Data access method, system and device, storage medium and program product

Abstract

The invention provides a data access method, system and device, a storage medium and a program product. The method comprises the following steps: acquiring a first data request, wherein the first data request comprises a request parameter and an encrypted authorization certificate; obtaining a decryption result returned after the encrypted authorization certificate is decrypted by calling a certificate management module; under the condition that the decryption result shows that decryption succeeds and the authorization certificate is within the effective time, obtaining decrypted certificate information; the decrypted certificate information and the request parameter are forwarded to the central block chain, the decrypted certificate information comprises the encrypted identification code, and the request parameter comprises the data classification code; target data forwarded by the special block chain corresponding to the data classification code through the central block chain is obtained, the encrypted identification code passes verification on the special block chain side, and the target data is data corresponding to the request parameter. According to the invention, unauthorized access and malicious access can be effectively prevented, and the system security and the data query efficiency are improved.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to a data access method, system, device, storage medium, and program product. Background Technology

[0002] In today's era of rapid digital development, data has become a key production factor and strategic resource. Public data covers fields such as government affairs, healthcare, transportation, and education, and its potential value is immeasurable. However, fully realizing the value of public data and achieving effective sharing and utilization faces numerous challenges.

[0003] Currently, blockchain technology, with its decentralized, immutable, and traceable characteristics, has demonstrated enormous application potential in numerous fields, ensuring the security and transparency of public data authorization processes. However, some existing technologies store large amounts of data on a single chain, resulting in low efficiency in data retrieval and slow system response, failing to meet real-time requirements. Other solutions, while guaranteeing the immutability of the authorization process, lack a comprehensive security architecture, making them vulnerable to unauthorized or malicious high-volume attacks and posing security risks. Summary of the Invention

[0004] The purpose of this invention is to provide a data access method, system, device, storage medium, and program product to solve the problems of low data query efficiency and high security risks in existing data access systems.

[0005] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a data access method, executed by an isolation module, the method comprising:

[0006] Obtain a first data request, the first data request including request parameters and an encrypted authorization certificate;

[0007] By calling the certificate management module, the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate is obtained;

[0008] If the decryption result indicates successful decryption and the authorized certificate is within its validity period, the decrypted certificate information is obtained; and the decrypted certificate information and the request parameters are forwarded to the central blockchain. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes.

[0009] The target data is forwarded by the central blockchain through the dedicated blockchain corresponding to the data classification code, wherein the encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

[0010] In some embodiments, the method further includes:

[0011] If the decryption result indicates decryption failure, or if the decryption result indicates decryption success but the authorization certificate is not valid within the time limit, the first data request shall be rejected.

[0012] In some embodiments, the method further includes:

[0013] Get the second data request;

[0014] If it is determined that the second data request does not carry an authorization certificate, the second data request is rejected.

[0015] In some embodiments, the request to obtain the first data includes:

[0016] Obtain the first data packet, which carries the first data request;

[0017] The step of obtaining the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate by calling the certificate management module includes:

[0018] If the first data packet meets the preset allowed access conditions, the certificate management module is invoked to obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate. The encrypted authorization certificate is carried in the request header of the first data packet.

[0019] In some embodiments, the method further includes:

[0020] If the first data packet does not meet the preset allowed access conditions, the first data packet is discarded.

[0021] In some embodiments, the preset access permission conditions include a first access permission condition and a second access permission condition;

[0022] The first condition for allowing access is that the protocol of the data packet is Hypertext Transfer Security Protocol (HTTPS), and the port is the port corresponding to HTTPS.

[0023] The second allowed access conditions include: the platform value in the request header of the data packet is the system serial number, the size of the data packet is within a preset range, and the media access control MAC address in the request header of the data packet is the same as the MAC address in the authorization certificate.

[0024] In some embodiments, the method further includes:

[0025] The error information forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain is obtained, wherein the encrypted identification code fails verification on the dedicated blockchain side;

[0026] The error message is returned to the user client that initiated the data request.

[0027] In some embodiments, the method further includes:

[0028] Obtain registration request information;

[0029] Send the registration request information to the certificate management module;

[0030] Receive the encrypted authorization certificate sent by the certificate management module;

[0031] The encrypted authorization certificate is returned to the user client that initiated the registration request.

[0032] Secondly, embodiments of the present invention also provide a data access method executed by a central blockchain, the method comprising:

[0033] Obtain the decrypted certificate information and request parameters forwarded by the isolation module, wherein the decrypted certificate information includes an encrypted identification code and the request parameters include a data classification code;

[0034] The request parameters and the encrypted identification code are sent to the dedicated blockchain corresponding to the data classification code, wherein the data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes.

[0035] The system receives target data sent by the dedicated blockchain corresponding to the data classification code and forwards the target data to the isolation module. The encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

[0036] In some embodiments, the method further includes:

[0037] The data classification code in the request parameters and the encrypted identification code in the decrypted certificate information are extracted through the first smart contract.

[0038] Sending the request parameters and the encrypted identification code to the dedicated blockchain corresponding to the data classification code includes:

[0039] The request parameters and the encrypted identification code are forwarded to the dedicated blockchain corresponding to the data classification code via a second smart contract.

[0040] In some embodiments, the method further includes:

[0041] The system receives error information sent by the dedicated blockchain corresponding to the data classification code and forwards the error information to the isolation module, wherein the encrypted identification code fails verification on the dedicated blockchain side.

[0042] Thirdly, embodiments of the present invention also provide a data access method executed by a dedicated blockchain, the method comprising:

[0043] The receiving center blockchain sends request parameters and an encrypted identification code; the dedicated blockchain corresponds to the data classification code in the request parameters.

[0044] By calling the certificate management module, the verification result returned by the certificate management module after verifying the encrypted identification code is obtained;

[0045] If the verification result indicates that the verification has passed, data retrieval is performed based on the request parameters to obtain the target data.

[0046] The target data is forwarded to the isolation module via the central blockchain.

[0047] In some embodiments, the method further includes:

[0048] If the verification result indicates that the verification failed, an error message is generated;

[0049] The error message is sent to the central blockchain.

[0050] Fourthly, embodiments of the present invention also provide a data access method, executed by a certificate management module, the method further comprising:

[0051] In response to the call from the isolation module, the encrypted authorization certificate is decrypted to obtain the decryption result;

[0052] The decryption result is returned to the isolation module;

[0053] In response to calls from the dedicated blockchain, the encrypted identification code is verified, and the verification result is obtained.

[0054] The verification result is returned to the dedicated blockchain.

[0055] In some embodiments, verifying the encrypted identification code to obtain a verification result includes:

[0056] The encrypted identification code is decrypted to obtain the decrypted identification code;

[0057] The decrypted identification code is reverse-scrambled to obtain the authorization code and certificate serial number;

[0058] The permission code is verified to obtain the verification result.

[0059] In some embodiments, the method further includes:

[0060] Receive the registration request information sent by the isolation module;

[0061] Based on the registration request information, generate an encrypted authorization certificate;

[0062] The isolation module returns the encrypted authorization certificate to the user client that initiated the registration request.

[0063] In some embodiments, generating an encrypted authorization certificate based on the registration request information includes:

[0064] Generate an N-bit universally unique identifier (UUID) as the certificate serial number;

[0065] The certificate validity period is calculated based on the user registration time in the registration request information;

[0066] Based on the data type requested by the user in the registration request information, obtain the corresponding permission code;

[0067] The identification code, which includes the permission code and the certificate serial number, is sequentially scrambled and encrypted to obtain the encrypted identification code.

[0068] Based on the certificate serial number, the certificate validity period, and the encrypted identification code, encryption processing is performed to obtain an encrypted authorization certificate.

[0069] Fifthly, embodiments of the present invention also provide a data access system, including: an isolation module, a certificate management module, a central blockchain, and at least one dedicated blockchain;

[0070] The isolation module is used to decrypt the encrypted authorization certificate in the first data request by calling the certificate management module, and if the decryption is successful and the authorization certificate is within the valid time, obtain the decrypted certificate information; forward the decrypted certificate information and the request parameters in the first data request to the central blockchain; and reject data requests with invalid or no authorization certificates.

[0071] The central blockchain is used to obtain the decrypted certificate information and request parameters forwarded by the isolation module. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The request parameters and the encrypted identification code are sent to the dedicated blockchain corresponding to the data classification code. The data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes.

[0072] The dedicated blockchain corresponding to the data classification code is used to receive the request parameters and the encrypted identification code sent by the central blockchain; to verify the encrypted identification code by calling the certificate management module, and if the verification is successful, to retrieve the target data according to the request parameters; and to forward the target data to the isolation module through the central blockchain.

[0073] In some embodiments, the system further includes an interface module for initiating a first data request through user operation and sending the first data request to the isolation module, wherein the first data request includes request parameters and an encrypted authorization certificate.

[0074] In a sixth aspect, embodiments of the present invention also provide a data access device, including a memory, a processor, and a computer program stored in the memory and running thereon. When the processor executes the program, it implements the data access method as described in the first aspect above, or the data access method as described in the second aspect above, or the data access method as described in the third aspect above, or the data access method as described in the fourth aspect above.

[0075] In a seventh aspect, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data access method as described in the first aspect above, or implements the steps of the data access method as described in the second aspect above, or implements the steps of the data access method as described in the third aspect above, or implements the steps of the data access method as described in the fourth aspect above.

[0076] Eighthly, embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps in the data access method as described in the first aspect above, or implement the steps in the data access method as described in the second aspect above, or implement the steps in the data access method as described in the third aspect above, or implement the steps in the data access method as described in the fourth aspect above.

