Data management system

Abstract

This application discloses a data management system, relating to the field of data security technology. The system includes: a data sending node and a blockchain node associated with the data sending node; a first transmission channel and a second transmission channel are configured in parallel between the data sending node and the blockchain node; a verification unit and a carrier virtual machine for storing transmitted data are configured on the first transmission channel, and a verification virtual machine for storing verification information corresponding to the verification unit is configured on the second transmission channel; an association is established between the carrier virtual machine and the verification virtual machine; when the data sending node sends transmitted data to the blockchain node through the carrier virtual machine and passes through the first verification unit, the first verification unit obtains the first verification information corresponding to the first verification unit in the verification virtual machine and performs security verification to perform data transmission operations based on the security verification result. This improves the security of data during the process from the sending end to the blockchain node.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically to a data management system. Background Technology

[0002] With the widespread application of digital technologies, the collection, transmission, and storage of various types of data have become core components of information systems. To ensure the authenticity, integrity, and immutability of data, blockchain technology, with its decentralized, traceable, and tamper-proof characteristics, is widely used in trusted data storage scenarios.

[0003] Currently, blockchain-based data transmission solutions typically involve the data sender directly uploading data to the corresponding blockchain node for on-chain storage. However, data is vulnerable to illegal interception, tampering, or loss during transmission, posing a significant security risk. Summary of the Invention

[0004] This application provides a data management system to solve the problem that data is easily intercepted, tampered with, or lost in related technologies. By setting up an architecture with dual parallel transmission channels, dual virtual machine linkage, and multi-verification unit hierarchical verification, dynamic security control and anomaly blocking of the data transmission process are realized, ensuring that data is securely and legally stored on the blockchain.

[0005] In a first aspect, embodiments of this application provide a data management system, the system comprising:

[0006] Data sending nodes and blockchain nodes associated with the data sending nodes; The data sending node and the blockchain node are connected in parallel via a first transmission channel and a second transmission channel. The first transmission channel is equipped with at least one verification unit and a carrier virtual machine for storing transmission data. The second transmission channel is equipped with a verification virtual machine for storing at least one verification information corresponding to at least one verification unit. The carrier virtual machine and the verification virtual machine are associated with each other. When a data sending node sends transmission data to a blockchain node through a carrier virtual machine, and the carrier virtual machine carries the transmission data through a first verification unit, the first verification unit obtains the first verification information corresponding to the first verification unit in the verification virtual machine, and performs security verification based on the first verification information, so as to perform data transmission operation according to the security verification result. The first verification unit is any verification unit among at least one verification unit.

[0007] In some embodiments, the carrier virtual machine is provided with at least one storage space, and the transmitted data is distributed and stored in the at least one storage space according to a preset rule, and the at least one storage space is associated with at least one verification information in the verification virtual machine.

[0008] In some embodiments, at least one verification information is stored sequentially in the verification virtual machine based on the order in which at least one verification unit is set along the transmission direction on the first transmission channel.

[0009] In some embodiments, at least one verification unit is set in the first transmission channel based on the transmission stage of the transmitted data.

[0010] In some embodiments, the data transmission operation based on the security verification result includes: if the security verification result indicates that the security verification has passed, unlocking the first verification unit to allow the carrier virtual machine to carry the transmission data along the first transmission channel; if the security verification result indicates that the security verification has failed, maintaining the locked state of the first verification unit to prevent the carrier virtual machine from passing through the first verification unit.

[0011] In some embodiments, the carrier virtual machine has a built-in data statistics module, which is used to count the amount of data or the number of data packets transmitted in at least one storage space and obtain statistical results.

[0012] In some embodiments, the data statistics module compares the statistical results obtained with a preset baseline data volume to obtain a data comparison result; if the data comparison result indicates that the amount of transmitted data in the first storage space has changed, it determines that the second verification information corresponding to the first storage space is invalid, wherein the first storage space is any one of at least one storage space.

[0013] In some embodiments, the carrier virtual machine has a built-in hash verification module. The hash verification module is used to determine the real-time hash value of the transmitted data in at least one storage space, and compare the real-time hash value with the original hash value of the transmitted data to obtain a hash comparison result. If the hash comparison result indicates that the first real-time hash value of the transmitted data in the first storage space is inconsistent with the first original hash value, it is determined that the transmitted data in the first storage space has been tampered with, so as to determine that the second verification information corresponding to the first storage space is invalid.

