A government affair data management method and device

Abstract

The application provides a government affair data management method and device, and relates to the technical field of Internet of Things. The method is used for a consortium chain network, the consortium chain network includes a root node representing a public security system, a center node representing a government affair system, and a regional node representing a regional system; the method includes: the root node encrypts government affair data based on a first key generated by itself and a second key of the center node, and sends the government affair ciphertext data to the center node after obtaining the government affair ciphertext data; the center node initiates a calculation task, and broadcasts a subtask and corresponding government affair ciphertext data to the regional node; the regional node responds to the subtask, and performs calculation based on the government affair ciphertext data and / or regional local data stored by the regional node, and returns the center node after obtaining a calculation ciphertext result; and the center node decrypts the calculation ciphertext result based on a third key and a fourth key, and obtains a calculation result about the calculation task. The application improves the security of cross-system data interaction.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a method and apparatus for managing government data. Background Technology

[0002] Currently, in the process of digital transformation of urban governance, massive, multi-source, and cross-domain government data is gradually becoming a core element in promoting the modernization of social governance. However, in the actual process of data collaboration and sharing, grassroots units still face many challenges, such as inconsistent standards, network isolation, security risks, and business segmentation, which seriously restrict the release of the value of government data and the coordinated improvement of governance capabilities. Especially in the context of cross-level, cross-regional, and cross-departmental data flow, the phenomena of scattered data sources, fragmented processes, and unclear responsibilities are common, resulting in low efficiency of grassroots governance, insufficient data freshness, and delayed problem discovery and response.

[0003] Specifically, grassroots governance involves multiple network environments such as government networks, public security networks, and the Internet, with frequent cross-network data interaction. However, there is currently a lack of secure and reliable cross-network communication mechanisms, which poses risks such as sensitive data leakage and unauthorized access, making it difficult to meet data security compliance requirements and seriously affecting cross-departmental collaboration and efficient data flow. Summary of the Invention

[0004] To address the aforementioned problems in the prior art, this invention provides a method and apparatus for managing government data, which improves the security of cross-system data interaction.

[0005] Firstly, this application provides a method for managing government data in a consortium blockchain network, the consortium blockchain network including a root node representing a public security system, a central node representing a government system, and regional nodes representing regional systems; the method includes:

[0006] The root node encrypts the government data to be transmitted based on its own first key and the second key from the central node, and then sends the encrypted government data to the central node.

[0007] The central node initiates a computing task and broadcasts the sub-tasks and corresponding encrypted government data, which are split from the computing task, to the corresponding regional nodes.

[0008] The regional node responds to the subtask by performing calculations based on the received government encrypted data and / or its stored local regional data, and returns the encrypted calculation result to the central node.

[0009] The central node decrypts the received computation ciphertext result based on the third key corresponding to the second key and the fourth key from the root node, to obtain the computation result for the computation task.

[0010] In one possible implementation, the consortium blockchain network is constructed through the following steps:

[0011] When the public security system receives an authentication request from any government affairs system, it verifies the legitimacy of the authentication request, wherein the authentication request includes the government affairs system's identification data, identity credentials, and authentication request timestamp.

[0012] After successful authentication, the public security system authorizes the authentication credential to the government affairs system and establishes the first trust chain between the public security system and the government affairs system.

[0013] The regional system downloads the authentication credential from any government system and establishes a second trust chain between the regional system and the government system based on the authentication credential, thereby constructing a consortium blockchain network from the first trust chain and the second trust chain.

[0014] In one possible implementation, the first key includes a first private key and a second private key; the root node encrypts the government data to be transmitted based on its own generated first key and the second key from the central node, and then sends the encrypted government data to the central node, including:

[0015] The root node obtains the government data to be transmitted and the corresponding data structure metadata.

[0016] The root node uses its stored first private key to encrypt the government data, resulting in encrypted data;

[0017] The root node uses its stored second private key to sign the first concatenated data composed of the encrypted data and the data structure metadata to obtain government signature data.

[0018] The root node uses a second key from the central node to encapsulate a second concatenated data consisting of the encrypted data, the data structure metadata, and the government signature data, to obtain government encrypted data.

[0019] In one possible implementation, the fourth key includes a first public key corresponding to the second private key; the central node initiates a computation task and broadcasts the sub-tasks split from the computation task and the corresponding encrypted government data to the corresponding regional nodes, including:

[0020] The central node receives the encrypted government data.

[0021] The central node decrypts the government encrypted data based on the third key corresponding to the second key to obtain decrypted data;

[0022] The central node decrypts the government signature data in the decrypted data using the first public key from the root node to obtain the data to be verified.

[0023] The central node compares the data to be verified with the concatenation result of the encrypted data and the data structure metadata in the decrypted data, and stores the received government encrypted data when they match.

[0024] In one possible implementation, the method further includes:

[0025] The central node acquires behavior records of at least one data retrieval event that occurs within a specified time period. The data retrieval event is used to indicate an event in which data stored by the central node is retrieved by the regional node. The behavior record is used to indicate the regional node identifier of the retrieving regional node, the central node identifier of the retrieving central node, the event occurrence timestamp of the data retrieval event, the summary result, the data purpose of the data retrieval event, and the single event weight. The summary result is obtained by hashing the retrieved government encrypted data.

