Full-life-cycle auditing and tracking system and method

Abstract

The invention discloses a full-life-cycle auditing tracking system and method, and belongs to the technical field of data tracking backtracking, and the method specifically comprises the steps: carrying out the global unique identifier distribution of personnel configuration data during the first collection, embedding a timestamp, an operation identifier and a link identifier in each life cycle node of the data, constructing a real-time auditing model, and carrying out the real-time auditing of the data; through data change monitoring, behavior pattern recognition and an anomaly detection algorithm, each data operation is recorded in real time and compared with a preset auditing strategy, risk early warning is triggered, block chain evidence storage is established at a key operation node, a multi-block chain link relation network diagram is constructed based on multiple block chains, and when an abnormal node occurs, a data life chain is generated. Predecessor nodes of the abnormal nodes are backtracked, recursive check is carried out on each predecessor node, and an abnormal source and a responsibility subject are positioned; according to the method, the multi-step association risk can be found, the situation that tracking cannot be achieved during tracking and backtracking is prevented, the missed judgment rate is reduced, and the accuracy and efficiency of tracking and backtracking are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data tracking and tracing, and specifically relates to a full-life cycle audit and tracking system and method. Background Art

[0002] The human resources (HR) management system of modern large enterprises usually consists of multiple subsystems such as recruitment, attendance, salary, performance, and separation. These subsystems are often deployed separately in local data centers and cloud environments, generating their own audit logs respectively, forming data islands.

[0003] When it is necessary to trace the data of a certain employee throughout the life cycle (from onboarding to separation and destruction), the following problems will occur: the chain is broken, the log formats are not unified or not recorded, resulting in the inability to trace end-to-end; the compliance check is not comprehensive, and it is difficult for traditional solutions to cover the full life cycle of data from collection to destruction; the anomaly detection ability is insufficient, and it is difficult for traditional technologies to identify complex risks with multi-step associations.

[0004] For example, Chinese Patent with the authorization announcement number CN114372296B discloses a blockchain-based user behavior data audit method and system. The method includes the steps: S1, perform an initialization operation; S2, collect user behavior data in real time based on a unified data storage specification; S3, upload and deploy information such as data fingerprints to the blockchain as vouchers based on a data chunking and secondary index storage mechanism; S4, verify the integrity of user behavior data, traverse the secondary index storage mechanism to obtain the file set storing user behavior data; based on the "challenge-response-verification" mode, use a smart contract to audit the integrity of user behavior data; S5, use the complete user behavior data as the audit basis to track and audit data security events and evaluate the quality of cloud services. This invention effectively solves the trust problem between cloud service providers and users by utilizing the non-repudiation of the blockchain, ensuring the safety and credibility of the audit process; and improves the audit efficiency of massive data by using the secondary index storage mechanism.

[0005] Defects of the above prior art: Although the blockchain can perform backtracking and tracing, it is difficult to discover the relationship between abnormal nodes and precursor nodes. In a complex audit data environment, it is difficult to discover complex anomalies with multi-step associations and impossible to perform accurate positioning. Summary of the Invention

[0006] In view of the deficiencies of the prior art, the present invention proposes a full-life-cycle audit and tracking system and method, which can achieve real-time monitoring, complete recording and traceability in the stages of data collection, transmission, processing, storage and destruction. At the same time, through associated identification, multi-blockchain and tracking back, the defects of data islands and broken tracking chains in traditional methods are effectively avoided, realizing the closed-loop audit and tracking of personnel configuration data throughout the life cycle, and greatly improving data security and compliance.

[0007] To achieve the above object, the present invention provides the following technical solutions: A full-life-cycle audit and tracking method, comprising: When the personnel configuration data is first collected, a unique identifier is assigned, and timestamps, operation identifiers and link identifiers are embedded at each life cycle node of the data. The personnel configuration data includes business data and metadata; According to the personnel configuration data and the corresponding timestamps, operation identifiers and link identifiers, a multi-blockchain link relationship network diagram is determined based on a multi-dimensional evidence storage data model and a multi-blockchain. The multi-dimensional evidence storage data model records all-element information of operation behaviors in the key node information on the chain, and the multi-blockchain consists of different blockchains determined by the on-chain rules; According to the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object with an abnormality in the multi-blockchain link relationship network diagram, a data life chain is generated; According to the data life chain, the abnormal source and the responsible entity are located.