[0014] In some embodiments, if the security verification result indicates that the security verification has failed, after maintaining the locked state of the first verification unit, the process includes: the data sending node retrieving the original backup data of the transmitted data and reloading it into the carrier virtual machine, and sending the original backup data to the blockchain node through the carrier virtual machine until the carrier virtual machine passes the first verification unit and reaches the blockchain node.

[0015] In some embodiments, when a blockchain node successfully receives the transmitted data, the transmitted data is stored in the target block on the blockchain corresponding to the blockchain node, and the on-chain timestamp of the transmitted data and the hash value of the previous blockchain block corresponding to the transmitted data are recorded.

[0016] This application provides a data management system that establishes a first transmission channel and a second transmission channel in parallel between the data sending node and the blockchain node. The first transmission channel houses a verification unit and a carrier virtual machine for storing transmitted data, while the second transmission channel houses a verification virtual machine for storing verification information corresponding to the verification unit. An association is established between the carrier virtual machine and the verification virtual machine. When the carrier virtual machine carries transmitted data through the verification unit, the verification unit obtains the corresponding verification information from the verification virtual machine for security verification and controls the data transmission operation based on the verification result. Compared to related technologies where data is directly sent and easily intercepted or tampered with, this application introduces a dual-channel parallel verification mechanism during transmission, achieving real-time security verification of transmitted data. This mechanism can promptly detect and block data tampering or illegal interception, ensuring the originality and integrity of the data transmitted to the blockchain node, significantly improving the security of data from the sending end to the blockchain node.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are merely embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort, and this application can be applied to other similar scenarios based on the provided drawings.

[0019] Figure 1 A schematic diagram of a data management system provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating a specific data management method based on a data management system, as provided in an embodiment of this application. Detailed Implementation

[0020] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. The described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0021] It should be noted that the terms "system," "device," "unit," and / or "module" used in this application are methods of distinguishing different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they can be replaced by other expressions.

[0022] Hereinafter, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first," "second," or "third" may explicitly or implicitly include one or more of that feature.

[0023] With the widespread application of digital technologies, the collection, transmission, and storage of various types of data have become core components of information systems. To ensure the authenticity, integrity, and immutability of data, blockchain technology, with its unique characteristics such as decentralization, traceability, and tamper-resistance, is widely used in various trusted data storage scenarios.

[0024] Currently, blockchain-based data transmission solutions typically involve the data sender directly uploading data to the corresponding blockchain node for on-chain storage. These solutions mostly use a single transmission channel for data transmission, with the blockchain node only storing and verifying the received data. This lack of real-time security control over the entire data transmission process presents significant security vulnerabilities.

[0025] Specifically, the above data transmission method has the following drawbacks: data is easily intercepted, tampered with, or lost in the transmission link; due to the lack of multi-level verification and dynamic security verification mechanisms during transmission, it is impossible to detect abnormal situations in the data transmission process in a timely manner, thus making it difficult to guarantee the integrity, legality, and security of the final data uploaded to the blockchain, and failing to meet the data transmission and storage requirements in high-security scenarios.

[0026] Taking the data management of intangible cultural heritage (ICH) as an example, ICH, as a precious carrier of human civilization's memory, faces new opportunities and challenges in its protection and inheritance in the digital age. ICH digitization, leveraging advanced technologies, is gradually becoming a core path to solving traditional ICH protection problems and achieving its sustainable inheritance. By conducting high-precision digital collection and structured processing of multi-dimensional data contained in ICH, including written records, visual images, sound recordings, and dynamic demonstrations, a "digital cultural gene bank" of ICH that transcends time and space can be constructed. This digital storage method not only effectively overcomes the limitations of traditional physical carriers, which are easily damaged and difficult to preserve for long periods, but also enables the sustainable preservation and convenient dissemination of ICH culture through various technological means.

[0027] In the context of intangible cultural heritage (ICH) data management, related technologies also leverage the decentralized and tamper-proof characteristics of blockchain systems to store ICH data on the blockchain for trusted preservation. However, during the process of uploading ICH data from the applicant to the blockchain node, the same security issues as with general data transmission still exist. Data is easily intercepted illegally and is at risk of being lost or tampered with. Furthermore, the current lack of a robust security verification mechanism during ICH data transmission makes it impossible to guarantee the legality and integrity of the ICH data ultimately transmitted to the blockchain, thus failing to meet the core requirements for ICH data security protection.

