A data security and privacy management method and system based on blockchain technology

Abstract

This invention discloses a data security and privacy management method and system based on blockchain technology, comprising the following steps: S1, collecting raw data from the target system and preprocessing it; S2, constructing an access control policy set; S3, converting it into a structured policy configuration file and deploying a smart contract; S4, the smart contract matching and judging access requests against preset policies; S5, judging whether the access request is legitimate; S6, structuring the access logs and writing them into the blockchain ledger; S7, intelligently selecting an encryption mechanism and providing the access return data to the accessing party; S8, using a federated gradient boosting tree algorithm to model and predict access patterns. This invention integrates blockchain smart contracts and the federated gradient boosting tree algorithm, combined with differential privacy, zero-knowledge proof, and homomorphic encryption technologies, to achieve intelligent and refined data privacy protection, possessing advantages such as high reliability, strong intelligence, and strong traceability.

Description

Technical Field

[0001] This invention relates to the field of data security and privacy protection technology, and in particular to a data security and privacy management method and system based on blockchain technology. Background Art

[0002] With the rapid development of the digital society, in data usage scenarios involving multi-entity collaboration and cross-system interaction, how to achieve efficient sharing and authorized access while ensuring data security and privacy has become a crucial issue that current information security technologies urgently need to address.

[0003] Currently, access control in data sharing and management systems typically employs a centralized access control architecture. Traditional access control mechanisms, such as those based on access control lists, role-based access control, and attribute-based access control, rely on centralized servers for policy configuration and access verification. This approach has several significant drawbacks: Firstly, the policy configuration process is opaque, with the definition, modification, and execution of access rules often handled manually by system administrators, making them susceptible to human error or abuse of permissions. Secondly, it is difficult to achieve full-process traceability and auditability of data access behavior and permission changes, especially in cross-organizational and cross-platform data flows, where data responsibility delineation and security auditing have inherent weaknesses.

[0004] Furthermore, traditional data security mechanisms often employ static encryption and access credentials, which in practice often fail to provide dynamic protection for sensitive data. Once data is authorized for access, the system struggles to control the specific use of the data by the accessing party and lacks in-depth analysis and judgment of access behavior. This "allow-to-go" management approach is no longer sufficient to meet the technical demands for refined management of data assets and controllable risks in the context of current higher requirements for data compliance, security, and privacy protection.

[0005] In recent years, blockchain technology has gradually become an important technical support for data management systems due to its decentralized, tamper-proof, and traceable characteristics. By deploying smart contracts on the blockchain, access control rules can be solidified in the form of code logic, automatically executing access judgment logic and recording operation results, effectively reducing the risks of human intervention and configuration. However, existing permission management solutions that combine blockchain and smart contracts focus more on the judgment and recording of basic access rules, lacking the ability to dynamically identify and adapt to complex access behaviors. At the same time, most solutions have failed to fully integrate user behavior data for model learning, nor have they formed an automatic evolution mechanism for access control policies, resulting in insufficient system intelligence and adaptability.

[0006] In terms of data privacy protection, although there are various technical approaches such as differential privacy, homomorphic encryption, and zero-knowledge proof, existing solutions generally face the problems of single algorithms and lack of flexible scheduling mechanisms. Most privacy protection methods are effective for specific scenarios, but they cannot dynamically select the most suitable encryption or desensitization scheme based on multiple dimensions such as data sensitivity, access frequency, and user attributes. At the same time, data protection technology and access control logic are often disconnected, failing to form a unified privacy protection control chain, resulting in a fragmented system architecture and limited protection capabilities.

[0007] Furthermore, most current access control systems rely on static configuration rules and lack the ability to model and predict based on historical access data. In large-scale distributed systems, different nodes accumulate a large amount of user behavior, data call and operation logs. If these data cannot be effectively utilized, potential abnormal access patterns cannot be discovered, and access policies cannot be optimized and upgraded in a data-driven manner. Existing permission learning methods generally rely on centralized data modeling, which is difficult to deploy in privacy-sensitive environments or environments where data cannot be centrally stored, and lacks federated modeling mechanisms for multi-party collaborative scenarios.

[0008] In summary, existing technologies still have the following main problems in achieving data security and privacy management: First, access control mechanisms rely on centralized deployment, the rule configuration process is opaque and easily tampered with, and lacks the ability to automatically execute and record on the blockchain; Second, access control policies are static and fixed, unable to be automatically adjusted and optimized based on historical behavior, and lack learning and evolution capabilities; Third, privacy protection mechanisms are separated from access control, lacking dynamic protection strategies that combine user characteristics and data sensitivity; Fourth, existing solutions are difficult to achieve collaborative modeling and policy sharing in a distributed data environment with multiple institutions and nodes, and cannot effectively support cross-system data security management.

[0009] Therefore, there is an urgent need to propose a comprehensive solution that combines blockchain, smart contracts, privacy-preserving algorithms, and federated learning. This solution should ensure transparent and trustworthy data access control while automating policy configuration, enabling adaptive privacy processing, and making access behavior auditable and predictable. In this way, an intelligent, efficient, and trustworthy data security and privacy management system can be built. Summary of the Invention

[0010] One objective of this invention is to propose a data security and privacy management method and system based on blockchain technology. This invention integrates blockchain smart contracts and federated gradient boosting tree algorithm to construct a decentralized and adaptive data access control mechanism, realizes dynamic optimization of access policies and automatic on-chain execution, and combines differential privacy, zero-knowledge proof and homomorphic encryption technology to achieve intelligent and refined privacy protection of data in the sharing process. It has the advantages of high credibility, strong intelligence and strong traceability.

[0011] A data security and privacy management method based on blockchain technology according to an embodiment of the present invention includes the following steps:

[0012] S1. Collect raw data from the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset.

[0013] S2. Construct an access control policy set based on a standardized dataset;

[0014] S3. Convert the access control policy set into a structured policy configuration file, generate contract code based on a preset contract template, compile and deploy it as a smart contract to each node in the blockchain network;

[0015] S4. When an access request is received, the access request is submitted to the blockchain network as a transaction, and the smart contract matches and judges the access request with the preset strategy.

[0016] S5. Determine whether the access request is valid based on the execution result of the smart contract. If it is valid, record the access authorization event and allow access. If it is invalid, deny access and record the denial event.

[0017] S6. Structure the access control results, request information and smart contract execution logs, and write them onto the blockchain ledger to form a record of data access behavior.