[0008] Specifically, the determining of the multi-blockchain link relationship network diagram based on the personnel configuration data and the corresponding timestamps, operation identifiers and link identifiers, and based on the multi-dimensional evidence storage data model and the multi-blockchain, includes: Based on the personnel configuration data and the corresponding timestamps, operation identifiers and link identifiers, key nodes are screened, the on-chain rules of the blockchain are defined, and the key node information screened out is put on the chain through consensus and contract; A multi-dimensional evidence storage data model is constructed, the evidence storage fields are designed, and all-element information of operation behaviors in the key node information on the chain is recorded, including: operation subject, operation object, operation characteristics and on-chain identifier; Based on the multi-dimensional evidence storage data model and the multi-blockchain, a multi-blockchain link relationship network diagram is constructed, wherein the nodes are operation records and the edges are association relationships.

[0009] Specifically, the screening of key nodes based on the personnel configuration data and the corresponding timestamps, operation identifiers and link identifiers, the definition of the on-chain rules of the blockchain, and the putting of the key node information screened out on the chain through consensus and contract, includes: Train a multi-dimensional risk scoring model based on machine learning algorithms, input the selected key node information into the trained multi-dimensional risk scoring model, and output the scoring result; Preset a three-level chain-uploading strategy. When the scoring result is greater than or equal to 8, force chain uploading, store the evidence through the consensus of the consortium chain, and record all operation elements. When the scoring result is less than 8 and greater than 5, select chain uploading, and the smart contract automatically verifies the permissions. If the verification passes, enter the fast evidence storage chain. When the scoring result is less than or equal to 5, perform lightweight evidence storage and directly upload to the chain; Through the three-level chain-uploading strategy, automatically select the corresponding chain layer evidence storage contract according to the scoring result.

[0010] Specifically, generating a data life chain according to the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object with anomalies in the multi-blockchain link relationship network diagram includes: When an audit anomaly occurs, perform an aggregation operation on the known abnormal data objects. Using any business data in the known abnormal data objects as the primary key, aggregate all operation records of the abnormal data objects in the multi-blockchain link relationship network diagram, and arrange them in ascending order of timestamp to generate a data life chain; Check the logical faults in the data life chain, and set the logical fault points as abnormal nodes.

[0011] Specifically, locating the abnormal source and the responsible entity according to the data life chain includes: Starting from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it belongs to a permission-related operation, and retain the predecessor nodes that are the same as or associated with the abnormal node subject; Based on the predecessor nodes that are the same as or associated with the abnormal node subject, identify illegal permission acquisition, and locate the abnormal source and the responsible entity.

[0012] Specifically, identifying illegal permission acquisition, and locating the abnormal source and the responsible entity according to the predecessor nodes that are the same as or associated with the abnormal node subject includes: Obtain the permission change records of the predecessor nodes that are the same as or associated with the abnormal node subject, verify whether the permission change operations comply with the judgment rules, and identify illegal permission acquisition. The judgment rules are: unauthorized permission change, over-range permission acquisition, and abnormal permission time limit; Check the login records before and after the permission change operation, identify abnormal login characteristics, and locate the abnormal source; Generate an evidence chain of privilege abuse and locate the responsible entity. Concatenate the traced key precursor nodes in chronological order to generate a privilege abuse path graph. If the privilege change operation is compliant, but subsequent sensitive operations exceed the privilege scope, the responsible entity is the operation executor. If there is approval forgery or system vulnerability exploitation in the privilege change operation, the responsible entity is traced back to the initiator of the privilege change.

[0013] Specifically, when the personnel configuration data is first collected, a unique identifier is assigned, and timestamps, operation identifiers, and link identifiers are embedded at each life cycle node of the data, including: Collect personnel configuration data in real time and preprocess the collected personnel configuration data. The preprocessing includes data verification and cleaning; Generate an initial timestamp and a source identifier, and generate a globally unique digital fingerprint for each piece of personnel configuration data; Perform digital signature on the preprocessed personnel configuration data.

[0014] A full life cycle audit and trace system for implementing the full life cycle audit and trace method, including: a data processing module, a relationship graph generation module, a life chain generation module, and a traceback module; The data processing module is used to assign a unique identifier when the personnel configuration data is first collected, and embed timestamps, operation identifiers, and link identifiers at each life cycle node of the data. The personnel configuration data includes business data and metadata; The relationship graph generation module is used to determine a multi-blockchain link relationship network graph based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, based on a multi-dimensional evidence storage data model and multiple blockchains. The multi-dimensional evidence storage data model records all the element information of the operation behavior in the key node information on the chain. The multiple blockchains are composed of different blockchains determined by the on-chain rules; The life chain generation module is used to generate a data life chain according to all the operation records of the multi-blockchain link relationship network graph and the abnormal node data object with an abnormality in the multi-blockchain link relationship network graph; The traceback module is used to locate the abnormal source and the responsible entity according to the data life chain.