[0028] To address the issues of data transmission vulnerability to interception and tampering, and the lack of real-time security verification in the aforementioned related technologies, this application proposes a data management system. This system establishes parallel dual transmission channels between the data sending node and the blockchain node. The first transmission channel deploys a carrier virtual machine carrying the transmitted data and a multi-level verification unit, while the second transmission channel deploys a verification virtual machine with corresponding verification information. These carrier virtual machines and verification virtual machines are then linked and bound together. During data transmission, the verification unit matches and verifies the verification information. When abnormal data changes occur, the associated verification information becomes invalid, blocking transmission. This achieves dynamic security control and anti-tampering / anti-interception protection throughout the entire data transmission process, ensuring secure and legitimate on-chain storage of data.

[0029] The data management system provided in this application will be described in detail below with reference to the accompanying drawings.

[0030] Figure 1 A schematic diagram of a data management system provided in an embodiment of this application is shown. Figure 1 As shown, the system includes: Data sending nodes and blockchain nodes associated with the data sending nodes; The data sending node and the blockchain node are connected in parallel via a first transmission channel and a second transmission channel. The first transmission channel is equipped with at least one verification unit and a carrier virtual machine for storing transmission data. The second transmission channel is equipped with a verification virtual machine for storing at least one verification information corresponding to at least one verification unit. The carrier virtual machine and the verification virtual machine are associated with each other. When a data sending node sends transmission data to a blockchain node through a carrier virtual machine, and the carrier virtual machine carries the transmission data through a first verification unit, the first verification unit obtains the first verification information corresponding to the first verification unit in the verification virtual machine, and performs security verification based on the first verification information, so as to perform data transmission operation according to the security verification result. The first verification unit is any verification unit among at least one verification unit.

[0031] In some embodiments, a data sending node refers to the source device or system that initiates data transmission, such as a terminal of an intangible cultural heritage application unit, used to upload intangible cultural heritage-related data to the blockchain network. A blockchain node refers to a server or computer constituting the blockchain network, responsible for receiving, verifying, and storing data, and participating in the blockchain consensus mechanism. In this application, each data sending node has a one-to-one corresponding blockchain node.

[0032] This application constructs a blockchain network by identifying the applicant entities that need to upload data to blockchain nodes and establishing a communication connection between the applicant entities and the blockchain nodes. Specifically, this application can configure a corresponding cloud server as its dedicated blockchain node for each applicant entity that submits multiple intangible cultural heritage data; then, multiple blockchain nodes are interconnected through network protocols to form a complete blockchain network.

[0033] The application information includes details about the applicants for intangible cultural heritage projects at the district / county, city, and provincial levels, such as the unit name, type of intangible cultural heritage, and project number. Based on this information, an application entity is registered. Each application entity is assigned a corresponding cloud server as a blockchain node, and multiple blockchain nodes are interconnected via a network protocol to form a blockchain. This network protocol can be a P2P (peer-to-peer) protocol, gRPC (remote procedure call protocol), or libp2P (a general P2P framework), etc.

[0034] This blockchain can reliably record the data of the applicant from the application and review of intangible cultural heritage data to the final approval, realize the decentralized storage and immutability of data, and ensure the authenticity and integrity of intangible cultural heritage data throughout the entire process.

[0035] In some embodiments, this application achieves real-time secure monitoring of the data transmission process by establishing a linkage verification mechanism between the data sending node and the blockchain node.

[0036] In this application, two transmission channels are set up in parallel between the data sending node and the blockchain node: a first transmission channel and a second transmission channel. The first transmission channel is the main data transmission channel (also known as the main channel), used to carry actual business data, such as intangible cultural heritage project materials such as text, images, and audio. The second transmission channel is an auxiliary control channel (also known as a guidance channel), set up in parallel with the first transmission channel, used to transmit verification data to achieve secure verification of the data transmission process.

[0037] The first transmission channel is equipped with a carrier virtual machine and at least one verification unit. The carrier virtual machine (also known as a trace packet) is a virtualized container or software entity running on the first transmission channel, used to carry, encapsulate, and transmit specific business data. This carrier virtual machine is located in the first transmission channel near the data sending node. The verification unit is a logical checkpoint or verification node (also known as a gate) set up on the first transmission channel, equivalent to a "door" in the data channel. Each verification unit corresponds to a transmission stage or position and must be correctly opened to allow data to pass through.