[0018] S7. Based on the visitor's identity, target data type, and access frequency, intelligently select differential privacy mechanism, zero-knowledge proof mechanism, or homomorphic encryption mechanism to perform privacy protection processing on the access returned data before providing it to the visitor;

[0019] S8. Based on the data usage and access behavior records in each storage node, the access pattern is modeled and predicted using the federated gradient boosting tree algorithm. The access control policy set is dynamically optimized according to the prediction results, the contract code is regenerated, and the updated smart contract is deployed to the blockchain network.

[0020] Optionally, the raw data includes user identity information, access request, data type, and data resource identifier, and the preprocessing includes format conversion, time synchronization, noise filtering, and normalization.

[0021] Optionally, the access control policy includes accessing users, target resources, operation permissions, authorization conditions, and effective time ranges.

[0022] Optionally, S2 specifically includes:

[0023] S21. Extract access control-related feature variables from the standardized dataset and construct an initial feature set F = {f1, f2, ..., f...}n}, where f n These represent characteristic variables, including user identity, user role, request time, requested resource type, resource sensitivity level, and historical access status.

[0024] S22. Perform one-hot encoding on the categorical variables in the initial feature set F to generate a sparse feature matrix X = {x} ij}, where x ij This represents the encoded value of the i-th access record on the j-th feature;

[0025] S23. Given a sparse feature matrix X and a set of historical access authorization record tags Y = {y} i} to perform association, where y i ∈{0,1} represents the access control result of the i-th record, where 1 indicates that access is allowed and 0 indicates that access is denied;

[0026] S24. Construct the access control scoring function S(i) and use a linear weighted model to score access records:

[0027]

[0028] Where S(i) represents the access control scoring function, w j Let x represent the weight vector of the j-th feature. ij This represents the encoded value of the i-th access record on the j-th feature;

[0029] S25. Set an access control threshold θ, and generate an access policy label based on the comparison between the access control scoring function calculation result and the threshold. When the access control scoring function value is greater than the access control threshold, the access policy label is 1, and when the access control scoring function value is less than the access control threshold, the access policy label is 0.

[0030] S26. The feature variables and weight vector W = {w1, w2, ..., w...} involved in the access control scoring function are... n The access control threshold θ and the access decision result are used as access control policy rules, and recorded as a policy entry set P = {p1, p2, ..., p...} k};

[0031] S27. Generate an access control policy set based on the policy entry set P, and store it as a structured configuration file as input for subsequent smart contract generation and deployment.

[0032] Optionally, S3 specifically includes:

[0033] S31. Parse the fields of each policy in the access control policy set, extract the access user identifier, resource identifier, operation type, permission type and effective time range, and construct a structured configuration item;

[0034] S32. Combine all configuration items into a configuration file data structure;

[0035] S33. Load a preset contract template, wherein the preset contract template includes a contract declaration area, a permission judgment function, an event triggering function, a state variable definition area, and a rule definition area;

[0036] S34. Based on the configuration items in the structured strategy configuration file, insert each item into the rule definition area of ​​the preset contract template through the rule mapping logic, and automatically generate the contract code file.

[0037] S35. Compile the generated contract code file to obtain the smart contract bytecode;

[0038] S36. By calling the deployment function through the blockchain interface, the smart contract bytecode is deployed to all predefined contract nodes in the blockchain network, generating a set of on-chain contract addresses, and establishing a mapping relationship between the configuration file identifier and the corresponding contract address to complete the smart contract deployment operation.

[0039] Optionally, S4 specifically includes:

[0040] S41. After receiving a user access request, extract the access parameters and construct an access request quadruple. The access request quadruple includes the identity identifier of the accessing user, the unique identifier of the target resource, the operation type requested by the user, and the submission time of the access request.

[0041] S42. Package the access request quadruple into a transaction data structure, and define the access transaction as TX = R, Sig, TS, where TX represents the access request transaction object, R represents the access request quadruple, Sig represents the digital signature of the requesting user, and TS represents the timestamp of the transaction submission.

[0042] S43. Submit the access transaction TX to the blockchain network through the blockchain client interface and send it to the node containing the access control smart contract;

[0043] S44. The smart contract on the node parses the received access transaction and calls the permission judgment function;

[0044] S45. In the smart contract, load the preset access control policy set P, perform a matching operation, and determine whether policy p exists. j Conditions met:

[0045]

[0046] Among them, UID i and UID j The RID represents the user identifier allowed by the policy. i and RID j Indicates the corresponding resource identifier, OP i and OP j Indicates the allowed operation types. Indicates the time range during which the policy takes effect, Auth i This indicates the policy authorization result: 1 for allowed access, 0 for denied access, ∧ for a logical AND operation to determine if all conditions are met simultaneously, UID for the accessing user, RID for the target resource, OP for the operation type, T for the access request time, and p. i This represents the i-th access control policy;

[0047] S46. If there exists a strategy p that satisfies the condition... j If the match is successful, the smart contract will output the access control result:

[0048] checkAccess(R) = Auth j ;

[0049] Where checkAcces(R) represents the access determination result, Auth j This represents the authorization value of the matching strategy, and R represents the access request quadruple.

[0050] Optionally, S7 specifically includes:

[0051] S71. Parse the user identifier field, resource identifier field, and resource type field in the access transaction, and retrieve the historical interaction records between the corresponding user and the resource in the data usage log, and count the number of accesses F;

[0052] S72. Query the sensitivity level corresponding to resource type DT from the resource tag library and assign it to the sensitivity level set:

[0053] DT∈{T1,T2,T3};

[0054] Where DT represents the query resource type, T1 represents ordinary data, T2 represents data containing restricted fields, and T3 represents data containing critical privacy information;

[0055] S73. Based on the sensitivity level and access frequency, invoke the rule matching logic to execute the privacy mechanism selection process, and output the protection mechanism type M based on the conditions. The rule matching logic includes:

[0056] When the queried resource type is ordinary data and the number of accesses is less than the access frequency threshold, the protection mechanism type is set to differential privacy mechanism;

[0057] When the queried resource type contains data with restricted fields and the number of accesses exceeds the access frequency threshold, the protection mechanism type is set to zero-knowledge proof mechanism;

[0058] When querying data containing critical privacy information, set the protection mechanism type to homomorphic encryption.

[0059] S74. Execute according to the selection result, including:

[0060] When the differential privacy mechanism is selected, the perturbation generation function is called to add a random noise term ε to the original data D, and the noise addition calculation is performed:

[0061] D * =D+ε,ε~Lap(0,λ);

[0062] Among them, D * The data after adding noise is represented by ε, where D represents the original data, ε represents the noise variable following a Laplace distribution, Lap represents the Laplace distribution, and λ represents the set privacy budget parameter.

