Data cross-border flow control method and system based on block chain smart contract

Abstract

The invention belongs to the technical field of data processing. The block chain intelligent contract-based data cross-border flow control method comprises the specific steps that domestic enterprises put forward data outbound quota and type applications, and after supervision and approval, information is written into a block chain contract to form an on-chain quota general table; the enterprise initiates an outbound request to trigger a contract, obtains information such as the remaining quota and verifies qualification, data types and the quota; generating an SRv6 label containing a specified field; checking the quota and uploading the outbound abstract event; the supervisor accesses the record auditing on the chain; according to the method, the whole data outbound process is controllable and checkable, the compliance and efficiency are improved, and data tampering is avoided.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a method and system for controlling cross-border data flows based on blockchain smart contracts. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the acceleration of global digitalization, the cross-border flow of data, as a key production factor, is becoming increasingly frequent. Enterprises conducting international business need to routinely transfer user data to overseas servers to support operations. Against this backdrop, the compliance and security of cross-border data flows have become core regulatory focuses. Relevant laws and regulations explicitly require quota controls and process reviews for cross-border data transactions to ensure data security and protect personal information rights. To implement these laws and regulations, a declaration-based cross-border data regulatory system is currently being built, forming three core regulatory mechanisms: a security assessment mechanism for highly sensitive, large-volume, or critical infrastructure-related data; a standard contract mechanism applicable to the transfer of small amounts of personal information by general enterprises; and a personal information protection certification mechanism relying on third-party certification. Some regions are further piloting a "negative list" mechanism, allowing certain low-risk data types to be exempt from declaration within a whitelist, thereby improving data flow efficiency while maintaining compliance.

[0004] While existing cross-border data supervision mechanisms have established a basic framework, deficiencies in their technical implementation limit their effectiveness. Traditional data export supervision generally relies on post-event audits or centralized systems, failing to achieve dynamic control throughout the entire process. On the one hand, current mechanisms are based on proactive declarations by enterprises, lacking effective means to verify the authenticity of declared information. Furthermore, log records in enterprise export systems are easily tampered with, making reliable traceability and auditing difficult. On the other hand, existing filing and evaluation processes require significant manual intervention, with lengthy processing times from material upload to approval and filing, which cannot meet the efficiency demands of high-frequency data trading scenarios. Simultaneously, existing mechanisms lack the technical capabilities for real-time quota verification and automatic over-limit control, failing to intercept violations in real time during data export execution. Even with a "negative list" mechanism, reliance on centralized approval and post-event supervision remains, failing to establish effective control when data export occurs, resulting in delayed regulatory response and blind spots. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for controlling cross-border data flows based on blockchain smart contracts. It solves the core problem of traditional cross-border data supervision relying on post-audit or centralized systems, overcomes the deficiencies of tampering risk, poor timeliness, regulatory blind spots, and inefficiency of manual approval, improves the controllability, traceability, and compliance review efficiency of the entire data export process, avoids process delays caused by illegal transmission by enterprises, log tampering, and manual intervention, and realizes the transformation of supervision from passive post-event accountability to proactive real-time control.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for controlling cross-border data flows based on blockchain smart contracts.

[0007] A method for controlling cross-border data flows based on blockchain smart contracts includes the following processes: Once a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type, and recipient qualification information will be written into the blockchain contract to form an on-chain quota master table. When a domestic enterprise initiates a specific data export request, it triggers a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining export quota, the types of data allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient, and the on-chain filing information. It also verifies whether the data type of this outbound transaction is within the allowed range and whether the remaining quota meets the requirements of this transaction. After verification, an SRv6 tag containing a network prefix field, a function type field, a function parameter field, and a check code field is generated based on the preset SRv6 tag configuration. The SRv6 tag specifies the data transmission path for data export, the compliance processing functions that the node needs to perform, and the corresponding dynamic parameters. The smart contract automatically deducts the amount corresponding to this outbound data and writes the time, quantity, type, recipient identifier, and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; Regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

[0008] In one implementation of the first aspect of the present invention, the network prefix field of the SRv6 tag is 32 bits, which is used to identify the target network domain and clarify the data outbound traffic path. Different network prefixes are used to distinguish non-cross-border transmission paths, cross-border transmission paths and sensitive area transmission paths.