[0038] A verification virtual machine (also known as a boot point) is deployed on the second transmission channel. This verification virtual machine runs as a virtualized container or software entity on the second transmission channel and is located in a fixed position. It pre-stores verification information that corresponds one-to-one with each verification unit on the first transmission channel. The verification information is a verification credential (also known as an unlock code) stored in the verification virtual machine. Each piece of verification information corresponds to a verification unit, which is equivalent to the "key" or "password" to unlock that verification unit.

[0039] A correlation is established between the carrier virtual machine and the verification virtual machine. This correlation is a pre-established logical mapping with dual functions: First, when the carrier virtual machine passes through any verification unit on the first transmission channel, it can accurately locate and obtain the verification information corresponding to that verification unit in the verification virtual machine based on this mapping, ensuring the accurate execution of the verification process. Second, this mapping binds the transmitted data stored in the carrier virtual machine with the corresponding verification information in the verification virtual machine. When the data content in any storage space within the carrier virtual machine changes, it synchronously triggers a change in the corresponding verification information in the verification virtual machine through this mapping, causing the original verification information to become invalid. Through this correlation, the system realizes a real-time linkage mechanism of "data changes, verification changes" during data transmission, providing a technical foundation for segmented verification and tamper detection.

[0040] During actual transmission, the carrier virtual machine carries the transmission data along the first transmission channel towards the blockchain node. When the carrier virtual machine passes any verification unit, the verification unit obtains the corresponding verification information from the verification virtual machine at a fixed location based on the association relationship and matches it with its own preset verification rules. If the match is successful, the verification unit unlocks, allowing the carrier virtual machine to continue transmission; if the match fails, the verification unit remains locked, interrupting data transmission. Through this linkage verification mechanism between the fixed verification source and the moving carrier, the system can detect whether the data has been tampered with in real time during data transmission. Once an anomaly is detected, it immediately blocks the transmission, ensuring that the data arriving at the blockchain node is original and complete.

[0041] To further improve transmission efficiency and the granularity of security monitoring, this application allows for multiple independent storage spaces within the carrier virtual machine. Before sending data, the system divides the complete transmission data into several parts according to preset rules (such as data type, data size, data block order, or transmission priority), and stores them in different storage spaces, achieving distributed data storage. Each storage space is associated with a specific verification information in the verification virtual machine, forming a one-space-one-verification binding structure. This design allows the verification unit to accurately retrieve the corresponding verification information through storage space indexes. Furthermore, when data in a storage space changes, only the verification information corresponding to that space becomes invalid, while other storage spaces remain unaffected. This achieves fine-grained security monitoring and fault isolation of the data, enhancing the system's fault tolerance and anti-attack capabilities. This application achieves the association between the carrier virtual machine (i.e., the tracking packet) and the verification virtual machine (i.e., the boot point) by setting an association key. This association key consists of multiple interconnected association frames, each of which is bound to a storage space within the carrier virtual machine and a corresponding unlock code within the verification virtual machine, thus forming a mapping relationship between storage space and unlock code. It should be noted that the association frame, acting as an intermediate layer, isolates direct data manipulation from security verification logic, reducing system complexity and allowing centralized management of the binding between unlock code and closing gate through the boot point, facilitating dynamic adjustment of security policies (e.g., adding or deleting closing gates without modifying the data layer logic). Furthermore, this intermediate layer design offers advantages in fault isolation and scalability: when an association frame fails, only its associated closing gate and storage space are affected, while other transmission channels continue to function normally; when adding new intangible cultural heritage data types or transmission protocols, only the mapping relationship between the association frame and the unlock code needs to be adjusted, without reconstructing the underlying architecture.

[0042] In some embodiments, the storage order of the verification information corresponds one-to-one with the setting order of the verification units on the first transmission channel. Specifically, multiple verification units are sequentially arranged along the transmission direction on the first transmission channel, arranged from the closest data sending node to the closest blockchain node; the verification information stored in the verification virtual machine is also arranged in the exact same order, that is, the verification information corresponding to the first verification unit is stored in the first position of the verification virtual machine, the verification information corresponding to the second verification unit is stored in the second position, and so on. This sequential storage mechanism allows each verification unit to complete the verification simply by directly accessing the verification information at the same position in the verification virtual machine according to its own position number, without the need for complex searching or matching, greatly improving verification efficiency, and fundamentally avoiding the problem of verification information mismatch caused by identifier tampering or search errors.