[0015] Specifically, the relationship graph generation module includes: an on-chain unit, an evidence storage unit, and a relationship graph generation unit; The on-chain unit screens key nodes based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, defines the on-chain rules of the blockchain, and uploads the screened key node information to the chain through consensus and contracts; The evidence storage unit is used to construct a multi-dimensional evidence storage data model, design evidence storage fields, and record all the element information of the operation behavior in the key node information on the chain; The relational graph generation unit is used to construct a multi-blockchain link relational network graph based on a multi-dimensional evidence storage data model and multiple blockchains.

[0016] Specifically, the tracking and tracing module includes: a predecessor node checking unit and a positioning and identification unit; The predecessor node checking unit is used to start from an abnormal node, trace back the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it belongs to an operation related to permissions, and retain the predecessor nodes that are the same as or associated with the subject of the abnormal node; The positioning and identification unit is used to identify illegal permission acquisition according to the predecessor nodes that are the same as or associated with the subject of the abnormal node, and locate the source of the abnormality and the responsible entity.

[0017] Compared with the prior art, the beneficial effects of the present invention are: 1. The present invention proposes a full-life-cycle audit tracking system and method. By dynamically evaluating risks to screen key nodes and combining blockchain hierarchical evidence storage, it ensures the operation records of the entire process of data collection, processing, storage, and destruction, and ensures the compliance and security of data.

[0018] 2. The present invention proposes a full-life-cycle audit tracking system and method. Through preliminary anomaly detection, abnormal audit behaviors with high risk warnings are screened out. Then, by constructing a multi-blockchain link relational network graph, when an anomaly occurs, a data life chain is generated, the predecessor nodes of the abnormal node are traced back, each predecessor node is recursively checked, the source of the anomaly and the responsible entity are located, multi-step associated risks can be discovered, the situation of being unable to track during tracking and tracing can be prevented, the misjudgment rate is reduced, and the accuracy of tracking and tracing is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flowchart of the full-life-cycle audit tracking method provided by the present invention; Figure 2 It is a flowchart of preliminary screening provided by the present invention; Figure 3 It is a flowchart of tracking and tracing provided by the present invention; Figure 4 It is an architecture diagram of the full-life-cycle audit tracking system provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] The following specifically describes the present application with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be noted that those of ordinary skill in the art can make several deformations and improvements without departing from the concept of the present application. These all belong to the protection scope of the present application.

[0021] In order to make the objectives, technical solutions and advantages of the present application more clear and understandable, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0022] It should be noted that if there is no conflict, the various features in the embodiments of the present application can be combined with each other, and all are within the protection scope of the present application. In addition, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from the module division in the device or the flowchart. In addition, the terms "first", "second", "third", etc. used in the present application do not limit the data and the execution order, but only distinguish the same items or similar items with basically the same functions and effects.

[0023] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as commonly understood by those skilled in the technical field to which this application belongs. The terms used in this specification in the description of the present application are only for the purpose of describing specific embodiments and are not used to limit the present application. The term "and / or" used in this specification includes any and all combinations of one or more of the related listed items.

[0024] Embodiment 1 Please refer to Figures 1 - 3 , an embodiment provided by the present invention: a full-life cycle audit and tracking method, including the following specific steps: Step S1: Assign a unique identifier when the personnel configuration data is first collected, and embed a timestamp, an operation identifier, and a link identifier at each life cycle node of the data; In this embodiment, before the data enters the audit link, the source verification, structured processing, generation of a globally unique identifier (UID) and metadata (timestamp, source identifier, etc.), and digital signature of the original personnel configuration data are completed to ensure traceability and non-tampering throughout the life cycle.

[0025] The specific steps of Step S1 are as follows: Step S101: Collect personnel configuration data in real time and preprocess the collected personnel configuration data, where the personnel configuration data includes business data and metadata; Specifically, the data access method is as follows: Integrate a lightweight collection SDK or Agent on the human resources system (recruitment platform, attendance system, salary platform, etc.); Deploy a dedicated API gateway at the enterprise intranet and cloud access point, and all HR data requests must be landed through this gateway; Regularly and automatically detect the SDK / Agent version to ensure that the collection logic and security patches are up-to-date; The SDK / Agent captures personnel configuration data in real time by intercepting application-layer API calls or form submissions. The API gateway uniformly processes all access requests based on reverse proxy and Web Application Firewall (WAF) technologies.