[0009] In one implementation of the first aspect of the present invention, the smart contract includes quota management logic, supports configuring data outbound quotas by year and quarter, can dynamically adjust the quota value according to regulatory instructions, and automatically rejects subsequent data outbound requests from enterprises when the remaining quota is zero.

[0010] In one implementation of the first aspect of the present invention, the smart contract pre-determines the mandatory compliant nodes corresponding to different data types. The network relay device parses the transmission path according to the network prefix field of the SRv6 tag, so that the data transmission process strictly follows the node routing rules agreed in the contract, forming a mandatory path constraint.

[0011] In one implementation of the first aspect of the present invention, the outbound summary event also includes a record of the result of the node performing compliance processing functions during the data outbound process. The compliance processing functions are specified by the function type field of the SRv6 tag, including one or more combinations of content compliance detection, sensitive data identification, data encryption, signature encapsulation, traffic auditing, and dropping or adenoma.

[0012] In one implementation of the first aspect of the present invention, the function parameter field of the SRv6 tag is 64 bits, which is used to carry dynamic parameters corresponding to the function type field, including one or more of the following: traffic unique tag, compliance policy ID, enterprise user ID or encryption key index. The checksum field of the SRv6 tag is 16 bits, which is used to perform integrity verification and trust verification on the entire content of the SRv6 tag to prevent the tag field from being tampered with during data transmission.

[0013] Secondly, the present invention provides a data cross-border flow control system based on blockchain smart contracts.

[0014] A data cross-border flow control system based on blockchain smart contracts includes: The quota information on-chain unit is configured as follows: after a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type and recipient qualification information are written into the blockchain contract to form an on-chain quota master table. The outbound request triggering and information acquisition unit is configured to: when a domestic enterprise initiates a specific data outbound request, trigger a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining outbound quota, the data types allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The multi-dimensional compliance verification unit is configured as follows: the smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient and the on-chain filing information, and verifies whether the data type of this outbound transmission is within the allowed range and whether the remaining quota meets the requirements of this transmission. The SRv6 tag generation and configuration unit is configured to: after verification, generate an SRv6 tag containing a network prefix field, a function type field, a function parameter field and a check code field based on the preset SRv6 tag configuration; and specify the data outbound transmission path, the compliance processing functions that the node needs to perform and the corresponding dynamic parameters through the SRv6 tag. The quota reduction and outbound information on-chain unit is configured as follows: the smart contract automatically reduces the quota corresponding to this outbound data, and writes the time, quantity, type, recipient identifier and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; The regulatory compliance audit unit is configured so that regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

[0015] Thirdly, the present invention provides a computer device, comprising: a processor and a computer-readable storage medium; A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the data cross-border flow control method based on blockchain smart contracts of the first aspect of the present invention.

[0016] Fourthly, the present invention provides a computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed by the data cross-border flow control method based on blockchain smart contracts of the first aspect of the present invention.

[0017] Fifthly, the present invention provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the data cross-border flow control method based on blockchain smart contracts of the first aspect of the present invention.

[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention writes the application for cross-border data quotas and types by domestic enterprises into a blockchain contract after approval by regulators, forming an on-chain quota master table. When an enterprise initiates a specific cross-border request, a smart contract is triggered to obtain the remaining quota, allowed data types, and SRv6 tag configuration. After multi-dimensional verification of the enterprise's license, recipient's identity, data type, and quota, an SRv6 tag with specified fields is generated to clarify the transmission path and node compliance function. The quota is automatically reduced, and the cross-border summary event is uploaded to the chain. Regulators complete the audit by accessing the on-chain records through the module. This solves the core problem of traditional cross-border data supervision relying on post-audit or centralized systems, overcomes the shortcomings of tampering risk, poor timeliness, regulatory blind spots, and inefficiency of manual approval, improves the controllability, traceability, and compliance review efficiency of the entire cross-border data process, avoids process delays caused by illegal enterprise transmission, log tampering, and manual intervention, and realizes the transformation of supervision from passive post-event accountability to proactive real-time control.

