A blockchain-based e-commerce operation data security protection system and method

Abstract

The present application provides a blockchain-based e-commerce operation data security protection system and method, which distributes and stores the e-commerce operation data processed by homomorphic encryption through various nodes of the blockchain network; determines the trust attributes of each user's access behavior based on historical behavior data, performs fuzzy mapping on all trust attributes, and obtains the fuzzy membership of each user's access behavior, and then determines the behavioral trust of the e-commerce cloud platform in the user access process through all fuzzy memberships; determines the encrypted identity credentials of the target user based on the target user's behavior score and initial access level; performs minimum permission constraints on the target user's access rights through the analysis results of the encrypted identity credentials and the behavioral trust through smart contracts, obtains encrypted access rights, and limits the target user's authorized scope of access to encrypted data based on the encrypted access rights. By adopting the solution of the present application, minimum permission constraints on the authorized scope of access to e-commerce operation data can be achieved.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and more specifically, to a blockchain-based e-commerce operation data security protection system and method. Background Art

[0002] Blockchain is widely used in scenarios such as identity authentication, supply chain management, and financial transactions. The application of blockchain in data security protection is mainly reflected in enhancing data security through decentralized structure, encryption technology, and tamper-proof characteristics. Blockchain uses distributed ledger technology to store data on multiple nodes to ensure that data will not be lost or tampered with due to single point failure or tampering. At the same time, every data exchange in the blockchain is encrypted to ensure the privacy of data during transmission and storage. Only authorized users can decrypt and access relevant data. In addition, the consensus mechanism of the blockchain ensures consistency between all nodes, avoids malicious operations or tampering, and improves data integrity.

[0003] In the existing technology, under the traditional identity- and role-based blockchain access control model, user access rights are usually statically assigned and authorized based on their role or identity. For example, a user may have excessive permissions because he or she is classified as a certain role (such as "administrator" or "business manager"), including access to sensitive data or performing important operations. The traditional permission allocation method ignores the specific behavior and actual needs of users, which easily leads to users having access rights that exceed their actual work needs, thereby posing the risk of abuse or malicious behavior. In particular, when the user's behavior changes, the original role permissions are not adjusted in time. Therefore, how to implement minimum permission constraints on the scope of authorization for access to e-commerce operation data has become a difficult problem facing the industry. Summary of the Invention

[0004] This application provides a blockchain-based e-commerce operation data security protection system and method, which can implement minimum permission constraints on the scope of authorization for access to e-commerce operation data.

[0005] In a first aspect, the present application provides a blockchain-based e-commerce operation data security protection method, comprising the following steps:

[0006] Performing homomorphic encryption on the e-commerce operation data of the e-commerce cloud platform to obtain encrypted data of the e-commerce cloud platform, and then distributing and storing the encrypted data through various nodes of the blockchain network;

[0007] Obtain historical behavioral data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attributes of each user's access behavior based on the historical behavioral data, perform fuzzy mapping on all trust attributes, and obtain the fuzzy membership of each user's access behavior. Then, determine the trust degree of the e-commerce cloud platform in the user's access process based on all the fuzzy memberships.

[0008] determining a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determining an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user;

[0009] When the target user applies to access the encrypted data, the encrypted identity certificate is parsed through the smart contract in the blockchain network, and the target user's access rights are subject to minimum permission constraints based on the parsing result and the trust level of the behavior to obtain the target user's encrypted access rights. The authorized scope of the target user's access to the encrypted data is limited based on the encrypted access rights.

[0010] Preferably, homomorphic encryption is performed on the e-commerce operation data of the e-commerce cloud platform to obtain encrypted data of the e-commerce cloud platform, specifically including:

[0011] Select a homomorphic encryption algorithm based on the encryption requirements of the e-commerce operation data;

[0012] Generate a public key according to the homomorphic encryption algorithm;

[0013] The e-commerce operation data is encrypted by the public key to obtain encrypted data of the e-commerce cloud platform.

[0014] Preferably, distributing and storing the encrypted data across various nodes of the blockchain network specifically includes:

[0015] Dividing the encrypted data into blocks according to the order of recording time to obtain multiple data blocks;

[0016] Multiple blocks are generated based on the consensus mechanism of the blockchain network, and each data block is stored in each block.

[0017] Preferably, determining the trust attribute of each user's access behavior based on the historical behavior data specifically includes:

[0018] Obtaining each user's historical behavior record from the historical behavior data;

[0019] Perform abnormal behavior detection on each user's historical behavior records to identify abnormal behavior characteristics of each user;

[0020] The trust attribute of each user's access behavior is determined through the abnormal behavior characteristics of each user.

