Agricultural product traceability data management method and device based on block chain

Abstract

The invention discloses an agricultural product traceability data management method and device based on a block chain. Constructing an alliance chain architecture consisting of a management chain and a data chain, when a certain data chain accesses a new node, sending a request to the management chain corresponding to the data chain, initiating a consensus to each node of the management chain, and determining an access result according to a consensus result; and in response to an external data access request, performing permission matching on the data access request, allocating a permission to the data access request according to a matching result, and displaying the data of the data chain allowed to be accessed by the permission. According to the technical scheme, the architecture of the management chain and the data chain is adopted, the data chain can be brought into supervision and auditing of the management chain, and combined management and control of multiple departments are effectively achieved while the safety of agricultural product quality tracing data is guaranteed; through the identity verification and authority control strategy of data reading access, the authority of the user to data use can be accurately identified, and the data use efficiency is improved while the data security is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain, and in particular, to a method and device for managing agricultural product traceability data based on blockchain. Background Art

[0002] The supervision and guarantee of the quality and safety of agricultural products are inseparable from the efficient management and traceability of quality supervision data. Only by accurately recording and managing the quality monitoring data of agricultural products in various links such as production, circulation, and sales can problems be accurately and quickly located and solved when they occur, thereby effectively guaranteeing the quality and safety of agricultural products.

[0003] Currently, the information management means for agricultural product quality supervision data mainly include identification technologies such as barcodes and RFID combined with information systems to realize the traceability and application of relevant data. Since the quality supervision of agricultural products involves multiple links such as farmers, producers, logistics enterprises, distributors, and retailers, and the regulatory departments are different in each link, the effectiveness and correctness of agricultural product quality supervision data require joint review and consensus among multiple regulatory departments. The traditional method has a low implementation degree for cross-departmental data supervision and review, resulting in the accuracy and effectiveness of agricultural product quality supervision data not being fully guaranteed.

[0004] Based on this, a method is needed to achieve the accurate access, efficient management, and data access based on different permissions of agricultural product traceability data. Summary of the Invention

[0005] The present invention provides a method and device for managing agricultural product traceability data based on blockchain, which can achieve the accurate access, efficient management, and data access based on different permissions of agricultural product traceability data.

[0006] According to one aspect of the present invention, a method for managing agricultural product traceability data based on blockchain is provided, including:

[0007] Constructing a consortium chain architecture composed of a management chain and a data chain, wherein each data chain stores traceability data of at least one link of the agricultural product supply chain, and the management chain stores the data chain identification information of each data chain, the data node identification information on the data chain, and the ciphertext exchange information of the data node data;

[0008] When a new node is connected to a certain data chain, sending a request to the management chain corresponding to the data chain to enable each node of the management chain to initiate a consensus, and determining the access result of the new node according to the consensus result;

[0009] In response to an external data access request, performing permission matching on the data access request, allocating permissions to the data access request according to the matching result, and displaying the data of the data chain allowed to be accessed by the permission.

[0010] Optionally, sending a request to the management chain corresponding to the data chain to initiate consensus among the nodes of the management chain, and determining the access result of the newly added data chain node according to the consensus result, including:

[0011] Randomly select a node of the management chain as the primary node to initiate an access request. After the primary node receives the access request, initiate consensus to other nodes of the management chain;

[0012] If the consensus is successful, the primary node exchanges access response data with the data chain that sent the access request, including the identification information, attribute information, and ciphertext information of the new node, and stores them in their respective block nodes. The identification information of the new node is the unique identification ID of the consortium chain, generated according to the timestamp generated when the access request occurs; the attribute information identifies the category information and business information of the new node; the ciphertext information is the paired secret key information agreed upon when accessing the new node.

[0013] Optionally, the initiating consensus to other nodes of the management chain after the primary node receives the access request includes:

[0014] Randomly and evenly group all the nodes according to the total number of the nodes. Among them, a candidate list and a non-candidate list are set in each group. Select candidate nodes from the candidate list, and the remaining nodes in the candidate list are used as backup nodes; the primary node constructs a consensus network with the candidate nodes;

[0015] The primary node sends a prepare message to the candidate nodes in the consensus network so that the candidate nodes respond after receiving the prepare message. Nodes that do not respond or respond with incorrect messages are set as suspicious nodes;

[0016] When the total number of the suspicious nodes is less than the set consensus network threshold, send an execute message to the candidate nodes in the consensus network so that the candidate nodes return a verification result after receiving the execute message. When a preset number of verification messages indicating successful verification are received, confirm that the consensus is reached;

[0017] When the total number of the suspicious nodes is not less than the consensus network threshold, move all the suspicious nodes to the non-candidate list and reorganize the consensus network.