[0043] In some embodiments, the deployment location of the verification unit corresponds to the transmission stage of the transmitted data. The system divides the complete data transmission process into multiple consecutive transmission stages, such as the initial sending stage, the intermediate transmission stage, and the near-arrival stage, each stage corresponding to different security requirements and verification objectives. Based on this stage division, the verification unit is deployed at the starting point or key node of the corresponding transmission stage, ensuring that the carrier virtual machine must pass the verification of the corresponding verification unit before entering a new transmission stage. This stage-based approach to setting verification units allows the system to apply security policies of different granularities at different stages: the initial stage can focus on basic verification such as data format and sending permissions; the intermediate stage can focus on in-depth detection of data integrity and tamper-proofness; and the final stage can focus on confirmation of receiving permissions and storage eligibility. Once an anomaly occurs in the data at a certain stage, the verification unit at that stage can promptly block the transmission, preventing problematic data from entering subsequent stages. This achieves hierarchical and staged protection for the entire data transmission process, ensuring that the breach of a single verification unit does not affect overall security and avoiding the risk of single point of failure. It should be understood that the verification rules (or permission levels) used by different verification units in this application may be the same or different to achieve fine-grained access control, and this application does not make specific limitations on this.

[0044] In terms of specific verification implementation, the carrier virtual machine can have a built-in data statistics module and / or hash verification module. The data statistics module is used to count the amount of data or the number of data packets transmitted in each storage space and compare the statistical results with a preset baseline data amount. If the comparison result indicates that the amount of data in a certain storage space has changed (i.e., the real-time data amount or number of data packets in the statistical result is greater than or equal to the baseline data amount), then the verification information corresponding to that storage space is determined to be invalid. The hash verification module is used to calculate the real-time hash value of the data transmitted in each storage space and compare it with the original hash value. If the comparison result indicates a discrepancy, then it is determined that the transmitted data in that storage space has been tampered with, and thus the corresponding verification information is determined to be invalid. These two detection mechanisms can be used individually or in combination, providing multiple safeguards for data change detection.

[0045] When a security verification failure leads to a transmission interruption, the data management system of this application can also support a retransmission mechanism. That is, the data sending node retrieves the original backup data of the transmitted data, reloads it into the carrier virtual machine, and retransmits the data to the blockchain node through the carrier virtual machine until the carrier virtual machine successfully passes all verification units and reaches the blockchain node.

[0046] After the blockchain node successfully receives the transmitted data, the data management system of this application can also store the transmitted data in the target block on the blockchain corresponding to the blockchain node, and record the on-chain timestamp of the transmitted data and the hash value of the previous blockchain block corresponding to the transmitted data, thereby completing the secure on-chain storage of data.

[0047] Specifically, such as Figure 2 As shown, this application provides a schematic diagram of a specific data management method based on a data management system. (Refer to...) Figure 2 This system sets up a main channel and a guiding channel in parallel between the applicant and the blockchain nodes. The intangible cultural heritage data to be transmitted (such as text and images) first enters the tracking packet (i.e., the carrier virtual machine) in the main channel. This tracking packet is divided into multiple storage spaces, each of which has a one-to-one correspondence with the unlocking code (i.e., verification information) stored in the "KeyEnd" (i.e., the verification virtual machine) in the guiding channel (e.g., 10MB of data corresponds to index IA). During transmission, the tracking packet moves along the main channel towards the blockchain node, while the KeyEnd is set at a preset position in the guiding channel. When the tracking packet passes through the verification unit on the main channel, the corresponding unlocking code in the KeyEnd needs to be matched and verified. If the data is tampered with during transmission, resulting in changes to the data volume or content, the corresponding unlocking code will become invalid, the verification unit will refuse passage and send a retransmission command, interrupting the transmission; if the verification is successful, the tracking packet successfully reaches the blockchain node for distributed storage.

[0048] For ease of understanding, the following uses the intangible cultural heritage data management scenario as an example to specifically explain the data management system of this application.

[0049] Suppose that an entity applying for an intangible cultural heritage project (i.e., the applicant, corresponding to the data sending node) needs to upload a set of application materials to a blockchain node for record-keeping. These application materials include: a project application form (text file, approximately 2MB), a photo of the inheritor (image file, approximately 5MB), and a demonstration video of the craft (video file, approximately 100MB).

