Human social training supervision system and method based on block chain and TEE

Abstract

The embodiment of the invention provides a human and social training supervision system and method based on a block chain and TEE, and belongs to the technical field of block chains. The scheme comprises a training supervision module which is used for calling data of a supervisor TEE and providing a training supervision function for a human resource supervisor; the supervisor TEE is used for providing an environment for checking the execution of the smart contract; the verification smart contract is used for performing verification based on plaintext information according to a verification rule and returning a verification result to the training supervision module; the training management module is used for calling data of the TEE of the institution party and providing a training management function for the training institution party; the institution TEE is used for providing an environment for execution of the uplink smart contract; the uplink smart contract is used for combining encrypted ciphertext data and plaintext data and then performing uplink storage; and the block chain network is used for providing tamper-proof and traceable functions for the uplink data. According to the invention, the consistency of trainees and training processes can be ensured, and data counterfeiting and tampering are prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchains, and in particular to a human resource training supervision system and method based on blockchains and TEEs. BACKGROUND

[0002] In related technologies, skill training mainly has the following problems: Training process supervision is difficult: there are many online platforms, no unified standards, lack of monitoring means, training process and training personnel are not easy to supervise, offline training monitoring means are few, and necessary monitoring facilities and methods are lacking; Training data supervision is difficult: training information and data are scattered, and supervision is difficult; Training data verification is difficult: the authenticity verification of training information and data is laborious and difficult, and it is difficult to prevent fraud and tampering.

[0003] In summary, the technical problems in related technologies need to be improved. SUMMARY

[0004] The main purpose of the embodiments of the present application is to propose a human resource training supervision system and method based on blockchains and TEEs, which can solve the problem of online and offline training process monitoring, ensure that the training personnel and the training process are consistent, and ensure the effectiveness of the training; ensure the data security of the training information, solve the safe storage and consistency of the training information, prevent data fraud and tampering, and ensure the reliability of the data; can safely and efficiently verify the training data, and ensure the authenticity of the data.

[0005] To achieve the above purpose, one aspect of the embodiments of the present application proposes a human resource training supervision system based on blockchains and TEEs, which comprises a human resource supervision party node, a training institution party node, a cloud storage module, and a blockchain network; the human resource supervision party node comprises a training supervision module and a supervision party TEE; the training institution party node comprises a training management module and an institution party TEE; The training supervision module is configured to call data of the supervision party TEE to provide a training supervision function for the human resource supervision party; the training supervision function comprises attendance supervision, video supervision during the training process, and supervision of the entire training process; The supervision party TEE is configured to provide an environment for verifying the execution of a smart contract; the verification smart contract is configured to verify information based on plaintext according to verification rules and return the verification result to the training supervision module; The training management module is configured to call data of the institution party TEE to provide a training management function for the training institution party; the training management function comprises attendance management during the training process, video collection and storage management during the training, and management of the entire training process; The mechanism side TEE is configured to provide an environment for execution of the on-chain smart contract; and the on-chain smart contract is configured to store, in a chained manner, merged data of encrypted ciphertext data and plaintext data. The cloud storage module is configured to store training information and monitoring video collected in a training process. The blockchain network is configured to provide anti-tampering and traceability functions for the chained data.

[0006] In some embodiments, the supervision side TEE includes a supervision side key management module, a supervision side certificate management module, and a supervision side secure communication module. The supervision side key management module is configured to securely store and manage a supervision side public key, a supervision side private key, and an encryption key of the supervision side. The supervision side certificate management module is configured to issue and manage identity certificates of the training institution side nodes participating in the entire blockchain network. The supervision side secure communication module is configured to provide a secure channel for network communication between the supervision side TEE and the mechanism side TEE.

[0007] In some embodiments, the mechanism side TEE includes a mechanism side key management module, a mechanism side certificate management module, and a mechanism side secure communication module. The mechanism side key management module is configured to securely store and manage a mechanism side public key, a mechanism side private key, and an encryption key of the mechanism side. The mechanism side certificate management module is configured to apply for identity certificates from the human resource supervision side node. The mechanism side secure communication module is configured to provide a secure channel for network communication between the mechanism side TEE and the supervision side TEE.

[0008] To achieve the above-mentioned purpose, another aspect of the embodiments of the present application proposes a human resource training supervision method based on a blockchain and a TEE, which is used to implement the system as described above. The method includes the following steps: The supervision side TEE and the mechanism side TEE perform an initialization operation to obtain TEE initialization information; The mechanism side and the supervision side perform an encryption key exchange according to the TEE initialization information to obtain key exchange information; The supervision side TEE and the mechanism side TEE perform construction of a blockchain network to obtain blockchain network construction information; The training data is chained according to the key exchange information and the blockchain network construction information to obtain chained data; the training data includes attendance information, monitoring video information, and training process information; Data credibility verification is performed according to the chained data to obtain verification data, and human resource training supervision is completed.

[0009] In some embodiments, the initialization operation is performed by the supervisor TEE and the agency TEE to obtain TEE initialization information, including: Detecting whether the supervisor public key and the supervisor private key exist in the supervisor key management module using the supervisor TEE; When the supervisor public key and the supervisor private key do not exist in the supervisor key management module, the supervisor TEE creates the supervisor public key and the supervisor private key to obtain supervisor TEE initialization information; the supervisor public key and the supervisor private key are used to identify the supervisor identity; Detecting whether the agency public key and the agency private key exist in the agency key management module using the agency TEE; When the agency public key and the agency private key do not exist in the agency key management module, the agency TEE creates the agency public key and the agency private key to obtain agency TEE initialization information; the agency public key and the agency private key are used to identify the agency identity; Taking the supervisor TEE initialization information and the agency TEE initialization information as the TEE initialization information.

[0010] In some embodiments, the encryption key exchange between the agency and the supervisor is performed according to the TEE initialization information to obtain key exchange information, including: According to the TEE initialization information, sending key exchange request information to the supervisor TEE through the agency secure communication module; the key exchange request information includes an agency public key and an agency signature; After the supervisor TEE receives the key exchange request information of the training agency node, verifying the agency signature using the agency public key; If the verification of the agency signature is passed, the supervisor TEE uses the ECDH algorithm to calculate and generate an encryption key based on the supervisor private key and the agency public key to obtain the supervisor's encryption key, stores the supervisor's encryption key in the supervisor key management module, and obtains the supervisor's exchange information; According to the TEE initialization information, sending key exchange response information to the agency TEE through the supervisor secure communication module; the key exchange response information includes a supervisor public key and a supervisor signature; After the agency TEE receives the key exchange response information of the human resource supervisor node, verifying the supervisor signature using the supervisor public key; If the verification of the signature of the supervisor party is passed, the agency party TEE uses the ECDH algorithm to calculate the generated encryption key based on the agency party private key and the supervisor party public key, obtains the encryption key of the agency party, stores the encryption key of the agency party in the agency party key management module, and obtains the exchange information of the agency party; The exchange information of the supervisor party and the exchange information of the agency party are used as the key exchange information.