[0026] The central node determines the settlement result of the regional node based on the single event weight, data complexity, and the number of times it is called within a specified period for any regional node in any data call event.

[0027] The central node adds the settlement vouchers, settlement results, and behavior records of the regional nodes to the audit blockchain, wherein the settlement vouchers are determined by the regional node identifier and the specified period of the regional node.

[0028] In one possible implementation, the method further includes:

[0029] When the root node obtains the government data, or the central node stores the government encrypted data, corresponding data source information, data resource information, and data status information are generated. The data source information includes a data identifier, data source node, data version information, data structure information, data generation timestamp, and data update timestamp. The data resource information includes data resource category, classification level, data structure description information, and access control permission information. The data status information includes the data lifecycle status at any given time, the data validity period expiration time, and data change information.

[0030] Based on the data source information, the data resource information, and the data status information, data association relationships are determined, wherein the data association relationships include a first association relationship between the government data, a second association relationship between the government encrypted data, and a third association relationship between the government data and the government encrypted data;

[0031] Based on the data association relationship, a data association graph is constructed, wherein a node in the data association graph represents the government data or the government encrypted data, and an edge in the data association graph represents the data association relationship between two connected nodes.

[0032] In one possible implementation, constructing the data association graph based on the data association relationships includes:

[0033] When the regional node receives encrypted government data sent by the central node, the regional node determines the path fingerprint of the received encrypted government data based on the data association graph.

[0034] The regional node generates and stores the data registration information of the received government encrypted data based on the data source information and the path fingerprint of the government encrypted data.

[0035] In one possible implementation, constructing the data association graph based on the data association relationship further includes:

[0036] When a change is detected in the government data obtained by the root node or the government encrypted data stored by the central node, change information is generated, the corresponding government data or government encrypted data is updated, and broadcast to the corresponding central node or regional node. The change information includes the data change type, the changed fields, and the execution time after the data change.

[0037] When the regional node receives the change information, it updates the data registration information of the corresponding government encrypted data according to the change information, and determines the impact of the data update on downstream data according to the data association diagram.

[0038] When it is determined that the influence exceeds the preset influence threshold, the downstream data is recalculated based on the data association graph.

[0039] In one possible implementation, the government data is obtained through the following steps:

[0040] The root node establishes an address database, which includes province information, city information, district / county information, street information, community information, house number information, building information, unit information, town information, village information, grid information, and microgrid information;

[0041] The root node obtains the corresponding government data based on the address database.

[0042] Secondly, this application provides a government data management device for a consortium blockchain network, the consortium blockchain network including a root node representing a public security system, a central node representing a government system, and regional nodes representing regional systems; the device includes:

[0043] An encryption module is used by the root node to encrypt the government data to be transmitted based on a first key generated by itself and a second key from the central node, and then send the encrypted government data to the central node.

[0044] The task module is used by the central node to initiate computing tasks and broadcast the sub-tasks and corresponding encrypted government data that are split from the computing tasks to the corresponding regional nodes.

[0045] The calculation module is used by the regional node to respond to the subtask, perform calculations based on the received government encrypted data and / or its stored regional local data, and return the calculated encrypted result to the central node.

[0046] The decryption module is used by the central node to decrypt the received ciphertext result based on the third key corresponding to the second key and the fourth key from the root node, so as to obtain the calculation result of the calculation task.

[0047] The government data management method and apparatus provided in this application improve the security of data transmission and interaction by configuring the public security system, government system, and regional system into a consortium blockchain network. Based on this consortium blockchain network, the root node encrypts the government data to be transmitted using its own generated first key and a second key from the central node, and then sends the encrypted government data to the central node, ensuring the confidentiality of the public security system data. Subsequently, the regional nodes respond to the sub-tasks issued by the central node, perform calculations based on the received encrypted government data and / or the regional local data they store, and return the encrypted calculation results to the central node. The central node aggregates and decrypts the encrypted calculation results, ensuring that the original data is always kept at the root node or regional nodes, and only the encrypted intermediate results are shared, avoiding data leakage, meeting the privacy protection requirements in a cross-system environment, and satisfying the compliance of cross-system transmission, thereby improving the security of cross-system data interaction. Attached Figure Description

[0048] Figure 1 A flowchart illustrating a method for managing government data provided in an embodiment of this application;

[0049] Figure 2 Architecture diagram of public security system, government affairs system and regional system provided in the embodiments of this application;

[0050] Figure 3 This is a schematic diagram of the structure of a government data management device provided in an embodiment of this application. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] Figure 1 This is a flowchart illustrating a method for managing government data provided in an embodiment of this application. The method is used in a consortium blockchain network, which includes a root node representing a public security system, a central node representing a government system, and regional nodes representing regional systems. The method includes steps S101 to S104.

[0053] S101. The root node encrypts the government data to be transmitted based on its own first key and the second key from the central node, and then sends the encrypted government data to the central node.

