Data interaction system based on block chain
By using a blockchain-based data interaction system and a multi-factor evaluation process to calculate dynamic permission levels and generate data access tokens, the system addresses the shortcomings in data security, credibility, and fairness in traditional systems, and achieves dynamic access control and refined management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-27
- Publication Date
- 2026-03-13
AI Technical Summary
Traditional data exchange systems face challenges in terms of data security, credibility, and fairness. Furthermore, their access control mechanisms are rigid, making it impossible to achieve dynamic adjustments and fine-grained authorization, resulting in insufficient system performance and traceability.
A blockchain-based data interaction system was designed, which includes modules for request reception, evaluation factor acquisition, permission evaluation, data management, and data authorization. The system calculates dynamic permission levels through a multi-factor evaluation process, generates and manages data access tokens, and ensures the dynamism and fine-grained nature of access control.
It enhances the security, adaptability, and granularity of data interaction, enables automated permission downgrading for malicious behavior, ensures the immutability and traceability of evaluation factors, and is suitable for high-security and compliance scenarios.
Smart Images
Figure CN121659341A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data interaction technology, and more specifically to a data interaction system based on blockchain. Background Technology
[0002] Currently, with the rapid development and iteration of cloud computing and big data, data processing in more and more fields is carried out through cloud computing. After processing, the data is exchanged in the cloud. However, traditional data interaction faces many challenges in terms of data security, credibility, and fairness. The system overhead of interacting with the cloud is also quite large. How to ensure data security, credibility, and fairness during data interaction, optimize the overhead generated by the interaction, and increase the subsequent traceability of data are all issues that we need to consider. Therefore, blockchain technology has been introduced to optimize cloud data interaction through the decentralized characteristics of blockchain.
[0003] First, in terms of data security and privacy protection, traditional centralized systems are vulnerable to single points of failure. All data and access permissions are concentrated in the hands of a single or a few service providers. If the central server suffers an external attack (such as a hacker intrusion) or internal misconduct occurs, it can easily lead to large-scale data breaches, tampering, or misuse. Furthermore, the separation of data ownership and control makes it difficult for data holders to effectively track and control the actual use of their data after it has been accessed, posing a serious challenge to privacy protection.
[0004] Secondly, regarding the credibility and impartiality of the system, the interaction process in a centralized model lacks transparency and immutability. Both or more parties involved in the interaction must unconditionally trust the management and adjudication of the central platform. When data disputes arise (e.g., disputes about whether specific data was accessed at a certain point in time and by whom), the log records provided by the central platform may be unilaterally modified, making it difficult to gain the consensus and impartiality of this evidence among all participants. This poses a significant obstacle in high-value or high-compliance data interaction scenarios.
[0005] Furthermore, existing access control mechanisms generally suffer from rigidity and coarse-grainedness. Most systems manage permissions based on static, pre-assigned roles or attributes; once authorized, permissions typically remain fixed for the validity period. This model cannot dynamically adjust based on the visitor's real-time behavior reputation, historical compliance records, or external environmental risks. Even if an initially trusted visitor subsequently exhibits abnormal or malicious access behavior, the system cannot promptly detect and automatically downgrade their permissions, leaving data continuously exposed to risk. Simultaneously, the traditional "all or nothing" access model makes it difficult to achieve differentiated and granular authorization for data with different security levels, hindering the sharing and circulation of peripheral data while ensuring the security of core data.
[0006] Finally, regarding system performance and traceability, traditional systems typically require maintaining large and complex log centers to achieve auditability, resulting in significant storage and computational overhead. Furthermore, these logs themselves are at risk of being centrally tampered with or deleted. While blockchain technology has been introduced to leverage its decentralized and immutable characteristics, most existing blockchain-based data interaction solutions remain at the level of equally sharing all data with all authorized nodes. They fail to deeply integrate the immutability of blockchain with dynamic, fine-grained access control policies, thus failing to address the core issue of "how to dynamically adjust the scope of on-chain data access based on real-time changes in trust levels." Summary of the Invention
[0007] The technical problem solved by this invention is to provide a new type of data interaction system based on blockchain, which can effectively improve the security, credibility and fairness of the data interaction process.