[0011] In some embodiments, the construction of the blockchain network is performed by the supervisor party TEE and the agency party TEE, and the blockchain network construction information is obtained, including: The training supervisor module calls the supervisor party certificate management module of the supervisor party TEE, and uses the supervisor party private key to create a blockchain network CA root certificate; The training supervisor module calls the supervisor party certificate management module of the supervisor party TEE, uses the blockchain network CA root certificate to issue a node network access identity certificate, and deploys and starts as a blockchain founder node; The training management module calls the agency party certificate management module of the agency party TEE, uses the agency party private key to generate a node identity certificate request CSR file; The training management module calls the agency party certificate management module of the agency party TEE to export the node identity certificate request CSR file and sends it to the supervisor party TEE for certificate application, and the training supervisor module calls the supervisor party certificate management module to use the supervisor party private key to issue a node identity certificate for the agency party TEE and return it to the agency party TEE; The agency party TEE configures the node and the node identity certificate and starts as a new node of the blockchain network to join the blockchain founder node of the supervisor party; The new node and the blockchain founder node perform mutual signature and certificate exchange, perform identity authentication and network access of the agency party TEE, and obtain the agency party identity authentication and network access information; According to the agency party identity authentication and network access information, the deployment of the local TEE environment is completed, and the blockchain network construction information is obtained.

[0012] In some embodiments, the training data is chained according to the key exchange information and the blockchain network construction information, and the chained data is obtained, including: Obtain attendance information; the attendance information includes attendance student identity information and student clock-in and clock-out information; The attendance information is signed by the agency party private key through the attendance supervision function of the training management module to generate a blockchain transaction calling a chain smart contract, and the chain smart contract is called; The attendance information is encrypted by calling the encryption key of the agency party in the upper chain smart contract, and attendance ciphertext data is obtained; The attendance ciphertext data and the plaintext data of the attendance information are merged and stored by using the upper chain smart contract, and attendance upper chain data is obtained; the attendance upper chain data is distributed and shared to the supervision network through a block chain network consensus mechanism; Obtain monitoring video information; the monitoring video information includes video files and video description information; upload the monitoring video information to a cloud storage module; The video files are calculated by using an abstract algorithm to generate tamper-proof video abstract information; The video abstract information and the video description information are signed by calling the private key of the agency party through the training management module to generate a block chain transaction for calling the upper chain smart contract, and the upper chain smart contract is called; The video description information is encrypted by calling the encryption key of the agency party in the upper chain smart contract, and video ciphertext data is obtained; The video ciphertext data and the plaintext data of the monitoring video information are merged and stored by using the upper chain smart contract, and video upper chain data is obtained; the video upper chain data is distributed and shared to the supervision network through a block chain network consensus mechanism; Obtain training process information; the training process information includes training course information, student examination information, student training feedback, and student graduation certificate information; The training process information is signed by calling the private key of the agency party through the training management module to generate a block chain transaction for calling the upper chain smart contract, and the upper chain smart contract is called; The training process information is encrypted by calling the encryption key of the agency party in the upper chain smart contract, and training process ciphertext data is obtained; The training process ciphertext data and the plaintext data of the training process information are merged and stored by using the upper chain smart contract, and training process upper chain data is obtained; the training process upper chain data is distributed and shared to the supervision network through a block chain network consensus mechanism; The attendance upper chain data, the video ciphertext data, and the training process ciphertext data are used as upper chain data.

[0013] In some embodiments, the data trusted verification is performed according to the upper chain data, and verification data is obtained, and the human resource training supervision is completed, including: Obtain verification request data; the verification request data includes attendance information verification request data, monitoring video information verification request data and training process information verification request data; the attendance information verification request data includes the identity information of the student to be verified and the verification rule of the attendance information; the training process information verification request data includes the identity information of the student to be verified and the verification rule of the video information; The process supervision module generates a verification block chain transaction by signing the verification request data using a supervisor private key, and calls a verification smart contract in the supervisor TEE; The verification smart contract retrieves the data to be verified on the chain, and decrypts the encrypted part thereof using the encryption key of the supervisor to obtain decrypted data; when the verification request data is attendance information verification request data, the data to be verified is the attendance information of the student to be verified; when the verification request data is monitoring video information verification request data, the data to be verified is video summary information and video description information; when the verification request data is training process information verification request data, the data to be verified is the training process information of the student to be verified; The verification smart contract verifies the data to be verified based on the plaintext, and if there is a verification rule, verifies according to the verification rule, and returns the verification result to the process supervision module and displays it to the training supervision module to obtain verification data and complete the human resource training supervision.

[0014] To achieve the above object, an aspect of an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method described above.

[0015] To achieve the above object, another aspect of an embodiment of the present application provides an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0016] To achieve the above object, another aspect of an embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the method described above.

[0017] The embodiments of the present application at least have the following beneficial effects: the present application provides a human resource training supervision system and method based on blockchain and TEE, the scheme comprises: a training supervision module, which is used for calling data of a supervision party TEE, and providing a training supervision function for a human resource supervision party; the training supervision function comprises attendance supervision, video supervision during training, and supervision of the whole training process; the supervision party TEE is used for providing an environment for execution of a verification smart contract; the verification smart contract is used for verifying based on plaintext information according to verification rules, and returning verification results to the training supervision module; a training management module, which is used for calling data of an institution party TEE, and providing a training management function for a training institution party; the training management function comprises attendance management during training, video collection and storage management during training, and management of the whole training process; the institution party TEE is used for providing an environment for execution of a chain-up smart contract; the chain-up smart contract is used for merging encrypted ciphertext data and plaintext data, and then performing chain-up storage; a cloud storage module, which is used for storing training information and monitoring videos collected during training; a blockchain network, which is used for providing anti-tampering and traceability functions for chain-up data. The present application can ensure that training personnel and training processes are consistent, and prevent data falsification and tampering. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 FIG. 1 is a schematic diagram of a human resource training supervision system based on blockchain and TEE provided by the embodiments of the present application; Figure 2 FIG. 2 is a schematic diagram of a supervision party TEE provided by the embodiments of the present application; Figure 3 FIG. 3 is a schematic diagram of an institution party TEE provided by the embodiments of the present application; Figure 4 FIG. 4 is a flowchart of a human resource training supervision method based on blockchain and TEE provided by the embodiments of the present application; Figure 5 FIG. 5 is a flowchart of obtaining TEE initialization information provided by the embodiments of the present application; Figure 6 FIG. 6 is a flowchart of obtaining key exchange information provided by the embodiments of the present application; Figure 7 FIG. 7 is a flowchart of obtaining blockchain network construction information provided by the embodiments of the present application; Figure 8 FIG. 8 is a flowchart of obtaining chain-up data provided by the embodiments of the present application; Figure 9 FIG. 9 is a flowchart of verifying data provided by the embodiments of the present application; Figure 10 FIG. 10 is a hardware structure schematic diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0019] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, identical numbers in different drawings represent identical or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with embodiments of the present application. They are merely examples of apparatuses and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0020] It can be understood that the terms "first", "second" and the like as used in the present application can be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determining".

[0021] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0023] Before the embodiments of the present application are described in detail, first, some nouns and terms involved in the embodiments of the present application are described, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0024] 1) TEE (Trusted Execution Environment): It is a secure area built by software and hardware methods on a computing platform, which can protect the code and data loaded in the secure area in terms of confidentiality and integrity. Its goal is to ensure that a task is executed as expected, and to ensure the confidentiality and integrity of the initial state, and the confidentiality and integrity of the runtime state.