[0054] It should be noted that Figure 2 This is an architecture diagram of a public security system, a government affairs system, and a regional system provided in this application embodiment. The public security system 21 is connected to the government affairs system 22, and the government affairs system 22 is connected to the regional system 23. The public security system stores and can access highly sensitive data, such as user privacy information, population information, and case records. The government affairs system coordinates regional nodes and initiates computational tasks (such as regional data analysis and user security analysis). The regional system can be the government affairs system of a district / county government or a subdistrict office; this regional system stores local data specific to its region.

[0055] In this application, when the public security system receives an authentication request from the government system, it authenticates the request. If successful, a connection is established between the public security system and the government system. Similarly, upon receiving a joining request from the regional system, the government system establishes a connection with the regional system, thereby constructing a consortium blockchain network. Therefore, by configuring the public security system, government system, and regional system into a consortium blockchain network, this application achieves data isolation, access control, and privacy protection, enabling data transmission in a controlled and trusted environment and improving data security.

[0056] Furthermore, based on the consortium blockchain network, to prevent the leakage of sensitive data stored in the root node representing the public security system, this application encrypts and encapsulates the data at the root node, and then distributes the encrypted government data to the government system. This ensures that public security system data does not flow out of the root node in plaintext, thereby improving data security. Specifically, this application encrypts the government data to be transmitted using a self-generated first key and a second key from the central node, improving data confidentiality and preventing data tampering.

[0057] S102. The central node initiates a computing task and broadcasts the sub-tasks and corresponding government encrypted data split from the computing task to the corresponding regional nodes.

[0058] S103. The regional node responds to the subtask by performing calculations based on the received government encrypted data and / or its stored regional local data, and returns the encrypted result to the central node.

[0059] S104. The central node decrypts the received ciphertext result based on the third key corresponding to the second key and the fourth key from the root node to obtain the calculation result for the calculation task.

[0060] In this application, the central node initiates a computation task and breaks it down into multiple sub-tasks, which are then distributed to various regional nodes. Simultaneously, the central node distributes encrypted government data related to each sub-task to the corresponding regional nodes. These regional nodes then respond to the computation task, performing calculations based on the encrypted government data from the root node and / or their own stored local data to obtain the encrypted computation result. It should be noted that regional nodes employ privacy-preserving computation techniques (such as secure multi-party computation) to ensure that intermediate results do not leak the original data (i.e., government data from the public security system). This prevents regional nodes from directly accessing the original data content of the public security system, while ensuring that the original data remains either at the root node (i.e., government data) or at the regional nodes (i.e., local regional data), sharing only the encrypted intermediate results to prevent data leakage.

[0061] Furthermore, the regional nodes send the calculated encrypted results to the central node, and the central node decrypts the results after summarizing them, further improving data security.

[0062] Therefore, this application sends encrypted data to the central node through the root node to prevent the leakage of sensitive data. Then, the central node initiates a computing task and coordinates the regional nodes. The regional nodes respond to the computing task by performing calculations based on the encrypted data and local data, and return the calculation results to the central node. This ensures that the original data of the root node and the regional nodes are not transmitted externally and that the data is isolated, meeting the privacy protection requirements in a cross-system environment and meeting the compliance requirements of cross-system transmission, thereby improving the security of cross-system data interaction.

[0063] In some embodiments, the consortium blockchain network is constructed through the following steps:

[0064] When the public security system receives an authentication request from any government affairs system, it verifies the legitimacy of the authentication request, wherein the authentication request includes the government affairs system's identification data, identity credentials, and authentication request timestamp.

[0065] After successful authentication, the public security system authorizes the authentication credential to the government affairs system and establishes the first trust chain between the public security system and the government affairs system.

[0066] The regional system downloads the authentication credential from any government system and establishes a second trust chain between the regional system and the government system based on the authentication credential, thereby constructing a consortium blockchain network from the first trust chain and the second trust chain.

[0067] In this embodiment, the public security system acts as the authoritative root of trust, verifying the legitimacy of the government system's identification data (such as organization codes), identity credentials (such as digital certificates), and timestamps to ensure the authenticity and trustworthiness of the request source. The timestamp prevents replay attacks, enhancing the dynamic security of authentication, while the encrypted transmission of identity credentials (such as using asymmetric encryption) further safeguards data security.

[0068] Furthermore, after the public security system successfully authenticates the government affairs system, the two systems establish a direct peer-to-peer trust relationship (i.e., the first trust chain), forming the root and central nodes of the consortium blockchain network. It should be noted that the authentication credential can be a unique credential (such as a temporary token or digital signature) generated after each successful authentication by the public security system, preventing long-term misuse of the credential. Optionally, if the identity of the government affairs system changes (e.g., certificate expires), the public security system can revoke authorization, blocking unauthorized access.

[0069] Optionally, the regional system indirectly trusts the public security system by downloading and verifying the authentication credentials of the government system, eliminating the need for repeated interaction with the public security system, reducing network load, and improving operational efficiency. Thus, the regional system and the government system establish a point-to-point trust (i.e., a second trust chain), forming regional nodes and a central node in the consortium blockchain network.

[0070] Therefore, this embodiment uses the public security system to authenticate the government system and the government system to authenticate the regional system, and establishes a consortium blockchain network after authentication to improve the efficiency of network access, achieve identity trust and efficient compliance, that is, to realize cross-system data transmission in a trusted environment and improve cross-system collaboration efficiency.