[0077] The above-described technical solution of the present invention has at least the following beneficial effects:

[0078] In this embodiment of the invention, a first data request is obtained, which includes request parameters and an encrypted authorization certificate. A certificate management module is invoked to obtain the decryption result returned by the module after decrypting the encrypted authorization certificate. If the decryption result indicates successful decryption and the authorization certificate is within its validity period, the decrypted certificate information is obtained. The decrypted certificate information and request parameters are then forwarded to the central blockchain. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The data classification code characterizes the data type of the dedicated blockchain; different dedicated blockchains have different data classification codes. The target data corresponding to the data classification code is obtained and forwarded by the dedicated blockchain through the central blockchain. The encrypted identification code is verified on the dedicated blockchain side, and the target data corresponds to the request parameters. Thus, through the cooperation of the isolation module and the certificate management module, only authorized and valid data access is accepted, effectively preventing unauthorized and malicious access and improving system security. Furthermore, the data-classified blockchain structure significantly reduces blockchain storage pressure and improves data query efficiency. Attached Figure Description

[0079] Figure 1 One of the flowcharts illustrating the data access method according to an embodiment of the present invention;

[0080] Figure 2 A second flowchart illustrating the data access method according to an embodiment of the present invention;

[0081] Figure 3 The third flowchart illustrates the data access method according to an embodiment of the present invention;

[0082] Figure 4 The fourth flowchart illustrates the data access method according to an embodiment of the present invention.

[0083] Figure 5 This diagram illustrates the structure of the identification code before scrambling in this invention.

[0084] Figure 6 This is a schematic diagram illustrating the architecture of a data access system according to an embodiment of the present invention.

[0085] Figure 7 This diagram illustrates the network defense process corresponding to the isolation module of the present invention.

[0086] Figure 8 This diagram illustrates the user registration and authentication process corresponding to the isolation module of the present invention.

[0087] Figure 9 This diagram illustrates the access authentication process corresponding to the isolation module of the present invention.

[0088] Figure 10 This diagram illustrates the certificate generation process corresponding to the certificate management module of the present invention.

[0089] Figure 11 This diagram illustrates the certificate authentication process corresponding to the certificate management module of the present invention.

[0090] Figure 12 This is a schematic diagram illustrating the data access system flow of the present invention;

[0091] Figure 13 One of the schematic diagrams of the data access device of the present invention;

[0092] Figure 14 A second schematic diagram illustrating the data access device of the present invention;

[0093] Figure 15 The third schematic diagram of the data access device of the present invention;

[0094] Figure 16 The fourth schematic diagram illustrates the data access device of the present invention. Detailed Implementation

[0095] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0096] like Figure 1 As shown, this embodiment of the invention provides a data access method, which is executed by an isolation module. Specifically, the method may include:

[0097] Step 101: Obtain a first data request, which includes request parameters and an encrypted authorization certificate;

[0098] The user can initiate the first data request through the interface module; the isolation module receives the first data request sent by the interface module.

[0099] It should be noted that a valid data request, i.e., the first data request, includes an encrypted authorization certificate and request parameters.

[0100] Optional, request parameters include, but are not limited to, data classification code, data time range, data name, and data source.

[0101] Step 102: By calling the certificate management module, obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate;

[0102] Here, the isolation module calls the certificate management module to decrypt the encrypted authorization certificate; it determines whether the certificate is valid based on whether the decryption is successful, and returns the decryption result to the isolation module.

[0103] Step 103: If the decryption result indicates successful decryption and the authorization certificate is within its validity period, obtain the decrypted certificate information; and forward the decrypted certificate information and the request parameters to the central blockchain. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes.

[0104] The process involves the isolation module forwarding the decrypted authorization certificate and request parameters to the central blockchain. The central blockchain then reads the data classification code from the request parameters and the encrypted identification code from the decrypted authorization certificate. The data classification code determines the corresponding dedicated blockchain, thus identifying which dedicated blockchain stores the data required for this request. Finally, the request parameters and the encrypted identification code are sent to the dedicated blockchain corresponding to the data classification code to obtain the target data corresponding to the first data request from that dedicated blockchain.

[0105] It should be noted that different data types can be stored on different dedicated blockchains. For example, data can be categorized into general data, important data, and core data based on its importance. In other words, data types include general data, important data, and core data. Specifically, data type can be represented by a data classification code, and there is a correlation between the data classification code and the dedicated blockchain.

[0106] Step 104: Obtain the target data forwarded by the central blockchain through the dedicated blockchain corresponding to the data classification code, wherein the encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

[0107] It should be noted that the encrypted identification code is verified on the dedicated blockchain side. Specifically, the dedicated blockchain verifies the encrypted identification code by calling the certificate management module, and the verification result indicates that it passes. The target data is the data corresponding to the request parameters, or it can be understood as data that meets the requirements indicated by the request parameters, or data retrieved according to the request parameters.

[0108] The data access method of this invention involves: acquiring a first data request, which includes request parameters and an encrypted authorization certificate; invoking a certificate management module to obtain a decryption result returned by the certificate management module after decrypting the encrypted authorization certificate; if the decryption result indicates successful decryption and the authorization certificate is within its validity period, acquiring the decrypted certificate information; and forwarding the decrypted certificate information and request parameters to a central blockchain. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code, which characterizes the data type of a dedicated blockchain; different dedicated blockchains correspond to different data classification codes. The method also involves acquiring the target data forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain. The encrypted identification code is verified on the dedicated blockchain side, and the target data corresponds to the request parameters. Thus, through the cooperation of the isolation module and the certificate management module, only authorized and valid data access is accepted, effectively preventing unauthorized and malicious access and improving system security. Furthermore, the data-classified blockchain structure significantly reduces blockchain storage pressure and improves data query efficiency.

[0109] In some embodiments, the method of the present invention further includes:

[0110] If the decryption result indicates decryption failure, or if the decryption result indicates decryption success but the authorization certificate is not valid within the time limit, the first data request shall be rejected.

[0111] In some embodiments, the method of the present invention further includes:

[0112] Get the second data request;

[0113] If it is determined that the second data request does not carry an authorization certificate, the second data request is rejected.

[0114] In the above embodiments, the isolation module considers data requests without authorization certificates, data requests that fail to decrypt, and data requests that are successfully decrypted but whose authorization certificates are not valid within the validity period as invalid data requests, or as unauthorized or malicious access. The isolation module rejects such data requests to improve system security.

[0115] The isolation module is the only module of the system exposed to the outside world (besides the interface module mentioned later). It only provides the ability to call the application programming interface (API). Its main function is to act as a secure channel between internal data and external networks, prevent unauthorized and malicious access from the outside, and forward compliant data between the internal and external networks.

[0116] In some embodiments, step 101 above, obtaining the first data request, includes:

[0117] Obtain the first data packet, which carries the first data request;

[0118] Accordingly, in step 102, by calling the certificate management module, the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate is obtained, including:

[0119] If the first data packet meets the preset allowed access conditions, the certificate management module is invoked to obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate. The encrypted authorization certificate is carried in the request header of the first data packet.

[0120] Based on this, in some embodiments, the method of the present invention further includes:

[0121] If the first data packet does not meet the preset allowed access conditions, the first data packet is discarded.

[0122] In other words, the prerequisite for executing step 102 is that the first data packet carrying the first data request must meet the preset allowed access conditions. For a first data packet that does not meet the preset allowed access conditions, the isolation module will discard the first data packet.

[0123] Specifically, a deep packet inspection (DPI) system is deployed on the isolation module. The DPI system intercepts the first data packet and analyzes its content. If the data packet meets the preset access conditions, the data request is authenticated; if the data packet does not meet the preset access conditions, the data packet is discarded.

[0124] Optionally, the preset access permission conditions include a first access permission condition and a second access permission condition;

[0125] The first condition for allowing access is that the protocol of the data packet is Hypertext Transfer Security Protocol (HTTPS), and the port is the port corresponding to HTTPS.

[0126] The second allowed access conditions include: the platform value in the request header of the data packet is the system serial number, the size of the data packet is within a preset range, and the media access control MAC address in the request header of the data packet is the same as the MAC address in the authorization certificate.

[0127] Specifically, after acquiring the first data packet, the method of the present invention further includes:

[0128] Parse the first data packet to obtain the destination port, protocol, data packet size, platform value in the request header, and MAC address of the first data packet;

[0129] Determine whether the destination port and protocol of the first data packet meet the first allowed access condition, and whether the size of the data packet, the platform value in the request header of the data packet, and the MAC address meet the second allowed access condition;

[0130] If both the first and second access conditions are satisfied, the data packet is determined to satisfy the preset access conditions; if at least one of the first and second access conditions is not satisfied, the data packet is determined not to satisfy the preset access conditions.

[0131] In some embodiments, the method of the present invention further includes:

[0132] The error information forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain is obtained, wherein the encrypted identification code fails verification on the dedicated blockchain side;

[0133] The error message is returned to the user client that initiated the data request.

[0134] It should be noted that the encrypted identification code failed verification on the dedicated blockchain side. Specifically, this means that the dedicated blockchain verifies the encrypted identification code by calling the certificate management module. If the verification result indicates that it failed, the dedicated blockchain will forward the error information to the isolation module through the central blockchain. After that, the isolation module will return the error information to the user terminal that initiated the data request.

[0135] In some embodiments, the method of the present invention further includes:

[0136] Obtain registration request information;

[0137] It should be noted that this registration request information is an approved registration request information.

[0138] Send the registration request information to the certificate management module;

[0139] Receive the encrypted authorization certificate sent by the certificate management module;

[0140] The encrypted authorization certificate is returned to the user client that initiated the registration request.

