's historical behavior record from the historical behavior data;

[0019] Perform abnormal behavior detection on each user's historical behavior records to identify abnormal behavior characteristics of each user;

[0020] The trust attribute of each user's access behavior is determined through the abnormal behavior characteristics of each user.

[0021] Preferably, determining the behavioral trust of the e-commerce cloud platform in the user access process through all fuzzy memberships specifically includes:

[0022] Describe all fuzzy memberships with information entropy features to obtain membership entropy;

[0023] The trust evaluation of the typical behavior of the user in accessing the e-commerce cloud platform is performed through the average value of all fuzzy memberships and the membership entropy, and the behavioral trust of the e-commerce cloud platform in the user's access process is obtained.

[0024] Preferably, determining the encrypted identity credentials of the target user according to the behavior score and the initial access level of the target user specifically includes:

[0025] Define the initial access level for target users;

[0026] Obtain the target user's identity information;

[0027] The behavior score, the initial access level and the identity information are digitally signed to obtain an encrypted identity credential of the target user.

[0028] Preferably, the minimum permission constraint is applied to the target user's access rights according to the analysis result and the behavior trust, and obtaining the encrypted access rights of the target user specifically includes:

[0029] Obtaining a behavior score and an initial access level of the target user from the analysis result;

[0030] Determine a first access permission for the target user according to the behavior score and the initial access level;

[0031] determining a second access permission of the target user according to the behavior score and the behavior trust;

[0032] Based on the principle of minimum constraints, the first access permission and the second access permission are constrained to obtain the encrypted access permission of the target user.

[0033] In the second aspect, the present application provides an e-commerce operation data security protection system based on blockchain, including:

[0034] An encryption module is used to perform homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform to obtain the encrypted data of the e-commerce cloud platform, and then distribute the encrypted data through various nodes of the blockchain network;

[0035] A processing module is used to obtain the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attribute of each user's access behavior based on the historical behavior data, perform fuzzy mapping on all trust attributes, obtain the fuzzy membership of each user's access behavior, and then determine the behavioral trust of the e-commerce cloud platform for the user's access process through all the fuzzy memberships;

[0036] The processing module is further used to determine a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user;

[0037] The execution module is used to parse the encrypted identity credential through the smart contract in the blockchain network when the target user applies for access to the encrypted data, and to perform minimum permission constraints on the target user's access rights based on the analysis result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorization scope of the target user to access the encrypted data according to the encrypted access rights.

[0038] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned blockchain-based e-commerce operation data security protection method.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned blockchain-based e-commerce operation data security protection method.

[0040] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects:

[0041] In the embodiments of the present application, the e-commerce operation data of the e-commerce cloud platform is subjected to homomorphic encryption processing to obtain the encrypted data of the e-commerce cloud platform, and then the encrypted data is distributed and stored through each node of the blockchain network; the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period is obtained, the trust attribute of each user's access behavior is determined according to the historical behavior data, all the trust attributes are subjected to fuzzy mapping to obtain the fuzzy membership degree of each user's access behavior, and then the behavior trust degree of the e-commerce cloud platform for the user access process is determined through all the fuzzy membership degrees; the behavior score of the target user is determined according to the historical behavior data of the target user within a specified time period, and the encrypted identity credential of the target user is determined according to the behavior score and the initial access level of the target user; when the target user applies to access the encrypted data, the encrypted identity credential is parsed through a smart contract in the blockchain network, and the access permission of the target user is restricted by the minimum permission according to the parsing result and the behavior trust degree to obtain the encrypted access permission of the target user, and the authorization range for the target user to access the encrypted data is restricted according to the encrypted access permission.