[0063] When the zero-knowledge proof mechanism is selected, the zero-knowledge proof mechanism construction module is invoked to generate the proof content π, and the original data D is bound to the proof structure, combining the data format as follows:

[0064] D * = (D, π);

[0065] Among them, D * π represents the combined data, and π represents the content of the proof.

[0066] When the homomorphic encryption mechanism is selected, the encryption parameters PK = (n, g) are loaded, and the Paillier encryption function is used to perform the encryption operation:

[0067] D * =E PK (D)=g D ·r n mod n 2 ;

[0068] Among them, D * Let D represent the ciphertext data, g and n represent the homomorphic encryption public key parameters, r represent the encrypted random number, mod represent the modulo operator, and E represent the ciphertext data. PK This indicates a homomorphic encryption mechanism;

[0069] S75. After the data processing is completed, the scrambled data, binding proof, or ciphertext data is injected into the response module and sent to the requesting user as an access response.

[0070] Optionally, S8 specifically includes:

[0071] S81. The system executes a data collection program on each storage node in the blockchain network, reads the data usage behavior and data access behavior records of the nodes, extracts user identifier, resource identifier, operation type, access time and access judgment value, and constructs a local structured training dataset.

[0072] S82. Each node initializes the substructure of the gradient boosting tree algorithm locally according to the local modeling process of the federated gradient boosting tree algorithm, sets the number of tree rounds to G, trains the weak classifier round by round on the local structured training dataset, executes the boosting calculation process, and generates a decision tree in each round:

[0073]

[0074] in, Let α represent the prediction result for the j-th sample. t This represents the learning rate of the t-th subtree. This represents the decision tree generated by the i-th node in the t-th round of training. Let G represent the feature vector of the j-th sample, and G represent the total number of tree turns.

[0075] S83. Calculate the first and second gradient values ​​of the samples in each training round:

[0076]

[0077] in, This represents the first-order gradient value. This represents the second-order gradient value. Indicates the true label of the sample Compared with the predicted value The loss function between This represents the differentiation operation. Indicates the true label of the sample;

[0078] S84. Each node, based on the collaborative training mechanism of the federated gradient boosting tree algorithm, processes its local gradient information. The data is encrypted and uploaded to the federated coordination server. The coordinator then summarizes the global feature gains, selects the optimal split point, and generates a global decision structure.

[0079] S85. The coordination server constructs the global tree structure for the current round based on the aggregation results and distributes the decision parameters to all nodes. Each node synchronously updates the structure of the gradient boosting tree algorithm.

[0080] S86. Each node performs a local prediction task on the updated decision tree, scores the behavioral characteristics of new access requests, and calculates the prediction results:

[0081]

[0082] in, Indicates the prediction result, η t h represents the weight of the decision tree in round t. t (·) represents the decision tree obtained in the t-th round of global training;

[0083] S87. When the system detects the predicted output When the current behavior pattern is inconsistent with the existing access control policy set, or when it is not covered by the policy, the model automatically generates supplementary policy entries.

[0084] S88. The system calls the strategy reconstruction program based on the supplementary strategy entries, writes the structured configuration file, and calls the smart contract template rendering engine to generate new contract code. The bytecode is then compiled and deployed to each node of the blockchain network, covering the old version of the smart contract.

[0085] A data security and privacy management system based on blockchain technology according to an embodiment of the present invention includes:

[0086] The data acquisition module is used to collect raw data from the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset.

[0087] The policy generation module is used to build access control policy sets based on standardized datasets and convert access control policies into structured policy configuration files.

[0088] The contract building module is used to load a preset contract template based on a structured strategy configuration file, generate contract code files, compile them into smart contract bytecode, and deploy them to various nodes in the blockchain network through the blockchain interface;

[0089] The request processing module is used to construct an access request quadruple when an access request is received, encapsulate the access request into a blockchain transaction, and submit it to the blockchain node containing the smart contract.

[0090] The contract execution module is used by smart contracts in blockchain nodes to match and judge access requests with deployed access control policies, output access judgment results, and record access authorization events or denial events.

[0091] The access audit module is used to structure access control results, request information and contract execution logs and write them into the blockchain ledger to form a traceable record of data access behavior.

[0092] The privacy protection module is used to select differential privacy mechanism, zero-knowledge proof mechanism or homomorphic encryption mechanism to perform privacy protection processing on the access returned data before providing it to the access party, based on the visitor's identity, target data type and access frequency.

[0093] The strategy optimization module is used to model and predict access patterns based on the data usage and access behavior records in each blockchain storage node, using the federated gradient boosting tree algorithm. Based on the prediction results, a new set of access control policies is generated, the contract construction module is called to regenerate the contract code, and the updated smart contract is deployed to the blockchain network.

[0094] The beneficial effects of the present invention are:

[0095] This invention provides a data security and privacy management method and system based on blockchain technology, which overcomes the problems of access control relying on centralized configuration, opaque permission judgment process, single data protection mechanism and inability to dynamically evolve access policies in the prior art. It constructs a data security management system with decentralized control capabilities, intelligent decision-making capabilities and multi-level privacy protection capabilities.

[0096] First, this invention migrates traditional server-centric permission rules to on-chain execution by deploying access control smart contracts in a blockchain network. This automates access control logic, ensures transparency in rule execution, and enables real-time on-chain storage of access behavior results. It effectively avoids human configuration errors and data tampering risks, enhancing the credibility and security of data access control. The introduction of smart contracts not only improves access control efficiency but also builds a data access infrastructure based on automatic contract adjudication, enabling the system to determine and record permissions without relying on third-party administrators in multi-organizational collaborative scenarios.

[0097] Secondly, this invention is the first to combine access control policies with a federated modeling mechanism. By utilizing access behavior data recorded in each node, distributed modeling and pattern recognition are performed through a federated gradient boosting tree algorithm to establish a predictive model of access behavior. This enables the early detection and identification of potential abnormal access or rule-incompatible behaviors. This mechanism not only improves the system's responsiveness to complex access behaviors, but also dynamically optimizes the access control policy set and generates corresponding new contract code to be deployed on the chain, forming a fully adaptive closed loop of policy-contract-execution, which greatly enhances the system's intelligence and self-evolution capabilities.

[0098] Furthermore, during the data access response phase, this invention intelligently selects privacy protection technologies such as differential privacy, zero-knowledge proof, or homomorphic encryption based on factors such as visitor identity, target resource type, and access frequency. It performs multi-layered and customized protection processing on the returned data as needed, ensuring that the data is "usable but not visible," effectively reducing the risk of sensitive information leakage. This mechanism dynamically decides the protection method based on the privacy sensitivity of the actual application scenario, breaking the problem of fixed encryption methods and insufficient protection strength in traditional methods, and improving the flexibility and adaptability of system privacy protection.