[0008] The basic solution provided by this invention is a data interaction system based on blockchain, characterized in that it includes a request receiving module, an evaluation factor acquisition module, a permission evaluation module, a data management module, and a receipt authorization module. The request receiving module is used to receive data access requests from the requesting party. The evaluation factor acquisition module is used to acquire evaluation factors associated with the accessing party when a data access request is received from the accessing party, wherein the evaluation factors include at least the accessing party's historical access records and attribute information; The permission assessment module is used to calculate and generate the dynamic permission level of the accessing party based on the assessment factors and a predefined permission assessment algorithm. The data management module is used to determine the target data block from a set of multiple pre-defined data blocks according to the dynamic permission level. Different data blocks store data of different types or different security levels, and different dynamic permission levels correspond to different data block access permissions. The data authorization module is used to generate and return a data access token to the accessing party, the data access token containing access authorization information for the target data block.
[0009] The principle and advantages of this invention are as follows: Traditional data access control is often static; once permissions are granted, they are difficult to change according to actual circumstances, and data is usually stored centrally, posing risks of single points of failure and lack of trust. This application constructs a dynamic security model. When an access party initiates a request, the system does not immediately authorize it, but instead initiates a multi-factor evaluation process, comprehensively considering its historical behavior and its own attributes, thereby calculating a dynamic permission level that changes in real time. This level directly determines the range of data blocks that the access party can access, achieving a leap in trust from "identity" to "behavior".
[0010] This enhances the security, adaptability, and granularity of data interaction. The system no longer mechanically executes fixed rules but intelligently identifies the risk and trustworthiness of access parties, automatically downgrading permissions for malicious or abnormal behavior, effectively preventing unauthorized data access. Simultaneously, utilizing blockchain as the underlying storage not only ensures the immutability and traceability of key information such as evaluation factors and historical records but also provides a solid foundation of trust for the entire permission decision-making process, resolving concerns about impartiality in multi-party collaborations. This design makes the system particularly suitable for scenarios with high security and compliance requirements.
[0011] Furthermore, the evaluation factor acquisition module includes a historical access acquisition module, an attribute information acquisition module, and an oracle interface module; The historical access acquisition module is used to acquire the historical access records of the accessing party. The historical access records include the historical access frequency, the data block type of the historical access, the success and failure records of the historical access, and whether there is any unauthorized access behavior. The attribute information acquisition module is used to acquire pre-stored static attribute information of the access party from the blockchain network. The static attribute information includes the access party's digital identity, organization, and role level. The oracle interface module is used to obtain real-time dynamic attribute information of the access party from a trusted off-chain data source through a blockchain oracle. The real-time dynamic attribute information includes the access party's latest credit score, real-time authentication status from an authoritative institution, and environmental risk indicators related to the context of the access.
[0012] The historical access acquisition module extracts the visitor's behavioral trajectory from the trusted source of the blockchain ontology, forming a temporal profile of their credibility. The attribute information acquisition module reads their inherent and relatively stable identity characteristics from the on-chain identity contract, laying the foundation for the permission framework. The oracle interface module breaks the closed nature of the blockchain, acting as a bridge to securely introduce real-time dynamic credit data from the external world into the on-chain decision-making process. These three modules work together to ensure that the evaluation factors not only include static identity information but also cover dynamic behavioral records and real-time external credit changes.
[0013] This greatly enriches the decision-making basis for permission assessment, enabling the system to make more accurate and context-sensitive judgments. By introducing off-chain oracles, the system can detect credit fluctuations or risk events in the real world of the access party, thereby making real-time responses to internal permissions and achieving proactive defense through the linkage of internal and external risks.
[0014] Furthermore, the permission evaluation module includes a factor weight configuration module, The factor weight configuration module is used to predefine and dynamically adjust the weight of different types of evaluation factors when calculating dynamic permission levels. The permission score management module is used to call a predefined permission evaluation algorithm, load the evaluation factors and their corresponding weights provided by the evaluation factor acquisition module, and output the permission score. The permission mapping module is used to match permission scores with preset permission level ranges to determine the dynamic permission level of the access party.
[0015] This module transforms a vague concept of "evaluation" into a standardized, quantifiable, configurable, and executable calculation process. It converts evaluation factors into specific permission levels through three sub-modules: factor weight configuration, permission score management, and level mapping.
[0016] Furthermore, the data management module includes a block identification module, a permission mapping module, and a block retrieval module; The block identifier module is used to define and maintain the type identifiers and security level identifiers of different data blocks; The permission mapping module is used to store and manage the mapping strategy between dynamic permission levels and data block access permissions. It queries and obtains the corresponding list of target data blocks based on the input dynamic permission level. The block retrieval module is used to locate and verify the accessibility of the corresponding data block in the block network based on the target data block list.