[0141] This invention proposes an isolation module with network defense and authentication functions. This isolation module can quickly and accurately filter unauthorized and malicious access through the DPI system, which greatly improves the system's anti-attack capability. Moreover, the isolation module provides a service entry point to the external network, truly achieving physical isolation and further improving system security.

[0142] like Figure 2 As shown, this embodiment of the invention provides a data access method, which is executed by a central blockchain. Specifically, the method may include:

[0143] Step 201: Obtain the decrypted certificate information and request parameters forwarded by the isolation module, wherein the decrypted certificate information includes an encrypted identification code and the request parameters include a data classification code;

[0144] In this process, after the central blockchain obtains the decrypted certificate information and request parameters forwarded by the isolation module, it can read the data classification code from the request parameters and the encrypted identification code from the decrypted authorization certificate, thereby determining the dedicated blockchain corresponding to the data classification code, that is, finding out which dedicated blockchain the data required for this request is stored on.

[0145] Step 202: Send the request parameters and the encrypted identification code to the dedicated blockchain corresponding to the data classification code, wherein the data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes;

[0146] It should be noted that the main function of the central blockchain is to analyze the data type of the target data required by the user, i.e., the data classification code; and to locate the dedicated blockchain and log records where the target data is located.

[0147] Step 203: Receive the target data sent by the dedicated blockchain corresponding to the data classification code, and forward the target data to the isolation module. The encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

[0148] It should be noted that the encrypted identification code is verified on the dedicated blockchain side. Specifically, the dedicated blockchain verifies the encrypted identification code by calling the certificate management module, and the verification result indicates that it passes. The target data is the data corresponding to the request parameters, or it can be understood as data that meets the requirements indicated by the request parameters, or data retrieved according to the request parameters.

[0149] The data access method of this invention involves obtaining decrypted certificate information and request parameters forwarded by an isolation module. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. Then, the request parameters and the encrypted identification code are sent to a dedicated blockchain corresponding to the data classification code. The data classification code characterizes the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes. Finally, the method receives target data sent by the dedicated blockchain corresponding to the data classification code and forwards the target data to the isolation module. The encrypted identification code is verified on the dedicated blockchain side, and the target data corresponds to the request parameters. This data-classified blockchain structure significantly reduces blockchain storage pressure and improves data query efficiency.

[0150] In other words, the present invention is based on a data classification blockchain structure, which includes a central blockchain and at least one dedicated blockchain, and can significantly reduce the storage pressure on the blockchain and improve the response speed.

[0151] In some embodiments, the method of the present invention further includes:

[0152] The data classification code in the request parameters and the encrypted identification code in the decrypted certificate information are extracted through the first smart contract.

[0153] Sending the request parameters and the encrypted identification code to the dedicated blockchain corresponding to the data classification code includes:

[0154] The request parameters and the encrypted identification code are forwarded to the dedicated blockchain corresponding to the data classification code via a second smart contract.

[0155] Here, all business logic on the central blockchain is automatically executed by smart contracts, ensuring the transparency and immutability of the data processing process. This mainly includes a trust management smart contract (i.e., the first smart contract), a request proxy smart contract (i.e., the second smart contract), and a log recording smart contract.

[0156] The trust management smart contract works as follows: When a user accesses data, they must include certificate information and request parameters. When the request reaches the central data block through the isolation module, the first smart contract is triggered. This first smart contract extracts the decrypted certificate information and request information to obtain the user's basic information, encrypted identification code, validity period (certificate validity time), and data classification code. It then verifies the validity of the request by checking whether the certificate has expired, whether the certificate content matches the copy stored in the certificate management module, and whether the request parameters include the data classification code.

[0157] For example, the pseudocode for a trust management smart contract is shown below:

[0158] pragma solidity ^0.8.0

[0159] contract TrustValidator {

[0160] / / Define certificate structure

[0161] struct Certificate {

[0162] string serialNumber; / / Serial number

[0163] uint256 startTime; / / Certificate effective time

[0164] uint256 endTime; / / Certificate expiration time

[0165] string permissionCode; / / Encryption identification code

[0166] string userName; / / Username

[0167] string mac; / / User's MAC address

[0168] }

[0169] / / Mapping from serial number to certificate copy

[0170] mapping(string => Certificate) private certificateCopies;

[0171] / / Validate request

[0172] function validateRequest(

[0173] string memory serialNumber,

[0174] string memory startTime,

[0175] string memory endTime,

[0176] string memory permissionCode,

[0177] string memory userName,

[0178] string memory mac,

[0179] string memory categoryCode

[0180] public view returns(bool) {

[0181] / / Get a copy of the certificate

[0182] Certificate storage certCopy = cetificateCopies[serialNumber];

[0183] / / Verify if the certificate is expired, where parseDateTime() converts the date and time string to a Unix timestamp.

[0184] uint256 start = parseDateTime(startTime);

[0185] uint256 end = parseDateTime(endTime);

[0186] if(now<start‖now > end) {

[0187] return false;

[0188] }

[0189] / / Check if the certificate content is consistent

[0190] if(

[0191] keccak256(abi.encodePacked(serialNumber))!= keccak256(abi.encodePacked(cerCopy.serialNumber))‖

[0192] parseDateTime(startTime) != certCopy.startTime‖

[0193] parseDateTime(startTime) != certCopy.endTime‖

[0194] keccak256(abi.encodePacked(permissionCode))!= keccak256(abi.encodePacked(cerCopy.permissionCode))‖

[0195] keccak256(abi.encodePacked(userName))!= keccak256(abi.encodePacked(cerCopy.userName))‖

[0196] keccak256(abi.encodePacked(mac))!= keccak256(abi.encodePacked(cerCopy.mac))‖

[0197] ) {

[0198] return false;

[0199] }

[0200] / / Check if the request parameters include a category code

[0201] if(bytes(categoryCode).length = = 0) {

[0202] retrun false;

[0203] }

[0204] return true;

[0205] }

[0206] }

[0207] Request proxy smart contract: When a user requests data, the request will be sent through the central blockchain. After authentication by the trust management smart contract, it will be forwarded to the corresponding dedicated blockchain for data retrieval.

[0208] For example, the pseudocode for requesting a proxy smart contract is shown below:

[0209] pragma solidity ^0.8.0

[0210] / / Assume there is an interface for interacting with the target's private blockchain.

[0211] interface ITargetBlockchain {

[0212] / / The method for processing requests using the target-specific blockchain, with input parameters including: encrypted identifier and request parameters.

[0213] function processRequest(string memory permissionCode,string memoryrequestParams) external;

[0214] }

[0215] contract RequestProxy {

[0216] / / Map classification codes to target dedicated blockchain addresses

[0217] mapping(string => address) private targetBlockchains;

[0218] / / Set the target blockchain address

[0219] function setTargetBlockchain(string memory categoryCode,addressblockchainAddress) public {

[0220] targetBlockchains[categoryCode] = blockchainAddress;

[0221] }

[0222] / / Send a request to the target's dedicated blockchain, permissionCode: encrypted identifier, requestParams: request parameters

[0223] function sendRequestToBlockchain(

[0224] string memory permissionCode,

[0225] string memory requestParams

[0226] public {

[0227] / / Parse the category code from the request parameters, where extractFromParams() is the parsing function.

[0228] string memory categoryCode = extractFromParams(requestParams);

[0229] / / Get the target's dedicated blockchain address

[0230] address targetBlockchain = targetBlockchain[categoryCode];

[0231] require(targetBlockchain ! = address(0),"Unknown category code");

[0232] / / Call the processRequest method of the target private blockchain

[0233] ITargetBlockchain(targetBlockchain).processRequest(categoryCode,permissionCode, requestParams);

[0234] }

[0235] }

[0236] Log recording smart contract: Maintains an immutable global transaction log (including system logs and user operation logs). All actions in the system will trigger this contract, forming a queryable and traceable log data (each log has a unique identifier, generated by the system).

[0237] For example, the pseudocode for a logging smart contract is shown below:

[0238] pragma solidity ^0.8.0

[0239] / / Define a generic log structure

[0240] struct LogEntry {

[0241] string type; / / Log type (System: system log or Operation: operation log)

[0242] string module; / / Operation module

[0243] string serialNumber; / / Serial number, can be empty in system logs.

[0244] uint256 timestamp; / / Log message

[0245] }

[0246] / / Log recording of smart contracts

[0247] contract LogRecorder {

[0248] / / Use the log ID as the key to map to the log entry

[0249] mapping(uint256 => LogEntry) private logs;

[0250] / / Log ID counter

[0251] uint256 private logIdCounter;

[0252] / / Add log entry

[0253] function addLog(

[0254] string memory_type,

[0255] string memory module,

[0256] string memory serialNumber,

[0257] string memory message

[0258] internal {

[0259] / / Create a new log entry

[0260] LogEntry memory entry = LogEntry({

[0261] type: _type,

[0262] module: module,

[0263] serialNumber: serialNumber,

[0264] timestamp: block.timestamp,

[0265] message: message

[0266] });

[0267] / / Assign a log ID to the new entry

[0268] uint256 logId = logIdCounter++;

[0269] / / Add the new entry to the log map

[0270] Logs[logId] = entry;

[0271] }

[0272] / / Retrieve all operation log entries for the specified sequence number or retrieve log entries for the specified log ID.

[0273] function getLogs(string memory serialNumber,uint256 logId) publicview retruns(LogEntry[] memory) {

[0274] ···

[0275] }

[0276] }

[0277] The system logs are mainly generated by the isolation module, and the log type is unauthorized access interception. The isolation module is the main body, and it records information such as the interception time and reason for interception, which is used for subsequent system protection analysis. The user operation logs are generated by the operations of authorized users. Operation logs are generated in the isolation module, the central blockchain, the certificate management module, and the dedicated blockchain. These logs are mapped to the authorized user's certificate serial number and record information such as the module, time, operation content, and operation result of the operation. All operation logs of authorized users can be queried later based on the certificate serial number.