[0025] 2) CSR (Certificate Signing Request): a coded file containing the website, service, country, organization, domain name, public key and signature, used to obtain an SSL certificate from a trusted Certificate Authority (CA).

[0026] 3) ECDH (Elliptic Curve Diffie-Hellman), a key agreement protocol based on elliptic curve cryptography; 4) MD5 (Message-Digest Algorithm 5), an algorithm for generating fixed-length hashes; 5) SHA (Secure Hash Algorithm), a secure hash algorithm.

[0027] In the related art, the current skill training mainly has the following problems: Training process supervision is difficult: there are many online platforms, no unified standard, lack of monitoring means, and it is difficult to supervise the training process and training personnel; offline training monitoring means are few, and necessary monitoring facilities and methods are lacking; Training data supervision is difficult: training information and data are scattered, and it is difficult to supervise; Training data verification is difficult: the authenticity verification of training information and data is difficult and high, and it is difficult to prevent fraud and tampering.

[0028] Therefore, in the embodiments of the present application, a human resource training supervision system and method based on blockchain and TEE are provided. The scheme analyzes the above problems and adopts effective technical means to ensure effective monitoring of the whole process of the training process, solves the problem of online and offline training process monitoring, ensures that the training personnel and the training process are consistent, guarantees the effectiveness of the training, ensures the data security of the training information, solves the safe storage and consistency of the training information, prevents data fraud and tampering, and guarantees the reliability of the data. Training data can be verified safely and efficiently to ensure the authenticity of the data.

[0029] To this end, the present application uses blockchain technology and TEE technology to solve the above problems: using the distributed ledger technology of blockchain, solving the problem of difficult centralized storage and management of data in the training process and low security; using the tamper-proof mechanism of blockchain to ensure that the training process and training results stored in the blockchain cannot be modified and the data is safe and reliable; using the traceability of blockchain, which can ensure the traceability of the whole training process and the traceability of any data modification; using the secure storage capability provided by TEE to solve the secure storage problem of the keys and identity certificates of the participating parties, providing secure support for the trusted authentication of the blockchain network identity and the privacy of sensitive data, thereby further enhancing the credibility of the training supervision network; using the hardware isolation capability provided by TEE to provide a secure and reliable operating environment for the processing of sensitive private data, thereby preventing the risk of leakage during the use of sensitive private data and protecting the privacy of the training students.

[0030] Blockchain is a block chain storage, tamper-proof, secure and reliable decentralized distributed ledger, which combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies, records transactions and information through a growing data block chain, and ensures the security and transparency of data. Blockchain technology has the following key features: 1) Decentralization: Blockchain technology does not require a central server or institution to manage data, but relies on multiple participants in the network to jointly maintain and verify transaction information, which reduces the reliance on a single entity.

[0031] 2) Tamper-proof: Once data is written to the blockchain, it cannot be changed or deleted.

[0032] 3) Transparency: Although transaction data is public on the blockchain, individual identities can remain anonymous through encryption. This transparency increases the credibility of the system, as anyone can view transaction records but cannot change them.

[0033] 4) Smart Contracts: Blockchain can also host smart contracts, which are automatically executed programs that can automatically execute contract terms when preset conditions are met, without the need for intermediaries.

[0034] TEE (Trusted Execution Environment) is a secure area on a computing platform built by software and hardware methods, providing an additional layer of protection for sensitive data and applications, making them immune to the operating system and other software running in non-secure mode. It can guarantee that the code and data loaded in the secure area are protected in terms of confidentiality and integrity. Its goal is to ensure that a task performs as expected, guaranteeing the confidentiality and integrity of the initial state, as well as the confidentiality and integrity of the runtime state. TEE technology has a wide range of applications in mobile payments, digital rights management, identity verification, enterprise security, etc., and is an important part of building modern device security architecture. TEE has the following key features: 1) Hardware isolation: TEE uses hardware-level isolation technology to provide a protected execution environment for critical task code and data. This means that even if the main operating system is controlled by an attacker, the data and running code in the TEE should be safe.

[0035] 2) Independent operation: TEE can operate independently of the main operating system, with its own processor, memory and storage space, which allows TEE to perform security-related tasks such as encryption, decryption, key management and user authentication without relying on potentially unsafe external components.

[0036] 3) Secure boot and update: TEE usually has the ability of secure boot, ensuring that it can only run authenticated code, preventing malicious software from injecting during the boot process. In addition, the update process of TEE is also secure to prevent vulnerabilities from being introduced during the update process.

[0037] 4) Secure storage: TEE can provide secure storage space for private keys, user credentials and other sensitive information, which can be protected even in the case of device loss or theft.

[0038] 5) Secure input / output: TEE can support secure input / output interfaces such as secure keyboard and biometric sensors to ensure that user input cannot be intercepted.

[0039] 6) Application interface: TEE usually provides a secure application interface that allows applications in the non-secure environment to communicate securely with services within the TEE, enabling encrypted payments, identity verification and other functions.

[0040] The application aims to solve the problems of training process supervision difficulty, training data supervision difficulty, training data verification difficulty and the like in human resource skill training, adopts a blockchain and a TEE technology, ensures that training personnel and training processes are consistent, guarantees training effectiveness, ensures data security of training information, solves safe storage and consistency of training information, prevents data falsification and tampering, guarantees data reliability, can safely and efficiently verify training data, and ensures data authenticity. 1) Trusted initialization of the system: the trusted execution environment of the TEE is used to complete trusted exchange of a data encryption key between a supervision party and a training institution party through a secure and trusted transmission channel; and the secure storage capability of the TEE is used to realize secure storage of the data encryption key.

[0041] 2) Trusted construction of a blockchain network: the trusted execution environment of the TEE is used to complete trusted issuance of a digital certificate of the institution party by the supervision party through a secure and trusted transmission channel, to provide trusted identity authentication for construction of the blockchain network.

[0042] 3) Trusted on-chain of sensitive private training data: operation of the training data is completed in the TEE environment, is not interfered by human factors, enhances data security and privacy protection, and prevents data leakage; the anti-tampering and secure storage capability of the blockchain technology is used to guarantee authenticity, consistency and security of the training data.

[0043] 4) Trusted verification of training data: the anti-tampering and traceability capability of the blockchain is used to guarantee safe and trusted and traceable training data; and the data verifiable is verified in the TEE environment, to further enhance the trustworthiness of data verification.

[0044] The human resource training supervision method based on the blockchain and the TEE provided in the embodiments of the application relates to the field of information technology. The human resource training supervision method based on the blockchain and the TEE provided in the embodiments of the application can be applied to a terminal, can be applied to a server, and can also be software running in the terminal or the server. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, and the like, but is not limited thereto; the server end can be configured as a stand-alone physical server, can be configured as a server cluster or a distributed system formed by multiple physical servers, can be configured as a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN, and big data and artificial intelligence platform, and the server can also be a node server in a blockchain network; and the software can be an application for implementing the human resource training supervision method based on the blockchain and the TEE, and the like, but is not limited to the above forms.

