Full life cycle audit tracking system and method

Abstract

The present invention discloses a full life cycle audit tracking system and method, which belongs to the field of data tracking and backtracing technology. The method specifically includes: allocating a global unique identifier to personnel configuration data when it is first collected, and embedding a timestamp, an operation identifier and a link identifier at each data life cycle node, building a real-time audit model, and recording each data operation in real time through data change monitoring, behavior pattern recognition and anomaly detection algorithms, comparing it with a preset audit strategy, triggering a risk warning, establishing blockchain evidence at key operation nodes, and constructing a multi-blockchain link relationship network diagram based on multiple blockchains. When an abnormal node appears, a data life chain is generated, the predecessor node of the abnormal node is traced back, and each predecessor node is recursively checked to locate the source of the abnormality and the responsible party. The present application can discover multi-step related risks, prevent the situation where tracking cannot be found during tracking and backtracing, reduce the missed judgment rate, and improve the accuracy and efficiency of tracking and backtracing.

Description

Technical Field

[0001] The present invention belongs to the technical field of data tracking and backtracking, and in particular to a full life cycle audit tracking system and method. Background Art

[0002] Human resource (HR) management systems at modern large enterprises typically consist of multiple subsystems, including recruitment, attendance, compensation, performance management, and resignation. These subsystems are often deployed across local data centers and cloud environments, each generating its own audit logs and creating data silos.

[0003] When it is necessary to trace the data of an employee throughout its entire life cycle (from employment to departure and destruction), the following problems may arise: broken chains, inconsistent log formats or lack of records, resulting in the inability to trace back end to end; incomplete compliance checks, and traditional solutions are unable to cover the entire life cycle of data from collection to destruction; insufficient anomaly detection capabilities, and traditional technologies are unable to identify complex risks associated with multiple steps.

[0004] For example, a Chinese patent with authorization announcement number CN114372296B discloses a blockchain-based user behavior data audit method and system, which includes the following steps: S1, perform initialization operations; S2, collect user behavior data in real time based on a unified data storage specification; S3, upload and deploy data fingerprints and other information to the blockchain as credentials based on data segmentation and a secondary index storage mechanism; S4, verify the integrity of user behavior data, traverse the secondary index storage mechanism, and obtain a collection of files storing user behavior data; based on a "challenge-response-verification" model, use smart contracts to audit the integrity of user behavior data; S5, use the intact user behavior data as the audit basis to track and audit data security incidents and evaluate the quality of cloud services. This invention effectively solves the trust issue between cloud service providers and users by utilizing the non-repudiation of blockchain, ensuring a secure and reliable audit process; and utilizes a secondary index storage mechanism to improve the efficiency of auditing massive amounts of data.

[0005] The defects of the above-mentioned existing technologies: Although blockchain can perform backtracking, it is difficult to discover the relationship between abnormal nodes and previous nodes. In a complex audit data environment, it is difficult to discover complex anomalies with multi-step associations and cannot be accurately located. Summary of the Invention

[0006] In response to the shortcomings of the existing technology, the present invention proposes a full life cycle audit tracking system and method, which can achieve real-time monitoring, complete recording and traceability in each stage of data collection, transmission, processing, storage and destruction. At the same time, through associated identification, multiple blockchains and tracking backtracking, it effectively avoids the defects of data silos and broken tracking chains in traditional methods, realizes closed-loop audit tracking of the entire life cycle of personnel configuration data, and greatly improves data security and compliance.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] Full lifecycle audit trail approach, including:

[0009] Assigning a unique identifier to personnel configuration data when it is first collected, and embedding a timestamp, operation identifier, and link identifier at each data lifecycle node. The personnel configuration data includes business data and metadata.

[0010] Based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, a multi-blockchain link relationship network diagram is determined based on a multi-dimensional evidence data model and multiple blockchains. The multi-dimensional evidence data model records all elements of the operation behavior in the key node information on the chain, and the multiple blockchains are composed of different blockchains determined by the chain rules;

[0011] Generate a data lifecycle based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram;

[0012] Locate the source of the anomaly and the responsible party based on the data life cycle.

[0013] Specifically, the multi-blockchain link relationship network diagram is determined based on the multi-dimensional evidence data model and multiple blockchains according to the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, including:

[0014] Based on personnel configuration data and corresponding timestamps, operation identifiers, and link identifiers, key nodes are screened, blockchain on-chain rules are defined, and the selected key node information is uploaded to the blockchain through consensus and contracts;

[0015] Build a multi-dimensional evidence data model, design evidence fields, and record all elements of the operation behavior in the key node information on the chain, including: operation subject, operation object, operation characteristics and on-chain identification;

[0016] Based on the multi-dimensional evidence data model and multiple blockchains, a multi-blockchain link relationship network diagram is constructed, where nodes are operation records and edges are association relationships.