[0099] Finally, all key operations formed during access control and data protection in this invention, including access request parameters, contract judgment results, and data protection type selection, are recorded on the blockchain in a structured manner, constructing a complete access behavior audit chain. This enables cross-node and cross-time accountability and operational verification, providing solid technical support for post-event supervision, compliance review, and behavior tracing. Compared to existing permission systems that lack automatic auditing capabilities, this invention improves the operability of the system in terms of data responsibility allocation and violation detection. Attached Figure Description

[0100] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0101] Figure 1 This is a flowchart of a data security and privacy management method based on blockchain technology proposed in this invention. Detailed Implementation

[0102] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0103] refer to Figure 1 A data security and privacy management method based on blockchain technology includes the following steps:

[0104] S1. Collect raw data from the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset.

[0105] S2. Construct an access control policy set based on a standardized dataset;

[0106] S3. Convert the access control policy set into a structured policy configuration file, generate contract code based on a preset contract template, compile and deploy it as a smart contract to each node in the blockchain network;

[0107] S4. When an access request is received, the access request is submitted to the blockchain network as a transaction, and the smart contract matches and judges the access request with the preset strategy.

[0108] S5. Determine whether the access request is valid based on the execution result of the smart contract. If it is valid, record the access authorization event and allow access. If it is invalid, deny access and record the denial event.

[0109] S6. Structure the access control results, request information and smart contract execution logs, and write them onto the blockchain ledger to form a record of data access behavior.

[0110] S7. Based on the visitor's identity, target data type, and access frequency, intelligently select differential privacy mechanism, zero-knowledge proof mechanism, or homomorphic encryption mechanism to perform privacy protection processing on the access returned data before providing it to the visitor;

[0111] S8. Based on the data usage and access behavior records in each storage node, the access pattern is modeled and predicted using the federated gradient boosting tree algorithm. The access control policy set is dynamically optimized according to the prediction results, the contract code is regenerated, and the updated smart contract is deployed to the blockchain network.

[0112] This invention constructs a data security and privacy management method based on blockchain technology. By transforming access control policies into smart contracts and deploying them on the blockchain, it achieves automatic determination of access requests and on-chain recording of results, effectively enhancing the transparency and security of the system. On this basis, a federated gradient boosting tree algorithm is introduced to perform distributed modeling and access pattern prediction of access behavior data of each node, supporting dynamic optimization and automatic evolution of access control policies, and improving the system's adaptive response capability to complex access behaviors. At the same time, combined with differential privacy, zero-knowledge proof and homomorphic encryption mechanisms, it realizes intelligent privacy protection processing based on access context, ultimately forming a multi-party collaborative data management scheme that ensures data controllability, auditable use, and privacy protection.

[0113] In this embodiment, the raw data includes user identity information, access request, data type and data resource identifier, and the preprocessing includes format conversion, time synchronization, noise filtering and normalization.

[0114] This invention improves data quality and consistency by performing format conversion, time synchronization, noise filtering, and normalization on the raw data, providing a high-quality input foundation for subsequent access strategy construction and model training, and effectively enhancing the accuracy and robustness of the system's data processing.

[0115] In this embodiment, the access control policy includes accessing users, target resources, operation permissions, authorization conditions, and effective time range.

[0116] This invention enables fine-grained, multi-dimensional access permission configuration by clearly defining the access users, target resources, operation permissions, authorization conditions, and time ranges involved in the access control policy. This enhances the expressiveness and scalability of the policy and helps to achieve flexible permission management.

[0117] In this embodiment, S2 specifically includes:

[0118] S21. Extract access control-related feature variables from the standardized dataset and construct an initial feature set F = {f1, f2, ..., f...} n}, where f n These represent characteristic variables, including user identity, user role, request time, requested resource type, resource sensitivity level, and historical access status.

[0119] S22. Perform one-hot encoding on the categorical variables in the initial feature set F to generate a sparse feature matrix X = {x} ij}, where x ij This represents the encoded value of the i-th access record on the j-th feature;

[0120] S23. Given a sparse feature matrix X and a set of historical access authorization record tags Y = {y} i} to perform association, where y i ∈{0,1} represents the access control result of the i-th record, where 1 indicates that access is allowed and 0 indicates that access is denied;

[0121] S24. Construct the access control scoring function S(i) and use a linear weighted model to score access records:

[0122]

[0123] Where S(i) represents the access control scoring function, w j Let x represent the weight vector of the j-th feature. ij This represents the encoded value of the i-th access record on the j-th feature;

[0124] S25. Set an access control threshold θ, and generate an access policy label based on the comparison between the access control scoring function calculation result and the threshold. When the access control scoring function value is greater than the access control threshold, the access policy label is 1, and when the access control scoring function value is less than the access control threshold, the access policy label is 0.

[0125] S26. The feature variables and weight vector W = {w1, w2, ..., w...} involved in the access control scoring function are... nThe access control threshold θ and the access decision result are used as access control policy rules, and recorded as a policy entry set P = {p1, p2, ..., p...} k};

[0126] S27. Generate an access control policy set based on the policy entry set P, and store it as a structured configuration file as input for subsequent smart contract generation and deployment.

[0127] This invention extracts feature variables from a standardized dataset, constructs an access scoring function, and automatically generates policy labels. Based on the scoring function, it realizes the quantitative definition and dynamic generation of policy rules, thereby improving the intelligence of policy construction and reducing the cost of manual configuration.

[0128] In this embodiment, S3 specifically includes:

[0129] S31. Parse the fields of each policy in the access control policy set, extract the access user identifier, resource identifier, operation type, permission type and effective time range, and construct a structured configuration item;

[0130] S32. Combine all configuration items into a configuration file data structure;

[0131] S33. Load a preset contract template, wherein the preset contract template includes a contract declaration area, a permission judgment function, an event triggering function, a state variable definition area, and a rule definition area;

[0132] S34. Based on the configuration items in the structured strategy configuration file, insert each item into the rule definition area of ​​the preset contract template through the rule mapping logic, and automatically generate the contract code file.

[0133] S35. Compile the generated contract code file to obtain the smart contract bytecode;

[0134] S36. By calling the deployment function through the blockchain interface, the smart contract bytecode is deployed to all predefined contract nodes in the blockchain network, generating a set of on-chain contract addresses, and establishing a mapping relationship between the configuration file identifier and the corresponding contract address to complete the smart contract deployment operation.