[0021] Preferably, determining the trust degree of the e-commerce cloud platform in the user's access process through all fuzzy memberships specifically includes:

[0022] Perform information entropy feature description on all fuzzy memberships to obtain membership entropy;

[0023] The trust evaluation of the typical behavior of users in accessing the e-commerce cloud platform is performed through the average value of all fuzzy memberships and the membership entropy, and the behavioral trust of the e-commerce cloud platform in the user's access process is obtained.

[0024] Preferably, determining the encrypted identity credentials of the target user according to the behavior score and the initial access level of the target user specifically includes:

[0025] Define the initial access level for target users;

[0026] Obtain the target user's identity information;

[0027] The behavior score, the initial access level, and the identity information are digitally signed to obtain an encrypted identity credential of the target user.

[0028] Preferably, the minimum permission constraint is applied to the target user's access rights based on the analysis result and the behavior trust level, and obtaining the target user's encrypted access rights specifically includes:

[0029] Obtaining the target user's behavior score and initial access level from the parsing result;

[0030] determining a first access permission for the target user based on the behavior score and the initial access permission level;

[0031] determining a second access permission for the target user according to the behavior score and the behavior trust;

[0032] Based on the principle of minimum constraints, the first access permission and the second access permission are constrained to obtain the encrypted access permission of the target user.

[0033] Secondly, this application provides a blockchain-based e-commerce operation data security protection system, including:

[0034] An encryption module is used to perform homomorphic encryption on the e-commerce operation data of the e-commerce cloud platform to obtain the encrypted data of the e-commerce cloud platform, and then distribute the encrypted data across various nodes of the blockchain network;

[0035] A processing module is used to obtain historical behavioral data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attributes of each user's access behavior based on the historical behavioral data, perform fuzzy mapping on all trust attributes to obtain the fuzzy membership of each user's access behavior, and then determine the trust degree of the e-commerce cloud platform in the user's access process based on all the fuzzy memberships;

[0036] The processing module is further configured to determine a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user;

[0037] The execution module is used to parse the encrypted identity certificate through the smart contract in the blockchain network when the target user applies to access the encrypted data, and to impose minimum permission constraints on the target user's access rights based on the parsing result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorized scope of the target user's access to the encrypted data according to the encrypted access rights.

[0038] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores code, and the processor is configured to obtain the code and execute the above-mentioned blockchain-based e-commerce operation data security protection method.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned blockchain-based e-commerce operation data security protection method.

[0040] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects:

[0041] In an embodiment of the present application, the e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted to obtain the encrypted data of the e-commerce cloud platform, and then the encrypted data is distributedly stored through each node of the blockchain network; the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period is obtained, the trust attribute of each user's access behavior is determined based on the historical behavior data, all the trust attributes are fuzzy mapped to obtain the fuzzy membership of each user's access behavior, and then the behavioral trust of the e-commerce cloud platform for the user access process is determined through all the fuzzy memberships; the behavior score of the target user is determined based on the historical behavior data of the target user within a specified time period, and the encrypted identity credential of the target user is determined based on the behavior score and the initial access level of the target user; when the target user applies to access the encrypted data, the encrypted identity credential is parsed through the smart contract in the blockchain network, and the minimum permission constraint is imposed on the target user's access permission based on the parsing result and the behavior trust, to obtain the encrypted access permission of the target user, and the authorization scope of the target user to access the encrypted data is limited based on the encrypted access permission.

[0042] It can be seen that this application uses the parsing results and behavioral trust to impose minimum permission constraints on the target user's access rights, obtains the target user's encrypted access rights, and then limits the target user's authorized scope of access to encrypted data by the encrypted access rights; first, by performing homomorphic encryption on the e-commerce operation data of the e-commerce cloud platform, it ensures that the e-commerce operation data can still be processed in an encrypted state, which can reduce the exposure risk of sensitive encrypted data during storage and calculation; secondly, based on the trust attribute evaluation of historical behavioral data, the system can dynamically evaluate the user's trust according to the user's access behavior, and form the user's behavioral affiliation through fuzzy mapping, thereby identifying and quantifying the trust attributes of the user's behavior. Through the calculation of behavioral trust, the system can accurately reflect the behavioral characteristics of typical users within a specified time period; then, when the target user applies to access encrypted data, through the intelligent The contract parses the encrypted identity credentials, and parses and verifies the permissions of the user's encrypted identity credentials through the smart contract, so that the adjustment and authorization process of access rights no longer rely on manual intervention, thereby reducing the possibility of human error and improving the security and reliability of the system; finally, based on the parsing results of the encrypted identity credentials and the behavioral trust of the e-commerce cloud platform in the user access process, the access rights of the target user are constrained by minimum permissions, and the encrypted access rights of the target user are obtained. The access rights can be dynamically adjusted according to the user's actual behavior, thereby ensuring that the user's access scope is limited to the data required for his or her duties and actual needs. Unlike the traditional static permission allocation method, the dynamic evaluation based on user behavior can adjust user permissions in real time, thereby reducing the risk of excessive authorization of permissions; in summary, the present application scheme can achieve minimum permission constraints on the authorization scope of access to e-commerce operation data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is an exemplary flow chart of a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application;