[0042] It can be seen that in the present application, the access permission of the target user is restricted by the minimum permission according to the parsing result and the behavior trust degree to obtain the encrypted access permission of the target user, and then the authorization range for the target user to access the encrypted data is restricted by the encrypted access permission; first, by performing homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform, it is ensured that the e-commerce operation data can still be processed in the encrypted state, which can reduce the exposure risk of sensitive encrypted data during storage and calculation; second, based on the evaluation of the trust attribute of the historical behavior data, the system can dynamically evaluate the trust degree of the user according to the user's access behavior, and form the behavior membership degree of the user through fuzzy mapping, so as to identify and quantify the trust attribute of the user behavior. Through the calculation of the behavior trust degree, the system can accurately reflect the behavior characteristics of typical users within a specified time period; then, when the target user applies to access the encrypted data, the encrypted identity credential is parsed through a smart contract in the blockchain network. By parsing and verifying the encrypted identity credential of the user through the smart contract, the adjustment and authorization process of the access permission no longer depends on manual intervention, thus reducing the possibility of human errors and improving the security and reliability of the system; finally, the access permission of the target user is restricted by the minimum permission according to the parsing result of the encrypted identity credential and the behavior trust degree of the e-commerce cloud platform for the user access process to obtain the encrypted access permission of the target user, and the access permission of the user can be dynamically adjusted according to the actual behavior of the user, so as to ensure that the access range of the user is limited to the data required by his duties and actual needs. Different from the traditional static permission allocation method, the dynamic evaluation based on the user behavior can adjust the user permission in real time, which can reduce the risk of over-authorization of permissions; in summary, the solution of the present application can achieve the minimum permission restriction on the access authorization range of the e-commerce operation data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is an exemplary flow chart of a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application;

[0044] Figure 2 It is a schematic diagram of the structure of a blockchain according to some embodiments of the present application;

[0045] Figure 3 is a schematic diagram of a process for determining a behavior score according to some embodiments of the present application;

[0046] Figure 4 It is a structural diagram of an e-commerce operation data security protection system based on blockchain according to some embodiments of the present application;

[0047] Figure 5 It is a structural diagram of a computer device for implementing a blockchain-based e-commerce operation data security protection method as shown in some embodiments of the present application. DETAILED DESCRIPTION

[0048] In order to better understand the technical solution of the present application, the technical solution of the present application will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0049] refer to Figure 1 , which is an exemplary flow chart of a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application. The blockchain-based e-commerce operation data security protection method 100 mainly includes the following steps:

[0050] In step 101, the e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted to obtain the encrypted data of the e-commerce cloud platform, and then the encrypted data is distributedly stored through each node of the blockchain network.

[0051] It should be noted that blockchain-based e-commerce operation data security protection is a solution that uses blockchain technology to ensure the security and immutability of e-commerce operation data. Figure 2 As shown, this figure is a schematic diagram of the structure of the blockchain in some embodiments of the present application. The blockchain is a distributed ledger technology that stores data in a series of blocks arranged in chronological order. Each block contains a block header, the number of transactions, and a certain number of transaction records, and these blocks are linked together through cryptographic methods to form an unchangeable chain structure.

[0052] In some embodiments, the e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted to obtain the encrypted data of the e-commerce cloud platform, which can be achieved by the following steps:

[0053] Select a homomorphic encryption algorithm based on the encryption requirements of the e-commerce operation data;

[0054] Generate a public key according to the homomorphic encryption algorithm;

[0055] The e-commerce operation data is encrypted by the public key to obtain encrypted data of the e-commerce cloud platform.

[0056] It should be noted that in the homomorphic encryption processing, common homomorphic encryption algorithms include partially homomorphic encryption (PHE), limited homomorphic encryption (SHE), and fully homomorphic encryption (FHE). Partially homomorphic encryption is suitable for application scenarios that only need to perform a single operation, and its computational cost is low, such as adding and summarizing the total transaction amount in e-commerce. Limited homomorphic encryption is suitable for scenarios that need to perform multiple operations but have limited operation depth, and its computational cost is low, such as the encryption processing of user behavior data in the recommendation algorithm of the e-commerce platform. Fully homomorphic encryption is suitable for scenarios that need to perform multiple complex operations on encrypted data, and its computational cost is high, such as accurate encrypted data mining and user portrait analysis on the e-commerce platform. The present application scheme pre-encrypts all e-commerce operation data, and the amount of encrypted data is large. Therefore, the present application embodiment uses a partially homomorphic encryption algorithm with low computational cost to homomorphically encrypt the e-commerce operation data.