[0135] This invention transforms strategy configuration into structured files and automatically generates and deploys smart contracts using preset contract templates, thus constructing an automatic mapping mechanism between strategies and contracts. This enables on-chain deployment and unified execution of access control logic, improving deployment efficiency and execution consistency.

[0136] In this embodiment, S4 specifically includes:

[0137] S41. After receiving a user access request, extract the access parameters and construct an access request quadruple. The access request quadruple includes the identity identifier of the accessing user, the unique identifier of the target resource, the operation type requested by the user, and the submission time of the access request.

[0138] S42. Package the access request quadruple into a transaction data structure, and define the access transaction as TX = R, Sig, TS, where TX represents the access request transaction object, R represents the access request quadruple, Sig represents the digital signature of the requesting user, and TS represents the timestamp of the transaction submission.

[0139] S43. Submit the access transaction TX to the blockchain network through the blockchain client interface and send it to the node containing the access control smart contract;

[0140] S44. The smart contract on the node parses the received access transaction and calls the permission judgment function;

[0141] S45. In the smart contract, load the preset access control policy set P, perform a matching operation, and determine whether policy p exists. j Conditions met:

[0142]

[0143] Among them, UID i and UID j The RID represents the user identifier allowed by the policy. i and RID j Indicates the corresponding resource identifier, OP i and OP j Indicates the allowed operation types. Indicates the time range during which the policy takes effect, Auth i This indicates the policy authorization result: 1 for allowed access, 0 for denied access, ∧ for a logical AND operation to determine if all conditions are met simultaneously, UID for the accessing user, RID for the target resource, OP for the operation type, T for the access request time, and p. i This represents the i-th access control policy;

[0144] S46. If there exists a strategy p that satisfies the condition... j If the match is successful, the smart contract will output the access control result:

[0145] checkAccess(R) = Auth j ;

[0146] Where checkAcces(R) represents the access determination result, Auth jThis represents the authorization value of the matching strategy, and R represents the access request quadruple.

[0147] This invention constructs an access request quadruple and submits the access request via blockchain transaction. The smart contract performs matching judgment according to a preset strategy, realizing automated permission verification and access control without human intervention, effectively reducing the risk of human configuration and improving response efficiency.

[0148] In this embodiment, S7 specifically includes:

[0149] S71. Parse the user identifier field, resource identifier field, and resource type field in the access transaction, and retrieve the historical interaction records between the corresponding user and the resource in the data usage log, and count the number of accesses F;

[0150] S72. Query the sensitivity level corresponding to resource type DT from the resource tag library and assign it to the sensitivity level set:

[0151] DT∈{T1,T2,T3};

[0152] Where DT represents the query resource type, T1 represents ordinary data, T2 represents data containing restricted fields, and T3 represents data containing critical privacy information;

[0153] S73. Based on the sensitivity level and access frequency, invoke the rule matching logic to execute the privacy mechanism selection process, and output the protection mechanism type M based on the conditions. The rule matching logic includes:

[0154] When the queried resource type is ordinary data and the number of accesses is less than the access frequency threshold, the protection mechanism type is set to differential privacy mechanism;

[0155] When the queried resource type contains data with restricted fields and the number of accesses exceeds the access frequency threshold, the protection mechanism type is set to zero-knowledge proof mechanism;

[0156] When querying data containing critical privacy information, set the protection mechanism type to homomorphic encryption.

[0157] S74. Execute according to the selection result, including:

[0158] When the differential privacy mechanism is selected, the perturbation generation function is called to add a random noise term ε to the original data D, and the noise addition calculation is performed:

[0159] D * =D+ε,ε~Lap(0,λ);

[0160] Among them, D *The data after adding noise is represented by ε, where D represents the original data, ε represents the noise variable following a Laplace distribution, Lap represents the Laplace distribution, and λ represents the set privacy budget parameter.

[0161] When the zero-knowledge proof mechanism is selected, the zero-knowledge proof mechanism construction module is invoked to generate the proof content π, and the original data D is bound to the proof structure, combining the data format as follows:

[0162] D * = (D, π);

[0163] Among them, D * π represents the combined data, and π represents the content of the proof.

[0164] When the homomorphic encryption mechanism is selected, the encryption parameters PK = (n, g) are loaded, and the Paillier encryption function is used to perform the encryption operation:

[0165] D * =E PK (D)=g D ·r n mod n 2 ;

[0166] Among them, D * Let D represent the ciphertext data, g and n represent the homomorphic encryption public key parameters, r represent the encrypted random number, mod represent the modulo operator, and E represent the ciphertext data. PK This indicates a homomorphic encryption mechanism;

[0167] S75. After the data processing is completed, the scrambled data, binding proof, or ciphertext data is injected into the response module and sent to the requesting user as an access response.

[0168] This invention introduces user identity, resource sensitivity level, and access frequency as input parameters, and intelligently selects differential privacy, zero-knowledge proof, or homomorphic encryption mechanisms for customized data protection, achieving "usable but invisible" access result output and enhancing the system's responsiveness to changes in data sensitivity.

[0169] In this embodiment, S8 specifically includes:

[0170] S81. The system executes a data collection program on each storage node in the blockchain network, reads the data usage behavior and data access behavior records of the nodes, extracts user identifier, resource identifier, operation type, access time and access judgment value, and constructs a local structured training dataset.

[0171] S82. Each node initializes the substructure of the gradient boosting tree algorithm locally according to the local modeling process of the federated gradient boosting tree algorithm, sets the number of tree rounds to G, trains the weak classifier round by round on the local structured training dataset, executes the boosting calculation process, and generates a decision tree in each round:

[0172]

[0173] in, Let α represent the prediction result for the j-th sample. t This represents the learning rate of the t-th subtree. This represents the decision tree generated by the i-th node in the t-th round of training. Let G represent the feature vector of the j-th sample, and G represent the total number of tree turns.

[0174] S83. Calculate the first and second gradient values ​​of the samples in each training round:

[0175]

[0176] in, This represents the first-order gradient value. This represents the second-order gradient value. Indicates the true label of the sample Compared with the predicted value The loss function between This represents the differentiation operation. Indicates the true label of the sample;

[0177] S84. Each node, based on the collaborative training mechanism of the federated gradient boosting tree algorithm, processes its local gradient information. The data is encrypted and uploaded to the federated coordination server. The coordinator then summarizes the global feature gains, selects the optimal split point, and generates a global decision structure.

[0178] S85. The coordination server constructs the global tree structure for the current round based on the aggregation results and distributes the decision parameters to all nodes. Each node synchronously updates the structure of the gradient boosting tree algorithm.

