Personal data cross-border circulation method based on block chain

Abstract

The invention discloses a personal data cross-border circulation method based on a block chain. The method comprises the steps of data acquisition and local storage, third-party neutral institution witness and data fingerprint chaining, data transmission and use authorization declaration, fingerprint verification and data verification on a receiver chain, and full-link tracing and dynamic auditing. Aiming at the problems that trust guarantee of personal data cross-border circulation depends on a single technical means such as centralized institution authentication or encrypted transmission or a static legal protocol, a trust transfer chain is lengthy, and cross-national legal mutual recognition is fragile, a data fingerprint anchoring system constructed based on a block chain is designed; aiming at the problems that traditional data cross-border authorization depends on a manual signing protocol or static strategy configuration, response lag exists, rule execution deviation exists, privacy protection and compliance auditing are difficult to consider and the like, a data use rule is dynamically constrained through an intelligent contract; a user defines a data use range, timeliness and an operation white list through a declarative intelligent contract, and contract codes are automatically executed after being subjected to consensus verification of nodes on a chain.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, relates to blockchain technology, and specifically is a method for cross-border circulation of personal data based on blockchain. Background Art

[0002] In traditional methods for cross-border circulation of personal data, one type of method is based on a legal compliance framework. By establishing a mutual recognition mechanism between countries or regions, it compulsorily requires data recipients to meet specific security standards, and relies on the approval and supervision mechanism of a centralized institution to promote the cross-border circulation of personal data. However, the centralized approval process of this method is time-consuming and lengthy, and it is difficult to adapt to high-frequency and fragmented cross-border business scenarios. Moreover, legal conflicts in different jurisdictions lead to the fragility of the mutual recognition mechanism. Another type of method uses differential privacy technology to add noise to the data set to obscure individual information. However, differential privacy needs to balance data availability and privacy protection intensity, and excessive noise injection may reduce the data value. Another type of method uses Secure Multi-Party Computation (SMPC) to achieve collaborative multi-party data computing without exposing the original data. However, technologies such as SMPC rely on complex cryptographic protocols and face network latency and computing power bottlenecks during cross-domain communication, making it difficult to support the demand for large-scale real-time data circulation. In view of the above problems and the technical characteristics of blockchain, this application provides a method for cross-border circulation of personal data based on blockchain. Summary of the Invention

[0003] The purpose of the present invention is to provide a method for cross-border circulation of personal data based on blockchain, so as to solve the problems of trust loss, data tampering, and authorization out of control in cross-border circulation of personal data, and realize safe, compliant, and efficient cross-border collaboration of multi-subject data.

[0004] The technical problems to be solved by the present invention are: how to construct a decentralized trust mechanism and dynamic compliance constraints to support the safe and controllable transfer of the entire cross-border link of personal data and multi-jurisdictional collaborative auditing.

[0005] The purpose of the present invention can be achieved through the following technical solutions: A method for cross-border circulation of personal data based on blockchain, including the following steps: Step 1: Data acquisition and local storage: The user securely downloads personal data from the data provider and stores it at a specified location, generating a storage path index.

[0006] Step 2: Third-party neutral agency witnessing and data fingerprint on-chain: With the authorization of the user, the third-party agency verifies the storage process and generates a hash value of the data file, and writes the fingerprint bound to the user identity into the blockchain for evidence storage.

[0007] Step 3: Data Transmission and Usage Authorization Declaration: The user transmits data to the recipient through a secure channel and synchronizes the usage authorization declaration based on the smart contract to the blockchain.

[0008] Step 4: On-chain Fingerprint Verification and Data Authenticity Verification by the Recipient: The recipient calculates the data hash and verifies it with the on-chain stored fingerprint. After matching, the authenticity verification is completed. If there is an anomaly, the usage process is terminated.

[0009] Step 5: Full-chain Traceability and Dynamic Auditing: Data usage behaviors are stored on the chain in real time, supporting users or regulatory parties to trace the operations throughout the life cycle and trigger compliance control.