[0026] Preprocessing includes data verification and cleaning. Data verification performs field-level format verification on the collected personnel configuration data, such as ID card numbers, email formats, and mobile phone numbers. Regular expressions and Schema validation libraries (such as JSONSchema) are used to ensure the compliance of structured data. Cleaning includes deleting duplicate and redundant data, filling in missing values, and detecting outliers. Statistical methods and rule engines (RuleEngine) are used to detect and clean outliers / missing values. Business data mainly refers to data such as employee names, employee numbers, and attendance records. Metadata mainly refers to information data attached to business data to describe the attributes, sources, status, etc. of this record. Examples of metadata include: business description metadata, with example fields employeeId, eventType, describing which employee and what operation (hire, transfer, termination, etc.) this record data is about; technical tracking metadata, with example fields UID, timestamp, describing the globally unique identifier and high-precision timestamp for sorting and tracing; source environment metadata, with example fields sourceSystemId, nodeId, networkZone, describing the collection system identifier, collection node, and internal / public network label; security neuron data, with example fields signature, publicKeyId, describing the digital signature and the identifier of the public key used for signing, facilitating verification and key management; processing status metadata, with example fields processingStage, auditFlag, describing the current process stage (collected, stored, destroyed) and audit status (normal, abnormal) of the data.

[0027] Step S102: Generate an initial timestamp and a source identifier, and generate a globally unique digital fingerprint for each piece of personnel configuration data. Specifically, inject the core fields of the cleaned personnel configuration data, such as employee number + timestamp + source identifier, calculate the SHA-256 hash of the concatenated string, obtain a 256-bit digest, combine the digest with a random salt again to form a hash, and output the final globally unique digital fingerprint. The initial timestamp comes from an NTP synchronization server to ensure that each collection point uses the same time reference. Add a source identifier to each piece of data, such as the source system ID, collection node ID, or network location label, such as internal / public network.

[0028] Step S103: Perform digital signature on the preprocessed personnel configuration data.

[0029] In this embodiment, an asymmetric encryption algorithm is used to sign the preprocessed personnel configuration data and its metadata, and the signature is appended to the end of the data packet to form a data + signature structure, and the signature public key is saved; Through the above steps, the end-to-end trusted collection of personnel configuration data and the generation of a globally unique identifier are completed. The data collected at different time points will correspond to different identifiers, laying a data foundation for subsequent full-life cycle auditing, effectively avoiding data islands, and preventing tampering and loss in the initial link.

[0030] Step S2: Build a real-time audit model. Through data change monitoring, behavior pattern recognition, and anomaly detection algorithms, each data operation is recorded in real time and compared with the preset audit policies to trigger risk warnings; As Figure 2 shown, the specific steps of step S2 are as follows: Step S201: Real-time monitor the add, delete, and modify operations of personnel configuration data through database triggers and change data capture technologies, parse the captured original operation logs into standardized audit fields, such as operation time, operating user, data object, comparison of before and after values, etc., and store them in an independent audit log library; Step S202: Based on the compliance requirements of human resource management, preset audit policy rules, and establish a normal behavior baseline through historical operation log analysis; Specifically, the audit policy rules are, for example: modification of sensitive data requires dual approval, single-person operation triggers a warning, and sensitive data such as salary, health information, etc.; operations on core data during non-working hours are regarded as abnormal, such as operating on data such as employee departure status and contract expiration date in the early morning; cross-departmental user access to full-employee salary data is automatically intercepted and alarmed, and cross-departmental personnel such as non-HR personnel; Analyze historical operation logs, such as the regular operation frequency, time distribution, data access scope, etc. of a certain position user in the past six months, and establish a normal behavior baseline according to the analysis results, such as an HR specialist only modifies the attendance data of employees in his own department, and the average daily operation is less than or equal to 20 times.

[0031] Step S203: Compare the real-time operation logs with the audit policy rules item by item, such as checking whether the operator has permission, whether the data change conforms to the business process, analyzing the behavior pattern, and using the isolation forest algorithm to identify abnormal patterns that deviate from the behavior baseline. For example, a certain user suddenly exports a large number of employee contact information in batches, far exceeding the daily operation scale, and the same account continuously tries to log in and modify attendance data at different IP addresses, suspected of account theft; In this embodiment, by combining multi-dimensional data such as user roles, operation time, and data object types, it is determined whether the minimum necessary principle is met, normal business fluctuations are distinguished from real violations, and hidden risks are identified to make up for the limitations of manual inspections.

[0032] Step S204: Set real-time warnings according to abnormal behavior patterns, set different response strategies according to risk levels, and conduct preliminary screening of the audit data.

[0033] In this embodiment, the risk levels are divided into low risk, medium risk, and high risk. For low risk, for example, the operation complies with the rules but there is potential room for optimization (such as a single person modifying non-sensitive data), only log records are made and the administrator is prompted to pay attention; for medium risk, for example, some rules are violated but no substantial impact is caused (such as modifying attendance data), a warning notice is immediately sent to the HRBP and IT security teams; for high risk, for example, serious violations or suspected data leaks (such as unauthorized export of all employees' bank account information), the operation is automatically blocked and an emergency plan is triggered, such as freezing the account and starting data tracing. Through real-time data capture technology, it is ensured that during the entire life cycle of personnel configuration data, every change from collection to destruction is recorded. After the recording is completed, rules are set for abnormal analysis to discover potential risks. According to the risk levels, different response strategies are set to conduct preliminary screening of the data, eliminate high-risk data, and process high-risk data to avoid actual losses caused by data leakage or tampering.