[0179] S86. Each node performs a local prediction task on the updated decision tree, scores the behavioral characteristics of new access requests, and calculates the prediction results:

[0180]

[0181] in, Indicates the prediction result, η t h represents the weight of the decision tree in round t. t (·) represents the decision tree obtained in the t-th round of global training;

[0182] S87. When the system detects the predicted output When the current behavior pattern is inconsistent with the existing set of access control policies, or when it is not covered by a policy, the model automatically generates supplementary policy entries.

[0183] S88. The system calls the strategy reconstruction program based on the supplementary strategy entries, writes the structured configuration file, and calls the smart contract template rendering engine to generate new contract code. The bytecode is then compiled and deployed to each node of the blockchain network, covering the old version of the smart contract.

[0184] This invention collects access behavior data through distributed nodes and combines it with the federated gradient boosting tree algorithm for modeling and prediction. This enables policy optimization and adaptive updates without sharing the original data, effectively enhancing the system's ability to perceive access patterns and evolve policies.

[0185] A data security and privacy management system based on blockchain technology includes:

[0186] The data acquisition module is used to collect raw data from the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset.

[0187] The policy generation module is used to build access control policy sets based on standardized datasets and convert access control policies into structured policy configuration files.

[0188] The contract building module is used to load a preset contract template based on a structured strategy configuration file, generate contract code files, compile them into smart contract bytecode, and deploy them to various nodes in the blockchain network through the blockchain interface;

[0189] The request processing module is used to construct an access request quadruple when an access request is received, encapsulate the access request into a blockchain transaction, and submit it to the blockchain node containing the smart contract.

[0190] The contract execution module is used by smart contracts in the blockchain node to match and judge access requests with deployed access control policies, output access judgment results, and record access authorization events or denial events.

[0191] The access audit module is used to structure access control results, request information and contract execution logs and write them into the blockchain ledger to form a traceable record of data access behavior.

[0192] The privacy protection module is used to select differential privacy mechanism, zero-knowledge proof mechanism or homomorphic encryption mechanism to perform privacy protection processing on the access returned data before providing it to the access party, based on the visitor's identity, target data type and access frequency.

[0193] The strategy optimization module is used to model and predict access patterns based on the data usage and access behavior records in each blockchain storage node, using the federated gradient boosting tree algorithm. Based on the prediction results, a new set of access control policies is generated, the contract construction module is called to regenerate the contract code, and the updated smart contract is deployed to the blockchain network.

[0194] Example 1:

[0195] To verify the feasibility of this invention in enterprise data governance, it was applied to the data sharing management platform of a large internet technology company. The company has multiple business departments, including R&D, operations, marketing, finance, and legal affairs. Its internal data resources include user behavior logs, market analysis reports, financial transaction data, contract files, employee information, etc. Due to the large amount of commercially sensitive and personal privacy data involved, the company has always faced problems such as low efficiency of access control, difficulty in holding people accountable for data misuse, and a lack of privacy protection mechanisms when using data between different business lines.

[0196] Before deploying this invention, the company used a combination of static access permission lists and role-based access control for data access management. The operations and maintenance department manually configured access policies, and users had to wait for review after submitting access requests, which usually took 1-3 days. Moreover, access records were only stored in local server logs, which posed risks such as manual deletion and missing information. The system lacked reliable and auditable capabilities, especially when cross-departmental access to financial data and user analysis data was involved, leading to frequent access conflicts and permission errors.

[0197] The company deploys the eight main functional modules included in the method of this invention in its unified data platform. During the data collection phase, information such as user access request records, data resource identifiers, request operation types, and user identities are collected from internal systems. Taking August 2024 as an example, the company had a total of 62,215 cross-departmental data access requests, of which 14,328 were from the marketing department's access to user behavior logs and 9,504 were from the operations department's access to financial transaction records.

[0198] The system automatically performs data format conversion, time synchronization, noise filtering, and normalization to form a unified standardized dataset. Based on this, the platform builds an access control policy set and automatically generates a structured configuration file. Contract code is automatically generated through smart contract templates and deployed to multiple business nodes in the company's internal blockchain network. After a user initiates an access request, the request is encapsulated as a transaction and broadcast to the on-chain nodes. The node contract determines the access permissions according to the configured policy and immediately returns an authorization or denial result.

[0199] During the data return phase, the system dynamically selects differential privacy, zero-knowledge proof, or homomorphic encryption technology for data protection based on the visitor's identity, resource sensitivity level, and access frequency. For example, when the marketing department accesses financial statements, if the access behavior is frequent and the resource field includes a tax field, the company system will automatically apply the Paillier homomorphic encryption algorithm to encrypt the data and return operable ciphertext data through the permission calculation module. Conversely, if the accessed content is statistical analysis results, a differential privacy mechanism will be used for perturbation processing to meet the dual requirements of analysis accuracy and privacy protection.

[0200] During operation, each node automatically records access requests and processing results. The system collects an average of 2,300 data access records per day. Every 48 hours, it performs modeling training based on the federated gradient boosting tree algorithm. The system locally models access behavior data within 7 days. Each node builds a decision subtree locally and sends intermediate results to the coordination node via encrypted transmission. The coordination node integrates information to generate a global model, predicts policy adaptation, and automatically identifies abnormal access patterns and policy gaps, triggering the policy entry generation module for optimization iteration.

[0201] Table 1 Comparison of Experimental Data

[0202]

[0203] Overall, the comparative data shows that the deployment of this invention in enterprise data platforms significantly improves the shortcomings of traditional data access control methods in terms of efficiency, accuracy, and privacy protection.

[0204] In terms of access response efficiency, this invention replaces the original method of relying on manual approval by submitting access requests as transactions to the blockchain network and having them automatically executed by smart contracts. This significantly reduces the average access processing time from 47,520 seconds (approximately 13.2 hours) before implementation to 0.49 seconds, achieving almost real-time feedback in access response time and improving business collaboration efficiency.

[0205] Regarding the accuracy of access control, due to the introduction of structured policy configuration, scoring function modeling, and federated learning algorithm to dynamically optimize the policy, the system's policy misjudgment rate has decreased from the original 1.6% to 0.2%, a reduction of 87.5%, which significantly reduces the risk of misauthorization and omission of data and enhances the system's access security.

[0206] Data behavior auditing capabilities have also been significantly enhanced. By structuring access control results, request parameters, and contract execution logs and writing them into the blockchain ledger, the complete recording rate of access logs has increased from 76.2% to 99.5%, achieving full-process traceability and cross-departmental accountability for access behavior, thus meeting the enterprise's auditing needs for a clear data responsibility chain.