[0050] This application establishes a first transmission channel and a second transmission channel between the applicant entity and the blockchain node. The first transmission channel has three verification units, corresponding to the initial verification stage, the intermediate verification stage, and the final verification stage. The second transmission channel deploys a verification virtual machine, which pre-stores three verification pieces of information corresponding to the three verification units, stored sequentially according to the order of the verification units.

[0051] The data sending node divides the application materials into three parts: text data is stored in storage space 1 of the carrier virtual machine, image data is stored in storage space 2, and video data is stored in storage space 3. The carrier virtual machine establishes an association with the verification virtual machine, and each storage space is bound to a verification information: storage space 1 is bound to verification information A, storage space 2 is bound to verification information B, and storage space 3 is bound to verification information C.

[0052] The carrier virtual machine carries three parts of data and moves towards the blockchain node along the first transmission channel. When it reaches the first verification unit, the verification unit obtains the first verification information (i.e., verification information A) from the verification virtual machine according to its own position, and matches it with its own preset rules to verify the format and integrity of the text data in storage space 1. After the verification is successful, the data is unlocked, allowing the carrier virtual machine to continue moving forward.

[0053] During transmission, if the image data in storage space 2 is illegally tampered with, and the data size changes from 5MB to 5.3MB, then the data size is determined to be greater than or equal to the baseline data size (e.g., 5.1MB). This change triggers a synchronous change in verification information B through the correlation relationship, causing verification information B to become invalid.

[0054] When the carrier virtual machine reaches the second verification unit, the verification unit obtains the second verification information (i.e., verification information B) from the verification virtual machine. It finds that this verification information does not match the preset rules, and the verification fails. The second verification unit remains locked, interrupts the carrier virtual machine's transmission, and the system displays the message "Data transmission failed, please re-upload."

[0055] The data sending node retrieves the locally backed-up original application materials, reloads them into the new carrier virtual machine, and restarts the transmission. During the second transmission, all data remains unaltered, and the three verification units pass verification sequentially, successfully bringing the carrier virtual machine to the blockchain node. The blockchain node extracts the complete application materials from the carrier virtual machine, creates a new block for storage, records the current timestamp, and references the hash value of the previous block, completing the data upload to the blockchain.

[0056] Afterwards, relevant personnel can use a blockchain explorer to enter the project number or the name of the inheritor to query the complete application record and on-chain information of the intangible cultural heritage project, and trace its entire process data.

[0057] To implement the aforementioned data management process, this application first requires the construction of a traction package between the applicant (corresponding data sending node) and the corresponding blockchain node. This traction package includes a main channel (corresponding to the first transmission channel) for transmitting intangible cultural heritage data, a guiding channel (corresponding to the second transmission channel) for verifying the legality of data transmission, and a guiding package.

[0058] Then, based on the binding relationships between the connecting frames in the traction packet and the storage spaces in the tracking packet (corresponding to the carrier virtual machine) transmitted on the main channel, the opening codes (corresponding to the verification information) in the guiding points (corresponding to the verification virtual machine) transmitted on the guiding channel, and the matching relationships between the opening codes and the closed gates (corresponding to the verification units) on the main channel, the transmission of intangible cultural heritage data is monitored until the data is transmitted to the corresponding cloud server (corresponding to the blockchain node). Finally, the corresponding blocks of the intangible cultural heritage data are stored in the cloud server, and the on-chain timestamp and the hash value referencing the previous block are identified.

[0059] Understandably, when applying for intangible cultural heritage (ICH) projects, the relevant applicants only need to upload the application form, photos, audio recordings, videos, and other supporting materials to the blockchain network through the applicant's portal. This information will be immediately made public to other nodes in the blockchain. As ICH protection efforts progress, the blockchain's online database can be used to conveniently and quickly update and supplement data. During the process of transmitting ICH data to blockchain nodes through the applicant's portal, the security of the data transmission must be ensured to guarantee the accuracy of the ICH data stored in the blockchain. The traction package set up in this application allows for full monitoring of ICH data during transmission until it reaches the corresponding cloud server. On the cloud server, the corresponding block of the ICH data is stored and marked with an on-chain timestamp and reference to the hash value of the previous block. Each data upload corresponds to a new block on the chain, which continues the hash value setting of the previous block. This securely records the entire process of ICH data from application to on-chain, ensuring data immutability.