[0034] Step S3: Establish blockchain evidence preservation at key operation nodes, conduct multi-dimensional recording of operation behaviors according to operation roles and data access permissions. When audit anomalies occur, use multi-level links for pattern analysis and traceability verification to locate the source of the anomaly and the responsible entity. Such as Figure 3 shown, the specific steps of Step S3 are as follows: Step S301: Based on the entire life cycle of the personnel configuration data after preliminary screening, screen key nodes, define blockchain on-chain rules, and upload the screened key node information to the chain through consensus and contracts. In this embodiment, the entire life cycle of personnel configuration data includes data collection, permission change, sensitive data modification, data destruction, etc. The low-risk and medium-risk operation nodes are screened out as key nodes. For example: batch adjustment of employee salaries, modification of key information in labor contracts, destruction of data of departing employees, administrator permission allocation, data docking with third-party systems such as social security platform data synchronization, etc. The specific steps for uploading the screened key node information to the chain through consensus and contracts include: Step S3011: Train a multi-dimensional risk scoring model based on machine learning algorithms, input the screened key node information into the trained multi-dimensional risk scoring model, and output a scoring result. Step S3012: Preset a three - level on - chain strategy. When the scoring result is greater than or equal to 8, force on - chain, conduct evidence storage through the consensus of the consortium chain, and record all operation elements. When the scoring result is less than 8 and greater than 5, optional on - chain, and the smart contract automatically verifies permissions. If the verification passes, enter the fast evidence - storage chain. When the scoring result is less than or equal to 5, conduct lightweight evidence storage and directly on - chain; Step S3013: Through the three - level on - chain strategy, automatically select the corresponding chain - layer evidence - storage contract according to the risk scoring result.

[0035] Specifically, it is selected through the preset channel mapping rules in the chain code. The mapping logic is risk scoring → evidence - storage channel. According to the real - time risk scoring, automatically call the evidence - storage contract of the corresponding chain layer to achieve the automatic matching of "operation → chain layer". The three scoring on - chains correspond to different blockchains.

[0036] The evidence storage through the consortium chain consensus includes adopting an improved PBET formula algorithm. When the number of confirmed nodes with a label greater than or equal to 2f + 1, where f represents the maximum number of Byzantine nodes that can be tolerated, it is determined that the consensus passes and on - chain is carried out, otherwise it is marked as invalid.

[0037] Step S302: Build a multi - dimensional evidence - storage data model, design evidence - storage fields, and record all the element information of the operation behavior in the key node information on - chain, including at least: operation subject, operation object, operation characteristics, and on - chain identifier; In this embodiment, the operation subject includes: user ID, role, department, job number, etc.; the operation object includes: data type (such as salary, attendance, and contract), data unique identifier, data version; the operation characteristics include: timestamp, operation type, IP address, device fingerprint, approval process ID, etc.; the on - chain identifier includes: block height, transaction hash, forward / backward block link.

[0038] Step S303: Based on the multi - dimensional evidence - storage data model and multi - blockchains, build a multi - blockchain link relationship network diagram. Among them, the nodes are operation records, and the edges are association relationships. String together all the operations of the same data object in chronological order to form a data life chain, and trace and audit anomalies according to the data life chain to locate the source of anomalies and the responsible entity.

[0039] The specific steps of Step S303 are as follows: Step S3031: Based on the multi - dimensional evidence - storage data model and multi - blockchains, analyze the association relationships of operation records, including: time - series relationship, operation dependency relationship, permission association relationship, and device / IP association relationship, and build a multi - blockchain link relationship network diagram; In this embodiment, the timing relationship is that the operations of the same data object are sorted by timestamp, with the previous operation pointing to the next operation, forming a time-chain edge. For example, create → first modification → second modification → archive; the operation dependency relationship is that the approval operation and the execution operation are associated through a dependency node, forming a process-chain edge. For example, the approval passed node points to the data modification node; the permission association relationship is the association between the operation subject role and the sensitivity of the data object, and a set of legal permission edges is predefined through a permission table. For example, ordinary employee → query own attendance is a compliant edge, and ordinary employee → query executive salary is an abnormal edge; the device / IP association relationship is that multiple operation nodes under the same device fingerprint or IP address are interconnected to identify the operation mode of abnormal device concentration. For example, more than 10 different accounts access sensitive data under the same public Wi-Fi; Potential risks that cannot be discovered by a single-node audit can be identified through the edge relationship.