[0278] In some embodiments, the method of the present invention may further include:

[0279] The system receives error information sent by the dedicated blockchain corresponding to the data classification code and forwards the error information to the isolation module, wherein the encrypted identification code fails verification on the dedicated blockchain side.

[0280] It should be noted that the encrypted identification code failed verification on the dedicated blockchain side. Specifically, this means that the dedicated blockchain verifies the encrypted identification code by calling the certificate management module. If the verification result indicates that it failed, the dedicated blockchain will forward the error information to the isolation module through the central blockchain. After that, the isolation module will return the error information to the user terminal that initiated the data request.

[0281] like Figure 3 As shown, this embodiment of the invention provides a data access method, which is executed by a dedicated blockchain. Specifically, the method may include:

[0282] Step 301: Receive request parameters and encrypted identification codes sent by the central blockchain; the dedicated blockchain corresponds to the data classification code in the request parameters;

[0283] As described above, the blockchain structure for data classification includes a central blockchain and at least one dedicated blockchain. For example, the dedicated blockchain includes a general data blockchain, an important data blockchain, and a core data blockchain, corresponding to the data type (data classification code) and supporting expansion.

[0284] Step 302: By calling the certificate management module, obtain the verification result returned by the certificate management module after verifying the encrypted identification code;

[0285] Step 303: If the verification result indicates that the verification has passed, perform data retrieval based on the request parameters to obtain the target data;

[0286] Specifically, the dedicated blockchain corresponding to the data classification code searches for data based on the search criteria in the request parameters; and de-identifies the user information in the searched data to obtain the target data.

[0287] Based on certain statistical results, user information can be deduced from the search results. This user information is considered personal privacy information. To prevent the leakage of personal privacy information, it is necessary to anonymize the user information in the search results. Specifically, this can be done by modifying or hiding the user information.

[0288] Step 304: The target data is forwarded to the isolation module through the central blockchain.

[0289] The data access method of this invention involves receiving request parameters and an encrypted identification code sent by a central blockchain; the dedicated blockchain corresponds to the data classification code in the request parameters; if the verification result indicates that the verification is passed, data retrieval is performed according to the request parameters to obtain the target data; finally, the target data is forwarded to the isolation module through the central blockchain. In this way, the blockchain structure with data classification can significantly reduce the blockchain storage pressure and improve data query efficiency.

[0290] Each dedicated blockchain in this invention maintains its own data. Its main function is to retrieve data based on search criteria in the request parameters forwarded by the central blockchain agent and perform data anonymization processing. All these operations can be implemented through smart contracts. These mainly include data processing smart contracts, data search smart contracts, and data anonymization smart contracts.

[0291] In some embodiments, retrieving target data based on the request parameters may include:

[0292] By searching smart contracts, data can be retrieved based on request parameters to obtain the searched data;

[0293] By using a data anonymization smart contract, the searched data is anonymized to obtain the target data.

[0294] The data processing smart contract includes functions for adding, updating, and deleting data. For example, the pseudocode for the data processing smart contract is shown below:

[0295] pragma solidity ^0.8.0

[0296] / / Data processing smart contract

[0297] contract DateProcessor {

[0298] / / Define data structure

[0299] struct DataTtem {

[0300] string data; / / Data content

[0301] uint256 timestamp; / / Data creation time

[0302] }

[0303] / / Use the data ID as the key to map to the data item

[0304] uint256 private nextDataId;

[0305] / / Add data

[0306] function addData(string memory data) public {

[0307] / / Create new data items

[0308] DataItem storage newItem = dataItems[nextDataId];

[0309] newItem.data = data;

[0310] newItem.timestamp = block.timestamp;

[0311] / / Update the next data ID

[0312] nextDataId++;

[0313] }

[0314] / / Update data

[0315] function updateData(uint256 id,string memory newData) public {

[0316] require(dataItems[id].data ! = "", "Data does not exist");

[0317] dataItems[id].data = newData;

[0318] }

[0319] / / Delete data

[0320] function deletData(unit256 id) public {

[0321] require(dataItems[id].data ! = "", "Data does not exist");

[0322] delete dataItems[id];

[0323] }

[0324] }

[0325] Data search smart contract: Retrieves data based on request parameters forwarded by the central blockchain, and then triggers a data anonymization smart contract. An example of the pseudocode for the data search smart contract is shown below:

[0326] pragma solidity ^0.8.0

[0327] / / Import data processing smart contract

[0328] import ". / DataProcessor.sol";

[0329] / / Data search smart contract

[0330] contract DataSearcher {

[0331] / / A reference to the data processing smart contract

[0332] DataProcessor private dataProcessor;

[0333] / / Constructor

[0334] constructor(address _dataProcessorAddress) {

[0335] dataProcessor = DataProcessor(_dataProcessorAddress);

[0336] }

[0337] / / Retrieve data based on request parameters

[0338] function queryData(string memory requestParams) public view returnsDataItem[] {

[0339] / / Parse request parameters, where parseRequestParams() is the parsing function.

[0340] mapping(string => string) memory conditions = parseRequestParams(requestParams)

[0341] / / Iterate through all the data and filter out those that meet all the conditions, where filterByCondition() is the filtering function.

[0342] DataItem[] memory datas = storeContract.filterByConditions(conditions);

[0343] return datas

[0344] }

[0345] }

[0346] Data anonymization smart contracts: These contracts modify and hide sensitive information (including sensitive information that can be deduced based on certain statistical results) from data. For example, some digits of a phone number might be replaced with asterisks (*), and address and time information in user travel data might be hidden. An example pseudocode for a data anonymization smart contract is shown below:

[0347] pragma solidity ^0.8.0

[0348] / / Define data structure

[0349] struct SensitiveData {

[0350] string phoneNumber; / / Mobile phone number

[0351] string location; / / address

[0352] ... / / Other sensitive information

[0353] }

[0354] / / Data anonymization smart contract

[0355] contract DataAnonymizer {

[0356] / / Use the data ID as the key to map to sensitive data

[0357] mapping(uint256 => SensitiveData) private sensitiveData;

[0358] / / De-identified phone number, where maskPhoneNumber() is a private function used for specific de-identification processing of the phone number.

[0359] function anonymizePhoneNumber(uint256 id) public view returns(stringmemory) {

[0360] require(sensitveData[id].phoneNumber !="","Data does not exist");

[0361] string memory phoneNumber = sensitiveData[id].phoneNumber;

[0362] string memory maskphoneNumber = maskphoneNumber(phoneNumber);

[0363] return maskPhoneNumber;

[0364] }

[0365] / / Hides location information, where hideLocation() is a private function used for specific location hiding processing.

[0366] function hideLocation(unit256 id) public view retruns(string memory){

[0367] require(sensitveData[id].location ! = "", "Data does not exist");

[0368] string memory location = sensitiveData[id].location;

[0369] string memory hiddenLocation = hideLocation(location);

[0370] return hiddenLocation.

[0371] }

[0372] / / Other sensitive information processing

[0373] ···

[0374] }

[0375] In some embodiments, the method of the present invention further includes:

[0376] If the verification result indicates that the verification failed, an error message is generated;

[0377] The error message is sent to the central blockchain.

[0378] Here, the verification result indicates that the verification failed, meaning that the encrypted identification code failed the verification on the dedicated blockchain side. Specifically, the dedicated blockchain verifies the encrypted identification code by calling the certificate management module, and the verification result indicates that it failed. At this time, the dedicated blockchain will forward the error information to the isolation module through the central blockchain. After that, the isolation module will return the error information to the user terminal that initiated the data request.

[0379] like Figure 4 As shown, this embodiment of the invention provides a data access method, which is executed by a certificate management module. Specifically, the method may include:

[0380] Step 401: Respond to the call from the isolation module, decrypt the encrypted authorization certificate, and obtain the decryption result;

[0381] Step 402: Return the decryption result to the isolation module;

[0382] Step 403: Respond to the call from the dedicated blockchain, verify the encrypted identification code, and obtain the verification result;

[0383] Step 404: Return the verification result to the dedicated blockchain.

[0384] The data access method of this invention decrypts the encrypted authorization certificate in response to the call of the isolation module to obtain the decryption result; returns the decryption result to the isolation module; verifies the encrypted identification code in response to the call of the dedicated blockchain to obtain the verification result; and returns the verification result to the dedicated blockchain. By decoupling certificate decryption, certificate verification, and identification code verification, the independence of the authentication of the isolation module, the central blockchain, and the dedicated blockchain is ensured, so that the main modules in the system have a certain degree of anti-attack capability and the security of the system is guaranteed.

[0385] In some embodiments, the method of the present invention further includes:

[0386] Receive the registration request information sent by the isolation module;

[0387] Here, during user registration, authentication is verified through the isolation module. Once the verification is successful, the isolation module calls the certificate generation function of the certificate management module to generate an authorization certificate.

[0388] Based on the registration request information, generate an encrypted authorization certificate;

[0389] The isolation module returns the encrypted authorization certificate to the user client that initiated the registration request.

[0390] As an optional implementation, generating an encrypted authorization certificate based on the registration request information may include:

[0391] 1) Generate an N-bit universally unique identifier (UUID) as the certificate serial number;

[0392] Specifically, the certificate management module calls the randomUUID method of the java.until.UUID library to generate a unique 32-bit hexadecimal UUID, which serves as the certificate serial number.