[0207] Regarding privacy protection, this invention introduces a multi-mechanism intelligent selection logic based on data type and access behavior, which increases the matching accuracy of privacy mechanisms from the original 70.3% to 95.7%, an improvement of approximately 25.4%. The system can flexibly invoke differential privacy, zero-knowledge proof, or homomorphic encryption mechanisms for different types of sensitive information, effectively achieving the goal of "usable but not visible" data usage and ensuring compliant sharing of enterprise data.

[0208] This invention also constructs an access behavior modeling mechanism based on federated gradient boosting trees, which realizes the automatic learning and evolution of access strategies. The strategy update response cycle is shortened from the original 3.8 days to 0.9 days, improving the speed at which the strategy adapts to new access patterns. At the same time, the average F1-score predicted by the model reaches 0.936, indicating that the system has high stability and accuracy and can support continuous online optimization of access strategies.

[0209] In terms of coverage, the system's policy response rate to new access patterns has increased from 81.5% to 97.2%, significantly reducing access policy blind spots and gray areas, laying the foundation for ensuring the secure operation of the data system. In addition, the false exposure rate of sensitive data after system deployment has decreased from 2.3% to 0.4%, demonstrating a significant enhancement in privacy protection capabilities.

[0210] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A data security and privacy management method based on blockchain technology, characterized in that, Includes the following steps: S1. Collect raw data from the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset. S2. Construct an access control policy set based on a standardized dataset; S3. Convert the access control policy set into a structured policy configuration file, generate contract code based on a preset contract template, compile and deploy it as a smart contract to each node in the blockchain network; S4. When an access request is received, the access request is submitted to the blockchain network as a transaction, and the smart contract matches and judges the access request with the preset strategy. S5. Determine whether the access request is valid based on the execution result of the smart contract. If it is valid, record the access authorization event and allow access. If it is invalid, deny access and record the denial event. S6. Structure the access control results, request information and smart contract execution logs, and write them onto the blockchain ledger to form a record of data access behavior. S7. Based on the visitor's identity, target data type, and access frequency, intelligently select differential privacy mechanism, zero-knowledge proof mechanism, or homomorphic encryption mechanism to perform privacy protection processing on the access returned data before providing it to the visitor; S8. Based on the data usage and access behavior records in each storage node, the access pattern is modeled and predicted using the federated gradient boosting tree algorithm. The access control policy set is dynamically optimized according to the prediction results, the contract code is regenerated, and the updated smart contract is deployed to the blockchain network.

2. The data security and privacy management method based on blockchain technology according to claim 1, characterized in that, The raw data includes user identity information, access requests, data types, and data resource identifiers. The preprocessing includes format conversion, time synchronization, noise filtering, and normalization.

3. The data security and privacy management method based on blockchain technology according to claim 1, characterized in that, The access control policy includes accessing users, target resources, operation permissions, authorization conditions, and effective time range.

4. The data security and privacy management method based on blockchain technology according to claim 1, characterized in that, S2 specifically includes: S21. Extract access control-related feature variables from the standardized dataset and construct an initial feature set F = {f1, f2, ..., f...} n }, where f n These represent characteristic variables, including user identity, user role, request time, requested resource type, resource sensitivity level, and historical access status. S22. Perform one-hot encoding on the categorical variables in the initial feature set F to generate a sparse feature matrix X = {x} ij }, where x ij This represents the encoded value of the i-th access record on the j-th feature; S23. Given a sparse feature matrix X and a set of historical access authorization record tags Y = {y} i } to perform association, where y i ∈{0,1} represents the access control result of the i-th record, where 1 indicates that access is allowed and 0 indicates that access is denied; S24. Construct the access control scoring function S(i) and use a linear weighted model to score access records: Where S(i) represents the access control scoring function, w j Let x represent the weight vector of the j-th feature. ij This represents the encoded value of the i-th access record on the j-th feature; S25. Set an access control threshold θ, and generate an access policy label based on the comparison between the access control scoring function calculation result and the threshold. When the access control scoring function value is greater than the access control threshold, the access policy label is 1, and when the access control scoring function value is less than the access control threshold, the access policy label is 0. S26. The feature variables and weight vector W = {w1, w2, ..., w...} involved in the access control scoring function are... n The access control threshold θ and the access decision result are used as access control policy rules, and recorded as a policy item set P = {p1, p2, ..., p...} k }; S27. Generate an access control policy set based on the policy entry set P, and store it as a structured configuration file as input for subsequent smart contract generation and deployment.

5. A data security and privacy management method based on blockchain technology according to claim 1, characterized in that, S3 specifically includes: S31. Parse the fields of each policy in the access control policy set, extract the access user identifier, resource identifier, operation type, permission type and effective time range, and construct a structured configuration item; S32. Combine all configuration items into a configuration file data structure; S33. Load a preset contract template, wherein the preset contract template includes a contract declaration area, a permission judgment function, an event triggering function, a state variable definition area, and a rule definition area; S34. Based on the configuration items in the structured strategy configuration file, insert each item into the rule definition area of ​​the preset contract template through the rule mapping logic, and automatically generate the contract code file. S35. Compile the generated contract code file to obtain the smart contract bytecode; S36. By calling the deployment function through the blockchain interface, the smart contract bytecode is deployed to all predefined contract nodes in the blockchain network, generating a set of on-chain contract addresses, and establishing a mapping relationship between the configuration file identifier and the corresponding contract address to complete the smart contract deployment operation.

6. A data security and privacy management method based on blockchain technology according to claim 1, characterized in that, S4 specifically includes: S41. After receiving a user access request, extract the access parameters and construct an access request quadruple. The access request quadruple includes the identity identifier of the accessing user, the unique identifier of the target resource, the operation type requested by the user, and the submission time of the access request. S42. Package the access request quadruple into a transaction data structure, and define the access transaction as TX = {R, Sig, TS}, where TX represents the access request transaction object, R represents the access request quadruple, Sig represents the digital signature of the requesting user, and TS represents the timestamp of the transaction submission. S43. Submit the access transaction TX to the blockchain network through the blockchain client interface and send it to the node containing the access control smart contract; S44. The smart contract on the node parses the received access transaction and calls the permission judgment function; S45. In the smart contract, load the preset access control policy set P, perform a matching operation, and determine whether policy p exists. j Conditions met: Among them, UID j The RID represents the user identifier allowed by the policy. j Indicates the corresponding resource identifier, OP j Indicates the allowed operation types. Indicates the time range during which the policy takes effect, Auth j This represents the authorization value of the policy, where 1 indicates permission and 0 indicates denial. ∧ represents a logical AND operation to determine if multiple conditions are met simultaneously. UID represents the accessing user's identity, RID represents the target resource identifier, OP represents the operation type, T represents the access request time, and p... j This represents the j-th access control policy; S46. If there exists a strategy p that satisfies the condition... j If the match is successful, the smart contract will output the access control result: checkAccess(R)=Auth j ; Here, checkAcces(R) represents the access judgment result, and R represents the access request quadruple.