[0071] In some embodiments, the first key includes a first private key and a second private key; the root node encrypts the government data to be transmitted based on its own generated first key and the second key from the central node, and then sends the encrypted government data to the central node, including:

[0072] The root node obtains the government data to be transmitted and the corresponding data structure metadata.

[0073] The root node uses its stored first private key to encrypt the government data, resulting in encrypted data;

[0074] The root node uses its stored second private key to sign the first concatenated data composed of the encrypted data and the data structure metadata to obtain government signature data.

[0075] The root node uses a second key from the central node to encapsulate a second concatenated data consisting of the encrypted data, the data structure metadata, and the government signature data, to obtain government encrypted data.

[0076] In this embodiment, the first private key can be a key stored locally on the root node (such as a symmetric key or an asymmetric encryption private key). The root node uses this first private key to encrypt the government data, ensuring that the data is in an encrypted state before transmission and preventing the leakage of sensitive data. Then, the root node concatenates the encrypted data with data structure metadata to form the first concatenated data, and signs the first concatenated data using a second private key (such as an RSA private key), forming an undeniable digital fingerprint. The data structure metadata can include the data format, timestamp, source identifier, etc., of the government data. Therefore, by signing the encrypted government data with the data structure metadata, this embodiment can prevent data parsing errors or malicious attacks caused by tampering with the data structure metadata (such as field type or length), improve the uniqueness and confidentiality of the data, and reduce the risk of single-key leakage.

[0077] Furthermore, the root node concatenates the encrypted data, data structure metadata, and government signature data into a second concatenated data. This second concatenated data is then further encapsulated using a second key from the central node (such as a public key issued by the recipient), forming encrypted government data. This second key can be a new key generated by the central node each time it needs to receive data, preventing key leakage.

[0078] Therefore, this embodiment greatly improves the security of data transmission and prevents the leakage of keys and data by encrypting government data, signing and encapsulating the first concatenated data, and encapsulating the second concatenated data a second time.

[0079] It should be noted that after receiving the ciphertext result returned by the regional nodes, the central node needs to decrypt the ciphertext result. Specifically, optionally, the central node decrypts the result using a third key corresponding to the second key, obtaining second concatenated data. This second concatenated data may be composed of encrypted data, data structure metadata, and government signature data. Then, the central node uses a fourth key from the root node (such as the first public key or a public key paired with the first private key) to decrypt the second concatenated data again, obtaining the calculation result for the computation task. Therefore, this application achieves data isolation and improves data confidentiality by decrypting at the central node.

[0080] In some embodiments, the fourth key includes a first public key corresponding to the second private key; the central node initiates a computation task and broadcasts the sub-tasks split from the computation task and the corresponding encrypted government data to the corresponding regional nodes, including:

[0081] The central node receives the encrypted government data.

[0082] The central node decrypts the government encrypted data based on the third key corresponding to the second key to obtain decrypted data;

[0083] The central node decrypts the government signature data in the decrypted data using the first public key from the root node to obtain the data to be verified.

[0084] The central node compares the data to be verified with the concatenation result of the encrypted data and the data structure metadata in the decrypted data, and stores the received government encrypted data when they match.

[0085] In this embodiment, after receiving the encrypted government data from the root node, the central node needs to verify the encrypted government data to prevent data tampering. Specifically, the central node uses a third key (such as the session private key in a symmetric key) paired with the second key (i.e., the public key from the central node) to decrypt the encrypted government data. It should be noted that since the second key is temporarily generated by the central node in response to the current data transmission and is used only once, the third key has key isolation.

[0086] Furthermore, the central node uses the first public key (paired with the first private key) of the root node to decrypt the government signature data, restoring the original data concatenation structure of "encrypted data + data structure metadata," which is the data to be verified. Then, the data to be verified is compared with the concatenation result composed of the encrypted data and data structure metadata in the decrypted data. If they match, it is considered that the data sent from the root node to the central node has not been tampered with, and the received data is stored.

[0087] Therefore, this embodiment ensures the integrity and security of the data received by the central node by verifying the integrity of the data sent from the root node to the central node.

[0088] In some embodiments, the method further includes:

[0089] The central node acquires behavior records of at least one data retrieval event that occurs within a specified time period. The data retrieval event is used to indicate an event in which data stored by the central node is retrieved by the regional node. The behavior record is used to indicate the regional node identifier of the retrieving regional node, the central node identifier of the retrieving central node, the event occurrence timestamp of the data retrieval event, the summary result, the data purpose of the data retrieval event, and the single event weight. The summary result is obtained by hashing the retrieved government encrypted data.

[0090] The central node determines the settlement result of the regional node based on the single event weight, data complexity, and the number of times it is called within a specified period for any regional node in any data call event.

[0091] The central node adds the settlement vouchers, settlement results, and behavior records of the regional nodes to the audit blockchain, wherein the settlement vouchers are determined by the regional node identifier and the specified period of the regional node.