[0017] By categorizing data blocks according to security levels and linking them to dynamic permissions, the system enables on-demand authorization, minimizes data exposure, and significantly enhances data security. Simultaneously, this modular design makes data policy management exceptionally clear. When access rules need adjustment, only the policy in the permission mapping module needs to be updated, without altering the underlying data storage structure or core evaluation algorithm. This significantly improves the system's flexibility and scalability, easily handling the increasing complexity of data types and permission models brought about by future business development.
[0018] Furthermore, the data authorization module includes a token generation module, a permission encapsulation module, a token encryption module, and a token management module; The token generation module is used to create the basic structure of data access tokens; The permission encapsulation module is used to write the target data block list determined by the data management module and the corresponding access operation permissions into the data access token; The token encryption module is used to encrypt the assembled data access token and digitally sign it using the system private key; The token management module is used to set the effective time, expiration time, or maximum number of uses for the data access token.
[0019] Access authorization is materialized as a secure, controllable, and lifecycle-bound digital token. This module ensures the integrity and security of the authorization credential through a pipeline of four sub-modules: token generation, permission encapsulation, token encryption, and token management. The token generation module creates a standardized container for the token; the permission encapsulation module precisely fills the container with the final access scope—the list of target data blocks and operation permissions—calculated by all the preceding modules, ensuring the accuracy of the authorization. The token encryption module is crucial for security; it ensures that the token cannot be tampered with or forged during transmission and storage by encrypting and digitally signing it, preventing unauthorized use and escalation of permissions. The token management module injects a time or frequency dimension into the token, giving it a lifecycle concept. The greatest advantage of this design is that it securely and reliably delivers the one-time permission decision result to the accessing party. The encryption and signing mechanisms guarantee the non-repudiation and integrity of the authorization credential, serving as the final technical barrier against unauthorized access. Introducing lifecycle management is a fundamental security enhancement. It limits the harm caused by accidental leakage of tokens to a short time window or a limited number of times, greatly reducing potential security risks and enabling fine-grained control of dynamic permissions over time.
[0020] Furthermore, it also includes an access control enforcement module and a behavior logging module; An access control enforcement module, deployed on a blockchain node, is used to intercept data access requests, verify the validity of the data access token issued by the data authorization module, and strictly control access to the target data block based on the authorization information in the token. The behavior recording module is used to write key information of each data access, including the identity of the accessing party, the access time, the target data block accessed, and the access result, into the blockchain as an immutable record. This is used to update historical access records and provide clues for post-event auditing.
[0021] A complete security closed loop of "decision-execution-audit" has been constructed to ensure that the system's security policies are not only accurately calculated, but also strictly enforced and fully traceable. Attached Figure Description
[0022] Figure 1 This is a schematic diagram of an embodiment of a blockchain-based data interaction system according to the present invention. Detailed Implementation
[0023] The following detailed description illustrates the specific implementation method: The basic implementation examples are as follows: Figure 1 As shown: A blockchain-based data interaction system, characterized in that it includes a request receiving module, an evaluation factor acquisition module, an authorization evaluation module, a data management module, and a receipt authorization module; The request receiving module is used to receive data access requests from the requesting party. The evaluation factor acquisition module is used to acquire evaluation factors associated with the accessing party when a data access request is received from the accessing party, wherein the evaluation factors include at least the accessing party's historical access records and attribute information; The permission assessment module is used to calculate and generate the dynamic permission level of the accessing party based on the assessment factors and a predefined permission assessment algorithm. The data management module is used to determine the target data block from a set of multiple pre-defined data blocks according to the dynamic permission level. Different data blocks store data of different types or different security levels, and different dynamic permission levels correspond to different data block access permissions. The data authorization module is used to generate and return a data access token to the accessing party, the data access token containing access authorization information for the target data block.
[0024] Traditional data access control is often static; once permissions are granted, they are difficult to change according to actual circumstances, and data is usually stored centrally, posing risks of single points of failure and lack of trust. This application constructs a dynamic security model. When an access party initiates a request, the system does not immediately authorize it, but initiates a multi-factor evaluation process, comprehensively considering its historical behavior and its own attributes, to calculate a dynamic permission level that changes in real time. This level directly determines the range of data blocks that the access party can access, achieving a leap in trust from "identity" to "behavior".
[0025] This enhances the security, adaptability, and granularity of data interaction. The system no longer mechanically executes fixed rules but intelligently identifies the risk and trustworthiness of access parties, automatically downgrading permissions for malicious or abnormal behavior, effectively preventing unauthorized data access. Simultaneously, utilizing blockchain as the underlying storage not only ensures the immutability and traceability of key information such as evaluation factors and historical records but also provides a solid foundation of trust for the entire permission decision-making process, resolving concerns about impartiality in multi-party collaborations. This design makes the system particularly suitable for scenarios with high security and compliance requirements.