[0018] Optionally, the ciphertext information is generated and used in the following manner:

[0019] The primary node generates and stores an encryption function and a set of independent variables, constructs an equivalent function of the encryption function on the set of independent variables, and the new node stores the equivalent function;

[0020] In response to a data node access request for the new node, apply to the master node for the encryption function and a random number belonging to the set of independent variables, and calculate the ciphertext verification information;

[0021] Pack the ciphertext verification information and the random number into the data access request and send it to the data chain where the new node is located. This data chain calculates a verification value based on the ciphertext verification information and an equivalent function, and compares the verification value with the ciphertext verification information. If the difference is within the threshold, the ciphertext verification passes; otherwise, the ciphertext verification fails.

[0022] Optionally, the permissions include a first permission and a second permission. The second permission allows access to all the information stored in the managed chain nodes, and the first permission allows access to less information than the second permission. Correspondingly, in response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data chain allowed to be accessed by this permission, including:

[0023] Calculate the authentication result value of the data access request, and determine whether the data access request matches the first permission or the second permission according to the authentication result value;

[0024] If it matches the first permission, display the data allowed to be accessed by the first permission. If it matches the second permission, according to the identification information in the all information, send the ciphertext information in the all information to the data chain where the corresponding data chain node is located for secondary verification. After successful verification, generate a knowledge graph based on the data of the corresponding data node and feedback it.

[0025] Optionally, calculating the authentication result value of the data access request and determining whether the data access request matches the first permission or the second permission according to the authentication result value includes:

[0026] Calculate the authentication result value through the following formula:

[0027]

[0028] where W0 is the authentication result value, n is the total number of agricultural product supervision links, Q i is the permission configuration of the agricultural product in the i-th supervision link; C i is the claimed access permission of the agricultural product to the data in the i-th supervision link; W i (Q i , C i ) is the matching relationship between the permission configuration and the claimed usage permission of the agricultural product in the i-th supervision link, W i (Q i , Ci ) The value range is [0, 1], W i (Q i , C i ) = 0 indicates a complete mismatch, W i (Q i , C i ) = 1 indicates a complete match;

[0029] Substitute the user information included in the data access request into the above formula to calculate the identity authentication result value;

[0030] Determine whether the data access request matches the first permission or the second permission according to the value of the identity authentication result value.

[0031] Optionally, the generation of the knowledge graph based on the data of the corresponding data node includes:

[0032] Extract the set of subject objects based on the data of the data node; traverse all data chains to extract the set of object objects related to the subject objects;

[0033] Apply the knowledge in the field of crops to design the set of relationships between the subject and the object;

[0034] Extract entities from the set of subject objects and the set of object relationships to obtain the set of core entities; extract relationship entities from the set of relationships between the subject and the object to form a set of relationship entities; extract attribute entities based on and to form a set of attribute entities;

[0035] Design the connection mechanism of the set of core entities, the set of relationship entities and the set of attribute entities, establish a formal triple ontology model, and use the knowledge graph representation language to describe the triple ontology model to obtain the knowledge graph.

[0036] According to another aspect of the present invention, there is provided a blockchain-based agricultural product traceability data management device, including:

[0037] A node access unit, configured to, when a new node accesses a certain data link, send a request to the management link corresponding to the data link to cause each node of the management link to initiate a consensus, and determine the access result of the new node according to the consensus result;

[0038] A data access unit, configured to, in response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data link allowed to be accessed by the permission.

[0039] According to another aspect of the present invention, there is provided an electronic device, and the electronic device includes:

[0040] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor is enabled to execute the blockchain-based agricultural product traceability data management method according to any embodiment of the present invention.

[0041] According to another aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing a processor to implement the blockchain-based agricultural product traceability data management method according to any embodiment of the present invention when executed.

[0042] According to another aspect of the present invention, there is provided a computer program product including a computer program that implements the blockchain-based agricultural product traceability data management method according to any embodiment of the present invention when executed by a processor.

[0043] The technical solution of the embodiment of the present invention adopts an architecture of a management chain plus a data chain, which can incorporate activities such as data access and access of the data chain into the supervision and review of the management chain, ensuring the security of agricultural product quality traceability data while effectively realizing the joint control of multiple departments for agricultural product quality and safety; through the identity authentication and permission control strategy for data reading and access, the permissions of users to use data can be accurately identified, improving the data usage efficiency while ensuring the security of agricultural product quality supervision data.

[0044] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present invention, nor is it used to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. Description of the Drawings

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can also obtain other drawings without creative efforts based on these drawings.