[0019] This invention sets the network prefix field of the SRv6 tag to 32 bits. This field identifies the target network domain and clarifies the data outbound traffic path, distinguishing between non-cross-border transmission paths, cross-border transmission paths, and sensitive area transmission paths based on different network prefixes. This solution solves the problems of vague control over traditional data outbound transmission paths and the inability to accurately distinguish transmission needs in different scenarios. It overcomes the shortcomings of insufficient compliance risk prevention caused by transmission path confusion, improves the accuracy of data outbound transmission path identification and control, and avoids data being sent to non-compliant paths due to unclear path division. It ensures that different types of data (such as non-cross-border data, cross-border data, and sensitive area-related data) can be transmitted along the preset compliant path, laying the path foundation for subsequent nodes to perform corresponding compliance processing functions.

[0020] This invention embeds quota management logic into smart contracts, supporting the configuration of data outbound quotas on an annual or quarterly basis. It can dynamically adjust quota values ​​based on regulatory instructions and automatically reject subsequent data outbound requests from enterprises when the remaining quota is zero. This solution solves the problem of traditional cross-border data supervision lacking dynamic quota control methods, overcoming the enforcement vacuum caused by manual intervention to interrupt transmission or "operation with defects" after quotas are exhausted. It improves the automation and flexibility of data outbound quota control, avoiding compliance risks caused by enterprises exceeding quota limits or untimely manual intervention. It upgrades quotas from static presets to dynamic adjustments and from manual monitoring to automatic control, adapting to quota management needs under different cycles and regulatory requirements.

[0021] This invention pre-defines mandatory compliance nodes corresponding to different data types within smart contracts. Network relay devices parse the transmission path based on the network prefix field of the SRv6 tag, ensuring that data transmission strictly follows the node routing rules agreed upon in the contract, forming a mandatory path constraint. This solution solves the problem of traditional data outbound transmission potentially bypassing approval interfaces and flowing out of the country through gray channels. It overcomes the inability to intercept illegal outbound transmission at the "execution point," improves the compliance and incorruptibility of data transmission paths, avoids the risk of sensitive data bypassing compliance nodes for illegal outbound transmission, and ensures that all types of data are processed through preset compliance nodes during transmission by mandatory path constraints, blocking illegal outbound channels at the transmission link level.

[0022] This invention incorporates the result records of compliance processing functions performed by nodes during the data export process into the export summary event. The node compliance processing functions are specified by the function type field of the SRv6 tag, covering a combination of functions such as content compliance detection and sensitive data identification. This solution addresses the problems of traditional data export audits lacking records of node compliance processing results and having incomplete audit evidence chains. It overcomes the shortcomings of regulatory agencies in tracing and holding accountable node processing behaviors, improves the comprehensiveness and evidentiary validity of data export audits, and avoids situations where the lack of node processing result records leads to audits failing to cover the entire process and making it difficult to locate violations. It provides regulators with a traceable basis for verifying whether nodes have performed compliance functions as required.

[0023] This invention sets the functional parameter field of the SRv6 tag to 64 bits to carry dynamic parameters such as traffic tag and policy ID, and sets the checksum field to 16 bits to perform integrity verification and trust verification of the entire tag content. This solution solves the problems of insufficient functional parameter transmission and easy tag tampering in traditional data export, overcomes the defects of poor functional adaptability and low tag trust, improves the diversity and security of SRv6 tag functions, avoids the risk of nodes failing to accurately execute compliance functions due to insufficient parameters, and avoids the risk of transmission paths or functional instructions failing due to tag tampering, ensuring that the tag can flexibly adapt to different compliance processing requirements while maintaining the integrity and trust of its own content, and ensuring the accurate transmission and execution of functional instructions during data export.

[0024] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0025] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0026] Figure 1A current cross-border data flow framework diagram provided as an exemplary embodiment of the present invention; Figure 2 A current data outbound business process diagram provided as an exemplary embodiment of the present invention; Figure 3 A data export business process diagram based on smart contract + SRv6 technology is provided as an exemplary embodiment of the present invention; Figure 4 A diagram illustrating an outbound compliance audit architecture based on smart contracts, provided as an exemplary embodiment of the present invention. Figure 5 A design effect diagram of a tag field based on SRv6 technology is provided as an exemplary embodiment of the present invention; Figure 6 A flowchart of a data export compliance audit based on smart contract technology is provided as an exemplary embodiment of the present invention. Figure 7 A schematic diagram of a cross-border data flow control system based on blockchain smart contracts, provided as an exemplary embodiment of the present invention; Figure 8 A schematic diagram of a computer device provided for an exemplary embodiment of the present invention. Detailed Implementation