[0017] Specifically, the method of screening key nodes based on personnel configuration data and corresponding timestamps, operation identifiers, and link identifiers, defining blockchain on-chain rules, and uploading the screened key node information to the blockchain through consensus and contracts includes:

[0018] Train a multidimensional risk scoring model based on a machine learning algorithm, input the filtered key node information into the trained multidimensional risk scoring model, and output the scoring results;

[0019] A three-level chain-up strategy is preset. When the score is greater than or equal to 8, it is forced to be on-chain, and evidence is stored through the alliance chain consensus, recording all operation elements. When the score is less than 8 and greater than 5, it is selected to be on-chain, and the smart contract automatically verifies the authority. If the verification passes, it enters the fast evidence storage chain. When the score is less than or equal to 5, lightweight evidence is stored and directly on-chain;

[0020] Through the three-level chain strategy, the corresponding chain-level evidence storage contract is automatically selected based on the scoring results.

[0021] Specifically, generating a data lifecycle according to the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram includes:

[0022] When an audit exception occurs, perform an aggregation operation on the known abnormal data object. Using any business data in the known abnormal data object as the primary key, aggregate all operation records of the abnormal data object in the multi-blockchain link relationship network diagram, arrange them in ascending order by timestamp, and generate a data life chain.

[0023] Check the logical faults in the data life cycle and set the logical fault points as abnormal nodes.

[0024] Specifically, locating the source of the anomaly and the responsible party based on the data lifecycle includes:

[0025] Starting from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it is a permission-related operation, and retain the predecessor nodes with the same subject or permission-related as the abnormal node;

[0026] Based on the predecessor nodes with the same subject or associated permissions as the abnormal node, illegal permission acquisition is identified and the source of the abnormality and the responsible party are located.

[0027] Specifically, identifying illegal permission acquisition based on the predecessor node that is identical to or has permissions associated with the abnormal node, and locating the abnormal source and responsible party includes:

[0028] Obtain permission change records for predecessor nodes with the same subject or associated permissions as the abnormal node, verify whether the permission change operation complies with the judgment rules, and identify illegal permission acquisition. The judgment rules are: unapproved permission change, permission acquisition beyond the scope, and abnormal permission expiration;

[0029] Check login records before and after permission changes, identify abnormal login characteristics, and locate the source of the anomaly;

[0030] Generate a chain of evidence of authority abuse and locate the responsible party. Connect the key predecessor nodes traced back in chronological order to generate a path diagram of authority abuse. If the authority change operation is compliant but the subsequent sensitive operation exceeds the scope of authority, the responsible party is the operator of the operation. If the authority change operation involves approval forgery or system vulnerability exploitation, the responsible party will be traced back to the initiator of the authority change.

[0031] Specifically, a unique identifier is assigned when the personnel configuration data is first collected, and a timestamp, operation identifier, and link identifier are embedded in each data lifecycle node, including:

[0032] Collecting personnel configuration data in real time and preprocessing the collected personnel configuration data, including data verification and cleaning;

[0033] Generate an initial timestamp and source identifier, and generate a globally unique digital fingerprint for each piece of staffing data;

[0034] Digitally sign the pre-processed staffing data.

[0035] A full life cycle audit tracking system is used to implement the full life cycle audit tracking method, including: a data processing module, a relationship diagram generation module, a life chain generation module and a tracking and tracing module;

[0036] The data processing module is used to assign a unique identifier when the personnel configuration data is first collected, and to embed a timestamp, an operation identifier, and a link identifier at each lifecycle node of the data, wherein the personnel configuration data includes business data and metadata;

[0037] The relationship graph generation module is used to determine a multi-blockchain link relationship network graph based on the multi-dimensional evidence data model and multiple blockchains according to the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers. The multi-dimensional evidence data model records all the elements of the operation behavior in the key node information on the chain, and the multiple blockchains are composed of different blockchains determined by the chain rules;

[0038] The life chain generation module is used to generate a data life chain based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram;

[0039] The tracking and tracing module is used to locate the source of the anomaly and the responsible party based on the data life chain.