[0393] 2) Calculate the certificate validity period based on the user registration time in the registration request information;

[0394] Optionally, the certificate is valid for 6 months from the date of user registration. A new certificate must be applied for after the validity period expires.

[0395] 3) Obtain the corresponding permission code based on the data type requested by the user in the registration request information;

[0396] It should be noted that different data types correspond to different dedicated blockchains with different keys and permission codes. There is a correspondence between the keys and permission codes, and they are stored in the certificate management module.

[0397] 4) The identification code, which includes the permission code and the certificate serial number, is sequentially scrambled and encrypted to obtain the encrypted identification code;

[0398] The certificate management module obtains the key corresponding to the access code based on the data type requested by the user. After scrambling the identification code, which includes the access code and the certificate serial number, the encrypted identification code is obtained using the key corresponding to the access code.

[0399] See the structural diagram of the identification code before scrambling. Figure 5 Both the permission code and the sequence code are hexadecimal numbers, totaling 48 bits. The permission code is fixed, with one code corresponding to each permission level (such as the data types a user can access).

[0400] The user-side authorization certificate can contain multiple identification codes. These codes are the primary credentials used by the dedicated blockchain to authenticate user permissions. To enhance the reliability and security of these codes, it is necessary to perform both scrambling and encryption. The specific process is as follows:

[0401] a) Convert the original identification code A into the following 6*8 matrix M;

[0402]

[0403] Where A1 represents the first digit of the identification code, A 48 This represents the 48th digit of the identification code.

[0404] b) Use Arnold's algorithm to scramble matrix M to obtain M new .

[0405]

[0406] c) Matrix M new Converting it into a 48-bit sequence yields the scrambled identification code A. new .

[0407]

[0408] d) Use the corresponding SM2 public key to set A new Encryption is performed to obtain the encrypted identification code.

[0409] 5) Based on the certificate serial number, the certificate validity period, and the encrypted identification code, perform encryption processing to obtain an encrypted authorization certificate.

[0410] The above processing yields certificate attribute information, including the certificate serial number, certificate validity period, and encrypted identification code. Optionally, the certificate serial number, certificate validity period, and encrypted identification code are converted into a JSON string. The specific data structure corresponding to the JSON string is as follows:

[0411] {

[0412] serialNumber: "88ff77ff66ffaabbcc88ff77ff66ffaabbcc"

[0413] endTime: "2025-01-01 00:00:00"

[0414] startTime: "2024-06-30 23:59:59"

[0415] permissionCode:[

[0416] "aaaabbbbcccc1111aaaabbbbcccc1111aaaabbbbcccc1111aaaabbbbcccc1111"

[0417] "aaaabbbbcccc1111aaaabbbbcccc1111aaaabbbbcccc1111aaaabbbbcccc1111"

[0418] ],

[0419] userName: "Test User"

[0420] mac: "11:22:33:44:55:66"

[0421] }

[0422] Where serialNumber is the serial number, endTime is the certificate validity period, startTime is the certificate generation time, permissionCode is the encrypted identification code, userName is the username, and mac is the user's MAC address.

[0423] The certificate management module of this invention saves a copy of the issued certificate file (i.e., the encrypted authorization certificate), and forwards the encrypted authorization certificate to the isolation module. The isolation module then returns the certificate to the user terminal that initiated the registration request, prompting the user to download and install it.

[0424] In some embodiments, step 403 above, verifying the encrypted identification code to obtain a verification result, includes:

[0425] The encrypted identification code is decrypted to obtain the decrypted identification code;

[0426] The decrypted identification code is reverse-scrambled to obtain the authorization code and certificate serial number;

[0427] The permission code is verified to obtain the verification result.

[0428] This embodiment demonstrates that the certificate management module has certificate authentication functionality. Certificate authentication is a crucial means of protecting data security; it verifies a user's identity and permissions, ensuring user control and effectively enhancing system security.

[0429] like Figure 6 As shown, this embodiment of the invention provides a data access system, including: an isolation module 601, a certificate management module 602, a central blockchain 603, and at least one dedicated blockchain 604.

[0430] The isolation module 601 is used to decrypt the encrypted authorization certificate in the first data request by calling the certificate management module 602, and if the decryption is successful and the authorization certificate is within the valid time, obtain the decrypted certificate information; forward the decrypted certificate information and the request parameters in the first data request to the central blockchain; and reject data requests with invalid or no authorization certificates.

[0431] The central blockchain 603 is used to obtain the decrypted certificate information and request parameters forwarded by the isolation module 601. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The request parameters and the encrypted identification code are sent to the dedicated blockchain corresponding to the data classification code. The data classification code is used to characterize the data type of the dedicated blockchain. Different dedicated blockchains 604 have different data classification codes.

[0432] The dedicated blockchain 604 corresponding to the data classification code is used to receive the request parameters and the encrypted identification code sent by the central blockchain 603; to verify the encrypted identification code by calling the certificate management module 602, and to retrieve the target data according to the request parameters if the verification is successful; and to forward the target data to the isolation module 601 through the central blockchain.

[0433] In some embodiments, the system further includes an interface module 605, which is used to initiate a first data request through user operation and send the first data request to the isolation module 601. The first data request includes request parameters and an encrypted authorization certificate.

[0434] In this invention, users can initiate data requests through the interface module. The request first passes through the isolation module and then reaches the central blockchain. The central blockchain forwards the request to the target dedicated blockchain (i.e., the dedicated blockchain corresponding to the data classification code) based on the data classification code. Finally, the target dedicated blockchain retrieves the data and returns it to the user along the original path.

[0435] The certificate management module interacts with the isolation module, the central blockchain, and the dedicated blockchain, and is mainly responsible for functions such as decryption, authentication, and certificate generation.

[0436] Optionally, the isolation module is also used for:

[0437] If the decryption result indicates decryption failure, or if the decryption result indicates decryption success but the authorization certificate is not valid within the time limit, the first data request shall be rejected.

[0438] Optionally, the isolation module is also used for:

[0439] Get the second data request;

[0440] If it is determined that the second data request does not carry an authorization certificate, the second data request is rejected.

[0441] Optionally, the isolation module is also used for:

[0442] Obtain the first data packet, which carries the first data request;

[0443] The step of obtaining the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate by calling the certificate management module includes:

[0444] If the first data packet meets the preset allowed access conditions, the certificate management module is invoked to obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate. The encrypted authorization certificate is carried in the request header of the first data packet.

[0445] Optionally, the isolation module is also used for:

[0446] If the first data packet does not meet the preset allowed access conditions, the first data packet is discarded.

[0447] Optionally, the preset access permission conditions include a first access permission condition and a second access permission condition;

[0448] The first condition for allowing access is that the protocol of the data packet is Hypertext Transfer Security Protocol (HTTPS), and the port is the port corresponding to HTTPS.

[0449] The second allowed access conditions include: the platform value in the request header of the data packet is the system serial number, the size of the data packet is within a preset range, and the media access control MAC address in the request header of the data packet is the same as the MAC address in the authorization certificate.

[0450] Optionally, the isolation module is also used for:

[0451] The error information forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain is obtained, wherein the encrypted identification code fails verification on the dedicated blockchain side;

[0452] The error message is returned to the user client that initiated the data request.

[0453] Optionally, the isolation module is also used for:

[0454] Obtain registration request information;

[0455] Send the registration request information to the certificate management module;

[0456] Receive the encrypted authorization certificate sent by the certificate management module;

[0457] The encrypted authorization certificate is returned to the user client that initiated the registration request.

[0458] The interface module in the data access system of this invention is a client developed using the electron-vue framework, providing users with an entry point for data services. This includes user registration, data classification and querying, data visualization, intelligent Q&A, help documentation and tutorials, system messages, and other user interfaces. In addition to the interface module, all operations in the entire process trigger the central blockchain's log recording contract. Due to the numerous trigger points, they are not described in the individual module processes but are indicated by the symbol (*) in the relevant diagrams of this invention.

[0459] New users will be taken to the registration and authentication interface upon opening the client. Users will fill in company information, legal representative information, purpose of use, and a commitment certificate to initiate the authentication process. If the system approves the application, the user will need to download and install the authorization certificate according to the system message, and then use the full interface functionality. During the certificate's validity period, users can use all interface functions directly without logging in. If the authorization certificate expires, the user will be redirected to the registration and authentication process to reapply for a certificate.

[0460] The main functions of the isolation module include: network defense, user registration and authentication, access authorization, and data forwarding.

[0461] Specifically, for network defense: a Deep Packet Inspection (DPI) system is deployed on the isolation module. The DPI system intercepts and analyzes data packets to obtain information such as the source protocol type, destination port, request headers, and packet size from the request message. It then determines whether the request matches the system's built-in whitelist policy, i.e., preset allowed access conditions (including header feature policies (i.e., the first allowed access condition) and data feature policies (i.e., the second allowed access condition)) to identify and block network security threats such as malware and network attacks. The main process can be found in [link to documentation]. Figure 7 Specifically:

[0462] Step 71: The interface module sends a data request to the isolation module, and the DPI system intercepts the data packet.

[0463] Step 72: The DPI system parses the data packet and determines whether it matches the system's built-in whitelist policy.

[0464] If not, proceed to step 73; if yes, proceed to step 74.

[0465] Specifically, the transport layer of the data packet is parsed to obtain the destination port, and the application layer-specific Secure Sockets Layer / Transport Layer Security (SSL / TLS) handshake characteristics of the data packet are used to determine whether it is Hypertext Transfer Protocol Secure (HTTPS). The above operations yield the protocol and destination port tuple information.

[0466] The header feature strategy includes the protocol of the data packet being Hypertext Transfer Protocol Secure (HTTPS) and the port (443) corresponding to HTTPS.