[0057] In the specific implementation, first, in order to reduce the computational cost of encryption operations, a partially homomorphic encryption algorithm (such as Paillier encryption that supports additive homomorphism) can be selected as the homomorphic encryption algorithm in the embodiment of the present application, for example; then, a public key is generated by the selected partially homomorphic encryption algorithm, and the public key is used for data encryption operations to ensure the security and versatility of the encryption process; finally, the generated public key is used to encrypt the e-commerce operation data item by item to obtain the encrypted e-commerce operation data, and the encrypted e-commerce operation data is used as the encrypted data of the e-commerce cloud platform.

[0058] In some embodiments, the encrypted data may be distributedly stored across nodes of the blockchain network by using the following steps:

[0059] Dividing the encrypted data into blocks according to the order of recording time to obtain multiple data blocks;

[0060] Multiple blocks are generated based on the consensus mechanism of the blockchain network, and each data block is stored in each block.

[0061] In the specific implementation, first, the corresponding encrypted data is divided into blocks according to the specified time period according to the chronological order of e-commerce operation data collection to obtain multiple data blocks. For example, the encrypted data corresponding to the operation data recorded on the same day can be grouped into one data block; then, multiple blocks are generated based on the consensus mechanism of the blockchain network (such as PoW or PoS), and each data block is stored in a different block according to the consensus algorithm, where each block contains a hash value pointing to the previous block. The hash value can ensure that the data is linked together in sequence, thereby achieving the integrity and consistency of encrypted data storage.

[0062] In step 102, the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period is obtained, the trust attributes of each user's access behavior are determined based on the historical behavior data, all trust attributes are fuzzy mapped, and the fuzzy membership of each user's access behavior is obtained, and then the behavioral trust of the e-commerce cloud platform in the user's access process is determined through all the fuzzy memberships.

[0063] It should be noted that the specified time period in the present application refers to the time period corresponding to the current moment to the past six months. In other embodiments, the specified time period may also include other time periods, which are not limited here. In specific implementation, the historical behavior data of all users accessing the e-commerce cloud platform within the specified time period can be obtained by the following steps, namely: obtaining the behavior data of all users accessing the e-commerce cloud platform from the database of the e-commerce cloud platform from the current moment to the past six months, and then grouping all the obtained behavior data into a set as historical behavior data.

[0064] In some embodiments, determining the trust attribute of each user's access behavior based on the historical behavior data may be implemented by the following steps:

[0065] Obtaining each user's historical behavior record from the historical behavior data;

[0066] Perform abnormal behavior detection on each user's historical behavior records to identify abnormal behavior characteristics of each user;

[0067] The trust attribute of each user's access behavior is determined through the abnormal behavior characteristics of each user.

[0068] It should be noted that the trust attribute in this application is an indicator to measure the credibility of user access behavior.

[0069] In the specific implementation, first, the behavior record of each user is extracted from the historical behavior data, and the record includes the user's browsing window, IP address, access timestamp and access frequency; then, the existing anomaly detection technology is used to analyze the historical behavior record of each user to identify abnormal behavior characteristics, and the abnormal behavior characteristics specifically include abnormal characteristics of IP address, abnormal characteristics of access time and abnormal characteristics of access frequency. Among them, common anomaly detection methods include outlier detection based on statistics, machine learning algorithms (such as Isolation Forest) or deep learning methods (such as autoencoders), this application uses statistical outlier detection to detect abnormal behavior in the user's historical behavior records. Specifically, all behavior data in the user's historical behavior records can be converted into numerical data, and the standard deviation of all numerical data and the mean can be calculated. If the Z-score of a data point exceeds the set threshold, it is determined to be abnormal, and the behavior feature corresponding to the data point is used as the abnormal behavior feature; finally, the abnormal behavior feature of each user can be represented by a vector, and the specific form of the vector is: [abnormal feature value of IP address, abnormal feature value of access time, abnormal feature value of access frequency], and the obtained vector is used as a trust attribute vector, and then each trust attribute vector is used to characterize the trust attribute of each user's access behavior.