[0092] In this embodiment, the data retrieval event can be a data transaction, data retrieval, data transmission, or other similar event. The event timestamp is the timestamp of the data transaction, retrieval, or transmission. The data purpose can be statistics, prediction, identity verification, etc. The settlement result can be a settlement amount, such as the fee paid by the caller to the provider (e.g., a regional node calling data from a central node), or it can be compensation from the provider to the caller for resource consumption.

[0093] Subsequently, the central node packages the settlement vouchers, settlement results, and behavior records onto the blockchain, using the distributed consensus mechanism of the blockchain (such as PBFT, PoS) to ensure that the data is immutable.

[0094] Therefore, this embodiment summarizes the data calls and contributions of each node within a certain period after the data interaction in the consortium blockchain network is completed, performs transaction settlement according to the preset protocol, and records relevant operation logs for auditing and traceability.

[0095] In some embodiments, the method further includes:

[0096] When the root node obtains the government data, or the central node stores the government encrypted data, corresponding data source information, data resource information, and data status information are generated. The data source information includes a data identifier, data source node, data version information, data structure information, data generation timestamp, and data update timestamp. The data resource information includes data resource category, classification level, data structure description information, and access control permission information. The data status information includes the data lifecycle status at any given time, the data validity period expiration time, and data change information.

[0097] Based on the data source information, the data resource information, and the data status information, data association relationships are determined, wherein the data association relationships include a first association relationship between the government data, a second association relationship between the government encrypted data, and a third association relationship between the government data and the government encrypted data;

[0098] Based on the data association relationship, a data association graph is constructed, wherein a node in the data association graph represents the government data or the government encrypted data, and an edge in the data association graph represents the data association relationship between two connected nodes.

[0099] In this embodiment, data management is achieved by configuring data source information, data resource information, and data status information for data entering the consortium blockchain network. Specifically, for the data source information, the data identifier is a unique identifier for government data or encrypted government data; the data source node can be a root node or a central node; the data structure information describes the structure, type, and constraints of the data fields; the data version information can be a version number; the data generation timestamp represents the timestamp of the first generation of the data; and the data update timestamp represents the timestamp of the most recent update of the data. Therefore, by configuring the data source information, which includes the data identifier and the source node, the data source can be quickly located, and version control and timeliness management can be achieved.

[0100] For data resource information, this embodiment forms a resource catalog of all data resource information. Here, data resource information represents data type (e.g., "key personnel database"), data resource categories can be "population," "risk," "spatial location," etc., and classification levels can be whether it involves classified information or is a core resource (A / B / C level). Data structure description information represents field structure, data field list, and type description, and access control information represents access permissions. Therefore, by configuring data resource information, data resource classification is achieved.

[0101] Data status information is represented as the lifecycle trajectory of each piece of data. Specifically, data lifecycle status indicates the lifecycle state of data at a certain moment, while data change information indicates how the data originated and how it was processed. Therefore, configuring data status information improves real-time data monitoring capabilities and reduces the risk of data leakage.

[0102] Furthermore, based on data source information, data resource information, and data status information, data relationships are determined to construct a data relationship graph. These relationships can be derivational or flow relationships between data; for example, the relationship between government data Di and Dj can be represented as Dj being derived from Di. Thus, in the data relationship graph, each node represents a piece of data, such as government data or encrypted government data, and each edge represents a data relationship. In addition, each node carries identifiers containing its data source information, data resource information, and data status information.

[0103] Optionally, to ensure the timeliness and compliance of the data derivation process, each data entity is bound to an expiration timestamp (i.e., the expiration date of the data validity period in the above data status information), indicating the period during which it is considered valid in the system. When the time of the derivation relationship is greater than the expiration date of the data validity period of the node, the edge connected to the node will be marked as invalid, which means that the node connected to the node was generated based on expired data, and data recalculation, compensation or risk control reminders need to be triggered.

[0104] Therefore, this embodiment constructs a data association graph to achieve traceable and correlated data analysis, realize full-process data tracking, and improve the efficiency of data management.

[0105] Based on the above embodiments, in some embodiments, constructing a data association graph based on the data association relationship includes:

[0106] When the regional node receives encrypted government data sent by the central node, the regional node determines the path fingerprint of the received encrypted government data based on the data association graph.

[0107] The regional node generates and stores the data registration information of the received government encrypted data based on the data source information and the path fingerprint of the government encrypted data.

[0108] In this embodiment, when the central node sends data to the regional nodes, the regional nodes register the received data locally. This registration includes recording the data source information of the received encrypted government data, such as the data identifier, data source node, data version information, data structure information, data generation timestamp, and data update timestamp. Subsequently, a path fingerprint for the data is generated based on the data relationship graph, i.e., the relationship between upstream and downstream data is obtained.

[0109] Therefore, this embodiment ensures the traceability and reliability of data sources by registering the data received by regional nodes, and prevents tampering or illegal derivation.

[0110] Based on the above embodiments, in some embodiments, constructing a data association graph based on the data association relationship further includes:

[0111] When a change is detected in the government data obtained by the root node or the government encrypted data stored by the central node, change information is generated, the corresponding government data or government encrypted data is updated, and broadcast to the corresponding central node or regional node. The change information includes the data change type, the changed fields, and the execution time after the data change.