[0044] Figure 2 is a schematic diagram of the structure of a blockchain according to some embodiments of the present application;

[0045] Figure 3 is a schematic diagram of a process for determining a behavior score according to some embodiments of the present application;

[0046] Figure 4 This is a schematic diagram of the structure of a blockchain-based e-commerce operation data security protection system according to some embodiments of the present application;

[0047] Figure 5 This is a structural diagram of a computer device for implementing a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application. DETAILED DESCRIPTION

[0048] In order to better understand the technical solution of the present application, the technical solution of the present application will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0049] refer to Figure 1 This figure is an exemplary flow chart of a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application. The blockchain-based e-commerce operation data security protection method 100 mainly includes the following steps:

[0050] In step 101, the e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted to obtain the encrypted data of the e-commerce cloud platform, and then the encrypted data is distributedly stored through each node of the blockchain network.

[0051] It should be noted that blockchain-based e-commerce operation data security protection is a solution that uses blockchain technology to ensure the security and non-tamperability of e-commerce operation data. Figure 2 As shown in the figure, it is a schematic diagram of the structure of the blockchain in some embodiments of the present application. The blockchain is a distributed ledger technology that stores data in a series of blocks arranged in chronological order. Each block contains a block header, the number of transactions and a certain number of transaction records, and these blocks are linked together through cryptographic methods to form an unchangeable chain structure.

[0052] In some embodiments, homomorphic encryption processing is performed on the e-commerce operation data of the e-commerce cloud platform to obtain encrypted data of the e-commerce cloud platform. The following steps can be used to achieve this:

[0053] Select a homomorphic encryption algorithm based on the encryption requirements of the e-commerce operation data;

[0054] Generate a public key according to the homomorphic encryption algorithm;

[0055] The e-commerce operation data is encrypted by the public key to obtain encrypted data of the e-commerce cloud platform.

[0056] It should be noted that in homomorphic encryption processing, common homomorphic encryption algorithms include partial homomorphic encryption (PHE), limited homomorphic encryption (SHE), and full homomorphic encryption (FHE). Partial homomorphic encryption is suitable for application scenarios that only need to perform a single operation, and its computational cost is low, such as adding and summarizing the total transaction amount in e-commerce. Limited homomorphic encryption is suitable for scenarios that need to perform multiple operations but have limited computational depth, and its computational cost is low, such as the encryption processing of user behavior data in the recommendation algorithm of the e-commerce platform. Fully homomorphic encryption is suitable for scenarios that need to perform multiple complex operations on encrypted data, and its computational cost is high, such as accurate encrypted data mining and user portrait analysis in the e-commerce platform. The present application scheme pre-encrypts all e-commerce operation data, and the amount of encrypted data is large. Therefore, the embodiment of the present application uses a partially homomorphic encryption algorithm with low computational cost to homomorphically encrypt the e-commerce operation data.

[0057] In specific implementation, first, in order to reduce the computational cost of encryption operations, a partially homomorphic encryption algorithm (such as Paillier encryption that supports additive homomorphism) can be selected as the homomorphic encryption algorithm in the embodiment of this application, for example; then, a public key is generated by the selected partially homomorphic encryption algorithm, and the public key is used for data encryption operations to ensure the security and versatility of the encryption process; finally, the generated public key is used to encrypt the e-commerce operation data item by item to obtain the encrypted e-commerce operation data, and the encrypted e-commerce operation data is used as the encrypted data of the e-commerce cloud platform.

[0058] In some embodiments, the distributed storage of the encrypted data across the nodes of the blockchain network may be achieved by the following steps:

[0059] Dividing the encrypted data into blocks according to the order of recording time to obtain multiple data blocks;

[0060] Multiple blocks are generated based on the consensus mechanism of the blockchain network, and each data block is stored in each block.