[0467] If the protocol and destination port in the above two-tuple do not meet the rules, then proceed to step 73; if they do meet the rules, then obtain the HTTPS request header information from the application layer of the data packet and calculate the size of the data packet.

[0468] The request header content and packet size are used as data features to determine whether the system's built-in data feature policy is matched. If not matched, proceed to step 73; if matched, proceed to step 74.

[0469] The process for determining a hit is as follows:

[0470] ①a) The request header should include standard HTTPS request header parameters such as Accept and Accept-Encoding, as well as system-defined request header parameters. If the request header contains the following parameters, proceed to step ②.

[0471] {

[0472] Accept:application / json,text / javascript,* / *;q=0.01

[0473] Accept-Encoding,deflate,br,zstd

[0474] Accept-Language:zh-CN,zh;q=0.9

[0475] Cache-Control: no-cache

[0476] Host: www.xxx.com

[0477] Referrer: https: / / www.xxx.com /

[0478] System:windows

[0479] Platform: System Serial Number

[0480] Mac: 00-12-22-33-44-55

[0481] Certificate: Certificate Content

[0482] ···

[0483] }

[0484] The custom request header Platform value is the system serial number, a string consisting of letters and numbers, built into the DPI system's configuration file and interface module. The MAC value is the MAC address obtained by the user's interface module from the server. The Certificate value is the user's authorization certificate content. If the intercepted request is a user registration request, this field can be empty.

[0485] ② Determine whether the system's built-in data feature policy has been hit, i.e., whether the following three conditions are met. If all three conditions are met, it is determined to be a hit, and step 74 is executed, i.e., continue to perform access authentication; if at least one of the three conditions is not met, it is determined to be a miss, and step 73 is executed, and the data packet is discarded.

[0486] 1. The value of the Platform header should be consistent with the built-in system serial number.

[0487] 2. Calculate the size S of the data packet. Since the requests from the interface module only contain certificates and request parameters in addition to the regular content, S in this system should satisfy the following formula, and the unit is bytes.

[0488] 100 < S < 100 × 1024

[0489] 3. The MAC address value in the request header should be verified by the certificate management module and must be the same as the MAC address in a copy of an authorized certificate in the certificate management module.

[0490] Step 73: Discard the data packet.

[0491] Step 74: Perform access authentication.

[0492] For user registration and authentication: Before using this system, users need to provide their personal real-name information or enterprise qualification information for registration and authentication. This authentication information will be submitted by the isolation module to the corresponding administrator's email address for manual review, based on the classification level (i.e., data type) of the requested access data. After review, the isolation module will provide feedback to the user through the interface module and prompt the user to download and install the authorization certificate. For a detailed user registration and authentication flowchart, please refer to [link / reference needed]. Figure 8 .

[0493] Step 81: Fill in the authentication information through the interface module; the authentication information includes basic information (such as personal real-name information or enterprise qualification information) and authentication level (such as the classification level of the data to be accessed).

[0494] Step 82, analyze the certification level.

[0495] Step 83: Send the authentication information to the corresponding administrator (such as general data administrator, important data administrator, core data administrator) for review.

[0496] Step 84: Determine if the pass / fail condition is met;

[0497] If yes, proceed to step 85; otherwise, proceed to step 87.

[0498] Step 85: Notify the isolation module to approve the application.

[0499] Step 86: The certificate management module generates an authorization certificate.

[0500] Step 87: Feedback is sent to the client that initiated the request.

[0501] Regarding access authentication: The access authentication function of the isolation module effectively filters unauthorized access from the external network, reducing system load and improving system security. For a detailed user access authentication flowchart, please refer to [link / reference needed]. Figure 9 .

[0502] Step 91: Obtain the encrypted authorization certificate and request parameters;

[0503] Step 92: The certificate management module decrypts the encrypted authorization certificate.

[0504] Step 93: Determine if decryption was successful;

[0505] If yes, proceed to step 94; otherwise, proceed to step 95.

[0506] Step 94: Return the decrypted authorization certificate content;

[0507] Step 95, Request denied;

[0508] Step 96: Notify the user;

[0509] Step 97: Forward the decrypted authorization certificate content and request parameters to the central blockchain.

[0510] The isolation module obtains the encrypted authorization certificate and request parameters carried by the user, and then calls the certificate management module to decrypt the encrypted authorization certificate. If the certificate decryption fails, the request will be rejected and the interface module will be notified to display an error message; if the certificate decryption is successful, the decrypted certificate content and request parameters will be forwarded to the central blockchain for processing.

[0511] Regarding data forwarding: Since the isolation module plays a role in network isolation in the system, all user-permitted requests, data returned by the central blockchain and certificate management module will be forwarded through the isolation module.

[0512] The certificate management module in this invention system is used for:

[0513] In response to the call from the isolation module, the encrypted authorization certificate is decrypted to obtain the decryption result;

[0514] The decryption result is returned to the isolation module;

[0515] In response to calls from the dedicated blockchain, the encrypted identification code is verified, and the verification result is obtained.

[0516] The verification result is returned to the dedicated blockchain.

[0517] Optionally, the certificate management module is also used for:

[0518] The encrypted identification code is decrypted to obtain the decrypted identification code;

[0519] The decrypted identification code is reverse-scrambled to obtain the authorization code and certificate serial number;

[0520] The permission code is verified to obtain the verification result.

[0521] Optionally, the certificate management module is also used for:

[0522] Receive the registration request information sent by the isolation module;

[0523] Based on the registration request information, generate an encrypted authorization certificate;

[0524] The isolation module returns the encrypted authorization certificate to the user client that initiated the registration request.

[0525] Optionally, the certificate management module is also used for:

[0526] Generate an N-bit universally unique identifier (UUID) as the certificate serial number;

[0527] The certificate validity period is calculated based on the user registration time in the registration request information;

[0528] Based on the data type requested by the user in the registration request information, obtain the corresponding permission code;

[0529] The identification code, which includes the permission code and the certificate serial number, is sequentially scrambled and encrypted to obtain the encrypted identification code.

[0530] Based on the certificate serial number, the certificate validity period, and the encrypted identification code, encryption processing is performed to obtain an encrypted authorization certificate.

[0531] The certificate management module in this invention is an improved distributed certificate management module. By decoupling the certificate decryption, certificate verification, and identification code verification processes, it ensures the independence of the authentication of the isolation module, the central blockchain, and the dedicated blockchain, enabling the main modules within the system to have a certain degree of resistance to attacks and ensuring the security of the entire system.

[0532] The certificate management module interacts with the isolation module, the central blockchain, and the dedicated blockchain. Its main functions include certificate generation, certificate authentication, and certificate revocation. The certificate module also has storage capabilities, storing copies of issued certificate files, SM2 key pairs used for certificate encryption and decryption, SM2 key pairs for each level (corresponding to different data types), and permission codes of dedicated blockchains.

[0533] Regarding certificate generation: During user registration, authentication is verified through the isolation module. Once verified, the isolation module calls the certificate generation function of the certificate management module to generate an encrypted authorization certificate. A diagram illustrating the certificate generation process can be found here. Figure 10 .

[0534] Step 1001: Send the user registration information to the isolation module through the interface module.

[0535] Step 1002: The isolation module performs authentication review. If the review is successful, the certificate generation function of the certificate management module is called to generate a serial number, certificate validity period, and encrypted identification code.

[0536] Step 1003: Encrypt the serial number, certificate validity period, and encrypted identification code to obtain an encrypted authorization certificate.

[0537] Step 1004: Write the encrypted authorization certificate to the server.

[0538] Step 1005: Return the encrypted authorization certificate to the client that initiated the request.

[0539] Regarding certificate authentication: Certificate authentication is a crucial means of data security protection. It verifies a user's identity and permissions, ensuring user control and effectively enhancing system security. When a user initiates an access request, the client (user) places the user's authorized certificate in the "Certificate" header and the request parameters in the request body. A diagram illustrating the certificate authentication generation process can be found here. Figure 11 .

[0540] Step 1101: Registered users send data requests to the isolation module through the interface module;

[0541] Step 1102: The isolation module intercepts the data request, obtains the encrypted authorization certificate in the request header, the classification code and other parameters in the request body; and calls the certificate authentication function of the certificate management module.

[0542] Step 1103: The certificate management module uses its own SM2 private key to decrypt the encrypted authorization certificate and obtain the certificate attribute information.

[0543] The certificate attribute information includes the certificate serial number, certificate validity period, and encrypted identification code.

[0544] Step 1104: Determine if decryption was successful;

[0545] If yes, proceed to step 1105; otherwise, end.

[0546] Step 1105: Forward the decrypted authorization certificate and request parameters to the central blockchain.

[0547] It should be noted that after successful decryption, the certificate management module will inform the isolation module that the authorization certificate is valid.

[0548] Step 1106: Trigger the trust management smart contract;

[0549] Step 1107: Determine whether the contract verification has passed;

[0550] If yes, proceed to step 1108; otherwise, end. Specifically, if contract verification fails, the process terminates and returns an error message to the client that initiated the request.

[0551] Step 1108: Trigger the request proxy smart contract to locate the target dedicated blockchain based on the classification code in the request parameters;

[0552] Step 1109: Call the certificate management module to decrypt the encrypted identification code.

[0553] Here, the target dedicated blockchain calls the certificate management module and uses its SM2 private key stored in the certificate management module to decrypt the encrypted identification code. After that, the decrypted identification code is processed by the inverse Arnold algorithm to obtain a 16-bit permission code and a 32-bit certificate serial number.

[0554] Step 1110: Determine whether the permission code matches the permission code corresponding to the target dedicated blockchain.