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0028] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0029] Figure 1 This document illustrates a current framework for cross-border data transfer, specifically including: A business system initiates a data transfer declaration and assessment request, submitting it to a data compliance assessment service platform for review. After professional assessment, the service platform issues a transfer permit to the business system, authorizing it to conduct cross-border data transmission. Subsequently, the business system conducts data transfer activities based on the permit, transmitting compliant data to overseas business systems through the enterprise's network exit to support overseas business operations. After data transfer is completed, a post-transfer audit is required to verify compliance; however, in practice, auditing difficulties may arise (such as difficulties in data traceability and complex cross-border evidence collection), which may affect the effectiveness of enterprise network exit supervision and risk management. The entire process must ensure a complete and seamless connection between the declaration and assessment, permit issuance, transmission execution, and audit closed loop to meet the compliance requirements of cross-border data flows.

[0030] From a technical point of view, such as Figure 2As shown, the existing data export business scheme follows strict process management: First, enterprises need to complete preliminary work such as data export assessment, declaration and contract filing (Step 1) to ensure the compliance of the exported data and form complete declaration materials; then, it is submitted to the competent authorities such as the Cyberspace Administration and the Management Committee for review (Step 2), which conduct technical assessment of the data type, security measures and necessity; after the review is approved, the competent authorities issue an export license (Step 3), clarifying the legal authority for data export; enterprises carry out actual data export activities with the license (Step 4), including technical operations such as data transmission, storage and cross-border flow; finally, the competent authorities such as the Cyberspace Administration and the Management Committee conduct post-event supervision of the entire data export process through audit activities (Step 5), verifying whether the data use complies with the declared content and legal and regulatory requirements, forming a closed-loop management of the entire process.

[0031] As can be seen, the above solutions have the following problems: As shown in the figure above, the disadvantages of the current technical solutions are as follows: (1) The authenticity of the data reported by enterprises cannot be verified. The current mechanism is based on the premise of enterprises actively reporting. Enterprises fill in the types, quantities, paths, and uses of outbound data. It is difficult and complicated for regulatory agencies to verify whether the reported data is consistent with the actual outbound behavior. There are behaviors such as malicious underreporting, omission, false reporting, and selective reporting, which have certain regulatory blind spots; (2) The log audit mechanism is missing or cannot be traced for a long time. It is inconsistent with the log capabilities of the enterprise's outbound system and cannot meet the basic requirements of auditability and traceability. It is also easy to be deleted or tampered with by technical means. The lack of "tamper-proof technology" makes it difficult for regulatory agencies to implement "behavioral evidence collection", "post-event audit", "accountability for violations"; (3) The review process involves a lot of manual intervention and is inefficient. The current outbound filing or assessment process generally requires manual uploading of materials, approval documents, and stamping for filing, which takes several days to several months, which restricts the development of high-frequency data trading scenarios. For example, each free trade zone needs to assess the data export filing of hundreds of systems, which is complicated and has high personnel costs; (4) There is no dynamic quota control method, and there is a lack of refined control methods such as "real-time quota verification method", "use of over-limit freezing technology" and "data transmission content verification mechanism". Once the quota is exhausted, it is often only possible to manually intervene to interrupt data transmission or "operate with defects", resulting in a serious law enforcement vacuum; (5) It is impossible to intercept illegal export at the "execution point" in time. Currently, compliance verification occurs in "pre-declaration" or "post-accountability", rather than in "data export action", and it is impossible to implement disposal actions when illegal events occur. The lack of "pre-contract + permission control" mechanism leads to sensitive information being able to bypass the approval interface and flow out of the country through gray channels.