[0040] Step S3032: When an audit anomaly occurs, perform an aggregation operation on the known abnormal data objects. Using any business data in the known abnormal data objects as the primary key, aggregate all the operation records of the abnormal data objects in the multi-blockchain link relationship network diagram, and arrange them in ascending order of timestamp to generate a data life chain; In this embodiment, for example, using the employee ID as the primary key, aggregate all the operation records of the abnormal data objects in the multi-blockchain link relationship network diagram. The life chain of the employee is: create (2024-01-01) → salary adjustment (requiring approval) (2024-06-06) → approval passed (2024-06-07) → salary modification (2025-03-16) → attendance anomaly marked (2025-04-01) → separation data archived (2025-04-20); By constructing the data life chain, abnormal nodes can be discovered more efficiently and accurately.

[0041] Step S3033: Check the logical breakpoints in the data life chain, and set the logical breakpoint as an abnormal node; Specifically, for logical breakpoint judgment: whether there is a missing approval node before a sensitive operation, such as no approval passed node before salary modification; whether the archiving process is completed before data destruction, such as no archiving node before separation data destruction, etc. Abnormal nodes are judged through logical breakpoints.

[0042] Step S3034: Starting from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it belongs to a permission-related operation, and retain the predecessor nodes with the same subject as the abnormal node or permission association; Specifically, starting from the abnormal node, trace forward its three types of key precursor operations: permission change operations, such as role upgrade, permission group addition, approval process creation; login authentication operations, such as off-site IP login, unfamiliar device authentication, multi-factor authentication bypass; process dependency operations, such as approval passed, permission application, system vulnerability exploitation. Set the backtracking time window and the type of edges for backtracking, and collect all direct precursor nodes through reverse graph traversal. Recursively check whether they belong to permission-related operations. If the operation type includes permission change, role assignment, approval passed, only retain the precursor nodes that are the same as the abnormal node subject or are permission-related, and exclude irrelevant operations, such as system automatic backup, regular data query.

[0043] Step S3035: Identify illegal permission acquisition based on the precursor nodes that are the same as the abnormal node subject or are permission-related, and locate the source of the anomaly and the responsible entity.

[0044] The specific steps of the said step S3035 are as follows: Step S30351: Obtain the permission change records of the precursor nodes that are the same as the abnormal node subject or are permission-related, verify whether the permission change operations comply with the judgment rules, and identify illegal permission acquisition. The judgment rules are: no approval permission change, out-of-scope permission acquisition, and abnormal permission time limit; In this embodiment, the judgment rules are: no approval permission change, there is no approval passed node associated with the permission change node, and the changed permission exceeds the role responsibility definition, such as an intern obtaining data deletion permission; out-of-scope permission acquisition and abnormal permission time limit, the permission validity period exceeds the business rules, such as the temporary permission duration > 72 hours without being recovered.

[0045] Step S30352: Check the login records before and after the permission change operation, identify abnormal login characteristics, and locate the source of the anomaly; Specifically, the abnormal login characteristics are such as: the login IP does not match the user's usual residence, such as a user in Shanghai suddenly logging in from a Beijing IP; the device fingerprint is not registered, such as accessing the permission management system for the first time using an unfamiliar device, etc.

[0046] Step S30353: Generate an evidence chain of permission abuse and locate the responsible entity. Concatenate the traced key precursor nodes in chronological order to generate a permission abuse path graph. If the permission change operation is compliant, but subsequent sensitive operations exceed the permission scope, the responsible entity is the operation executor. If there is approval forgery or system vulnerability exploitation in the permission change operation, the responsible entity is traced back to the initiator of the permission change.

[0047] Specifically, an example of the permission abuse path graph is: abnormal node (data export) ← permission change (add "salary export" permission) ← approval forgery (false approval passed node) ← account theft (unfamiliar device login), and the responsible entity is determined according to the responsible entity judgment rule.

[0048] Through a multi-blockchain and multi-dimensional evidence-preserving data model, a multi-blockchain link relationship network diagram is constructed. According to abnormal situations, a data life chain is constructed, and the abnormal precursor nodes are traced from the data life chain to locate the abnormal source and the responsible entity. The blockchain screens the data and ensures the security of the data. By traversing the data life chain, the abnormal source and the responsible entity are found. Compared with traditional log search, the backtracking time is greatly reduced, the missed judgment rate is lowered, and long-term privilege abuse can be automatically discovered, making up for the deficiency of manual review in the correlation analysis of historical operations.

[0049] Step S4: In the data destruction stage, information such as the destruction method, time, and responsible person is encrypted and stored and link-packaged, which is consistent with the life cycle chain.