[0112] When the regional node receives the change information, it updates the data registration information of the corresponding government encrypted data according to the change information, and determines the impact of the data update on downstream data according to the data association diagram.

[0113] When it is determined that the influence exceeds the preset influence threshold, the downstream data is recalculated based on the data association graph.

[0114] In this embodiment, by clearly defining the triple structure of change information (such as change type, change field, and execution time), a semantic description of data changes is achieved, providing structured input for subsequent impact analysis and avoiding processing errors caused by ambiguous change information. Subsequently, when data changes occur at the root node, the change information and the corresponding encrypted government data are broadcast to the central node to achieve data synchronization. When data changes occur at the central node, the change information and the corresponding encrypted government data are broadcast to the regional nodes to achieve data synchronization.

[0115] Therefore, this embodiment can ensure data consistency among the root node, central node, and regional nodes, thereby improving the accuracy and efficiency of task processing.

[0116] In some embodiments, the government data is obtained through the following steps:

[0117] The root node establishes an address database, which includes province information, city information, district / county information, street information, community information, house number information, building information, unit information, town information, village information, grid information, and microgrid information;

[0118] The root node obtains the corresponding government data based on the address database.

[0119] In this embodiment, a multi-level address database with structures including towns, villages, residential areas, grids, and microgrids is constructed to achieve initial binding of standard addresses with spatial grid units, providing basic support for data territorial management and refining address granularity and governance boundaries. Grid information can be related to grassroots governance units divided by dimensions such as population and area, while microgrid information can be related to the smallest subdivided governance units within the grid (such as buildings or unit groups). Specific government data (such as address information) is then obtained based on this address database.

[0120] Furthermore, based on grid information and microgrid information, the address information is mapped to verify, complete, and dynamically update unbound or incorrectly bound address information, gradually forming a one-to-one correspondence between standard addresses and microgrids, thereby improving the accuracy, timeliness, and spatial location accuracy of the data.

[0121] Therefore, this embodiment improves the spatial accuracy of address information and the granularity of governance, providing a structural foundation for trusted data access and automatic dispatch of governance tasks for regional nodes.

[0122] Figure 3 This is a schematic diagram of a government data management device provided in an embodiment of this application. The government data management device is used in a consortium blockchain network, which includes a root node representing a public security system, a central node representing a government system, and regional nodes representing regional systems. The government data management device 300 includes:

[0123] The encryption module 301 is used by the root node to encrypt the government data to be transmitted based on a first key generated by itself and a second key from the central node, and then send the encrypted government data to the central node.

[0124] Task module 302 is used by the central node to initiate a computing task and broadcast the sub-tasks and corresponding government encrypted data split from the computing task to the corresponding regional nodes.

[0125] The calculation module 303 is used by the regional node to respond to the subtask, perform calculations based on the received government encrypted data and / or its stored regional local data, and return the calculated encrypted result to the central node.

[0126] The decryption module 304 is used by the central node to decrypt the received computation ciphertext result based on the third key corresponding to the second key and the fourth key from the root node, so as to obtain the computation result of the computation task.

[0127] In some embodiments, the device 300 includes:

[0128] The legitimacy authentication module is used by the public security system to authenticate the legitimacy of any authentication request received from any government system. The authentication request includes the identification data, identity credentials, and authentication request timestamp of the government system.

[0129] The government system authentication module is used to authorize authentication credentials to the government system after the public security system has passed authentication, and to establish the first trust chain between the public security system and the government system.

[0130] The regional system authentication module is used for the regional system to download the authentication credential from any government system, and to establish a second trust chain between the regional system and the government system based on the authentication credential, so that a consortium blockchain network can be constructed from the first trust chain and the second trust chain.

[0131] In some embodiments, the first key includes a first private key and a second private key; the encryption module 301 includes:

[0132] The data acquisition unit is used by the root node to acquire the government data to be transmitted and the corresponding data structure metadata.

[0133] A data encryption unit is used by the root node to encrypt the government data using its stored first private key to obtain encrypted data;

[0134] A signature unit is used by the root node to sign the first concatenated data composed of the encrypted data and the data structure metadata using its stored second private key, thereby obtaining government signature data.

[0135] The encapsulation unit is used by the root node to encapsulate the second concatenated data, which consists of the encrypted data, the data structure metadata, and the government signature data, using a second key from the central node, to obtain government encrypted data.

[0136] In some embodiments, the task module 302 further includes:

[0137] A government encrypted data receiving unit is used by the central node to receive the government encrypted data.

[0138] The first decryption unit is used by the central node to decrypt the government encrypted data based on the third key corresponding to the second key, so as to obtain decrypted data.

[0139] The second decryption unit is used by the central node to decrypt the government signature data in the decryption data according to the first public key from the root node, so as to obtain the data to be verified.

[0140] The comparison unit is used by the central node to compare the data to be verified with the concatenation result of the encrypted data and the data structure metadata in the decrypted data, and to store the received government encrypted data when they match.