[0070] In some embodiments, fuzzy mapping is performed on all trust attributes to obtain the fuzzy membership of each user access behavior, which can be achieved by using the following steps:

[0071] Divide all trust attributes into multiple fuzzy intervals;

[0072] Mapping the abnormal feature value in each trust attribute to the corresponding fuzzy interval to obtain the fuzzy mapping value of each trust attribute;

[0073] The fuzzy mapping value of each trust attribute is fuzzily evaluated through a preset membership function to obtain the fuzzy membership degree of each user's access behavior.

[0074] It should be noted that the fuzzy interval in this application is used to divide the abnormal characteristic values ​​of the trust attribute into sets of different ranges, and its function is to convert continuous behavioral characteristic values ​​into fuzzy categories; the fuzzy membership in this application is an indicator to measure the degree of matching of user access behavior within different trust attribute fuzzy intervals.

[0075] In the specific implementation, first, a trust attribute vector reflecting the trust attribute is obtained, and all trust attributes are divided into three fuzzy intervals of normal, abnormal, and severely abnormal according to the size of the trust attribute vector modulus; then, for each trust attribute, the abnormal characteristic value of the IP address, the abnormal characteristic value of the access time, and the abnormal characteristic value of the access frequency are obtained from the trust attribute corresponding to the trust attribute vector, and then the abnormal characteristic value of the IP address, the abnormal characteristic value of the access time, and the abnormal characteristic value of the access frequency are weighted averaged, wherein the weight of each item can be determined by the ratio between the abnormal characteristic value corresponding to each item and the average value of its abnormal characteristic value, and the value obtained by the weighted average is used as the fuzzy mapping value of the trust attribute, and the fuzzy mapping value of each trust attribute can be obtained; finally, the triangular membership function can be used as the preset membership function, and then the membership value of each fuzzy mapping value in the corresponding fuzzy interval is calculated by the triangular membership function, and the membership value of each fuzzy mapping value in the corresponding fuzzy interval can be used as the fuzzy membership of each user's access behavior.

[0076] In some embodiments, determining the behavioral trust of the e-commerce cloud platform in the user access process through all fuzzy memberships can be implemented by the following steps:

[0077] Describe all fuzzy memberships with information entropy features to obtain membership entropy;

[0078] The trust evaluation of the typical behavior of the user in accessing the e-commerce cloud platform is performed through the average value of all fuzzy memberships and the membership entropy, and the behavioral trust of the e-commerce cloud platform in the user's access process is obtained.

[0079] It should be noted that the membership entropy in this application is an indicator that measures the uncertainty of the distribution of user behavior in each fuzzy interval; the behavioral trust in this application is an indicator that measures the credibility of users under specific behavior patterns, which reflects the reliability of user behavior; in addition, it should be noted that the typical user in this application refers to a representative sample user group that can be used to evaluate and predict platform user behavior, and the behavior pattern of this user group can reflect the access behavior of most users on the platform.