[0046] Figure 1 is a flowchart of a blockchain-based agricultural product traceability data management method provided in Embodiment 1 of the present invention;

[0047] Figure 2 is a schematic diagram of a consortium chain applicable to Embodiment 1 of the present invention;

[0048] Figure 3Schematic diagram of a control module applicable to Embodiment 1 of the present invention;

[0049] Figure 4 Flowchart of a data node access method provided by Embodiment 2 of the present invention;

[0050] Figure 5 Flowchart of a data reading method provided by Embodiment 3 of the present invention;

[0051] Figure 6 Schematic diagram of the structure of an agricultural product traceability data management device based on blockchain provided by Embodiment 4 of the present invention;

[0052] Figure 7 Schematic diagram of the structure of an electronic device for implementing the agricultural product traceability data management method based on blockchain of the embodiments of the present invention. Detailed implementation manners

[0053] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0054] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present invention described herein can be implemented in an order different from those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0055] Embodiment 1

[0056] Figure 1The figure is a flowchart of a method for managing agricultural product traceability data based on blockchain according to Embodiment 1 of the present invention. This embodiment is applicable to the situation of managing agricultural product traceability data. The method can be executed by a device for managing agricultural product traceability data based on blockchain. The device for managing agricultural product traceability data based on blockchain can be implemented in the form of hardware and / or software, and can be configured in an electronic device. As Figure 1 shown, the method includes:

[0057] S110. Construct a consortium chain architecture composed of a management chain and data chains. Among them, each data chain stores the traceability data of at least one link in the agricultural product supply chain, and the management chain stores the data chain identification information of each data chain, the data node identification information on the data chain, and the ciphertext exchange information of the data of the data nodes.

[0058] Figure 2 The figure is a schematic diagram of a consortium chain applicable to Embodiment 1 of the present invention. Its overall architecture is composed of a management chain and data chains. Among them, the management chain is used by the competent department and similar organizations, and the data chains are used by the personnel of each link in the agricultural product supply chain. Each participating chain is provided with a control module for implementing management functions. The consortium chain is used to realize the access and reading of traceability data.

[0059] Exemplarily, the data of the data chain includes the traceability data of 5 links of production, processing, logistics, warehousing, and sales required for safety supervision, and is stored and read through the method of ciphertext verification. Taking red dates as an example of agricultural products, the data content includes: 1) Traceability data of the production link: red date variety, origin, batch number, growth environment, growth cycle, fertilization situation, yield information, pesticide residue; 2) Traceability data of the processing link: red date grade information, quality inspection information, incoming time, outgoing time, processing batch number, operator information, processing equipment, processing technology, etc.; 3) Traceability data of the logistics link: logistics provider, logistics order number, logistics method, order information, transportation route, etc.; 4) Traceability data of the warehousing link: warehousing enterprise information, warehouse address, warehousing batch, warehousing environment, management personnel, etc.; 5) Traceability data of the sales link: sales enterprise, sales time, sales place, selling price, salesperson, purchase quantity, etc.

[0060] The management chain mainly stores the data summary information of the managed data chains, including: data chain identification information (for example, if the identification information is the production link, then this data chain stores the traceability data of the production link), data node identification information on the data chain (for example, for the data chain storing the traceability data of the production link, there may be a situation where a single node cannot store all the data and multiple nodes are required for storage. The data node identification information is the respective numbers or other types of unique identity information of these nodes), ciphertext exchange information of the data of the data nodes, etc.

[0061] S120. When a new node is connected to a certain data link, a request is sent to the management link corresponding to the data link to cause each node of the management link to initiate a consensus, and the access result of the new node is determined according to the consensus result.

[0062] When a new node of a certain data link is accessed, the set data access smart contract is called to send a request to the management link. Each node of the management link initiates a consensus. After the consensus is reached, the audit result is notified to the data link to complete the access of the data node.

[0063] Specifically, when there is a need for a new node to access the data link, the data access smart contract will be called. After the smart contract is activated, a node in the management link will be randomly selected as the primary node, and an access request will be sent to it. After the selected primary node on the management link receives the access request, it will initiate a consensus by applying an improved Byzantine algorithm based on elastic grouping and reputation scoring. When each node of the management link reaches a consensus, the audit result will be notified to the data link. If the consensus is successful, the new node will be officially connected to the data link; if the consensus fails, the data node access will be rejected.

[0064] S130. In response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data link permitted by the permission.

[0065] When there is an external data access request, the identity authentication smart contract is activated, and permission identity authentication is performed through a certain algorithm. The verification results can be divided into two types: group permission matching and final permission matching. When the requesting party passes the group permission matching, the requesting party can read the attribute information stored in the corresponding management link node matched by the access request, so as to complete the external acquisition of the summary information (for example, when a tourist wants to view relevant traceability data, due to insufficient permissions, they can only view the summary of the traceability data to understand the general content); when the requesting party passes the final permission matching, the requesting party can read all the information (including identification information, attribute information, and ciphertext information) stored in the corresponding management link node matched by the access request. The requesting party sends the ciphertext information to the data link where the corresponding data link node is located for secondary verification according to the identification information. After the verification is successful, the data link control module calls the knowledge graph generation smart contract to generate a knowledge graph based on the data of the corresponding data node and feedback it to the data request party, thus completing an external data access.