[0141] In some embodiments, the device 300 further includes:

[0142] The recording unit is used for the central node to obtain behavior records of at least one data retrieval event that occurs within a specified time period. The data retrieval event is used to indicate an event in which data stored by the central node is retrieved by the regional node. The behavior record is used to indicate the regional node identifier of the retrieving regional node, the central node identifier of the retrieving central node, the event occurrence timestamp of the data retrieval event, the summary result, the data purpose of the data retrieval event, and the single event weight. The summary result is obtained by hashing the retrieved government encrypted data.

[0143] The settlement unit is used by the central node to determine the settlement result of the regional node based on the single event weight, data complexity, and the number of calls of any regional node in any data call event within a specified period.

[0144] An audit processing unit is used by the central node to add the settlement voucher, settlement result, and behavior record of the regional node to the audit blockchain, wherein the settlement voucher is determined by the regional node identifier of the regional node and the specified period.

[0145] In some embodiments, the device 300 further includes:

[0146] An information generation unit is used to generate corresponding data source information, data resource information, and data status information when the root node obtains the government data or the central node stores the government encrypted data. The data source information includes a data identifier, a data source node, data version information, data structure information, a data generation timestamp, and a data update timestamp. The data resource information includes data resource category, classification level, data structure description information, and access control permission information. The data status information includes the data lifecycle status at any given time, the data validity period expiration time, and data change information.

[0147] A data association determination unit is used to determine data associations based on the data source information, the data resource information, and the data status information, wherein the data associations include a first association between the government data, a second association between the government encrypted data, and a third association between the government data and the government encrypted data;

[0148] A data association graph construction unit is used to construct a data association graph based on the data association relationship, wherein a node in the data association graph represents the government data or the government encrypted data, and an edge in the data association graph represents the data association relationship between two connected nodes.

[0149] In some embodiments, the data association graph construction unit includes:

[0150] A regional node processing unit is used to determine the path fingerprint of the received government encrypted data based on the data association graph when the regional node receives the government encrypted data sent by the central node.

[0151] The regional node data registration unit is used for the regional node to generate and store data registration information of the received government encrypted data based on the data source information and the path fingerprint of the government encrypted data.

[0152] In some embodiments, the data association graph construction unit further includes:

[0153] The data change unit is used to generate change information and update the corresponding government data or government encrypted data when it detects that the government data obtained by the root node or the government encrypted data stored by the central node has changed, and broadcast it to the corresponding central node or regional node. The change information includes the data change type, the changed fields and the execution time after the data change.

[0154] The update unit is used to update the data registration information of the corresponding government encrypted data according to the change information when the regional node receives the change information, and to determine the impact of the data update on downstream data according to the data association diagram.

[0155] The recalculation unit is used to recalculate the downstream data based on the data association graph when it is determined that the influence exceeds a preset influence threshold.

[0156] In some embodiments, the device 300 further includes:

[0157] Address database establishment unit, used by the root node to establish address database, the address database includes province information, city information, district / county information, street information, community information, house number information, building information, unit information, town information, village information, grid information and microgrid information;

[0158] The government data acquisition unit is used by the root node to acquire the corresponding government data based on the address database.

[0159] The apparatus in this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of each embodiment of this application. For detailed functional descriptions of each module of the apparatus, please refer to the descriptions in the corresponding methods shown above, which will not be repeated here.

[0160] In the description of embodiments of the present invention, the terms "first," "second," "third," and "fourth" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first," "second," "third," or "fourth" may explicitly or implicitly include one or more of that feature. In the description of the present invention, unless otherwise stated, "a plurality of" means two or more.

[0161] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for managing government data, characterized in that, For a consortium blockchain network, the consortium blockchain network includes a root node representing a public security system, a central node representing a government affairs system, and regional nodes representing regional systems; the method includes: The root node encrypts the government data to be transmitted using a first key it generates and a second key from the central node, obtaining encrypted government data, and then sends it to the central node. The first key includes a first private key and a second private key. The process includes: the root node acquiring the government data to be transmitted and the corresponding data structure metadata; the root node encrypting the government data using its stored first private key to obtain encrypted data; the root node signing a first concatenated data consisting of the encrypted data and the data structure metadata using its stored second private key to obtain government signature data; and the root node encapsulating a second concatenated data consisting of the encrypted data, the data structure metadata, and the government signature data using the second key from the central node to obtain encrypted government data. The central node initiates a computation task and broadcasts the subtasks and corresponding encrypted government data derived from the computation task to the corresponding regional nodes. The fourth key includes a first public key corresponding to the second private key. The process includes: the central node receiving the encrypted government data; the central node decrypting the encrypted government data using a third key corresponding to the second key to obtain decrypted data; the central node decrypting the government signature data in the decrypted data using the first public key from the root node to obtain data to be verified; and the central node comparing the data to be verified with the concatenation result of the encrypted data and the data structure metadata in the decrypted data, and storing the received encrypted government data if they match. The regional node responds to the subtask by performing calculations based on the received government encrypted data and / or its stored local regional data, and returns the encrypted calculation result to the central node. The central node decrypts the received computation ciphertext result based on the third key corresponding to the second key and the fourth key from the root node, to obtain the computation result for the computation task.