[0032] In view of the problems existing in the current solution, this implementation proposes a method for controlling cross-border data flow based on blockchain smart contracts, such as... Figure 3 As shown, the process includes the following: Step 1: Domestic enterprises initiate data export requests; Step 2: Obtain information such as the type and quota of data exported by calling the API. This information is written into the blockchain contract after being approved by the regulator, forming a quota master table. Step 3: Check whether the company's exit permit matches its overseas identity; Step 4: Verify the outbound identity, outbound data type, and outbound data limit by checking the on-chain contract; Step 5: The smart contract automatically reduces the credit limit, records summary information such as the quantity, time, type, and recipient of the outbound data, and specifies the encryption and auditing device for the outbound data through the SRv6 tag to achieve secure and reliable outbound business data transfer; Step Six: Regulatory nodes can audit all outbound activities through on-chain logs to ensure their legality and compliance.

[0033] like Figure 4 The diagram shows the overall architecture of the system of this invention, including key systems such as a data export detection platform, a unit data export business system, a data export compliance business system, a data export encryption system, and an international export audit system. These systems verify and control data through contract calls and on-chain data digests. More specifically, firstly, when a unit business system initiates a data export transaction, it must submit a data export declaration and compliance assessment to the data export monitoring platform. The monitoring platform supervises the entire process and achieves full-process coverage monitoring through dotted lines. During the business execution phase, the data export compliance business system conducts self-checks on the export data for compliance and adds an SRv6 export tag to the data packet. Subsequently, the export data encryption system performs secure encryption on the data based on the SRv6 tag, ensuring data security during transmission. As a data export channel, the enterprise network exit transmits encrypted data to overseas business systems. In the international export process, the international export audit system conducts compliance audits on the exported data based on SRv6 tags to ensure that the data export complies with regulatory requirements. Throughout the entire enterprise data export process, the data export monitoring platform continuously monitors the unit's business systems, compliant business systems, encrypted systems, and network exits across the entire chain, and receives export route quota information to achieve risk warning and dynamic control. This process constructs a monitoring and management system covering the entire lifecycle of data export through four core links: declaration and assessment, compliance testing, tag encryption, and export audit.

[0034] This invention digitizes and automates traditional regulatory business logic by embedding it into blockchain smart contracts, enabling on-chain execution of a pre-approval mechanism for data export. Previously, manual approval or offline filing was significantly delayed and easily circumvented. This invention designs data export operations to be triggered only through a smart contract interface, making each data export an "unavoidable" node in the compliance chain. The contract verifies the enterprise's identity, data type, remaining quota, and recipient's qualifications; only when these conditions are met can the transaction be successfully initiated, establishing an "access-based export channel" that significantly improves compliance rates and prevents illegal transmission.

[0035] This invention ensures the tamper-proof nature of outbound data and achieves full-process traceability. Every outbound data transaction (including call time, data type, quantity, recipient identifier, etc.) is recorded as a contract event. All records are written into the blockchain ledger, making them tamper-proof and non-repudiable. It provides audit and statistical interfaces, allowing regulators to obtain real-time overviews of enterprise outbound behavior, and provides a "technically provable" regulatory evidence chain, supporting law enforcement tracing, administrative accountability, and statistical reporting.

[0036] This invention realizes automated quota management driven by smart contracts, embedding annual / quarterly data outbound quotas and data type counting mechanisms into the contracts; it automatically deducts and compares data in real time, supports dynamic adjustment of quotas, and can automatically reject outbound operations when the quota is exhausted, automatically replacing regulatory authorities in quota monitoring and execution, improving efficiency and preventing over-limit violations.

[0037] This invention offers flexible deployment and adaptability to various scenarios. The system can be deployed in industry regulatory chains, free trade zone local chains, etc. Subsequently, audit data can be connected and reported to regulatory nodes to achieve regulatory data sharing. Combined with flexible SRv6 tagging technology, it enables flexible, controllable, and auditable data export paths. Specific tag designs are as follows... Figure 5 As shown, the first 32 bits maintain network routableness, the middle 16+64 bits provide functions and parameters to realize the business orchestration mechanism, and the last 16 bits ensure the security and trustworthiness of the tag content.