[0040] Specifically, the relationship graph generation module includes: a chain unit, a proof storage unit and a relationship graph generation unit;

[0041] The on-chain unit selects key nodes based on personnel configuration data and corresponding timestamps, operation identifiers, and link identifiers, defines blockchain on-chain rules, and uploads the selected key node information to the blockchain through consensus and contracts;

[0042] The evidence storage unit is used to build a multi-dimensional evidence storage data model, design evidence storage fields, and record all elements of the operation behavior in the key node information on the chain;

[0043] The relationship graph generation unit is used to construct a multi-blockchain link relationship network graph based on a multi-dimensional evidence data model and multiple blockchains.

[0044] Specifically, the tracking and tracing module includes: a predecessor node inspection unit and a positioning and identification unit;

[0045] The predecessor node checking unit is used to start from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node, determine whether it is a permission-related operation, and retain the predecessor nodes with the same subject as the abnormal node or with permission-related operations;

[0046] The positioning and identification unit is used to identify illegal permission acquisition and locate the abnormal source and responsible party based on the predecessor node that is the same as or has authority-related with the abnormal node subject.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] 1. This invention proposes a full life cycle audit tracking system and method, which screens key nodes through dynamic risk assessment and combines blockchain layered evidence storage to ensure the full process operation records of data collection, processing, storage, and destruction, thereby ensuring the compliance and security of data.

[0049] 2. The present invention proposes a full life cycle audit tracking system and method. Through preliminary anomaly detection, abnormal audit behaviors with high risk warning are screened out. Then, by constructing a multi-blockchain link relationship network diagram, when an anomaly occurs, a data life chain is generated, and the predecessor node of the abnormal node is traced back. Each predecessor node is recursively checked to locate the source of the anomaly and the responsible party. It can discover multi-step related risks, prevent the situation where tracking cannot be found during tracing back, reduce the missed judgment rate, and improve the accuracy of tracing back. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1A flow chart of the full life cycle audit tracking method provided by the present invention;

[0051] Figure 2 A preliminary screening flow chart provided for the present invention;

[0052] Figure 3 The tracking and backtracking flow chart provided by the present invention;

[0053] Figure 4 This is the architecture diagram of the full life cycle audit tracking system provided by the present invention. DETAILED DESCRIPTION

[0054] The present application is described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the present application, but are not intended to limit the present application in any form. It should be noted that those skilled in the art may make several variations and improvements without departing from the scope of the present application. These all fall within the scope of protection of the present application.

[0055] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0056] It should be noted that, if there is no conflict, the various features in the embodiments of the present application can be combined with each other and are all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematic and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flow chart. In addition, the words "first", "second", "third", etc. used in this application do not limit the data and execution order, but only distinguish between the same items or similar items with basically the same functions and effects.

[0057] Unless otherwise defined, all technical and scientific terms used in this specification have the same meanings as those commonly understood by those skilled in the art to which this application belongs. The terms used in this specification and in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" as used in this specification includes any and all combinations of one or more of the relevant listed items.

[0058] Example 1

[0059] See also Figure 1-Figure 3 The present invention provides an embodiment of a full life cycle audit tracking method, comprising the following specific steps:

[0060] Step S1: assign a unique identifier when the personnel configuration data is first collected, and embed a timestamp, operation identifier, and link identifier at each lifecycle node of the data;

[0061] In this embodiment, before the data enters the audit link, the source verification, structural processing, generation and digital signature of the original personnel configuration data, including a globally unique identifier (UID) and metadata (timestamp, source identifier, etc.), are completed to ensure that the data is traceable and cannot be tampered with throughout the subsequent life cycle.

[0062] The specific steps of step S1 are:

[0063] Step S101: collecting personnel configuration data in real time and preprocessing the collected personnel configuration data, wherein the personnel configuration data includes business data and metadata;

[0064] Specifically, data access involves integrating a lightweight data collection SDK or agent into the HR system (recruitment platform, attendance system, payroll platform, etc.); deploying a dedicated API gateway at the enterprise intranet and cloud access points, through which all HR data requests must be processed; and regularly automatically checking SDK / Agent versions to ensure that data collection logic and security patches are up to date.

[0065] SDK / Agent captures staffing data in real time by intercepting application-layer API calls or form submissions. The API gateway processes all access requests in a unified manner based on reverse proxy and Web Application Firewall (WAF) technology.

[0066] Preprocessing includes data validation and cleaning. Data validation involves field-level format verification of collected personnel configuration data, such as ID number, email address format, and mobile phone number format. Regular expressions and schema validation libraries (such as JSONSchema) are used to ensure structured data compliance. Cleaning includes deleting duplicate and redundant data, filling missing values, and detecting outliers. Statistics and the Rule Engine are used to detect and clean up outliers / missing values.