[0066] Figure 3 It is a schematic diagram of a control module applicable to the first embodiment of the present invention, as Figure 3As shown in the figure, the control module of the participating chain can call various programs and smart contracts, namely the above-mentioned data access smart contract, identity authentication smart contract, and knowledge graph generation smart contract, to implement relevant functions. The functions include two categories: data access and data reading. In terms of data access, when a new node is added to the data chain, the control module calls the data access smart contract. It randomly selects a master node in the management chain, and the master node initiates a consensus to all nodes in the management chain using an improved Byzantine algorithm. If the consensus is reached, the master node exchanges response data with the newly added data node, and the new node joins the corresponding data chain to complete data access. If the consensus is not reached, the data node access is rejected. In terms of data reading, when there is an external data access request, the control module activates the identity authentication smart contract to perform permission identity authentication through a specific algorithm. The verification results are divided into group permission matching and final permission matching. If the requesting end passes the group permission matching, it can read the attribute information stored in the corresponding management chain node. If it passes the final permission matching, it can read all information (including identification, attributes, and ciphertext information). Then, the requesting end sends the ciphertext information to the data chain where the corresponding data chain node is located for secondary verification. After successful verification, the control module calls the knowledge graph generation smart contract to generate graph data based on the data of the corresponding data node and feedback it to the requesting end to complete data reading.

[0067] The technical solution of the embodiment of the present invention adopts the architecture of a management chain plus a data chain, which can incorporate activities such as data access and access in the data chain into the supervision and review of the management chain. While ensuring the security of agricultural product quality traceability data, it also effectively realizes the joint control of multiple departments for agricultural product quality and safety. Through the identity authentication and permission control strategy for data reading and access, it can accurately identify the user's permission to use data, improve the data usage efficiency while ensuring the security of agricultural product quality supervision data.

[0068] Embodiment 2

[0069] Figure 4 It is a flowchart of a data node access method provided by the second embodiment of the present invention, and this embodiment further explains on the basis of the above-mentioned first embodiment. As Figure 4 shown, the method includes:

[0070] S410. Randomly select a node in the management chain as the master node to initiate an access request. After the master node receives the access request, it initiates a consensus to other nodes in the management chain.

[0071] When a node joins the data chain, the "access smart contract" is activated at the corresponding data chain management end. This contract selects a random node on the management chain as the primary node and sends an access request. After receiving the request, the selected primary node on the management chain initiates a consensus using an improved Byzantine algorithm. If the consensus is successful, the primary node exchanges access response data with the data chain that sent the access request, including the identification information, attribute information, and ciphertext information of the new node, and stores them in their respective block nodes. Among them, the identification information of the new node is the unique identification ID of the consortium chain, generated from the 16-bit timestamp generated when the access request occurs; the attribute information identifies the category information and business information of the data node; the ciphertext information is the paired secret key information agreed upon when accessing the data node.

[0072] S420. If the consensus is successful, the primary node exchanges access response data with the data chain that sent the access request, including the identification information, attribute information, and ciphertext information of the new node, and stores them in their respective block nodes. Among them, the identification information of the new node is the unique identification ID of the consortium chain, generated according to the timestamp generated when the access request occurs; the attribute information identifies the category information and business information of the new node; the ciphertext information is the paired secret key information agreed upon when accessing the new node.

[0073] In the embodiment of the present invention, after the primary node receives the access request, it initiates a consensus to other nodes on the management chain, including:

[0074] Randomly and evenly group all the nodes according to the total number of the nodes. Among them, a candidate list and a non-candidate list are set in each group. Select candidate nodes from the candidate list, and the remaining nodes in the candidate list are used as backup nodes; the primary node constructs a consensus network with the candidate nodes;

[0075] The primary node sends a prepare message to the candidate nodes in the consensus network so that the candidate nodes respond after receiving the prepare message. Nodes that do not respond or respond with an incorrect message are set as suspicious nodes;

[0076] When the total number of the suspicious nodes is less than the set consensus network threshold, send an execute message to the candidate nodes in the consensus network so that the candidate nodes return a verification result after receiving the execute message. When a preset number of verification messages indicating successful verification are received, it is confirmed that the consensus is reached;

[0077] When the total number of the suspicious nodes is not less than the consensus network threshold, move all the suspicious nodes to the non-candidate list and reorganize the consensus network.