[0050] Embodiment 2 Please refer to Figure 4 , another embodiment provided by the present invention: a full-life-cycle audit and tracking system, including: a data processing module, a relationship diagram generation module, a life chain generation module, and a tracking and backtracking module; The data processing module is used to assign a unique identifier when the personnel configuration data is first collected, and embed a time stamp, an operation identifier, and a link identifier at each life cycle node of the data. The personnel configuration data includes business data and metadata; The relationship diagram generation module is used to determine a multi-blockchain link relationship network diagram based on the personnel configuration data and the corresponding time stamp, operation identifier, and link identifier, based on a multi-dimensional evidence-preserving data model and a multi-blockchain. The multi-dimensional evidence-preserving data model records all-element information of operation behaviors in the key node information on the chain. The multi-blockchain is composed of different blockchains determined by the on-chain rules; The life chain generation module is used to generate a data life chain according to all operation records of the multi-blockchain link relationship network diagram and the abnormal node data object where an abnormality occurs in the multi-blockchain link relationship network diagram; The tracking and backtracking module is used to locate the abnormal source and the responsible entity according to the data life chain.

[0051] The relationship diagram generation module includes: an on-chain unit, an evidence-preserving unit, and a relationship diagram generation unit; The on-chain unit screens key nodes based on the personnel configuration data and the corresponding time stamp, operation identifier, and link identifier, defines the on-chain rules of the blockchain, and uploads the screened key node information to the chain through consensus and contracts; The evidence-preserving unit is used to construct a multi-dimensional evidence-preserving data model, design evidence-preserving fields, and record all-element information of operation behaviors in the key node information on the chain; The relationship graph generation unit is used to construct a multi-blockchain link relationship network diagram based on a multi-dimensional evidence storage data model and multiple blockchains.

[0052] The traceback module includes: a predecessor node checking unit and a positioning and identification unit; The predecessor node checking unit is used to start from an abnormal node, trace back the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it belongs to an operation related to permissions, and retain the predecessor nodes that are the same as or associated with the abnormal node subject; The positioning and identification unit is used to identify illegal permission acquisition according to the predecessor nodes that are the same as or associated with the abnormal node subject, and locate the source of the abnormality and the responsible entity.

[0053] In addition, the parts of the above technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0054] As described above in the specific embodiments, the purpose, technical solutions, and beneficial effects of the present invention have been further described in detail. It should be understood that the above are only specific embodiments of the present invention and are not used to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. Full life cycle audit and tracking method, characterized in that, It includes the following specific steps: When the personnel configuration data is collected for the first time, a unique identifier is assigned, and timestamps, operation identifiers, and link identifiers are embedded at each lifecycle node of the data. The personnel configuration data includes business data and metadata; Based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, a multi-blockchain link relationship network diagram is determined based on a multi-dimensional evidence storage data model and multiple blockchains. The multi-dimensional evidence storage data model records all-element information of operation behaviors in the key node information on the chain, and the multiple blockchains are composed of different blockchains determined by the on-chain rules; Based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object with an anomaly in the multi-blockchain link relationship network diagram, a data life chain is generated; Locate the anomaly source and responsible entity based on the data life chain.

2. The full life cycle audit and tracking method according to claim 1, characterized in that The determining of the multi-blockchain link relationship network diagram based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, based on a multi-dimensional evidence storage data model and multiple blockchains, includes: Screen key nodes based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, define the on-chain rules for the blockchain, and upload the screened key node information to the chain through consensus and contracts; Construct a multi-dimensional evidence storage data model, design evidence storage fields, and record all-element information of operation behaviors in the key node information on the chain, including: operation subject, operation object, operation characteristics, and on-chain identifier; Based on the multi-dimensional evidence storage data model and multiple blockchains, construct a multi-blockchain link relationship network diagram, where the nodes are operation records and the edges are association relationships.

3. The full life cycle audit and tracking method according to claim 2, characterized in that The screening of key nodes based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, defining the on-chain rules for the blockchain, and uploading the screened key node information to the chain through consensus and contracts, includes: Train a multi-dimensional risk scoring model based on a machine learning algorithm, input the screened key node information into the trained multi-dimensional risk scoring model, and output a scoring result; Preset a three-level on-chain strategy. When the scoring result is greater than or equal to 8, force it to be on the chain, store the evidence through the consensus of the consortium chain, and record all operation elements. When the scoring result is less than 8 and greater than 5, select to be on the chain, and the smart contract automatically verifies the permissions. If the verification passes, it enters the evidence storage chain. When the scoring result is less than or equal to 5, perform lightweight evidence storage and directly go on the chain; Through the three-level on-chain strategy, automatically select the corresponding chain layer evidence storage contract according to the scoring result.