[0067] Business data mainly refers to data such as employee name, work number, and attendance records. Metadata mainly refers to information data attached to business data that is used to describe the attributes, source, status, and other information of this record. Metadata includes: business description metadata, example fields employeeId and eventType, which describe which employee and what operation (hire, transfer, resignation, etc.) this record data belongs to; technical tracking metadata, example fields UID and timestamp, which describe the globally unique identifier and high-precision timestamp for sorting and tracing; source environment metadata, example fields sourceSystemId, nodeId, and networkZone, which describe the collection system identifier, collection node, and internal / public network label; security neuron data, example fields signature and publicKeyId, which describe the digital signature and the public key used for the signature, for verification and key management; processing status metadata, example fields processingStage and auditFlag, which describe the current data process stage (collected, stored, destroyed) and audit status (normal, abnormal).

[0068] Step S102: Generate an initial timestamp and source identifier, and generate a globally unique digital fingerprint for each piece of personnel configuration data;

[0069] Specifically, the core fields of the cleaned personnel configuration data are injected, such as employee ID + timestamp + source identifier, and the SHA-256 hash is calculated for the concatenated string to obtain a 256-bit summary. The summary is combined with a random salt to form a hash, and the final globally unique digital fingerprint is output; the initial timestamp comes from the NTP synchronization server to ensure that each collection point uses the same time base, and a source identifier is added to each data, such as the source system ID, collection node ID or network location tag, such as intranet / public network.

[0070] Step S103: digitally sign the pre-processed personnel configuration data.

[0071] In this embodiment, an asymmetric encryption algorithm is used to sign the pre-processed personnel configuration data and its metadata, and the signature is appended to the end of the data packet to form a data + signature structure, and the signature public key is saved;

[0072] The above steps complete the end-to-end trusted collection of personnel configuration data and the generation of a globally unique identifier. Data collected at different time points will correspond to different identifiers, laying a data foundation for subsequent full life cycle audits. It also effectively avoids data silos and prevents tampering and loss in the initial stages.

[0073] Step S2: Build a real-time audit model. Through data change monitoring, behavior pattern recognition, and anomaly detection algorithms, each data operation is recorded in real time, compared with the preset audit strategy, and triggers risk warnings.

[0074] like Figure 2 As shown, the specific steps of step S2 are:

[0075] Step S201: Using database triggers and change data capture technology to monitor the addition, deletion, and modification operations of personnel configuration data in real time, the captured raw operation logs are parsed into standardized audit fields, such as operation time, operation user, data object, and before-after value comparison, and stored in an independent audit log library;

[0076] Step S202: Based on human resource management compliance requirements, preset audit policy rules and establish a normal behavior baseline through historical operation log analysis;

[0077] Specifically, audit policy rules include: sensitive data modifications require two-person approval, single-person operations trigger alerts, sensitive data such as salary and health information; operations on core data during non-working hours are considered abnormal, such as operations on employee resignation status, contract expiration dates, etc. in the early morning; cross-departmental users accessing all employee salary data will be automatically intercepted and an alarm will be issued, cross-departmental personnel such as non-HR personnel;

[0078] Analyze historical operation logs, such as the frequency, time distribution, and data access scope of regular operations performed by users in a certain position over the past six months. Establish a normal behavior baseline based on the analysis results. For example, an HR specialist may only modify the attendance data of employees in their department each month, with an average daily operation of less than or equal to 20 times.

[0079] Step S203: Compare the real-time operation logs against the audit policy rules one by one, such as checking whether the operator has the authority and whether the data changes comply with the business process. Analyze the behavior patterns and use the isolation forest algorithm to identify abnormal patterns that deviate from the behavior baseline. For example, a user suddenly exports a large number of employee contact information in batches, far exceeding the daily operation scale. The same account repeatedly attempts to log in and modify attendance data from a remote IP address, which may indicate suspected account theft.

[0080] In this embodiment, multi-dimensional data such as user role, operation time, and data object type are combined to determine whether the principle of minimum necessity is met, distinguish normal business fluctuations from real violations, and identify hidden risks to make up for the limitations of manual inspections.

[0081] Step S204: Set up real-time warnings based on abnormal behavior patterns, set up different response strategies based on risk levels, and conduct preliminary screening of audit data.

[0082] In this embodiment, risk levels are divided into low, medium, and high. Low risk, for example, occurs when an operation complies with regulations but has potential for optimization (e.g., a single person modifying non-sensitive data). In this case, only a log is recorded and the administrator is prompted for attention. Medium risk, for example, occurs when some regulations are violated but no substantial impact is caused (e.g., modifying attendance data). An early warning notification is immediately sent to the HRBP and IT security team. High risk, for example, occurs when there is a serious violation or suspected data leak (e.g., unauthorized export of all employees' bank account information). The operation is automatically blocked and emergency plans are triggered, such as freezing accounts and initiating data tracing.