[0038] First, the network prefix field specifies the network area to which the SRv6 node belongs, which is used for fast routing and location across the entire network. Different service paths (such as non-cross-border, cross-border, and sensitive areas) can be directly distinguished by different prefixes. Secondly, the function type field defines the type of operation performed by the SRv6 node. Specific functions may include: detection functions, such as content compliance detection and sensitive data identification; encryption functions, which trigger security actions such as data encryption, signing, and encapsulation; auditing functions, such as international export-side auditing systems, which record outbound traffic metadata for subsequent verification; and blocking / rate limiting functions, which execute drop or rate limiting policies on non-compliant or abnormal traffic. Furthermore, the function parameter field provides additional parameters or context information for the function type, enabling SRv6 tags to not only specify functions but also dynamically implement specific business strategies, thus enriching the diversity of tag functions. Finally, the verification code field ensures the integrity and trustworthiness of the tag field itself, preventing the tag from being tampered with midway (e.g., the operator or attacker modifying the functional parameters in the path). Combined with smart contracts, it achieves non-repudiation of the tag and contract terms.

[0039] In this implementation, the integration mechanism of SRv6 technology and smart contracts is as follows: Figure 6 As shown, the network prefix in the SRv6 tag determines that the data flow must pass through designated audit or security nodes. The smart contract pre-defines "which data types must pass through which nodes," and network forwarding must comply with the contract, forming a mandatory path constraint. The smart contract solidifies this processing instruction on the blockchain and specifies the execution logic corresponding to different parameters. When data arrives at a node, the device parses the SRv6 field, calls the local contract engine, or queries the contract execution result to achieve automated compliance processing. More specifically, when enterprises initiate cross-border business requests through their business systems, they need to use the enterprise's outbound "wallet" and outbound compliance detection system to complete preliminary preparations. The business application is supported by the blockchain network, and the process starts from the initial block #0 and enters the enterprise outbound application stage at block #1. At this time, the system simultaneously transmits the application information to the regulatory authorities for regulatory approval and sends block information to the international compliance audit system to verify the outbound data content; after approval, the blockchain network enters the block #2 stage, issuing the outbound path and execution strategy. In the transaction execution stage, block #3 uses the smart contract to perform the transaction smart contract deduction operation. This step incorporates a transaction verification mechanism to check the remaining quota in real time: if the quota is sufficient, the smart contract continues to deduct funds; if the quota is insufficient, an "insufficient quota" message is generated via an event trigger and fed back to the blockchain strategy adjustment module; block #4 further implements the smart contract quota deduction rules to ensure transaction compliance. Throughout the process, the international compliance audit system continuously acquires information from each stage of the blockchain, cross-verifies the content of outbound data, and forms a closed-loop regulatory system. The combination of regulatory approval results and the automated execution of smart contracts ensures both business efficiency and compliance requirements, ultimately achieving secure and controllable processing of the company's cross-border business.

[0040] Figure 7 A data cross-border flow control system based on blockchain smart contracts is shown, including: The quota information on-chain unit 701 is configured as follows: after a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type and recipient qualification information are written into the blockchain contract to form an on-chain quota master table. The outbound request triggering and information acquisition unit 702 is configured to: when a domestic enterprise initiates a specific data outbound request, trigger a blockchain smart contract by calling the API interface, and the smart contract obtains the enterprise's remaining outbound quota, the data types allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table; The multi-dimensional compliance verification unit 703 is configured to: the smart contract performs consistency verification on the enterprise's outbound license, the identity of the overseas recipient and the on-chain filing information, and at the same time verifies whether the data type of this outbound transmission is within the allowed range and whether the remaining quota meets the requirements of this transmission. The SRv6 tag generation and configuration unit 704 is configured to: after verification, generate an SRv6 tag containing a network prefix field, a function type field, a function parameter field and a check code field based on a preset SRv6 tag configuration, and specify the data outbound transmission path, the compliance processing function to be performed by the node and the corresponding dynamic parameters through the SRv6 tag; The quota reduction and outbound information on-chain unit 705 is configured as follows: the smart contract automatically reduces the quota corresponding to this outbound data, and writes the time, quantity, type, recipient identifier and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; Regulatory compliance audit unit 706 is configured to allow regulators to access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

[0041] It is understood that the aforementioned units can be individually or entirely merged into one or more other units, or some of the units can be further divided into multiple functionally smaller units. This achieves the same operation without affecting the technical effects of the embodiments of the present invention. The aforementioned units are based on logical functional division. In practical applications, the function of one unit can be implemented by multiple units, or the function of multiple units can be implemented by one unit. In other embodiments of the present invention, the system may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented collaboratively by multiple units.