[0555] If yes, proceed to step 1111; otherwise, end.

[0556] Step 1111: Perform data retrieval and return the target data.

[0557] Regarding certificate revocation: When a user initiates a revocation request, or when a certificate expires, the certificate revocation function in the certificate module will be triggered through the isolation module. This function will delete the corresponding certificate copy on the certificate module.

[0558] Optionally, the central blockchain is also used to receive target data sent by the dedicated blockchain corresponding to the data classification code, and forward the target data to the isolation module, wherein the encrypted identification code is verified on the dedicated blockchain side, and the target data is data corresponding to the request parameters.

[0559] Optionally, the centralized blockchain is also used for:

[0560] The data classification code in the request parameters and the encrypted identification code in the decrypted certificate information are extracted through the first smart contract.

[0561] The request parameters and the encrypted identification code are forwarded to the dedicated blockchain corresponding to the data classification code via a second smart contract.

[0562] Optionally, the centralized blockchain is also used for:

[0563] The system receives error information sent by the dedicated blockchain corresponding to the data classification code and forwards the error information to the isolation module, wherein the encrypted identification code fails verification on the dedicated blockchain side.

[0564] Optionally, a dedicated blockchain can also be used for:

[0565] If the verification result indicates that the verification failed, an error message is generated;

[0566] The error message is sent to the central blockchain.

[0567] The number of dedicated blockchains in this invention can be dynamically adjusted as needed, enhancing system scalability. A system flowchart of this invention can be found [here]. Figure 12 .

[0568] like Figure 13 As shown, this embodiment of the invention also provides a data access device applied to an isolation module, the device including:

[0569] The first acquisition unit 1301 is used to acquire a first data request, the first data request including request parameters and an encrypted authorization certificate;

[0570] The second acquisition unit 1302 is used to obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate by calling the certificate management module;

[0571] The first processing unit 1303 is configured to, when the decryption result indicates successful decryption and the authorization certificate is within the valid time, obtain the decrypted certificate information; and forward the decrypted certificate information and the request parameters to the central blockchain, wherein the decrypted certificate information includes an encrypted identification code, the request parameters include a data classification code, the data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains correspond to different data classification codes;

[0572] The third acquisition unit 1304 is used to acquire the target data forwarded by the central blockchain through the dedicated blockchain corresponding to the data classification code, wherein the encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

[0573] Optionally, the device further includes:

[0574] The second processing unit is configured to reject the first data request if the decryption result indicates decryption failure, or if the decryption result indicates decryption success but the authorization certificate is not valid within the time limit.

[0575] Optionally, the device further includes:

[0576] The fourth acquisition unit is used to acquire the second data request;

[0577] The third processing unit is configured to reject the second data request if it is determined that the second data request does not carry an authorization certificate.

[0578] Optionally, the first acquisition unit 1301 is specifically used for:

[0579] Obtain the first data packet, which carries the first data request;

[0580] If the first data packet meets the preset allowed access conditions, the certificate management module is invoked to obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate. The encrypted authorization certificate is carried in the request header of the first data packet.

[0581] Optionally, the device further includes:

[0582] The fourth processing unit is used to discard the first data packet if the first data packet does not meet the preset allowed access conditions.

[0583] Optionally, the preset access permission conditions include a first access permission condition and a second access permission condition;

[0584] The first condition for allowing access is that the protocol of the data packet is Hypertext Transfer Security Protocol (HTTPS), and the port is the port corresponding to HTTPS.

[0585] The second allowed access conditions include: the platform value in the request header of the data packet is the system serial number, the size of the data packet is within a preset range, and the media access control MAC address in the request header of the data packet is the same as the MAC address in the authorization certificate.

[0586] Optionally, the device further includes:

[0587] The fifth acquisition unit is used to acquire error information forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain, wherein the encrypted identification code fails verification on the dedicated blockchain side;

[0588] The fifth processing unit is used to return the error information to the user terminal that initiated the data request.

[0589] Optionally, the device further includes:

[0590] The sixth acquisition unit is used to acquire registration request information;

[0591] The first sending unit is used to send the registration request information to the certificate management module;

[0592] The first receiving unit is used to receive the encrypted authorization certificate sent by the certificate management module;

[0593] The sixth processing unit is used to return the encrypted authorization certificate to the user terminal that initiated the registration request.

[0594] The data access device of this invention obtains a first data request, which includes request parameters and an encrypted authorization certificate; it calls a certificate management module to obtain a decryption result returned by the certificate management module after decrypting the encrypted authorization certificate; if the decryption result indicates successful decryption and the authorization certificate is within its validity period, it obtains the decrypted certificate information; and it forwards the decrypted certificate information and request parameters to a central blockchain. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code, which characterizes the data type of a dedicated blockchain; different dedicated blockchains have different data classification codes. It then obtains the target data forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain. The encrypted identification code is verified on the dedicated blockchain side, and the target data corresponds to the request parameters. Thus, through the cooperation of the isolation module and the certificate management module, only authorized and valid data access is accepted, effectively preventing unauthorized and malicious access and improving system security. Furthermore, the data-classified blockchain structure significantly reduces blockchain storage pressure and improves data query efficiency.

[0595] like Figure 14 As shown, this embodiment of the invention also provides a data access device applied to a central blockchain, comprising:

[0596] The seventh acquisition unit 1401 is used to acquire the decrypted certificate information and request parameters forwarded by the isolation module, wherein the decrypted certificate information includes an encrypted identification code and the request parameters include a data classification code;

[0597] The second sending unit 1402 is used to send the request parameters and the encrypted identification code to the dedicated blockchain corresponding to the data classification code, wherein the data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes.

[0598] The second receiving unit 1403 is used to receive target data sent by the dedicated blockchain corresponding to the data classification code, and forward the target data to the isolation module, wherein the encrypted identification code is verified on the dedicated blockchain side, and the target data is data corresponding to the request parameters.

[0599] Optionally, the device further includes:

[0600] The seventh processing unit is used to extract the data classification code from the request parameters and the encrypted identification code from the decrypted certificate information through the first smart contract.

[0601] The second sending unit is specifically used to forward the request parameters and the encrypted identification code to the dedicated blockchain corresponding to the data classification code through the second smart contract.

[0602] Optionally, the device further includes:

[0603] The third receiving unit is used to receive error information sent by the dedicated blockchain corresponding to the data classification code, and forward the error information to the isolation module, wherein the encrypted identification code fails the verification on the dedicated blockchain side.

[0604] The data access device of this invention obtains decrypted certificate information and request parameters forwarded by an isolation module. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. Then, the request parameters and the encrypted identification code are sent to a dedicated blockchain corresponding to the data classification code. The data classification code characterizes the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes. Finally, the device receives target data sent by the dedicated blockchain corresponding to the data classification code and forwards the target data to the isolation module. The encrypted identification code is verified on the dedicated blockchain side, and the target data corresponds to the request parameters. Thus, through a data-classified blockchain structure, the storage pressure on the blockchain can be significantly reduced, and data query efficiency can be improved.

[0605] like Figure 15 As shown, this embodiment of the invention also provides a data access device applied to a dedicated blockchain, which may include:

[0606] The fourth receiving unit 1501 is used to receive request parameters and encrypted identification codes sent by the central blockchain; the dedicated blockchain corresponds to the data classification code in the request parameters.

[0607] The eighth acquisition unit 1502 is used to obtain the verification result returned by the certificate management module after verifying the encrypted identification code by calling the certificate management module;

[0608] The eighth processing unit 1503 is used to retrieve the target data according to the request parameters when the verification result indicates that the verification has passed.

[0609] The ninth processing unit 1504 is used to forward the target data to the isolation module through the central blockchain.

[0610] Optionally, the device further includes:

[0611] The tenth processing unit is used to generate error information when the verification result indicates that the verification has failed.

[0612] The third sending unit is used to send the error information to the central blockchain.

[0613] The data access device of this invention receives request parameters and an encrypted identification code sent by a central blockchain; the dedicated blockchain corresponds to the data classification code in the request parameters; if the verification result indicates that the verification is passed, data retrieval is performed according to the request parameters to obtain the target data; finally, the target data is forwarded to the isolation module through the central blockchain. In this way, the blockchain structure with data classification can significantly reduce the blockchain storage pressure and improve data query efficiency.

[0614] like Figure 16 As shown, this embodiment of the invention also provides a data access device applied to a certificate management module. The device 1600 may include:

[0615] The decryption unit 1601 is used to respond to the call of the isolation module, decrypt the encrypted authorization certificate, and obtain the decryption result;

[0616] The fourth sending unit 1602 is used to return the decryption result to the isolation module;

[0617] Verification unit 1603 is used to respond to calls from the dedicated blockchain, verify the encrypted identification code, and obtain the verification result;

[0618] The fifth sending unit 1604 is used to return the verification result to the dedicated blockchain.

[0619] Optionally, the verification unit 1603 is specifically used for:

[0620] The encrypted identification code is decrypted to obtain the decrypted identification code;

[0621] The decrypted identification code is reverse-scrambled to obtain the authorization code and certificate serial number;

[0622] The permission code is verified to obtain the verification result.

[0623] Optionally, the device further includes:

[0624] The fifth receiving unit is used to receive the registration request information sent by the isolation module;

[0625] The certificate generation unit is used to generate an encrypted authorization certificate based on the registration request information;

[0626] The sixth sending unit is used to return the encrypted authorization certificate to the user terminal that initiated the registration request through the isolation module.