[0080] In specific implementation, first, all fuzzy memberships can be substituted into the information entropy calculation formula. The information entropy of the fuzzy membership can be obtained through the formula, and then the information entropy is used as the membership entropy. By calculating the entropy values ​​of all fuzzy memberships, the complexity of most user behaviors can be described. For example, if the user's behavior is more evenly distributed in the membership of multiple trust attributes (for example, there are both high anomalies and low anomalies), then its entropy value is larger, indicating that the user's behavior is more unpredictable. If the membership is concentrated in a certain interval, the entropy value is smaller, indicating that the user's behavior is more consistent; then, by calculating the average value of all fuzzy memberships, an indicator representing the consistency of user behavior can be obtained. If the average value is high, it means that the user behavior is consistent in most trust attributes and the behavior is more credible. If the average value is low, it means that the user behavior is more dispersed and may be abnormal. Further, the product of the natural exponential function value of the opposite number of the membership entropy and the average value of all fuzzy memberships can be used as the behavioral trust of the e-commerce cloud platform in the user access process.

[0081] In step 103, a behavior score of the target user is determined based on the historical behavior data of the target user within a specified time period, and an encrypted identity credential of the target user is determined based on the behavior score and the initial access level of the target user.

[0082] In some embodiments, reference Figure 3 As shown, this figure is a schematic diagram of the process of determining the behavior score in some embodiments of the present application. In this embodiment, the behavior score of the target user is determined according to the historical behavior data of the target user within a specified time period, which can be achieved by the following steps:

[0083] In step 1031, historical behavior data of the target user within a specified time period is obtained;

[0084] In step 1032, the behavior characteristics of the target user are extracted from the historical behavior data;

[0085] In step 1033, the target user's access behavior is evaluated based on the behavior characteristics to obtain a behavior score of the target user.

[0086] It should be noted that the behavior score in this application is an indicator to measure user preference behavior.

[0087] In the specific implementation, first, the system obtains all historical behavior data of the target user in the past six months. The behavior data content usually includes access records, browsed pages, stay time and click behavior; then, the key behavior features are extracted from the historical behavior data through the existing feature extraction model. The behavior features specifically include access frequency, access time, type of browsed pages and degree of interaction; finally, an evaluation model is initialized. The evaluation model can be trained based on the historical behavior data of other users, and then the extracted behavior features are input into the evaluation model to output a score for evaluating the user's access behavior, and the score is used as the behavior score of the target user; it should be noted that the training process of the evaluation model is usually based on the user's historical behavior The goal is to build a model that can evaluate the behavior of new users by learning the preference behavior of existing users. The first step is to collect a large amount of historical behavior data of users and extract key behavior features (such as visit frequency, visit time, type of browsed pages and degree of interaction). The second step is to use these behavior features to train the model. Commonly used training algorithms include supervised learning methods (such as regression analysis, support vector machines, decision trees). The purpose is to predict the preference behavior score of the target user based on the behavior characteristics of the target user. During the training process, the evaluation model continuously optimizes parameters to minimize the error between the predicted score and the actual score. After the training is completed, the evaluation model can generate a corresponding behavior score based on the user's behavior characteristics to reflect the user's behavior preference.

[0088] In some embodiments, determining the encrypted identity credentials of the target user according to the behavior score and the initial access level of the target user may be implemented by the following steps:

[0089] Define the initial access level for target users;

[0090] Obtain the target user's identity information;

[0091] The behavior score, the initial access level and the identity information are digitally signed to obtain an encrypted identity credential of the target user.

[0092] It should be noted that the encrypted identity credential in this application is a credential generated by encrypting and digitally signing important data such as the user's identity information, behavior score, access level, etc. through encryption technology.

[0093] In the specific implementation, first, the initial access level of the target user can be defined according to the activity and credit level of the target user, and can be represented by a hierarchy system (such as ordinary users, advanced users, VIP users); then, the identity information of the target user is obtained from the database, and the identity information includes user ID, personal information and account information; finally, a hash value is generated by the behavior score, initial access level and identity information, and then the hash value is encrypted by a key generated by an encryption function to obtain an encrypted hash value, and the encrypted hash value is generated into an encrypted identity certificate of the target user through digital signature technology, which ensures the authenticity of the user identity, the integrity and non-tamperability of the data. The digital signature of the certificate is generated by the private key of the target user, and its validity can be verified by the public key to ensure the security of user behavior and identity information.