[0045] The application is operable in a variety of general purpose or special purpose computer systems environments or configurations. Examples of well known computing systems, environments, and / or configurations that can be suitable for use with the application include personal computers, server computers, handheld or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. The application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0046] It should be noted that in each of the specific embodiments of the present application, when it is necessary to perform relevant processing according to user information, user behavior data, user historical data, and user location information, and other data related to the identity or characteristics of the user, the user's permission or consent is obtained first, and the collection, use, and processing of the data comply with relevant laws, regulations, and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the separate permission or separate consent of the user is obtained through a pop-up window or a jump to a confirmation page, and after obtaining the separate permission or separate consent of the user, the necessary user-related data for enabling the embodiments of the present application to normally operate is obtained.

[0047] The embodiments of the present application are further described below with reference to the accompanying drawings.

[0048] In one aspect, the embodiments of the present application provide a human resource training supervision system based on a blockchain and a TEE, referring to Figure 1 The system includes a human resource supervision party node, a training institution party node, a cloud storage module, and a blockchain network. The human resource supervision party node includes a training supervision module and a supervision party TEE. The training institution party node includes a training management module and an institution party TEE. The training supervision module is configured to call data of the supervision party TEE to provide a training supervision function for the human resource supervision party. The training supervision function includes attendance supervision, video supervision during training, and supervision of the whole training process. The supervision party TEE is configured to provide an environment for verifying the execution of a smart contract. The smart contract is configured to verify information based on plaintext according to verification rules and return the verification result to the training supervision module. The training management module is configured to call data of the agency TEE, and provide a training management function for the training agency. The training management function includes attendance management in the training process, video collection and storage management during the training, and management of the whole training process. The agency TEE is configured to provide an environment for execution of the on-chain smart contract. The on-chain smart contract is configured to merge the encrypted ciphertext data and the plaintext data and store the merged data on the chain. The cloud storage module is configured to store information of the training and the monitoring video collected in the training process. The blockchain network is configured to provide anti-tampering and traceability functions for the on-chain data.

[0049] As an optional implementation, the embodiments of the present application integrate the blockchain, the TEE (trusted execution environment) and the cloud storage, and achieve the goals of high credibility, anti-tampering and automatic verification for the human resource training supervision.

[0050] In some embodiments, referring to Figure 2 The supervisory TEE disclosed by the embodiments of the present application includes a supervisory key management module, a supervisory certificate management module and a supervisory secure communication module. The supervisory key management module is configured to securely store and manage the supervisory public key, the supervisory private key and the encryption key of the supervisory party. The supervisory certificate management module is configured to issue and manage the identity certificates of the participating training agency nodes in the entire blockchain network. The supervisory secure communication module is configured to provide a secure channel for network communication between the supervisory TEE and the agency TEE.

[0051] In some embodiments, referring to Figure 3 The agency TEE disclosed by the embodiments of the present application includes an agency key management module, an agency certificate management module and an agency secure communication module. The agency key management module is configured to securely store and manage the agency public key, the agency private key and the encryption key of the agency. The agency certificate management module is configured to apply for an identity certificate to the human resource supervision node. The agency secure communication module is configured to provide a secure channel for network communication between the agency TEE and the supervisory TEE.

[0052] The embodiments of the present application also provide a human resource training supervision method based on the blockchain and the TEE, which is used to implement the above system, and referring to Figure 4 The method includes the following steps: Step S100: performing an initialization operation through the supervisory TEE and the agency TEE to obtain TEE initialization information. Step S200, performing an encryption key exchange between the agency and the supervisor according to the TEE initialization information, to obtain key exchange information; Step S300, performing construction of a blockchain network through the supervisor TEE and the agency TEE, to obtain blockchain network construction information; Step S400, performing on-chain storage of training data according to the key exchange information and the blockchain network construction information, to obtain on-chain data; the training data includes attendance information, monitoring video information, and training process information; Step S500, performing data credibility verification according to the on-chain data, to obtain verification data, and completing the supervision of the human resource training.

[0053] In some embodiments, with reference to Figure 5 The step S100 disclosed by the embodiment of the present application performs an initialization operation through the supervisor TEE and the agency TEE, to obtain TEE initialization information, including: Step S110, detecting, by using the supervisor TEE, whether the supervisor public key and the supervisor private key exist in a supervisor key management module; Step S120, when the supervisor public key and the supervisor private key do not exist in the supervisor key management module, creating, by the supervisor TEE, the supervisor public key and the supervisor private key, to obtain supervisor TEE initialization information; the supervisor public key and the supervisor private key are used to identify the identity of the supervisor; Step S130, detecting, by using the agency TEE, whether the agency public key and the agency private key exist in an agency key management module; Step S140, when the agency public key and the agency private key do not exist in the agency key management module, creating, by the agency TEE, the agency public key and the agency private key, to obtain agency TEE initialization information; the agency public key and the agency private key are used to identify the identity of the agency; Step S150, taking the supervisor TEE initialization information and the agency TEE initialization information as the TEE initialization information.

[0054] In some embodiments, with reference to Figure 6 The step S200 disclosed by the embodiment of the present application performs an encryption key exchange between the agency and the supervisor according to the TEE initialization information, to obtain key exchange information, including: Step S210, according to the TEE initialization information, sending, by using an agency secure communication module, key exchange request information to the supervisor TEE; the key exchange request information includes an agency public key and an agency signature; Step S220, after the supervisor TEE receives the key exchange request information of the training agency node, verifying, by using the agency public key, the agency signature; Step S230, if the verification of the agency party signature is passed, the supervision party TEE uses the ECDH algorithm to calculate and generate an encryption key based on the supervision party private key and the agency party public key, obtains the encryption key of the supervision party, stores the encryption key of the supervision party in the supervision party key management module, and obtains the exchange information of the supervision party; Step S240, according to the TEE initialization information, the key exchange response information is sent to the agency party TEE through the supervision party secure communication module; the key exchange response information includes the supervision party public key and the supervision party signature; Step S250, after the agency party TEE receives the key exchange response information of the human resource supervision party node, the supervision party signature is verified using the supervision party public key; Step S260, if the verification of the supervision party signature is passed, the agency party TEE uses the ECDH algorithm to calculate and generate an encryption key based on the agency party private key and the supervision party public key, obtains the encryption key of the agency party, stores the encryption key of the agency party in the agency party key management module, and obtains the exchange information of the agency party; Step S270, the exchange information of the supervision party and the exchange information of the agency party are used as the key exchange information.

[0055] In some embodiments, with reference to Figure 7 The step S300 disclosed by the embodiment of the application is executed by the supervision party TEE and the agency party TEE to construct the blockchain network, and obtains the blockchain network construction information, including: Step S310, the training supervision module calls the supervision party certificate management module of the supervision party TEE, and uses the supervision party private key to create a blockchain network CA root certificate; Step S320, the training supervision module calls the supervision party certificate management module of the supervision party TEE, uses the blockchain network CA root certificate to issue a node network access identity certificate, and deploys and starts as a blockchain founder node; Step S330, the training management module calls the agency party certificate management module of the agency party TEE, and uses the agency party private key to generate a node identity certificate request CSR file; Step S340, the training management module calls the agency party certificate management module of the agency party TEE to export the node identity certificate request CSR file, and sends it to the supervision party TEE for certificate application; the training supervision module calls the supervision party certificate management module to use the supervision party private key to issue a node identity certificate for the agency party TEE, and returns it to the agency party TEE; Step S350, the agency party TEE configures the node and the node identity certificate, and starts as a new node of the blockchain network to join the blockchain founder node of the supervision party; Step S360, the new node and the blockchain origin node perform mutual signature and certificate exchange, perform identity authentication and network access of the agency side private key of the agency side TEE, and obtain agency side identity authentication and network access information; Step S370, the local TEE environment is deployed according to the agency side identity authentication and network access information, and the blockchain network construction information is obtained.