[0078] Dynamically group the nodes in the management chain. Exemplarily, assume that the total number of nodes in the management chain is R, and randomly and evenly divide these nodes into r groups. The grouping rules are as follows:

[0079]

[0080] The nodes in each group are marked. The nodes representing the group participating in the consensus are marked as TY, and the nodes within the group that do not participate in the consensus are identified as TN. Each group is set with a TY candidate list, and several nodes are selected to participate in the consensus according to the reputation value of the nodes. In the initial state, all nodes in the group are in the candidate list. The nodes that have not successfully participated in the consensus are identified as TN and kicked out of the TY candidate list. The nodes participating in the consensus can be divided into primary nodes, candidate nodes, consensus nodes, suspicious nodes, and backup nodes. Among them, the primary node is the node that accepts the request and initiates the consensus; the candidate node is the node that participates in the consensus except the primary node, that is, when the primary node is working properly, the candidate node is an ordinary node participating in the consensus, and when the primary node cannot work, the candidate node can replace the primary node; the suspicious node is the node that has passive participation in the consensus, does not forward information, or spreads false information; the backup node is the node that replaces the consensus node; generally, the backup node does not participate in the consensus. Only when the number of consensus nodes is less than the quantity threshold set by the consensus mechanism due to failures or becoming suspicious nodes, the backup node will be included in the consensus for reaching an agreement.

[0081] The consensus process includes:

[0082] 1. request (request) phase: The external request information is sent to a primary node on the management chain

[0083] 2. pre - prepare (pre - prepare) phase: After receiving the request information, the primary node, among the divided groups, 50% of the nodes in the candidate list of each group are candidate nodes, and the remaining nodes are backup nodes. The primary node constructs a consensus network with all candidate nodes.

[0084] 3. prepare (prepare) phase: The primary node sends a prepare message to all nodes in the consensus network and receives responses. The nodes that do not respond or have incorrect response messages are set as suspicious nodes. The total number of suspicious nodes is f. When f is less than the set consensus network threshold, it enters the next phase; when f is greater than the set consensus network threshold, all suspicious nodes are marked, and it returns to the previous phase to reorganize the consensus network.

[0085] 4. commit (execute) phase: The control module of the management chain sends an execute message to all nodes in the consensus network. After each node in the consensus network receives the execute message, it needs to return a verification message. When the control module receives 2f + 1 successfully verified messages, it can be considered that the consensus is reached.

[0086] 5. response (response) phase: The control module of the management chain sends the consensus response result to the request end. The nodes of each group can be regarded as the consistent response result of the accepting nodes.

[0087] In the embodiments of the present invention, ciphertext information is generated and used in the following manner:

[0088] The master node generates and stores an encryption function and a set of independent variables, constructs an equivalent function of the encryption function on the set of independent variables, and the new node stores the equivalent function;

[0089] Corresponding to the data node access request for the new node, apply to the master node for the encryption function and a random number belonging to the set of independent variables, and calculate the ciphertext verification information;

[0090] Pack the ciphertext verification information and the random number into the data access request, and send it to the data chain where the new node is located. The data chain calculates the verification value based on the ciphertext verification information and the equivalent function, compares the verification value with the ciphertext verification information. If the difference is within the threshold, the ciphertext verification passes, otherwise the ciphertext verification fails.

[0091] The master node generates an encryption function P (X) and a set of independent variable values E, and constructs Q (X) the equivalent function of P (x) on E;

[0092] 2) The master node stores the encryption function P (X) , and the newly connected node stores the equivalent function Q (x) ;

[0093] 3) When a data node access request is made, the encryption function P (X) of this data node and a random number x0 ∈ E should be applied to the management chain first, and the ciphertext verification information is calculated accordingly Pack k and x0 into the data access request and send it to the data chain where the data node is located; the management module of the data chain calculates (x) based on x0 and the equivalent function Q Compare l with k. If the difference is within the threshold, the ciphertext verification passes and this access is valid. Otherwise, the ciphertext verification fails and access is not allowed.

[0094] In the second embodiment of the present invention, when new quality supervision data is accessed, an improved Byzantine algorithm is applied for consensus. While ensuring the consensus efficiency, more regulatory agencies are also incorporated into the consensus system, ensuring the accuracy and immutability of agricultural product quality traceability data and avoiding regulatory loopholes. The generation and use mechanism of ciphertext information effectively prevents data from being illegally accessed and tampered with through encryption algorithms and strict verification processes. Even if the data is obtained during transmission or storage, without the correct key and verification process, the data content cannot be interpreted, thus ensuring the security and integrity of agricultural product quality safety traceability data and ensuring that only authorized access parties can obtain the corresponding data.