[0083] Through real-time data capture technology, we ensure that every change in the entire life cycle of personnel configuration data, from collection to destruction, is recorded. After the record is completed, rules are set to conduct anomaly analysis to identify potential risks. According to the level of risk, different response strategies are set up, and the data is preliminarily screened to eliminate high-risk data. High-risk data is then processed to avoid data leakage or tampering that would cause actual losses.

[0084] Step S3: Establish blockchain evidence at key operation nodes, record operational behaviors in multiple dimensions based on operation roles and data access rights, and use multi-level links to conduct pattern analysis and traceability verification when audit anomalies occur to locate the source of the anomaly and the responsible party.

[0085] like Figure 3 As shown, the specific steps of step S3 are:

[0086] Step S301: Based on the full life cycle of the initially screened personnel configuration data, key nodes are screened, blockchain on-chain rules are defined, and the screened key node information is uploaded to the blockchain through consensus and contracts;

[0087] In this embodiment, the entire lifecycle of personnel configuration data includes data collection, permission changes, sensitive data modification, data destruction, etc., and low-risk and medium-risk operation nodes are selected as key nodes, such as: batch adjustment of employee salaries, modification of key information in labor contracts, destruction of data of resigned employees, allocation of administrator permissions, and data connection with third-party systems such as synchronization of social security platform data.

[0088] The selected key node information is uploaded to the chain through consensus and contract. The specific steps include:

[0089] Step S3011: training a multidimensional risk scoring model based on a machine learning algorithm, inputting the filtered key node information into the trained multidimensional risk scoring model, and outputting the scoring results;

[0090] Step S3012: A three-level chain-up strategy is preset. When the score result is greater than or equal to 8, it is mandatory to chain up, and the evidence is stored through the alliance chain consensus, recording all operation elements. When the score result is less than 8 and greater than 5, it can be optionally chained up, and the smart contract automatically verifies the authority. If the verification passes, it enters the fast evidence storage chain. When the score result is less than or equal to 5, lightweight evidence is stored and directly uploaded to the chain;

[0091] Step S3013: Through the three-level chain strategy, the corresponding chain-layer evidence storage contract is automatically selected according to the risk scoring results.

[0092] Specifically, the selection is made through the channel mapping rules preset in the chain code. The mapping logic is risk score → evidence channel. According to the real-time risk score, the evidence contract of the corresponding chain layer is automatically called to realize the automatic matching of "operation → chain layer". The three scores on the chain correspond to different blockchains.

[0093] The said evidence storage through alliance chain consensus includes adopting an improved PBET formula algorithm to confirm that when the node passes the label greater than or equal to 2f+1, f represents the maximum number of Byzantine nodes that can be tolerated, the consensus is judged to be passed and uploaded to the chain, otherwise it is marked as invalid.

[0094] Step S302: Construct a multi-dimensional evidence data model, design evidence fields, and record all elements of the operation behavior in the key node information on the chain, including at least: the operation subject, operation object, operation characteristics, and on-chain identification;

[0095] In this embodiment, the operation subjects include: user ID, role, department, work number, etc.; the operation objects include: data type (such as salary, attendance and contract), data unique identifier, data version; operation characteristics include: timestamp, operation type, IP address, device fingerprint, approval process ID, etc.; on-chain identifiers include: block height, transaction hash, forward / backward block links.

[0096] Step S303: Based on the multi-dimensional evidence data model and multiple blockchains, a multi-blockchain link relationship network diagram is constructed, in which nodes are operation records and edges are association relationships. All operations on the same data object are connected in chronological order to form a data life chain. According to the data life chain, anomalies are tracked and audited to locate the source of the anomaly and the responsible party.

[0097] The specific steps of step S303 are:

[0098] Step S3031: Based on the multi-dimensional evidence data model and multiple blockchains, the association relationship of the operation records is analyzed, including: time sequence relationship, operation dependency relationship, permission association relationship, and device / IP association relationship, and a multi-blockchain link relationship network diagram is constructed;

[0099] In this embodiment, the temporal relationship is that operations on the same data object are sorted by timestamp, and the previous operation points to the next operation, forming a time chain edge, such as creation → first modification → second modification → archiving; the operation dependency relationship is: the approval operation and the execution operation are associated through the dependency node, forming a process chain edge, such as the approval node points to the data modification node; the permission association relationship is the association between the operation subject role and the sensitivity of the data object, and the legal permission edge set is predefined through the permission table, such as ordinary employee → querying personal attendance is a compliance edge, and ordinary employee → querying executive compensation is an abnormal edge; the device / IP association relationship is the interconnection of multiple operation nodes under the same device fingerprint or IP address, identifying abnormal device centralized operation mode, such as 10+ different accounts accessing sensitive data under the same public wife;

[0100] Edge relationships can identify potential risks that cannot be discovered by single-node audits.