[0056] In some embodiments, with reference to Figure 8 The step S400 disclosed in the embodiment of the application is executed according to the key exchange information and the blockchain network construction information to perform the on-chain of the training data, and the on-chain data is obtained, including: Step S410, obtaining attendance information; the attendance information includes attendance student identity information and student clock-in and clock-out information; Step S420, the attendance information is signed by the agency side private key through the attendance supervision function of the training management module to generate a blockchain transaction calling the on-chain smart contract, and the on-chain smart contract is called; Step S430, the encryption key of the agency side is called to perform encryption processing on the attendance student identity information in the attendance information in the on-chain smart contract, and the attendance ciphertext data is obtained; Step S440, the on-chain smart contract is used to merge the attendance ciphertext data and the plaintext data of the attendance information, and then the on-chain storage is performed, and the attendance on-chain data is obtained; the attendance on-chain data is distributed and shared to the supervision network through the blockchain network consensus mechanism; Step S450, obtaining monitoring video information; the monitoring video information includes video files and video description information; the monitoring video information is uploaded to the cloud storage module; Step S460, the video files are calculated by using the digest algorithm to generate tamper-proof video digest information; Step S470, the video digest information and the video description information are signed by the agency side private key through the training management module to generate a blockchain transaction calling the on-chain smart contract, and the on-chain smart contract is called; Step S480, the on-chain smart contract is used to call the encryption key of the agency side to perform encryption processing on the identity privacy information in the video description information, and the video ciphertext data is obtained; Step S490, the on-chain smart contract is used to merge the video ciphertext data and the plaintext data of the monitoring video information, and then the on-chain storage is performed, and the video on-chain data is obtained; the video on-chain data is distributed and shared to the supervision network through the blockchain network consensus mechanism; Step S40A, obtaining training process information; the training process information includes training course information, student examination information, student training feedback and student graduation certificate information; Step S40B, the training management module calls the blockchain transaction of the on-chain smart contract by calling the agency private key to sign the training process information, and calls the on-chain smart contract; Step S40C, the encryption key of the agency is called in the on-chain smart contract to encrypt the student privacy information in the training process information, and the training process ciphertext data is obtained; Step S40D, the training process ciphertext data and the plaintext data of the training process information are merged and stored on the chain by using the on-chain smart contract, and the training process on-chain data is obtained; the training process on-chain data is distributed and shared to the supervision network through the consensus mechanism of the blockchain network; Step S40E, the attendance on-chain data, the video ciphertext data and the training process ciphertext data are used as the on-chain data.

[0057] As an optional implementation, the abstract algorithm of the embodiment of the present application can be MD5 algorithm or SHA series algorithm.

[0058] In some embodiments, with reference to Figure 9 The step S500 disclosed by the embodiment of the present application performs data trusted verification according to the on-chain data, obtains verification data, and completes the supervision of human resource training, including: Step S510, obtaining verification request data; the verification request data includes attendance information verification request data, monitoring video information verification request data and training process information verification request data; the attendance information verification request data includes the identity information of the student to be verified and the verification rule of the attendance information; the training process information verification request data includes the identity information of the student to be verified and the verification rule of the video information; Step S520, the process supervision module generates a verification blockchain transaction by signing the verification request data using the supervision private key, and calls the verification smart contract in the supervision TEE; Step S530, the verification smart contract retrieves the data to be verified on the chain, and decrypts the encrypted part by calling the encryption key of the supervision party to obtain the decrypted data; when the verification request data is the attendance information verification request data, the data to be verified is the attendance information of the student to be verified; when the verification request data is the monitoring video information verification request data, the data to be verified is the video summary information and the video description information; when the verification request data is the training process information verification request data, the data to be verified is the training process information of the student to be verified; Step S540, the verification smart contract verifies the plaintext data to be verified, and if there is a verification rule, the verification rule is used for verification, and the verification result is returned to the process supervision module and displayed to the training supervision module, and the verification data is obtained, and the supervision of human resource training is completed.

[0059] As an optional implementation, in the architecture of the system of the present application, reference is made to Figure 1 , which is composed of three parts, namely, a training supervision module and a supervision party TEE deployed at a human resources supervision party, a training management module and an institution party TEE deployed at each training institution party, and a cloud storage system and a blockchain network used by the supervision party and the institution party.

[0060] I. Architecture of the system (1) Training supervision module: The function of this system is to provide the human resources supervision party with training supervision functions, including attendance supervision, video supervision during training, and supervision of the whole training process.

[0061] (2) Supervision party TEE: The supervision party TEE provides a secure and trusted environment for verifying the execution of smart contracts, ensuring that the smart contract code is not disturbed by malicious software or operating systems during execution; the smart contract implementation chain verifies the information verification, ensuring that the verification process is not maliciously intervened; the key management module is responsible for the secure storage and management of the public and private keys and encryption keys of the supervision party; the secure communication module provides a secure channel for network communication between the supervision party TEE and the institution party TEE; the certificate management module is used to issue and manage the identity certificates of the participating institution party nodes in the entire blockchain network.

[0062] (3) Training management module: This system provides the training institution party with training management functions, including attendance management during training, video collection and storage management during training, and management of the whole training process.

[0063] (4) Institution party TEE: The institution party TEE provides a secure and trusted environment for the execution of the on-chain smart contract, ensuring that the smart contract code is not disturbed by malicious software or operating systems during execution; the on-chain smart contract is responsible for storing key data such as attendance information, video monitoring information, and training audit information on the chain; the key management module is responsible for the secure storage and management of the public and private keys and encryption keys of the institution; the secure communication module provides a secure channel for network communication between the institution party TEE and the supervision party TEE.

[0064] (5) Cloud storage module: responsible for storing training-related basic information and monitoring videos collected during training.

[0065] (6) Blockchain network: Using the distributed ledger technology of blockchain, tamper-proof mechanism, and traceability capability, it ensures the security and reliability of the key information of training and provides basic capability support for training supervision.

[0066] II. System initialization In order to ensure the normal operation of the system, the system needs to be initialized, including the initialization of the supervision party TEE and each institution party TEE, key exchange, and blockchain network construction.

[0067] (1) Supervisor TEE initialization The supervisor TEE starts running, and if the supervisor public key and private key do not exist, the supervisor creates a public key and a private key, and the function of the public and private key pair is to identify the identity of the supervisor.

[0068] (2) Agency TEE initialization The agency TEE starts running, and if the public key and private key of the party do not exist, the public key and private key of the party are created, and the function of the public and private key pair is to identify the identity of the agency.

[0069] (3) Agency and supervisor encrypted key exchange a) The agency sends a key exchange request containing the public key of the agency itself, the signature of the agency, etc. to the supervisor TEE through a secure communication channel.