[0095] Example 3

[0096] Figure 5 It is a flowchart of a data reading method provided in Example 3 of the present invention. This embodiment further explains and illustrates on the basis of the above-mentioned Example 1. The permissions include a first permission and a second permission. The second permission allows access to all the information stored in the managed chain nodes, and the information allowed to be accessed by the first permission is less than that of the second permission; as Figure 5 shown, the method includes:

[0097] S510. Calculate the authentication result value of the data access request, and determine whether the data access request matches the first permission or the second permission according to the authentication result value.

[0098] S520. If it matches the first permission, display the data allowed to be accessed by the first permission. If it matches the second permission, according to the identification information in all the information, send the ciphertext information in all the information to the data chain where the corresponding data chain node is located for secondary verification. After successful verification, generate a knowledge graph based on the data of the corresponding data node and feedback it.

[0099] Among them, the first permission is the group permission, and the second permission is the final permission. When the requesting end matches through the group permission, the requesting end can read the attribute information stored in the corresponding managed chain node that matches the access request, so as to complete the acquisition of the summary information from the outside; when the requesting end matches through the final permission, the requesting end can read all the information (including identification information, attribute information, and ciphertext information) stored in the corresponding managed chain node that matches the access request.

[0100] In the embodiment of the present invention, calculating the authentication result value of the data access request and determining whether the data access request matches the first permission or the second permission according to the authentication result value includes:

[0101] Calculate the authentication result value through the following formula:

[0102]

[0103] Among them, W0 is the authentication result value, n is the total number of agricultural product supervision links, Q i is the permission configuration of the agricultural product in the i-th supervision link; C i is the access permission claimed by the requesting end for the data in the i-th supervision link of the agricultural product; W i (Q i , C i ) is the matching relationship between the permission configuration of the agricultural product in the i-th supervision link and the access permission claimed by the requesting end, and W i (Q i , C i ) takes a value of [0, 1], and W i (Qi , C i ) = 0 indicates a complete mismatch, W i (Q i , C i ) = 1 indicates a complete match;

[0104] Bring the user information included in the access request into the above formula to calculate the authentication result value;

[0105] Determine whether the data access request matches the first permission or the second permission according to the value of the authentication result value.

[0106] With the authentication formula constructed based on the HMAC (Hash-based Message Authentication Code) algorithm as the core, that is Substitute the user information sent by the data request into this formula to calculate the value of W0, and use this to judge the user's permission.

[0107] When 0 < W0 ≤ n, the request side passes the group permission match. At this time, the request side can read the attribute information stored in the corresponding management chain node that matches the access request, so as to obtain some summary information about the agricultural product quality and safety traceability data, meeting the requirements of some scenarios with lower data sensitivity requirements.

[0108] When W0 = n, it is the final permission match. The request side can read all the information stored in the corresponding management chain node that matches the access request, including identification information, attribute information, and ciphertext information. However, after obtaining the ciphertext information, it is also necessary to send it to the data chain where the corresponding data chain node is located for secondary verification. After successful verification, the complete traceability data can be further obtained. This mechanism ensures the security of high-sensitivity data. If W0 = 0, it means a complete mismatch, and the data reading will be rejected to ensure that the data is not illegally accessed.

[0109] In the embodiment of the present invention, generating a knowledge graph based on the data of the corresponding data node includes:

[0110] Extracting a set of main object entities based on the data of the data node; traversing all data chains to extract a set of object entities related to the main object entities;

[0111] Applying the knowledge in the field of crops to design a set of relationships between the main object and the object;

[0112] Extracting entities from the set of main object entities and the set of relationships between the main object and the object to obtain a set of core entity entities; extracting relationship entity entities from the set of relationships between the main object and the object to form a set of relationship entity entities; extracting attribute entity entities based on and to form a set of attribute entity entities;

[0113] Design the connection mechanism for the core entity set, relationship entity set, and attribute entity set, establish a formal triple ontology model, and use the knowledge graph representation language to describe the triple ontology model to obtain a knowledge graph.

[0114] The requesting end sends the ciphertext information to the corresponding data link where the data link node is located for secondary verification according to the identification information. After successful verification, the data link control module calls the knowledge graph to generate a smart contract, generates a knowledge graph based on the data of the corresponding data node, and feeds it back to the data requesting end, thus completing an external data access. Using models such as NER (Named Entity Recognition), casRel (Relation Extraction Model Based on Cascade Decoding), and MetaPad (possibly a specific entity alignment model), entities and relationships are extracted from the data of the corresponding data node, a triple ontology (P, W, Q) is constructed, and it is converted into a knowledge graph in RDF (Resource Description Framework) format. For example, entities such as "red date production area", "pesticide usage situation", and "harvest time" are identified from the red date production data, as well as the relationships between them, such as "red date - produced in - a certain place", "red date - uses - a certain pesticide", etc.