[0060] The main channel serves as the primary data transmission channel, specifically used to transmit tracking packages containing intangible cultural heritage data. These tracking packages can store original materials such as text, images, and audio related to intangible cultural heritage items. The guidance channel serves as an auxiliary control channel, specifically used to transmit guidance points. These guidance points store opening codes and their core function is to verify the legality of data transmission, providing a basis for opening the closed door.

[0061] The main channel carries actual service data and must ensure high bandwidth and low latency to meet the transmission requirements of large files (such as videos and high-definition images). The guide channel only transmits control commands (such as enabling encoding), has lower real-time requirements, but must have high security to prevent control signals from being illegally tampered with.

[0062] In this application, the specific differences in the manifestations of the main channel and the pilot channel are as follows: 1) Visibility of data transmission: The main channel is visible to users. Transmission progress, data volume statistics, interruption / retransmission prompts, etc. are directly reflected in the user interface (such as upload progress bar, percentage display). For example, when a user uploads a video of intangible cultural heritage, the interface displays "Transmission in progress: 85%". If interrupted, "Transmission failed, please try again" will pop up. The guide channel is not visible to users. The control signal transmission runs entirely in the background and is not perceived by the user. The user can only see "Data verification successful" or "Transmission completed".

[0063] 2) Data packet structure and content: The main channel data packets are large in size and rich in content, containing original materials such as text, images, and audio of intangible cultural heritage projects. For example, a 1GB intangible cultural heritage craft video data packet contains video streams and metadata (shooting time, location, etc.); the guide channel data packets are small in size and simple in content, containing only control instructions (such as starting encoding, verification results). For example, a 128-byte data packet contains "Encoding sequence: 0xA3F2B1, stage: mid-way verification".

[0064] 3) Error handling and feedback mechanism: The main channel error types include data packet loss, content tampering, network interruption, etc. The feedback method is to directly prompt the user (such as "Upload failed: file is corrupted") or trigger automatic retransmission (corresponding to the retransmission mechanism in claim 9). For example, when the video data packet is corrupted, the system displays "File is incomplete, the third segment has been automatically retransmitted"; The guide channel error types include control signal tampering, opening encoding failure, closing gate failure verification, etc. The feedback method is to indirectly affect the transmission result. The user only sees "transmission interrupted" or "verification failed" and cannot perceive the specific control signal problem. For example, when the opening encoding is maliciously modified, the system directly interrupts the transmission and displays "Data verification failed, please re-upload" (corresponding to the verification failure interruption logic in claim 5).

[0065] 4) Logs and Monitoring Records: The main channel records include transmission time, data volume, progress percentage, and user operations (such as pause and cancel). Ordinary users can view historical transmission records through the interface. For example, the log shows "2025-08-07 14:30:00, Intangible Cultural Heritage Project A uploaded, data volume 1.2GB, status: completed". The guide channel records include control signal type, encoding sequence, closed door verification result, and security events (such as tampering attempts). Only system administrators or security auditors can view these records. For example, the log shows "2025-08-07 14:31:00, Guide Channel Event: Encoding 0xA3F2B1 verified, closed door 3 opened".

[0066] 5) Performance optimization goals: The main channel optimization direction is to improve transmission speed, reduce latency, and support concurrent transmission of large files. This can be achieved by using technologies such as TCP / IP protocol optimization, multi-threaded transmission, and CDN acceleration. The guide channel optimization direction is to enhance the security of control signals, reduce verification overhead, and prevent denial-of-service attacks (DoS). This can be achieved by using technologies such as encrypted transmission (e.g., TLS), dynamic encoding generation, and traffic rate limiting.

[0067] In summary, this application establishes a parallel dual-channel structure between the applicant and the blockchain nodes, separating the actual transmission of intangible cultural heritage data from its legality verification. This enables real-time secure monitoring of the data transmission process, ensuring the legality and integrity of the final data uploaded to the blockchain. Furthermore, the system establishes a linkage between the tracking package (carrier virtual machine) and the guiding point (verification virtual machine) through a linkage key. Any change to the data within the tracking package (such as loss or tampering) will trigger the invalidation of the corresponding opening code in the guiding point, causing it to fail to match the closing gate on the main channel. This promptly interrupts transmission and effectively prevents illegal data from entering the blockchain. Simultaneously, multiple storage spaces are set up within the tracking package to distribute the intangible cultural heritage data. The main channel is configured with multiple closing gates, and the guiding point with multiple opening codes. This not only improves efficiency through parallel transmission but also achieves fault isolation when data is partially tampered with, avoiding the risk of all data being corrupted under a single-point storage method, significantly enhancing the system's security and robustness.