[0070] b) After the supervisor TEE receives the key exchange request of the agency, the signature of the agency is verified using the public key of the agency, and the next step is performed after the verification is passed.

[0071] c) The supervisor TEE uses the ECDH algorithm to calculate and generate an encrypted key based on the supervisor's private key and the agency's public key, and securely stores it in the TEE environment.

[0072] d) The supervisor TEE sends a key exchange response containing the public key of the supervisor itself, the signature of the supervisor, etc. to the agency TEE through a secure communication channel.

[0073] e) After the agency TEE receives the key exchange response of the supervisor, the signature of the supervisor is verified using the public key of the supervisor, and the next step is performed after the verification is passed.

[0074] f) The agency TEE uses the ECDH algorithm to calculate and generate an encrypted key based on its own private key and the public key of the supervisor, and securely stores it in the TEE environment.

[0075] (4) Trusted construction of blockchain network a) The supervisor calls the certificate management module in the TEE to create a blockchain network CA root certificate using the private key in the TEE.

[0076] b) The supervisor calls the certificate management module in the TEE to issue a node network identity certificate using the CA root certificate, and deploys and starts as a blockchain founder node.

[0077] c) The agency calls the certificate management module in the TEE to generate a node identity certificate request CSR file using the private key in the TEE.

[0078] d) The institution party calls the certificate management module in the TEE to export the CSR file and sends it to the regulatory party to apply for a certificate. The regulatory party calls the certificate management module in the TEE to issue a node identity certificate for the institution party using the TEE private key, and returns it to the institution party.

[0079] e) The institution party configures the node and the certificate and starts the newly added node as a network to join the regulatory party's genesis node.

[0080] f) The nodes perform mutual signing and certificate exchange, and complete the identity authentication and network access process of the TEE private key, and complete the identity authentication and network access process.

[0081] g) The regulatory party and the institution party deploy the on-chain smart contract and the verification smart contract in the local TEE environment.

[0082] Three, secure storage of data (1) Attendance information on-chain Attendance information mainly includes student clock-in and clock-out information, etc. The information is structured data with small data volume, so the full-amount attendance information is on-chained.

[0083] a) The training institution uses a clock-in device to collect student attendance information; b) The attendance management module of the training institution party calls the private key of the TEE to sign the collected attendance information to generate a blockchain transaction calling the on-chain smart contract, and calls the on-chain smart contract in the TEE; c) In the on-chain smart contract of the institution party TEE, the encryption key of the TEE is called to encrypt the private information such as name involved in the attendance information; d) The on-chain smart contract of the TEE merges the encrypted ciphertext data and the plaintext data and stores them on-chain; e) The on-chain data is distributed and shared to the regulatory network through the consensus mechanism of the blockchain network.

[0084] (2) Surveillance video information on-chain Due to the large amount of surveillance video data, the storage space requirement is very high, so in this patent, the video information hash on-chain method is adopted. The specific process is as follows: a) During the training process, the video management module in the institution party training management module periodically collects training videos; b) Upload the collected video files to the cloud storage system; c) Use the digest algorithm MD5 to calculate the video file to generate tamper-proof video digest information; d) The video management module calls the private key in the institution party TEE to sign the video digest information and video description information to generate a blockchain transaction calling the on-chain smart contract, and calls the smart contract in the TEE; e) The TEE's on-chain smart contract calls the TEE's encryption key to encrypt privacy information such as names involved in the video description; f) The on-chain smart contract in the TEE merges the encrypted ciphertext data and plaintext data and stores them on the chain. g) On-chain data is distributed and shared to the regulatory network through the blockchain network consensus mechanism.

[0085] (3) Training process information is uploaded to the blockchain The training process information record includes training data at each stage of the training, such as training course information, trainee assessment information, trainee feedback, and trainee graduation and certificate information. Uploading the training process information to the blockchain can evaluate the training effectiveness of training institutions and ensure the compliance and legality of training; therefore, the entire data needs to be uploaded to the blockchain.

[0086] a) The training management module collects training process data such as training course information and trainee assessment information; b) The training institution's process management module calls the TEE's private key to sign the collected training process information, generates a blockchain transaction that calls the on-chain smart contract, and then calls the on-chain smart contract in the TEE. c) In the on-chain smart contract of the institution's TEE, the privacy information such as name, assessment results, and certificate involved in the training process information is encrypted using the TEE's encryption key; d) The on-chain smart contract of TEE merges the encrypted ciphertext data and plaintext data and stores them on the chain; e) On-chain data is distributed and shared to the regulatory network through the blockchain network consensus mechanism.

[0087] IV. Data Credibility Verification (1) Verification of attendance information Attendance information verification verifies the compliance of training-related attendance records using the provided student information on the blockchain. The process is as follows: a) The verification initiator enters the identity information of the trainees to be verified and the verification rules through the training supervision module; b) The attendance monitoring module generates a verification blockchain transaction by signing the student's identity information using the TEE's private key, and then calls the verification smart contract in the TEE. c) The verification smart contract in the TEE retrieves the student's attendance information on the chain and decrypts the encrypted part using the encryption key in the TEE; d) The verification smart contract in the TEE verifies the attendance information based on plaintext according to the verification rules, and returns the verification result to the attendance supervision module, and finally displays it to the verification initiator.

[0088] (2) Monitoring video information verification a) The verification initiator initiates a verification request to verify a specified video segment through the training supervision module; b) The video supervision module downloads the complete video file into the cloud storage system and calculates the MD5 digest information; c) The video supervision module generates a verification blockchain transaction using the private key in the TEE based on the video MD5 digest information and the video description information, and calls the verification smart contract in the TEE; d) The verification smart contract in the TEE retrieves the digest information corresponding to the video on the chain, and compares the consistency of the MD5 digest data. If consistent, return the verification success result to the video supervision module.

[0089] (3) Training process information verification a) The verification initiator enters the identity information of the student to be verified and the verification rules through the training supervision module; b) The process supervision module generates a verification blockchain transaction using the private key of the TEE based on the identity information of the student, and calls the verification smart contract in the TEE; c) The verification smart contract in the TEE retrieves the training process information of the student on the chain, and decrypts the encrypted part using the encryption key in the TEE; d) The verification smart contract in the TEE verifies the training process information based on the plaintext according to the verification rules, and returns the verification result to the process supervision module, which is finally displayed to the verification initiator.

[0090] The beneficial effects of the present application include: (1) A comprehensive and complete human resource training supervision solution based on blockchain and TEE technology This solution uses blockchain and TEE technology to design a complete supervision solution to solve the problems of training process supervision, training data supervision, and training data verification.

[0091] The present application uses blockchain and isolated computing TEE technology to protect the data privacy, confidentiality and security of the supervision process such as identity issuance and authentication process, encryption key management process, training data on-chain process, and training data verification process. In addition, for large file video data, the mechanism of off-chain cloud storage and on-chain message verification is adopted, which overcomes the problem of sharing, storage and verification of large file data between training institutions.

[0092] Based on this scheme has been in Sichuan Province vocational training scene pilot implementation and comprehensive promotion, covering an area of 17 more than 3000 city and state camera point, to the classroom video retention, on-site pictures have evidence, class data can be traced. It is the first case of the country will be used in the block chain of trusted technology in the employment of human resources supervision scene case.