[0026] The evaluation factor acquisition module includes a historical access acquisition module, an attribute information acquisition module, and an oracle interface module. The historical access acquisition module is used to acquire the historical access records of the accessing party. The historical access records include the historical access frequency, the data block type of the historical access, the success and failure records of the historical access, and whether there is any unauthorized access behavior. The attribute information acquisition module is used to acquire pre-stored static attribute information of the access party from the blockchain network. The static attribute information includes the access party's digital identity, organization, and role level. The oracle interface module is used to obtain real-time dynamic attribute information of the access party from a trusted off-chain data source through a blockchain oracle. The real-time dynamic attribute information includes the access party's latest credit score, real-time authentication status from an authoritative institution, and environmental risk indicators related to the context of the access.
[0027] The historical access acquisition module extracts the visitor's behavioral trajectory from the trusted source of the blockchain ontology, forming a temporal profile of their credibility. The attribute information acquisition module reads their inherent and relatively stable identity characteristics from the on-chain identity contract, laying the foundation for the permission framework. The oracle interface module breaks the closed nature of the blockchain, acting as a bridge to securely introduce real-time dynamic credit data from the external world into the on-chain decision-making process. These three modules work together to ensure that the evaluation factors not only include static identity information but also cover dynamic behavioral records and real-time external credit changes.
[0028] This greatly enriches the decision-making basis for permission assessment, enabling the system to make more accurate and context-sensitive judgments. By introducing off-chain oracles, the system can detect credit fluctuations or risk events in the real world of the access party, thereby making real-time responses to internal permissions and achieving proactive defense through the linkage of internal and external risks.
[0029] The permission evaluation module includes a factor weight configuration module. The factor weight configuration module is used to predefine and dynamically adjust the weight of different types of evaluation factors when calculating dynamic permission levels. The permission score management module is used to call a predefined permission evaluation algorithm, load the evaluation factors and their corresponding weights provided by the evaluation factor acquisition module, and output the permission score. The permission mapping module is used to match permission scores with preset permission level ranges to determine the dynamic permission level of the access party.
[0030] This module transforms a vague concept of "evaluation" into a standardized, quantifiable, configurable, and executable calculation process. It converts evaluation factors into specific permission levels through three sub-modules: factor weight configuration, permission score management, and level mapping.
[0031] The data management module includes a block identifier module, a permission mapping module, and a block retrieval module; The block identifier module is used to define and maintain the type identifiers and security level identifiers of different data blocks; The permission mapping module is used to store and manage the mapping strategy between dynamic permission levels and data block access permissions. It queries and obtains the corresponding list of target data blocks based on the input dynamic permission level. The block retrieval module is used to locate and verify the accessibility of the corresponding data block in the block network based on the target data block list.
[0032] By categorizing data blocks according to security levels and linking them to dynamic permissions, the system enables on-demand authorization, minimizes data exposure, and significantly enhances data security. Simultaneously, this modular design makes data policy management exceptionally clear. When access rules need adjustment, only the policy in the permission mapping module needs to be updated, without altering the underlying data storage structure or core evaluation algorithm. This significantly improves the system's flexibility and scalability, easily handling the increasing complexity of data types and permission models brought about by future business development.
[0033] The data authorization module includes a token generation module, a permission encapsulation module, a token encryption module, and a token management module; The token generation module is used to create the basic structure of data access tokens; The permission encapsulation module is used to write the target data block list determined by the data management module and the corresponding access operation permissions into the data access token; The token encryption module is used to encrypt the assembled data access token and digitally sign it using the system private key; The token management module is used to set the effective time, expiration time, or maximum number of uses for the data access token.
[0034] Access authorization is materialized as a secure, controllable, and lifecycle-bound digital token. This module ensures the integrity and security of the authorization credential through a pipeline of four sub-modules: token generation, permission encapsulation, token encryption, and token management. The token generation module creates a standardized container for the token; the permission encapsulation module precisely fills the container with the final access scope—the list of target data blocks and operation permissions—calculated by all the preceding modules, ensuring the accuracy of the authorization. The token encryption module is crucial for security; it ensures that the token cannot be tampered with or forged during transmission and storage by encrypting and digitally signing it, preventing unauthorized use and escalation of permissions. The token management module injects a time or frequency dimension into the token, giving it a lifecycle concept. The greatest advantage of this design is that it securely and reliably delivers the one-time permission decision result to the accessing party. The encryption and signing mechanisms guarantee the non-repudiation and integrity of the authorization credential, serving as the final technical barrier against unauthorized access. Introducing lifecycle management is a fundamental security enhancement. It limits the harm caused by accidental leakage of tokens to a short time window or a limited number of times, greatly reducing potential security risks and enabling fine-grained control of dynamic permissions over time.