[0010] In the said Step 1, the user downloads a personal information data packet from the data provider, including but not limited to the CSV / JSON format, ensures the transmission security through an encrypted transmission protocol, and stores the data at the location specified by the user, including but not limited to the local disk, private cloud storage, or distributed storage network. At the same time, a storage path index file is generated.

[0011] In the said Step 2, with the authorization of the user, a third-party neutral agency intervenes to verify the storage process. First, the agency verifies the user's identity and the integrity of the data packet through digital signature. Secondly, the SHA-256 algorithm is used to calculate the data file hash value to generate a unique "data fingerprint". Finally, the fingerprint is bound with the user identity identifier and timestamp and written into the public chain or consortium chain to form an immutable evidence record. Given the architectural differences between the public chain and the consortium chain in the cross-border data flow scenario, where the overseas data processing nodes are mainly deployed in the public chain network and the domestic data processing nodes mainly rely on the consortium chain network, the current cross-border data transmission protocol needs to fully consider the heterogeneous technical characteristics of these two types of distributed ledgers.

[0012] In the said Step 3, the user transmits the original data file to the data recipient through a secure channel such as IPFS or end-to-end encryption, and attaches an authorization declaration based on the smart contract, including but not limited to usage scope restrictions, validity period, and purpose description; the contract automatically synchronizes the authorization terms to the blockchain.

[0013] In the said Step 4, after the data recipient downloads the file, the data file hash value is calculated locally, and the original fingerprint in the evidence record is retrieved through a blockchain browser or API interface; the consistency of the two is compared. If they match, an authenticity verification certificate is generated; if they do not match, an alarm is triggered and the data usage process is terminated.

[0014] In the said Step 5, all data usage behaviors, including but not limited to the recipient's access records, data processing operations, etc., are uploaded to the chain in real time through event logs and stored in a compressed manner using the Merkle tree structure; users or regulatory parties can query the chain records according to conditions such as time range and operation type to achieve full life cycle traceability. If a violation is found, the smart contract automatically freezes the data access permission and notifies the user.

[0015] The present invention has the following beneficial effects: 1. Regarding the trust guarantee for the cross-border flow of personal data, which mainly relies on single technical means such as centralized institution authentication or encrypted transmission, or static legal agreements, there are problems such as a long trust transfer chain and fragile cross-border legal mutual recognition. A data fingerprint anchoring system based on blockchain technology is designed. After binding the hash value of the data file, the user's digital identity, and the timestamp, they are written into the permission chain. Utilizing the immutable feature of the blockchain to achieve the permanent storage of the data status. This method breaks through the limitation that traditional hash verification is only used in the transmission link, extends the data credibility verification to the storage source, and forms a full-cycle anchoring chain of "generation - storage - transmission - use". The data recipient does not need to rely on the repeated verification of the original data provider, and only needs to verify the fingerprint on the chain to confirm the data integrity and source legality, improving the verification efficiency.

[0016] 2. Regarding the traditional cross-border data authorization, which relies on manual signing of agreements or static policy configuration, there are problems such as lagging response, deviation in rule execution, and difficulty in balancing privacy protection and compliance auditing. A method of dynamically constraining data usage rules through smart contracts is designed. In the data transmission stage, the user defines the data usage scope, validity period, and operation whitelist through declarative smart contracts. After the contract code is verified by the consensus of the nodes on the chain, it is automatically executed. At the same time, the data usage behavior is encrypted and summarized and uploaded to the chain in real time. On the premise of ensuring privacy, cross-border data full-link behavior tracing is realized, reducing the risk of privacy leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flowchart of a method for cross-border flow of personal data based on blockchain in the present invention.

[0018] Figure 2 is an example schematic diagram of a method for cross-border flow of personal data based on blockchain in the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] In order to make the objectives, technical solutions, and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. Embodiment 1

[0020] A method for cross-border flow of personal data based on blockchain includes the following steps: Step 1: Data acquisition and local storage: The user securely downloads personal data from the data provider and stores it in a specified location, generating a storage path index.