[0093] (2) TEE-based encryption key exchange and digital certificate issuing mechanism Based on the hardware isolation, secure storage and other capabilities provided by TEE, a secure and trusted encryption key exchange mechanism between the supervision party and the institution party is realized, overcoming the security of the key in the traditional key exchange. At the same time, in view of the security requirements of the blockchain identity certificate of the participating institution party, through the implementation of digital certificate CA registration generation, digital certificate issuing, digital certificate verification and other certificate management and use processes in TEE, the certificate and key are protected from being accessed by external attackers or malicious software. Through the above two mechanisms, it is ensured that the encryption and authentication of the system can be completed in a safer environment, thereby protecting the privacy of the training data and enhancing the overall security of the training supervision module.

[0094] (3) TEE-based sensitive private data processing Based on the hardware isolation capability of TEE, the privacy and confidentiality of the sensitive data such as the identity of the student are ensured, overcoming the difficulty of sharing and verifying sensitive data among participating institutions, and combining the consensus mechanism of the blockchain to isolate, share and verify the private data. In the data chaining link, the application realizes the secure and isolated operation of the smart contract in the TEE environment, and the private data is encrypted and chained in the TEE; in the data sharing and transmission link, the data is shared to the supervision party and other participants in the form of ciphertext through the consensus mechanism of the blockchain, and the key is isolated in the TEE and cannot be obtained or cracked by a third party; in the verification link, the supervision party accesses the private data by calling the smart contract in the TEE, and obtains the verification result according to the verification rule, and cannot directly obtain the plaintext data.

[0095] The embodiment of the application also provides a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the method.

[0096] It can be understood that the contents in the above method embodiments are applicable to the present storage medium embodiment, the functions realized by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved by the present storage medium embodiment are also the same as those of the above method embodiments.

[0097] It can be understood that the contents in the above method embodiments are all applicable to the device embodiments, the device embodiments specifically implement the functions same as those of the above method embodiments, and achieve the same beneficial effects as those of the above method embodiments.

[0098] The embodiment of the present application further provides an electronic device, which comprises a memory and a processor. The memory stores a computer program. The processor executes the computer program to implement the method described above. The electronic device can be any intelligent terminal, such as a tablet computer or a vehicle-mounted computer.

[0099] It can be understood that the contents in the above method embodiments are all applicable to the device embodiments, the device embodiments specifically implement the functions same as those of the above method embodiments, and achieve the same beneficial effects as those of the above method embodiments.

[0100] Please refer to Figure 10 , Figure 10 The hardware structure of the electronic device of another embodiment is illustrated, and the electronic device comprises: The processor 1001 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is used to execute related programs to implement the technical solutions provided by the embodiments of the present application. The memory 1002 can be implemented in the form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory). The memory 1002 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 1002 and are called and executed by the processor 1001 to implement the above method of the embodiments of the present application. The input / output interface 1003 is used to realize information input and output. The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized by a wired manner (such as a USB, a network cable, etc.) or a wireless manner (such as a mobile network, WIFI, Bluetooth, etc.). The bus 905 transmits information between various components (such as the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004) of the device. The processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are communicatively connected with each other through a bus 905.

[0101] The embodiment of the present application further provides a computer program product, comprising a computer program which is executed by a processor to implement the method described above.

[0102] It can be understood that the contents in the above method embodiments are applicable to the program product embodiment, the program product embodiment specifically implements the functions same as those of the above method embodiments, and achieves the beneficial effects same as those of the above method embodiments.

[0103] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can further include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory disposed remotely with respect to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0104] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0105] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than those shown in the figures, or combine certain steps, or different steps.

[0106] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, that is, can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0107] Those skilled in the art can understand that all or some of the steps in the above disclosed method, the functional modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0108] The terms "first", "second", "third", "fourth", and the like in the description and in the claims of this application, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so termed is interchangeable under appropriate circumstances such that the embodiments of the application described herein are, for example, capable of orderly or chronological mundane operation, reverse order operation, based on circuitry availability, based on stated preference or the like, and that "default" or other orderings are thus permissible. Further, the terms "comprise", "comprising", "include", "including", and the like, are specifically intended to be open-ended. That is, references to individual steps and the like do not suhstantially exclude the presence of two or more of a given step or its integral presence in the process, method, system, article, or apparatus having been made with a wider scope. The use of notation such as "first", "second", "third", etc. does not generally limit the areas, but is used to connect between similar objects.

[0109] It should be understood that, in the application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the relationship between associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are only A, only B, and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects. "At least one of the following" or the like means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0110] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the above-mentioned units is only a logical functional division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other form.

[0111] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. Part or all of the units can be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0112] In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit.

[0113] When the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in part, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions used to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various other media that can store programs.

[0114] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and are not intended to limit the scope of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. A blockchain and TEE based human resource training supervision system, characterized in that, The system comprises a human resources supervision party node, a training institution party node, a cloud storage module and a blockchain network; the human resources supervision party node comprises a training supervision module and a supervision party TEE; the training institution party node comprises a training management module and an institution party TEE; The training supervision module is configured to call data of the supervision party TEE to provide a training supervision function for the human resources supervision party; the training supervision function comprises attendance supervision, video supervision during training and supervision of the whole training process; The supervision party TEE is configured to provide an environment for execution of a verification smart contract; The verification smart contract is configured to verify based on plaintext information according to a verification rule and return a verification result to the training supervision module; The training management module is configured to call data of the institution party TEE to provide a training management function for the training institution party; the training management function comprises attendance management during training, video collection and storage management during training and management of the whole training process; The institution party TEE is configured to provide an environment for execution of an on-chain smart contract; the on-chain smart contract is configured to merge encrypted ciphertext data and plaintext data and store them on a chain; The cloud storage module is configured to store training information and monitoring videos collected during training; The blockchain network is configured to provide anti-tampering and traceability functions for on-chain data.

2. The system of claim 1, wherein, The supervision party TEE comprises a supervision party key management module, a supervision party certificate management module and a supervision party secure communication module; The supervision party key management module is configured to securely store and manage a supervision party public key, a supervision party private key and encryption keys of the supervision party; The supervision party certificate management module is configured to issue and manage identity certificates of the training institution party nodes participating in the whole blockchain network; The supervision party secure communication module is configured to provide a secure channel for network communication between the supervision party TEE and the institution party TEE.

3. The system of claim 1, wherein, The institution party TEE comprises an institution party key management module, an institution party certificate management module and an institution party secure communication module; The institution party key management module is configured to securely store and manage an institution party public key, an institution party private key and encryption keys of the institution party; The institution party certificate management module is configured to apply for identity certificates from the human resources supervision party node; The institution party secure communication module is configured to provide a secure channel for network communication between the institution party TEE and the supervision party TEE.