[0115] The generation and unified identification of the knowledge graph data adopted in the embodiments of the present invention can accurately and vividly trace the data and its association relationships with other data. While enhancing the vividness of data display, it also enhances the comprehensibility and operability of the traceable data, making data application more comprehensive.

[0116] Embodiment 4

[0117] Figure 6 It is a structural schematic diagram of an agricultural product traceability data management device provided by Embodiment 4 of the present invention. As Figure 6 shown, the device includes:

[0118] A construction unit 610, configured to construct a consortium chain architecture composed of a management chain and a data chain, where each data chain stores the traceability data of at least one link of the agricultural product supply chain, and the management chain stores the data chain identification information of each data chain, the data node identification information on the data chain, and the ciphertext exchange information of the data node data;

[0119] A node access unit 620, configured to, when a new node accesses a certain data link, send a request to the corresponding management chain of the data link to enable each node of the management chain to initiate consensus, and determine the access result of the new node according to the consensus result;

[0120] A data access unit 630, configured to, in response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data link allowed to be accessed by the permission.

[0121] The agricultural product traceability data management device based on blockchain provided by the embodiments of the present invention can execute the agricultural product traceability data management method based on blockchain provided by any embodiment of the present invention, and has corresponding functional modules and beneficial effects for executing the method.

[0122] Embodiment 5

[0123] Figure 7 FIG. shows a schematic structural diagram of an electronic device 10 that can be used to implement the embodiments of the present invention. The electronic device is intended to represent various forms of digital computers, such as, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as, personal digital processors, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0124] As Figure 7 shown, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc. The memory stores a computer program executable by the at least one processor. The processor 11 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0125] Multiple components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0126] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the blockchain-based agricultural product traceability data management method.

[0127] In some embodiments, the blockchain-based agricultural product traceability data management method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the blockchain-based agricultural product traceability data management method described above can be executed. Alternatively, in other embodiments, the processor 11 can be configured to execute the blockchain-based agricultural product traceability data management method by any other suitable means (e.g., by means of firmware).

[0128] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: implemented in one or more computer programs, the one or more computer programs can be executed and / or interpreted on a programmable system including at least one programmable processor, the programmable processor can be a special or general-purpose programmable processor, can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit the data and instructions to the storage system, the at least one input device, and the at least one output device.

[0129] The computer program for implementing the method of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the computer program is executed by the processor, the functions / operations specified in the flowchart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, as an independent software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0130] In the context of the present invention, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] To provide for interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can also be used to provide for interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0132] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which the user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0133] A computing system may include a client and a server. The client and the server are generally far from each other and usually interact via a communication network. The client-server relationship is created by computer programs running on respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system, and solves the defects of difficult management and weak business scalability existing in traditional physical hosts and VPS services.

[0134] It should be understood that various forms of the processes shown above can be used, steps can be reordered, added or deleted. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and no limitation is made herein.

[0135] The above specific embodiments do not constitute a limitation on the protection scope of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for managing agricultural product traceability data based on blockchain, characterized in that, Including: Construct a consortium blockchain architecture composed of a management chain and a data chain. Among them, each data chain stores the traceability data of at least one link in the agricultural product supply chain, and the management chain stores the data chain identification information of each data chain, the data node identification information on the data chain, and the ciphertext exchange information of the data node data; When a new node joins a certain data chain, send a request to the management chain corresponding to this data chain to enable each node of the management chain to initiate a consensus, and determine the access result of the new node according to the consensus result; In response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data chain that the permission allows to access.

2. The method according to claim 1, wherein The step of sending a request to the management chain corresponding to this data chain to enable each node of the management chain to initiate a consensus and determining the access result of the new data chain node according to the consensus result includes: Randomly select a node of the management chain as the primary node to initiate an access request. After the primary node receives the access request, initiate a consensus to other nodes of the management chain; If the consensus is successful, the primary node exchanges access response data with the data chain that sent the access request, including the identification information, attribute information, and ciphertext information of the new node, and stores them in their respective block nodes. Among them, the identification information of the new node is the unique identification ID of the consortium blockchain, which is generated according to the timestamp generated when the access request occurs; the attribute information identifies the category information and business information of the new node; the ciphertext information is the paired secret key information agreed upon when accessing the new node.