4. The full life cycle audit and tracking method according to claim 1, characterized in that The generating of the data life chain based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object with an anomaly in the multi-blockchain link relationship network diagram, includes: When an audit anomaly occurs, perform an aggregation operation on the known abnormal data objects. Using any business data in the known abnormal data objects as the primary key, aggregate all operation records of the abnormal data objects in the multi-blockchain link relationship network diagram, and arrange them in ascending order of timestamps to generate a data life chain; Check the logical faults in the data life chain, and set the logical fault points as abnormal nodes.

5. The full life cycle audit and tracking method according to claim 1, characterized in that The locating of the anomaly source and responsible entity based on the data life chain, includes: Starting from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it belongs to an operation related to permissions, and retain the predecessor nodes that are the same as or associated with the main body of the abnormal node; Based on the predecessor nodes that are the same as or associated with the main body of the abnormal node, identify illegal permission acquisition, and locate the source of the abnormality and the responsible entity.

6. The full life cycle audit and tracking method according to claim 5, characterized in that The identifying illegal permission acquisition, locating the source of the abnormality and the responsible entity according to the predecessor nodes that are the same as or associated with the main body of the abnormal node includes: Obtain the permission change records of the predecessor nodes that are the same as or associated with the main body of the abnormal node, verify whether the permission change operation conforms to the determination rules, and identify illegal permission acquisition. The determination rules are: unauthorized permission change, out-of-scope permission acquisition, and abnormal permission timeliness; Check the login records before and after the permission change operation, identify abnormal login characteristics, and locate the source of the abnormality; Generate an evidence chain of permission abuse and locate the responsible entity. Concatenate the key predecessor nodes traced back in chronological order to generate a permission abuse path diagram. If the permission change operation is compliant, but subsequent operations exceed the permission scope, the responsible entity is the operation executor. If there is approval forgery or system vulnerability exploitation in the permission change operation, the responsible entity is traced back to the initiator of the permission change.

7. The full life cycle audit and tracking method according to claim 1, characterized in that The assigning a unique identifier at the first collection of personnel configuration data and embedding timestamps, operation identifiers, and link identifiers at each life cycle node of the data includes: Real-time collect personnel configuration data, and preprocess the collected personnel configuration data. The preprocessing includes data verification and cleaning; Generate an initial timestamp and a source identifier, and generate a globally unique digital fingerprint for each piece of personnel configuration data; Perform digital signature on the preprocessed personnel configuration data.

8. A full - life - cycle audit and tracking system for implementing the full - life - cycle audit and tracking method according to any one of claims 1 - 7, characterized in that, Including: A data processing module, a relationship graph generation module, a life chain generation module, and a tracing and backtracking module; The data processing module is used to assign a unique identifier at the first collection of personnel configuration data, and embed timestamps, operation identifiers, and link identifiers at each life cycle node of the data. The personnel configuration data includes business data and metadata; The relationship graph generation module is used to determine a multi-blockchain link relationship network diagram based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, based on a multi-dimensional evidence storage data model and multiple blockchains. The multi-dimensional evidence storage data model records all-element information of operation behaviors in the key node information on the chain. The multiple blockchains are composed of different blockchains determined by the on-chain rules; The life chain generation module is used to generate a data life chain according to all operation records of the multi-blockchain link relationship network diagram and the abnormal node data object where an abnormality occurs in the multi-blockchain link relationship network diagram; The tracing and backtracking module is used to locate the source of the abnormality and the responsible entity according to the data life chain.

9. The full life cycle audit and tracking system according to claim 8, wherein The relationship graph generation module includes: an on-chain unit, an evidence storage unit, and a relationship graph generation unit; The on-chain unit filters key nodes based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, defines blockchain on-chain rules, and uploads the screened key node information to the chain through consensus and contracts; The evidence storage unit is used to construct a multi-dimensional evidence storage data model, design evidence storage fields, and record all-element information of operation behaviors in the key node information uploaded to the blockchain. The relationship graph generation unit is used to construct a multi-blockchain link relationship network diagram based on the multi-dimensional evidence storage data model and multiple blockchains.

10. The full life cycle audit and tracking system according to claim 9, characterized in that, The tracking and tracing module includes: a predecessor node checking unit and a positioning and identifying unit; The predecessor node checking unit is used to start from an abnormal node, trace back the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it belongs to an operation related to permissions, and retain the predecessor nodes that are the same as or associated with the abnormal node subject; The positioning and identifying unit is used to identify illegal permission acquisition according to the predecessor nodes that are the same as or associated with the abnormal node subject, and locate the source of the abnormality and the responsible entity.

Images