[0042] According to another embodiment of the present invention, the system of this embodiment can be constructed by running a computer program (including program code) capable of performing the steps involved in the corresponding method of the present invention on a general-purpose computing device, such as a computer, which includes processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM). The computer program can be recorded on, for example, a computer-readable recording medium, loaded into the aforementioned computing device through the computer-readable recording medium, and run therein.

[0043] Figure 8 A computer device is shown, which includes a processor 801, a communication interface 802, and a computer-readable storage medium 803. The processor 801, communication interface 802, and computer-readable storage medium 803 can be connected via a bus or other means.

[0044] The communication interface 802 is used to receive and send data. The computer-readable storage medium 803 can be stored in the memory of the electronic device. The computer-readable storage medium 803 is used to store computer programs, which include program instructions. The processor 801 is used to execute the program instructions stored in the computer-readable storage medium 803.

[0045] The processor 801 is the computing and control core of electronic devices. It is suitable for implementing one or more instructions, specifically for loading and executing one or more instructions to achieve corresponding methods or functions.

[0046] Processor 801 is configured to perform the following procedure: Once a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type, and recipient qualification information will be written into the blockchain contract to form an on-chain quota master table. When a domestic enterprise initiates a specific data export request, it triggers a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining export quota, the types of data allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient, and the on-chain filing information. It also verifies whether the data type of this outbound transaction is within the allowed range and whether the remaining quota meets the requirements of this transaction. After verification, an SRv6 tag containing a network prefix field, a function type field, a function parameter field, and a check code field is generated based on the preset SRv6 tag configuration. The SRv6 tag specifies the data transmission path for data export, the compliance processing functions that the node needs to perform, and the corresponding dynamic parameters. The smart contract automatically deducts the amount corresponding to this outbound data and writes the time, quantity, type, recipient identifier, and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; Regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

[0047] This invention also provides a computer-readable storage medium, which is a memory device in an electronic device for storing programs and data. It is understood that the computer-readable storage medium here may include both built-in storage media in the electronic device and extended storage media supported by the electronic device. The computer-readable storage medium provides storage space for storing the processing system of the electronic device.

[0048] Furthermore, this storage space also contains one or more instructions suitable for loading and execution by the processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory; alternatively, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0049] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor loads and executes the one or more instructions stored in the computer-readable storage medium to perform the following process: Once a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type, and recipient qualification information will be written into the blockchain contract to form an on-chain quota master table. When a domestic enterprise initiates a specific data export request, it triggers a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining export quota, the types of data allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient, and the on-chain filing information. It also verifies whether the data type of this outbound transaction is within the allowed range and whether the remaining quota meets the requirements of this transaction. After verification, an SRv6 tag containing a network prefix field, a function type field, a function parameter field, and a check code field is generated based on the preset SRv6 tag configuration. The SRv6 tag specifies the data transmission path for data export, the compliance processing functions that the node needs to perform, and the corresponding dynamic parameters. The smart contract automatically deducts the amount corresponding to this outbound data and writes the time, quantity, type, recipient identifier, and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; Regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

[0050] The present invention also provides a computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the following process: Once a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type, and recipient qualification information will be written into the blockchain contract to form an on-chain quota master table. When a domestic enterprise initiates a specific data export request, it triggers a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining export quota, the types of data allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient, and the on-chain filing information. It also verifies whether the data type of this outbound transaction is within the allowed range and whether the remaining quota meets the requirements of this transaction. After verification, an SRv6 tag containing a network prefix field, a function type field, a function parameter field, and a check code field is generated based on the preset SRv6 tag configuration. The SRv6 tag specifies the data transmission path for data export, the compliance processing functions that the node needs to perform, and the corresponding dynamic parameters. The smart contract automatically deducts the amount corresponding to this outbound data and writes the time, quantity, type, recipient identifier, and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; Regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

[0051] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can implement the described functions using different methods for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0052] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic cable, digital cable) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data processing device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0053] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for controlling cross-border data flows based on blockchain smart contracts, characterized in that, Includes the following processes: Once a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type, and recipient qualification information will be written into the blockchain contract to form an on-chain quota master table. When a domestic enterprise initiates a specific data export request, it triggers a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining export quota, the types of data allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient, and the on-chain filing information. It also verifies whether the data type of this outbound transaction is within the allowed range and whether the remaining quota meets the requirements of this transaction. After verification, an SRv6 tag containing a network prefix field, a function type field, a function parameter field, and a check code field is generated based on the preset SRv6 tag configuration. The SRv6 tag specifies the data transmission path for data export, the compliance processing functions that the node needs to perform, and the corresponding dynamic parameters. The smart contract automatically deducts the amount corresponding to this outbound data and writes the time, quantity, type, recipient identifier, and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; Regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