[0061] In the specific implementation, first, the corresponding encrypted data is divided into blocks according to the specified time period according to the chronological order of e-commerce operation data collection to obtain multiple data blocks. For example, the encrypted data corresponding to the operation data recorded on the same day can be grouped into one data block; then, multiple blocks are generated based on the consensus mechanism of the blockchain network (such as PoW or PoS), and each data block is stored in a different block according to the consensus algorithm. Each block contains a hash value pointing to the previous block. The hash value can ensure that the data is linked together in sequence, thereby achieving the integrity and consistency of the encrypted data storage.

[0062] In step 102, the historical behavior data of all users accessing the e-commerce cloud platform within a specified time period is obtained, the trust attributes of each user's access behavior are determined based on the historical behavior data, all the trust attributes are fuzzy mapped, and the fuzzy membership of each user's access behavior is obtained, and then the behavioral trust of the e-commerce cloud platform in the user's access process is determined through all the fuzzy memberships.

[0063] It should be noted that the specified time period in this application refers to the time period corresponding to the current moment to the past six months. In other embodiments, the specified time period may also include other time periods, which are not limited here. In specific implementation, obtaining the historical behavior data of all users accessing the e-commerce cloud platform within the specified time period can be achieved by adopting the following steps, namely: obtaining the behavior data of all users accessing the e-commerce cloud platform from the database of the e-commerce cloud platform from the current moment to the past six months, and then grouping all the obtained behavior data into a set as historical behavior data.

[0064] In some embodiments, determining the trust attribute of each user's access behavior based on the historical behavior data can be achieved by using the following steps:

[0065] Obtaining each user's historical behavior record from the historical behavior data;

[0066] Perform abnormal behavior detection on each user's historical behavior records to identify abnormal behavior characteristics of each user;

[0067] The trust attribute of each user's access behavior is determined through the abnormal behavior characteristics of each user.

[0068] It should be noted that the trust attribute in this application is an indicator to measure the credibility of user access behavior.

[0069] In the specific implementation, first, each user's behavior record is extracted from the historical behavior data. The record includes the user's browsing window, IP address, access timestamp, and access frequency. Then, the existing anomaly detection technology is applied to analyze the historical behavior record of each user to identify abnormal behavior characteristics. The abnormal behavior characteristics specifically include abnormal characteristics of IP address, abnormal characteristics of access time, and abnormal characteristics of access frequency. Among them, common anomaly detection methods include outlier detection based on statistics, machine learning algorithms (such as Isolation Forest) or deep learning methods (such as autoencoders), this application uses statistical outlier detection to detect abnormal behavior in the user's historical behavior records. Specifically, all behavioral data in the user's historical behavior records can be converted into numerical data, and the standard deviation of all numerical data and the mean can be calculated. If the Z-score of a data point exceeds the set threshold, it is judged to be abnormal, and the behavioral characteristics corresponding to the data point are used as abnormal behavior characteristics; finally, the abnormal behavior characteristics of each user can be represented by a vector, and the specific form of the vector is: [abnormal feature value of IP address, abnormal feature value of access time, abnormal feature value of access frequency], and the obtained vector is used as a trust attribute vector, and then each trust attribute vector is used to characterize the trust attribute of each user's access behavior.

[0070] In some embodiments, fuzzy mapping of all trust attributes to obtain the fuzzy membership of each user access behavior can be achieved by the following steps:

[0071] Divide all trust attributes into multiple fuzzy intervals;

[0072] Mapping the abnormal characteristic value in each trust attribute to the corresponding fuzzy interval to obtain the fuzzy mapping value of each trust attribute;

[0073] The fuzzy mapping value of each trust attribute is fuzzily evaluated through a preset membership function to obtain the fuzzy membership degree of each user's access behavior.

[0074] It should be noted that the fuzzy interval in this application is used to divide the abnormal characteristic values ​​of the trust attribute into sets of different ranges, and its function is to convert continuous behavioral characteristic values ​​into categories with fuzziness; the fuzzy membership in this application is an indicator to measure the degree of matching of user access behavior within different trust attribute fuzzy intervals.