4. A method for human resource training supervision based on a blockchain and a TEE, for being implemented by the system according to any one of claims 1 to 3, characterized in that, The method comprises the following steps: Performing an initialization operation through the supervision party TEE and the institution party TEE to obtain TEE initialization information; Performing encryption key exchange of the institution party and the supervision party according to the TEE initialization information to obtain key exchange information; Performing construction of a blockchain network through the supervision party TEE and the institution party TEE to obtain blockchain network construction information; Performing on-chain storage of training data according to the key exchange information and the blockchain network construction information to obtain on-chain data; the training data comprises attendance information, monitoring video information and training process information; Performing data credible verification according to the on-chain data to obtain verification data, thereby completing human resources training supervision.

5. The method of claim 4, wherein, The initialization operation is performed by the supervisor TEE and the agency TEE, and TEE initialization information is obtained, including: The supervisor TEE is used to detect whether the supervisor public key and the supervisor private key exist in the supervisor key management module; When the supervisor public key and the supervisor private key do not exist in the supervisor key management module, the supervisor TEE creates the supervisor public key and the supervisor private key, and obtains supervisor TEE initialization information; the supervisor public key and the supervisor private key are used to identify the supervisor identity; The agency TEE is used to detect whether the agency public key and the agency private key exist in the agency key management module; When the agency public key and the agency private key do not exist in the agency key management module, the agency TEE creates the agency public key and the agency private key, and obtains agency TEE initialization information; the agency public key and the agency private key are used to identify the agency identity; The supervisor TEE initialization information and the agency TEE initialization information are used as TEE initialization information.

6. The method of claim 4, wherein, The encryption key exchange between the agency and the supervisor is performed according to the TEE initialization information, and key exchange information is obtained, including: According to the TEE initialization information, the agency sends key exchange request information to the supervisor TEE through the agency secure communication module; the key exchange request information includes an agency public key and an agency signature; After the supervisor TEE receives the key exchange request information of the training agency node, the supervisor TEE verifies the agency signature using the agency public key; If the verification of the agency signature is passed, the supervisor TEE uses the ECDH algorithm to calculate and generate an encryption key based on the supervisor private key and the agency public key, obtains the encryption key of the supervisor, stores the encryption key of the supervisor in the supervisor key management module, and obtains the exchange information of the supervisor; According to the TEE initialization information, the supervisor sends key exchange response information to the agency TEE through the supervisor secure communication module; the key exchange response information includes a supervisor public key and a supervisor signature; After the agency TEE receives the key exchange response information of the human resource supervisor node, the agency TEE verifies the supervisor signature using the supervisor public key; If the verification of the supervisor signature is passed, the agency TEE uses the ECDH algorithm to calculate and generate an encryption key based on the agency private key and the supervisor public key, obtains the encryption key of the agency, stores the encryption key of the agency in the agency key management module, and obtains the exchange information of the agency; The exchange information of the supervisor and the exchange information of the agency are used as key exchange information.

7. The method of claim 4, wherein, The supervisor TEE and the agency TEE are used to perform the construction of the blockchain network, and blockchain network construction information is obtained, including: The training supervision module calls the supervisor certificate management module of the supervisor TEE, and uses the supervisor private key to create a blockchain network CA root certificate; The training supervision module calls the supervision party certificate management module of the supervision party TEE, uses the blockchain network CA root certificate issuing node network identity certificate, and deploys to start as a blockchain founder node; The training management module calls the agency party certificate management module of the agency party TEE, uses the agency party private key to generate a node identity certificate request CSR file; The training management module calls the agency party certificate management module of the agency party TEE to export the node identity certificate request CSR file and sends it to the supervision party TEE for certificate application, and the training supervision module calls the supervision party certificate management module to issue a node identity certificate for the agency party TEE using the supervision party private key and returns it to the agency party TEE; The agency party TEE configures the node and the node identity certificate and starts to join the blockchain network as a new node to the supervision party's blockchain founder node; The new node and the blockchain founder node perform mutual signature and certificate exchange, perform identity authentication and network access of the agency party TEE using the agency party private key, and obtain agency party identity authentication and network access information; According to the agency party identity authentication and network access information, the local TEE environment is deployed, and the blockchain network construction information is obtained.

8. The method of claim 4, wherein, According to the key exchange information and the blockchain network construction information, the training data is chained, and the chained data is obtained, including: Obtain attendance information; the attendance information includes attendance student identity information and student clock-in and clock-out information; Through the attendance supervision function of the training management module, the agency party private key is called to sign the attendance information to generate a blockchain transaction calling the on-chain smart contract, and the on-chain smart contract is called; In the on-chain smart contract, the encryption key of the agency party is called to encrypt the attendance student identity information in the attendance information, and the attendance ciphertext data is obtained; The on-chain smart contract is used to merge the attendance ciphertext data and the plaintext data of the attendance information and store them on the chain, and the attendance on-chain data is obtained; the attendance on-chain data is distributed and shared to the supervision network through the blockchain network consensus mechanism; Obtain monitoring video information; the monitoring video information includes video files and video description information; upload the monitoring video information to the cloud storage module; An encryption algorithm is used to calculate the video files to generate tamper-proof video summary information; Through the training management module, the agency party private key is called to sign the video summary information and the video description information to generate a blockchain transaction calling the on-chain smart contract, and the on-chain smart contract is called; The on-chain smart contract is used to encrypt the video description information in the video description information using the encryption key of the agency party, and the video ciphertext data is obtained; The on-chain smart contract is used to merge the video ciphertext data and the plaintext data of the monitoring video information and store them on the chain, and the video on-chain data is obtained; the video on-chain data is distributed and shared to the supervision network through the blockchain network consensus mechanism; Obtaining training process information; the training process information includes training course information, trainee examination information, trainee training feedback, and trainee graduation certificate information; The training management module calls the institution private key to sign the training process information, generates a blockchain transaction for calling a smart contract, and calls the smart contract; In the smart contract, the trainee privacy information in the training process information is encrypted using the institution encryption key to obtain training process ciphertext data; The training process ciphertext data and the plaintext data of the training process information are merged and stored on the blockchain using the smart contract to obtain training process on-chain data; the training process on-chain data is distributed and shared to the supervision network through the blockchain network consensus mechanism; The attendance on-chain data, the video ciphertext data, and the training process ciphertext data are used as on-chain data.

9. The method of claim 4, wherein, The on-chain data is used to perform data trust verification to obtain verification data and complete the supervision of the human resources training, including: Obtaining verification request data; the verification request data includes attendance information verification request data, monitoring video information verification request data, and training process information verification request data; the attendance information verification request data includes the identity information of the trainee to be verified and the verification rules of the attendance information; the training process information verification request data includes the identity information of the trainee to be verified and the verification rules of the video information; The process supervision module generates a verification blockchain transaction using the supervision private key based on the verification request data, and calls a verification smart contract in the supervision TEE; The verification smart contract retrieves the data to be verified on the chain, and decrypts the encrypted part using the supervision encryption key to obtain decrypted data; when the verification request data is attendance information verification request data, the data to be verified is the attendance information of the trainee to be verified; when the verification request data is monitoring video information verification request data, the data to be verified is video summary information and video description information; when the verification request data is training process information verification request data, the data to be verified is the training process information of the trainee to be verified; The verification smart contract verifies the data to be verified based on the plaintext; if there are verification rules, the verification rules are used for verification, and the verification result is returned to the process supervision module and displayed to the training supervision module to obtain verification data and complete the supervision of the human resources training.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to implement the method of any one of claims 4 to 9.

Images