[0094] It should be noted that the encrypted identity credentials in this application are stored in the blockchain.

[0095] In step 104, when the target user applies for access to the encrypted data, the encrypted identity credential is parsed through the smart contract in the blockchain network, and the target user's access rights are subject to minimum permission constraints based on the parsing result and the behavior trust, to obtain the target user's encrypted access rights, and the authorization scope of the target user's access to the encrypted data is limited based on the encrypted access rights.

[0096] It should be noted that in this application, parsing the encrypted identity credentials through the smart contract in the blockchain network refers to using the smart contract on the blockchain to verify, decrypt and parse the encrypted identity credentials stored in the blockchain to determine the user's behavior score, access rights and other information; in specific implementation: first, the smart contract will use the public key of the target user to decrypt the encrypted identity credentials and extract key information such as the behavior score and initial access level; secondly, the smart contract will match this information with the access control rules of the platform to verify whether the user has the authority to access certain data or perform specific operations; finally, the smart contract dynamically executes the corresponding permission granting or restriction operations based on the parsing results, such as allowing or denying users to access sensitive data of the e-commerce cloud platform.

[0097] In some embodiments, the access rights of the target user are constrained to the minimum permission according to the analysis result and the behavior trust, and the encrypted access rights of the target user are obtained by the following steps:

[0098] Obtaining a behavior score and an initial access level of the target user from the analysis result;

[0099] Determine a first access permission for the target user according to the behavior score and the initial access level;

[0100] determining a second access permission of the target user according to the behavior score and the behavior trust;

[0101] Based on the principle of minimum constraints, the first access permission and the second access permission are constrained to obtain the encrypted access permission of the target user.

[0102] It should be noted that the first access right in this application refers to the basic access right, which is used to provide users with a preliminary access scope to ensure that their access rights match their behavioral characteristics and identities, thereby achieving preliminary permission control and security protection; in addition, the second access right refers to the compensatory access right, which is used to dynamically adjust the access rights of the target user according to the degree of abnormality of the target user's behavior, to ensure that the permission allocation is more flexible and in line with the user's actual behavior performance, thereby improving the security and refined management of the system; it should also be noted that the encrypted access right in this application refers to the user's permission to access encrypted data.

[0103] In specific implementation, determining the first access right of the target user through the behavior score and the initial access level can be implemented in the following manner, namely: the behavior score and the initial access level can be compared with the preset rules to obtain a basic access right, and the basic access right can be used as the first access right of the target user, wherein the preset rule is: judging the score interval of the behavior score, each score interval corresponds to an access right, and the access right corresponding to the behavior score can be obtained, each initial access level corresponds to an access right, and then the sum of the access right corresponding to the behavior score and the access right corresponding to the initial access level is used as the user's basic access right; determining the second access right of the target user according to the behavior score and the behavior trust can be implemented in the following manner, namely: the product of the behavior score and the behavior trust can be used as an adjustment factor for the access right, and then the adjustment factor and the preset rule are added. The adjustment factor interval is compared, and an access right is preset for each adjustment factor interval. The access right corresponding to the adjustment factor can be obtained by the above method, and the access right is used as the second access right of the target user; based on the minimum constraint principle, the first access right and the second access right are constrained to obtain the encrypted access right of the target user, which can be implemented in the following way, namely: the minimum permission constraint principle requires that the target user can only obtain the minimum permission required to perform the current task. The required permission required for the target user to apply for access to encrypted data can be obtained first, and the sum of the first access right and the second access right is used as the specific permission of the target user. The required permission is then compared with the specific permission. When the required permission is less than or equal to the specific permission, the required permission is used as the encrypted access right of the target user. When the required permission is greater than the specific permission, the specific permission is used as the encrypted access right of the target user.