[0068] Embodiments of this application also provide an electronic device including the data management system described in any of the above embodiments.

[0069] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0070] The image generation system provided in this application has been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A data security management system, characterized in that, include: Data sending node and blockchain node associated with said data sending node; The data sending node and the blockchain node are provided with a first transmission channel and a second transmission channel in parallel. The first transmission channel is equipped with at least one verification unit and a carrier virtual machine for storing transmitted data. The carrier virtual machine contains at least one storage space. The second transmission channel is equipped with a verification virtual machine for storing at least one verification piece of information corresponding to the at least one verification unit. A linkage key is provided between the carrier virtual machine and the verification virtual machine. The linkage key consists of multiple interconnected linkage frames. Each linkage frame is bound to a storage space within the carrier virtual machine and to a verification piece of information within the verification virtual machine, forming a mapping relationship between storage spaces and verification information. When the transmitted data content in any storage space within the carrier virtual machine changes, the mapping synchronously triggers a change in the corresponding verification information in the verification virtual machine, causing the original verification information to become invalid. When the data sending node sends the transmission data to the blockchain node through the carrier virtual machine, and the carrier virtual machine carries the transmission data through the first verification unit, the first verification unit obtains the first verification information corresponding to the first verification unit in the verification virtual machine, and performs security verification based on the first verification information, so as to perform data transmission operation according to the security verification result. The first verification unit is any one of the at least one verification unit.

2. The system according to claim 1, characterized in that, The carrier virtual machine is provided with at least one storage space, and the transmitted data is distributed and stored in the at least one storage space according to a preset rule. The at least one storage space is associated with at least one verification information in the verification virtual machine.

3. The system according to claim 1, characterized in that, The at least one verification information is stored sequentially in the verification virtual machine based on the order in which the at least one verification unit is set along the transmission direction on the first transmission channel.

4. The system according to claim 1, characterized in that, The at least one verification unit is set in the first transmission channel based on the transmission stage of the transmitted data.

5. The system according to claim 1, characterized in that, The data transmission operation based on the security verification result includes: If the security verification result indicates that the security verification is successful, the first verification unit is unlocked to allow the carrier virtual machine to carry the transmission data and transmit it along the first transmission channel; If the security verification result indicates that the security verification has failed, the first verification unit remains locked to prevent the carrier virtual machine from passing through the first verification unit.

6. The system according to claim 2, characterized in that, The carrier virtual machine has a built-in data statistics module, which is used to count the amount of data or the number of data packets transmitted in the at least one storage space and obtain statistical results.

7. The system according to claim 6, characterized in that, The data statistics module compares the statistical results obtained with a preset benchmark data volume to obtain the data comparison results. If the data comparison result indicates that the amount of transmitted data in the first storage space has changed, it is determined that the second verification information corresponding to the first storage space is invalid, and the first storage space is any one of the at least one storage space.

8. The system according to claim 2, characterized in that, The carrier virtual machine has a built-in hash verification module. The hash verification module is used to determine the real-time hash value of the data transmitted in the at least one storage space, and compare the real-time hash value with the original hash value of the transmitted data to obtain a hash comparison result. If the hash comparison result indicates that the first real-time hash value of the transmitted data in the first storage space is inconsistent with the first original hash value, it is determined that the transmitted data in the first storage space has been tampered with, and the second verification information corresponding to the first storage space is determined to be invalid.

9. The system according to claim 5, characterized in that, After maintaining the locked state of the first verification unit when the security verification result indicates a security verification failure, the following steps are included: The data sending node retrieves the original backup data of the transmitted data and reloads it into the carrier virtual machine. The carrier virtual machine then sends the original backup data to the blockchain node until the carrier virtual machine passes the first verification unit and reaches the blockchain node.

10. The system according to claim 1, characterized in that, If the blockchain node successfully receives the transmitted data, it stores the transmitted data in the target block on the blockchain corresponding to the blockchain node, and records the on-chain timestamp of the transmitted data and the hash value of the previous blockchain block corresponding to the transmitted data.

Images