[0021] The user downloads a personal information data packet from the data provider, including but not limited to the CSV / JSON format, ensures the security of the transmission through an encrypted transmission protocol, and stores the data at the location specified by the user, including but not limited to the local disk, private cloud storage, or distributed storage network, while generating a storage path index file.

[0022] In terms of the encrypted transmission protocol: The transmission between the user and the data provider adopts the TLS 1.3 protocol or a quantum-resistant encryption protocol (such as NTRU) to ensure the security of the transport layer and prevent man-in-the-middle attacks; for large-scale data packets, the IPFS protocol is used to achieve distributed transmission, and decentralized addressing is achieved through the content identifier (CIDv1) to avoid single points of failure. After the data is chunked, the BLS signature aggregation technology is used to verify the transmission integrity.

[0023] In terms of strengthening storage security: Local storage supports the hardware security module (HSM) to perform XTS-AES full-disk encryption, and the key management follows the FIPS 140-3 standard. The storage key is decoupled from the identity authentication through key hierarchical derivation (HKDF-SHA512); the distributed storage network (such as IPFS) adopts the sharding encryption technology. After the data is sharded, it is stored in different nodes respectively, and the complete file can be recombined only through the user's private key.

[0024] After the user downloads the data, local storage is completed through the encryption protocol and the storage security module (labeled as "HSM"), and a UUID index is generated and recorded in the on-chain metadata table.

[0025] Step 2: Third-party neutral agency witnessing and data fingerprint on-chain: With the user's authorization, the third-party agency verifies the storage process and generates the hash value of the data file, and writes the fingerprint into the blockchain for evidence after binding it with the user's identity.

[0026] With the user's authorization, a third-party neutral agency intervenes to verify the storage process. First, the agency verifies the user's identity and the integrity of the data packet through digital signatures; second, the SHA-256 algorithm is used to calculate the hash value of the data file to generate a unique "data fingerprint"; finally, the fingerprint is bound with the user's identity identifier and timestamp and written into the public chain or consortium chain to form an immutable evidence record. Given the architectural differences between the public chain and the consortium chain in the scenario of cross-border data flow, where the overseas data processing nodes are mainly deployed in the public chain network and the domestic data processing nodes mainly rely on the consortium chain network, the current cross-border data transmission protocol needs to fully consider the heterogeneous technical characteristics of these two types of distributed ledgers.

[0027] Qualification requirements for the third-party agency: The agency needs to pass the timestamp authentication of the National Time Service Center to ensure that the evidence time cannot be tampered with; it needs to have the compliance certification of the TEE (Trusted Execution Environment) of the Ministry of Industry and Information Technology to verify the physical security of the storage node (such as tamper-proof hardware).

[0028] Hash algorithm compatibility design: The domestic data processing nodes use the national cryptographic SM3 algorithm to generate data fingerprints, meeting the requirements of China's Cybersecurity Law; the overseas nodes use the SHA-3 algorithm, and the mapping verification of the dual-algorithm hash values is realized through cross-chain smart contracts.

[0029] Evidence storage chain selection strategy: Domestic data evidence storage is written into the consortium chain (such as FISCO BCOS), supporting real-time auditing by regulatory agencies; overseas data evidence storage is written into the public chain (such as Ethereum), leveraging its decentralized characteristics to ensure cross-border mutual trust.

[0030] Third-party institutions verify storage nodes (labeled as "secure containers") in the TEE environment, generate hashes and write them into the domestic consortium chain and overseas public chain respectively, synchronize the dual-chain hash values through cross-chain oracles, and adopt threshold signature (TSS) technology to ensure the security of cross-chain operations.

[0031] Step 3: Data transmission and usage authorization statement: Users transmit data to the recipient through a secure channel, and synchronize the usage authorization statement based on the smart contract to the blockchain.