[0075] In the specific implementation, first, a trust attribute vector reflecting the trust attribute is obtained, and all trust attributes are divided into three fuzzy intervals of normal, abnormal, and severely abnormal according to the size of the trust attribute vector modulus; then, for each trust attribute, the abnormal characteristic value of the IP address, the abnormal characteristic value of the access time, and the abnormal characteristic value of the access frequency are obtained from the trust attribute corresponding trust attribute vector, and then the abnormal characteristic value of the IP address, the abnormal characteristic value of the access time, and the abnormal characteristic value of the access frequency are weighted averaged, where the weight of each item can be determined by the ratio between the abnormal characteristic value corresponding to each item and the average value of its abnormal characteristic value, and the value obtained by the weighted average is used as the fuzzy mapping value of the trust attribute, and the fuzzy mapping value of each trust attribute can be obtained; finally, the triangular membership function can be used as the preset membership function, and the membership value of each fuzzy mapping value in the corresponding fuzzy interval is calculated by the triangular membership function, and the membership value of each fuzzy mapping value in the corresponding fuzzy interval can be used as the fuzzy membership of each user's access behavior.

[0076] In some embodiments, determining the trustworthiness of the e-commerce cloud platform in the user's access process through all fuzzy memberships can be achieved by the following steps:

[0077] Perform information entropy feature description on all fuzzy memberships to obtain membership entropy;

[0078] The trust evaluation of the typical behavior of users in accessing the e-commerce cloud platform is performed through the average value of all fuzzy memberships and the membership entropy, and the behavioral trust of the e-commerce cloud platform in the user's access process is obtained.

[0079] It should be noted that the membership entropy in this application is an indicator for measuring the uncertainty of the distribution of user behavior in various fuzzy intervals; the behavioral trust in this application is an indicator for measuring the credibility of users under specific behavioral patterns, which reflects the reliability of user behavior; in addition, it should be noted that the typical users in this application refer to a representative sample user group that can be used to evaluate and predict platform user behavior, and the behavioral pattern of this user group can reflect the access behavior of most users on the platform.

[0080] In specific implementation, first, all fuzzy memberships can be substituted into the information entropy calculation formula. The information entropy of the fuzzy membership can be obtained through the formula, and then the information entropy is used as the membership entropy. By calculating the entropy values ​​of all fuzzy memberships, the complexity of most user behaviors can be described. For example, if the user's behavior is relatively evenly distributed in the membership of multiple trust attributes (for example, there are both high anomalies and low anomalies), then its entropy value is large, indicating that the user's behavior is relatively unpredictable. If the membership is concentrated in a specific interval, the entropy value is small, indicating that the user behavior is relatively consistent. Then, by calculating the average value of all fuzzy memberships, an indicator representing the consistency of user behavior can be obtained. If the average value is high, it means that the user behavior is consistent in most trust attributes and the behavior is more trustworthy. If the average value is low, it means that the user behavior is relatively scattered and may be abnormal. Furthermore, the product of the natural exponential function value of the opposite number of the membership entropy and the average value of all fuzzy memberships can be used as the behavioral trust of the e-commerce cloud platform in the user access process.

[0081] In step 103, a behavior score of the target user is determined based on the historical behavior data of the target user within a specified time period, and an encrypted identity credential of the target user is determined based on the behavior score and the initial access level of the target user.

[0082] In some embodiments, reference Figure 3 As shown in FIG, this figure is a schematic diagram of the process of determining a behavior score in some embodiments of the present application. In this embodiment, determining the behavior score of a target user based on the historical behavior data of the target user within a specified time period can be achieved by using the following steps:

[0083] In step 1031, historical behavior data of the target user within a specified time period is obtained;

[0084] In step 1032, the behavior characteristics of the target user are extracted from the historical behavior data;

[0085] In step 1033, the target user's access behavior is evaluated based on the behavior characteristics to obtain a behavior score of the target user.

[0086] It should be noted that the behavior score in this application is an indicator to measure user preference behavior.

[0087] In the specific implementation, first, the system obtains all the historical behavior data of the target user in the past six months. The behavior data content usually includes visit records, browsed pages, stay time and click behavior; then, the key behavior features are extracted from the historical behavior data through the existing feature extraction model. The behavior features specifically include visit frequency, visit period, type of browsed pages and degree of interaction; finally, an evaluation model is initialized. The evaluation model can be trained based on the historical behavior data of other users, and then the extracted behavior features are input into the evaluation model to output a score for evaluating the user's visit behavior, and the score is used as the behavior score of the target user; it should be noted that the training process of the evaluation model is usually based on the user's historical behavior The goal is to build a model that can evaluate the behavior of new users by learning the preference behavior of existing users. The first step is to collect a large amount of historical behavior data of users and extract key behavior features (such as visit frequency, visit time, type of browsed pages and degree of interaction). The second step is to use these behavior features to train the model. Commonly used training algorithms include supervised learning methods (such as regression analysis, support vector machines, decision trees). The purpose is to predict the preference behavior score of the target user based on the behavior characteristics of the target user. During the training process, the evaluation model continuously optimizes the parameters to minimize the error between the predicted score and the actual score. After the training is completed, the evaluation model can generate a corresponding behavior score based on the user's behavior characteristics to reflect the user's behavior preference.