7. A data security and privacy management method based on blockchain technology according to claim 1, characterized in that, Specifically, S7 includes: S71. Parse the user identifier field, resource identifier field, and resource type field in the access transaction, and retrieve the historical interaction records between the corresponding user and the resource in the data usage log, and count the number of accesses F; S72. Query the sensitivity level corresponding to resource type DT from the resource tag library and assign it to the sensitivity level set: DT∈{T1,T2,T3}; Where DT represents the query resource type, T1 represents ordinary data, T2 represents data containing restricted fields, and T3 represents data containing critical privacy information; S73. Based on the sensitivity level and access frequency, invoke the rule matching logic to execute the privacy mechanism selection process, and output the protection mechanism type M based on the conditions. The rule matching logic includes: When the queried resource type is ordinary data and the number of accesses is less than the access frequency threshold, the protection mechanism type is set to differential privacy mechanism; When the queried resource type contains data with restricted fields and the number of accesses exceeds the access frequency threshold, the protection mechanism type is set to zero-knowledge proof mechanism; When querying data containing critical privacy information, set the protection mechanism type to homomorphic encryption. S74. Execute according to the selection result, including: When the differential privacy mechanism is selected, the perturbation generation function is called to add a random noise term ε to the original data D, and the noise addition calculation is performed: D * =D+ε,ε~Lap(0,λ); Among them, D * The data after adding noise is represented by ε, where D represents the original data, ε represents the noise variable following a Laplace distribution, Lap represents the Laplace distribution, and λ represents the set privacy budget parameter. When the zero-knowledge proof mechanism is selected, the zero-knowledge proof mechanism construction module is invoked to generate the proof content π, and the original data D is bound to the proof structure, combining the data format as follows: D * =(D,π); Among them, D * π represents the combined data, and π represents the content of the proof. When the homomorphic encryption mechanism is selected, the encryption parameters PK = (n, g) are loaded, and the Paillier encryption function is used to perform the encryption operation: D * =E PK (D)=g D ·r n mod n 2 ; Among them, D * Let D represent the ciphertext data, g and n represent the homomorphic encryption public key parameters, r represent the encrypted random number, mod represent the modulo operator, and E represent the ciphertext data. PK This indicates a homomorphic encryption mechanism; S75. After the data processing is completed, the scrambled data, binding proof, or ciphertext data is injected into the response module and sent to the requesting user as an access response.

8. A data security and privacy management method based on blockchain technology according to claim 1, characterized in that, S8 specifically includes: S81. The system executes a data collection program on each storage node in the blockchain network, reads the data usage behavior and data access behavior records of the nodes, extracts user identifier, resource identifier, operation type, access time and access judgment value, and constructs a local structured training dataset. S82. Each node initializes the substructure of the gradient boosting tree algorithm locally according to the local modeling process of the federated gradient boosting tree algorithm, sets the number of tree rounds to G, trains the weak classifier round by round on the local structured training dataset, executes the boosting calculation process, and generates a decision tree in each round: in, Let α represent the prediction result for the j-th sample. t This represents the learning rate of the t-th subtree. This represents the decision tree generated by the i-th node in the t-th round of training. Let G represent the feature vector of the j-th sample, and G represent the total number of tree turns. S83. Calculate the first and second gradient values ​​of the samples in each round of training: in, This represents the first-order gradient value. This represents the second-order gradient value. Indicates the true label of the sample Compared with the predicted value The loss function between This represents the differentiation operation. Indicates the true label of the sample; S84. Each node, based on the collaborative training mechanism of the federated gradient boosting tree algorithm, processes its local gradient information. The data is encrypted and uploaded to the federated coordination server. The coordinator then summarizes the global feature gains, selects the optimal split point, and generates a global decision structure. S85. The coordination server constructs the global tree structure for the current round based on the aggregation results and distributes the decision parameters to all nodes. Each node synchronously updates the structure of the gradient boosting tree algorithm. S86. Each node performs a local prediction task on the updated decision tree, scores the behavioral characteristics of new access requests, and calculates the prediction results: in, Indicates the prediction result, η t h represents the weight of the decision tree in round t. t (·) represents the decision tree obtained in the t-th round of global training; S87. When the system detects the predicted output When the current behavior pattern is inconsistent with the existing access control policy set, or when it is not covered by the policy, the model automatically generates supplementary policy entries. S88. The system calls the strategy reconstruction program based on the supplementary strategy entries, writes the structured configuration file, and calls the smart contract template rendering engine to generate new contract code. The bytecode is then compiled and deployed to each node of the blockchain network, covering the old version of the smart contract.

9. A data security and privacy management system based on blockchain technology, implementing the data security and privacy management method based on blockchain technology as described in any one of claims 1 to 8, characterized in that, include: The data acquisition module is used to collect raw data from the target system, generate a dataset to be processed, preprocess the dataset to be processed, and form a standardized dataset. The policy generation module is used to build access control policy sets based on standardized datasets and convert access control policies into structured policy configuration files. The contract building module is used to load a preset contract template based on a structured strategy configuration file, generate contract code files, compile them into smart contract bytecode, and deploy them to various nodes in the blockchain network through the blockchain interface; The request processing module is used to construct an access request quadruple when an access request is received, encapsulate the access request into a blockchain transaction, and submit it to the blockchain node containing the smart contract. The contract execution module is used by smart contracts in the blockchain node to match and judge access requests with deployed access control policies, output access judgment results, and record access authorization events or denial events. The access audit module is used to structure access control results, request information and contract execution logs and write them into the blockchain ledger to form a traceable record of data access behavior. The privacy protection module is used to select differential privacy mechanism, zero-knowledge proof mechanism or homomorphic encryption mechanism to perform privacy protection processing on the access returned data before providing it to the access party, based on the visitor's identity, target data type and access frequency. The strategy optimization module is used to model and predict access patterns based on the data usage and access behavior records in each blockchain storage node, using the federated gradient boosting tree algorithm. Based on the prediction results, a new set of access control policies is generated, the contract construction module is called to regenerate the contract code, and the updated smart contract is deployed to the blockchain network.

Images