[0101] Step S3032: When an audit exception occurs, perform an aggregation operation on the known abnormal data object. Using any business data in the known abnormal data object as the primary key, aggregate all operation records of the abnormal data object in the multi-blockchain link relationship network diagram, arrange them in ascending order by timestamp, and generate a data life chain.

[0102] In this embodiment, if the employee ID is used as the primary key and all operation records of the abnormal data object in the multi-blockchain link relationship network diagram are aggregated, the employee's life chain is: creation (2024-01-01) → salary adjustment (approval required) (2024-06-06) → approval (2024-06-07) → salary modification (2025-03-16) → attendance abnormality mark (2025-04-01) → resignation data archiving (2025-04-20); by constructing the data life chain, abnormal nodes can be discovered more efficiently and accurately.

[0103] Step S3033: Check the logical faults in the data lifecycle and set the logical fault points as abnormal nodes;

[0104] Specifically, logical fault judgment: whether there is a missing approval node before sensitive operations, such as no approval node before salary modification; whether the archiving process is completed before data destruction, such as no archiving node before the destruction of resignation data, etc., and abnormal nodes are judged through logical faults.

[0105] Step S3034: Starting from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it is a permission-related operation, and retain the predecessor nodes with the same subject as the abnormal node or with related permissions;

[0106] Specifically, starting from the abnormal node, trace back to its three types of key predecessor operations: permission change operations, such as role upgrade, permission group addition, and approval process creation; login authentication operations, such as remote IP login, unfamiliar device authentication, and multi-factor authentication bypass; process-dependent operations, such as approval, permission application, and system vulnerability exploitation. Set the backtracking time window and the backtracking edge type, collect all direct predecessor nodes through reverse traversal of the graph, and recursively check whether they belong to permission-related operations. For example, if the operation type includes permission change, role assignment, and approval, only retain the predecessor nodes that are the same as the abnormal node subject or permission-related, and exclude irrelevant operations, such as system automatic backup and regular data query.

[0107] Step S3035: Identify illegal permission acquisition based on the predecessor node that is the same as or has authority-related permissions as the abnormal node, and locate the abnormal source and responsible party.

[0108] The specific steps of step S3035 are:

[0109] Step S30351: Obtain the permission change records of the predecessor node with the same subject or permission association as the abnormal node, verify whether the permission change operation complies with the judgment rules, and identify illegal permission acquisition. The judgment rules are: unapproved permission change, permission acquisition beyond the scope, and abnormal permission expiration.

[0110] In this embodiment, the judgment rules are: no approval authority change, the authority change node has no edge-associated approval node, the changed authority exceeds the role responsibility definition, such as an intern obtaining data deletion authority; out-of-scope authority acquisition and abnormal authority time limit, the authority validity period exceeds the business rules, such as the temporary authority duration is greater than 72 hours and is not recovered.

[0111] Step S30352: Check the login records before and after the permission change operation, identify abnormal login characteristics, and locate the source of the abnormality;

[0112] Specifically, abnormal login features include: the login IP does not match the user's permanent residence, such as a Shanghai user suddenly logging in from a Beijing IP; the device fingerprint is not registered, such as the first time using an unfamiliar device to access the access management system.

[0113] Step S30353: Generate an evidence chain for authority abuse and locate the responsible party. Connect the key predecessor nodes traced back in chronological order to generate an authority abuse path diagram. If the authority change operation is compliant, but the subsequent sensitive operation exceeds the scope of authority, the responsible party is the operator of the operation. If the authority change operation involves approval forgery or system vulnerability exploitation, the responsible party will be traced back to the initiator of the authority change.

[0114] Specifically, the path diagram of permission abuse is as follows: abnormal node (data export) ← permission change (adding "salary export" permission) ← approval forgery (false approval passes the node) ← account theft (login from an unfamiliar device), and the responsible party is determined according to the responsible party judgment rules.

[0115] Through multi-blockchain and multi-dimensional evidence data models, a multi-blockchain link relationship network diagram is constructed, and a data life chain is constructed based on abnormal situations. The predecessor node of the abnormality is traced from the data life chain, and the source of the abnormality and the responsible party are located. The blockchain screens the data and ensures the security of the data. The source of the abnormality and the responsible party are found by traversing the data life chain. Compared with traditional log searches, it greatly reduces the backtracking time and the missed judgment rate. It can automatically detect long-term abuse of authority and make up for the shortcomings of manual review in historical operation correlation analysis.