[0088] In some embodiments, determining the encrypted identity credentials of the target user based on the behavior score and the initial access level of the target user may be achieved by the following steps:

[0089] Define the initial access level for target users;

[0090] Obtain the target user's identity information;

[0091] The behavior score, the initial access level, and the identity information are digitally signed to obtain an encrypted identity credential of the target user.

[0092] It should be noted that the encrypted identity credential in this application is a credential generated by encrypting and digitally signing important data such as the user's identity information, behavior score, access level, etc. through encryption technology.

[0093] In specific implementation, first, the initial access level of the target user can be defined according to the activity and credit level of the target user, and a hierarchical system (such as ordinary users, advanced users, VIP users) can be used to represent it; then, the identity information of the target user is obtained from the database, and the identity information includes user ID, personal information and account information; finally, a hash value is generated by the behavior score, initial access level and identity information, and the hash value is encrypted by the key generated by the encryption function to obtain an encrypted hash value, and the encrypted hash value is generated into an encrypted identity certificate of the target user through digital signature technology, which ensures the authenticity of the user identity, the integrity and non-tamperability of the data. The digital signature of the certificate is generated by the private key of the target user, and its validity can be verified by the public key to ensure the security of user behavior and identity information.

[0094] It should be noted that the encrypted identity credentials in this application are stored in the blockchain.

[0095] In step 104, when the target user applies to access the encrypted data, the encrypted identity credentials are parsed through the smart contract in the blockchain network, and the target user's access rights are subject to minimum permission constraints based on the parsing result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorized scope of the target user's access to the encrypted data according to the encrypted access rights.

[0096] It should be noted that in this application, parsing the encrypted identity credentials through the smart contract in the blockchain network means using the smart contract on the blockchain to verify, decrypt and parse the encrypted identity credentials stored in the blockchain to determine the user's behavior score, access rights and other information; in specific implementation: first, the smart contract will use the public key of the target user to decrypt the encrypted identity credentials and extract key information such as the behavior score and initial access level; secondly, the smart contract will match this information with the platform's access control rules to verify whether the user has the authority to access certain data or perform specific operations; finally, the smart contract dynamically executes corresponding permission granting or restriction operations based on the parsing results, such as allowing or denying users to access sensitive data on the e-commerce cloud platform.

[0097] In some embodiments, the target user's access rights are subject to minimum permission constraints based on the analysis results and the behavior trust level, and the encrypted access rights of the target user are obtained by the following steps:

[0098] Obtaining the target user's behavior score and initial access level from the parsing result;

[0099] determining a first access permission for the target user based on the behavior score and the initial access permission level;

[0100] determining a second access permission for the target user according to the behavior score and the behavior trust;

[0101] Based on the principle of minimum constraints, the first access permission and the second access permission are constrained to obtain the encrypted access permission of the target user.

[0102] It should be noted that the first access right in this application refers to the basic access right, which is used to provide users with a preliminary access scope to ensure that their access rights match their behavioral characteristics and identity, thereby achieving preliminary permission control and security protection; in addition, the second access right refers to the compensatory access right, which is used to dynamically adjust the access rights of the target user according to the degree of abnormality of the target user's behavior, to ensure that the permission allocation is more flexible and in line with the user's actual behavior performance, thereby improving the security and refined management of the system; it should also be noted that the encrypted access right in this application refers to the user's permission to access encrypted data.

[0103] In specific implementation, determining the first access right of the target user by the behavior score and the initial access level can be implemented in the following manner, namely: the behavior score and the initial access level can be compared with the preset rules to obtain a basic access right, and the basic access right can be used as the first access right of the target user, wherein the preset rules are: judging the score interval of the behavior score, each score interval corresponds to an access right, and the access right corresponding to the behavior score can be obtained, each initial access level corresponds to an access right, and then the sum of the access right corresponding to the behavior score and the access right corresponding to the initial access level is used as the user's basic access right; determining the second access right of the target user according to the behavior score and the behavior trust can be implemented in the following manner, namely: the product of the behavior score and the behavior trust can be used as an adjustment factor for the access right, and then the adjustment factor is added to the preset rule. The adjustment factor interval is compared, and an access right is preset for each adjustment factor interval. The access right corresponding to the adjustment factor can be obtained by the above method, and the access right is used as the second access right of the target user; based on the minimum constraint principle, the encryption access right of the target user is obtained by constraining the first access right and the second access right. The following method is adopted, namely: the minimum permission constraint principle requires that the target user can only obtain the minimum permission required to perform the current task. The required permission required for the target user to apply for access to encrypted data can be obtained first, and the sum of the first access right and the second access right is used as the specific permission of the target user. Then, the required permission is compared with the specific permission. When the required permission is less than or equal to the specific permission, the required permission is used as the encryption access right of the target user. When the required permission is greater than the specific permission, the specific permission is used as the encryption access right of the target user.