[0627] Optionally, the certificate generation unit is specifically used for:

[0628] Generate an N-bit universally unique identifier (UUID) as the certificate serial number;

[0629] The certificate validity period is calculated based on the user registration time in the registration request information;

[0630] Based on the data type requested by the user in the registration request information, obtain the corresponding permission code;

[0631] The identification code, which includes the permission code and the certificate serial number, is sequentially scrambled and encrypted to obtain the encrypted identification code.

[0632] Based on the certificate serial number, the certificate validity period, and the encrypted identification code, encryption processing is performed to obtain an encrypted authorization certificate.

[0633] The data access device of this invention, in response to a call from the isolation module, decrypts the encrypted authorization certificate to obtain a decryption result; returns the decryption result to the isolation module; in response to a call from the dedicated blockchain, verifies the encrypted identification code to obtain a verification result; and returns the verification result to the dedicated blockchain. By decoupling certificate decryption, certificate verification, and identification code verification, the independence of the authentication of the isolation module, the central blockchain, and the dedicated blockchain is ensured, giving the main modules within the system a certain degree of resistance to attacks and ensuring the security of the system.

[0634] This invention also provides a data access device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the above-described functionality. Figure 1 , Figure 2 , Figure 3 or Figure 4 The various processes in the data access method embodiments described herein achieve the same technical effect, and will not be repeated here to avoid repetition.

[0635] This invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described functions. Figure 1 , Figure 2 , Figure 3 or Figure 4 The various processes in the method embodiments achieve the same technical effect, and to avoid repetition, they will not be described again here. The computer-readable storage medium mentioned includes, for example, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0636] This invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the functions described above. Figure 1 , Figure 2 , Figure 3 or Figure 4 The various processes in the method embodiments can achieve the same technical effect, and will not be described again here to avoid repetition.

[0637] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0638] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 A device for one or more processes and / or the functions specified in one or more boxes.

[0639] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce a paper article including an instruction means, the instruction means being implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0640] These computer program instructions can also be loaded onto a computer or other programmable data processing equipment, causing the computer or other programmable equipment to perform a series of operational steps to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0641] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data access method, characterized in that, Executed by the isolation module, the method includes: Obtain a first data request, the first data request including request parameters and an encrypted authorization certificate; By calling the certificate management module, the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate is obtained; If the decryption result indicates successful decryption and the authorized certificate is within its validity period, the decrypted certificate information is obtained; and the decrypted certificate information and the request parameters are forwarded to the central blockchain. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes. The target data is forwarded by the central blockchain through the dedicated blockchain corresponding to the data classification code, wherein the encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

2. The method according to claim 1, characterized in that, The method further includes: If the decryption result indicates decryption failure, or if the decryption result indicates decryption success but the authorization certificate is not valid within the time limit, the first data request shall be rejected.

3. The method according to claim 1, characterized in that, The method further includes: Get the second data request; If it is determined that the second data request does not carry an authorization certificate, the second data request is rejected.

4. The method according to claim 1, characterized in that, The request to obtain the first data includes: Obtain the first data packet, which carries the first data request; The step of obtaining the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate by calling the certificate management module includes: If the first data packet meets the preset allowed access conditions, the certificate management module is invoked to obtain the decryption result returned by the certificate management module after decrypting the encrypted authorization certificate. The encrypted authorization certificate is carried in the request header of the first data packet.

5. The method according to claim 4, characterized in that, The method further includes: If the first data packet does not meet the preset allowed access conditions, the first data packet is discarded.

6. The method according to claim 4 or 5, characterized in that, The preset access permission conditions include a first access permission condition and a second access permission condition; The first condition for allowing access is that the protocol of the data packet is Hypertext Transfer Security Protocol (HTTPS), and the port is the port corresponding to HTTPS. The second allowed access conditions include: the platform value in the request header of the data packet is the system serial number, the size of the data packet is within a preset range, and the media access control MAC address in the request header of the data packet is the same as the MAC address in the authorization certificate.

7. The method according to claim 1, characterized in that, The method further includes: The error information forwarded by the dedicated blockchain corresponding to the data classification code through the central blockchain is obtained, wherein the encrypted identification code fails verification on the dedicated blockchain side; The error message is returned to the user client that initiated the data request.

8. The method according to claim 1, characterized in that, The method further includes: Obtain registration request information; Send the registration request information to the certificate management module; Receive the encrypted authorization certificate sent by the certificate management module; The encrypted authorization certificate is returned to the user client that initiated the registration request.

9. A data access method, characterized in that, The method, executed by a central blockchain, includes: Obtain the decrypted certificate information and request parameters forwarded by the isolation module, wherein the decrypted certificate information includes an encrypted identification code and the request parameters include a data classification code; The request parameters and the encrypted identification code are sent to the dedicated blockchain corresponding to the data classification code, wherein the data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes. The system receives target data sent by the dedicated blockchain corresponding to the data classification code and forwards the target data to the isolation module. The encrypted identification code is verified on the dedicated blockchain side, and the target data is the data corresponding to the request parameters.

10. The method according to claim 9, characterized in that, The method further includes: The data classification code in the request parameters and the encrypted identification code in the decrypted certificate information are extracted through the first smart contract. Sending the request parameters and the encrypted identification code to the dedicated blockchain corresponding to the data classification code includes: The request parameters and the encrypted identification code are forwarded to the dedicated blockchain corresponding to the data classification code via a second smart contract.

11. The method according to claim 9, characterized in that, The method further includes: The system receives error information sent by the dedicated blockchain corresponding to the data classification code and forwards the error information to the isolation module, wherein the encrypted identification code fails verification on the dedicated blockchain side.

12. A data access method, characterized in that, The method, executed by a dedicated blockchain, includes: The receiving center blockchain sends request parameters and an encrypted identification code; the dedicated blockchain corresponds to the data classification code in the request parameters. By calling the certificate management module, the verification result returned by the certificate management module after verifying the encrypted identification code is obtained; If the verification result indicates that the verification has passed, data retrieval is performed based on the request parameters to obtain the target data. The target data is forwarded to the isolation module via the central blockchain.

13. The method according to claim 12, characterized in that, The method further includes: If the verification result indicates that the verification failed, an error message is generated; The error message is sent to the central blockchain.

14. A data access method, characterized in that, The method, executed by the certificate management module, further includes: In response to the call from the isolation module, the encrypted authorization certificate is decrypted to obtain the decryption result; The decryption result is returned to the isolation module; In response to calls from the dedicated blockchain, the encrypted identification code is verified, and the verification result is obtained. The verification result is returned to the dedicated blockchain.

15. The method according to claim 14, characterized in that, The verification of the encrypted identification code to obtain the verification result includes: The encrypted identification code is decrypted to obtain the decrypted identification code; The decrypted identification code is reverse-scrambled to obtain the authorization code and certificate serial number; The permission code is verified to obtain the verification result.

16. The method according to claim 14, characterized in that, The method further includes: Receive the registration request information sent by the isolation module; Based on the registration request information, generate an encrypted authorization certificate; The isolation module returns the encrypted authorization certificate to the user client that initiated the registration request.

17. The method according to claim 16, characterized in that, The step of generating an encrypted authorization certificate based on the registration request information includes: Generate an N-bit universally unique identifier (UUID) as the certificate serial number; The certificate validity period is calculated based on the user registration time in the registration request information; Based on the data type requested by the user in the registration request information, obtain the corresponding permission code; The identification code, which includes the permission code and the certificate serial number, is sequentially scrambled and encrypted to obtain the encrypted identification code. Based on the certificate serial number, the certificate validity period, and the encrypted identification code, encryption processing is performed to obtain an encrypted authorization certificate.

18. A data access system, characterized in that, include: The system includes an isolation module, a certificate management module, a central blockchain, and at least one dedicated blockchain. The isolation module is used to decrypt the encrypted authorization certificate in the first data request by calling the certificate management module, and to obtain the decrypted certificate information if the decryption is successful and the authorization certificate is within the valid time. Forward the decrypted certificate information and the request parameters in the first data request to the central blockchain; reject data requests with invalid or no authorization certificates. The central blockchain is used to obtain the decrypted certificate information and request parameters forwarded by the isolation module. The decrypted certificate information includes an encrypted identification code, and the request parameters include a data classification code. The request parameters and the encrypted identification code are sent to the dedicated blockchain corresponding to the data classification code. The data classification code is used to characterize the data type of the dedicated blockchain, and different dedicated blockchains have different data classification codes. The dedicated blockchain corresponding to the data classification code is used to receive the request parameters and the encrypted identification code sent by the central blockchain; to verify the encrypted identification code by calling the certificate management module, and if the verification is successful, to retrieve the target data according to the request parameters; and to forward the target data to the isolation module through the central blockchain.

19. The data access system according to claim 18, characterized in that, The system also includes an interface module, which is used to initiate a first data request through user operation and send the first data request to the isolation module. The first data request includes request parameters and an encrypted authorization certificate.

20. A data access device, comprising a memory, a processor, and a computer program stored in the memory and running thereon, characterized in that, When the processor executes the program, it implements the data access method as described in any one of claims 1 to 8, or the data access method as described in any one of claims 9 to 11, or the data access method as described in claim 12 or 13, or the data access method as described in any one of claims 14 to 17.

21. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the data access method as described in any one of claims 1 to 8, or the steps of the data access method as described in any one of claims 9 to 11, or the steps of the data access method as described in claims 12 or 13, or the steps of the data access method as described in any one of claims 14 to 17.

22. A computer program product, characterized in that, The method includes computer instructions that, when executed by a processor, implement the steps of the data access method as described in any one of claims 1 to 8, or the steps of the data access method as described in any one of claims 9 to 11, or the steps of the data access method as described in claims 12 or 13, or the steps of the data access method as described in any one of claims 14 to 17.

Images