3. The method according to claim 2, wherein The step of initiating a consensus to other nodes of the management chain after the primary node receives the access request includes: Randomly and evenly group each node according to the total number of nodes. Among them, a candidate list and a non-candidate list are set in each group. Select candidate nodes from the candidate list, and the remaining nodes in the candidate list are used as backup nodes; the primary node constructs a consensus network with the candidate nodes; The primary node sends a prepare message to the candidate nodes in the consensus network so that the candidate nodes respond after receiving the prepare message. Nodes that do not respond or respond with incorrect messages are set as suspicious nodes; When the total number of suspicious nodes is less than the set consensus network threshold, send an execute message to the candidate nodes in the consensus network so that the candidate nodes return a verification result after receiving the execute message. When a preset number of verification messages indicating successful verification are received, confirm that the consensus is reached; When the total number of suspicious nodes is not less than the consensus network threshold, move all suspicious nodes to the non-candidate list and reorganize the consensus network.

4. The method according to claim 2, wherein The ciphertext information is generated and used in the following manner: The primary node generates and stores an encryption function and a set of independent variables, constructs an equivalent function of the encryption function on the set of independent variables, and the new node stores the equivalent function; Corresponding to a data node access request for the new node, apply to the primary node for the encryption function and a random number belonging to the set of independent variables, and calculate ciphertext verification information; Pack the ciphertext verification information and the random number into the data access request and send it to the data chain where the new node is located. This data chain calculates a verification value based on the ciphertext verification information and an equivalence function, and compares the verification value with the ciphertext verification information. If the difference is within the threshold, the ciphertext verification passes; otherwise, the ciphertext verification fails.

5. The method according to claim 1, wherein The permissions include a first permission and a second permission. The second permission allows access to all the information stored in the management chain nodes, and the first permission allows access to less information than the second permission. Correspondingly, in response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data chain allowed to be accessed by this permission, including: Calculate the authentication result value of the data access request, and determine whether the data access request matches the first permission or the second permission according to the authentication result value; If it matches the first permission, display the data allowed to be accessed by the first permission. If it matches the second permission, according to the identification information in the all information, send the ciphertext information in the all information to the data chain where the corresponding data chain node is located for secondary verification. After successful verification, generate a knowledge graph based on the data of the corresponding data node and feedback it.

6. The method according to claim 5, wherein The calculating the authentication result value of the data access request and determining whether the data access request matches the first permission or the second permission according to the authentication result value includes: Calculate the authentication result value through the following formula: Wherein, W0 is the authentication result value, n is the total number of agricultural product supervision links, and Q i is the permission configuration of the agricultural product in the i-th supervision link; C i is the access permission claimed by the request side of the agricultural product for the data in the i-th supervision link; W i (Q i , C i ) is the matching relationship between the permission configuration of the agricultural product in the i-th supervision link and the permission claimed by the request side, and W i (Q i , C i ) takes a value in [0, 1], and when W i (Q i , C i ) = 0, it means a complete mismatch, and when W i (Q i , C i ) = 1, it means a complete match; Substitute the user information included in the data access request into the above formula to calculate the authentication result value; Determine whether the data access request matches the first permission or the second permission according to the value of the authentication result value.

7. The method according to claim 5, characterized in that The generating a knowledge graph based on the data of the corresponding data node includes: Extract a set of subject objects based on the data of the data node; traverse all data chains to extract a set of object objects related to the subject object; Apply the knowledge in the field of crops to design a set of relationships between the subject and the object; Extract entities from the set of subject objects and the set of object relationships to obtain a set of core entities; extract relationship entities from the set of relationships between the subject and the object to form a set of relationship entities; extract attribute entities based on and to form a set of attribute entities; Design a connection mechanism for the set of core entities, the set of relationship entities, and the set of attribute entities, establish a formal triple ontology model, and use a knowledge graph representation language to describe the triple ontology model to obtain the knowledge graph.

8. An agricultural product traceability data management device based on blockchain, characterized in that, Include: A construction unit for constructing a federated blockchain architecture composed of a management chain and a data chain. Among them, each data chain stores the traceability data of at least one link of the agricultural product supply chain, and the management chain stores the data chain identification information of each data chain, the data node identification information on the data chain, and the ciphertext exchange information of the data node data; The node access unit is used to, when a new node accesses a certain data link, send a request to the corresponding management link of the data link so that each node of the management link initiates a consensus, and determine the access result of the new node according to the consensus result; The data access unit is used to, in response to an external data access request, perform permission matching on the data access request, allocate permissions to the data access request according to the matching result, and display the data of the data link that the permission allows to access.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the blockchain-based agricultural product traceability data management method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, and the computer instructions are used to implement the blockchain-based agricultural product traceability data management method according to any one of claims 1-7 when executed by a processor.

11. A computer program product, characterized in that, The computer program product includes a computer program, and the computer program implements the blockchain-based agricultural product traceability data management method according to any one of claims 1-7 when executed by a processor.

Images