[0104] It should be noted that limiting the authorized scope of the target user's access to the encrypted data based on the encryption access rights means controlling the user's access rights through encryption access rights, thereby limiting the scope of encrypted data that the user can access; in specific implementation, first, based on the encryption access rights of the target user, the system will identify the data range that the user is allowed to access; then, encryption technology, such as public key encryption, is used to protect the data access rights information; finally, by verifying the user's encryption identity credentials, it is ensured that the user's access request complies with its authorization scope, and access requests that do not meet the conditions are restricted, thereby achieving security control of data access.

[0105] On the other hand, in some embodiments, the present application provides a blockchain-based e-commerce operation data security protection system, referring to Figure 4 This figure is a schematic diagram of the structure of a blockchain-based e-commerce operation data security protection system according to some embodiments of the present application. The blockchain-based e-commerce operation data security protection system 400 includes: an encryption module 401, a processing module 402, and an execution module 403, which are described as follows:

[0106] Encryption module 401, in this application, is mainly used to perform homomorphic encryption processing on the e-commerce operation data of the e-commerce cloud platform to obtain encrypted data of the e-commerce cloud platform, and then distribute the encrypted data through various nodes of the blockchain network;

[0107] Processing module 402, in this application, is used to obtain historical behavioral data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attributes of each user's access behavior based on the historical behavioral data, perform fuzzy mapping on all trust attributes to obtain the fuzzy membership of each user's access behavior, and then determine the trust degree of the e-commerce cloud platform in the user's access process based on all the fuzzy memberships;

[0108] In the present application, the processing module 402 is further configured to determine a behavior score of the target user based on the historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user;

[0109] Execution module 403. The execution module 403 in this application is mainly used to parse the encrypted identity credentials through the smart contract in the blockchain network when the target user applies to access the encrypted data, and to perform minimum permission constraints on the target user's access rights based on the parsing results and the trust level of the behavior, to obtain the target user's encrypted access rights, and to limit the authorized scope of the target user's access to the encrypted data based on the encrypted access rights.

[0110] In addition, the present application also provides a computer device, which includes a memory and a processor, the memory stores code, and the processor is configured to obtain the code and execute the above-mentioned blockchain-based e-commerce operation data security protection method.

[0111] In some embodiments, reference Figure 5 , which is a schematic diagram of the structure of a computer device that implements a blockchain-based e-commerce operation data security protection method according to some embodiments of the present application. The blockchain-based e-commerce operation data security protection method in the above embodiment can be achieved by Figure 5 The computer device 500 shown in FIG. 5 is implemented as shown in FIG. 5 . The computer device 500 includes at least one processor 501 , a communication bus 502 , a memory 503 , and at least one communication interface 504 .

[0112] The processor 501 may be a general-purpose central processing unit (CPU) or an application-specific integrated circuit (ASIC).

[0113] The communication bus 502 may be used to transmit information between the aforementioned components.

[0114] The memory 503 may be a read-only memory (ROM) or other static storage device that can store static information and instructions, a random access memory (RAM) or other dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 503 may be independent and connected to the processor 501 via the communication bus 502. The memory 503 may also be integrated with the processor 501.

[0115] Memory 503 is used to store program code for executing the solution of the present application, and is controlled by processor 501 for execution. Processor 501 is used to execute the program code stored in memory 503. The program code may include one or more software modules. The blockchain-based e-commerce operation data security protection method in the above embodiment can be implemented by processor 501 and one or more software modules in the program code in memory 503.

[0116] The communication interface 504 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0117] In a specific implementation, as an embodiment, a computer device may include multiple processors, each of which may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0118] The aforementioned computer device may be a general-purpose computer device or a dedicated computer device. In a specific implementation, the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. The embodiments of the present application do not limit the type of computer device.

[0119] In addition, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned blockchain-based e-commerce operation data security protection method.