[0032] Users transmit the original data file to the data recipient through a secure channel such as IPFS or end-to-end encryption, and attach an authorization statement based on the smart contract, including but not limited to usage scope restrictions, validity period, and purpose description; the contract automatically synchronizes the authorization terms to the blockchain.

[0033] Secure channel technologies include: adopting end-to-end encryption (such as the Signal protocol) to ensure that only the sender and recipient can decrypt the data; for sensitive data, adding homomorphic encryption transmission to allow the recipient to perform calculations in the ciphertext state.

[0034] Smart contract dynamic authorization: The authorization statement follows the OAuth 2.1 standard extension, including spatio-temporal constraints (Geo-fencing), differential privacy parameters (ε≤1), and the permission to call the federated learning model. The statement file is compressed and stored in the CBOR encoding format. The authorization statement supports multi-condition nested logic (such as "only allowing access from European IP addresses and the number of uses ≤ 5 times"); the contract code is ensured to be vulnerability-free through formal verification tools (such as CertiK) to avoid bypassing the authorization rules.

[0035] When the smart contract is deployed, it triggers on-chain consensus verification (labeled as "node verification"). After the contract logic is formally verified, it takes effect, and the authorization rules are transmitted bound to the data file.

[0036] Step 4: The recipient verifies the data hash on the chain and authenticates the data: The recipient calculates the data hash and verifies it with the on-chain evidence storage fingerprint. After matching, the authentication is completed. If there is an anomaly, the usage process is terminated.

[0037] After the data recipient downloads the file, the data file hash value is calculated locally, and the original fingerprint in the deposit record is retrieved through a blockchain browser or API interface; the consistency of the two is compared. If they match, an authenticity verification certificate is generated; if they do not match, an alarm is triggered and the data usage process is terminated.

[0038] Zero-Knowledge Proof (ZKP) implementation: The recipient uses the zk-SNARKs protocol to generate a proof to verify the consistency between the local hash and the on-chain fingerprint without exposing the original data; a verification key is pre-set on the chain, and the validity of the proof is quickly verified through lightweight calculations.

[0039] Exception handling mechanism: When the hashes do not match, a verifiable audit report is automatically generated, triggering an on-chain reputation penalty mechanism to reduce the reputation score of the recipient node; if the continuous exceptions exceed the threshold, the smart contract automatically adds the recipient to the cross-border data blacklist and prohibits subsequent interactions.

[0040] The authenticity verification process achieves privacy protection through the zk-SNARKs protocol (labeled as the "ZKP module"), and the verification result is written into the on-chain event log.

[0041] Step Five: Full-chain traceability and dynamic auditing: Data usage behaviors are stored on the chain in real time, supporting users or regulatory parties to trace the operations throughout the life cycle and trigger compliance control.

[0042] All data usage behaviors, including but not limited to the recipient's access records, data processing operations, etc., are uploaded to the chain in real time through event logs and stored in a compressed manner using the Merkle tree structure; users or regulatory parties can query the on-chain records according to conditions such as time range and operation type to achieve full-life cycle traceability. If a violation is found, the smart contract automatically freezes the data access permission and notifies the user.

[0043] Cross-chain traceability technology: Use Chainlink oracles to monitor events on domestic consortium chains and overseas public chains, and synchronize logs through a standardized interface (such as JSON-RPC); the log format follows the W3C Verifiable Credentials specification, supporting multi-chain compatible parsing.

[0044] Dynamic compliance control: Violation behaviors (such as accessing beyond geographical boundaries) trigger automatic forfeiture by the smart contract, freezing the token assets pledged by the recipient; regulatory agencies can trace the full-chain operations through a cross-chain browser, supporting one-click generation of audit reports. When advanced persistent threat (APT) features are detected, a trusted execution environment sandbox is enabled to isolate suspicious operations, and the permission status of all network nodes is updated in real time through the CRL (Certificate Revocation List) broadcast protocol.