[0116] Step S4: During the data destruction phase, information such as the destruction method, time, and responsible person is encrypted, stored, and packaged in links to keep it consistent with the lifecycle chain.

[0117] Example 2

[0118] See also Figure 4 ,Another embodiment provided by the present invention: a full life cycle audit tracking system, comprising: a data processing module, a relationship diagram generation module, a life chain generation module and a tracking and tracing module;

[0119] The data processing module is used to assign a unique identifier when the personnel configuration data is first collected, and to embed a timestamp, an operation identifier, and a link identifier at each lifecycle node of the data, wherein the personnel configuration data includes business data and metadata;

[0120] The relationship graph generation module is used to determine a multi-blockchain link relationship network graph based on the multi-dimensional evidence data model and multiple blockchains according to the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers. The multi-dimensional evidence data model records all the elements of the operation behavior in the key node information on the chain, and the multiple blockchains are composed of different blockchains determined by the chain rules;

[0121] The life chain generation module is used to generate a data life chain based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram;

[0122] The tracking and tracing module is used to locate the source of the anomaly and the responsible party based on the data life chain.

[0123] The relationship graph generation module includes: an on-chain unit, a proof storage unit, and a relationship graph generation unit;

[0124] The on-chain unit selects key nodes based on personnel configuration data and corresponding timestamps, operation identifiers, and link identifiers, defines blockchain on-chain rules, and uploads the selected key node information to the blockchain through consensus and contracts;

[0125] The evidence storage unit is used to build a multi-dimensional evidence storage data model, design evidence storage fields, and record all elements of the operation behavior in the key node information on the chain;

[0126] The relationship graph generation unit is used to construct a multi-blockchain link relationship network graph based on a multi-dimensional evidence data model and multiple blockchains.

[0127] The tracking and tracing module includes: a predecessor node inspection unit and a positioning and identification unit;

[0128] The predecessor node checking unit is used to start from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node, determine whether it is a permission-related operation, and retain the predecessor nodes with the same subject as the abnormal node or with permission-related operations;

[0129] The positioning and identification unit is used to identify illegal permission acquisition and locate the abnormal source and responsible party based on the predecessor node that is the same as or has authority-related with the abnormal node subject.

[0130] In addition, the parts of the above technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive redundancy.

[0131] The above-described specific embodiments further illustrate the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the above description is merely a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. Full life cycle audit tracking method, characterized by: The specific steps include: Assigning a unique identifier to personnel configuration data when it is first collected, and embedding a timestamp, operation identifier, and link identifier at each data lifecycle node. The personnel configuration data includes business data and metadata. Based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, a multi-blockchain link relationship network diagram is determined based on a multi-dimensional evidence data model and multiple blockchains. The multi-dimensional evidence data model records all elements of the operation behavior in the key node information on the chain, and the multiple blockchains are composed of different blockchains determined by the chain rules; Generate a data lifecycle based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram; Locate the source of the anomaly and the responsible party based on the data lifecycle; The generating of a data life chain according to the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram includes: When an audit exception occurs, perform an aggregation operation on the known abnormal data object. Using any business data in the known abnormal data object as the primary key, aggregate all operation records of the abnormal data object in the multi-blockchain link relationship network diagram, arrange them in ascending order by timestamp, and generate a data life chain. Check the logical faults in the data lifecycle and set the logical fault points as abnormal nodes; The method of locating the source of the anomaly and the responsible party according to the data lifecycle includes: Starting from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node to determine whether it is a permission-related operation, and retain the predecessor nodes with the same subject or permission-related as the abnormal node; Identify illegal permission acquisition based on the predecessor nodes with the same subject or associated permissions as the abnormal node, and locate the abnormal source and responsible party; The method of identifying illegal permission acquisition and locating the abnormal source and responsible party based on the predecessor node with the same subject or authority association as the abnormal node includes: Obtain permission change records for predecessor nodes with the same subject or associated permissions as the abnormal node, verify whether the permission change operation complies with the judgment rules, and identify illegal permission acquisition. The judgment rules are: unapproved permission change, permission acquisition beyond the scope, and abnormal permission expiration; Check login records before and after permission changes, identify abnormal login characteristics, and locate the source of the anomaly; Generate an evidence chain of authority abuse and locate the responsible party. Connect the key predecessor nodes traced back in chronological order to generate an authority abuse path map. If the authority change operation is compliant but the subsequent operation exceeds the scope of authority, the responsible party is the operation executor. If the authority change operation involves approval forgery or system vulnerability exploitation, the responsible party will be traced back to the initiator of the authority change.