2. The method for managing government data according to claim 1, characterized in that, The consortium blockchain network is constructed through the following steps: When the public security system receives an authentication request from any government affairs system, it verifies the legitimacy of the authentication request, wherein the authentication request includes the government affairs system's identification data, identity credentials, and authentication request timestamp. After successful authentication, the public security system authorizes the authentication credential to the government affairs system and establishes the first trust chain between the public security system and the government affairs system. The regional system downloads the authentication credential from any government system and establishes a second trust chain between the regional system and the government system based on the authentication credential, thereby constructing a consortium blockchain network from the first trust chain and the second trust chain.

3. The method for managing government data according to claim 2, characterized in that, The method further includes: The central node acquires behavior records of at least one data retrieval event that occurs within a specified time period. The data retrieval event is used to indicate an event in which data stored by the central node is retrieved by the regional node. The behavior record is used to indicate the regional node identifier of the retrieving regional node, the central node identifier of the retrieving central node, the event occurrence timestamp of the data retrieval event, the summary result, the data purpose of the data retrieval event, and the single event weight. The summary result is obtained by hashing the retrieved government encrypted data. The central node determines the settlement result of the regional node based on the single event weight, data complexity, and the number of times it is called within a specified period for any regional node in any data call event. The central node adds the settlement vouchers, settlement results, and behavior records of the regional nodes to the audit blockchain, wherein the settlement vouchers are determined by the regional node identifier and the specified period of the regional node.

4. The method for managing government data according to claim 3, characterized in that, The method further includes: When the root node obtains the government data, or the central node stores the government encrypted data, corresponding data source information, data resource information, and data status information are generated. The data source information includes a data identifier, data source node, data version information, data structure information, data generation timestamp, and data update timestamp. The data resource information includes data resource category, classification level, data structure description information, and access control permission information. The data status information includes the data lifecycle status at any given time, the data validity period expiration time, and data change information. Based on the data source information, the data resource information, and the data status information, data association relationships are determined, wherein the data association relationships include a first association relationship between the government data, a second association relationship between the government encrypted data, and a third association relationship between the government data and the government encrypted data; Based on the data association relationship, a data association graph is constructed, wherein a node in the data association graph represents the government data or the government encrypted data, and an edge in the data association graph represents the data association relationship between two connected nodes.

5. The method for managing government data according to claim 4, characterized in that, The step of constructing a data association graph based on the data association relationships includes: When the regional node receives encrypted government data sent by the central node, the regional node determines the path fingerprint of the received encrypted government data based on the data association graph. The regional node generates and stores the data registration information of the received government encrypted data based on the data source information and the path fingerprint of the government encrypted data.

6. The method for managing government data according to claim 5, characterized in that, The step of constructing a data association graph based on the data association relationships further includes: When a change is detected in the government data obtained by the root node or the government encrypted data stored by the central node, change information is generated, the corresponding government data or government encrypted data is updated, and broadcast to the corresponding central node or regional node. The change information includes the data change type, the changed fields, and the execution time after the data change. When the regional node receives the change information, it updates the data registration information of the corresponding government encrypted data according to the change information, and determines the impact of the data update on downstream data according to the data association diagram. When it is determined that the influence exceeds the preset influence threshold, the downstream data is recalculated based on the data association graph.

7. The method for managing government data according to claim 6, characterized in that, The government data is obtained through the following steps: The root node establishes an address database, which includes province information, city information, district / county information, street information, community information, house number information, building information, unit information, town information, village information, grid information, and microgrid information; The root node obtains the corresponding government data based on the address database.

8. A management device for government data, characterized in that, For use in a consortium blockchain network, the consortium blockchain network includes a root node representing a public security system, a central node representing a government affairs system, and regional nodes representing regional systems; the device includes: An encryption module is used by the root node to encrypt the government data to be transmitted based on a first key generated by itself and a second key from the central node, and then send the encrypted government data to the central node. The first key includes a first private key and a second private key. The module includes: the root node obtaining the government data to be transmitted and the corresponding data structure metadata; the root node encrypting the government data using its stored first private key to obtain encrypted data; the root node signing a first concatenated data composed of the encrypted data and the data structure metadata using its stored second private key to obtain government signature data; and the root node encapsulating a second concatenated data composed of the encrypted data, the data structure metadata, and the government signature data using the second key from the central node to obtain encrypted government data. The task module is used by the central node to initiate computing tasks and broadcast the sub-tasks and corresponding encrypted government data that are split from the computing tasks to the corresponding regional nodes. The calculation module is used by the regional node to respond to the subtask, perform calculations based on the received government encrypted data and / or its stored regional local data, and return the calculated encrypted result to the central node. The decryption module is used by the central node to decrypt the received ciphertext result based on a third key corresponding to the second key and a fourth key from the root node, to obtain the calculation result for the calculation task. The fourth key includes a first public key corresponding to the second private key. The process includes: the central node receiving the government ciphertext data; the central node decrypting the government ciphertext data based on the third key corresponding to the second key to obtain decrypted data; the central node decrypting the government signature data in the decrypted data based on the first public key from the root node to obtain data to be verified; and the central node comparing the data to be verified with the concatenation result of the encrypted data and the data structure metadata in the decrypted data, and storing the received government ciphertext data when they match.

Images