[0104] It should be noted that limiting the authorized scope of the target user's access to the encrypted data according to the encrypted access rights means controlling the user's access rights through encrypted access rights, thereby limiting the scope of encrypted data that the user can access; in specific implementation, first, based on the target user's encrypted access rights, the system will identify the data range that he is allowed to access; then, encryption technology, such as public key encryption, is used to protect the data's access rights information; finally, by verifying the user's encrypted identity credentials, it is ensured that the user's access request complies with its authorized scope, and access requests that do not meet the conditions are restricted, thereby achieving security control of data access.

[0105] On the other hand, in some embodiments, the present application provides an e-commerce operation data security protection system based on blockchain, referring to Figure 4 , which is a schematic diagram of the structure of an e-commerce operation data security protection system based on blockchain according to some embodiments of the present application. The e-commerce operation data security protection system based on blockchain 400 includes: an encryption module 401, a processing module 402 and an execution module 403, which are respectively described as follows:

[0106] Encryption module 401, in this application, encryption module 401 is mainly used to perform homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform to obtain encrypted data of the e-commerce cloud platform, and then distribute the encrypted data through each node of the blockchain network;

[0107] Processing module 402, in this application, is used to obtain historical behavior data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attribute of each user's access behavior based on the historical behavior data, perform fuzzy mapping on all trust attributes, obtain the fuzzy membership of each user's access behavior, and then determine the behavioral trust of the e-commerce cloud platform for the user's access process through all the fuzzy memberships;

[0108] The processing module 402 in the present application is also used to determine the behavior score of the target user according to the historical behavior data of the target user within a specified time period, and determine the encrypted identity credentials of the target user according to the behavior score and the initial access level of the target user;

[0109] Execution module 403. In this application, execution module 403 is mainly used to parse the encrypted identity credentials through the smart contract in the blockchain network when the target user applies for access to the encrypted data, and to perform minimum permission constraints on the target user's access rights based on the analysis results and the behavior trust, to obtain the target user's encrypted access rights, and to limit the authorization scope of the target user to access the encrypted data based on the encrypted access rights.

[0110] In addition, the present application also provides a computer device, which includes a memory and a processor, the memory stores a code, and the processor is configured to obtain the code and execute the above-mentioned blockchain-based e-commerce operation data security protection method.

[0111] In some embodiments, reference Figure 5 , which is a schematic diagram of the structure of a computer device for implementing a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application. The blockchain-based e-commerce operation data security protection method in the above embodiment can be Figure 5 The computer device 500 shown in the figure is implemented, and the computer device 500 includes at least one processor 501, a communication bus 502, a memory 503 and at least one communication interface 504.

[0112] The processor 501 may be a general-purpose central processing unit (CPU) or an application-specific integrated circuit (ASIC).

[0113] The communication bus 502 may be used to transmit information between the above-mentioned components.

[0114] The memory 503 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 503 may exist independently and be connected to the processor 501 via the communication bus 502. The memory 503 may also be integrated with the processor 501.

[0115] Among them, the memory 503 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 501. The processor 501 is used to execute the program code stored in the memory 503. The program code may include one or more software modules. The blockchain-based e-commerce operation data security protection method in the above embodiment can be implemented by the processor 501 and one or more software modules in the program code in the memory 503.

[0116] The communication interface 504 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0117] In a specific implementation, as an embodiment, a computer device may include multiple processors, each of which may be a single-CPU processor or a multi-CPU processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0118] The above-mentioned computer device can be a general-purpose computer device or a special-purpose computer device. In a specific implementation, the computer device can be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiment of the present application does not limit the type of computer device.

[0119] In addition, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned blockchain-based e-commerce operation data security protection method.