[0045] The cross-chain oracle (labeled as "Oracle node") synchronizes the domestic / overseas chain logs, and the regulator monitors the data flow, operation behavior, and the associated relationship of device fingerprints in real time through the audit interface (labeled as "Regulatory Panel"), supporting Time Travel Query to trace back the state at any moment. Example 2

[0046] See Figure 2 As shown, taking Mr. Wang, a user in Area A in China, applying for a loan from a financial institution in Area B overseas as an example, personal data needs to be cross-border circulated between Area A in China and Area B overseas.

[0047] Step 1: Data acquisition and local storage. Mr. Wang, a user in Area A in China, downloads the personal credit report and bank statement data files through the secure interfaces of data providers such as the People's Bank of China Credit Reference Center and commercial banks, encrypts and stores them in a local encrypted hard drive or a private cloud storage node, and at the same time generates a unique identifier (UUID) containing the storage path and the encrypted key index as the logical index for subsequent data calls.

[0048] Step 2: Witness by a third-party neutral institution and data fingerprint on-chain. The user authorizes the National Time Service Center and a third-party CA institution certified by the Ministry of Industry and Information Technology to witness the storage process. The third-party institution verifies the physical security of the storage node and the user's biometric characteristics through a Trusted Execution Environment (TEE); performs a SHA-3 hash operation on the encrypted data file stored by the user to generate a 256-bit data fingerprint, which is bound to the user's digital identity; writes the data fingerprint, user identity identifier, timestamp, and the third-party digital signature into a permissioned chain to generate a proof-of-storage block, completing the solidification of the data state.

[0049] Step 3: Data transmission and usage authorization statement.

[0050] When the user submits a loan application to a bank in Area B overseas, the encrypted data file stored locally is transmitted to the recipient through a TLS 1.3 encrypted channel, synchronously triggering a smart contract. Declare the data usage authorization rules on the blockchain, including the usage purpose (only for loan risk assessment), validity period (30 days), and geographical restriction (only accessible to servers in Area B); the smart contract binds the recipient's public key (based on the RSA-3072 algorithm) and the operation permission whitelist (such as prohibiting data forwarding to a third party), and the contract code takes effect after being consensus-verified by the on-chain nodes.

[0051] Step 4: Fingerprint verification and data authenticity verification on the recipient chain. After receiving the data file, the bank in Region B overseas calls the blockchain interface to obtain the fingerprint of the deposited data and the authorization terms of the smart contract; locally calculates the SHA-3 hash value of the data file, and verifies its consistency with the on-chain fingerprint through the zero-knowledge proof protocol to ensure that the data has not been tampered with; if the hash matches and the authorization is compliant, decrypt the data and enter the loan review process; if there are anomalies such as a mismatch in the hash value or exceeding the authorized region, immediately terminate the process and trigger an on-chain violation warning event.

[0052] Step 5: Full-chain traceability and dynamic auditing.

[0053] During the data usage process, the system executes an on-chain tracking mechanism: all operations of the bank on the data generate event logs through the smart contract, recording the operation timestamp, operation type, and data summary; users can query the complete usage record of the data in Region B through the blockchain browser, and if unauthorized usage is found, they can trigger the smart contract to automatically freeze the data access permission; the regulatory agency synchronizes the on-chain logs based on the cross-chain protocol to conduct automated compliance audits on cross-border data behaviors.

[0054] Through this embodiment, it can be seen that the method for cross-border circulation of personal data based on blockchain prevents data from being tampered with before and after cross-border through third-party witness and on-chain fingerprint anchoring; the non-repudiable log based on the timestamp supports regulatory collaboration in multiple jurisdictions and reduces cross-border legal disputes.

[0055] The above embodiments are only used to illustrate the technical idea of the present invention, and the protection scope of the present invention cannot be limited thereby. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention fall within the protection scope of the present invention.