2. The data cross-border flow control method based on blockchain smart contracts as described in claim 1, characterized in that, The network prefix field of the SRv6 tag is 32 bits, which is used to identify the target network domain and clarify the traffic path of data leaving the country. Different network prefixes are used to distinguish between non-cross-border transmission paths, cross-border transmission paths and transmission paths in sensitive areas.

3. The data cross-border flow control method based on blockchain smart contracts as described in claim 1, characterized in that, The smart contract includes quota management logic, supports configuring data outbound quotas on an annual or quarterly basis, can dynamically adjust quota values ​​according to regulatory instructions, and automatically rejects subsequent data outbound requests from enterprises when the remaining quota is zero.

4. The data cross-border flow control method based on blockchain smart contracts as described in claim 1, characterized in that, The smart contract pre-defines the mandatory compliant nodes corresponding to different data types. The network relay device parses the transmission path based on the network prefix field of the SRv6 tag, so that the data transmission process strictly follows the node routing rules agreed in the contract, forming a mandatory path constraint.

5. The data cross-border flow control method based on blockchain smart contracts as described in claim 1, characterized in that, The outbound summary event also includes the result record of the node performing compliance processing functions during the data outbound process. The compliance processing functions are specified by the function type field of the SRv6 tag, including one or more combinations of content compliance detection, sensitive data identification, data encryption, signature encapsulation, traffic auditing, and discarding or limiting traffic.

6. The data cross-border flow control method based on blockchain smart contracts as described in claim 1, characterized in that, The SRv6 tag's function parameter field is 64 bits, used to carry dynamic parameters corresponding to the function type field, including one or more of the following: traffic unique tag, compliance policy ID, enterprise user ID, or encryption key index. The SRv6 tag has a 16-bit checksum field, which is used to perform integrity verification and trust verification on the overall content of the SRv6 tag, preventing the tag field from being tampered with during data transmission.

7. A data cross-border flow control system based on blockchain smart contracts, characterized in that, include: The quota information on-chain unit is configured as follows: after a domestic enterprise initiates an application for data export quota and data type through the enterprise application module, and the regulatory authority approves the application, the data export quota, data type and recipient qualification information are written into the blockchain contract to form an on-chain quota master table. The outbound request triggering and information acquisition unit is configured to: when a domestic enterprise initiates a specific data outbound request, trigger a blockchain smart contract by calling the API interface. The smart contract obtains the enterprise's remaining outbound quota, the data types allowed to be exported, and the preset SRv6 tag configuration information from the on-chain quota table. The multi-dimensional compliance verification unit is configured as follows: the smart contract verifies the consistency between the enterprise's outbound license, the identity of the overseas recipient and the on-chain filing information, and verifies whether the data type of this outbound transmission is within the allowed range and whether the remaining quota meets the requirements of this transmission. The SRv6 tag generation and configuration unit is configured to: after verification, generate an SRv6 tag containing a network prefix field, a function type field, a function parameter field and a check code field based on the preset SRv6 tag configuration; and specify the data outbound transmission path, the compliance processing functions that the node needs to perform and the corresponding dynamic parameters through the SRv6 tag. The quota reduction and outbound information on-chain unit is configured as follows: the smart contract automatically reduces the quota corresponding to this outbound data, and writes the time, quantity, type, recipient identifier and SRv6 tag execution result of this outbound data as an outbound summary event into the blockchain ledger; The regulatory compliance audit unit is configured so that regulators can access outbound summary events and quota usage records on the blockchain in real time or offline through the regulatory audit module to complete the compliance audit of data outbound behavior.

8. A computer device, characterized in that, include: Processor and computer-readable storage media; A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, implements the data cross-border flow control method based on blockchain smart contracts as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the data cross-border flow control method based on blockchain smart contracts as described in any one of claims 1 to 6.

Images