[0035] It also includes an access control enforcement module and a behavior logging module; An access control enforcement module, deployed on a blockchain node, is used to intercept data access requests, verify the validity of the data access token issued by the data authorization module, and strictly control access to the target data block based on the authorization information in the token. The behavior recording module is used to write key information of each data access, including the identity of the accessing party, the access time, the target data block accessed, and the access result, into the blockchain as an immutable record. This is used to update historical access records and provide clues for post-event auditing.
[0036] A complete security closed loop of "decision-execution-audit" has been constructed to ensure that the system's security policies are not only accurately calculated, but also strictly enforced and fully traceable.
[0037] The above are merely embodiments of the present invention. Commonly known structures and characteristics are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.
Claims
1. A data interaction system based on blockchain, characterized in that: It includes a request receiving module, an evaluation factor acquisition module, a permission evaluation module, a data management module, and a receipt authorization module; The request receiving module is used to receive data access requests from the requesting party. The evaluation factor acquisition module is used to acquire evaluation factors associated with the accessing party when a data access request is received from the accessing party, wherein the evaluation factors include at least the accessing party's historical access records and attribute information; The permission assessment module is used to calculate and generate the dynamic permission level of the accessing party based on the assessment factors and a predefined permission assessment algorithm. The data management module is used to determine the target data block from a set of multiple pre-defined data blocks according to the dynamic permission level. Different data blocks store data of different types or different security levels, and different dynamic permission levels correspond to different data block access permissions. The data authorization module is used to generate and return a data access token to the accessing party, the data access token containing access authorization information for the target data block.
2. The data interaction system based on blockchain according to claim 1, characterized in that: The evaluation factor acquisition module includes a historical access acquisition module, an attribute information acquisition module, and an oracle interface module. The historical access acquisition module is used to acquire the historical access records of the accessing party. The historical access records include the historical access frequency, the data block type of the historical access, the success and failure records of the historical access, and whether there is any unauthorized access behavior. The attribute information acquisition module is used to acquire pre-stored static attribute information of the access party from the blockchain network. The static attribute information includes the access party's digital identity, organization, and role level. The oracle interface module is used to obtain real-time dynamic attribute information of the access party from a trusted off-chain data source through a blockchain oracle. The real-time dynamic attribute information includes the access party's latest credit score, real-time authentication status from an authoritative institution, and environmental risk indicators related to the context of the access.
3. The data interaction system based on blockchain according to claim 2, characterized in that: The permission evaluation module includes a factor weight configuration module. The factor weight configuration module is used to predefine and dynamically adjust the weight of different types of evaluation factors when calculating dynamic permission levels. The permission score management module is used to call a predefined permission evaluation algorithm, load the evaluation factors and their corresponding weights provided by the evaluation factor acquisition module, and output the permission score. The permission mapping module is used to match permission scores with preset permission level ranges to determine the dynamic permission level of the access party.
4. A data interaction system based on blockchain according to claim 3, characterized in that: The data management module includes a block identifier module, a permission mapping module, and a block retrieval module; The block identifier module is used to define and maintain the type identifiers and security level identifiers of different data blocks; The permission mapping module is used to store and manage the mapping strategy between dynamic permission levels and data block access permissions. It queries and obtains the corresponding list of target data blocks based on the input dynamic permission level. The block retrieval module is used to locate and verify the accessibility of the corresponding data block in the block network based on the target data block list.
5. A data interaction system based on blockchain according to claim 4, characterized in that: The data authorization module includes a token generation module, a permission encapsulation module, a token encryption module, and a token management module; The token generation module is used to create the basic structure of data access tokens; The permission encapsulation module is used to write the target data block list determined by the data management module and the corresponding access operation permissions into the data access token; The token encryption module is used to encrypt the assembled data access token and digitally sign it using the system private key; The token management module is used to set the effective time, expiration time, or maximum number of uses for the data access token.
6. A data interaction system based on blockchain according to claim 5, characterized in that: It also includes an access control enforcement module and a behavior logging module; An access control enforcement module, deployed on a blockchain node, is used to intercept data access requests, verify the validity of the data access token issued by the data authorization module, and strictly control access to the target data block based on the authorization information in the token. The behavior recording module is used to write key information of each data access, including the identity of the accessing party, the access time, the target data block accessed, and the access result, into the blockchain as an immutable record. This is used to update historical access records and provide clues for post-event auditing.