Claims

1. A method for cross-border circulation of personal data based on blockchain, characterized in that: The method comprises the following steps: Step 1: The user securely downloads personal data from the data provider and stores it in a designated location, generating a storage path index; Step 2: With the user's authorization, a third-party organization verifies the storage process and generates a hash value for the data file, binds the fingerprint to the user's identity, and writes it into the blockchain for evidence storage; Step 3: The user transmits data to the recipient through a secure channel and synchronizes the authorization statement based on the smart contract to the blockchain; Step 4: The recipient calculates the data hash and verifies it with the fingerprint stored on the chain. After matching, the authentication is completed. If there is an exception, the usage process is terminated; Step 5: Data usage behavior is stored on the chain in real time, allowing users or regulators to trace operations throughout the entire life cycle and trigger compliance controls.

2. The method for cross-border circulation of personal data based on blockchain as claimed in claim 1, characterized in that: The step one includes the following contents: the user downloads the personal information data package from the data provider, ensures the transmission security through an encrypted transmission protocol, and stores the data to the location specified by the user, which is a local disk, private cloud storage or distributed storage network, and generates a storage path index file.

3. The method for cross-border circulation of personal data based on blockchain as claimed in claim 1, characterized in that: The step 2 includes the following contents: with the authorization of the user, a third-party neutral organization intervenes to verify the storage process. First, the organization verifies the user identity and data packet integrity through a digital signature; second, the SHA-256 algorithm is used to calculate the hash value of the data file to generate a unique "data fingerprint"; finally, the fingerprint is bound to the user identity and timestamp, and written into a public chain or consortium chain to form an unalterable evidence record.

4. The method for cross-border circulation of personal data based on blockchain as claimed in claim 1, characterized in that: The step three includes the following contents: the user transmits the original data file to the data recipient through a secure channel and attaches an authorization statement based on a smart contract, including but not limited to usage scope restrictions, validity period and purpose description; the contract automatically synchronizes the authorization terms to the blockchain.

5. The method for cross-border circulation of personal data based on blockchain as claimed in claim 1, characterized in that: The step four includes the following contents: after the data recipient downloads the file, the hash value of the data file is calculated locally, and the original fingerprint in the evidence record is retrieved through the blockchain browser or API interface; the two are compared for consistency, and if they match, a verification certificate is generated; if they are inconsistent, an alarm is triggered and the data usage process is terminated.

6. The method for cross-border circulation of personal data based on blockchain as claimed in claim 1, characterized in that: Step five includes the following: all data usage behaviors are uploaded to the chain in real time through event logs and stored in a Merkle tree structure; users or regulators can query on-chain records according to time range and operation type conditions to achieve full life cycle traceability; if any violation is found, the smart contract automatically freezes data access rights and notifies the user.

7. A device for cross-border circulation of personal data based on blockchain, characterized in that: Data acquisition and local storage module: users securely download personal data from data providers and store it in a designated location, generating a storage path index; Third-party neutral institution witness and data fingerprint chain module: after user authorization, the third-party institution verifies the storage process and generates a data file hash value, binds the fingerprint to the user identity and writes it into the blockchain for evidence storage; Data transmission and authorization statement module: users transmit data to recipients through a secure channel, and synchronize authorization statements based on smart contracts to the blockchain; Receiver on-chain fingerprint verification and data authentication module: The receiver calculates the data hash and verifies it with the on-chain evidence fingerprint. After matching, the authentication is completed. If an exception occurs, the usage process is terminated; Full-link traceability and dynamic audit module: Data usage behavior is stored on the chain in real time, supporting users or regulators to trace full life cycle operations and trigger compliance control.

8. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the method according to any one of claims 1 to 6.

9. A terminal device, characterized in that: The terminal device includes: a processor, a memory, a communication interface and a bus; the processor, the memory and the communication interface are connected through the bus and communicate with each other; the memory stores executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any one of claims 1 to 6 above.

Images