[0120] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0121] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A blockchain-based e-commerce operation data security protection method, characterized in that: The steps include: Perform homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform to obtain the encrypted data of the e-commerce cloud platform, and then distribute and store the encrypted data through various nodes of the blockchain network; Obtain the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attribute of each user's access behavior based on the historical behavior data, perform fuzzy mapping on all trust attributes, obtain the fuzzy membership of each user's access behavior, and then determine the behavioral trust of the e-commerce cloud platform in the user's access process through all the fuzzy memberships; Determine a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and an initial access level of the target user; When the target user applies for access to the encrypted data, the encrypted identity credential is parsed through the smart contract in the blockchain network, and the target user's access rights are subject to minimum permission constraints based on the parsing result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorized scope of the target user's access to the encrypted data based on the encrypted access rights.

2. The method according to claim 1, characterized in that The e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted, and the encrypted data of the e-commerce cloud platform includes: Select a homomorphic encryption algorithm based on the encryption requirements of the e-commerce operation data; Generate a public key according to the homomorphic encryption algorithm; The e-commerce operation data is encrypted by the public key to obtain encrypted data of the e-commerce cloud platform.

3. The method according to claim 1, characterized in that Distributing the encrypted data through various nodes of the blockchain network specifically includes: Dividing the encrypted data into blocks according to the order of recording time to obtain multiple data blocks; Multiple blocks are generated based on the consensus mechanism of the blockchain network, and each data block is stored in each block.

4. The method according to claim 1, characterized in that Determining the trust attribute of each user's access behavior based on the historical behavior data specifically includes: Obtaining each user's historical behavior record from the historical behavior data; Perform abnormal behavior detection on each user's historical behavior records to identify abnormal behavior characteristics of each user; The trust attribute of each user's access behavior is determined through the abnormal behavior characteristics of each user.

5. The method according to claim 1, characterized in that Determining the behavioral trust of the e-commerce cloud platform in the user access process through all fuzzy memberships specifically includes: Describe all fuzzy memberships with information entropy features to obtain membership entropy; The trust evaluation of the typical behavior of the user in accessing the e-commerce cloud platform is performed through the average value of all fuzzy memberships and the membership entropy, and the behavioral trust of the e-commerce cloud platform in the user's access process is obtained.

6. The method according to claim 1, characterized in that Determining the encrypted identity credentials of the target user based on the behavior score and the initial access level of the target user specifically includes: Define the initial access level for target users; Obtain the target user's identity information; The behavior score, the initial access level and the identity information are digitally signed to obtain an encrypted identity credential of the target user.

7. The method according to claim 1, characterized in that Based on the analysis results and the trust level of the behavior, the target user's access rights are subject to minimum permission constraints, and the encrypted access rights of the target user are obtained, including: Obtaining a behavior score and an initial access level of the target user from the analysis result; Determine a first access permission for the target user according to the behavior score and the initial access level; determining a second access permission of the target user according to the behavior score and the behavior trust; Based on the principle of minimum constraints, the first access permission and the second access permission are constrained to obtain the encrypted access permission of the target user.

8. An e-commerce operation data security protection system based on blockchain, characterized in that: include: An encryption module is used to perform homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform to obtain the encrypted data of the e-commerce cloud platform, and then distribute the encrypted data through various nodes of the blockchain network; A processing module is used to obtain the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attribute of each user's access behavior based on the historical behavior data, perform fuzzy mapping on all trust attributes, obtain the fuzzy membership of each user's access behavior, and then determine the behavioral trust of the e-commerce cloud platform for the user's access process through all the fuzzy memberships; The processing module is further used to determine a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user; The execution module is used to parse the encrypted identity credential through the smart contract in the blockchain network when the target user applies for access to the encrypted data, and to perform minimum permission constraints on the target user's access rights based on the analysis result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorization scope of the target user to access the encrypted data according to the encrypted access rights.

9. A computer device, comprising a memory and a processor, wherein the memory stores a code, characterized in that: The processor is configured to obtain the code and execute the blockchain-based e-commerce operation data security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the blockchain-based e-commerce operation data security protection method as described in any one of claims 1 to 7 is implemented.

Images