[0120] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0121] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A blockchain-based e-commerce operation data security protection method, characterized in that: The steps include: Performing homomorphic encryption on the e-commerce operation data of the e-commerce cloud platform to obtain encrypted data of the e-commerce cloud platform, and then distributing and storing the encrypted data through various nodes of the blockchain network; Obtain historical behavioral data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attributes of each user's access behavior based on the historical behavioral data, perform fuzzy mapping on all trust attributes, and obtain the fuzzy membership of each user's access behavior. Then, determine the trust degree of the e-commerce cloud platform in the user's access process based on all the fuzzy memberships. determining a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determining an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user; When a target user applies to access the encrypted data, the encrypted identity credentials are parsed through a smart contract in the blockchain network, and minimum permission constraints are imposed on the target user's access rights based on the parsing result and the trust level of the behavior, thereby obtaining the target user's encrypted access rights. The target user's authorized scope of access to the encrypted data is then limited based on the encrypted access rights. Among them, the e-commerce operation data of the e-commerce cloud platform is homomorphically encrypted, and the encrypted data of the e-commerce cloud platform specifically includes: Select a homomorphic encryption algorithm based on the encryption requirements of the e-commerce operation data; Generate a public key according to the homomorphic encryption algorithm; Encrypting the e-commerce operation data using the public key to obtain encrypted data of the e-commerce cloud platform; The distributed storage of the encrypted data through the nodes of the blockchain network specifically includes: Dividing the encrypted data into blocks according to the order of recording time to obtain multiple data blocks; Generate multiple blocks based on the consensus mechanism of the blockchain network, and store each data block in a separate block; Among them, the trust degree of the e-commerce cloud platform in the user's access process is determined by all fuzzy memberships, specifically including: Perform information entropy feature description on all fuzzy memberships to obtain membership entropy; The trust evaluation of the typical behavior of users in accessing the e-commerce cloud platform is performed through the average value of all fuzzy memberships and the membership entropy, and the behavioral trust of the e-commerce cloud platform in the user's access process is obtained.

2. The method according to claim 1, wherein Determining the trust attribute of each user's access behavior based on the historical behavior data specifically includes: Obtaining each user's historical behavior record from the historical behavior data; Perform abnormal behavior detection on each user's historical behavior records to identify abnormal behavior characteristics of each user; The trust attribute of each user's access behavior is determined through the abnormal behavior characteristics of each user.

3. The method according to claim 1, wherein Determining the encrypted identity credentials of the target user based on the behavior score and the initial access level of the target user specifically includes: Define the initial access level for target users; Obtain the target user's identity information; The behavior score, the initial access level, and the identity information are digitally signed to obtain an encrypted identity credential of the target user.

4. The method according to claim 1, wherein Based on the analysis results and the trust level of the behavior, the target user's access rights are subject to minimum permission constraints. The encrypted access rights of the target user are obtained, including: Obtaining the target user's behavior score and initial access level from the parsing result; determining a first access permission for the target user based on the behavior score and the initial access permission level; determining a second access permission for the target user according to the behavior score and the behavior trust; Based on the principle of minimum constraints, the first access permission and the second access permission are constrained to obtain the encrypted access permission of the target user.

5. A blockchain-based e-commerce operation data security protection system, which uses the method described in any one of claims 1 to 4 to perform e-commerce operation data security protection, characterized in that: The system includes: An encryption module is used to perform homomorphic encryption on the e-commerce operation data of the e-commerce cloud platform to obtain the encrypted data of the e-commerce cloud platform, and then distribute the encrypted data across various nodes of the blockchain network; A processing module is used to obtain historical behavioral data of all users accessing the e-commerce cloud platform within a specified time period, determine the trust attributes of each user's access behavior based on the historical behavioral data, perform fuzzy mapping on all trust attributes to obtain the fuzzy membership of each user's access behavior, and then determine the trust degree of the e-commerce cloud platform in the user's access process based on all the fuzzy memberships; The processing module is further configured to determine a behavior score of the target user based on historical behavior data of the target user within a specified time period, and determine an encrypted identity credential of the target user based on the behavior score and the initial access level of the target user; The execution module is used to parse the encrypted identity certificate through the smart contract in the blockchain network when the target user applies to access the encrypted data, and to impose minimum permission constraints on the target user's access rights based on the parsing result and the behavior trust, so as to obtain the target user's encrypted access rights, and limit the authorized scope of the target user's access to the encrypted data according to the encrypted access rights.

6. A computer device comprising a memory and a processor, wherein the memory stores a code, wherein: The processor is configured to obtain the code and execute the blockchain-based e-commerce operation data security protection method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the blockchain-based e-commerce operation data security protection method according to any one of claims 1 to 4 is implemented.

Images