2. The full life cycle audit tracking method according to claim 1, characterized in that: The method of determining a multi-blockchain link relationship network diagram based on the multi-dimensional evidence data model and multiple blockchains according to the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers includes: Based on personnel configuration data and corresponding timestamps, operation identifiers, and link identifiers, key nodes are screened, blockchain on-chain rules are defined, and the selected key node information is uploaded to the blockchain through consensus and contracts; Build a multi-dimensional evidence data model, design evidence fields, and record all elements of the operation behavior in the key node information on the chain, including: operation subject, operation object, operation characteristics and on-chain identification; Based on the multi-dimensional evidence data model and multiple blockchains, a multi-blockchain link relationship network diagram is constructed, where nodes are operation records and edges are association relationships.

3. The full life cycle audit tracking method according to claim 2, characterized in that: The key nodes are screened based on the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers, and the blockchain listing rules are defined. The screened key node information is uploaded to the blockchain through consensus and contracts, including: Train a multidimensional risk scoring model based on a machine learning algorithm, input the filtered key node information into the trained multidimensional risk scoring model, and output the scoring results; A three-level chain-up strategy is preset. When the score is greater than or equal to 8, it is forced to be on-chain, and evidence is stored through the alliance chain consensus, recording all operation elements. When the score is less than 8 and greater than 5, it is selected to be on-chain, and the smart contract automatically verifies the authority. If the verification passes, it enters the evidence chain. When the score is less than or equal to 5, lightweight evidence is stored and directly on-chain; Through the three-level chain strategy, the corresponding chain-level evidence storage contract is automatically selected based on the scoring results.

4. The full life cycle audit tracking method according to claim 1, characterized in that: The method of allocating a unique identifier when the personnel configuration data is first collected and embedding a timestamp, operation identifier, and link identifier at each data lifecycle node includes: Collecting personnel configuration data in real time and preprocessing the collected personnel configuration data, including data verification and cleaning; Generate an initial timestamp and source identifier, and generate a globally unique digital fingerprint for each piece of staffing data; Digitally sign the pre-processed staffing data.

5. A full life cycle audit tracking system, used to implement the full life cycle audit tracking method according to any one of claims 1 to 4, characterized in that: include: Data processing module, relationship diagram generation module, life chain generation module and tracking and tracing module; The data processing module is used to assign a unique identifier when the personnel configuration data is first collected, and to embed a timestamp, an operation identifier, and a link identifier at each lifecycle node of the data, wherein the personnel configuration data includes business data and metadata; The relationship graph generation module is used to determine a multi-blockchain link relationship network graph based on the multi-dimensional evidence data model and multiple blockchains according to the personnel configuration data and the corresponding timestamps, operation identifiers, and link identifiers. The multi-dimensional evidence data model records all the elements of the operation behavior in the key node information on the chain, and the multiple blockchains are composed of different blockchains determined by the chain rules; The life chain generation module is used to generate a data life chain based on the multi-blockchain link relationship network diagram and all operation records of the abnormal node data object where the abnormality occurs in the multi-blockchain link relationship network diagram; The tracking and tracing module is used to locate the source of the anomaly and the responsible party based on the data life chain.

6. The full life cycle audit tracking system according to claim 5, characterized in that: The relationship graph generation module includes: an on-chain unit, a proof storage unit, and a relationship graph generation unit; The on-chain unit selects key nodes based on personnel configuration data and corresponding timestamps, operation identifiers, and link identifiers, defines blockchain on-chain rules, and uploads the selected key node information to the blockchain through consensus and contracts; The evidence storage unit is used to build a multi-dimensional evidence storage data model, design evidence storage fields, and record all elements of the operation behavior in the key node information on the chain; The relationship graph generation unit is used to construct a multi-blockchain link relationship network graph based on a multi-dimensional evidence data model and multiple blockchains.

7. The full life cycle audit tracking system according to claim 6, characterized in that: The tracking and backtracking module includes: a predecessor node inspection unit and a positioning and identification unit; The predecessor node checking unit is used to start from the abnormal node, trace back to the predecessor nodes of the abnormal node, recursively check each predecessor node, determine whether it is a permission-related operation, and retain the predecessor nodes with the same subject as the abnormal node or with permission-related operations; The positioning and identification unit is used to identify illegal permission acquisition and locate the abnormal source and responsible party based on the predecessor node that is the same as or has authority-related with the abnormal node subject.

Images